Documentation forSecurity Event Manager

Monitor Windows domain controllers for brute force hacking attempts

You can monitor your Windows domain controllers using the SEM Agent. After you install and configure the agent, the software tracks brute force and other types of hacking attempts to your domain controllers and reports all events to the SEM Manager.

These events include:

  • Unauthorized access to your administrative accounts
  • Failed logon attempts
  • Account lockouts
  • User and group modification
  • Change management events

Install the SEM agent on all domain controllers to ensure the SEM Manager captures all your domain events (even if they are not replicated across all domain controllers).

You can view the events on the SEM Console using the change management filter and create custom filters to report all activity on your domain controllers.

Install and configure the SEM agent

When you install the SEM agent, you have the option to install USB Defender. This application works together with the SEM agent to provide real-time notification when a USB drive is installed in your domain controller server. By default, USB Defender generates events related to USB mass storage devices attached to your SEM agents.

For additional security, Microsoft implemented a method in their operating system to log security events. As a result, SEM agents on systems running Windows Server 2008 or Windows 7 require different connectors than the agents running on systems with the legacy Windows operating systems.

If you are running both old and legacy Windows operating systems in your environment, create a connector profile for each operating system.

For SEM agent software and hardware requirements, see the system requirements in the SEM Installation Guide.

Install a SEM agent on a single Windows domain controller

  1. Download the SolarWinds SEM Agent installer for Windows from the SolarWinds Customer Portal.

    See Install the SEM agent the SEM Installation and Upgrade Guide for instructions.

  2. Extract the ZIP file contents to a local or network directory.

  3. Run Setup.exe.

  4. To start the installation wizard, click Next.

  5. Accept the End User License Agreement if you agree, and then click Next.

  6. In the Manager Name field, enter the host name of your SEM Manager, and then click Next.

    Do not change the default port values.

  7. Confirm the Manager Communication settings, and then click Next.

  8. (Optional) To install USB Defender with the SEM agent, select the check box.

  9. Confirm the settings on the pre-Installation summary, and then click Install.

  10. When the installation is complete, click Next to start the SEM agent service.

  11. Inspect the agent log for any errors, and then click Next.

  12. To exit the installer, click Done.

    13. The SEM agent is installed on your system and begins sending events to your SEM Manager and SEM Console.

    The SEM agent continues running on your system until you uninstall the software or manually stop the SEM agent service.

Configure Windows domain controller connectors

Configure the following connectors that apply to your installation on your Windows domain controllers:

  1. On the SEM Console, navigate to Configure > Nodes.
  2. Under Refine Results, expand the Type group, and then select the Agent check box.
  3. Select an agent, and then click Manage node connectors.
  4. Find the connector to configure. Type part of the connector name in the search box, or use the filter menus in the Refine Results pane.
  1. Select an available connector, and then click Add Connector.
  2. Complete the connector configuration form. The following fields are common across most connectors:
    • Name: Enter a user-friendly label for your connectors.
    • Log File: Enter the location of the log file that the connector will normalize. This is a location on either the local computer (Agents), or the SEM appliance (non-Agent devices).
    • Output: Normalized, Raw + Normalized, Raw. You only need to configure these values if SEM is configured to save raw (unnormalized) log messages.
  3. Click Add.
  4. To start a connector, select a configured connector, and then click Start.

Maintain and monitor multiple domain controller Agents

Connector Profiles help you maintain and monitor multiple domain controllers in your SEM console. You can use these profiles to configure and modify connector settings at the profile level, as well as provide a group you can use to filter incoming event traffic from your SEM Agents to your SEM console.

Create a connector profile based on a single SolarWinds SEM Agent

Follow this procedure to create a connector profile based on a single SEM Agent and a corresponding filter to monitor activity on all systems in the profile.

  1. Install the SEM Agent software on all systems you want to include in your new connector profile.

    See the SEM Installation and Upgrade Guide for instructions on how to download and install the SEM Agent.

  2. Configure a single SEM Agent to serve as the template for your connector profile.

  3. On the SEM menu bar, navigate to Configure > Connector Profile.

  4. Click Create Connector Profile.

  5. Enter a profile name and description.

  6. From the Template list, select the new SEM Agent, and then click Save.

  7. In the Groups list, locate your new connector profile.

    Use the Refine Results pane if needed.

  8. Next to your connector profile, click , and then select Edit.

  9. In the Available Agents pane, locate the SolarWinds SEM Agents you want to add to your connector profile.

  10. Click the arrow next to each SEM Agent you want to add to the Contained Agents pane.

  11. When complete, click Save.

Create a filter for all activity in a Connector Profile

  1. Log in to the SEM Console.
  2. On the toolbar, click Live Events.
  3. To create a filter at a group level in the Filter Values pane, for example, the Overview group, move the mouse pointer over a group heading to expose the vertical ellipsis, and click Add New Filter.

    Or:

    To create a filter at the root level, click the add icon, and then select Add New Filter.

  4. Enter a descriptive name for your new filter in the Name field on the right.
  5. In the first column under Filter Values on the left, expand Event Groups, and select Any Alert.
  6. Drag DetectionIP from the second column on the left into the filter builder.

    When you drag a value into the filter builder, the correct drop location is illuminated with a blue line.

  7. In the same way, expand the Connector Profiles group, select your profile, and drag it into the filter value drop location.

  8. Click Save.

Create and enable a critical logon failures rule

Clone and enable critical account logon failures rule to track failed logon attempts to the default Windows Administrator account. The default action for this rule is to generate a HostIncident event, which you can use in conjunction with the Incidents report to notify auditors you are auditing the critical events on your network.

  1. Log in to the SEM Console.

  2. On the toolbar, click Rules.

  3. On the Rules toolbar, click Create rule from template.

  4. In the search box, enter:

    "critical account" failures

  5. Select the Critical Account Logon Failures rule template, and then click Next.
  6. Review and edit the existing conditions and values where needed, and then click Next.
  7. Review and adjust the rule details where needed, and then click Create.

    See Create a new rule for additional guidance.

Tune Windows Logging for SEM implementation

After you install and configure your SEM Agents, optimize your SEM deployment by tuning your Windows operating system to log the specific events you want to see in your SEM console and store in your SEM database. Set your group and local policies according to your environment requirements. See Configure Windows audit policy for use with SEM for more information.