3. Administration

This chapter covers the initial setup of your Management Center, agent installation, and routine tasks in the Web UI.

Contents

• 3.1. System Status
  • 3.1.1. Status Overview
  • 3.1.2. Diagnostics
  • 3.1.3. Logs
• 3.2. User Management
  • 3.2.1. User Defaults
    • 3.2.1.1. Password Policy
    • 3.2.1.2. Automatic Deactivation
  • 3.2.2. Roles
  • 3.2.3. Rights
  • 3.2.4. Restrictions
  • 3.2.5. LDAP Configuration
• 3.3. Single Sign-On
  • 3.3.1. Configuration
    • 3.3.1.1. Guided Mode
    • 3.3.1.2. Advanced Mode
    • 3.3.1.3. OpenID Connect
    • 3.3.1.4. SAML 2.0
  • 3.3.2. Role Mapping
  • 3.3.3. SSO Users
    • 3.3.3.1. API Keys for SSO Users
  • 3.3.4. Logout
• 3.4. Endpoint Agent Deployment
  • 3.4.1. Windows Agent Deployment
  • 3.4.2. Linux Agent Deployment
  • 3.4.3. macOS Agent Deployment
    • 3.4.3.1. macOS Full Disk Access
• 3.5. Uninstall Endpoint Agents
  • 3.5.1. Uninstall Endpoint Agents on Windows
  • 3.5.2. Uninstall Endpoint Agents on Linux
  • 3.5.3. Uninstall Endpoint Agents on macOS
• 3.6. Asset Management
  • 3.6.1. Asset Overview
  • 3.6.2. Asset Labels
    • 3.6.2.1. Export Asset List
    • 3.6.2.2. Import Labels
  • 3.6.3. Search Query
  • 3.6.4. Asset Migration
  • 3.6.5. Delete Assets
  • 3.6.6. Software Inventory
• 3.7. Scan Control
  • 3.7.1. Managing Scan Templates
  • 3.7.2. THOR Excludes and False-Positive Filters
  • 3.7.3. Live Event Streaming
• 3.8. Scan a Single System
  • 3.8.1. Create a Single Scan
  • 3.8.2. Stopping a Single Scan
  • 3.8.3. Download Scan Results
• 3.9. Scan a Group of Systems
  • 3.9.1. Create Group Scans
  • 3.9.2. List of all Group Scans
  • 3.9.3. Starting a Group Scan
  • 3.9.4. Details of a Group Scan
• 3.10. Scheduled Group Scan
• 3.11. Syslog Forwarding
• 3.12. Response Control
  • 3.12.1. Opening a Remote Console on an endpoint
  • 3.12.2. Response Control with Pre-Defined Playbooks
  • 3.12.3. Response Control for Groups of Systems
  • 3.12.4. Response Control with Custom Playbooks
  • 3.12.5. Change the Asset(s) Proxy
• 3.13. Aurora
  • 3.13.1. Aurora Overview
  • 3.13.2. Deploy Aurora on Asset
  • 3.13.3. Change Service for an Asset
  • 3.13.4. Create a Custom Aurora Configuration
  • 3.13.5. Process Excludes
  • 3.13.6. False Positive Filters
  • 3.13.7. Response Action Logs
  • 3.13.8. Best Practices for Managing Aurora
• 3.14. Sigma
  • 3.14.1. What is Sigma?
  • 3.14.2. Creating a Ruleset
  • 3.14.3. Choosing which Rules to Activate
  • 3.14.4. False Positive Tuning of Sigma Rules
  • 3.14.5. Adding Custom Rules
  • 3.14.6. Rule and Response Updates
  • 3.14.7. How to Activate Responses
• 3.15. IOC Management
  • 3.15.1. Integrating Custom IOCs
  • 3.15.2. Scan only with Custom IOCs
  • 3.15.3. Integrating IOCs through MISP
    • 3.15.3.1. MISP Attributes used by the Management Center
• 3.16. Evidence Collection
• 3.17. Thunderstorm
  • 3.17.1. Thunderstorm License
  • 3.17.2. Thunderstorm Logs
  • 3.17.3. Thunderstorm Configuration
• 3.18. Download Links
  • 3.18.1. Use Case 1 - Share the URL without Hostname
  • 3.18.2. Use Case 2 - Share the URL with Hostname
  • 3.18.3. Use Case 3 - Use the URL in Scripts
• 3.19. Licensing
  • 3.19.1. Thunderstorm
• 3.20. Updates
  • 3.20.1. Management Center Updates
  • 3.20.2. Version Pinning
  • 3.20.3. Agent Updates
• 3.21. Additional Settings
  • 3.21.1. Rsyslog Forwarding
  • 3.21.2. TLS Certificate Installation
  • 3.21.3. Manage Services
  • 3.21.4. NTP Configuration
  • 3.21.5. Link Analysis Cockpit
  • 3.21.6. Link Master Management Center
  • 3.21.7. Link MISP
  • 3.21.8. Change Proxy Settings
• 3.22. Advanced Settings
  • 3.22.1. Preview Signatures
• 3.23. User Settings
  • 3.23.1. Changing Your Password
  • 3.23.2. Two-Factor Authentication
    • 3.23.2.1. Enable Two-Factor Authentication
    • 3.23.2.2. Disable Two-Factor Authentication
  • 3.23.3. API Key