diff --git a/.claude/references/kb-editing-conventions.md b/.claude/references/kb-editing-conventions.md index 1050e7d22a..24b796e023 100644 --- a/.claude/references/kb-editing-conventions.md +++ b/.claude/references/kb-editing-conventions.md @@ -229,7 +229,7 @@ Determine the article type from its structure first — this is authoritative an - Contains `## Overview` or `## Instructions` (or both) → **How-To (Instructions)**. Same partial-match tolerance. - Contains `## Question` or `## Answer` (or both) → **How-To (Q&A)**. If only one is present, §15 flags the other as missing — don't fall through to a different classification. -**Known edge case (not worth reordering for):** checking Instructions before Q&A means a Q&A article that happens to carry an `## Overview` heading — with no Symptom/Cause/Resolution heading, which would otherwise claim it first under the Resolution-first rule above — classifies as How-To (Instructions) instead, and gets told to add `## Instructions`. This is the mirror risk of the Resolution-first ordering, but in the opposite direction. It hits zero files in the current corpus (checked: every `## Question`+`## Overview` file also has a Symptom/Cause/Resolution heading and classifies as Resolution instead, per the Resolution-first rule — including `docs/kb/accessanalyzer-2601/kb-article-template.md`, a multi-template reference file containing all three article-type templates concatenated, which is a Resolution match, not an instance of this edge case). Documented here so a future maintainer doesn't mistake it for a new bug when a file eventually does hit it. +**Known edge case (not worth reordering for):** checking Instructions before Q&A means a Q&A article that happens to carry an `## Overview` heading — with no Symptom/Cause/Resolution heading, which would otherwise claim it first under the Resolution-first rule above — classifies as How-To (Instructions) instead, and gets told to add `## Instructions`. This is the mirror risk of the Resolution-first ordering, but in the opposite direction. It hits zero files in the current corpus (checked: every `## Question`+`## Overview` file also has a Symptom/Cause/Resolution heading and classifies as Resolution instead, per the Resolution-first rule — including `docs/kb/accessanalyzer-26.1/kb-article-template.md`, a multi-template reference file containing all three article-type templates concatenated, which is a Resolution match, not an instance of this edge case). Documented here so a future maintainer doesn't mistake it for a new bug when a file eventually does hit it. If none of these section structures are present, fall back to the title: diff --git a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/_category_.json b/docs/accessanalyzer/26.1/agents/_category_.json similarity index 67% rename from docs/accessanalyzer/2601/gettingstarted/sharepoint-online/_category_.json rename to docs/accessanalyzer/26.1/agents/_category_.json index a8d05dd13b..56e5043fce 100644 --- a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/_category_.json +++ b/docs/accessanalyzer/26.1/agents/_category_.json @@ -1,5 +1,5 @@ { - "label": "SharePoint Online", + "label": "Agents", "position": 50, "collapsed": true, "collapsible": true diff --git a/docs/accessanalyzer/26.1/agents/agent-labels.md b/docs/accessanalyzer/26.1/agents/agent-labels.md new file mode 100644 index 0000000000..a58d6d7ba5 --- /dev/null +++ b/docs/accessanalyzer/26.1/agents/agent-labels.md @@ -0,0 +1,99 @@ +--- +title: Agent Labels and Scan Routing +description: How agent labels route each scan execution to an agent, and what happens when no agent carries the label. +sidebar_position: 2 +--- + +Labels are how you tell a scan where to run. Each deployed agent carries one or more `key=value` labels. A scan names a label, and its executions run on an agent that carries it. Leave the label out and the scan runs on the System agent. + +Agent labels are separate from the labels you put on sources. Source labels group sources and pick scan targets; agent labels pick the machine that does the scanning. They don't interact, and they follow different rules. [Labels](../sources/labels.md) describes source labels. + +## Agent Labels + +You add labels when you [deploy an agent](deploy-agent.md) and change them later with **Edit**. A deployed agent must have at least one label. The System agent has no labels you can edit, so its **Labels** column on the Agents page is empty. + +The **Labels** field's hint reads "Keys and values are lowercased; spaces become hyphens." Access Analyzer trims surrounding spaces, lowercases the key and the value, and turns each run of spaces inside them into a single hyphen. Enter `Data Center` as the key and `US East` as the value, and the stored label is `data-center=us-east`. + +After that clean-up, the key and the value must fit these rules. + +| Part | Must start with | Can contain | Maximum length | +|---|---|---|---| +| Key | A letter or number | Letters, numbers, and hyphens | 53 characters | +| Value | A letter or number | Letters, numbers, hyphens, underscores, and dots | 63 characters | + +Avoid two keys. Access Analyzer reserves `name`, and `default` marks the System agent internally. Common choices are `region`, `environment`, and `network`, but any keys that make sense for you are fine. + +Pick labels around how you'll route scans, not around how the hosts are built. `region=us-east` and `network=dmz` describe what a scan needs; `cpu=16` doesn't. The **Search agents…** field on the Agents page finds agents by label key, label value, or `key:value`, so a consistent scheme helps there too. + +## Agent Selection + +You select a scan's agent when you create it, in the **Agent** field on the **Schedule** step. The dropdown has two groups: **System**, holding the single option **System agent**, and **Agent labels**, listing every `key=value` your agents carry. Select one label. Any agent that carries it can run the scan. + +![Agent location options](/images/accessanalyzer/26.1/scans/create-scan-4-schedule-agent-menu.webp) + +A scan with several sources can send one of them elsewhere. On the **Configure** step: + +1. Expand the source type's section (for example **File Server**). +2. Click **Add source override**. +3. In **Source to override**, select the source. +4. In the override's **Agent** field, select a label. + +Click **Remove override** to undo it. The override applies to that source only; the scan's other sources keep the scan-level choice. + +When an execution starts, Access Analyzer picks the agent for each source in this order: + +```mermaid +flowchart TD + A[Execution starts for a source] --> B{Source has an agent override?} + B -- Yes --> C[Use the override label] + B -- No --> D{Scan has an agent label?} + D -- Yes --> E[Use the scan-level label] + D -- No --> F[Run on the System agent] + C --> G{An online agent carries the label?} + E --> G + G -- Yes --> H[Execution runs on that agent] + G -- No --> I[Execution waits] +``` + +Two details matter here. First, matching is exact: the agent must carry both the key and the value of the label you picked. An agent labeled `region=us-west` doesn't qualify for `region=us-east`, and an agent with only `env=production` doesn't either. Second, an agent that shows **Offline** on the Agents page can't run scans, so a match on labels alone isn't enough; the agent must be online. + +Access Analyzer decides routing each time an execution starts, not when you save the scan. Relabeling an agent, or changing a scan's **Agent** field, takes effect from the next execution. + +The **Agent** column on the Scans page shows where each scan runs: **System** for scans with no label, otherwise the label. + +## Executions With No Matching Agent {#when-no-agent-matches} + +The **Agent** dropdown only offers labels that agents carry, but nothing checks again later. If you delete or relabel the only agent with a scan's label, the scan keeps that label and its schedule fires as normal. Access Analyzer creates the execution, but no scanning happens and the execution doesn't fail immediately. It waits for an agent that carries the label to come online: a new agent you deploy, an offline agent that comes back, or an existing agent you relabel. If no matching agent comes online within about two hours, Access Analyzer marks the execution **Failed**, and the scan's next scheduled execution tries again. + +The same wait happens when the only matching agent goes offline. + +If an execution shows **Running** but makes no progress: + +1. Go to **Configuration > Agents**. +2. Check for a **Healthy** agent whose **Labels** include the scan's label. +3. If there isn't one, deploy an agent with that label, bring the offline agent back online, or edit the scan and select a label that an online agent carries. + +Editing the scan fixes its next execution only; the execution that's already waiting still needs a matching agent to come online. The Home page's **Needs attention** panel lists offline agents with a **Check agents** link, the quickest way to spot an agent that has gone offline. [Scan executions](../scans/scan-executions.md) lists every execution and its status. + +## Example + +Suppose you run the Access Analyzer server in your main data center and have two more agents deployed. + +| Agent | Labels | +|---|---| +| **Default Agent** (the System agent) | none | +| `agent-east` | `env=production`, `region=us-east` | +| `agent-west` | `env=production`, `region=us-west` | + +You configure four scans. + +| Scan | Agent field | Override | Where it runs | +|---|---|---|---| +| HR shares | **System agent** | none | On the server, because you set no label | +| East finance shares | `region=us-east` | none | On `agent-east`, the only agent with that label | +| All production shares | `env=production` | none | On either `agent-east` or `agent-west`, since both carry the label | +| Regional archives | `region=us-east` | `fs-west-01` set to `region=us-west` | On `agent-east` for every source except `fs-west-01`, which runs on `agent-west` | + +If `agent-west` goes offline, "All production shares" keeps running on `agent-east`, while the `fs-west-01` override in "Regional archives" waits for `agent-west` to report **Healthy** again, or fails after about two hours. + +Later you delete `agent-east` to rebuild it. "East finance shares" and the `region=us-east` sources of "Regional archives" keep their label, so their next executions wait, while "All production shares" continues on `agent-west`. The waiting executions start as soon as you deploy the rebuilt agent with `region=us-east` again; if that takes longer than about two hours, Access Analyzer marks them **Failed** and the next scheduled executions try again. diff --git a/docs/accessanalyzer/26.1/agents/deploy-agent.md b/docs/accessanalyzer/26.1/agents/deploy-agent.md new file mode 100644 index 0000000000..1a753d4b3b --- /dev/null +++ b/docs/accessanalyzer/26.1/agents/deploy-agent.md @@ -0,0 +1,136 @@ +--- +title: Deploy an Agent +description: Prepare a Linux host and an SSH service account, deploy the agent from the Agents page, and edit or remove it later. +sidebar_position: 1 +--- + +Access Analyzer installs agents for you. You point it at a Linux host it can reach over SSH, and the server runs a set of checks, installs the agent software, and joins the host to the installation. You don't install anything on the host by hand. + +You need the Admin role for everything on this page. Viewers can see the Agents page but can't deploy, edit, or remove agents. + +## Prepare the Host + +The host needs a Linux operating system with `bash`, `curl`, and `sudo` installed, an SSH user the server can sign in as, and enough headroom to run scans. Access Analyzer checks every requirement in this table before it installs anything, both when you click **Test connection** and again at the start of a real deployment. + +| Requirement | Minimum | +|---|---| +| CPU | 2 cores | +| Memory | 512 MB available | +| Disk | 5 GB free on `/` | +| SSH user | Can run `sudo` without a password | +| Tools | `bash`, `curl`, and `sudo` on the path | +| Internet | Can reach `https://get.k3s.io` | + +The host also needs these network paths; every port is Transmission Control Protocol (TCP). [Requirements](../install/requirements.md) lists the server side of the first two rows. + +| Direction | Port | Purpose | +|---|---|---| +| Server to host | TCP 22, or the port you enter in **SSH port** | SSH session that installs and configures the agent | +| Host to server | TCP 6443 | The agent's connection to the Access Analyzer server | +| Host to `get.k3s.io` | TCP 443 | Agent software installer | +| Host to `raw.githubusercontent.com` | TCP 443 | Installer checksum | +| Host to `oci.pkg.keygen.sh` | TCP 443 | Licensed software distribution for scan components | + +A deployed agent runs scan work and nothing else. Access Analyzer places nothing else on it. + +## SSH Service Account + +Access Analyzer signs in to the host with a service account of type **SSH username/key**. The account holds two values: **SSH username**, the Linux user to sign in as, and **SSH key**, that user's private key pasted in PEM or OpenSSH format. The key must not have a passphrase; deployment rejects a passphrase-protected key. The user must be able to run `sudo` without a password prompt. + +You can create the account ahead of time under **Configuration > Service accounts**, or from inside the Deploy agent panel with the **Add new service account** button next to the **Service account** field. The inline **Add service account** form fixes the type to **SSH username/key**; click **Add account** to save it. Either way the result is the same account, and you can reuse it for every agent that uses the same user and key. The field-level detail is in [SSH username and key](../service-accounts/ssh-key.md). + +The host key isn't part of the service account. Each agent has its own, entered when you deploy it. + +## Get the Host Key + +Access Analyzer checks the host's SSH identity against the key you enter and refuses to continue if the host presents a different one. Collect the public host key from a machine that can reach the host, such as the Access Analyzer server: + +```bash +ssh-keyscan -t ecdsa +``` + +If SSH listens on a port other than 22, add `-p `. The output line begins with the hostname; copy the key type and the key that follow it, for example `ecdsa-sha2-nistp256 AAAA…`. That is the value the **SSH host key** field expects: a key type, a space, and the key. If you can, compare it with the key on the host itself before you trust it. + +## Deploy the Agent + +1. Go to **Configuration > Agents**. +2. Click **Deploy agent**. + + ![Deploy agent panel with Name, SSH host, SSH host key, SSH port, Service account, and Labels](/images/accessanalyzer/26.1/agents/deploy-agent.webp) + +3. In **Name**, enter a name for the agent. +4. In **SSH host**, enter the hostname or IP address of the host. +5. In **SSH host key**, paste the host key you collected. +6. In **SSH port**, enter the SSH port if it isn't 22. +7. In **Service account**, select the SSH account. To create one now, click **Add new service account**. +8. Under **Labels**, add at least one label, such as `env=production` or `region=us-east`. Labels are how scans find this agent; see [Agent labels and scan routing](agent-labels.md). +9. To check the host before installing anything, click **Test connection** and wait for **Connection successful**. +10. Click **Deploy**. + +When deployment finishes, the panel closes, a notification reads `Agent "" deployed`, and the agent appears in the list with its **Health Status** and **Last Heartbeat**. + +### Fields + +| Field | What to enter | Rules | +|---|---|---| +| **Name** | A display name, for example `Production Agent` | Required; up to 255 characters | +| **SSH host** | Hostname or IP address, for example `node01.company.com` or `192.168.1.50` | Required; up to 255 characters; must be a valid hostname or IP address | +| **SSH host key** | The host's public key as ` ` | Required; must match the key the host presents | +| **SSH port** | The SSH port | Optional; 1 to 65535; defaults to 22 | +| **Service account** | An account of type SSH username/key | Required; the list shows only SSH accounts; **Edit credentials** opens the selected account | +| **Labels** | One or more `key=value` pairs | At least one required; keys and values are lowercased and spaces become hyphens | + +If you close the panel with unsaved changes, Access Analyzer asks you to confirm. + +### Test Connection + +In the Deploy agent panel, **Test connection** becomes available after you fill in **SSH host**, **SSH host key**, and **Service account**. It signs in to the host and runs the checks from [Prepare the host](#prepare-the-host), installing nothing. The button reads **Testing...** while it runs. + +A green **Connection successful** alert means every check passed. It can carry warnings underneath. A red alert reports what failed, for example a missing `curl`, a `sudo` that prompts for a password, or too little free disk. The result clears if you change any of the connection fields. + +### Deployment Sequence + +1. The server signs in over SSH and runs the same checks as **Test connection**. +2. It configures the host to download scan components from the software distribution service, authenticated with your license key, and writes the key to a root-only file on the host. +3. It installs the agent software on the host at the same version the server runs. +4. The host connects to the server on port 6443 and joins the installation. +5. The server applies the name and labels you entered to the agent. + +Allow about five minutes. Installation typically takes three to four minutes, and the server allows five minutes for the whole deployment, from signing in over SSH to the agent checking in. If it hasn't checked in by then, deployment still finishes. The Agents list refreshes every 60 seconds, so the agent can still appear a little later. + +If deployment fails, the panel shows the reason. Causes include an SSH user without passwordless `sudo`, a host that can't reach the server on port 6443, and a pasted host key that doesn't match the host. + +## Edit an Agent + +1. Go to **Configuration > Agents**. +2. In the agent's **Actions** menu, click **Edit**. + + ![Agent row menu with Edit](/images/accessanalyzer/26.1/agents/row-actions.webp) + +3. Change the **Name** or the **Labels**. A deployed agent must keep at least one label. + + ![Edit agent panel with Name and Labels](/images/accessanalyzer/26.1/agents/edit-agent.webp) + +4. Click **Save changes**. + +The SSH fields don't appear when you edit. Access Analyzer uses SSH only to deploy the agent; after that, the agent talks to the server over its own connection and no longer needs the host key or service account. + +**Test connection** works differently here: instead of checking the host over SSH, it sends a short test task through the agent and confirms it runs. It's a quick way to prove a deployed agent can accept work. Success shows **Connection successful**; a failure shows the server's message. + +You can't rename or relabel the System agent, listed as **Default Agent**; opening **Edit** on it shows **Name** and **Labels** locked. + +## Remove an Agent + +1. Go to **Configuration > Agents**. +2. In the agent's **Actions** menu, click **Delete**. +3. Click **Delete Agent** to confirm. + +A notification reads `Agent "" deleted`, and the agent leaves the list. + +Removal takes the agent out of Access Analyzer. The server doesn't connect to the host again, and the agent software stays installed there until you remove it yourself. + +You can't remove an agent while a scan is running on it; the attempt fails with **Failed to delete agent**. Wait for the execution to finish, or stop it from [Scan executions](../scans/scan-executions.md), then try again. + +Scans whose agent label pointed at the removed agent keep that label. Their next execution waits until another agent with matching labels is available, as described in [Agent labels and scan routing](agent-labels.md#when-no-agent-matches). Edit those scans, or deploy a replacement agent with the same labels, before their next scheduled run. + +The System agent has no **Delete** action. diff --git a/docs/accessanalyzer/26.1/agents/index.md b/docs/accessanalyzer/26.1/agents/index.md new file mode 100644 index 0000000000..5621f4072c --- /dev/null +++ b/docs/accessanalyzer/26.1/agents/index.md @@ -0,0 +1,66 @@ +--- +title: Agents +description: Agents are the Linux machines that run scans; the System agent is built into every installation, and you can deploy more where the network or the workload calls for it. +--- + +An agent is a Linux machine that runs scans. Every installation has one from the moment setup finishes: the System agent, which runs on the Access Analyzer server itself. Unless you route a scan, or one of its sources, to other agents with a label, every scan runs there. + +You can deploy more agents on other Linux hosts. Access Analyzer connects to the host over SSH, installs the agent software, and adds the agent to the list. From then on you steer scans to it with labels. [Deploy an agent](deploy-agent.md) covers the host requirements and the procedure; [Agent labels and scan routing](agent-labels.md) explains how a scan chooses where to run. + +## The System Agent + +The System agent always exists. You can't delete or rename it, and you can't give it labels, so its **Labels** column is empty. It shares the server with the rest of Access Analyzer, so heavy scans compete with the server's own services. + +The same agent goes by three names in the interface, depending on where it appears: + +| Where | What you see | +|---|---| +| The Agents page | **Default Agent** | +| The **Agent** field in the Create scan steps | **System agent** | +| The **Agent** column on the Scans page | **System** | + +## When to Deploy More Agents + +The System agent is enough for many installations. Add an agent when: + +- The server can't reach a source. An agent placed inside a segmented network or behind a firewall scans the sources there, so the scan traffic comes from the agent rather than the server. +- You want scan traffic to stay local. An agent in the same site or region as the data keeps large reads off slow or expensive links. +- Scans compete with the server. A dedicated agent takes only scan work, so long-running scans no longer slow the server. + +## Who Can Manage Agents + +Deploying, editing, and deleting agents requires the Admin role. Viewers can open the Agents page and see every agent but can't change anything. Assign roles on the [Users and roles](../settings/users.md) page. + +## The Agents Page + +Go to **Configuration > Agents**. + +![Agents list with Name, Health Status, Last Heartbeat, and Labels columns](/images/accessanalyzer/26.1/agents/list.webp) + +| Column | Meaning | +|---|---| +| **Name / IP** | The agent's name, with its hostname or IP address underneath | +| **Labels** | The `key=value` labels used for scan routing | +| **Health Status** | Whether the agent is reporting normally; see [Health status](#health-status) | +| **Last Heartbeat** | When the agent last reported in to the server; a dash means the agent hasn't reported yet | +| **Last Updated** | When the agent's record last changed | +| **Actions** | **Edit** for every agent; **Delete** for deployed agents only | + +The list sorts by **Last Updated**, newest first, and you can sort by **Name** and **Health Status** as well. It shows 25 agents per page (you can pick 10, 25, or 50) and refreshes every 60 seconds on its own, pausing while the **Deploy agent** or **Edit agent** panel is open. + +The **Search agents…** field matches an agent's name, a label key, a label value, or a `key:value` pair, so `region:us-east` finds every agent carrying that label. **Clear filters** resets the search. **Deploy agent** starts the deployment flow. + +### Health Status + +| Status | Meaning | What to do | +|---|---|---| +| **Healthy** | The agent is connected and reporting to the server | Nothing; scans routed to it run normally | +| **Offline** | The server has stopped hearing from the agent | Check the host and its connection to the server | + +The heartbeat is the agent's regular check-in with the server. **Last Heartbeat** shows the time of the most recent one, so a stale value alongside **Offline** tells you roughly when the agent went offline. Scan executions routed to an offline agent wait for it to come back, and fail if it stays offline for about two hours; see [When no agent matches](agent-labels.md#when-no-agent-matches). + +Offline agents also surface on the Home page. The **Needs attention** panel counts them ("1 agent is offline.") and its **Check agents** link opens the Agents page. + +### Actions + +**Edit** lets you change the agent's name and labels; on the System agent both are locked. **Delete** appears only for deployed agents. See [Edit an agent](deploy-agent.md#edit-an-agent) and [Remove an agent](deploy-agent.md#remove-an-agent). diff --git a/docs/accessanalyzer/2601/dashboards-reports/_category_.json b/docs/accessanalyzer/26.1/dashboards-reports/_category_.json similarity index 82% rename from docs/accessanalyzer/2601/dashboards-reports/_category_.json rename to docs/accessanalyzer/26.1/dashboards-reports/_category_.json index 91e8e50995..a95ac2483f 100644 --- a/docs/accessanalyzer/2601/dashboards-reports/_category_.json +++ b/docs/accessanalyzer/26.1/dashboards-reports/_category_.json @@ -1,6 +1,6 @@ { "label": "Dashboards and Reports", - "position": 50, + "position": 80, "collapsed": true, "collapsible": true } diff --git a/docs/accessanalyzer/26.1/dashboards-reports/dashboards/_category_.json b/docs/accessanalyzer/26.1/dashboards-reports/dashboards/_category_.json new file mode 100644 index 0000000000..2dd6d32b73 --- /dev/null +++ b/docs/accessanalyzer/26.1/dashboards-reports/dashboards/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "Dashboards", + "position": 1, + "collapsed": true, + "collapsible": true, + "link": { + "type": "generated-index", + "description": "The two summary dashboards: Data security for file servers and SharePoint Online, and Active Directory for domains, users, groups, and risks.", + "slug": "/dashboards-reports/dashboards" + } +} diff --git a/docs/accessanalyzer/26.1/dashboards-reports/dashboards/active-directory.md b/docs/accessanalyzer/26.1/dashboards-reports/dashboards/active-directory.md new file mode 100644 index 0000000000..7905c379b3 --- /dev/null +++ b/docs/accessanalyzer/26.1/dashboards-reports/dashboards/active-directory.md @@ -0,0 +1,88 @@ +--- +title: Active Directory Dashboard +description: A single-page summary of your Active Directory domains with user, group, and membership counts, privileged accounts, and every detected risk by type, level, and object. +sidebar_position: 2 +--- + +The Active Directory dashboard summarizes what an Identity sync collected from your domains. The top row counts domains, users, and groups. Below it, a **Users** section and a **Groups** section pair headline numbers with a breakdown of the risks found in each, and an **All Risks** section at the bottom lists every detected risk with its level and the object it concerns. + +Open it from **Dashboards > Active Directory**. Users with the Admin or Viewer role can see it. [Dashboards and reports](../index.md) explains the **Refresh** button, how to drill into a chart, and how fresh the numbers are. + +![Active Directory dashboard with Domains, Users, Groups, and risk tiles](/images/accessanalyzer/26.1/dashboards-reports/active-directory-dashboard.webp) + +## Where the Data Comes From + +Every card reads from an Identity sync on an Active Directory source. The dashboard needs no Access scan or Sensitive data scan, and no card depends on Netwrix Activity Monitor. Until the first Identity sync completes, the tiles show zero and the charts show **No results!**. [Scan types](../../scans/scan-types.md) explains how to run one; [Active Directory](../../sources/active-directory.md) explains the source itself. + +## Filter + +The dashboard has one filter and no tabs. + +| Filter | What it does | +|---|---| +| **Domain** | Restricts every card to one domain, chosen from the synced domains | + +Leave **Domain** empty to see all domains together. Because every card responds to it, the filter is the quickest way to look at one domain at a time. + +## Summary Row + +| Card | What it shows | How to read it | +|---|---|---| +| **Domains** | The number of distinct domains synced | Each synced domain counts once | +| **Users** | The number of user objects | Includes disabled accounts | +| **Enabled Users** | The number of users whose account status is Enabled | The difference between this and **Users** is the number of disabled accounts | +| **Groups** | The number of groups | Security groups and distribution lists together | +| **Direct Memberships** | The number of direct group membership entries | Direct means the count doesn't expand nested membership; the **Administrator Accounts** card does | + +## Users Section + +| Card | What it shows | How to read it | +|---|---|---| +| **Administrator Accounts** | The number of effective memberships in the built-in privileged groups in the following list | Effective means the count follows nested membership, so an account inside a group inside Domain Admins counts | +| **User Risks** | A pie chart of user-category risks by risk type | Shows which kind of user risk dominates; [Risk types](#risk-types) explains each type | +| **New Users** | Users created in the past seven days | A quick check on recent provisioning | +| **Users with Associated Risks** | The number of risk entries in the User category | Drill into it, or scroll to **Active Directory Risks**, to see which accounts are involved | + +
+Groups counted by **Administrator Accounts** + +Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Backup Operators, Server Operators, Print Operators, Group Policy Creator Owners, Domain Controllers, Read-only Domain Controllers, DnsAdmins, Cert Publishers, Remote Desktop Users, Distributed COM Users, Cryptographic Operators, Pre-Windows 2000 Compatible Access, Replicator, Network Configuration Operators, Performance Monitor Users, Performance Log Users, Windows Authorization Access Group, Terminal Server License Servers, and Incoming Forest Trust Builders. + +
+ +## Groups Section + +| Card | What it shows | How to read it | +|---|---|---| +| **Security Groups** | The number of groups whose type is Security | Compare with **DLs** to see how the **Groups** total splits | +| **Group Risks** | A pie chart of group-category risks by risk type | Shows which kind of group risk dominates | +| **DLs** | The number of distribution lists, meaning groups whose type isn't Security | Together with **Security Groups**, this accounts for every group in **Groups** | +| **Groups with Associated Risks** | The number of risk entries in the Group category | Drill into it, or scroll to **Active Directory Risks**, for the group names | + +## All Risks Section + +| Card | What it shows | How to read it | +|---|---|---| +| **Risks by Level** | A pie chart of all risks by level: LOW, MEDIUM, or HIGH | Start remediation with the HIGH slice | +| **Riskiest Objects** | A table of risk counts grouped by domain and object name, highest first | The users and groups with the most detected risks | +| **Active Directory Risks** | The full list: one row per detected risk, with the risk type, the object and its domain, when Access Analyzer detected it, additional context, the level, the category, and a description | Use the **Domain** filter to keep this list manageable, then drill into a row | + +## Risk Types + +Each row in **Active Directory Risks** carries one of the following risk types. The level and description are what you see in the table. + +| Risk type | Level | Category | Description | +|---|---|---|---| +| Empty Groups | LOW | Group | Groups with no members | +| Single Member Groups | LOW | Group | Groups with exactly one member | +| Large Groups | MEDIUM | Group | Groups exceeding the defined membership threshold | +| Duplicate Groups | LOW | Group | Groups that contain identical effective membership sets | +| Circular Nesting | MEDIUM | Group | Groups that include themselves through recursive membership loops | +| Stale Users | MEDIUM | User | Users who have not logged on within the defined inactivity threshold | +| Very Stale Users | MEDIUM | User | Users who have not logged on within the defined inactivity threshold | +| Isolated Users | LOW | User | Enabled users not present in any group membership record | +| Old Password | HIGH | User | Users whose password age exceeds defined threshold, indicating stale credentials | +| DC Logon Rights | HIGH | User | Users who are direct or indirect members of privileged administrative groups granting Domain Controller logon rights | +| Users Without Logon Record | LOW | User | Users who have never logged on | + +For account-level detail behind any of these, such as password age, last logon, and account status per user, open the **AD Users** report on the [Identity reports](../reports/identity.md#ad-users) page. diff --git a/docs/accessanalyzer/26.1/dashboards-reports/dashboards/data-security.md b/docs/accessanalyzer/26.1/dashboards-reports/dashboards/data-security.md new file mode 100644 index 0000000000..0ec07b923d --- /dev/null +++ b/docs/accessanalyzer/26.1/dashboards-reports/dashboards/data-security.md @@ -0,0 +1,67 @@ +--- +title: Data Security Dashboard +description: Scan coverage, sensitive data findings, and permissions across your File Server and SharePoint Online sources, plus an Activity tab of events from Netwrix Activity Monitor. +sidebar_position: 1 +--- + +The Data security dashboard is the first place to look after a scan. It pulls every File Server and SharePoint Online source into one view: the number of repositories and objects scanned, the sensitive data findings, and the permissions collected, with a table at the bottom that lists each share and site. A second tab shows access events from Netwrix Activity Monitor. + +Open it from **Dashboards > Data security**. Users with the Admin or Viewer role can see it. [Dashboards and reports](../index.md) explains the **Refresh** button, how to drill into a chart, and how fresh the numbers are. + +![Data security dashboard, Scan Overview tab, full page](/images/accessanalyzer/26.1/dashboards-reports/data-security-dashboard-full.webp) + +## Data Prerequisites + +An Access scan on your File Server and SharePoint Online sources fills the **Scan Overview** tab. Until a Sensitive data scan has run on those sources as well, **Sensitive Data Findings** shows 0, **Sensitive Data by Source** stays empty, and the **Sensitive Files** and **Sensitive Findings** columns of **Data Source Inventory** have nothing to report. The **Activity** tab holds no scan data at all: it shows events from Netwrix Activity Monitor and stays empty until that connection is in place. [Scan types](../../scans/scan-types.md) covers the scans; [Netwrix Activity Monitor](../../integrations/netwrix-activity-monitor.md) covers the feed. + +## Tabs and Filters + +The dashboard has two tabs, **Scan Overview** and **Activity**. Each tab has its own filters, shown above its cards, and every filter applies as soon as you change it. + +| Filter | Tab | What it does | +|---|---|---| +| **Data Source** | Scan Overview | Limits every card except **SharePoint Sites by Type** to **File Servers**, **SharePoint Online**, or both | +| **Start Date** | Activity | Earliest event time to include | +| **End Date** | Activity | Latest event time to include | +| **Event Type** | Activity | One or more event types, drawn from the events Access Analyzer has received | +| **Activity Source** | Activity | **File Servers**, **SharePoint Online**, or **Microsoft Copilot** | +| **User** | Activity | One or more users who performed events | +| **Event Status** | Activity | **Success** or **Failed** | + +All filters are optional and start empty, which means no restriction. + +## Scan Overview Tab + +The table lists the cards in the order they appear, top to bottom and left to right. + +| Card | What it shows | How to read it | +|---|---|---| +| **Total Data Repositories** | The number of file shares plus SharePoint Online site collections your scans have covered | The breadth of coverage; if you expect 40 shares and see 12, you haven't scanned some sources yet | +| **Total Objects Scanned** | The number of objects collected from file servers and SharePoint Online | Rises with each newly scanned source | +| **Sensitive Data Findings** | The total number of pattern matches across both source types | Zero until a Sensitive data scan has run; a single file can contribute several matches | +| **Permissions Analyzed** | The number of permission entries collected | A rough measure of how much data the permission reports draw on | +| **Objects by Data Source** | A bar chart comparing object counts for File Servers and SharePoint Online | Shows where the bulk of your data sits | +| **Sensitive Data by Source** | A pie chart splitting the findings between File Servers and SharePoint Online | Shows which platform carries more sensitive content | +| **File Server Objects by Host** | A bar chart of object counts per file server | Picks out the largest servers; each bar is one host | +| **SharePoint Sites by Type** | A pie chart of SharePoint Online sites by site type | The **Data Source** filter doesn't affect it | +| **Data Source Inventory** | One row per share or SharePoint Online site, with columns **Source Type**, **Location**, **Total Objects**, **Files**, **Folders**, **Sensitive Files**, and **Sensitive Findings** | Sorts by total objects, largest first; shows up to 20,000 rows; shares appear as `\\host\share` paths | + +## Activity Tab + +![Data security dashboard, Activity tab, with date, event type, source, user, and status filters](/images/accessanalyzer/26.1/dashboards-reports/data-security-dashboard-activity.webp) + +Every card on this tab responds to the six Activity filters. **Start Date** and **End Date** bound the time range; the other four narrow the events further. + +| Card | What it shows | How to read it | +|---|---|---| +| **Total Events** | The number of events in the selected range | Your baseline for the period | +| **Failed Events** | The number of events with status **Failed** | A spike is worth investigating: check which users and resources the failures cluster on | +| **Active Users** | The number of distinct users with at least one event | Compare with **Total Events** to see whether activity is spread out or concentrated | +| **Data Sources with Activity** | How many of the three activity sources reported events | Shows whether every feed you expect is reporting events | +| **Events by Type** | A bar chart of event counts per event type | One bar per event type; pick a single type in **Event Type** to isolate it across the other cards | +| **Activity Over Time** | A line chart of event counts over the range | Look for bursts outside working hours | +| **Events by Data Source** | A pie chart of events per activity source | Shows which platform generates most of the traffic | +| **Top Users by Activity** | A horizontal bar chart of users ranked by event count | The busiest accounts, which are worth checking against their roles | +| **Activity Detail** | The most recent 500 events, with columns **Time**, **Source**, **Event Type**, **User**, **Resource**, **Location**, and **Status** | Narrow the filters until fewer than 500 events match, so the table shows all of them | + +For a closer look at file server activity, open the **Activity Investigation** report from [Data reports](../reports/data.md). It filters by user, path, and event type. **Group By** sets the timeline's unit, day by default. diff --git a/docs/accessanalyzer/26.1/dashboards-reports/index.md b/docs/accessanalyzer/26.1/dashboards-reports/index.md new file mode 100644 index 0000000000..d34fd186a1 --- /dev/null +++ b/docs/accessanalyzer/26.1/dashboards-reports/index.md @@ -0,0 +1,56 @@ +--- +title: Dashboards and Reports +description: Dashboards summarize what your scans have found, reports answer one question in depth, and both open in the same viewer with filters, drill-down, and a Refresh button. +--- + +Everything a scan collects ends up in one of two places. Dashboards give you the wide view: a page of counts, charts, and a detail table for a whole area of your environment. Reports answer one question at a time, with filters tuned to that question. Both open in the same viewer and behave the same way once they're on screen. + +## Dashboards and Reports Compared + +There are two dashboards, listed under **Dashboards** in the sidebar: + +- [Data security dashboard](dashboards/data-security.md) covers File Server and SharePoint Online sources: what your scans have covered, where they found sensitive data, how many permissions they analyzed, and, on its **Activity** tab, which users did what. +- [Active Directory dashboard](dashboards/active-directory.md) covers your domains: users, groups, memberships, privileged accounts, and a catalog of detected risks. + +Reports live under **Reports**, on three pages. **Data** lists 11 reports on file servers and SharePoint Online, **Identity** lists three on Active Directory and Entra ID users and groups, and **Compliance** shows eight of the Data reports again, grouped by regulatory framework. Two of the Data entries, both named Share Audit, open the same report. Each report has a description under its name in the list, and all but the two Entra ID reports have filters of their own once open. + +Use a dashboard when you want totals and trends for a whole area. Use a report when you want the reason behind a number, or the specific folders, links, or accounts involved. [Data reports](reports/data.md), [Identity reports](reports/identity.md), and [Compliance reports](reports/compliance.md) describe every report and its cards. + +## Role Access + +Users with the Admin or Viewer role see the **Dashboards** section and can open any report. Users with the User admin role don't see **Dashboards**, and although they can open the **Reports** pages, report content doesn't load for their account. [Users and roles](../settings/users.md) explains the three roles. + +## The Viewer + +A dashboard or report page has breadcrumbs, a heading, a **Refresh** button at the top right, and the content itself below. Reports also show the report's description under the heading and a **Back to Data reports** or **Back to Identity reports** link that returns you to the list you came from, with the tab and category you had selected. + +Filters sit at the top of the content, inside the dashboard or report rather than in the page header. They apply the moment you change them; there's no Apply button. Where a filter accepts more than one value, you can pick several. Filters go back to their defaults when you click **Refresh** or reload the page. Some content also has tabs of its own: the Data security dashboard has **Scan Overview** and **Activity**, and the Share Audit report has four. + +Drill-down works on any tile, chart segment, bar, or table cell. Click one, and a menu offers ways to break the value down or see the records behind it. Choosing an option opens a detail view with a back button on the left, a title, and controls on the right for filtering, changing the chart type, adjusting settings, opening the query editor, and resetting your changes. You can explore freely but can't save what you build. The back button returns you to the dashboard, which reloads with its filters reset. + +If the content fails to load, the page shows **Dashboard error** and **Unable to load** followed by the dashboard or report name, sometimes with an **Error details** box. Click **Reload dashboard** to reload the page. + +## Data Freshness + +Nothing on these pages updates on its own, and Access Analyzer caches dashboard results, so a scan that finished a moment ago may not appear on a dashboard yet. After a scan completes, click **Refresh** to reload the page's data. If a dashboard's figures haven't changed after a refresh, the cached results may not have expired yet; wait and refresh again later. + +## What Each Dashboard and Report Needs + +Every dashboard and report appears in the interface from the first sign-in, even when there's no data behind it. Until the right scan has run, tiles show zero or **No results!**, and charts and tables show **No results!**. The table shows which scan, or which event feed, populates each dashboard and group of reports. [Scan types](../scans/scan-types.md) explains the Access scan, Sensitive data scan, and Identity sync; [Sources](../sources/index.md) explains which source types each applies to. + +| To populate | You need | +|---|---| +| Data security dashboard, **Scan Overview** tab | An Access scan on your File Server or SharePoint Online sources, plus a Sensitive data scan for the sensitive data tiles and charts | +| Data security dashboard, **Activity** tab | Netwrix Activity Monitor sending events to Access Analyzer | +| Active Directory dashboard | An Identity sync on an Active Directory source | +| File system permission reports: Broken Inheritance, High Risk ACLs, Open Access, Share Audit | An Access scan on a File Server source, plus a Sensitive data scan for the Open Access cards that show sensitive files and exposed patterns | +| File system sensitive data reports: Sensitive Data Overview, the Share Audit **Sensitive Data** tab | A Sensitive data scan on a File Server source | +| File system activity: Activity Investigation, the Share Audit **Activity** tab | Netwrix Activity Monitor sending events to Access Analyzer | +| SharePoint permission and sharing reports: Shared Links, High-Risk ACLs, Open Access | An Access scan on a SharePoint Online source, plus a Sensitive data scan for the cards that count links or files with sensitive data | +| SharePoint Sensitive Data Overview | A Sensitive data scan on a SharePoint Online source | +| AD Users | An Identity sync on an Active Directory source | +| Entra Users, Entra Groups | An Identity sync on an Entra ID source | + +For the file system permission reports, an Identity sync on the matching Active Directory source turns identifiers into names and expands group membership. The Share Audit **Overview** tab also draws on two other feeds: its Matches card needs a Sensitive data scan, and its Probable Owner card needs Netwrix Activity Monitor events. On the Share Audit **Sensitive Data** tab, the Users by Activity on Sensitive Files card also needs Netwrix Activity Monitor events. + +Activity data doesn't come from a scan. It arrives from Netwrix Activity Monitor, which watches file servers, SharePoint Online, and Microsoft 365 Copilot and streams events to Access Analyzer. [Netwrix Activity Monitor](../integrations/netwrix-activity-monitor.md) covers the connection. diff --git a/docs/accessanalyzer/26.1/dashboards-reports/reports/_category_.json b/docs/accessanalyzer/26.1/dashboards-reports/reports/_category_.json new file mode 100644 index 0000000000..4bcc9daf93 --- /dev/null +++ b/docs/accessanalyzer/26.1/dashboards-reports/reports/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "Reports", + "position": 2, + "collapsed": true, + "collapsible": true, + "link": { + "type": "generated-index", + "description": "The Data, Identity, and Compliance report pages, with the filters and cards of every report.", + "slug": "/dashboards-reports/reports" + } +} diff --git a/docs/accessanalyzer/26.1/dashboards-reports/reports/compliance.md b/docs/accessanalyzer/26.1/dashboards-reports/reports/compliance.md new file mode 100644 index 0000000000..a16c0ef99d --- /dev/null +++ b/docs/accessanalyzer/26.1/dashboards-reports/reports/compliance.md @@ -0,0 +1,59 @@ +--- +title: Compliance Reports +description: How the Compliance page arranges eight of the Data reports under GDPR, HIPAA, PCI DSS, SOX, ISO 27001, NIST CSF, and SOC 2, and what the Primary and Supporting badges mean. +sidebar_position: 3 +--- + +The **Compliance** page is a second way into the Data reports, arranged for someone preparing evidence for an audit rather than investigating an incident. It organizes reports that already exist: it doesn't run checks against a framework, score your environment, or produce findings of its own. What it gives you is a shortlist of the reports worth opening for a given framework, labeled by the control area each one covers. + +Open the page from **Reports > Compliance**. [Data reports](data.md) describes every report the page links to, with its filters and cards. + +![Compliance reports list, All tab](/images/accessanalyzer/26.1/dashboards-reports/reports-compliance.webp) + +## The Compliance Page + +The layout matches the other two report pages: a table with **Report** and **Category** columns, tabs above it, and chips under the tabs. Here the tabs are regulatory frameworks and the chips are control areas. + +The first tab, **All**, lists eight reports. One tab per framework follows, in this order: + +| Tab | Framework | +|---|---| +| **GDPR** | General Data Protection Regulation | +| **HIPAA** | Health Insurance Portability and Accountability Act | +| **PCI DSS** | Payment Card Industry Data Security Standard | +| **SOX** | Sarbanes-Oxley Act | +| **ISO 27001** | ISO/IEC 27001 information security management standard | +| **NIST CSF** | National Institute of Standards and Technology Cybersecurity Framework | +| **SOC 2** | System and Organization Controls 2 | + +Every framework tab lists the same eight reports, so each tab shows a count of eight. The frameworks carry no description text of their own; the tab label is all there is. What changes when you pick a framework is the badge next to each report name; see [Primary and Supporting badges](#primary-and-supporting-badges). + +The chips group the eight reports by control area. The counts are the same on every tab. + +| Chip | Reports | +|---|---| +| **Permissions** (3) | [Broken Inheritance](data.md#broken-inheritance), [High Risk ACLs](data.md#high-risk-acls), [Open Access](data.md#open-access) | +| **File share structure** (1) | [Share Audit](data.md#share-audit) | +| **Activity** (1) | [Activity Investigation](data.md#activity-investigation) | +| **Sensitive data** (2) | [Sensitive Data Overview](data.md#sensitive-data-overview), [Share Audit](data.md#share-audit-sensitive-data-entry) (the second Share Audit row on the Data page) | +| **External collaboration** (1) | [Shared Links](data.md#shared-links) | + +Both Share Audit rows from the Data page appear here, under different control areas. They open the same report. Switching tabs clears the selected chip, as on the other report pages. + +## Primary and Supporting Badges + +On the **All** tab, report names carry no badge. Select a framework and each name gains a small **Primary** or **Supporting** label. **Primary** means the report is direct evidence for that framework's controls; **Supporting** means it's useful context rather than the main exhibit. + +![Compliance reports list filtered to GDPR](/images/accessanalyzer/26.1/dashboards-reports/reports-compliance-gdpr.webp) + +Only two report-framework pairings carry the **Supporting** badge: the Share Audit row under **File share structure** on the **GDPR** tab and Shared Links under **SOX**. The second Share Audit row, under **Sensitive data**, is **Primary** on every tab, as is every other pairing. The badges are fixed, so they read the same in every deployment; they don't reflect anything about your data. + +## Included and Excluded Reports + +The eight reports on this page are the seven file server reports from the Data page plus Shared Links, the SharePoint sharing-links report. The page leaves out the Data page's other three SharePoint reports (High-Risk ACLs, Open Access, and Sensitive Data Overview, the SharePoint counterparts of three listed file server reports) and the [Identity reports](identity.md). To use those for compliance work, open them from their own pages. + +## Open a Report + +Click a row to open the report exactly as the Data page does, with the same filters and cards. The link at the top of the report reads **Back to Data reports** and takes you to the Data reports page, not back to Compliance. To return to the framework tab you were on, use your browser's Back button or open **Reports > Compliance** again. + +Because the reports are the same ones, the prerequisites are too: an Access scan on your File Server sources for the permission and file share structure reports, a Sensitive data scan for the sensitive data reports, an Access scan on your SharePoint Online sources for Shared Links, and events from Netwrix Activity Monitor for Activity Investigation. [Dashboards and reports](../index.md) has the full table. diff --git a/docs/accessanalyzer/26.1/dashboards-reports/reports/data.md b/docs/accessanalyzer/26.1/dashboards-reports/reports/data.md new file mode 100644 index 0000000000..5fb4c6f30c --- /dev/null +++ b/docs/accessanalyzer/26.1/dashboards-reports/reports/data.md @@ -0,0 +1,343 @@ +--- +title: Data Reports +description: The reports on the Data page, covering permissions, sensitive data, and access activity on File Server and SharePoint Online sources, with the filters and cards of each one. +sidebar_position: 1 +--- + +The **Data** page collects every report about the content of your file servers and SharePoint Online sites: who can reach it, where the sensitive files are, and who has been opening them. Seven reports cover file servers and four cover SharePoint Online. Two of the file server rows, both named Share Audit, open the same report, so the 11 rows lead to 10 distinct reports. + +Open the page from **Reports > Data**. [Dashboards and reports](../index.md) covers what's common to every report: the **Refresh** button, how filters apply, drilling into a chart, and how fresh the data is. + +![Data reports list, All tab](/images/accessanalyzer/26.1/dashboards-reports/reports-data.webp) + +## The Data Page + +The page is a table with two columns: **Report** and **Category**. Each row shows the report name with its description underneath, and a category chip on the right. Click anywhere on a row to open the report. + +Above the table, tabs narrow the list by platform and chips narrow it by category. Each tab and chip shows how many reports it contains. + +| Tab | Reports | Category chips | +|---|---|---| +| **All** | 11 | **Permissions** (7), **Activity** (1), **Classification / Stale Data** (3) | +| **File system** | 7 | **Permissions** (4), **Activity** (1), **Classification / Stale Data** (2) | +| **SharePoint** | 4 | **Permissions** (3), **Classification / Stale Data** (1) | + +The first chip in the row, **All**, repeats the tab's total. + +Switching tabs clears the chip you had selected. Clicking a selected chip again clears it. The page has no search box or sort control. + +The rows appear in this order: + +| Report | Tab | Category | +|---|---|---| +| [Broken Inheritance](#broken-inheritance) | File system | Permissions | +| [High Risk ACLs](#high-risk-acls) | File system | Permissions | +| [Open Access](#open-access) | File system | Permissions | +| [Share Audit](#share-audit) | File system | Permissions | +| [Activity Investigation](#activity-investigation) | File system | Activity | +| [Sensitive Data Overview](#sensitive-data-overview) | File system | Classification / Stale Data | +| [Share Audit](#share-audit-sensitive-data-entry), second entry | File system | Classification / Stale Data | +| [Shared Links](#shared-links) | SharePoint | Permissions | +| [High-Risk ACLs](#high-risk-acls-sharepoint) | SharePoint | Permissions | +| [Open Access](#open-access-sharepoint) | SharePoint | Permissions | +| [Sensitive Data Overview](#sensitive-data-overview-sharepoint) | SharePoint | Classification / Stale Data | + +Two names, Open Access and Sensitive Data Overview, appear on both the file system and SharePoint sides, and High Risk ACLs has a SharePoint twin spelled High-Risk ACLs. The **File system** and **SharePoint** tabs keep them apart, and the description under each name tells you which is which. + +## Inside a Report + +Every report opens the same way: breadcrumbs **Reports > Data** followed by the report name, a **Back to Data reports** link, the name as the page heading with the description under it, and **Refresh** at the top right. The report's own filters sit at the top of the content and take effect as soon as you change them. Only [Share Audit](#share-audit) and [Activity Investigation](#activity-investigation) have required filters; everywhere else, an empty filter means no restriction. + +**Back to Data reports** returns you to the list with the tab and chip you had selected. + +## File System Reports + +These seven reports read from your File Server sources. The permission reports need a completed Access scan on the source. The sensitive data reports need a Sensitive data scan. The activity report and the activity cards in Share Audit need events from Netwrix Activity Monitor. Where a report shows account or group names rather than identifiers, or expands group membership, it relies on an Identity sync of the Active Directory domain those accounts belong to. [Scan types](../../scans/scan-types.md) explains each scan. + +### Broken Inheritance + +"Folders where permission inheritance has been broken and explicit ACEs applied." + +An access control entry (ACE) is one line in a folder's permission list. Folders normally inherit their permissions from the folder above; when someone breaks that inheritance and adds explicit entries, the folder becomes an exception that's easy to overlook. This report finds those folders and shows where they cluster. It needs a completed Access scan on the File Server source. + +![Broken Inheritance report](/images/accessanalyzer/26.1/dashboards-reports/report-broken-inheritance.webp) + +The report shows **Host** and **Share** filters above its cards. + +| Card | What it shows | +|---|---| +| **Top Hosts** | Hosts ranked by the number of folders with broken inheritance | +| **Top Shares** | Shares ranked the same way | +| **Shares with Broken Inheritance** | A pie chart splitting the folders between shares | +| **File System Broken Inheritance Summary** | One row per share, with columns **Folders**, **Folders with Broken Inheritance**, **Percent**, **Explicit Ace Count**, **Explicit Trustee Count**, and **Explicit Deny Count** | + +Needs an Access scan on the File Server source. + +### High Risk ACLs + +"Shares and folders with overly permissive ACLs that expose sensitive data." + +A high-risk entry grants access to an open trustee: a group such as Everyone, Authenticated Users, or Domain Users that effectively means every account in the organization. This report lists the shares and folders where such entries appear. + +![High Risk ACLs report](/images/accessanalyzer/26.1/dashboards-reports/report-high-risk-acls.webp) + +| Filter | What it does | +|---|---| +| **Host** | Limits the report to the selected hosts | +| **Share** | Limits the report to the selected shares | + +| Card | What it shows | +|---|---| +| **Hosts** | The number of hosts with at least one high-risk folder | +| **Shares** | The number of shares with at least one high-risk folder | +| **Folders** | The number of folders with a high-risk entry | +| **Shares by High Risk Folders** | Shares ranked by how many high-risk folders they contain | +| **High Risk Permissions** | A pie chart of the entries by trustee and permission | +| **High Risk ACLs** | The detail list, one row per high-risk entry | + +Needs an Access scan on the File Server source. An Identity sync on the matching Active Directory source lets the report recognize group names. + +### Open Access + +"Shares accessible by Everyone or Domain Users without restrictions." + +Where High Risk ACLs looks at individual permission entries, Open Access resolves effective membership: a folder counts as open when Everyone or Domain Users can reach it directly or through a nested group. It also joins in sensitive data findings, so you can see which open folders hold files that matter. + +![Open Access report](/images/accessanalyzer/26.1/dashboards-reports/report-open-access.webp) + +| Filter | What it does | +|---|---| +| **Host** | Limits the report to the selected hosts | +| **Share** | Limits the report to the selected shares | +| **Pattern** | Limits the report to the selected sensitive data patterns | + +| Card | What it shows | +|---|---| +| **Hosts** | The number of hosts with open folders | +| **Shares** | The number of shares with open folders | +| **Folders** | The number of open folders | +| **Files with Sensitive Data** | The number of files in open folders that matched a sensitive data pattern | +| **Hosts by Open Folders** | A bar chart of open folders per host | +| **Shares by Open Folders** | Shares ranked by open folder count | +| **Exposed Sensitive Data** | A pie chart of the patterns matched in open folders | +| **Folders with Open Access** | The detail list, one row per open folder | + +Needs an Access scan on the File Server source, plus a Sensitive data scan for the two sensitive data cards. The effective membership resolution uses the Identity sync of the Active Directory domain the trustees belong to; without it, the report doesn't detect access granted through nested groups. + +### Share Audit + +"Detailed breakdown of effective permissions on each network share." + +Share Audit is the one report that looks at a single share at a time and covers it from every angle: what's in it, who can reach it, what sensitive data it holds, and who has been using it. The report splits its content across four tabs. + +![Share Audit report](/images/accessanalyzer/26.1/dashboards-reports/report-share-audit.webp) + +| Filter | What it does | +|---|---| +| **Share** | Required. Choose the share to audit from the list of scanned shares, shown as `\\host\share` paths. The filter starts at the placeholder `\\Host\Share`, and every card is empty until you pick a real share | +| **Date** | The time range for the **Activity** tab; defaults to the past seven days | +| **Group By** | The unit of time for the **Event Counts** chart on the **Activity** tab | + +**Date** and **Group By** apply only to the **Activity** cards. **Share** applies to everything. + +| Tab | Card | What it shows | +|---|---|---| +| **Overview** | **Last Scanned** | When a scan last covered the share | +| **Overview** | **Folders** | The number of folders in the share | +| **Overview** | **Files** | The number of files in the share | +| **Overview** | **File Size** | The total size of those files | +| **Overview** | **Matches** | The number of sensitive data matches found within the share | +| **Overview** | **Last Accessed** | The most recent last-accessed time of any file in the share | +| **Overview** | **Scan Status** | A pie chart of objects by their status from the last scan | +| **Overview** | **Probable Owner** | The account whose activity suggests it owns the share; needs Netwrix Activity Monitor events | +| **Permissions** | **Share Permissions** | The share-level permission list, with trustees resolved to user and group names | +| **Permissions** | **Expanded Permissions** | Effective folder permissions, with group membership expanded | +| **Permissions** | **Broken Inheritance** | Folders in this share with broken inheritance | +| **Sensitive Data** | **Files with Sensitive Data** | The number of files with at least one match | +| **Sensitive Data** | **Patterns Found** | The number of distinct patterns matched | +| **Sensitive Data** | **Pattern Groups Found** | The number of distinct pattern groups matched | +| **Sensitive Data** | **Matches by # of Files** | A pie chart of patterns by how many files matched each | +| **Sensitive Data** | **Users by Activity on Sensitive Files** | A bar chart of users ranked by events on files with sensitive data; needs Netwrix Activity Monitor | +| **Sensitive Data** | **Files with Sensitive Data by Last Accessed** | A bar chart bucketing sensitive files by their last-accessed time | +| **Sensitive Data** | **Sensitive Data Files** | The detail list of files with matches | +| **Activity** | **Active Users** | Users ranked by event count in the selected range | +| **Activity** | **Event Counts** | A bar chart of events over time, grouped by the **Group By** unit | +| **Activity** | **File System Activity** | The event-level list for the share | + +Needs an Access scan on the File Server source for the **Overview** and **Permissions** tabs, a Sensitive data scan for the **Sensitive Data** tab, and Netwrix Activity Monitor events for the **Activity** tab and the **Probable Owner** card. Trustee names on the **Permissions** tab come from the Identity sync of the matching Active Directory source. + +### Activity Investigation + +"Detailed audit trail of file and folder access events for forensic investigation." + +This is the report to open when you need to know what happened to a particular path, or what a particular account did, over a specific window. It reads the file server events that Netwrix Activity Monitor sends to Access Analyzer; no scan produces this data. + +![Activity Investigation report](/images/accessanalyzer/26.1/dashboards-reports/report-activity-investigation.webp) + +| Filter | What it does | +|---|---| +| **Date** | Required. The time range to investigate; defaults to the past seven days | +| **Group By** | Required. The unit of time for the **Activity Timeline**; defaults to day | +| **User** | The accounts that performed the events | +| **Path** | The paths the events touched | +| **Event Type** | The types of event to include | +| **Successful** | Whether to show successful events, failed events, or both | + +| Card | What it shows | +|---|---| +| **Activity Timeline** | A line chart of events over the range, at the **Group By** granularity | +| **Event Type** | A pie chart of events by type | +| **Successful** | A pie chart of successful against failed events | +| **Protocol** | A pie chart of events by the protocol used | +| **Top Users** | Accounts ranked by event count | +| **Top Hosts** | Hosts ranked by event count | +| **Top Shares** | Shares ranked by event count | +| **File System Activity** | The event-level list, one row per event | + +Needs Netwrix Activity Monitor sending file server events to Access Analyzer. [Netwrix Activity Monitor](../../integrations/netwrix-activity-monitor.md) explains the connection. + +### Sensitive Data Overview + +"Summary of sensitive data findings across all scanned file system locations." + +The file server counterpart of the sensitive data tiles on the Data security dashboard, with filters that let you narrow the findings to a host, a share, a pattern group, or a single pattern. [Sensitive data patterns](../../sensitive-data-patterns/index.md) explains what patterns and pattern groups are. + +![Sensitive Data Overview report](/images/accessanalyzer/26.1/dashboards-reports/report-sensitive-data-overview.webp) + +| Filter | What it does | +|---|---| +| **Host** | Limits the report to the selected hosts | +| **Share** | Limits the report to the selected shares | +| **Pattern Group** | Limits the report to matches from the selected pattern groups | +| **Pattern** | Limits the report to matches of the selected patterns | + +| Card | What it shows | +|---|---| +| **Hosts with Sensitive Data** | The number of hosts with at least one match | +| **Shares with Sensitive Data** | The number of shares with at least one match | +| **Files with Sensitive Data** | The number of files with at least one match | +| **Distinct Patterns Found** | How many different patterns matched | +| **Files by Pattern** | A pie chart of files per pattern | +| **Top Shares by Sensitive File Count** | A bar chart of shares ranked by sensitive file count | +| **Sensitive Data File Details** | The detail list, one row per file | + +Needs a Sensitive data scan on the File Server source. + +### Share Audit (Sensitive Data Entry) + +"Permission breakdown filtered to shares that contain sensitive data." + +This second Share Audit row sits under the **Classification / Stale Data** category so that it's findable when you're working through sensitive data rather than permissions. It opens the same report described in [Share Audit](#share-audit), with the same filters and tabs; the **Share** filter lists every scanned share, not only those with sensitive data. Pick the share you're interested in and go to the **Sensitive Data** tab. + +![Share Audit report](/images/accessanalyzer/26.1/dashboards-reports/report-share-audit-sensitive.webp) + +## SharePoint Reports + +These four reports read from your SharePoint Online sources. Three need an Access scan; the fourth needs a Sensitive data scan. All four share the **Site** and **Site Type** filters, which limit a report to the selected sites or to sites of the selected types. + +### Shared Links + +"Anonymous and company-wide sharing links that expose SharePoint content externally." + +An anonymous link works for anyone who has it; an organization link works for anyone in your tenant. This report counts both kinds, ranks sites by how many they carry, and flags the links that point at files with sensitive data. + +![Shared Links report](/images/accessanalyzer/26.1/dashboards-reports/report-shared-links.webp) + +| Filter | What it does | +|---|---| +| **Active Status** | Limits the report by whether a link is still active | +| **Pattern** | Limits the report to the selected sensitive data patterns | +| **Sharing Scope** | Limits the report to anonymous or organization-wide links | +| **Site** | Limits the report to the selected sites | +| **Site Type** | Limits the report to sites of the selected types | + +| Card | What it shows | +|---|---| +| **Shared Resources** | The number of resources with at least one sharing link | +| **Anonymous Links** | The number of links that work for anyone | +| **Organization Links** | The number of links that work for anyone in the organization | +| **Links with Sensitive Data** | The number of links pointing at files with a sensitive data match | +| **Top Sites by Shared Links** | Sites ranked by link count | +| **Open Access Links with Sensitive Data** | A pie chart of sensitive data in anonymous or organization-scoped links | +| **Shared Links Detail** | The detail list, one row per link | + +Needs an Access scan on the SharePoint Online source; the sensitive data cards also need a Sensitive data scan. + +### High-Risk ACLs (SharePoint) + +"SharePoint sites and libraries with overly permissive access control entries." + +The SharePoint equivalent of the file server High Risk ACLs report. It finds sites and libraries where a broad principal holds a permission, and grades each finding by severity. **Critical** means the principal is anonymous, or an anonymous sharing link, or an Everyone-like principal with write, delete, manage, or admin access. **High** means an Everyone-like principal with read-only access, Authenticated Users with write or delete access, or organization-wide sharing. + +![High-Risk ACLs report](/images/accessanalyzer/26.1/dashboards-reports/report-sharepoint-high-risk-acls.webp) + +| Filter | What it does | +|---|---| +| **Access Level** | Limits the report to findings at the selected access levels, such as read or write | +| **Risk Category** | Limits the report to the selected categories of finding | +| **Risk Severity** | **Critical**, **High**, or both | +| **Site** | Limits the report to the selected sites | +| **Site Type** | Limits the report to sites of the selected types | + +| Card | What it shows | +|---|---| +| **Number of High Risk ACLs** | The total number of findings | +| **Critical Findings** | The number of findings graded Critical | +| **High Findings** | The number of findings graded High | +| **Sites Affected** | The number of sites with at least one finding | +| **Findings by Risk Category** | A bar chart of findings per category | +| **Findings by Site Type** | A pie chart of findings per site type | +| **Findings by Access Level** | A bar chart of findings per access level | +| **Findings by Risk Severity** | A bar chart of Critical against High | +| **High-Risk ACL Details** | The detail list, one row per finding | + +Needs an Access scan on the SharePoint Online source. + +### Open Access (SharePoint) + +"SharePoint content accessible by all authenticated users without restrictions." + +Open here means reachable by every signed-in user in the tenant. The report counts the sites and resources in that state and, where a Sensitive data scan has run, the exposed files that contain sensitive data. + +![Open Access report](/images/accessanalyzer/26.1/dashboards-reports/report-sharepoint-open-access.webp) + +| Filter | What it does | +|---|---| +| **Site** | Limits the report to the selected sites | +| **Site Type** | Limits the report to sites of the selected types | + +| Card | What it shows | +|---|---| +| **Sites with open resources** | The number of sites with at least one open resource | +| **Open Resources** | The number of open resources | +| **Exposed files with Sensitive Data** | The number of open files with a sensitive data match | +| **Top sites by number of open resources** | Sites ranked by open resource count | +| **Top sites by exposed sensitive data (file count)** | Sites ranked by exposed sensitive file count | +| **Open resource details** | The detail list, one row per open resource | + +Needs an Access scan on the SharePoint Online source, plus a Sensitive data scan for the sensitive data cards. + +### Sensitive Data Overview (SharePoint) + +"Summary of sensitive data classifications found across SharePoint sites." + +The SharePoint counterpart of the file server Sensitive Data Overview: which sites hold sensitive data, how much, and of what kind. + +![Sensitive Data Overview report](/images/accessanalyzer/26.1/dashboards-reports/report-sharepoint-sensitive-data-overview.webp) + +| Filter | What it does | +|---|---| +| **Pattern** | Limits the report to matches of the selected sensitive data patterns | +| **Site** | Limits the report to the selected sites | +| **Site Type** | Limits the report to sites of the selected types | + +| Card | What it shows | +|---|---| +| **Sites with Sensitive Data** | The number of sites with at least one match | +| **Files with Sensitive Data** | The number of files with at least one match | +| **Types of Sensitive Data** | How many different patterns matched | +| **Top Sites by Files with Sensitive Data** | Sites ranked by sensitive file count | +| **Sensitive Data Types by File Count** | A pie chart of patterns by how many files matched each | +| **Sensitive Data Summary by Site** | One row per site with its counts | + +Needs a Sensitive data scan on the SharePoint Online source. diff --git a/docs/accessanalyzer/26.1/dashboards-reports/reports/identity.md b/docs/accessanalyzer/26.1/dashboards-reports/reports/identity.md new file mode 100644 index 0000000000..3e1ca44027 --- /dev/null +++ b/docs/accessanalyzer/26.1/dashboards-reports/reports/identity.md @@ -0,0 +1,77 @@ +--- +title: Identity Reports +description: The AD Users, Entra Users, and Entra Groups reports on the Identity page, with the filters and columns of AD Users. +sidebar_position: 2 +--- + +The **Identity** page holds the reports about accounts rather than content: one for Active Directory (AD) users; one for Entra ID users, with multi-factor authentication (MFA) status, licenses, and sign-in activity; and one for Entra ID groups, with their membership, types, and licenses. Each is a single table, one row per account or group. Only AD Users has filters at the top; you can drill into all three like any other report table. + +Open the page from **Reports > Identity**. [Dashboards and reports](../index.md) covers what's common to every report: the **Refresh** button, how filters apply, drilling into a table, and how fresh the data is. + +![Identity reports list, All tab](/images/accessanalyzer/26.1/dashboards-reports/reports-identity.webp) + +## The Identity Page + +The page is a table with **Report** and **Category** columns, and the description sits under each report name, as on the [Data reports](data.md) page. Tabs split the list by directory and chips split it by category; each shows a count. + +| Tab | Reports | Category chips | +|---|---|---| +| **All** | 3 | **Users** (2), **Groups** (1) | +| **Active Directory** | 1 | **Users** (1) | +| **Entra ID** | 2 | **Users** (1), **Groups** (1) | + +Switching tabs clears the selected chip. Click a row to open the report; **Back to Identity reports** at the top of the report returns you to the list with your tab and chip intact. + +| Report | Tab | Category | +|---|---|---| +| [AD Users](#ad-users) | Active Directory | Users | +| [Entra Users](#entra-users) | Entra ID | Users | +| [Entra Groups](#entra-groups) | Entra ID | Groups | + +An Identity sync populates all three: one on an Active Directory source for AD Users, one on an Entra ID source for the other two. [Scan types](../../scans/scan-types.md) explains the Identity sync; [Active Directory](../../sources/active-directory.md) and [Entra ID](../../sources/entra-id.md) explain the sources. + +## AD Users + +One row per user account in your synced domains, with columns covering identity, contact details, password state, logon history, and delegation. The filters at the top narrow the rows. + +![AD Users report](/images/accessanalyzer/26.1/dashboards-reports/report-ad-users.webp) + +Every filter is optional, and all but **Distinguished Name** let you pick several values. + +| Filter | Values | +|---|---| +| **Password Age** | **0–30 days**, **31–90 days**, **91–180 days**, **181–365 days**, **Over 365 days**, **Never set** | +| **Last Modified** | **Last 7 days**, **Last 30 days**, **Last 90 days**, **Last year**, **More than 1 year ago** | +| **Created** | **Last 7 days**, **Last 30 days**, **Last 90 days**, **Last year**, **More than 1 year ago** | +| **Days Since Last Logon** | **0–30 days**, **31–90 days**, **91–180 days**, **181–365 days**, **Over 365 days**, **Never logged on** | +| **Domain** | The synced domains | +| **SAM Account Name** | The account names found in the sync | +| **Distinguished Name** | Free text; matches any account whose distinguished name contains it, ignoring case | +| **Department** | The department values found in the sync | + +**SAM Account Name** is the Security Account Manager (SAM) name: the short logon name, without the domain. **Distinguished Name** is the quickest way to scope to an organizational unit: type part of its distinguished name, such as `OU=Finance`, and every account whose distinguished name contains that text matches. + +The columns, in order: + +
+AD Users columns + +**SAM Account Name**, **Display Name**, **First Name**, **Last Name**, **User Principal Name**, **Distinguished Name**, **Canonical Name**, **Common Name**, **Domain**, **Domain Canonical Name**, **Account Status** (Enabled or Disabled), **Created**, **Last Modified**, **Description**, **Admin Count**, **Email**, **Phone**, **Mobile**, **Office**, **Street Address**, **City**, **State**, **Postal Code**, **Country**, **Job Title**, **Department**, **Company**, **Manager**, **Employee ID**, **Password Last Set**, **Password Age (Days)**, **Password Never Expires**, **Account Expires** (Never when the account has no expiry), **Smartcard Required**, **MFA Enforced**, **Last Logon**, **Last Logon Timestamp**, **Days Since Last Logon**, **Bad Password Count**, **Last Bad Password**, **Lockout Time**, **Last Logoff**, **Logon Workstations**, **Allowed to Delegate To**, **Allowed to Act on Behalf Of**, **Service Principal Names**, and **Legacy Exchange DN**. + +
+ +Two columns hold the numbers behind the filters: **Password Age (Days)** behind the **Password Age** buckets, and **Days Since Last Logon** behind the filter of the same name. **Account Status** separates enabled accounts from disabled ones. + +For a risk-oriented view of the same accounts (stale users, old passwords, and privileged group membership), open the [Active Directory dashboard](../dashboards/active-directory.md). + +## Entra Users + +One row per user account in your Entra ID tenant, including its MFA status, the licenses assigned to it, and its sign-in activity. The report has no filters; drill into the table to narrow it. + +![Entra Users report](/images/accessanalyzer/26.1/dashboards-reports/report-entra-users.webp) + +## Entra Groups + +One row per group in your Entra ID tenant, with its type, membership, and any licenses assigned through it. Like Entra Users, it has no filters. + +![Entra Groups report](/images/accessanalyzer/26.1/dashboards-reports/report-entra-groups.webp) diff --git a/docs/accessanalyzer/2601/connectors/file-servers/_category_.json b/docs/accessanalyzer/26.1/guides/_category_.json similarity index 70% rename from docs/accessanalyzer/2601/connectors/file-servers/_category_.json rename to docs/accessanalyzer/26.1/guides/_category_.json index 5923518b84..4c8ec4e038 100644 --- a/docs/accessanalyzer/2601/connectors/file-servers/_category_.json +++ b/docs/accessanalyzer/26.1/guides/_category_.json @@ -1,5 +1,5 @@ { - "label": "File Servers", + "label": "Guides", "position": 20, "collapsed": true, "collapsible": true diff --git a/docs/accessanalyzer/26.1/guides/active-directory.md b/docs/accessanalyzer/26.1/guides/active-directory.md new file mode 100644 index 0000000000..a275821dc8 --- /dev/null +++ b/docs/accessanalyzer/26.1/guides/active-directory.md @@ -0,0 +1,108 @@ +--- +title: Scan Active Directory +description: Add a domain as an Active Directory source, run an Identity sync, and use the results in the Active Directory dashboard and in file server permission reports. +sidebar_position: 2 +--- + +Add one Active Directory domain as a source and run an Identity sync, which reads the domain's users, groups, organizational units, and memberships. The results feed the Active Directory dashboard and the AD Users report, and they let file server permission reports show account and group names instead of security identifiers (SIDs). + +One source covers one domain. If you have several domains, repeat the guide for each. + +## Before You Start + +### Account + +The Identity sync only reads. A regular domain user with the default read access to the domain is enough. + +### Network + +The Access Analyzer server, or the agent that runs the scan, needs one Lightweight Directory Access Protocol (LDAP) port open to a domain controller. The port you choose decides how Access Analyzer secures the connection. + +| Port | Protocol | Notes | +|------|----------|-------| +| 389 | LDAP with DIGEST-MD5 authentication and StartTLS | Enter the domain controller's fully qualified domain name (FQDN) in **Host**; DIGEST-MD5 authentication requires an FQDN and doesn't work with an IP address. Works with domain controllers that require LDAP signing. | +| 636 | LDAP over TLS (LDAPS) | The server or agent that runs the scan must trust the domain controller's certificate unless you turn on **Ignore SSL errors**. | + +When a connection uses TLS, it uses TLS 1.2. On port 389, Access Analyzer first tries DIGEST-MD5 with encryption over StartTLS; if that attempt fails, it retries with DIGEST-MD5 signing without TLS, and then with a simple bind. Access Analyzer doesn't use Kerberos or the Global Catalog ports (3268 and 3269). + +:::note + +Adding a domain as a source has nothing to do with how people sign in to Access Analyzer. Sign-in with Active Directory credentials is a separate setup task; see [Single sign-on](../settings/single-sign-on.md). + +::: + +## 1. Create the Service Account + +Active Directory sources use a **Username/password** service account. + +1. Go to **Configuration > Service accounts** and click **Add service account**. +2. In **Name**, enter a unique name, for example `svc-ad-sync`. +3. Leave **Service account type** set to **Username/password**. +4. In **Username**, enter the account's user name only, for example `svc-ad-sync`, without a `DOMAIN\` prefix or `@domain` suffix. Access Analyzer supplies the domain from the source's **Domain** field. +5. In **Password**, enter the password. +6. Click **Add account**. + +![Add service account drawer with the Username/password type selected](/images/accessanalyzer/26.1/service-accounts/add-username-password.webp) + +If you already created a **Username/password** account for a file server in the same domain and its **Username** is a plain user name with no domain prefix, you can reuse it here; the [Username and password](../service-accounts/username-password.md) page covers the details. + +## 2. Add the Source + +1. Go to **Configuration > Sources** and click **Add source**. +2. In **Source type**, select **Active Directory**. +3. Under **Details**, enter a **Name** for the source, such as the domain name. +4. Under **Connection**, in **Host**, enter a domain controller, for example `dc01.example.com`. Use the FQDN if you connect on port 389. +5. In **Port**, leave 389 or enter 636 for LDAPS. +6. Leave **Ignore SSL errors** clear. Turn it on only for a lab domain controller with a self-signed certificate on port 636. +7. In **Domain**, enter the DNS name of the domain, for example `corp.example.com`. +8. Under **Access**, in **Service account**, select the service account you created earlier. +9. Click **Test connection**. Access Analyzer binds to the domain controller and reads its root directory entry. Success shows the **Connection successful** message; failure shows a **Connection failed** alert with the reason, including a hint when the port and protocol don't match. +10. Click **Add source**. + +![Add source drawer for an Active Directory source](/images/accessanalyzer/26.1/sources/add-active-directory.webp) + +The [Active Directory](../sources/active-directory.md) source page describes each field and the connection checks in more depth. + +## 3. Create the Identity Sync + +Click **Next** to move from one step to the next. + +1. Go to **Configuration > Scans** and click **Create scan**. +2. On the **Type** step, select **Identity sync**. + + ![Create scan Type step with the Access, Sensitive data, and Identity sync cards](/images/accessanalyzer/26.1/scans/create-scan-1-type.webp) + +3. On the **Target** step, keep **Specific sources** and select the domain's checkbox. The list shows only sources that support Identity sync. +4. On the **Configure** step, leave **Use default configuration** selected. The default turns on **Enable differential scan**: the first run reads the whole domain; later runs read only the objects that changed since the previous run. +5. On the **Schedule** step, select **On a schedule**. +6. Keep the default **Daily** at 02:00 so group memberships stay current for the reports that depend on them. +7. Leave the agent set to **System agent**. + + ![Create scan Schedule step with a daily schedule selected](/images/accessanalyzer/26.1/scans/create-scan-4-schedule-daily.webp) + +8. On the **Review** step, enter a **Name** such as `corp.example.com - identity sync`. +9. Click **Create & run now**. + +[Schedules](../scans/schedules.md) explains the frequency options and what the **Schedule Status** column shows. + +## 4. Watch the Execution + +Go to **Configuration > Scan executions** and find the row for the new scan. The list refreshes on its own and shows the execution's **Status** and its **Objects** count. + +![Scan executions list](/images/accessanalyzer/26.1/scans/executions-list.webp) + +When the sync itself finishes, the execution moves to **Post processing** while Access Analyzer expands nested group memberships in a step named **Refresh Effective Memberships**. The step appears as a child row under the execution; click the arrow at the start of the row to show it. The execution reaches **Completed** once that step is done. + +If the status is **Failed**, open the row's **Actions** menu and click **View logs**. Authentication problems appear in the **Detailed logs** tab. If the message asks for an FQDN, **Host** holds an IP address and the port is 389; enter the domain controller's name instead. + +## 5. Check the Dashboard and Reports + +Go to **Dashboards > Active Directory** and click **Refresh**. In the **Domain** filter, select the domain you synced. The dashboard opens with counts for **Domains**, **Users**, **Enabled Users**, **Groups**, and **Direct Memberships**, followed by **Users**, **Groups**, and **All Risks** sections that end in the **Active Directory Risks** table. The [Active Directory dashboard](../dashboards-reports/dashboards/active-directory.md) page describes each card. + +![Active Directory dashboard with Domains, Users, Groups, and risk tiles](/images/accessanalyzer/26.1/dashboards-reports/active-directory-dashboard.webp) + +Under **Reports > Identity**, the **Active Directory** tab has the **AD Users** report: every user account with its status, password age, and last logon. The [Identity reports](../dashboards-reports/reports/identity.md) page describes each column. + +![AD Users report](/images/accessanalyzer/26.1/dashboards-reports/report-ad-users.webp) + +The sync also improves reports you may already be using. After it completes, the reports on the **File system** tab under **Reports > Data** resolve SIDs to names, expand group membership, and recognize open access granted through groups such as Domain Users. If you haven't scanned a file server yet, [Scan SMB file servers](./smb-file-servers.md) is the next guide. diff --git a/docs/accessanalyzer/26.1/guides/entra-id.md b/docs/accessanalyzer/26.1/guides/entra-id.md new file mode 100644 index 0000000000..f5e33687ae --- /dev/null +++ b/docs/accessanalyzer/26.1/guides/entra-id.md @@ -0,0 +1,104 @@ +--- +title: Scan Entra ID +description: Register an application for Access Analyzer, add the tenant as an Entra ID source, run an Identity sync, and open the Entra ID identity reports. +sidebar_position: 3 +--- + +Connect a Microsoft Entra ID tenant to Access Analyzer and run an Identity sync. The sync reads the tenant's users, groups (including dynamic membership rules), directory roles, and memberships. The results appear in the **Entra Users** and **Entra Groups** reports, and they let SharePoint Online scans of the same tenant calculate effective permissions. + +Access Analyzer signs in to the tenant as an application, not as a user, so the first job is an app registration with a client secret. + +## Before You Start + +**In Entra ID.** You need an administrator who can create an app registration and grant admin consent for its permissions. The registration needs Microsoft Graph application permissions that let Access Analyzer read users, groups, and directory roles; the sync never writes to the directory. When you add the source, **Test connection** checks that the app has the permissions it needs. + +**The network.** The Access Analyzer server needs outbound HTTPS (TCP 443) to the Microsoft sign-in and Microsoft Graph endpoints for your tenant's cloud. + +**In Access Analyzer.** Sign in with the Admin role. + +:::note + +Registering this application doesn't let people sign in to Access Analyzer with their Microsoft accounts. Set that up separately under [Single sign-on](../settings/single-sign-on.md). + +::: + +## 1. Register an Application in Entra ID + +1. In the Microsoft Entra admin center, create an app registration for Access Analyzer. +2. On the registration's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**. You need both in later steps. +3. Under **Certificates & secrets**, create a client secret. +4. Copy the secret value; Entra ID shows it only once. +5. Under **API permissions**, add the Microsoft Graph application permissions that grant read access to users, groups, and directory roles. +6. Grant admin consent for the tenant. + +Record the secret's expiry date. When you rotate it, update the service account you create in the next section. + +## 2. Create the Service Account + +Entra ID sources use a **Client ID/secret** service account. The tenant isn't part of the account; you enter it on the source in the next section. + +1. Go to **Configuration > Service accounts** and click **Add service account**. +2. In **Name**, enter a unique name, for example `entra-access-analyzer-app`. +3. In **Service account type**, select **Client ID/secret**. +4. In **Client (application) ID**, paste the **Application (client) ID** from the registration. +5. In **Client secret**, paste the secret value. +6. Click **Add account**. + +![Add service account drawer with the Client ID/secret type selected](/images/accessanalyzer/26.1/service-accounts/add-client-id-secret.webp) + +The [Client ID and secret](../service-accounts/client-id-secret.md) page covers editing the account when you rotate the secret. + +## 3. Add the Source + +1. Go to **Configuration > Sources** and click **Add source**. +2. In **Source type**, select **Entra ID**. +3. Under **Details**, enter a **Name**, such as the tenant's primary domain. +4. Under **Connection**, in **Tenant ID**, paste the **Directory (tenant) ID**. +5. In **Azure cloud**, leave **Azure (Commercial)** selected. If the tenant is in a government or China cloud, select **Azure Government (GCC)**, **Azure Government (GCC High)**, **Azure Government (DoD)**, or **Azure China (21Vianet)** instead. +6. Under **Access**, in **Service account**, select the account you created in the previous section. +7. Click **Test connection**. Access Analyzer signs in as the application and validates its permissions. Success shows a **Connection successful** message; failure shows a **Connection failed** alert with the reason. +8. Click **Add source**. + +![Add source drawer for an Entra ID source](/images/accessanalyzer/26.1/sources/add-entra-id.webp) + +Field details are on the [Entra ID](../sources/entra-id.md) source page. + +## 4. Create the Identity Sync + +Click **Next** to move from one step to the next. + +1. Go to **Configuration > Scans** and click **Create scan**. +2. On the **Type** step, select **Identity sync**. + + ![Create scan Type step with the Access, Sensitive data, and Identity sync cards](/images/accessanalyzer/26.1/scans/create-scan-1-type.webp) + +3. On the **Target** step, keep **Specific sources** and select the tenant's checkbox. +4. On the **Configure** step, click **Next**. Entra ID syncs have no settings to change. +5. On the **Schedule** step, select **On a schedule**. +6. Keep the default **Daily** at 02:00. +7. Leave the agent set to **System agent**. +8. On the **Review** step, enter a **Name** such as `contoso.onmicrosoft.com - identity sync`. +9. Click **Create & run now**. + +## 5. Watch the Execution + +Go to **Configuration > Scan executions** and find the new scan in the list. The list refreshes on its own; the status moves from **Pending** through **Running** to **Completed**, and **Objects** shows how many directory objects the sync read. + +![Scan executions list](/images/accessanalyzer/26.1/scans/executions-list.webp) + +If the status is **Failed**, open the row's actions menu and click **View logs**, then check the **Detailed logs** tab. A sign-in error points at the client ID, secret, or tenant ID; a permission error means the app registration is missing a Graph permission or its admin consent. [Scan executions](../scans/scan-executions.md) lists every status. + +## 6. Check the Reports + +Go to **Reports > Identity** and open the **Entra ID** tab. + +![Identity reports page on the Entra ID tab](/images/accessanalyzer/26.1/dashboards-reports/reports-identity-entra-id.webp) + +| Report | What it shows | +|--------|---------------| +| **Entra Users** | User accounts with multi-factor authentication (MFA) status, licenses, and sign-in activity | +| **Entra Groups** | Groups with their membership, type, and assigned licenses | + +Neither report has filters; open one and click **Refresh** to load the latest sync. Entra ID data has no dashboard of its own, and the Active Directory dashboard covers on-premises domains only. + +If you plan to scan SharePoint Online, do it after this sync has completed at least once. The [Scan Microsoft 365](./microsoft-365.md) guide explains how the two fit together. [Identity reports](../dashboards-reports/reports/identity.md) describes each report's columns. diff --git a/docs/accessanalyzer/26.1/guides/index.md b/docs/accessanalyzer/26.1/guides/index.md new file mode 100644 index 0000000000..adc67e3820 --- /dev/null +++ b/docs/accessanalyzer/26.1/guides/index.md @@ -0,0 +1,17 @@ +--- +title: Guides +description: One guide per platform, taking a new administrator from an empty install to the first populated dashboard or report. +--- + +Each guide covers one platform from start to finish: the service account, the source, the scans, the first run, and where the results appear. Follow a guide once, right after [installing Access Analyzer](../install/index.md). After that, the reference sections for [Sources](../sources/index.md), [Scans](../scans/index.md), and [Dashboards and reports](../dashboards-reports/index.md) cover the day-to-day detail. + +Before you start, ensure you can sign in to Access Analyzer with the [Admin role](../settings/users.md). + +| Guide | Source type label | Service account type | Scans you create | Where results appear | +|-------|-------------------|----------------------|------------------|----------------------| +| [Scan SMB file servers](./smb-file-servers.md) | **File Server** | **Username/password** | Access scan, then Sensitive data scan | Data security dashboard, File system reports | +| [Scan Active Directory](./active-directory.md) | **Active Directory** | **Username/password** | Identity sync | Active Directory dashboard, Active Directory identity reports | +| [Scan Entra ID](./entra-id.md) | **Entra ID** | **Client ID/secret** | Identity sync | Entra ID identity reports | +| [Scan Microsoft 365](./microsoft-365.md) | **SharePoint Online** | **Client ID/certificate** | Access scan, then Sensitive data scan | Data security dashboard, SharePoint reports | + +The guides are independent, but they work best in pairs. File system permission reports show account and group names only after an Active Directory Identity sync has run for the domain, so follow the Active Directory guide alongside the SMB file servers guide. SharePoint permission reports expand group membership using the latest Entra ID Identity sync for the same tenant; without it, Access Analyzer calculates permissions from SharePoint data alone. Pair the Microsoft 365 guide with the Entra ID guide. diff --git a/docs/accessanalyzer/26.1/guides/microsoft-365.md b/docs/accessanalyzer/26.1/guides/microsoft-365.md new file mode 100644 index 0000000000..7ca1d9bf2c --- /dev/null +++ b/docs/accessanalyzer/26.1/guides/microsoft-365.md @@ -0,0 +1,138 @@ +--- +title: Scan Microsoft 365 +description: Connect a SharePoint Online tenant with a certificate-based app registration, run an Access scan and a Sensitive data scan, and find the results in the SharePoint reports. +sidebar_position: 4 +--- + +Connect one Microsoft 365 tenant's SharePoint Online sites and OneDrive drives to Access Analyzer and run two scans: an Access scan that collects sites, permissions, and sharing links, and a Sensitive data scan that classifies the documents the Access scan found. At the end you'll have data in the Data security dashboard and the SharePoint reports. + +Access Analyzer calls the source type **SharePoint Online**. It signs in to the tenant as an application with a certificate, so setup is a round trip between Access Analyzer and the Microsoft Entra app registration. + +## Before You Start + +**In Entra ID.** You need an administrator who can create an app registration, upload a certificate to it, and grant admin consent for its permissions. The registration needs application permissions that let Access Analyzer read SharePoint sites, their permissions, and their files. Don't create a client secret for it: SharePoint Online sources authenticate only with a certificate, and Access Analyzer generates that certificate for you in step 1. + +**The network.** The Access Analyzer server needs outbound HTTPS (TCP 443) to `login.microsoftonline.com`, `graph.microsoft.com`, and your tenant's SharePoint hosts (`.sharepoint.com` and `-my.sharepoint.com`). + +**An Entra ID source for the same tenant.** Effective permissions in SharePoint depend on group membership, and Access Analyzer takes that from the latest completed Entra ID Identity sync of the same tenant. Follow [Scan Entra ID](./entra-id.md) first. Without it, Access Analyzer calculates effective permissions from SharePoint data alone. + +**In Access Analyzer.** Sign in with the Admin role. + +## 1. Create the Service Account and Its Certificate + +SharePoint Online sources use a **Client ID/certificate** service account. Unlike an Entra ID source, which records the tenant ID on the source itself, a SharePoint Online source takes the tenant ID from the service account. + +1. In the Microsoft Entra admin center, create an app registration for Access Analyzer. +2. On the registration's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**. +3. In Access Analyzer, go to **Configuration > Service accounts** and click **Add service account**. +4. In **Name**, enter a unique name, for example `sharepoint-access-analyzer-app`. +5. In **Service account type**, select **Client ID/certificate**. +6. In **Client (application) ID**, paste the **Application (client) ID**. +7. In **Tenant ID**, paste the **Directory (tenant) ID**. +8. Under **Certificate**, leave **Generate for me** selected. When you save the account, Access Analyzer creates a self-signed RSA-2048 certificate that is valid for one year. +9. Click **Add account**. +10. In the **Account created and certificate generated** message, note the thumbprint and expiry date. +11. Click **Download certificate (.pem)** and save the file. +12. Click **Done**. + +![Add service account drawer with the Client ID/certificate type selected](/images/accessanalyzer/26.1/service-accounts/add-client-id-certificate.webp) + +If your organization issues its own certificates, select **Upload my own** instead and provide a `.pem` file, up to 1 MB, that contains both the certificate and its unencrypted private key. Access Analyzer rejects expired certificates and PFX files. The [Client ID and certificate](../service-accounts/client-id-certificate.md) page covers both options and what to do when the certificate is due to expire. + +## 2. Upload the Certificate to the App Registration + +1. In the Microsoft Entra admin center, open the app registration. +2. Under **Certificates & secrets**, upload the `.pem` file you downloaded. It holds only the public certificate. +3. Check that the thumbprint Entra ID shows matches the one from step 1. +4. Add the application permissions Access Analyzer needs. +5. Grant admin consent for the tenant. + +:::warning + +The generated certificate expires one year after you create the account, and scans fail when it does. When you regenerate or replace it in Access Analyzer, upload the new public certificate to the app registration before the next scan runs. + +::: + +## 3. Add the Source + +1. Go to **Configuration > Sources** and click **Add source**. +2. In **Source type**, select **SharePoint Online**. +3. Under **Details**, enter a **Name**, such as the tenant name. +4. Under **Connection**, in **SharePoint domain**, enter the tenant's SharePoint host, for example `contoso.sharepoint.com`. +5. Leave **Azure cloud** at **Azure (Commercial)** unless the tenant is in a government or China cloud. +6. Under **Access**, in **Service account**, select the account from step 1. +7. Click **Test connection**. Access Analyzer signs in with the certificate and checks that the registration can reach the tenant. A **Connection successful** message confirms it; a **Connection failed** alert gives the reason. If it fails, confirm that you uploaded the certificate and granted admin consent. +8. Click **Add source**. + +![Add source drawer for a SharePoint Online source](/images/accessanalyzer/26.1/sources/add-sharepoint-online.webp) + +Field details are on the [Microsoft 365](../sources/microsoft-365.md) source page. + +## 4. Create the Access Scan + +Run the Access scan first. The Sensitive data scan in step 6 classifies documents from the inventory this scan builds. + +1. Go to **Configuration > Scans** and click **Create scan**. +2. On the **Type** step, select **Access** and click **Next**. + + ![Create scan Type step with the Access, Sensitive data, and Identity sync cards](/images/accessanalyzer/26.1/scans/create-scan-1-type.webp) + +3. On the **Target** step, keep **Specific sources** and select the tenant. +4. On the **Configure** step, leave **Use default configuration** selected for the first run. The defaults are **Workers** 4, **Collect OneDrive** on, and no entries in **Include site collections**, **Exclude site collections**, or **Exclude object URLs**, so the scan covers every site collection and every OneDrive drive. +5. On the **Schedule** step, leave **Manual — run on demand** for the first run. Leave the agent set to **System agent**. +6. On the **Review** step, enter a **Name** such as `Contoso SharePoint - access`. +7. Click **Create & run now**. + +![Create scan Review step with the scan named and the summary shown](/images/accessanalyzer/26.1/scans/create-scan-5-review-named.webp) + +When you're ready to narrow the scan, edit it and select **Customize this source** on the **Configure** step. **Include site collections** limits the scan to the site collections you list and takes no wildcards; **Exclude site collections** and **Exclude object URLs** accept the `*` wildcard. Keep **Workers** at 4 unless the tenant has SharePoint Online prioritization (adaptive throttling) turned on; even then, 32 is the practical maximum before throttling cancels out the gain. Every Access scan is a full crawl of the sites in scope; there is no differential option. [Scan types](../scans/scan-types.md) describes each setting. + +## 5. Watch the Execution + +Go to **Configuration > Scan executions**. The list refreshes on its own, and the **Objects** column grows as the scan reads the tenant. A first scan of a large tenant takes a while. + +![Scan executions list](/images/accessanalyzer/26.1/scans/executions-list.webp) + +If the status is **Failed**, open the row's actions menu, click **View logs**, and check the **Detailed logs** tab. A sign-in error points at the certificate or the app registration. [Scan executions](../scans/scan-executions.md) lists every status. + +## 6. Create the Sensitive Data Scan + +After the Access scan shows **Completed**, create the second scan. It downloads documents from the Access scan's inventory and classifies them against sensitive data patterns. By default the scan skips documents larger than 10 MB and files with excluded extensions; both limits are in [Application settings](../settings/application.md). + +1. Go to **Configuration > Scans** and click **Create scan**. +2. On the **Type** step, select **Sensitive data** and click **Next**. +3. On the **Target** step, select the same tenant. +4. On the **Configure** step, under **Sensitive data classification**, choose which pattern groups the scan uses. Leave **Inherit from global configuration** on to use the groups marked **Scanned by default** at **Configuration > Sensitive data patterns**, or turn it off and pick groups under **Sensitive Data Pattern Groups to Classify**. SharePoint Online has no other Sensitive data settings. + + ![Create scan Configure step for a Sensitive data scan showing the classification settings](/images/accessanalyzer/26.1/scans/create-scan-sensitive-3-configure.webp) + +5. On the **Schedule** step, leave **Manual — run on demand**. +6. On the **Review** step, enter a **Name** such as `Contoso SharePoint - sensitive data`. +7. Click **Create & run now**. + +:::note + +On a fresh install, no pattern group carries **Scanned by default**, and a scan with no groups selected classifies against every pattern group. Select the groups you care about before putting the scan on a schedule. + +::: + +[Sensitive data patterns](../sensitive-data-patterns/index.md) describes the built-in groups and confidence levels. + +## 7. Check the Dashboards and Reports + +Dashboards and reports don't refresh on their own. Open one and click **Refresh** to reload it; results from a scan that has just finished can take some time to appear. + +**Dashboards > Data security** shows the tenant in **Total Data Repositories**, **Total Objects Scanned**, **Permissions Analyzed**, **SharePoint Sites by Type**, and **Data Source Inventory**. After the Sensitive data scan, **Sensitive Data Findings** and **Sensitive Data by Source** include SharePoint too. + +**Reports > Data**, on the **SharePoint** tab, has four reports. + +![Data reports page on the SharePoint tab](/images/accessanalyzer/26.1/dashboards-reports/reports-data-sharepoint.webp) + +| Report | Needs | What it shows | +|--------|-------|---------------| +| **Shared Links** | Access scan | Anonymous and company-wide sharing links that expose content externally | +| **High-Risk ACLs** | Access scan | Sites and libraries with overly permissive access control entries | +| **Open Access** | Access scan | Content that all authenticated users can reach without restriction | +| **Sensitive Data Overview** | Sensitive data scan | Sensitive data classifications across SharePoint sites | + +**Shared Links** also appears under **Reports > Compliance** for each framework. The other three SharePoint reports live only on the **Data** page. [Data reports](../dashboards-reports/reports/data.md) describes every report and its filters, and the [Data security dashboard](../dashboards-reports/dashboards/data-security.md) page covers each card. diff --git a/docs/accessanalyzer/26.1/guides/smb-file-servers.md b/docs/accessanalyzer/26.1/guides/smb-file-servers.md new file mode 100644 index 0000000000..89d4c6f305 --- /dev/null +++ b/docs/accessanalyzer/26.1/guides/smb-file-servers.md @@ -0,0 +1,151 @@ +--- +title: Scan SMB File Servers +description: Connect a Windows, NetApp, Dell PowerScale, or Nutanix Files server over SMB, run an Access scan and a Sensitive data scan, and find the results. +sidebar_position: 1 +--- + +Connect one SMB file server to Access Analyzer and run the two scans that matter for file data: an Access scan that inventories shares, folders, and permissions, and a Sensitive data scan that classifies the files the Access scan found. At the end you'll have data in the Data security dashboard and the File system reports. + +In the UI the source type is called **File Server**. It covers Windows file servers, NetApp, Dell PowerScale (formerly Isilon), and Nutanix Files over SMB 2 or SMB 3. + +## Before You Start + +You need three things: an account that can read the shares, a network path to the server, and the Admin role in Access Analyzer. + +**The account** - Access Analyzer only reads. Give the account NTFS **Read** on every folder and file you want inventoried; the specific rights it needs are List folder / Read data, Read attributes, and Read permissions. The Sensitive data scan reads file contents, which the same Read right covers. + +Making the account a member of the file server's local **Administrators** or **Backup Operators** group lets the scan read folders whose permissions would otherwise lock it out. Without administrative rights the scan still lists every share, but it can't record each share's local path, and it logs any folder it can't open as an error. + +**The network** - The Access Analyzer server, or the agent that runs the scan, needs TCP 445 to the file server. The connection uses SMB 2 or 3 with signing; Access Analyzer doesn't support SMB 1. Authentication uses NT LAN Manager (NTLM). + +| Direction | Port | Purpose | +|-----------|------|---------| +| Access Analyzer or agent to file server | TCP 445 | SMB for share enumeration, permission collection, and file content | + +:::warning + +Keep **Port** at 445. Sensitive data scans read file contents only over port 445, so a File Server source on any other port can run Access scans but not Sensitive data scans. + +::: + +**Names in reports** - The Access scan records permissions as security identifiers (SIDs). To see account and group names in reports, and to expand group membership, add the domain as an Active Directory source and run an Identity sync. The [Scan Active Directory](./active-directory.md) guide covers it; you can do it before or after this guide. + +## 1. Create the Service Account + +File Server sources use a **Username/password** service account. + +1. Go to **Configuration > Service accounts** and click **Add service account**. +2. In **Name**, enter a unique name, for example `svc-fileserver-scan`. +3. Leave **Service account type** set to **Username/password**. +4. In **Username**, enter the account as `DOMAIN\username`. +5. In **Password**, enter the password. +6. Click **Add account**. + +![Add service account drawer with the Username/password type selected](/images/accessanalyzer/26.1/service-accounts/add-username-password.webp) + +:::tip + +The field accepts `username@domain` too, but Sensitive data scans read only the `DOMAIN\username` form. Use that form for any account that runs both scan types. + +::: + +The [Username and password](../service-accounts/username-password.md) page has the full field reference. + +## 2. Add the Source + +1. Go to **Configuration > Sources** and click **Add source**. +2. In **Source type**, select **File Server**. +3. Under **Details**, enter a **Name** for the source. +4. Optionally, add a **Description** and **Labels**. A label is a `key=value` pair such as `env=production`; it lets you target scans at groups of sources later. +5. Under **Connection**, in **Host**, enter the hostname or IP address of the server, for example `fileserver.example.com`. +6. Leave **Port** at 445. +7. In **Domain**, enter the Windows domain or workgroup name. Access Analyzer uses it only when the username doesn't carry a domain, so leave it empty if the service account's username is in the `DOMAIN\username` form. +8. Under **Access**, in **Service account**, select the service account you created earlier. +9. Click **Test connection**. Access Analyzer opens an SMB session and enumerates the shares. Success shows a **Connection successful** message; failure shows a **Connection failed** alert with the reason. +10. Click **Add source**. + +![Add source drawer with File Server selected, showing the Details, Connection, and Access sections](/images/accessanalyzer/26.1/sources/add-file-server.webp) + +To add many servers at once, [import sources from a CSV file](../sources/import-sources.md) instead. Field details and the connection checks are on the [SMB file servers](../sources/smb-file-servers.md) source page. + +## 3. Create the Access Scan + +Run the Access scan first. The Sensitive data scan you create in [Create the Sensitive data scan](#5-create-the-sensitive-data-scan) works from the file inventory this scan builds, so there's nothing for it to classify until an Access scan has completed. + +1. Go to **Configuration > Scans** and click **Create scan**. +2. On the **Type** step, select **Access** and click **Next**. + + ![Create scan Type step with the Access, Sensitive data, and Identity sync cards](/images/accessanalyzer/26.1/scans/create-scan-1-type.webp) + +3. On the **Target** step, keep **Specific sources** and select the file server you added. The list shows only sources that support Access scans. For a group of servers, select **Sources matching labels** instead and enter the label; the scan picks up any source that carries it at run time. + + ![Create scan Target step with one File Server source selected](/images/accessanalyzer/26.1/scans/create-scan-2-target-selected.webp) + +4. On the **Configure** step, leave **Use default configuration** selected. The defaults are **Workers** 3, **Exclude system shares** on (the scan skips shares whose names end in `$`), **Maximum scan depth** 50, and **Enable File-Level Permission Scanning** off, which means the scan collects permissions for shares and folders but not for individual files. Change these later, after you've seen a first run; [Scan types](../scans/scan-types.md) explains each setting. +5. On the **Schedule** step, leave **Manual — run on demand** for the first run. When the first run looks right, edit the scan and switch to **On a schedule**; the default is **Daily** at 02:00. Leave the agent set to **System agent** unless you have deployed an [agent](../agents/index.md) closer to the file server. +6. On the **Review** step, enter a **Name** such as `Finance file server - access` and check the summary. +7. Click **Create & run now**. + +![Create scan Review step with the scan named and the summary shown](/images/accessanalyzer/26.1/scans/create-scan-5-review-named.webp) + +**Create scan** saves the scan without running it. You can start it any time from **Configuration > Scans** with **Run** in the row's actions menu. + +## 4. Watch the Execution + +Go to **Configuration > Scan executions** and find the row for your scan. The list refreshes on its own. + +![Scan executions list showing a completed File Server Access scan](/images/accessanalyzer/26.1/scans/executions-list.webp) + +The status moves from **Pending** to **Running** and ends at **Completed**, **Completed with errors**, or **Failed**. The **Objects** and **Duration** columns fill in as the scan works. To follow along, open the row's actions menu and click **View logs**: the **Overview** tab shows milestones such as when the scan started and how long it took, and the **Detailed logs** tab shows every message. + +![Execution logs dialog on the Overview tab](/images/accessanalyzer/26.1/scans/execution-logs-overview.webp) + +**Completed with errors** means the scan couldn't read some objects, most often folders the account has no rights to. Access Analyzer keeps the data the scan did collect, and the next run uploads the rest. Check **Detailed logs** for the paths, fix the permissions or add the account to **Backup Operators**, and run the scan again from **Configuration > Scans**. + +[Scan executions](../scans/scan-executions.md) lists every status and the pause, resume, and stop controls. + +## 5. Create the Sensitive Data Scan + +After the Access scan shows **Completed**, create the second scan. It classifies files from the Access scan's inventory against sensitive data patterns. By default the scan skips files larger than 10 MB and files with excluded extensions; both limits are in [Application settings](../settings/application.md). + +1. Go to **Configuration > Scans** and click **Create scan**. +2. On the **Type** step, select **Sensitive data** and click **Next**. +3. On the **Target** step, select the same file server. +4. On the **Configure** step, under **Sensitive data classification**, select the pattern groups to look for. With **Inherit from global configuration** on, the scan uses the groups marked **Scanned by default** at **Configuration > Sensitive data patterns**. Turn it off to select groups for this scan only, such as **PCI DSS**, **PII**, and **Credentials**, under **Sensitive Data Pattern Groups to Classify**. + + ![Create scan Configure step for a Sensitive data scan showing the classification settings](/images/accessanalyzer/26.1/scans/create-scan-sensitive-3-configure.webp) + +5. Leave the File Server settings at their defaults: **Workers** 3, **Differential scan** off, and **Exclude System Shares** on. Turn **Differential scan** on later so scheduled runs classify only files that changed since the last run. +6. On the **Schedule** step, leave **Manual — run on demand**. +7. On the **Review** step, enter a **Name** such as `Finance file server - sensitive data`. +8. Click **Create & run now**. + +:::note + +On a fresh install no pattern group is marked **Scanned by default**. A scan that inherits the global configuration with no groups enabled, or that has no groups selected, classifies against every pattern group, built-in and custom. Select groups when you want the findings limited to the categories you care about. + +::: + +Follow the run in **Configuration > Scan executions**, as described in [Watch the execution](#4-watch-the-execution). [Sensitive data patterns](../sensitive-data-patterns/index.md) describes the built-in groups and how to add your own patterns. + +## 6. Check the Dashboards and Reports + +Dashboards and reports don't refresh on their own. Open one and click **Refresh** after a scan completes. + +**Dashboards > Data security** fills in after the Access scan: **Total Data Repositories**, **Total Objects Scanned**, **Permissions Analyzed**, **File Server Objects by Host**, and **Data Source Inventory**. After the Sensitive data scan, **Sensitive Data Findings** and **Sensitive Data by Source** show counts too. The **Data Source** filter narrows the view by source type, **File Servers** or **SharePoint Online**, not to a single server. + +![Data security dashboard with file server data](/images/accessanalyzer/26.1/dashboards-reports/data-security-dashboard.webp) + +**Reports > Data**, on the **File system** tab, has the reports that matter for file servers: + +| Report | Needs | What it shows | +|--------|-------|---------------| +| **Open Access** | Access scan | Shares that Everyone or Domain Users can reach without restriction | +| **High Risk ACLs** | Access scan | Shares and folders with overly permissive ACLs | +| **Broken Inheritance** | Access scan | Folders where inheritance is broken and explicit permissions are applied | +| **Share Audit** | Access scan | Effective permissions on one share; select a **Share** in the filters first | +| **Sensitive Data Overview** | Sensitive data scan | Findings across the scanned locations, filtered by host, share, pattern group, or pattern | + +**Activity Investigation** appears in the same tab but stays empty until you connect [Netwrix Activity Monitor](../integrations/netwrix-activity-monitor.md). **Reports > Compliance** arranges the same reports by framework, so the **GDPR** or **PCI DSS** tabs populate from these two scans as well. + +If the permission reports show SIDs instead of names, follow [Scan Active Directory](./active-directory.md) and run an Identity sync for the domain. [Data reports](../dashboards-reports/reports/data.md) describes every report and its filters. diff --git a/docs/accessanalyzer/26.1/index.md b/docs/accessanalyzer/26.1/index.md new file mode 100644 index 0000000000..5f02113fa3 --- /dev/null +++ b/docs/accessanalyzer/26.1/index.md @@ -0,0 +1,46 @@ +--- +title: Access Analyzer +description: What Netwrix Access Analyzer does, how its parts fit together, and where to begin. +sidebar_position: 1 +--- + +## What Access Analyzer Is + +Netwrix Access Analyzer is a self-hosted web application that you install on a Linux server you own. It scans your file servers and cloud storage platforms, and builds a picture of where sensitive data lives and who can reach it. It belongs to the data security posture management (DSPM) category of products. [Key concepts](key-concepts.md) defines the terms used throughout. + +![Access Analyzer Home page with the navigation sidebar and getting-started content](/images/accessanalyzer/26.1/overview/home.webp) + +## What It Does + +### Sources + +Access Analyzer collects permissions and inventory from SMB file servers (the **File Server** source type), Active Directory, Entra ID, and Microsoft 365 (the **SharePoint Online** source type). Each connected system is a source, and most will connect with a [service account](service-accounts/index.md). This doc on [Sources](sources/index.md) covers each type. + +### Scans and Agents + +A scan defines: +1. what to collect +2. from which sources +3. and when + +An Access Scan inventories shares, folders, files (and their metadata), and sites with their permissions. Sensitive Data Scans read each file's content, so they take longer. An Identity Sync pulls users, groups, and memberships from a directory service. Scans can run on demand or on a schedule. Every scan runs on an Agent: the System agent built into the server, or agents you deploy on other Linux hosts and pick with labels. See [Scans](scans/index.md) and [Agents](agents/index.md) for what they are and how to use them. + +### Sensitive Data + +Sensitive Data Patterns are regular expressions that you can group by compliance program, data category, or any other system you choose. Access Analyzer ships 139 built-in patterns in 11 groups, and you can add your own. A scan records which patterns matched in a file and how many times, but never the matched text. See [Sensitive data patterns](sensitive-data-patterns/index.md). + +### Dashboards and Reports + +Two dashboards, Data security and Active Directory, summarize what your scans have found. Reports under **Data**, **Identity**, and **Compliance** each answer one question, such as which folders have broken permission inheritance or which files contain sensitive data. See [Dashboards and reports](dashboards-reports/index.md). + +### Activity Data + +Scans show _who_ can reach _what_ data. To see who used that access, you can connect [Netwrix Activity Monitor](integrations/netwrix-activity-monitor.md), which streams the events it records on file servers, SharePoint Online, Microsoft 365 Copilot, and other systems to Access Analyzer. They fill the **Activity** tab of the Data security dashboard and the Activity Investigation report. See [Integrations](integrations/index.md). + +### Users and Sign-in + +Every user in Access Analyzer can have one of three roles: Admin, User Admin, or Viewer. Admins can change anything, User Admins manage other accounts only, and Viewers have read-only access. Users can sign in with a local account or, after you connect a directory service, with Active Directory or Entra ID credentials. See [Users and roles](settings/users.md) and [Single sign-on](settings/single-sign-on.md) under [Settings](settings/index.md). + +## Where to Start + +Start with [Installation](install/index.md): pick a size, prepare the server, and run the installer. Then [sign in for the first time](install/first-sign-in.md), change the one-time password, and connect a directory or leave that for later. After that, follow the [Guides](guides/index.md), one per platform, to populate your first report. Before a rollout, read [What's new in 26.1](whats-new.md) and [Known limitations](known-limitations.md). diff --git a/docs/accessanalyzer/2601/install/_category_.json b/docs/accessanalyzer/26.1/install/_category_.json similarity index 80% rename from docs/accessanalyzer/2601/install/_category_.json rename to docs/accessanalyzer/26.1/install/_category_.json index 4ec6b4da75..dd1605971d 100644 --- a/docs/accessanalyzer/2601/install/_category_.json +++ b/docs/accessanalyzer/26.1/install/_category_.json @@ -1,6 +1,6 @@ { "label": "Installation", - "position": 12, + "position": 10, "collapsed": true, "collapsible": true } diff --git a/docs/accessanalyzer/26.1/install/first-sign-in.md b/docs/accessanalyzer/26.1/install/first-sign-in.md new file mode 100644 index 0000000000..7871536530 --- /dev/null +++ b/docs/accessanalyzer/26.1/install/first-sign-in.md @@ -0,0 +1,81 @@ +--- +title: Sign In for the First Time +description: Sign in with the first administrator's one-time password, set a permanent password, and choose whether to connect an identity provider right away or later. +sidebar_position: 3 +--- + +The installer ends by printing a URL, a username, and a one-time password. The username is the email address you gave as the first administrator. Sign in with them once, and Access Analyzer walks you through replacing the password and deciding how everyone else signs in. + +## Sign In + +1. Open `https://` in a browser, using the hostname you gave the installer. +2. In **Username**, enter the first administrator's email address. +3. In **Password**, enter the one-time password from the installer summary. +4. Click **Sign in**. + +![Access Analyzer sign-in page with Username and Password fields](/images/accessanalyzer/26.1/overview/sign-in.webp) + +:::warning + +Three wrong passwords lock the account, and at this point no other administrator exists to unlock it. Paste the one-time password rather than retyping it. If you no longer have it, see [Retrieve the one-time password again](#retrieve-the-one-time-password-again). + +::: + +## Set A New Password + +The one-time password works only once, so Access Analyzer immediately asks for a new one, with the message "You must set a new password before continuing." + +1. In **New password**, enter a password of at least 12 characters. There are no other rules about which characters it must contain. +2. In **Confirm password**, enter it again. +3. Click **Change password**. + +The page rejects a new password for one of these reasons: + +| Message | Cause | +|---|---| +| Passwords don't match. | The two entries differ. | +| Password doesn't meet complexity requirements. | The password has fewer than 12 characters. | +| New password can't be the same as your current password. | You entered the one-time password again. | + +## Choose How to Set Up Sign-in + +After the password change, Access Analyzer shows a page titled **Connect an identity provider**. It explains that you're signed in with the local administrator account, and that connecting Active Directory or Entra ID lets the rest of your team sign in with the accounts they already have. It offers two buttons. + +![Connect an identity provider page with Set up identity provider and Set up later](/images/accessanalyzer/26.1/integrations/identity-provider-setup.webp) + +### Connect Your Identity Provider + +Click **Set up identity provider** to connect your directory right away. The setup runs in three steps, shown across the top of the page as **Identity provider**, **Connect**, and **Admins**. + +1. On **Identity provider**, select **Active Directory** or **Entra ID**. + + ![Identity provider selection step with Active Directory and Entra ID](/images/accessanalyzer/26.1/integrations/identity-provider-choose.webp) + +2. Click **Continue**. +3. On **Connect**, enter the connection details for the provider you chose. Active Directory needs a domain controller, a service account (Netwrix recommends a read-only account), and the certificate authority (CA) that issued the domain controller's certificate for Lightweight Directory Access Protocol over TLS (LDAPS). Entra ID needs an app registration and a one-time administrator consent. [Single sign-on](../settings/single-sign-on.md) describes every field and what to prepare on the directory side. +4. Click **Test connection and continue** for Active Directory, or **Sign in with Microsoft and continue** for Entra ID. +5. On **Admins**, add the people who should hold the Admin role, or leave the list empty. +6. Click **Finish setup**. If you added nobody, the button reads **Continue without admins** instead. +7. Wait while Access Analyzer applies the configuration, then click **log in to Access Analyzer**. + +That last click signs you out, because the setup has just changed the sign-in service. Sign in again with the local administrator account. Anyone you added on **Admins** signs in through the directory instead; if you connected Entra ID, the sign-in page also shows **Sign in with Microsoft**. + +### Set Up Later + +Choose this if you don't have the directory details yet, or if you want to explore the application before inviting anyone else. + +Click **Set up later** to skip straight to the application. The local administrator account keeps working, and Access Analyzer stops redirecting you to this page. You can run the same steps later: go to **Settings > System** and, under **Single sign-on**, click **Go to set up**. + +## Retrieve the One-Time Password Again + +If you closed the terminal before copying the password, you can read it back from the server. The stored password works only until the first administrator replaces it. Run this command on the server as root: + +```bash +kubectl get secret dspm-bootstrap-admin -n access-analyzer -o jsonpath='{.data.password}' | base64 -d +``` + +The command prints the password. + +## The Home Page + +After you sign in, the **Home** page greets you by name and offers to connect your first source. The [Guides](../guides/index.md) walk through connecting a source and scanning it. diff --git a/docs/accessanalyzer/26.1/install/index.md b/docs/accessanalyzer/26.1/install/index.md new file mode 100644 index 0000000000..7054502a4c --- /dev/null +++ b/docs/accessanalyzer/26.1/install/index.md @@ -0,0 +1,24 @@ +--- +title: Installation +description: How to prepare a Linux server, run the Access Analyzer installer, and sign in for the first time. +--- + +Access Analyzer runs on a single Linux server that you own. You download one installer binary, run it as root, and answer a few prompts. The installer checks the server, sets up every service, and prints the address and credentials you use to sign in. + +An installation takes three steps, each covered on its own page. + +1. [Requirements](requirements.md)—pick a size, confirm the server has enough CPU, RAM, and disk, and gather the license key, hostname, TLS certificate, and first administrator's email address before you start. +2. [Install Access Analyzer](run-the-installer.md)—copy the certificate to the server and run `dspm-installer`, either answering the prompts or passing everything as flags. +3. [Sign in for the first time](first-sign-in.md)—open the web application, change the first administrator's one-time password, and either connect Active Directory or Entra ID or skip that step for later. + +After the first sign-in, the [Guides](../guides/index.md) walk you through scanning your first source. + +## People You Need + +You need an administrator with root access to the Linux server, either signed in as root or using `sudo`. The installer writes to `/etc/dspm`, `/var/log`, and `/usr/local/bin`, so a non-root account can't complete it. + +You also need someone who can issue a TLS certificate for the server's hostname and someone who can open firewall ports. The [Requirements](requirements.md) page lists exactly what to ask for. + +## Scripting or Troubleshooting an Installation + +The [Installer reference](installer-reference.md) lists the flags, environment variables, exit codes, and preflight checks, for when you script an installation or need to find out why one stopped. diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md new file mode 100644 index 0000000000..41b8a9e710 --- /dev/null +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -0,0 +1,139 @@ +--- +title: Installer Reference +description: The dspm-installer flags, environment variables, configuration file keys, exit codes, preflight checks, and log locations. +sidebar_position: 4 +--- + +`dspm-installer` takes its settings from four places. A flag wins over an environment variable, an environment variable wins over the configuration file, and the configuration file wins over the built-in default. When the installer runs in a terminal, it prompts for any required value still missing; without a terminal, a missing required value is an error. + +```bash +dspm-installer [flags] +dspm-installer wait-for-apps [flags] +dspm-installer --help +dspm-installer --version +``` + +There are no single-letter flags. + +## Flags + +Two environment variable names need care: `--hostname` reads `DSPM_HOSTNAME`, not `HOSTNAME`, because the shell sets `HOSTNAME` itself, and `--assume-yes` reads `DSPM_ASSUME_YES`, not `ASSUME_YES`. + +| Flag | Environment variable | Default | Description | +|---|---|---|---| +| `--license-key` | `LICENSE_KEY` | none | Netwrix license key. Required. Validated online before the install starts. | +| `--hostname` | `DSPM_HOSTNAME` | none | Fully qualified domain name users open in their browsers. Lowercased before use. | +| `--first-admin-email` | `FIRST_ADMIN_EMAIL` | none | Email address of the first administrator. Required. Becomes that person's username. | +| `--first-admin-name` | `FIRST_ADMIN_NAME` | none | Full name of the first administrator. | +| `--tls-cert` | `TLS_CERT_FILE` | `/etc/dspm/tls.crt` | PEM TLS certificate file, full chain with the leaf certificate first. Requires `--tls-key`. | +| `--tls-key` | `TLS_KEY_FILE` | `/etc/dspm/tls.key` | PEM TLS private key file. Requires `--tls-cert`. | +| `--ca-bundle` | `TLS_CA_BUNDLE_FILE` | none | PEM certificate authority (CA) bundle. Needed when a private CA issued the certificate. | +| `--size` | `SIZE` | `medium` | Deployment size: `small`, `medium`, `large`, or `enterprise`. Case-insensitive. | +| `--target-revision` | `TARGET_REVISION` | `1.*` | Release version to install, such as `1.5.0`. The default installs the latest 1.x release. Also appears as **Target Revision** under **Show advanced settings?**. | +| `--accept-warnings` | `ACCEPT_WARNINGS` | `false` | Continue past preflight warnings without asking. | +| `--assume-yes` | `DSPM_ASSUME_YES` | `false` | Skip the review screen shown when the configuration file already supplies every required value. | +| `--dry-run` | `DRY_RUN` | `false` | Print the planned actions and exit without installing. Needs no TLS files and writes no configuration file. | +| `--log-level` | `LOG_LEVEL` | `info` | Detail written to the log file: `debug`, `info`, `warn`, or `error`. | +| `--postgres-data-dir` | `POSTGRES_DATA_DIR` | none | Custom directory for the application database's data. | +| `--clickhouse-data-dir` | `CLICKHOUSE_DATA_DIR` | none | Custom directory for the analytics store's data. | +| `--skip-preflight` | `SKIP_PREFLIGHT` | `false` | Skip the preflight checks. Intended for testing only. | +| `--version` | — | — | Print the installer version and exit. | +| `--help` | — | — | Print flag help and exit. | + +The defaults for `--tls-cert` and `--tls-key` apply only when you omit both flags. Supplying one without the other is an error: `--tls-cert and --tls-key must both be provided together`. + +A custom data directory must be an absolute path to an existing, writable directory. It can't be `/`, can't sit under `/bin`, `/sbin`, `/boot`, `/dev`, `/etc`, `/lib`, `/lib64`, `/proc`, `/root`, `/run`, `/sys`, `/usr`, or `/var/log`, and can't contain quotes, backslashes, dollar signs, or backticks. + +### Value Checks + +The installer rejects bad values before it changes anything on the server. + +| Value | Rules | +|---|---| +| License key | Letters, digits, hyphens, and underscores only. Checked online; an expired, suspended, unknown, or invalid key stops the install with exit code 10. If the installer can't reach the licensing service, it warns and continues. | +| Hostname | Must contain a dot, must not be an IP address, must not end in `.localhost`, and must not exceed 253 characters. Each dot-separated part is 1 to 63 letters, digits, or hyphens and can't start or end with a hyphen. | +| First administrator email | A plain address such as `admin@corp.example.com`, with a dotted domain and without a display name, quotes, backslashes, or spaces. Lowercased before use. | +| TLS certificate and key | PEM. The pair must match, the certificate must not be expired, and its Subject Alternative Names must include the hostname. A certificate that expires within 30 days produces a warning in the log. | +| CA bundle | PEM with at least one certificate. The TLS certificate must chain to it. If the TLS certificate is self-signed and you give no bundle, the installer uses the certificate as its own bundle. | + +## Configuration File + +The installer keeps its answers in `/etc/dspm/installer.yaml`. It writes the file itself: after every confirmed prompt in an interactive run, or once after license validation in a flag-driven run. On the first save it prints `Progress saved to /etc/dspm/installer.yaml — future runs will pre-fill these values.` A later run reads the file and asks only for what's still missing, so a canceled install resumes where it stopped. + +Keys are the flag names. The installer writes `license-key`, `hostname`, `first-admin-email`, `first-admin-name`, `tls-cert`, `tls-key`, and `ca-bundle`, plus `target-revision` when you pin a version other than `1.*`. It keeps any keys you add, and never saves operational flags such as `--accept-warnings`, `--assume-yes`, `--dry-run`, and `--skip-preflight`. You can also write the file by hand before the first run. + +```yaml title="/etc/dspm/installer.yaml" +license-key: XXXX-XXXX-XXXX-XXXX-XXXX-V3 +hostname: dspm.corp.example.com +first-admin-email: admin@corp.example.com +first-admin-name: Alice Smith +tls-cert: /etc/dspm/tls.crt +tls-key: /etc/dspm/tls.key +ca-bundle: /etc/dspm/ca-bundle.pem +``` + +The file holds the license key, so the installer creates it owned by root with mode `0600` inside a `0755` directory. A later run without `sudo` can't read it; the error ends with `re-run with sudo, or remove the file`. If `/etc/dspm/installer.yaml` doesn't exist, the installer also looks for `~/.dspm/installer.yaml`. `--dry-run` never writes the file. + +When the file supplies every required value and the installer runs in a terminal, it first asks **Show advanced settings?** (the default is **No**), then shows the review screen and asks **Everything look good?** before it starts. Declining the review prints `Config file /etc/dspm/installer.yaml was loaded — edit or delete that file, or override individual values with flags.` Pass `--assume-yes` to skip both questions. + +## Exit Codes + +| Code | Meaning | +|---|---| +| 0 | Success. | +| 1 | General failure: an invalid flag value, a hostname or TLS validation error, a required value missing in a non-interactive run, or prompts canceled with Esc or Ctrl-C (`installation cancelled`). | +| 10 | License key error. The key is expired, suspended, not found, or invalid. | +| 20 | The release version requested with `--target-revision` isn't available for this license key. | +| 50 | The installer couldn't install the platform, or the platform didn't become ready within 5 minutes. | +| 60 | The installer couldn't install a platform component. | +| 70 | The Access Analyzer services didn't all become healthy within 30 minutes, or you pressed Ctrl-C while waiting for them. | +| 71 | A service stayed in a failed state for 5 minutes. Only `wait-for-apps` returns this code; during an install the same condition exits 70. | +| 80 | Preflight checks failed (`preflight checks failed`), or you didn't accept warnings (`preflight warnings detected; use --accept-warnings to continue` or `installation stopped at preflight warnings`). | + +## Preflight Checks + +Eleven checks run before the installer changes anything on the server, in the order the following table lists them. Each ends as PASS, WARN, or FAIL. The installer prints only WARN and FAIL results, as ` [FAIL] ` or ` [WARN] `. Any FAIL stops the install; `--accept-warnings` doesn't override it. Any WARN stops it too unless you answer **Yes** to **Continue despite these warnings?** or pass `--accept-warnings`. + +The installer compares RAM and disk against their thresholds with a 5% tolerance, so a virtual machine provisioned at exactly the stated figure passes. It compares CPU cores exactly. + +| Check | What it tests | Result when not met | Message | +|---|---|---|---| +| `ram` | Total RAM against the minimum for the chosen size. | FAIL | ` GB RAM; the size requires GB` | +| `cpu` | CPU cores against the minimum for the chosen size. | FAIL | ` CPU cores; the size requires ` | +| `disk` | Free space on `/var/lib` against the 40 GB floor. | FAIL | ` GB free on /var/lib; at least 40 GB is needed to install` | +| `disk` | Free space on `/var/lib` against the size's recommended disk. | WARN | ` GB free on /var/lib; the size is designed to hold GB, so it will run out as data accumulates` | +| `cgroups` | The kernel exposes cgroups at `/sys/fs/cgroup`. | FAIL | `cgroups not available at /sys/fs/cgroup` | +| `kernel-modules` | The `br_netfilter` and `overlay` modules are loaded or built in. The install loads missing modules itself, so this check warns only when it can't inspect a module, or during a dry run when a module isn't loaded. | WARN | `kernel module issues: : could not check module: ` or `kernel module issues: : not loaded (dry run; will not be modprobed)` | +| `os` | The Linux distribution belongs to a recognized family. | WARN | `unrecognised Linux distribution; installation may not be supported` | +| `selinux` | SELinux isn't in enforcing mode. | WARN | The message says SELinux is enforcing and asks you to allow the platform's container policy or set SELinux to permissive. | +| `antivirus` | No known antivirus product is installed or running: `mdatp`, CrowdStrike, ClamAV, Sophos, Carbon Black, or Trend Micro. | WARN | `antivirus software detected: (exclusion hint: )` | +| `network` | Each of the 18 required hosts resolves in DNS and accepts a connection on port 443 within 5 seconds. | FAIL when a name doesn't resolve; WARN when a connection times out or is refused | `DNS resolution failed for: ` or `connection failed (timeout/refused) for: ` | +| `domain-join` | Whether the server belongs to an Active Directory domain. Informational only. | — | `no AD domain detected`, or a message naming the detected domain | +| `clock-sync` | A time-sync service (`chronyd`, `ntpd`, or `systemd-timesyncd`) is running. | WARN | `no clock sync daemon detected; Kerberos authentication requires clocks within 5 minutes of the AD domain controller — install chronyd, ntpd, or systemd-timesyncd to eliminate clock-skew risk` | + +When the `antivirus` check finds a product, add these paths to that product's exclusion list: `/var/lib/rancher/k3s/agent/containerd`, `/var/lib/rancher/k3s/data`, and `/run/k3s/containerd`. The hint in the message names the product's own command or console for adding exclusions. + +The [Requirements](requirements.md) page lists the 18 hosts the `network` check connects to and the CPU, RAM, and disk figures for each size. + +## The `wait-for-apps` Command + +`wait-for-apps` repeats the readiness wait without reinstalling anything. Use it when an install stopped while waiting for the services, or to check whether they're all ready. + +```bash +sudo dspm-installer wait-for-apps +``` + +It prints `Waiting for applications to become Synced and Healthy…` and exits when every service is healthy. + +| Flag | Default | Description | +|---|---|---| +| `--timeout` | `30m0s` | Maximum time to wait. | + +Exit codes: 0 when everything is healthy, 70 when the timeout passes, 71 when a service stays in a failed state for 5 minutes, and 1 for any other error. Ctrl-C exits 1. + +## Logs + +| File | Contents | +|---|---| +| `/var/log/dspm-installer.log` | Everything the installer does, as one JavaScript Object Notation (JSON) object per line, at the detail set by `--log-level`. The installer appends to the file on every run, with mode `0640`. If the installer can't write the file, it sends the same output to the terminal's standard error as text. | +| `/var/log/dspm-preflight.json` | The full result of the most recent preflight run: `timestamp`, `overallStatus`, and a `checks` list with `name`, `status`, and `message` for every check, including the ones that passed. `--dry-run` doesn't write it. | diff --git a/docs/accessanalyzer/26.1/install/requirements.md b/docs/accessanalyzer/26.1/install/requirements.md new file mode 100644 index 0000000000..7b5413a2e9 --- /dev/null +++ b/docs/accessanalyzer/26.1/install/requirements.md @@ -0,0 +1,125 @@ +--- +title: Requirements +description: Server sizing, hostname, network ports, TLS certificate, license key, first administrator, and browser requirements for installing Access Analyzer. +sidebar_position: 1 +--- + +Gather everything on this page before you run the installer. The installer runs a preflight check on the server first and stops if the server doesn't meet the hard requirements, so a few minutes here saves a failed installation later. + +## Server + +Access Analyzer installs on a single Linux server, physical or virtual. + +| Requirement | Details | +|---|---| +| Operating system | Ubuntu. Any Debian-based distribution should work. The installer doesn't check the release version. | +| Architecture | 64-bit x86 or Arm. | +| Access | Root, either directly or through `sudo`. | +| Free disk on `/var/lib` | At least 40 GB for every [size](#size). Access Analyzer stores its data under `/var/lib`. | + +On a distribution the installer doesn't recognize, the preflight check reports a warning instead of stopping, and you can choose to continue at your own risk. + +## Size + +You pick a size when you install. The size sets the CPU and RAM the installer requires, the disk it recommends, and how much capacity Access Analyzer reserves for itself. _The default is **medium**_. + +| Size | CPU cores | RAM | Disk | Designed for | +|---|---|---|---|---| +| small | 8 | 32 GB | 400 GB | Up to about 25 million objects and fewer than 5,000 identities. | +| medium | 16 | 64 GB | 1,000 GB | Up to about 200 million objects and 5,000 to 25,000 identities. | +| large | 24 | 96 GB | 3,000 GB | Up to about 800 million objects and 25,000 to 100,000 identities. | +| enterprise | 32 | 128 GB | 8,000 GB | Up to about 3 billion objects and more than 100,000 identities. | + +CPU cores and RAM are hard minimums: the installer's preflight check fails below them, and the install doesn't proceed. The check allows a 5% tolerance on RAM and disk, so a virtual machine provisioned at exactly the stated figure passes even though the guest sees slightly less. + +Disk is a recommendation. A server with less free space than the size recommends still installs and runs, but the preflight check warns that the disk is too small for the data that size is designed to hold. The 40 GB floor is different: below that, the preflight check fails. + +For example, a virtual machine with 16 cores, 64 GB of RAM, and 600 GB free on `/var/lib` installs as **medium** with a disk warning you can accept. The same machine with 12 cores fails preflight for **medium**; install it as **small** or add cores. + +If you want the data on a different volume, the installer accepts custom data directories. They must be absolute paths to existing, writable directories, and can't be `/` or sit under a reserved system path such as `/etc`, `/usr`, or `/var/log`. See [Installer reference](installer-reference.md) for the flags. + +## Hostname + +The server needs a fully qualified domain name, such as `access-analyzer.corp.example.com`, that users' browsers can resolve. The installer lowercases it and rejects anything that isn't a valid name: + +- It must contain a dot. +- It can't be an IP address. +- It can't end in `.localhost`. +- It can't exceed 253 characters, and each dot-separated part must be 1 to 63 letters, digits, or hyphens, with no hyphen at the start or end. + +Create the DNS record before you install. The TLS certificate's Subject Alternative Names must cover this name. + +## TLS Certificate + +Access Analyzer serves the web application **only** over HTTPS, and the installer never generates a certificate. You supply one. + +| Item | Requirement | +|---|---| +| Certificate | PEM format, full chain, leaf certificate first. Its Subject Alternative Names must include the hostname; the Common Name alone isn't enough. It must not be expired. | +| Private key | PEM format, unencrypted, and the key that matches the certificate. | +| CA bundle | Optional. PEM format. Needed only when a private certificate authority (CA) issued the certificate, so that the certificate chains to it. | + +The installer looks for the certificate at `/etc/dspm/tls.crt` and the key at `/etc/dspm/tls.key` unless you point it elsewhere. A self-signed certificate works, and the installer uses it as its own CA bundle, but browsers warn users about it. + +## License Key + +You need a Netwrix license key in the form `XXXX-XXXX-XXXX-XXXX-XXXX-V3`. The installer validates it online during the install, so the server must reach the licensing endpoints listed under [Outbound](#outbound). An expired, suspended, or unknown key stops the install. + +## First Administrator + +The installer creates the first administrator account and prints a temporary password at the end of the install. Have that person's email address ready; it becomes their username. Their full name is optional. + +## Network + +### Inbound + +Open these ports on the server's firewall. + +| Port | Protocol | From | Purpose | +|---|---|---|---| +| 443 | TCP | Users' browsers and agent hosts | The Access Analyzer web application. | +| 80 | TCP | Users' browsers | Redirects HTTP requests to HTTPS. | +| 4504 | TCP | Netwrix Activity Monitor | Receives activity data. Open it only if you use [Netwrix Activity Monitor](../integrations/netwrix-activity-monitor.md). | +| 6443 | TCP | Agent hosts | Lets [agents](../agents/index.md) connect back to the server. Open it only to the hosts you deploy agents on. | + +### Outbound + +The installer downloads everything it needs during the install, and the running product keeps a small number of outbound connections afterwards. Allow TCP 443 from the server to each of these hosts. The preflight check tests every one of them: it fails if a name doesn't resolve in DNS and warns if a connection times out or is refused. + +| Host | Purpose | +|---|---| +| `api.keygen.sh` | License validation and release lookups. | +| `oci.pkg.keygen.sh` | Software distribution. | +| `raw.pkg.keygen.sh` | Software distribution. | +| `keygen-dist.c3c9112df8df715f42d1162cdce5dba1.r2.cloudflarestorage.com` | Software distribution. | +| `get.k3s.io` | Platform component downloads. | +| `rpm.rancher.io` | Installer downloads. | +| `github.com` | Platform component downloads. | +| `api.github.com` | Platform component downloads. | +| `raw.githubusercontent.com` | Platform component downloads. | +| `release-assets.githubusercontent.com` | Platform component downloads. | +| `ghcr.io` | Platform component downloads. | +| `pkg-containers.githubusercontent.com` | Platform component downloads. | +| `registry-1.docker.io` | Platform component downloads. | +| `auth.docker.io` | Platform component downloads. | +| `production.cloudflare.docker.com` | Platform component downloads. | +| `docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com` | Installer downloads. | +| `d2glxqk2uabbnd.cloudfront.net` | Installer downloads. | +| `storage.googleapis.com` | Installer downloads. | + +Some features add outbound connections of their own after you configure them. + +| Host | Port | When it's needed | +|---|---|---| +| `login.microsoftonline.com`, `sts.windows.net` | TCP 443 | You use Entra ID as the identity provider. | +| `graph.microsoft.com` | TCP 443 | You add an Entra ID or SharePoint Online source. | +| Domain controllers | TCP 636 | You use Active Directory as the identity provider. The connection uses Lightweight Directory Access Protocol (LDAP) over TLS (LDAPS). | +| Domain controllers | TCP 389 | You scan an Active Directory source. The connection uses LDAP (default port). | +| File servers | TCP 445 | You scan an SMB file server source (default port). | +| Agent hosts | TCP 22 | You deploy an agent over SSH (default port, configurable). | + +## Browser + +Any modern browser should work. Netwrix doesn't support or recommend Internet Explorer. + +Once everything on this page is in place, continue to [Install Access Analyzer](run-the-installer.md). diff --git a/docs/accessanalyzer/26.1/install/run-the-installer.md b/docs/accessanalyzer/26.1/install/run-the-installer.md new file mode 100644 index 0000000000..30b9025f4e --- /dev/null +++ b/docs/accessanalyzer/26.1/install/run-the-installer.md @@ -0,0 +1,150 @@ +--- +title: Install Access Analyzer +description: Download the installer, copy the TLS certificate to the server, and run dspm-installer by answering prompts or passing flags. +sidebar_position: 2 +--- + +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + +The installer is a single Linux binary, `dspm-installer`. Run it as root on the server, and it checks the hardware, asks for anything you haven't supplied, sets up every service, and prints the address and credentials for the first sign-in. + +Before you start, work through [Requirements](requirements.md). You need the license key, the server's fully qualified hostname, the TLS certificate and private key files, and the email address & name of the first administrator at hand. + +## Download the Installer + +1. Download the Access Analyzer installer for your server's architecture from the download link Netwrix supplied with your license: `dspm-installer-linux-amd64` for 64-bit x86 or `dspm-installer-linux-arm64` for Arm. +2. Copy the file to the server, for example with `scp`. +3. Rename it. + + ```bash + mv dspm-installer-linux-amd64 dspm-installer + ``` + +4. Make it executable. + + ```bash + chmod +x dspm-installer + ``` + +5. Confirm it runs. + + ```bash + ./dspm-installer --version + ``` + +## Copy the TLS Certificate to the Server + +The installer expects the certificate at `/etc/dspm/tls.crt` and the private key at `/etc/dspm/tls.key`. If you keep them somewhere else, enter the paths when the installer prompts for them, or pass them with `--tls-cert` and `--tls-key`. + +1. Create the directory. + + ```bash + sudo mkdir -p /etc/dspm + ``` + +2. Move the certificate and key into place. + + ```bash + sudo mv /path/to/your.crt /etc/dspm/tls.crt + sudo mv /path/to/your.key /etc/dspm/tls.key + ``` + +3. Restrict the key to root. + + ```bash + sudo chmod 600 /etc/dspm/tls.key + ``` + +If a private certificate authority (CA) issued the certificate, copy its CA bundle too. `/etc/dspm/ca-bundle.pem` is a convenient place; the installer asks for the path. + +## Run the Installer + +Run the installer with `sudo`. The `-E` flag carries your environment through to root, which matters if you export the license key as `LICENSE_KEY` instead of typing it. + +```bash +sudo -E ./dspm-installer +``` + +If your `sudo` policy doesn't allow `-E`, pass the variable inline instead: `sudo LICENSE_KEY="$LICENSE_KEY" ./dspm-installer`. + +The installer runs its preflight checks first, then collects any value it doesn't have yet. You can let it ask, or supply everything up front. + + + + +When you run the installer with no flags in a terminal, it asks for each value it needs, one screen at a time. It asks only for values it doesn't already have, so a re-run skips what you answered before. + +1. **License Key** - paste your Netwrix license key in the form `XXXX-XXXX-XXXX-XXXX-XXXX-V3`. The installer validates it online before moving on. +2. **Hostname** - enter the fully qualified domain name users open in their browsers, for example `dspm.corp.example.com`. If the server's own name is a valid choice, the installer offers it as a suggestion. +3. **First Admin Email** and **First Admin Name** - enter the email address of the first administrator, and optionally their full name. The address becomes their username. +4. **TLS Certificate File**, **TLS Private Key File**, and **CA Bundle File (optional)** - press Enter to accept `/etc/dspm/tls.crt` and `/etc/dspm/tls.key`, or enter other paths. Fill in the CA bundle only if a private certificate authority issued the certificate. The installer checks that the certificate and key match, that the certificate hasn't expired, and that it covers the hostname you entered. +5. **Show advanced settings?** - select **No**. +6. Check the review screen. It lists the hostname, the certificate path (and the CA bundle path if you gave one), the first administrator, and a masked license key. +7. Answer **Yes** to **Everything look good?** + +The installer saves each answer to `/etc/dspm/installer.yaml` as soon as you confirm it. On the first save it prints `Progress saved to /etc/dspm/installer.yaml — future runs will pre-fill these values.` If you cancel with Esc or Ctrl-C, the installer exits with `installation cancelled`, and your answers stay in that file for the next run. + + + + +Pass every value as a flag and the installer asks nothing. Use this form in scripts or over a connection without a terminal, where the installer can't prompt and exits with an error for any missing value. + +```bash +sudo ./dspm-installer \ + --license-key "" \ + --hostname dspm.corp.example.com \ + --tls-cert /etc/dspm/tls.crt \ + --tls-key /etc/dspm/tls.key \ + --size medium \ + --first-admin-email admin@corp.example.com \ + --first-admin-name "Alice Smith" \ + --accept-warnings +``` + +`--accept-warnings` lets the install continue past preflight warnings. Without a terminal the installer can't ask you, so it stops on warnings unless you pass this flag. Leave it out the first time if you'd rather see the warnings and decide. + +`--size` defaults to `medium` when you omit it. Pass `--tls-cert` and `--tls-key` together; if you omit both, the installer uses `/etc/dspm/tls.crt` and `/etc/dspm/tls.key`. Add `--ca-bundle ` for a certificate from a private certificate authority. + +If `/etc/dspm/installer.yaml` exists from an earlier run and you're in a terminal, the installer still asks **Show advanced settings?** and shows the review screen before it starts. Add `--assume-yes` to skip both. + +Every flag also has an environment variable, listed in the [Installer reference](installer-reference.md). + + + + +## Preflight Checks + +The installer checks the server first, under the heading `Running preflight checks...`. Checks that pass are silent. Each failure or warning gets its own line, tagged `[FAIL]` or `[WARN]`, for example: + +```text + [FAIL] 48.0 GB RAM; the medium size requires 64 GB + [WARN] clock-sync no clock sync daemon detected +``` + +A `[FAIL]` stops the install. There's no way to override it: fix the server or choose a smaller size, then run the installer again. Failures cover CPU cores, RAM, the 40 GB disk floor, DNS resolution of the hosts the installer downloads from, and the availability of cgroups, a kernel feature the platform depends on. + +A `[WARN]` is a condition the install can continue past, such as less disk than the size recommends, no time-sync service, or antivirus software that may need exclusions. In a terminal the installer asks **Continue despite these warnings?**; answer **Yes** to go on. Without a terminal, warnings stop the install unless you pass `--accept-warnings`. + +The full list of checks, thresholds, and messages is in the [Installer reference](installer-reference.md#preflight-checks). The installer also writes the complete result of each run to `/var/log/dspm-preflight.json` (a `--dry-run` doesn't write it). + +## Install Phases + +After the checks and prompts, the installer validates the certificate and hostname, confirms the license key online, and saves your answers. Then it works through these phases, printing a progress line for each: + +1. Sets up the platform Access Analyzer runs on. The installer waits up to 5 minutes for it to become ready. +2. Downloads and starts the Access Analyzer services. A live line reads `Starting Access Analyzer ( of services running)` and counts up. The installer waits up to 30 minutes for every service to become healthy. +3. Creates the first administrator account, under `Provisioning first admin user...`. + +If the platform or the services don't become ready inside those limits, the installer stops with a non-zero exit code; the [Installer reference](installer-reference.md#exit-codes) lists the codes. If creating the first administrator fails, the installer prints a warning and still finishes. The installer logs everything it does to `/var/log/dspm-installer.log`. + +## Install Summary + +The installer prints a summary. It contains: + +- The web application URL, `https://`. +- **First Admin Credentials**: the **Username**, which is the email address you gave, and a one-time **Password**. +- A reminder to allow inbound port 443 through the firewall. +- The installation log path, `/var/log/dspm-installer.log`. + +Copy the password somewhere safe. It works once, and Access Analyzer asks you to replace it when you first sign in. Then open the URL in a browser and continue with [Sign in for the first time](first-sign-in.md), which also explains how to read the password back from the server if you lose it. diff --git a/docs/accessanalyzer/2601/configurations/_category_.json b/docs/accessanalyzer/26.1/integrations/_category_.json similarity index 50% rename from docs/accessanalyzer/2601/configurations/_category_.json rename to docs/accessanalyzer/26.1/integrations/_category_.json index e493e2c253..6a8f38c644 100644 --- a/docs/accessanalyzer/2601/configurations/_category_.json +++ b/docs/accessanalyzer/26.1/integrations/_category_.json @@ -1,6 +1,6 @@ { - "label": "Configuration", - "position": 16, + "label": "Integrations", + "position": 100, "collapsed": true, "collapsible": true } diff --git a/docs/accessanalyzer/26.1/integrations/index.md b/docs/accessanalyzer/26.1/integrations/index.md new file mode 100644 index 0000000000..1aa353969d --- /dev/null +++ b/docs/accessanalyzer/26.1/integrations/index.md @@ -0,0 +1,8 @@ +--- +title: Integrations +description: How Netwrix Activity Monitor connects to Access Analyzer and what it adds. +--- + +Access Analyzer integrates with [Netwrix Activity Monitor](netwrix-activity-monitor.md). Activity Monitor sends Access Analyzer the activity it records on file servers, SharePoint Online, and Microsoft 365 Copilot. You enroll an Activity Monitor agent with Access Analyzer using a short-lived enrollment token; after that the agent connects without it. The agent streams its events to the Access Analyzer server over TLS on port 4504. + +Scans tell you what data exists and who can reach it. Activity tells you who used that access, what they did, and when. With the integration in place, the **Activity** tab of the [Data security dashboard](../dashboards-reports/dashboards/data-security.md) breaks events down by type, data source, and user, and charts activity over time. The Activity Investigation report and the **Activity** tab of the Share Audit report in [Data reports](../dashboards-reports/reports/data.md) draw on the file server events from the same feed. All three stay empty until you enroll an agent and it starts sending data. diff --git a/docs/accessanalyzer/26.1/integrations/netwrix-activity-monitor.md b/docs/accessanalyzer/26.1/integrations/netwrix-activity-monitor.md new file mode 100644 index 0000000000..8960891478 --- /dev/null +++ b/docs/accessanalyzer/26.1/integrations/netwrix-activity-monitor.md @@ -0,0 +1,136 @@ +--- +title: Netwrix Activity Monitor +description: Enroll a Netwrix Activity Monitor agent with Access Analyzer so file, SharePoint Online, and Copilot activity appears in the Data security dashboard, and file server activity in the Activity Investigation and Share Audit reports. +sidebar_position: 1 +--- + +Netwrix Activity Monitor records who did what in the systems it monitors. Access Analyzer knows what data you have and who can reach it. Connect the two and Access Analyzer also knows who actually opened, changed, or deleted that data on file servers, in SharePoint Online, and in Microsoft 365 Copilot. You can see, for example, which users touched sensitive files on a share that's open to everyone. + +The connection is one-way: an Activity Monitor agent sends events to the Access Analyzer server over a Transmission Control Protocol (TCP) connection on port 4504, secured with TLS. + +## How the Integration Works + +Setup is a one-time enrollment, followed by a continuous stream of events. + +```mermaid +sequenceDiagram + participant Admin + participant AA as Access Analyzer + participant AM as Activity Monitor agent + Admin->>AA: Generate token + AA-->>Admin: Token (valid one hour) + Admin->>AM: Enter server, port 4504, and token + AM->>AA: Connect over TLS on port 4504 + AM->>AA: Enroll with token + AA-->>AM: Enrolled, certificates trusted both ways + loop After enrollment + AM->>AA: Activity events + end +``` + +Once Access Analyzer accepts the token, each side remembers the other's certificate, and the agent never needs the token again. From then on the agent sends events as they happen, and Access Analyzer stores them alongside its scan results. + +The Activity Monitor output sends three kinds of events: File System, SharePoint Online, and Microsoft 365 Copilot. + +## Where the Data Appears + +Activity data shows up in three places. Only the dashboard includes SharePoint Online and Copilot events; the two reports cover file server activity. + +- The [Data security dashboard](../dashboards-reports/dashboards/data-security.md) has an **Activity** tab with the tiles **Total Events**, **Failed Events**, **Active Users**, and **Data Sources with Activity**; the charts **Events by Type**, **Activity Over Time**, **Events by Data Source**, and **Top Users by Activity**; and an **Activity Detail** table. Filter it by **Start Date**, **End Date**, **Event Type**, **Activity Source**, **User**, and **Event Status**. +- The **Activity Investigation** report under [Data reports](../dashboards-reports/reports/data.md). Every framework under [Compliance reports](../dashboards-reports/reports/compliance.md) includes it too. +- The **Share Audit** report, also under Data reports, draws on file server activity in its **Activity** tab, in the **Probable Owner** card on the **Overview** tab, and in the **Users by Activity on Sensitive Files** chart on the **Sensitive Data** tab. + +Until an enrolled agent sends events, every card on the **Activity** tab reads **No results!**. + +![Data security dashboard, Activity tab, with date, event type, source, user, and status filters](/images/accessanalyzer/26.1/dashboards-reports/data-security-dashboard-activity.webp) + +## Prerequisites + +- **Activity Monitor version.** Netwrix Activity Monitor 10.0 with an output of type **Access Analyzer 26**. The [Activity Monitor documentation](/docs/activitymonitor/10_0/admin/outputs/accessanalyzer26) covers adding and editing that output. +- **Network path.** The host running the Activity Monitor agent must reach the Access Analyzer server on TCP port 4504. Open that port inbound on the server's firewall and on anything between the two hosts. +- **TLS certificate.** The Access Analyzer listener on port 4504 presents the same TLS certificate as the web interface, the one you supplied when you [installed Access Analyzer](../install/run-the-installer.md). The connection uses TLS 1.3. If the certificate has expired, the listener doesn't start and agents can't connect. +- **Admin role.** Only an Admin sees the **Enrollment token** panel, generates tokens, and changes the connection settings. A Viewer can see the connection settings but not change them. See [Users and roles](../settings/users.md). + +## Generate an Enrollment Token + +1. Sign in to Access Analyzer as an Admin. +2. Go to **Settings > Application**. +3. Scroll to the **Netwrix Activity Monitor** card. The **Enrollment token** panel is at the bottom of the card, below the four connection settings. +4. Click **Generate token**. If a token already exists, the button reads **Generate new token** instead. +5. Click the **Copy** icon next to the token. The message **Token copied to clipboard** confirms it. + +![Application settings tab showing the Classification and Netwrix Activity Monitor cards and the Enrollment token panel](/images/accessanalyzer/26.1/settings/application-full.webp) + +The panel shows the token in a read-only field with an **Expires** line under it. Three things about the token matter when you plan an enrollment session: + +- It's valid for one hour, so generate it right before you start enrolling. After an hour Access Analyzer rejects it and you generate a new one. +- Generating a new token invalidates any earlier token. Only the newest token works. Don't click **Generate new token** while a colleague is still enrolling with the previous one. +- One token can enroll several agents. The first enrollment doesn't consume it. If you have five Activity Monitor agents to connect, generate one token and use it for all five within the hour. + +For example, a token generated at 09:00 expires at 10:00. Between those times you can enroll as many agents as you like with it. At 09:30, if you generate another token, the 09:00 token stops working immediately, even though it hasn't reached its expiry time. + +If the panel is disabled, the port 4504 listener has no TLS certificate and Access Analyzer can't issue a token. The panel shows **NAM listener certificate isn't configured on this server.** NAM is short for Netwrix Activity Monitor. The listener uses the certificate you supplied at installation; see [Troubleshooting](#troubleshooting). + +## Enroll the Activity Monitor Agent + +The rest of the setup happens in Activity Monitor. The following steps are the outline; the field-by-field description is in the Activity Monitor documentation for the [Access Analyzer 26 output](/docs/activitymonitor/10_0/admin/outputs/accessanalyzer26). + +1. In Activity Monitor, add an output of type **Access Analyzer 26**, or open the properties of an existing one. +2. In **Server in SERVER:PORT format**, enter the Access Analyzer server and the listener port, for example `aa.corp.example.com:4504`. A short name, fully qualified domain name (FQDN), or IP address all work, as long as the agent can resolve it. +3. In **Enrollment Token**, paste the token you copied from Access Analyzer. +4. Click **Enroll**. + +The agent connects, checks that the server's certificate matches the one described in the token, and sends the token. Access Analyzer accepts it, records the agent, and events start flowing. Repeat for each agent, reusing the same token while it's valid. + +## Certificate Trust After Enrollment + +Enrollment does more than check the token. The token carries a fingerprint of the public key in the Access Analyzer server's TLS certificate, so the agent knows it has reached the right server before it sends anything. In return, Access Analyzer records the fingerprint of the public key in the agent's certificate. Renewing a certificate with the same key pair keeps that trust intact. From then on the two sides recognize each other by those certificates alone. + +That trust depends on the certificates in use at enrollment time: + +- If you replace the Access Analyzer TLS certificate with one that uses a different key pair, enrolled agents no longer trust the server. Generate a new token and enroll each agent again. +- If an agent's certificate changes, for example because it generated a new key pair, Access Analyzer no longer trusts that agent. Enroll it again with a fresh token. + +Access Analyzer treats an agent that connects with an unrecognized certificate as new: the agent has 10 seconds by default to present a valid token before Access Analyzer disconnects it. + +## Connection Settings + +The four settings in the **Netwrix Activity Monitor** card on **Settings > Application** tune how the listener treats agent connections. The defaults suit most environments. Each row shows its setting key, with the allowed range under the field. To change a value, edit it and click **Save changes** in the bar that appears at the bottom of the page. Changes apply to new connections without a restart. [Application settings](../settings/application.md) describes how the settings page itself behaves, including the **Overridden** badge and the reset-to-default control. + +| Setting | Default | Range | What it controls | +|---|---|---|---| +| `activitymonitor_connection_timeout` | 900 | 5–3600 | Seconds of inactivity before Access Analyzer drops an idle Activity Monitor agent. | +| `activitymonitor_enrollment_ban_duration_seconds` | 10 | 5–300 | Seconds to ban a source IP after it presents an invalid enrollment code (the code is the part of the token the agent sends). | +| `activitymonitor_enrollment_first_message_timeout_seconds` | 10 | 5–60 | Seconds to wait for the first message from a newly connected Activity Monitor agent. | +| `activitymonitor_max_message_size` | 16777216 | 65536–67108864 | Maximum size in bytes of a single Activity Monitor message (default 16 MB). | + +For example, with the default `activitymonitor_connection_timeout` of 900, Access Analyzer disconnects an agent that sends nothing for 15 minutes. Raise it to 3600 to keep a quiet agent connected for up to an hour. + +## Troubleshooting + +The listener writes to the application logs. + +1. Go to **Settings > System logs**. Only an Admin can open this tab. +2. In **Component**, select `nam-listener`. +3. Set **From** and **To** to the window in which you tried to enroll. + +The [System logs](../settings/system-logs.md) page explains the filters and the **Log details** drawer. + +The listener logs these messages: + +| Message | Meaning | +|---|---| +| `nam listener: bound` | The listener started and is accepting connections on port 4504. | +| `nam listener: connection limit reached, rejecting` | The listener is at its limit of 100 simultaneous connections and refused a new one. | +| `nam listener: TLS certificate expires soon` | The certificate is close to its expiry date. Renew it before then; the listener doesn't start with an expired certificate. | +| `nam writer: unknown activity type, dropped` | An event arrived with an activity type Access Analyzer doesn't store, so Access Analyzer dropped it. | + +Match the symptom to its likely cause: + +| Symptom | Likely cause | What to do | +|---|---|---| +| **Enroll** fails and nothing appears in the logs for that time | TCP port 4504 is blocked between the agent host and the Access Analyzer server. | Open the port on the server's firewall and any firewall in between. Confirm the agent host can resolve the server name you entered. | +| **Enroll** fails even though the agent reaches the server | The token is more than an hour old, or someone clicked **Generate new token** after you copied it. | Generate a new token and enroll again. After a rejected token, Access Analyzer ignores connections from that agent's IP address for `activitymonitor_enrollment_ban_duration_seconds` (10 seconds by default), so wait before retrying. | +| Every agent stopped sending data at the same time | The listener is no longer running because the Access Analyzer TLS certificate has expired, or someone replaced the certificate with one that uses a different key pair, so enrolled agents no longer recognize the server. | Check **Settings > System logs** for `nam listener: bound` after the last restart. If the certificate has expired, renew it; see [Install Access Analyzer](../install/run-the-installer.md). If someone replaced it with a different key pair, generate a new token and enroll each agent again. | +| One agent stopped sending data after a change on its host | The agent's certificate changed. | Enroll that agent again. | +| The **Enrollment token** panel is disabled with **NAM listener certificate isn't configured on this server.** | The listener has no TLS certificate to present, so Access Analyzer can't issue tokens. | The listener uses the certificate supplied during installation. Confirm the installation completed with a valid certificate and key; see [Install Access Analyzer](../install/run-the-installer.md). | diff --git a/docs/accessanalyzer/26.1/key-concepts.md b/docs/accessanalyzer/26.1/key-concepts.md new file mode 100644 index 0000000000..2bd5e284ff --- /dev/null +++ b/docs/accessanalyzer/26.1/key-concepts.md @@ -0,0 +1,64 @@ +--- +title: Key Concepts +description: The terms Access Analyzer uses for what it scans, how it signs in, where scans run, and where the results appear. +sidebar_position: 3 +--- + +Most of Access Analyzer's vocabulary sits in the sidebar under **Configuration**. The following terms come in the order a new administrator meets them. + +```mermaid +flowchart LR + A[Service Account] -- signs in to --> B[Source] + B -- targeted by --> C[Scan] + C -- routed to --> D[Agent] + D -- runs --> E[Scan Execution] + E -- fills --> F[Dashboards and Reports] +``` + +## Source and Source Type + +A source is a system that Access Analyzer connects to and scans. Its source type, one of **File Server**, **Active Directory**, **Entra ID**, or **SharePoint Online**, decides which Scan Types can run against it and which Service Account type it needs. A File Server source named `fs-finance-01` pointing at `fs01.corp.example.com` supports Access scans and Sensitive data scans. [Sources](sources/index.md) covers adding and managing them. + +## Service Account + +A Service Account is a saved credential that Access Analyzer uses to authenticate to a source. Attach it to every source that needs it, and you can rotate the secret in one place. Its type must match the source: Username/password for File Server and Active Directory, Client ID/secret for Entra ID, Client ID/certificate for SharePoint Online, and SSH username/key for deploying agents. A `corp-file-servers` account holding a domain user that can read the shares serves every File Server source in that domain. [Service accounts](service-accounts/index.md) covers each type. + +## Agent and the System Agent + +An Agent is a Linux machine that runs Access Scans. Every installation has the System agent, which runs on the Access Analyzer server and appears as **Default Agent** on the agents page; every scan runs there unless you route it elsewhere. Deploy more agents to reach segmented networks, keep scan traffic near the data, or take load off the server. An agent named `agent-london` in the London office scans the file servers there, so the traffic stays local. [Agents](agents/index.md) explains when and how to add one. + +## Label + +A label is a `key=value` pair. Source labels group sources and let a scan target every source that carries them, so a newly labeled source joins the right scans on their next run. Agent labels sit on deployed agents and tell a scan where to run. The two kinds don't interact. Give the source `fs-finance-01` the labels `site=london` and `team=finance`, and give the agent `agent-london` the agent label `site=london`; a scan can select the source by one and run on the agent by the other. See [Labels](sources/labels.md) and [Agent labels and scan routing](agents/agent-labels.md). + +## Scan and Scan Type + +A scan is a saved definition: a name, one scan type, a target, settings per source type, an agent, and a schedule. It collects nothing until it runs. The type can't change after creation, and it decides what the scan collects. An **Access Scan** inventories shares, folders, files (their metadata), sites, and their permissions. A **Sensitive Data Scan** reads file content and matches it against sensitive data patterns. An **Identity Sync** pulls users, groups, and memberships from a directory. "Finance access" is an Access Scan targeting `team=finance` sources; "Finance sensitive data" reads the same sources after the first has completed. See [Scans](scans/index.md) and [Scan types](scans/scan-types.md). + +## Schedule + +A schedule makes a scan run on its own. A scan is either manual (running only when someone clicks **Run**), or scheduled hourly, daily, weekly, or monthly at a start time saved in the time zone of the browser that saved it. A scheduled run does exactly what **Run** does, label targets included. "Finance access" set to **Daily** at 02:00 shows **Daily 2AM** on the Scans page and **Active** under **Schedule Status**. See [Schedules](scans/schedules.md) for the available options. + +## Scan Execution and Scan Target + +The scan target is the set of sources a scan covers: a fixed list (**Specific Sources**) or a rule (**Sources Matching Labels**) that Access Analyzer evaluates again at each run. A scan execution is one run of one scan against one source, with its own status, object count, duration, and logs. A "Finance access" scan, run against three `team=finance` sources, creates three executions, and one can end **Failed** while the others reach **Completed**. [Scan executions](scans/scan-executions.md) lists every status. + +## Sensitive Data Pattern and Pattern Group + +A sensitive data pattern is a regular expression with a name and a description. A pattern group collects related patterns under a name such as **PCI DSS** (Payment Card Industry Data Security Standard) or **Credentials**. Scans work at the group level: pick the groups, and every pattern in them runs. Access Analyzer ships 139 built-in patterns in 11 built-in groups. A custom employee ID pattern placed in the built-in **PII** (personally identifiable information) group runs in every scan that classifies PII. See [Sensitive data patterns](sensitive-data-patterns/index.md). + +## Dashboard and Report + +Dashboards and reports are where scan results appear. A dashboard gives the wide view of one area: counts, charts, and a detail table. A report answers one question, with filters tuned to it. Both refresh only when you click **Refresh**. After "Finance access" completes, the Data security dashboard counts the objects and permissions it collected, and the **Open Access** report lists the finance folders that Everyone or Domain Users can reach. [Dashboards and reports](dashboards-reports/index.md) maps each to the scan that feeds it. + +## Role + +A role decides what a user can do; every user holds exactly one of three. **Admin** can do everything, including changing sources, scans, agents, service accounts, patterns, and settings. **User admin** manages user accounts and single sign-on only, with no access to dashboards, sources, or scans. **Viewer** has read-only access and can pause, resume, and stop scan executions. Give the storage team's on-call engineer the Viewer role: they can follow executions and read reports without changing a scan. See [Users and roles](settings/users.md). + +## Objects and Identities + +The installer's size table measures capacity in two units: + +Objects are what an Access scan inventories: shares, folders, and files on a file server; sites, libraries, and documents in SharePoint Online. Each of these counts as an object, and the **Objects** column on the Scan executions page counts them _per run_. + +Identities are the users and groups an Identity Sync collects. A file server holding ~12 million objects, plus a domain with ~3,000 users & groups, would the **small** size in [Requirements](install/requirements.md). diff --git a/docs/accessanalyzer/26.1/known-limitations.md b/docs/accessanalyzer/26.1/known-limitations.md new file mode 100644 index 0000000000..4f59b99866 --- /dev/null +++ b/docs/accessanalyzer/26.1/known-limitations.md @@ -0,0 +1,66 @@ +--- +title: Known Limitations +description: Behaviors of Access Analyzer 26.1 to plan around, from installation and scanning to sign-in, backups, and the Netwrix Activity Monitor connection. +sidebar_position: 4 +--- + +These are behaviors of Access Analyzer 26.1 to plan around. Each item links to the page that covers it in full. + +## Installation + +The [installer](install/index.md) **must** run as root or through `sudo`; _a non-root account cannot complete it_. + +Access Analyzer serves the web application only over HTTPS, and the installer never generates a certificate, so **you must have one ready** for the server's hostname, _which must be a DNS name rather than an IP address_. See [Requirements](install/requirements.md). + +## Sources + +1. Sensitive data scans read [File Server](sources/smb-file-servers.md) content only over port 445; a source on another port can run Access scans but not Sensitive data scans. +2. Access Analyzer doesn't support the SMB 1x protocol. +3. An [Active Directory](sources/active-directory.md) source covers one domain and doesn't follow trusts, so add one source per domain. +4. You can't delete a [source](sources/index.md) while a scan execution is running or pending on it, or once scans have run against it; stop the execution or wait for it to finish first. + +## Service Accounts + +1. You can't change a [service account's](service-accounts/index.md) _type_ after you save it, and you can't delete an account while it is connected to a source. Create a new account for a different type, and point sources elsewhere before deleting. +2. Access Analyzer doesn't support passphrase-protected [SSH private keys](service-accounts/ssh-key.md). Create a key without a passphrase for agent deployment. + +## Agents + +1. You can't delete, rename, or label the [System agent](agents/index.md), and it shares the server with Access Analyzer itself, so deploy a dedicated agent for heavy scans. +2. You can't [remove an agent](agents/deploy-agent.md) while a scan is running on it, and removal leaves the agent software on the host until you uninstall it. +3. A scan [routed by label](agents/agent-labels.md) never falls back to the System agent. If no online agent carries the label, the execution waits, and Access Analyzer marks it Failed after about two hours. + +## Scans + +1. You can't change a [scan's](scans/index.md) type after creation; to collect something else, create another scan. +2. A [Sensitive data scan](scans/scan-types.md) needs a completed Access scan on the same source, because it works from that inventory. It skips files above the size limit, 10 MB by default, and files with excluded extensions, both set in [Application settings](settings/application.md). +3. After 90 days, Access Analyzer deletes [executions](scans/scan-executions.md) that end as Completed, Failed, or Cancelled; Completed with errors and Stopped executions stay until you delete the scan. An execution's **Detailed logs** tab holds the last 1,000 entries. When a failure isn't explained there, look in [System logs](settings/system-logs.md). + +## Sensitive Data Patterns + +1. You can't edit or delete [built-in patterns](sensitive-data-patterns/index.md) and groups, and there is no switch to turn off a single built-in pattern. To edit a pattern, create a custom pattern and copy the built-in pattern. +2. An empty [group selection](sensitive-data-patterns/pattern-groups.md) doesn't turn classification off; the scan classifies against every group, built-in and custom. +3. [Sensitive data scans](sensitive-data-patterns/index.md) extract text from Excel, Word, Portable Document Format (PDF), and plain text files. They don't read text in images or open encrypted documents. + +## Dashboards and Reports + +1. User admins don't see **Dashboards**, and [report](dashboards-reports/index.md) content doesn't load for them; give people who need reports the Viewer or Admin role. +2. File system permission reports show account and group names only after an Active Directory Identity Sync has run for the domain, so pair a File Server scan with an Identity Sync. The [Guides](guides/index.md) walk through both. + +## Users and Sign-in + +1. There is no self-service password reset. An Admin or User admin resets a local account's password from [**Settings > Users**](settings/users.md) if using a local account. +2. [Local accounts](settings/users.md) lock after three consecutive wrong passwords and stay locked until an Admin or User admin clicks **Unlock**. A session ends after 4 hours of inactivity or 8 hours after signing in. An account's type, local or federated, can't change after creation. +3. After you connect a [single sign-on (SSO)](settings/single-sign-on.md) provider, the web application has no control to disconnect it, replace it, connect a second one, or upload a new certificate authority (CA) certificate; keep a record of your configuration and contact Netwrix support for any of those. +4. Access Analyzer never creates users on its own: a directory user can sign in only after an Admin or User admin adds them as a **[Federated (SSO)](settings/single-sign-on.md)** account with the email address the directory reports. Directory groups don't map to roles. + +## Backups and System Logs + +1. A [backup](settings/backups.md) holds the configuration database, including settings and user accounts, but not scan results, the analytics store behind dashboards and reports, or the server's own configuration. +2. [Backups](settings/backups.md) run daily at 02:00 Coordinated Universal Time (UTC), and you can't change the time. There is no control to restore, download, or run a backup on demand; a restore is a manual procedure on the server. +3. Access Analyzer keeps [System logs](settings/system-logs.md) for 30 days, a period you can't change, and a download holds at most 10,000 entries. Split a longer range with **From** and **To**. + +## Netwrix Activity Monitor + +1. An [enrollment token](integrations/netwrix-activity-monitor.md) is valid for one hour, and generating a new token invalidates the previous one. One token can enroll several agents, so finish enrolling within the hour to avoid having to generate a new token. +2. The [listener](integrations/netwrix-activity-monitor.md) on port 4504 uses the Access Analyzer TLS certificate and doesn't start when it has expired. If you replace the certificate with one that uses a different key pair, enrolled agents stop trusting the server; generate a new token and enroll each agent again. diff --git a/docs/accessanalyzer/2601/overview/_category_.json b/docs/accessanalyzer/26.1/scans/_category_.json similarity index 53% rename from docs/accessanalyzer/2601/overview/_category_.json rename to docs/accessanalyzer/26.1/scans/_category_.json index e030b69dcf..93920f76ff 100644 --- a/docs/accessanalyzer/2601/overview/_category_.json +++ b/docs/accessanalyzer/26.1/scans/_category_.json @@ -1,6 +1,6 @@ { - "label": "Overview", - "position": 10, + "label": "Scans", + "position": 60, "collapsed": true, "collapsible": true } diff --git a/docs/accessanalyzer/26.1/scans/index.md b/docs/accessanalyzer/26.1/scans/index.md new file mode 100644 index 0000000000..cbd7a4ca7d --- /dev/null +++ b/docs/accessanalyzer/26.1/scans/index.md @@ -0,0 +1,196 @@ +--- +title: Scans +description: A scan is a saved definition of what to collect, from which sources, on which agent, and when; the Scans page is where you create, edit, run, and delete scans. +--- + +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + +A scan is a saved definition: a name, one scan type, a target, settings per source type, an agent, and a schedule. The scan collects nothing until it runs. Each run creates one scan execution per target source, and those executions are what fill the dashboards and reports. + +Three scan types exist. An **Access scan** inventories shares, folders, files, sites, and their permissions. A **Sensitive data scan** reads file content and classifies it against sensitive data patterns. An **Identity sync** pulls users, groups, and memberships from a directory. [Scan types](scan-types.md) explains what each one collects, which source types support it, and every setting. [Schedules](schedules.md) covers when scans run, and [Scan executions](scan-executions.md) covers following a run after it has started. + +## How a Scan Runs + +Whether you click **Run** or a schedule fires, the same thing happens. + +```mermaid +flowchart LR + A[Scan] --> B[Resolve the target sources] + B --> C[One execution per source] + C --> D[Agent collects the data] + D --> E[Dashboards and reports] +``` + +Access Analyzer resolves the target first. For a scan that targets specific sources, that's the list you picked. For a scan that targets sources by label, Access Analyzer looks up which sources carry the labels at that moment, so it picks up a source you labeled yesterday without any change to the scan. Each source then gets its own execution, and each execution runs on the agent the scan (or a per-source override) points at. Access Analyzer skips a source that already has an execution in progress for this scan rather than starting it twice, and resumes a source whose execution is paused. + +## The Scans Page + +Go to **Configuration > Scans**. The page lists every scan with its type, target, agent, and schedule. + +![Scans list showing one configured scan with its type, target, agent, schedule, and created columns](/images/accessanalyzer/26.1/scans/list.webp) + +| Column | What it shows | +|---|---| +| **Name** | The scan's name. Click it to open **Edit scan**. An icon next to the name shows the scan's description in a tooltip. | +| **Scan Type** | **Access**, **Sensitive data**, or **Identity sync**. | +| **Target** | The sources the scan covers, or the labels that select them. | +| **Agent** | **System** when the scan runs on the System agent, otherwise the agent label as `key=value`. | +| **Schedule** | **Manual**, or a short summary of the schedule such as **Daily 2AM** or **Hourly**. Click it to open the calendar. | +| **Schedule Status** | **Active** when the scan runs on a schedule, **Disabled** when it runs manually. | +| **Created** | When you created the scan. | +| **Actions** | The row menu; see [Row actions](#row-actions). | + +**Search scans…** matches the scan name, the scan type, the names and types of the target sources, and label selectors written as `key=value`. The **Scan type** and **Source type** dropdowns narrow the list further, and **Clear filters** resets both. You can sort by **Name**, **Scan Type**, or **Created**; the newest scans come first by default. The table shows 10, 25, 50, or 100 rows per page. + +Scan names don't have to be unique. Two scans can both be called "Finance shares", so give scans names that tell them apart at a glance. + +### Row Actions + +The **Actions** menu on each row offers up to five items. **Run**, **Pause**, and **Stop** appear only when they can do something. + +![Scan row actions menu with Run, Edit scan, and Delete](/images/accessanalyzer/26.1/scans/row-actions.webp) + +| Action | What it does | When it appears | +|---|---|---| +| **Run** | Starts one execution per target source, or resumes a source's paused execution, and opens Scan executions filtered to this scan. | At least one target source has no execution in progress, or has a paused execution you can resume | +| **Pause** | Asks every active execution of the scan to pause. Paused executions keep their progress, and you can resume them. | The scan has an execution that can be paused | +| **Stop** | Opens **Stop scan**, which stops every running and paused execution of the scan. | The scan has an execution that hasn't finished | +| **Edit scan** | Opens the scan at the **Review** step. | Always | +| **Delete** | Opens **Delete scan**. | Always | + +After **Run**, a notification reports the outcome: **Scan started** with the number of sources started, **Scan resumed** when the run picks up paused executions, **Scan already running** when every source already has an execution in progress, or **Scan partially started** when some sources couldn't start. If a scan targets sources by label and no source carries those labels at the moment, there is nothing to run and the scan doesn't start. + +### Calendar View + +**Calendar view** opens the **Scan schedule calendar**, a month grid of upcoming scheduled runs across every scan. Switch between **month**, **week**, **day**, and **agenda** views, and move with **Previous**, **Today**, and **Next**. The legend tells **Access scan**, **Sensitive data scan**, and **Disabled** entries apart, and the footer counts the scheduled executions in view. Clicking a scan's **Schedule** cell opens the same calendar. + +![Scan schedule calendar dialog showing a month grid with Previous, Today, Next, and month/week/day/agenda controls](/images/accessanalyzer/26.1/scans/calendar.webp) + +## Before You Begin + +You need at least one source whose type supports the scan type you want. File Server and SharePoint Online sources support Access and Sensitive data scans; Active Directory and Entra ID sources support Identity sync. [Sources](../sources/index.md) covers adding them. + +For a File Server source, a Sensitive data scan needs a completed Access scan first, because it picks its files from the inventory that the Access scan built. Run the Access scan to completion before you run the Sensitive data scan. + +If you want to target sources by label, put the labels on the sources first. [Labels](../sources/labels.md) explains source labels. + +## Create a Scan + +Creating a scan takes five steps: **Type**, **Target**, **Configure**, **Schedule**, and **Review**. The panel shows **Step N of 5** as you go, and **Back** returns to the previous step at any point. + +1. Go to **Configuration > Scans**. +2. Click **Create scan**. + +### Select the Scan Type + +1. Under **What should this scan do?**, select **Access**, **Sensitive data**, or **Identity sync**. +2. Click **Next**. + +![Create scan step 1 with Access, Sensitive data, and Identity sync cards](/images/accessanalyzer/26.1/scans/create-scan-1-type.webp) + +:::note + +You can't change the scan type after you create the scan. To collect something else, create another scan. + +::: + +### Select the Target + +Under **Which sources should this scan cover?**, select one of two targeting modes. + +**Specific sources** is a fixed list. You pick the sources, and the list stays as it is until you edit the scan. **Sources matching labels** is a rule: the scan covers every source that carries all the labels you select. Access Analyzer re-evaluates the rule every time the scan runs, so it picks up sources that gain the labels later and drops sources that lose them. + +Either way, the step offers only sources whose type supports the scan type. If none do, the step says so, and you need to add a suitable source first. + + + + +1. Select **Specific sources**. +2. Select the checkbox next to each source to scan. Use **Search sources…** to find a source in a long list. +3. Confirm the counter under the list shows the number you expect. +4. Click **Next**. + +![Create scan step 2 with one source selected](/images/accessanalyzer/26.1/scans/create-scan-2-target-selected.webp) + + + + +1. Select **Sources matching labels**. +2. In **Source labels**, select one or more labels. A source must carry every label you add. +3. Check the match count under the field. It updates as you add labels and tells you how many sources qualify today. +4. Click **Next**. + +![Create scan step 2 with label key/value selectors](/images/accessanalyzer/26.1/scans/create-scan-2-target-labels.webp) + + + + +You can save a label-targeted scan that matches no sources yet. It targets whatever matches when it runs. While a scan targets a label, you can't delete that label. + +### Configure Scan Settings + +Every source type in the target starts on its default settings. You can leave it there, customize the settings for all sources of that type, or give individual sources their own values. [Scan types](scan-types.md) lists every setting. + +1. Expand the section for a source type. Its badge reads **Defaults** or **Customized**. +2. Keep **Use default configuration**, or select **Customize for all File Server sources**. The label names the source type; when the target is a single source it reads **Customize this source**. +3. Change the settings. **Reset to defaults** puts them back. +4. To give one source its own settings, under **Source overrides**, select the source in **Source to override**. +5. Click **Add source override**. The override has its own copy of every setting and its own **Agent** picker. **Remove override** discards it. +6. For a Sensitive data scan, set the pattern groups under **Sensitive data classification**. See [Sensitive data scan](scan-types.md#sensitive-data-scan). +7. Click **Next**. + +![Create scan step 3 with customized File Server settings](/images/accessanalyzer/26.1/scans/create-scan-3-configure-customize.webp) + +If a source type has no settings for this scan type, the section says so and the sources run with the defaults. For a scan that targets sources by label, individual overrides become available when at least one source matches. If a source stops matching, its override moves to **Inactive overrides**. + +### Set the Schedule and Agent + +1. Under **When should this scan run?**, keep **Manual — run on demand** or select **On a schedule**. +2. If you selected **On a schedule**, select a **Frequency** and its time options. [Schedules](schedules.md) describes each option and the time zone rule. +3. In **Agent**, keep **System agent** or select an agent label. [Agent labels and scan routing](../agents/agent-labels.md) explains how Access Analyzer applies the choice. +4. Click **Next**. + +![Create scan step 4 with a daily schedule](/images/accessanalyzer/26.1/scans/create-scan-4-schedule-daily.webp) + +### Name and Review the Scan + +1. In **Name**, enter a name. This is the only required field on the step. +2. Optionally, enter a **Description**. It shows as a tooltip on the Scans page. +3. Check the **Summary** card. It lists **Scan type**, **Target**, **Settings**, and **Schedule**. To go back to a step, click **Edit** next to **Target**, **Settings**, or **Schedule**. +4. Click **Create scan** to save the scan, or **Create & run now** to save it and start it immediately. Both buttons stay disabled until you've entered a name. + +![Create scan review step ready to create](/images/accessanalyzer/26.1/scans/create-scan-5-review-named.webp) + +**Create & run now** creates the scan first and then starts it. If the run can't start, you see **Scan created but failed to start**, and the scan is still there to run later from the Scans page. + +Closing the panel with unsaved changes opens **Unsaved changes**: "You have unsaved changes that will be lost if you leave. Are you sure you want to leave?" **Stay** keeps you in the panel; **Leave** discards the changes. + +![Unsaved changes dialog with Stay and Leave](/images/accessanalyzer/26.1/scans/create-scan-unsaved-changes.webp) + +## Edit a Scan + +1. Go to **Configuration > Scans**. +2. Click the scan's name, or open its **Actions** menu and click **Edit scan**. The **Edit scan** panel opens at **Step 5 of 5: Review**. +3. Click **Edit** next to the section you want to change. +4. Make the change. +5. Click **Next** until you're back at **Review**. +6. Click **Save changes**. + +![Edit scan panel review step showing name, description, and summary with Edit buttons](/images/accessanalyzer/26.1/scans/edit-scan.webp) + +Everything except the scan type can change. + +:::warning + +Removing a source from a scan's target, whether by clearing its checkbox or by changing the labels so it no longer matches, deletes that source's executions for this scan and stops any that are running. + +::: + +## Delete a Scan + +1. Go to **Configuration > Scans**. +2. Open the scan's **Actions** menu and click **Delete**. +3. In the **Delete scan** dialog, click **Delete**. + +The dialog states the consequences: "Are you sure you want to delete this scan? This action can't be undone. Any running executions will be stopped, and all associated scan executions and data will be permanently removed." When an execution is in progress, the dialog adds a line warning that deleting the scan stops it. Deletion goes ahead either way. diff --git a/docs/accessanalyzer/26.1/scans/scan-executions.md b/docs/accessanalyzer/26.1/scans/scan-executions.md new file mode 100644 index 0000000000..311ca1c956 --- /dev/null +++ b/docs/accessanalyzer/26.1/scans/scan-executions.md @@ -0,0 +1,122 @@ +--- +title: Scan Executions +description: Track each run of a scan on the Scan executions page, act on a run that's still in progress, open its logs, and see how long the history is kept. +sidebar_position: 3 +--- + +A scan execution is one run of one scan against one source. A scan that targets six sources creates up to six executions each time it runs, and each one has its own status, object count, duration, and logs. The Scan executions page lists them all. + +## The Scan Executions Page + +Go to **Configuration > Scan executions**. The page refreshes itself every 3 seconds while it's open, so a running execution's status, object count, and duration update without a reload. Clicking **Run** on the Scans page brings you here with the list already filtered to that scan. + +![Scan executions list showing a completed execution with status, objects, duration, and started time](/images/accessanalyzer/26.1/scans/executions-list.webp) + +| Column | What it shows | +|---|---| +| **Scan Name** | The scan that created the execution. | +| **Scan Type** | **Access**, **Sensitive data**, or **Identity sync**. Child rows show the name of the follow-up step instead. | +| **Source** | The source this execution ran against. | +| **Source Type** | The source's type, such as **File Server**. | +| **Status** | The execution's status; see [Execution statuses](#execution-statuses). | +| **Objects** | How many objects the execution has processed so far, or in total after it has finished. | +| **Duration** | How long the execution ran, or has been running. | +| **Started** | When Access Analyzer created the execution. | +| **Actions** | The row menu with **View logs** and, while the run is active, **Pause**, **Resume**, or **Stop**. | + +Some executions run follow-up steps after the main collection. Those rows have an expand button in the first column; click it to show the child steps, each with its own status, duration, and **View logs**. + +**Search executions…** matches the scan name and the source name. The **Scan type**, **Status**, and **Source type** dropdowns narrow the list, and **Clear filters** resets all of them. Sort by **Scan Name**, **Scan Type**, **Source**, **Status**, or **Started**; the newest executions come first by default, and the table shows 10, 25, 50, or 100 rows per page. + +![Scan executions status filter options](/images/accessanalyzer/26.1/scans/executions-status-filter.webp) + +There is no separate detail page for an execution. Everything beyond the row itself lives in the logs dialog, described in [View the logs](#view-the-logs). + +## Execution Statuses + +| Status | Meaning | What you can do | +|---|---|---| +| **Pending** | Created and waiting for Access Analyzer to pick it up and start it. Also the state right after **Resume**. | **Stop** cancels it | +| **Running** | The agent is collecting data. | **Pause**, **Stop**, **View logs** | +| **Pausing** | Pause requested; the run is saving its progress. | Wait | +| **Paused** | The run has saved its progress and is waiting. It stays paused until you resume or stop it, or until the scan runs again. | **Resume** or **Run** on the scan; **Stop** ends it | +| **Resuming** | Resume requested; the run is continuing from its saved progress. | Wait | +| **Stopping** | Stop requested; the run is shutting down. | Wait | +| **Post processing** | Collection is done and a follow-up step is running. | **View logs** | +| **Completed** | Finished, and the run wrote all its data. | **View logs** | +| **Completed with errors** | Finished, but the run couldn't write some of its data. The data is partial and the next run of the scan uploads it again. | **View logs** to see the errors | +| **Failed** | The run ended without finishing. | **View logs**, then fix the cause and **Run** the scan again | +| **Stopped** | **Stop** ended it, including a stalled run that Access Analyzer ended after you requested a stop. | **View logs**; **Run** the scan again | +| **Cancelled** | Stopped while still **Pending**, either by **Stop** or because someone deleted the scan. | Nothing further | + +**Completed**, **Completed with errors**, **Failed**, **Stopped**, and **Cancelled** are final; an execution in one of those states never changes again. **Paused** isn't final, so a forgotten paused execution sits in the list until something resumes or stops it. + +An execution can run for at most 7 days. Access Analyzer also ends a run that has been stuck in **Pending** or **Running** for more than 2 hours: as **Stopped** when you requested a stop, and as **Failed** otherwise. + +## Pause, Resume, or Stop an Execution + +The **Actions** menu on each row offers whichever of **Pause**, **Resume**, and **Stop** apply to its status. A confirmation message appears for each request: **Pausing execution**, **Resuming execution**, or **Stopping execution**. To act on every execution of a scan at once, use **Pause** or **Stop** on the scan's row on the Scans page instead. + +![Scan execution actions menu with View logs](/images/accessanalyzer/26.1/scans/executions-row-actions.webp) + +### Pause an Execution + +1. Open the **Actions** menu of a **Running** execution. +2. Click **Pause**. +3. In **Pause execution**, click **Pause execution** to confirm. + +The status moves to **Pausing**, then to **Paused** when the run has saved its progress. + +### Resume an Execution + +1. Open the **Actions** menu of a **Paused** execution. +2. Click **Resume**. + +The status passes through **Pending** or **Resuming** and returns to **Running** when the agent picks the work back up. Clicking **Run** on the scan resumes its paused executions too. + +### Stop an Execution + +1. Open the **Actions** menu of a **Running**, **Pending**, or **Paused** execution. +2. Click **Stop**. +3. In **Stop execution**, click **Stop execution** to confirm. + +A **Running** execution moves to **Stopping** and then **Stopped**. A **Paused** execution becomes **Stopped** immediately, and a **Pending** one becomes **Cancelled**. All three are final; the next **Run** of the scan creates a new execution. + +## View the Logs + +**View logs** is available on every execution, whatever its status. Use it to see what a run did and why it ended. + +1. Open the execution's **Actions** menu. +2. Click **View logs**. +3. Read the **Overview** tab for the run's milestones. +4. Click **Detailed logs** for the full record. +5. Click **Close**. + +The dialog's title is **Logs — ``**. Its header shows when the execution started and its status, and offers **Pause scan**, **Resume scan**, or **Stop scan** for an active run, so you can act without closing the dialog. The footer shows **Last updated** with the time the dialog last refreshed. + +### Overview + +The **Overview** tab is a short timeline of the run's milestones. It opens with **Scan started**, which names the source and its type, and **Initializing scan configuration**, which names what triggered the run. Progress updates follow with the number of objects scanned and counts of warnings and errors. A successful run ends with **Scan completed successfully in** followed by the duration, and **Total objects scanned**; a run with problems ends with **Scan completed with errors**, **Scan failed**, or **Scan cancelled**. + +![Execution logs dialog Overview tab with execution summary](/images/accessanalyzer/26.1/scans/execution-logs-overview.webp) + +### Detailed Logs + +The **Detailed logs** tab shows the log lines the agent wrote during the run. It holds the last 1,000 entries, as the **Showing last 1,000 entries** footer says, and refreshes every 3 seconds while the execution is running. Type in **Search logs…** to filter the lines. **Auto-scroll** keeps the newest line in view on a live run; click **Pause scroll** to stop the view from moving while you read. + +An execution that has just started shows **No logs available yet** until the agent's first lines arrive. + +![Execution logs dialog Detailed logs tab with structured log lines](/images/accessanalyzer/26.1/scans/execution-logs-detailed.webp) + +## Run a Scan Again + +You can't retry an execution on its own. To collect again, run the scan: + +1. Go to **Configuration > Scans**. +2. Open the scan's **Actions** menu and click **Run** (see [Row actions](index.md#row-actions)). + +For each target source, Access Analyzer starts a fresh execution, resumes a paused one, or skips the source if an execution is still in progress. A Sensitive data scan or an Active Directory Identity sync with its differential setting turned on collects only what changed since the last run; see [Scan types](scan-types.md). + +## Retention + +Access Analyzer deletes executions that ended as **Completed**, **Failed**, or **Cancelled** once they are 90 days old. This period is fixed. Access Analyzer never deletes **Completed with errors** or **Stopped** executions by age, so a partial or interrupted run stays visible for as long as you need it. Deleting a scan removes all of its executions at once, and removing a source from a scan's target removes that source's executions. diff --git a/docs/accessanalyzer/26.1/scans/scan-types.md b/docs/accessanalyzer/26.1/scans/scan-types.md new file mode 100644 index 0000000000..a08b2437b0 --- /dev/null +++ b/docs/accessanalyzer/26.1/scans/scan-types.md @@ -0,0 +1,123 @@ +--- +title: Scan Types +description: Learn what Access scans, Sensitive data scans, and Identity sync collect, which sources each supports, their prerequisites and Configure settings, and the reports they feed. +sidebar_position: 1 +--- + +Every scan has exactly one type. You choose it on the first step of [Create a scan](index.md#create-a-scan), and it stays fixed from then on. The type decides what the scan collects, which sources it can target, and which settings the **Configure** step offers. + +| Scan type | What it collects | Source types | +|---|---|---| +| **Access** | Shares, folders, files, sites, and the permissions on them | File Server, SharePoint Online | +| **Sensitive data** | Sensitive data patterns found inside file content | File Server, SharePoint Online | +| **Identity sync** | Users, groups, and group memberships from a directory | Active Directory, Entra ID | + +On the **Configure** step, each source type in the target starts on **Use default configuration**. To change the values in the following tables for every source of that type, select **Customize for all File Server sources**; the label names the source type, and it reads **Customize this source** when the target is a single source. To change them for one source only, add a **Source overrides** entry. Settings you don't touch keep their defaults. + +## Access Scan + +An Access scan builds the inventory of what exists and who can reach it. On a File Server source that means the shares, the folders and files beneath them, and the permissions on shares and folders, with file-level permissions as an option. On a SharePoint Online source it means site collections, sites, lists, folders, and documents, plus the users and groups that hold permissions on them. When **Collect OneDrive** is on, it also covers users' OneDrive personal drives. + +The inventory is also what a Sensitive data scan works from, so run an Access scan before you schedule a Sensitive data scan on the same source. + +### File Server Settings + +| Setting | Default | Meaning | +|---|---|---| +| **Workers** | 3 | Concurrent workers, from 1 to 20. More workers finish sooner but use more network bandwidth and can overload the file server. | +| **Exclude system shares** | On | Skips administrative shares such as `C$` and `ADMIN$`. | +| **Include shares** | All shares | Switch to **Custom selection** and list share names to scan only those. Leave on **All shares** to scan every accessible share. | +| **Exclude shares** | Empty | Share names to skip. Ignored when **Include shares** lists specific shares. | +| **Maximum scan depth** | 50 | How many folder levels deep to go, up to 1000. This guards against endless recursion. | +| **Enable File-Level Permission Scanning** | Off | Collects permissions on individual files as well as folders. | +| **Exclude Hidden Shares** | Empty | Hidden share names to leave out of share enumeration. | + +Share names can contain letters, digits, hyphens, and underscores, and hidden shares end with `$`, as in `backup$`. Spaces, dots, and wildcards don't work, and you can list each share only once. The share settings take share names only; there is no setting for individual folder paths. + +### SharePoint Online Settings + +| Setting | Default | Meaning | +|---|---|---| +| **Workers** | 4 | Concurrent workers, from 1 to 256. Higher values shorten the scan but put more load on the tenant. Raise it only when the tenant has SharePoint Online prioritization (adaptive throttling) enabled, and treat 32 as the practical ceiling; beyond that, throttling tends to cancel out the gain. | +| **Include site collections** | Scan all URLs | Switch to **Include specific site collections** and enter exact site collection URLs, such as `https://contoso.sharepoint.com/sites/marketing`, to scan only those. This field doesn't support wildcards. | +| **Exclude site collections** | Empty | Site collections to skip. Supports the `*` wildcard, for example `*.sharepoint.com/sites/archive`. | +| **Exclude object URLs** | Empty | URL patterns for documents, folders, and lists to skip inside the scanned site collections. Supports the `*` wildcard. | +| **Collect OneDrive** | On | Includes users' OneDrive personal drives in the scan. | + +Exclude rules always win over include rules. A bare URL in **Exclude object URLs** doesn't match any documents; to exclude a whole site, end the pattern with `/*`, as in `*.sharepoint.com/sites/archive/*`. + +### Reports Fed by Access Scans + +Access scans feed the reports in the **Permissions** category on **Reports > Data**: for File Server, **Broken Inheritance**, **High Risk ACLs**, **Open Access**, and **Share Audit**; for SharePoint Online, **Shared Links**, **High-Risk ACLs**, and **Open Access**. Both feed the [Data security dashboard](../dashboards-reports/dashboards/data-security.md), and [Data reports](../dashboards-reports/reports/data.md) describes each report. + +## Sensitive Data Scan + +A Sensitive data scan opens files, reads their content, and matches it against [sensitive data patterns](../sensitive-data-patterns/index.md). For each file it records which pattern groups and patterns matched and how many times; it doesn't store the matched text itself. + +### Prerequisites + +The scan needs a completed Access scan on the same source, because it picks its files from the inventory that scan built. A Sensitive data scan on a source that has never had an Access scan finds nothing to classify. + +The scan doesn't read every inventoried file. Two settings per source type on **Settings > Application**, described in [Application settings](../settings/application.md), decide which files qualify: + +| Setting | Default | Meaning | +|---|---|---| +| `file_server_file_size_max_mb` | 10 | Largest file, in MB, to classify on File Server sources. Range 1 to 100. | +| `file_server_excluded_extensions` | 74 extensions | File extensions skipped on File Server sources: media, images, fonts, disk images, and executables such as `.mp4`, `.jpg`, `.iso`, and `.exe`. | +| `sharepoint_file_size_max_mb` | 10 | Largest file, in MB, to classify on SharePoint Online sources. Range 1 to 100. | +| `sharepoint_excluded_extensions` | 81 extensions | The File Server list plus web files such as `.html`, `.aspx`, and `.css`. | + +Changes to these settings reach the scanning service within five minutes and apply to scans that start after that. Scans already running keep the values they started with. + +### File Server Settings for Sensitive Data Scans + +| Setting | Default | Meaning | +|---|---|---| +| **Workers** | 3 | Concurrent workers reading file content, from 1 to 20. Leave it at 3 and the scan uses `classification_workers_default` on **Settings > Application** (default 15). Set any other value to use that number for this scan. | +| **Include shares** | All shares | Switch to **Custom selection** and list share names to classify only those. | +| **Exclude shares** | Empty | Share names to skip. | +| **Differential scan** | Off | Reads only files that are new or changed since the last Sensitive data scan of this source. | +| **Exclude System Shares** | On | Skips administrative shares such as `ADMIN$`, `IPC$`, and `C$`. | +| **Exclude Hidden Shares** | Empty | Hidden share names to leave out of share enumeration. | + +Turn on **Differential scan** for a recurring scan after the first full pass finishes. The first run still reads everything, because the scan hasn't classified anything yet; later runs then touch only what changed. + +![Create scan step 3 with customized File Server settings](/images/accessanalyzer/26.1/scans/create-scan-3-configure-customize.webp) + +SharePoint Online has no per-type Sensitive data settings. Its sources run with the global classification settings in [Prerequisites](#prerequisites). + +### Pattern Groups + +Under **Sensitive data classification**, the **Configuration source** card holds the **Inherit from global configuration** switch, which is on by default. While it's on, the scan classifies against the pattern groups marked **Scanned by default** on the Sensitive data patterns page, and the card reports how many groups that is. Changing the global set later changes what this scan looks for on its next run. + +Turn the switch off to select groups for this scan alone. **Sensitive Data Pattern Groups to Classify** lists the pattern groups and marks built-in ones with a **Built-in** badge. Type in **Search pattern groups** to filter the list, or click **Select All** to choose every group. [Pattern groups](../sensitive-data-patterns/pattern-groups.md) describes the groups themselves. + +![Sensitive data scan settings with selectable pattern groups](/images/accessanalyzer/26.1/scans/create-scan-sensitive-3-configure-custom-groups.webp) + +:::warning + +An empty selection doesn't mean "classify nothing". If the scan inherits the global configuration and no group carries **Scanned by default**, or if you turn inheritance off and select no groups, the scan classifies against every pattern group, built-in and custom alike. To narrow a scan, select the groups you want. + +::: + +### Reports Fed by Sensitive Data Scans + +Sensitive data scans feed both **Sensitive Data Overview** reports, one for file systems and one for SharePoint, and the sensitive-data variant of **Share Audit**, all listed in [Data reports](../dashboards-reports/reports/data.md). Findings also appear on the [Data security dashboard](../dashboards-reports/dashboards/data-security.md). + +## Identity Sync + +An Identity sync collects the accounts and groups of a directory. From Active Directory it collects users, groups, group memberships, and custom user attributes. From Entra ID it collects users, groups, and memberships. + +### Active Directory Settings + +| Setting | Default | Meaning | +|---|---|---| +| **Enable differential scan** | On | Collects only objects that changed since the last sync. Turn it off to force a full collection. | + +### Entra ID Settings + +Entra ID has no per-type settings. The **Configure** step tells you so and the source runs with the defaults. + +### Reports Fed by Identity Sync + +Active Directory syncs feed the **AD Users** report and the [Active Directory dashboard](../dashboards-reports/dashboards/active-directory.md). Entra ID syncs feed the **Entra Users** and **Entra Groups** reports. [Identity reports](../dashboards-reports/reports/identity.md) describes all three. diff --git a/docs/accessanalyzer/26.1/scans/schedules.md b/docs/accessanalyzer/26.1/scans/schedules.md new file mode 100644 index 0000000000..1db46c4007 --- /dev/null +++ b/docs/accessanalyzer/26.1/scans/schedules.md @@ -0,0 +1,88 @@ +--- +title: Schedules +description: Run scans manually or on an hourly, daily, weekly, or monthly schedule, understand the time zone rule, and choose the agent that runs them. +sidebar_position: 2 +--- + +Every scan is either manual or scheduled. You set this on the **Schedule** step when you create a scan and can change it at any time by editing the scan. On the same step you also pick the agent the scan runs on. + +## Manual and Scheduled Scans + +**Manual — run on demand** is the default. A manual scan runs only when someone starts it: **Run** on the Scans page, or **Create & run now** when you create it. Its **Schedule** column reads **Manual** and its **Schedule Status** badge reads **Disabled**. + +**On a schedule** makes the scan run itself. Its **Schedule** column summarizes the timing, such as **Daily 2AM**, and its **Schedule Status** badge reads **Active**. A scheduled run is identical to clicking **Run**. Access Analyzer resolves the target again, so label-targeted scans pick up any newly matching sources, and each target source gets its own execution. It skips a source that still has an execution in progress from the previous run and resumes a paused one. + +![Create scan step 4 schedule with Manual selected](/images/accessanalyzer/26.1/scans/create-scan-4-schedule-manual.webp) + +## Frequency Options + +Select a **Frequency**, and its controls appear below it. + +![Frequency options Hourly, Daily, Weekly, Monthly](/images/accessanalyzer/26.1/scans/create-scan-4-schedule-frequency-menu.webp) + +| Frequency | Controls | Default | Runs | +|---|---|---|---| +| **Hourly** | None | — | At the top of every hour | +| **Daily** | **Start time** | 02:00 | Once a day at the start time | +| **Weekly** | **Start time**, **Days of week** | 02:00, Mon to Fri | At the start time on each selected day | +| **Monthly** | **Start time**, **Day of Month** | 02:00, **1st** | At the start time on that day of each month | + +**Days of week** is a row of day buttons from **Mon** to **Sun**. Click a day to toggle it; at least one day must stay selected, so you can't turn off the last one. **Day of Month** offers **1st** through **31st**. + +![Create scan step 4 with a weekly schedule and day-of-week toggles](/images/accessanalyzer/26.1/scans/create-scan-4-schedule-weekly.webp) + +:::note + +A monthly schedule set to the 29th, 30th, or 31st doesn't run in months that are shorter than that. Pick the 28th or earlier if the scan must run every month. + +::: + +There is no one-time schedule. To run a scan once, leave it manual and click **Run**. + +Access Analyzer checks schedules every minute and queues a scheduled run within a minute of its start time. + +## Time Zone + +Access Analyzer saves start times in the time zone of the browser you save the scan from. A scan with **Start time** 02:00 saved from a browser in Berlin runs at 02:00 Berlin time, whoever views it later. To move the scan to a different time zone, edit it from a browser set to that zone and save it again. + +:::warning + +Saving a scheduled scan from a browser in another time zone moves the schedule to that zone, even if you changed nothing on the **Schedule** step. + +::: + +## Set a Schedule + +Start on the **Schedule** step of the Create scan flow. For an existing scan, click **Edit scan** in the scan's **Actions** menu on the Scans page. On the **Review** step, click **Edit** next to **Schedule**. + +1. Select **On a schedule**. +2. In **Frequency**, select **Hourly**, **Daily**, **Weekly**, or **Monthly**. +3. For anything other than **Hourly**, set **Start time**. +4. For **Weekly**, select the days in **Days of week**. +5. For **Monthly**, select a **Day of Month**. +6. Click **Next**. +7. On the **Review** step, enter a **Name** if the scan is new, then click **Create scan** or **Save changes**. + +The **Schedule** row of the **Summary** card shows the schedule as it appears on the Scans page, and the [Calendar view](index.md#calendar-view) shows the upcoming runs of every scheduled scan together. + +## Turn a Schedule Off and On + +There is no separate pause for a schedule. To stop a scan from running on its own: + +1. On the Scans page, click **Edit scan** in the scan's **Actions** menu. +2. On the **Review** step, click **Edit** next to **Schedule**. +3. On the **Schedule** step, select **Manual — run on demand**. +4. Click **Next**. +5. On the **Review** step, click **Save changes**. + +The **Schedule Status** badge changes to **Disabled**. The scan keeps its settings and target, so you can still run it manually. To resume the schedule, repeat the steps and select **On a schedule** instead. + +**Pause** and **Stop** on the Scans page act on the scan's running executions, not on its schedule. The schedule keeps firing, and when the next run comes due, Access Analyzer resumes a paused execution rather than leaving it waiting. [Scan executions](scan-executions.md) describes what **Pause** and **Stop** do to a running execution. + +## Agent + +The **Agent** field sits under the schedule controls. Open its dropdown to see two groups: **System**, with the single option **System agent**, and **Agent labels**, with one `key=value` entry for each label your deployed agents carry. Enter text in **Search labels…** to filter a long list. + +![Agent location options](/images/accessanalyzer/26.1/scans/create-scan-4-schedule-agent-menu.webp) + +With **System agent** selected, the scan runs on the Access Analyzer server. If you select a label, each execution runs on an agent that carries it. If no agent carries the label when a run starts, the execution doesn't fall back to the System agent. It waits for a matching agent and eventually fails if none becomes available. To send a single source to a different agent, use its **Source overrides** entry on the **Configure** step. [Agent labels and scan routing](../agents/agent-labels.md) has the full rules and worked examples. diff --git a/docs/accessanalyzer/26.1/sensitive-data-patterns/_category_.json b/docs/accessanalyzer/26.1/sensitive-data-patterns/_category_.json new file mode 100644 index 0000000000..aa288d7775 --- /dev/null +++ b/docs/accessanalyzer/26.1/sensitive-data-patterns/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Sensitive Data Patterns", + "position": 70, + "collapsed": true, + "collapsible": true +} diff --git a/docs/accessanalyzer/26.1/sensitive-data-patterns/built-in-patterns.md b/docs/accessanalyzer/26.1/sensitive-data-patterns/built-in-patterns.md new file mode 100644 index 0000000000..e7ca88e0c4 --- /dev/null +++ b/docs/accessanalyzer/26.1/sensitive-data-patterns/built-in-patterns.md @@ -0,0 +1,389 @@ +--- +title: Built-in Patterns +description: The 139 sensitive data patterns that ship with Access Analyzer, listed by pattern group with their confidence levels. +sidebar_position: 1 +--- + +Access Analyzer ships 139 built-in sensitive data patterns organized into 11 built-in groups. Both the patterns and the groups carry a **Built-in** badge on the **Sensitive Data Patterns** page. Of the 139 patterns, 79 are High confidence, 48 are Medium, and 12 are Low. + +Built-in patterns are read-only. You can't edit or delete them, and you can't add a built-in pattern to a group or remove it from one. On the **Sensitive Data Patterns** page, the **Regex / Description** column shows what each built-in pattern detects rather than its regular expression. You can add your own [custom patterns](custom-patterns.md) to any built-in group. + +## Built-in Groups + +| Group | Patterns | Description | +|---|---|---| +| **CCPA** | 4 | California Consumer Privacy Act personal information. | +| **CMMC** | 27 | Cybersecurity Maturity Model Certification controlled data and credentials. | +| **GDPR** | 44 | EU General Data Protection Regulation personal data. | +| **GDPR Restricted** | 29 | GDPR special-category (Article 9) data requiring heightened protection. | +| **GLBA** | 12 | Gramm-Leach-Bliley Act non-public personal financial information. | +| **HIPAA** | 5 | Health Insurance Portability and Accountability Act protected health information. | +| **PCI DSS** | 3 | Payment Card Industry Data Security Standard cardholder data. | +| **Credentials** | 25 | Cloud keys, API tokens, private keys, passwords, and other secrets. | +| **Financial Records** | 38 | Bank account, routing, and tax identifiers. | +| **PHI** | 5 | Protected health information: medical codes, terms, and treatment records. | +| **PII** | 34 | Personally identifiable information: names, IDs, contact details, and dates. | + +Many patterns belong to more than one group: 85 of the 139 do. **US SSN** (US Social Security number), for example, is in **GLBA**, **HIPAA**, and **PII**. Every pattern in **Credentials** is also in **CMMC**. A scan selects groups rather than individual patterns, so Access Analyzer reports a pattern's matches whenever you pick any group it belongs to. [Pattern groups](pattern-groups.md) explains how that selection works. + +## Patterns by Group + +Expand a group to see its patterns in alphabetical order, each with its confidence level and the text from the **Regex / Description** column. + +### CCPA + +**CCPA** holds four consumer-identity patterns: a driver's license number, an email address, a phone number, and a US street address. All four also belong to **PII**. + +
+CCPA patterns (4) + +| Pattern | Confidence | Description | +|---|---|---| +| Driver's license | Medium | Driver's license numbers, identified by a nearby driver's-license or DL-number label. | +| Email address | Medium | Email addresses in standard local-part@domain format. | +| Phone number | Low | Telephone numbers in US, UK, and general international dialing formats. | +| US address | High | US street addresses, matched by house number, street name, and a standard street-type suffix (St, Ave, Blvd, Rd, and similar). | + +
+ +### CMMC + +**CMMC** contains every **Credentials** pattern plus two for International Traffic in Arms Regulations (ITAR) export-control terms and restricted-party names. + +
+CMMC patterns (27) + +| Pattern | Confidence | Description | +|---|---|---| +| Amazon MWS Auth Token | High | Amazon Marketplace Web Service (MWS) authorization tokens, identified by their fixed amzn.mws. prefix. | +| AWS Access Key ID | High | AWS access key IDs embedded in code, configuration files, or connection strings, identified by AWS's fixed access-key-ID prefix. | +| AWS Account ID | Low | AWS account ID numbers, identified by a nearby aws_account_id-style label. | +| AWS Secret Access Key | Medium | AWS secret access keys — a bare 40-character base64-style secret — identified by a nearby aws_secret_access_key label. | +| AWS Session Token | Medium | AWS temporary session tokens, identified by a nearby aws_session_token-style label. | +| Azure Cosmos DB (DocumentDB) Auth Key | High | Azure Cosmos DB (DocumentDB) authorization keys, identified by a nearby DocumentDb label and their fixed base64 length. | +| Azure SAS Token | High | Azure Shared Access Signature (SAS) tokens, identified by their versioned sv=20YY-MM-DD query-string prefix. | +| Azure Storage Account Key | High | Azure Storage account keys embedded in code or connection strings, identified by their fixed base64 length. | +| Credentials | High | A broad set of application secrets and credentials — labeled API keys and tokens, JWTs, and vendor-specific tokens for GitHub, npm, SendGrid, Stripe, and Twilio — identified by their distinctive fixed-format prefixes or by a nearby secret/token label. | +| Credentials Embedded in URI | Medium | Usernames and passwords embedded directly in a URI, such as an FTP or database connection URL, identified by the scheme://user:pass@host structure. | +| Database Connection String | High | Database connection strings with an embedded password, identified by their Server=...;Password=... key-value format. | +| Generic Private Key | High | Private key material in PEM format, identified by the standard '-----BEGIN ... PRIVATE KEY-----' header. | +| Google Cloud API Key | High | Google Cloud API keys, identified by their fixed 'AIza' prefix. | +| Google Cloud OAuth Access Token | Medium | Google Cloud OAuth access tokens, identified by their fixed 'ya29.' prefix. | +| Google Cloud Service Account Key | High | Google Cloud service-account key files, identified by the JSON private_key_id field they contain. | +| ITAR Controlled Munitions List Terms | Low | Terms from the ITAR Controlled Munitions List nomenclature, identified alongside nearby export-control context. | +| ITAR Restricted Party / Denied Persons Match | Low | Names appearing on ITAR restricted-party/denied-persons lists, identified alongside nearby export-control context. | +| Kerberos Ticket File (krbtgt .kirbi) | High | Exported Kerberos golden/silver ticket files, identified by the krbtgt filename fragment and .kirbi extension. | +| Password | Medium | Passwords appearing in configuration files, connection strings, and markup, identified by a nearby password label. | +| PEM certificate block | High | X.509 certificates in PEM format, identified by the standard '-----BEGIN CERTIFICATE-----' header. | +| PEM public key block | High | Public key material in PEM format, identified by the standard '-----BEGIN ... PUBLIC KEY-----' header. | +| PGP Key Block | High | PGP public and private key blocks, identified by their standard '-----BEGIN PGP ... KEY BLOCK-----' delimiters. | +| PKCS#7/P7B Certificate Block | High | PKCS#7/P7B certificate blocks, identified by the standard '-----BEGIN PKCS7-----' header. | +| Slack Token | High | Slack API tokens, identified by Slack's fixed token prefix. | +| Slack Webhook URL | High | Slack incoming-webhook URLs, identified by their fixed hooks.slack.com format. | +| SSH Authorized Keys | High | SSH public keys as they appear in authorized_keys files and key listings, identified by their key-type prefix and encoded key body. | +| UNIX /etc/passwd file exposure | Medium | Exposed UNIX /etc/passwd-style colon-delimited user records. | + +
+ +### GDPR + +**GDPR** is the largest group, with 44 patterns. Most are national identifiers, social security and tax numbers, and passports for EU and other European countries. The rest are European street addresses, UK postcodes, email addresses, IP addresses, and dates of birth. + +
+GDPR patterns (44) + +| Pattern | Confidence | Description | +|---|---|---| +| Austrian National ID | Medium | Austrian national population-register identifiers (sourcePIN/ZMR), identified by a nearby sourcePIN, ZMR, or ccr-ID label. | +| Austrian Social Security Number (SSN) | Medium | Austrian social security numbers, identified by a nearby ASVG or Sozialversicherungsgesetz label. | +| Belgian National ID (BSN) | High | Belgian national register numbers in dash-grouped form, identified by a nearby BEID/EID label and validated against the Belgian national register mod-97 checksum. | +| Belgian National Register Number (Rijksregisternummer) | Medium | Belgian national register numbers (Rijksregisternummer) in dot-grouped, birth-date-anchored form, identified by a nearby SIS or Rijksregisternummer label. | +| Bulgarian EGN | Medium | Bulgarian EGN (uniform civil number) identifiers, identified by a nearby EGN label. | +| Czech Birth Number (Rodné číslo) | Medium | Czech birth numbers (Rodné číslo), identified by a nearby Rodné číslo or RČ label. | +| Czech National ID (Občanský průkaz) | Medium | Czech national identity card numbers (Občanský průkaz), identified by a nearby ČOP or identification-card label. | +| Czech Passport Number | Low | Czech passport numbers, identified by a nearby passport or Cestovní pas label. | +| Danish National ID (CPR number) | Medium | Danish CPR (personal identification) numbers, identified by a nearby CPR or personnummer label. | +| Date of birth | Medium | Dates of birth, identified by a nearby date-of-birth, DOB, or 'born on' label. | +| Dutch BSN (Burgerservicenummer) | Low | Dutch citizen service numbers (BSN), identified by a nearby BSN/Burgerservicenummer/sofinummer label; the format carries no checksum here, so this stays a lower-confidence signal. | +| Email address | Medium | Email addresses in standard local-part@domain format. | +| Estonian National ID | Medium | Estonian personal identification codes (isikukood), identified by a nearby IK or Isikukood label. | +| EU address | High | European street addresses in German- and French-style formats (e.g. a Straße/allee/platz name or a rue/avenue/boulevard name), matched by street name and house number. | +| Finnish Personal Identity Code (HETU) | Medium | Finnish personal identity codes (HETU), identified by a nearby HETU or henkilötunnus label. | +| French National ID Card (CNI) | Low | French national identity card (CNI) numbers, identified by a nearby carte d'identité or identification-nationale label. | +| French NIR | High | French social security (INSEE/NIR) numbers, identified by a nearby 'numéro de sécurité sociale' or INSEE label and validated against the NIR check-digit algorithm. | +| French tax identification number (SPI/SID) | Medium | French tax identification numbers (SPI/SID), identified by a nearby SID or numéro d'identification fiscale label. | +| German national ID card number (Personalausweis) | Medium | German national identity card numbers (Personalausweis), identified by a nearby Personalausweis or Ausweis label. | +| German passport number | Medium | German passport numbers, identified by a nearby Reisepass or Ausweisnummer label. | +| German SSN | Medium | German social security numbers, identified by a nearby Sozialversicherungsnummer, VSNR, or RVNR label. | +| German tax ID | High | German tax identification numbers (Steuer-ID), identified by a nearby Steueridentifikationsnummer or tax-ID label and validated against the German tax-ID check-digit algorithm. | +| Greek National ID | Medium | Greek national identity card numbers, identified by a nearby tautotita label. | +| Hungarian National ID | Medium | Hungarian national identity card numbers, identified by a nearby személyigazolvány szám label. | +| Hungarian Personal ID | Medium | Hungarian personal identification numbers, identified by a nearby Szám/Személyi szám label, distinct from the Hungarian national ID card and TAJ social-insurance number. | +| Hungarian TAJ (Social Insurance) Number | Medium | Hungarian TAJ social insurance numbers, identified by a nearby TAJ or társadalombiztosítási szám label. | +| IPv4 Address | Low | IPv4 addresses in standard dotted-decimal notation. | +| IPv6 Address | Medium | IPv6 addresses in full 8-group hexadecimal-colon notation. | +| Irish PPS Number | Medium | Irish Personal Public Service (PPS) numbers, identified by a nearby PPS label. | +| Italian Codice Fiscale | High | Italian Codice Fiscale (tax code) numbers, identified by a nearby codice fiscale or Italian fiscal-code label and validated against the Codice Fiscale check-character algorithm. | +| Latvian Personal Code (Personas kods) | Medium | Latvian personal codes (Personas kods), identified by a nearby PK/Personas kods label. | +| Lithuanian Personal Code (Asmens kodas) | Medium | Lithuanian personal codes (Asmens kodas), identified by a nearby AK/Asmens kodas label. | +| Norwegian National ID (Fødselsnummer) | Medium | Norwegian national identity numbers (Fødselsnummer), identified by a nearby fødselsnummer/fn label. | +| Polish NIP (Tax ID) | High | Polish NIP tax identification numbers, identified by a nearby NIP label and validated against the NIP weighted mod-11 checksum. | +| Polish PESEL (National ID) | High | Polish PESEL national identification numbers, identified by a nearby PESEL label and validated against the PESEL weighted mod-10 checksum. | +| Romanian CNP (Personal Numeric Code) | High | Romanian personal numeric codes (CNP), identified by a nearby CNP/Cod Numeric Personal label and validated against the CNP weighted mod-11 checksum. | +| Slovak Passport Number | Medium | Slovak passport numbers, identified by a nearby passport or Cestovný pas label. | +| Spain Passport | Medium | Spanish passport numbers, identified by a nearby Pasaporte label. | +| Spain Social Security Number (NUSS) | Medium | Spanish social security numbers (NUSS), identified by a nearby número de seguridad social label. | +| Spanish DNI/NIE | High | Spanish national identity numbers (DNI/NIE), identified by a nearby DNI/NIE label and validated against the Spanish ID check-letter algorithm. | +| Swedish Personal ID Number (Personnummer) | Medium | Swedish personal identity numbers (Personnummer), identified by a nearby Personnr/personnummer label. | +| UK NHS Number | High | UK NHS numbers, identified by a nearby NHS label and validated against the NHS number's modulus-11 check digit. | +| UK NINO | High | UK National Insurance numbers, validated against National Insurance number prefix and format rules. | +| UK postcode | High | UK postal codes, identified either by a nearby postcode or address label, or on their own when they match standard UK postcode formatting rules. | + +
+ +### GDPR Restricted + +**GDPR Restricted** is the subset of **GDPR** that covers national identity, social security, and tax identifiers. + +
+GDPR Restricted patterns (29) + +| Pattern | Confidence | Description | +|---|---|---| +| Austrian National ID | Medium | Austrian national population-register identifiers (sourcePIN/ZMR), identified by a nearby sourcePIN, ZMR, or ccr-ID label. | +| Austrian Social Security Number (SSN) | Medium | Austrian social security numbers, identified by a nearby ASVG or Sozialversicherungsgesetz label. | +| Belgian National ID (BSN) | High | Belgian national register numbers in dash-grouped form, identified by a nearby BEID/EID label and validated against the Belgian national register mod-97 checksum. | +| Belgian National Register Number (Rijksregisternummer) | Medium | Belgian national register numbers (Rijksregisternummer) in dot-grouped, birth-date-anchored form, identified by a nearby SIS or Rijksregisternummer label. | +| Bulgarian EGN | Medium | Bulgarian EGN (uniform civil number) identifiers, identified by a nearby EGN label. | +| Czech Birth Number (Rodné číslo) | Medium | Czech birth numbers (Rodné číslo), identified by a nearby Rodné číslo or RČ label. | +| Danish National ID (CPR number) | Medium | Danish CPR (personal identification) numbers, identified by a nearby CPR or personnummer label. | +| Dutch BSN (Burgerservicenummer) | Low | Dutch citizen service numbers (BSN), identified by a nearby BSN/Burgerservicenummer/sofinummer label; the format carries no checksum here, so this stays a lower-confidence signal. | +| Estonian National ID | Medium | Estonian personal identification codes (isikukood), identified by a nearby IK or Isikukood label. | +| Finnish Personal Identity Code (HETU) | Medium | Finnish personal identity codes (HETU), identified by a nearby HETU or henkilötunnus label. | +| French National ID Card (CNI) | Low | French national identity card (CNI) numbers, identified by a nearby carte d'identité or identification-nationale label. | +| French NIR | High | French social security (INSEE/NIR) numbers, identified by a nearby 'numéro de sécurité sociale' or INSEE label and validated against the NIR check-digit algorithm. | +| French tax identification number (SPI/SID) | Medium | French tax identification numbers (SPI/SID), identified by a nearby SID or numéro d'identification fiscale label. | +| German SSN | Medium | German social security numbers, identified by a nearby Sozialversicherungsnummer, VSNR, or RVNR label. | +| German tax ID | High | German tax identification numbers (Steuer-ID), identified by a nearby Steueridentifikationsnummer or tax-ID label and validated against the German tax-ID check-digit algorithm. | +| Greek National ID | Medium | Greek national identity card numbers, identified by a nearby tautotita label. | +| Hungarian Personal ID | Medium | Hungarian personal identification numbers, identified by a nearby Szám/Személyi szám label, distinct from the Hungarian national ID card and TAJ social-insurance number. | +| Hungarian TAJ (Social Insurance) Number | Medium | Hungarian TAJ social insurance numbers, identified by a nearby TAJ or társadalombiztosítási szám label. | +| Irish PPS Number | Medium | Irish Personal Public Service (PPS) numbers, identified by a nearby PPS label. | +| Italian Codice Fiscale | High | Italian Codice Fiscale (tax code) numbers, identified by a nearby codice fiscale or Italian fiscal-code label and validated against the Codice Fiscale check-character algorithm. | +| Latvian Personal Code (Personas kods) | Medium | Latvian personal codes (Personas kods), identified by a nearby PK/Personas kods label. | +| Lithuanian Personal Code (Asmens kodas) | Medium | Lithuanian personal codes (Asmens kodas), identified by a nearby AK/Asmens kodas label. | +| Norwegian National ID (Fødselsnummer) | Medium | Norwegian national identity numbers (Fødselsnummer), identified by a nearby fødselsnummer/fn label. | +| Polish NIP (Tax ID) | High | Polish NIP tax identification numbers, identified by a nearby NIP label and validated against the NIP weighted mod-11 checksum. | +| Polish PESEL (National ID) | High | Polish PESEL national identification numbers, identified by a nearby PESEL label and validated against the PESEL weighted mod-10 checksum. | +| Romanian CNP (Personal Numeric Code) | High | Romanian personal numeric codes (CNP), identified by a nearby CNP/Cod Numeric Personal label and validated against the CNP weighted mod-11 checksum. | +| Spain Social Security Number (NUSS) | Medium | Spanish social security numbers (NUSS), identified by a nearby número de seguridad social label. | +| Spanish DNI/NIE | High | Spanish national identity numbers (DNI/NIE), identified by a nearby DNI/NIE label and validated against the Spanish ID check-letter algorithm. | +| Swedish Personal ID Number (Personnummer) | Medium | Swedish personal identity numbers (Personnummer), identified by a nearby Personnr/personnummer label. | + +
+ +### GLBA + +**GLBA** groups payment card, bank, securities, and tax identifiers with financial-statement terms and the US Social Security number. It includes all three **PCI DSS** patterns. + +
+GLBA patterns (12) + +| Pattern | Confidence | Description | +|---|---|---| +| ABA routing number | High | US bank routing numbers, validated against the ABA routing-number checksum. | +| Credit Card Magnetic Stripe Track 1 | High | Raw ISO/IEC 7813 Track 1 magnetic-stripe dumps, matched by the %B sentinel and cardholder/expiry field structure. | +| Credit Card Magnetic Stripe Track 2 | Medium | Raw ISO/IEC 7813 Track 2 magnetic-stripe dumps, matched by the leading ';' sentinel and expiry-date field structure. | +| Credit Card Number | High | Payment card numbers for major brands, validated with the Luhn checksum. | +| CUSIP Number | High | US/Canada CUSIP securities identifiers, validated against the ANSI X9.6 modulus-10 check-digit algorithm. | +| Employer Identification Number (EIN) | Medium | US Employer Identification Numbers (EIN), identified by a nearby EIN or employer-identification label. | +| Financial Document Indicators | Low | Financial-statement terms (EBITDA, operating margin, net income, and similar) appearing together with a currency amount. | +| French VAT number | Medium | French VAT identification numbers, identified by a nearby TVA/VAT label. | +| German VAT | Medium | German VAT identification numbers, identified by a nearby Mehrwertsteuer/USt-Id/VAT label. | +| Spain VAT/CIF Number | Medium | Spanish VAT/CIF numbers, identified by a nearby IVA/VAT label and the mandatory ES country-code prefix. | +| US bank account number | Low | Bank account numbers, matched as a 7- to 14-digit sequence with no additional validation. | +| US SSN | High | US Social Security numbers in formatted or unformatted form, validated against Social Security Administration allocation rules. | + +
+ +### HIPAA + +**HIPAA** pairs medical billing codes and provider identifiers with the Medicare Beneficiary Identifier and the US Social Security number. + +
+HIPAA patterns (5) + +| Pattern | Confidence | Description | +|---|---|---| +| HCPCS Codes | Medium | Healthcare Common Procedure Coding System (HCPCS) billing codes, matched against the closed list of known codes. | +| Medical code | High | Medical billing and diagnostic codes — ICD-10 diagnosis codes, CPT procedure codes, and NDC drug codes — identified by a nearby diagnosis, procedure, or drug-code label. | +| Medicare Beneficiary Identifier (MBI) | Low | US Medicare Beneficiary Identifiers (MBI), identified by a nearby Medicare-beneficiary or MBI label; the format carries no public checksum, so this stays a lower-confidence signal. | +| Personal Identifier | High | National Provider Identifier (NPI) and DEA registration numbers for healthcare providers, identified by a nearby NPI or DEA label. | +| US SSN | High | US Social Security numbers in formatted or unformatted form, validated against Social Security Administration allocation rules. | + +
+ +### PCI DSS + +**PCI DSS** covers payment card numbers and raw magnetic-stripe data. All three patterns also belong to **GLBA**. + +
+PCI DSS patterns (3) + +| Pattern | Confidence | Description | +|---|---|---| +| Credit Card Magnetic Stripe Track 1 | High | Raw ISO/IEC 7813 Track 1 magnetic-stripe dumps, matched by the %B sentinel and cardholder/expiry field structure. | +| Credit Card Magnetic Stripe Track 2 | Medium | Raw ISO/IEC 7813 Track 2 magnetic-stripe dumps, matched by the leading ';' sentinel and expiry-date field structure. | +| Credit Card Number | High | Payment card numbers for major brands, validated with the Luhn checksum. | + +
+ +### Credentials + +The **Credentials** group targets cloud provider keys and tokens, private keys and certificates, passwords, connection strings, and chat-platform tokens. Every pattern here is also in **CMMC**. + +
+Credentials patterns (25) + +| Pattern | Confidence | Description | +|---|---|---| +| Amazon MWS Auth Token | High | Amazon Marketplace Web Service (MWS) authorization tokens, identified by their fixed amzn.mws. prefix. | +| AWS Access Key ID | High | AWS access key IDs embedded in code, configuration files, or connection strings, identified by AWS's fixed access-key-ID prefix. | +| AWS Account ID | Low | AWS account ID numbers, identified by a nearby aws_account_id-style label. | +| AWS Secret Access Key | Medium | AWS secret access keys — a bare 40-character base64-style secret — identified by a nearby aws_secret_access_key label. | +| AWS Session Token | Medium | AWS temporary session tokens, identified by a nearby aws_session_token-style label. | +| Azure Cosmos DB (DocumentDB) Auth Key | High | Azure Cosmos DB (DocumentDB) authorization keys, identified by a nearby DocumentDb label and their fixed base64 length. | +| Azure SAS Token | High | Azure Shared Access Signature (SAS) tokens, identified by their versioned sv=20YY-MM-DD query-string prefix. | +| Azure Storage Account Key | High | Azure Storage account keys embedded in code or connection strings, identified by their fixed base64 length. | +| Credentials | High | A broad set of application secrets and credentials — labeled API keys and tokens, JWTs, and vendor-specific tokens for GitHub, npm, SendGrid, Stripe, and Twilio — identified by their distinctive fixed-format prefixes or by a nearby secret/token label. | +| Credentials Embedded in URI | Medium | Usernames and passwords embedded directly in a URI, such as an FTP or database connection URL, identified by the scheme://user:pass@host structure. | +| Database Connection String | High | Database connection strings with an embedded password, identified by their Server=...;Password=... key-value format. | +| Generic Private Key | High | Private key material in PEM format, identified by the standard '-----BEGIN ... PRIVATE KEY-----' header. | +| Google Cloud API Key | High | Google Cloud API keys, identified by their fixed 'AIza' prefix. | +| Google Cloud OAuth Access Token | Medium | Google Cloud OAuth access tokens, identified by their fixed 'ya29.' prefix. | +| Google Cloud Service Account Key | High | Google Cloud service-account key files, identified by the JSON private_key_id field they contain. | +| Kerberos Ticket File (krbtgt .kirbi) | High | Exported Kerberos golden/silver ticket files, identified by the krbtgt filename fragment and .kirbi extension. | +| Password | Medium | Passwords appearing in configuration files, connection strings, and markup, identified by a nearby password label. | +| PEM certificate block | High | X.509 certificates in PEM format, identified by the standard '-----BEGIN CERTIFICATE-----' header. | +| PEM public key block | High | Public key material in PEM format, identified by the standard '-----BEGIN ... PUBLIC KEY-----' header. | +| PGP Key Block | High | PGP public and private key blocks, identified by their standard '-----BEGIN PGP ... KEY BLOCK-----' delimiters. | +| PKCS#7/P7B Certificate Block | High | PKCS#7/P7B certificate blocks, identified by the standard '-----BEGIN PKCS7-----' header. | +| Slack Token | High | Slack API tokens, identified by Slack's fixed token prefix. | +| Slack Webhook URL | High | Slack incoming-webhook URLs, identified by their fixed hooks.slack.com format. | +| SSH Authorized Keys | High | SSH public keys as they appear in authorized_keys files and key listings, identified by their key-type prefix and encoded key body. | +| UNIX /etc/passwd file exposure | Medium | Exposed UNIX /etc/passwd-style colon-delimited user records. | + +
+ +### Financial Records + +**Financial Records** centers on International Bank Account Numbers (IBANs): one generic IBAN pattern and one for each of 28 European countries. The other nine patterns are routing and bank account numbers, SWIFT/BIC bank identifier codes, securities identifiers, value-added tax (VAT) and employer identification numbers, and financial-statement terms. + +
+Financial Records patterns (38) + +| Pattern | Confidence | Description | +|---|---|---| +| ABA routing number | High | US bank routing numbers, validated against the ABA routing-number checksum. | +| Austrian IBAN | High | Austrian IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Belgian IBAN | High | Belgian IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Bulgarian IBAN | High | Bulgarian IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Croatian IBAN | High | Croatian IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| CUSIP Number | High | US/Canada CUSIP securities identifiers, validated against the ANSI X9.6 modulus-10 check-digit algorithm. | +| Cypriot IBAN | High | Cypriot IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Czech IBAN | High | Czech IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Danish IBAN | High | Danish IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Employer Identification Number (EIN) | Medium | US Employer Identification Numbers (EIN), identified by a nearby EIN or employer-identification label. | +| Estonian IBAN | High | Estonian IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Financial Document Indicators | Low | Financial-statement terms (EBITDA, operating margin, net income, and similar) appearing together with a currency amount. | +| Finnish IBAN | High | Finnish IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| French IBAN | High | French IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| French VAT number | Medium | French VAT identification numbers, identified by a nearby TVA/VAT label. | +| German IBAN | High | German IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| German VAT | Medium | German VAT identification numbers, identified by a nearby Mehrwertsteuer/USt-Id/VAT label. | +| Greek IBAN | High | Greek IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Hungarian IBAN | High | Hungarian IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| IBAN | High | International Bank Account Numbers, validated against the IBAN ISO 7064 check-digit algorithm. | +| Irish IBAN | High | Irish IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Italian IBAN | High | Italian IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Latvian IBAN | High | Latvian IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Lithuanian IBAN | High | Lithuanian IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Luxembourgian IBAN | High | Luxembourgish IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Maltan IBAN | High | Maltese IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Netherland IBAN | High | Dutch IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Polish IBAN | High | Polish IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Portuguese IBAN | High | Portuguese IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Romanian IBAN | High | Romanian IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Slovak IBAN | High | Slovak IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Slovenian IBAN | High | Slovenian IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Spain IBAN | High | Spanish IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| Spain VAT/CIF Number | Medium | Spanish VAT/CIF numbers, identified by a nearby IVA/VAT label and the mandatory ES country-code prefix. | +| Swedish IBAN | High | Swedish IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| SWIFT/BIC Code | High | SWIFT/BIC bank identifier codes, identified by a nearby SWIFT or BIC label and validated against BIC format rules. | +| UK IBAN | High | UK IBANs, validated against the IBAN ISO 7064 check-digit algorithm. | +| US bank account number | Low | Bank account numbers, matched as a 7- to 14-digit sequence with no additional validation. | + +
+ +### PHI + +**PHI** combines medical codes and provider identifiers with two patterns that detect clinical vocabulary and chart-style documentation phrasing. + +
+PHI patterns (5) + +| Pattern | Confidence | Description | +|---|---|---| +| HCPCS Codes | Medium | Healthcare Common Procedure Coding System (HCPCS) billing codes, matched against the closed list of known codes. | +| Medical code | High | Medical billing and diagnostic codes — ICD-10 diagnosis codes, CPT procedure codes, and NDC drug codes — identified by a nearby diagnosis, procedure, or drug-code label. | +| Medical license | High | National Provider Identifier (NPI) and DEA registration numbers for healthcare providers, identified by a nearby NPI or DEA label. | +| Medical Terms | Medium | Clinical vocabulary drawn from a curated medical dictionary — disease and condition names, prescription drug names, diagnostic procedures, and lab tests — counted toward a health-information determination when it appears alongside clinical-context phrasing and a patient or provider identifier. | +| Medical treatment | Medium | Clinical documentation phrasing — chart-section markers such as chief complaint, discharge summary, history of present illness, and assessment and plan — counted toward a health-information determination when combined with medical-term density, or on their own when several such markers appear together in a chart-style document. | + +
+ +### PII + +**PII** spans personal identifiers from countries around the world, contact details, addresses, network identifiers, dates of birth, salary data, and privileged legal documents. + +
+PII patterns (34) + +| Pattern | Confidence | Description | +|---|---|---| +| Australian Medicare Number (AMN) | Medium | Australian Medicare card numbers, identified by a nearby AMN or Medicare label. | +| Australian TFN | High | Australian Tax File Numbers, validated against the Australian Taxation Office's TFN check-digit algorithm. | +| Brazilian CPF | High | Brazilian CPF (individual taxpayer registry) numbers, identified by a nearby CPF or Brazilian tax-ID label and validated against the CPF check-digit algorithm. | +| Canadian address | High | Canadian street addresses, matched by house number, street name, and a standard street-type suffix (St, Ave, Blvd, Rd, and similar). | +| Canadian SIN | High | Canadian Social Insurance Numbers, validated against the SIN Luhn-style checksum. | +| Chinese Resident ID | High | Chinese Resident Identity Card numbers, identified by a nearby resident-ID or Chinese national-ID label and validated against the Resident ID check-digit algorithm. | +| Czech National ID (Občanský průkaz) | Medium | Czech national identity card numbers (Občanský průkaz), identified by a nearby ČOP or identification-card label. | +| Czech Passport Number | Low | Czech passport numbers, identified by a nearby passport or Cestovní pas label. | +| Date of birth | Medium | Dates of birth, identified by a nearby date-of-birth, DOB, or 'born on' label. | +| Driver's license | Medium | Driver's license numbers, identified by a nearby driver's-license or DL-number label. | +| Email address | Medium | Email addresses in standard local-part@domain format. | +| German national ID card number (Personalausweis) | Medium | German national identity card numbers (Personalausweis), identified by a nearby Personalausweis or Ausweis label. | +| German passport number | Medium | German passport numbers, identified by a nearby Reisepass or Ausweisnummer label. | +| Hungarian National ID | Medium | Hungarian national identity card numbers, identified by a nearby személyigazolvány szám label. | +| Indian Aadhaar | High | Indian Aadhaar (unique identification) numbers, identified by a nearby Aadhaar or Indian national-ID label and validated against the Aadhaar check-digit algorithm. | +| Indian PAN | High | Indian Permanent Account Numbers (PAN), identified by a nearby PAN or income-tax-PAN label and validated against the PAN format rules. | +| IPv4 Address | Low | IPv4 addresses in standard dotted-decimal notation. | +| IPv6 Address | Medium | IPv6 addresses in full 8-group hexadecimal-colon notation. | +| Japanese My Number | High | Japanese My Number (individual number) identifiers, identified by a nearby My Number or Japanese national-ID label and validated against the My Number check-digit algorithm. | +| MAC address | Medium | Network hardware (MAC) addresses in colon- or hyphen-separated hexadecimal form. | +| Medicare Beneficiary Identifier (MBI) | Low | US Medicare Beneficiary Identifiers (MBI), identified by a nearby Medicare-beneficiary or MBI label; the format carries no public checksum, so this stays a lower-confidence signal. | +| Mexican CURP | High | Mexican CURP (unique population registry code) numbers, identified by a nearby CURP or Mexican national-ID label and validated against the CURP format rules. | +| Passport Number | Medium | Passport numbers, identified by a nearby passport-number label. | +| Phone number | Low | Telephone numbers in US, UK, and general international dialing formats. | +| Privileged Legal Document | Low | Privileged legal filings, identified by their docket-style 'Case ... Document ... Filed' structure. | +| Salary data | High | Salary, wage, and compensation figures, identified by a nearby salary, pay, or compensation label and checked for a plausible currency amount. | +| Slovak Passport Number | Medium | Slovak passport numbers, identified by a nearby passport or Cestovný pas label. | +| Spain Passport | Medium | Spanish passport numbers, identified by a nearby Pasaporte label. | +| Swiss Social Security Number (AHV/AVS) | Medium | Swiss AHV/AVS social security numbers, identified either by their fixed 756. country-code prefix or by a nearby AHV-Nr/No AVS label. | +| UK NHS Number | High | UK NHS numbers, identified by a nearby NHS label and validated against the NHS number's modulus-11 check digit. | +| UK NINO | High | UK National Insurance numbers, validated against National Insurance number prefix and format rules. | +| US address | High | US street addresses, matched by house number, street name, and a standard street-type suffix (St, Ave, Blvd, Rd, and similar). | +| US ITIN | Medium | US Individual Taxpayer Identification Numbers (ITIN), identified by a nearby ITIN or taxpayer-ID label and validated against IRS ITIN numbering rules (a leading '9' with a qualifying group range). | +| US SSN | High | US Social Security numbers in formatted or unformatted form, validated against Social Security Administration allocation rules. | + +
diff --git a/docs/accessanalyzer/26.1/sensitive-data-patterns/custom-patterns.md b/docs/accessanalyzer/26.1/sensitive-data-patterns/custom-patterns.md new file mode 100644 index 0000000000..4cd0d67cb5 --- /dev/null +++ b/docs/accessanalyzer/26.1/sensitive-data-patterns/custom-patterns.md @@ -0,0 +1,123 @@ +--- +title: Custom Patterns +description: Create, test, edit, and delete your own sensitive data patterns and assign them to pattern groups. +sidebar_position: 2 +--- + +The built-in library covers regulated identifiers and secrets, not the identifiers specific to your organization: employee numbers, customer account codes, project codenames, and internal hostnames. A custom pattern is a regular expression you write for one of those, with a name, a confidence level, and the pattern groups it belongs to. + +After you save it, a custom pattern behaves like any other: it appears in the patterns table with its regular expression and a **Copy regex** button, it runs in every Sensitive data scan that classifies one of its groups, and its matches appear in reports under its name. Changes reach scans within about a minute. At scan time, a custom pattern records at most 10 matches per file. + +You need the Admin role to create, edit, or delete patterns. + +## Regular Expression Dialect + +Access Analyzer compiles custom patterns with a linear-time engine that uses the RE2 dialect. Linear-time matching means a pattern can't stall a scan on a pathological input, but it also means the engine rejects a few constructs from other regex engines: + +| Construct | Tokens | +|---|---| +| Lookahead | `(?=` and `(?!` | +| Lookbehind | `(?<=` and `(?` | +| Conditional patterns | `(?(` | + +The **Regex Pattern** field checks your expression on the server as you type. For lookarounds, atomic groups, and conditionals, the error names the construct and where it sits, ending in a message like: + +```text +unsupported syntax: positive lookahead `(?=` at byte offset 12: the linear engine does not support it +``` + +Rewrite the expression without the construct. You can usually replace a lookaround by matching the surrounding text as part of the pattern, and a word boundary (`\b`) at each end stops a pattern from matching inside a longer token. + +## Create a Custom Pattern + +1. Go to **Configuration > Sensitive data patterns**. +2. Click **Create Pattern**. +3. In **Name**, enter a name for the pattern. +4. In **Description**, describe what the pattern detects. +5. In **Regex Pattern**, enter the regular expression. +6. In **Confidence**, select **Low**, **Medium**, or **High**. +7. In **Groups**, select the pattern groups the pattern should belong to. +8. Under **Test before saving**, replace the sample text with values that should match and values that shouldn't, one per line. +9. Click **Test**. +10. Adjust the expression until the results are right. +11. Click **Create Pattern**. + +![Create Pattern dialog with Name, Description, Regex Pattern, Confidence, Groups, and Test before saving](/images/accessanalyzer/26.1/sensitive-data-patterns/create-pattern.webp) + +The pattern appears in the table, and a message confirms the save: **Pattern "``" created successfully.** + +| Field | Required | Details | +|---|---|---| +| **Name** | Yes | 1 to 255 characters. Shown in the patterns table, in group listings, and in reports. | +| **Description** | No | Up to 2,000 characters. | +| **Regex Pattern** | Yes | The regular expression, in the dialect described in [Regular expression dialect](#regular-expression-dialect). Access Analyzer validates it on the server as you type. | +| **Confidence** | Yes | **Low**, **Medium**, or **High**. Defaults to **Medium**. See [Confidence levels](index.md#confidence-levels). | +| **Groups** | No | Any combination of built-in and custom groups. A pattern in no group appears under **Ungrouped**. | + +Scans select groups, not individual patterns, so no scan can target a pattern that belongs to no group. Put it in at least one group. See [Pattern groups](pattern-groups.md). + +## Example: An Internal Employee ID + +Suppose employee IDs at your organization are the letters `EMP`, a hyphen, and six digits, and you want scans to flag documents that contain them. + +Fill in the **Create Pattern** dialog like this: + +| Field | Value | +|---|---| +| **Name** | Employee ID | +| **Description** | Internal employee identifiers in the form EMP- followed by six digits. | +| **Regex Pattern** | `\bEMP-\d{6}\b` | +| **Confidence** | **Medium** | +| **Groups** | **PII** (personally identifiable information) | + +The word boundaries keep the pattern from matching inside longer tokens such as `TEMP-123456` or `EMP-1234567`. Medium confidence is the right fit: the prefix is distinctive, but there is no checksum to rule out a made-up number. Putting the pattern in **PII**, a built-in group, means any scan that classifies that group picks it up without further configuration. Scans that inherit the global default set pick it up too, as long as PII is [scanned by default](pattern-groups.md#scanned-by-default). + +Paste this into **Sample text** with **Line by line** selected and click **Test**: + +```text +Employee: EMP-004821 +Manager: EMP-000317 +Badge: 4821 +Cost center: CC-004821 +``` + +The tester tints the first two lines green and the last two red, and the status reads **2 of 4 lines matched**. Click **Create Pattern**. + +## Edit a Custom Pattern + +1. Go to **Configuration > Sensitive data patterns**. +2. Find the pattern in the table, or type its name in the search box to filter the list. +3. In **Actions**, click **Edit pattern**. +4. Change the fields you need, including **Groups**. +5. Use **Test before saving** to confirm the new expression. +6. Click **Save Changes**. + +A message confirms the change: **Pattern "``" updated successfully.** + +If the pattern saves but its group changes fail, the message **Pattern "``" was saved, but its group memberships couldn't be updated.** appears, followed by the error. Click **Save Changes** again (or **Create Pattern**, when you're creating the pattern). The retry updates the saved pattern instead of creating a duplicate. + +## Delete a Custom Pattern + +:::warning + +Scans and groups that use a pattern don't block its deletion, and there is no in-use warning. The pattern stops running in scans within about a minute. + +::: + +1. Go to **Configuration > Sensitive data patterns**. +2. Find the pattern. +3. In **Actions**, click **Delete pattern**. +4. Confirm the deletion. + +A message confirms the deletion: **Pattern "``" was deleted successfully.** Deleting a pattern also removes it from every group. Findings already recorded keep the pattern's name, so historical reports don't change. + +## Manage a Pattern's Groups + +You can change a custom pattern's groups in two places: + +- In the pattern's **Edit Pattern** dialog, through the **Groups** field, where you set all of the pattern's groups at once. +- From a group's **Manage patterns** action, which adds or removes custom patterns for that one group. See [Pattern groups](pattern-groups.md#manage-the-patterns-in-a-group). + +Neither path changes a built-in pattern: you can't open **Edit pattern** for a built-in, and **Manage patterns** rejects adding or removing one. Their group membership is fixed. diff --git a/docs/accessanalyzer/26.1/sensitive-data-patterns/index.md b/docs/accessanalyzer/26.1/sensitive-data-patterns/index.md new file mode 100644 index 0000000000..1ccbd6b443 --- /dev/null +++ b/docs/accessanalyzer/26.1/sensitive-data-patterns/index.md @@ -0,0 +1,104 @@ +--- +title: Sensitive Data Patterns +description: How Access Analyzer uses regular expression patterns and pattern groups to classify sensitive data during scans, and where you manage them. +--- + +A sensitive data pattern is a regular expression with a name, a description, and a confidence level. When a Sensitive data scan reads a file, it extracts the text and runs the patterns against it. The scan records each hit against the file, noting the pattern that matched and the group it belongs to. + +A pattern group collects related patterns under a name you'd recognize from a compliance program or a data category, such as **PCI DSS** (Payment Card Industry Data Security Standard), **GDPR** (General Data Protection Regulation), or **Credentials**. Scans work at the group level: you choose which groups a scan classifies, and every pattern in those groups runs. + +Access Analyzer ships 139 built-in patterns in 11 built-in groups. You can add your own patterns and groups alongside them, and put custom patterns into built-in groups. + +To manage patterns and groups, go to **Configuration > Sensitive data patterns**. The page is available to the Admin role; see [Users and roles](../settings/users.md). + +## The Sensitive Data Patterns Page + +The page has two parts: the **Pattern Groups** panel on the left and the patterns table on the right. + +![Sensitive Data Patterns page with Pattern Groups and All Patterns](/images/accessanalyzer/26.1/sensitive-data-patterns/list.webp) + +### Pattern Groups Panel + +The panel starts with two fixed rows, **All Patterns** and **Ungrouped**, followed by one row per group. **Ungrouped** shows patterns that belong to no group. Selecting a group filters the table to that group's patterns and shows **Showing patterns in group** with the group name; click **Show all patterns** to clear the selection. + +Each group row shows the group's name and description, a **Built-in** badge for the groups that ship with the product, a **Scanned by default** switch, and an actions menu with **Test patterns**, **Manage patterns**, **Edit**, and **Delete**. The **Scanned by default** switch controls which groups a scan uses when it inherits the global configuration. + +Use the **Search pattern groups** field to filter groups by name and **New** to create a group. See [Pattern groups](pattern-groups.md). + +### Patterns Table + +The toolbar has a **Search patterns** field, a **Confidence** filter, **Clear filters**, and **Create Pattern**. The table shows 25 patterns per page; you can switch to 10 or 50. + +![Confidence filter with All Confidence Levels, Low, Medium, High](/images/accessanalyzer/26.1/sensitive-data-patterns/confidence-filter.webp) + +| Column | What it shows | +|---|---| +| **Name** | The pattern name. | +| **Regex / Description** | For built-in patterns, the description of what the pattern detects. For custom patterns, the regular expression, with a **Copy regex** button. | +| **Confidence** | A badge with the pattern's confidence level: Low, Medium, or High. | +| **Groups** | The pattern groups the pattern belongs to. | +| **Actions** | **Test pattern**, **Edit pattern**, and **Delete pattern**. You can't edit or delete built-in patterns. | + +## Confidence Levels + +Confidence describes how much you should trust a match. It's a label on the pattern; the **Confidence** column shows it and the **Confidence** filter uses it. + +The built-in patterns show what each level means: + +| Level | Use it for | Built-in examples | +|---|---|---| +| **High** | Formats with a checksum, a fixed prefix, or another strong structural signal, so a match is rarely accidental. | **Credit Card Number** (Luhn checksum), **US SSN** (Social Security number allocation rules), **AWS Access Key ID** (fixed Amazon Web Services prefix) | +| **Medium** | Distinctive formats without a checksum, often matching only when a label such as "DOB" or "password" appears nearby. | **Email address**, **Password**, **Date of birth** | +| **Low** | Generic shapes that legitimately occur in non-sensitive text. | **Phone number**, **IPv4 Address**, **US bank account number** (a 7- to 14-digit sequence with no validation) | + +Use the same reasoning when you set the confidence of a [custom pattern](custom-patterns.md). + +## Built-in and Custom Patterns + +Built-in patterns and groups carry a **Built-in** badge. You can't edit or delete them, and you can't add a built-in pattern to a group or remove it from one. There is no switch to turn off an individual built-in pattern; the way to narrow a scan is to choose which groups it classifies. The full list is in [Built-in patterns](built-in-patterns.md). + +Custom patterns are yours to create, test, edit, and delete. A custom pattern can belong to any number of groups, including built-in ones. For example, an internal employee ID pattern can sit in the built-in **PII** (personally identifiable information) group so that any scan that classifies PII also runs it. Changes to custom patterns and their group memberships reach scans within about a minute. See [Custom patterns](custom-patterns.md). + +## How Groups Feed Sensitive Data Scans + +Two settings decide which groups a Sensitive data scan classifies: + +- **Scanned by default**, set per group on this page, defines the global default set. +- **Inherit from global configuration**, on the scan's **Configure** step under **Sensitive data classification**, is on for new scans and uses the default set. Turn it off to pick groups in **Sensitive Data Pattern Groups to Classify**. + +An empty set doesn't turn classification off. If no group is scanned by default and the scan inherits, or if the scan overrides without selecting any group, the scan classifies against all groups, built-in and custom. When the set contains at least one group, the scan records only findings from those groups. + +[Pattern groups](pattern-groups.md) has the details and a diagram of how a scan picks its groups. For the scan side, see [Scan types](../scans/scan-types.md). + +## Test Patterns + +You can run a pattern against sample text in three places: in the **Test before saving** section of the **Create Pattern** and **Edit Pattern** dialogs, from **Test pattern** in a pattern's **Actions**, and from **Test patterns** in a group's actions menu. + +The tester opens with a short prefilled sample containing an SSN, a card number, an email address, a phone number, and two sentences of plain prose. + +1. In **Sample text**, replace the sample with your own text. +2. Select **Line by line** or **Multiline**. +3. Click **Test**. + +| Mode | How the tester treats the text | Result | +|---|---|---| +| **Line by line** (default) | The tester checks each line separately, tinting matching lines green and non-matching lines red. | **X of Y lines matched** | +| **Multiline** | The tester checks the whole text as one document and highlights every match in place. | **N matches**, or **No matches**. Above 100 matches, it highlights only the first 100 and the status adds **(first 100 shown)**. | + +If you change the pattern or the text after a run, the highlights dim and the status reads **Results outdated — run Test again.** + +A test accepts up to 64 KB of sample text and up to 200 lines in **Line by line** mode. Each test has 2 seconds to complete; a group test shares those 2 seconds across every pattern in the group. + +## What a Scan Classifies + +A Sensitive data scan extracts text from Excel workbooks, Word documents, Portable Document Format (PDF) files, and plain text files. It doesn't extract text from images, and it can't read encrypted Office documents. + +The scan skips files above the size limit. The default limit is 10 MB for both File Server and SharePoint Online sources, adjustable between 1 and 100 MB. Each source type also has a list of excluded file extensions covering media, binaries, fonts, and archives. Both settings live in the **Classification** card of [Application settings](../settings/application.md). + +At scan time, a custom pattern records at most 10 matches per file. Built-in patterns run under a per-pattern time budget of 250 ms per file, controlled by the `enable_pattern_execution_budget` flag in [Feature flags](../settings/feature-flags.md). The flag is on by default. When a pattern overruns its budget, the scan logs the overrun and keeps the matches the pattern found. + +## Where Matches Appear + +For each file, a scan stores the group name, the pattern name, and the number of matches. It never stores the matched text itself, so reports show which files contain which kinds of sensitive data, not the values. + +The **Sensitive Data Overview** report under **File system** lists shares, hosts, and files with sensitive data and lets you filter by **Pattern Group** and **Pattern**. The SharePoint report of the same name summarizes sensitive data found across SharePoint sites: files with sensitive data, the types of sensitive data found, and links with sensitive data. See [Dashboards and reports](../dashboards-reports/index.md). diff --git a/docs/accessanalyzer/26.1/sensitive-data-patterns/pattern-groups.md b/docs/accessanalyzer/26.1/sensitive-data-patterns/pattern-groups.md new file mode 100644 index 0000000000..66e402dbb7 --- /dev/null +++ b/docs/accessanalyzer/26.1/sensitive-data-patterns/pattern-groups.md @@ -0,0 +1,135 @@ +--- +title: Pattern Groups +description: Create and manage pattern groups, choose which groups are scanned by default, and understand how group selection shapes a Sensitive data scan. +sidebar_position: 3 +--- + +A pattern group is a named set of sensitive data patterns. Groups are the unit a Sensitive data scan works with: when you configure a scan, you pick groups, and the scan keeps findings only for the patterns in those groups. The scan records each finding under both the pattern name and the group name, and the **Sensitive Data Overview** report lets you filter on either. + +Access Analyzer ships 11 built-in groups, from **PCI DSS** (Payment Card Industry Data Security Standard) and **HIPAA** (Health Insurance Portability and Accountability Act) to **Credentials** and **PII** (personally identifiable information). They're listed with their patterns in [Built-in patterns](built-in-patterns.md). You can create your own groups for anything the built-in set doesn't capture, such as a group per business unit or per project, and fill them with [custom patterns](custom-patterns.md). + +You manage groups in the **Pattern Groups** panel on **Configuration > Sensitive data patterns**. The page needs the Admin role. + +## View the Patterns in a Group + +Click a group in the **Pattern Groups** panel. The patterns table filters to that group's patterns and shows **Showing patterns in group** together with the group name. Search and the **Confidence** filter keep working within the group. + +![Sensitive Data Patterns page filtered to the CCPA group](/images/accessanalyzer/26.1/sensitive-data-patterns/group-selected.webp) + +Click **Show all patterns** to return to the full list. The **Ungrouped** row works the same way for patterns that belong to no group. + +## Create a Pattern Group + +1. Go to **Configuration > Sensitive data patterns**. +2. In the **Pattern Groups** panel, click **New**. +3. In **Name**, enter a name for the group. +4. In **Description**, describe what the group is for. +5. In **Tags**, add any tags you want to attach to the group. +6. Click **Create Group**. + +![Create Pattern Group dialog with Name, Description, and Tags](/images/accessanalyzer/26.1/sensitive-data-patterns/create-pattern-group.webp) + +The group appears in the panel without a **Built-in** badge, and a message confirms the save: **Pattern group "``" created successfully.** + +| Field | Required | Details | +|---|---|---| +| **Name** | Yes | 1 to 255 characters. Group names are unique regardless of case, so `hr data` can't coexist with `HR Data`. | +| **Description** | No | Up to 2,000 characters. Shown under the group name in the panel and in the scan's group picker. | +| **Tags** | No | Free-text keywords attached to the group. | + +A new group is empty. Add patterns to it with **Manage patterns**, or set the group in a pattern's **Groups** field when you create or edit the pattern. + +## Edit a Pattern Group + +1. In the **Pattern Groups** panel, open the group's actions menu. +2. Click **Edit**. +3. Change **Name**, **Description**, or **Tags**. +4. Click **Save Changes**. + +![Pattern group menu with Test patterns, Manage patterns, Edit, and Delete](/images/accessanalyzer/26.1/sensitive-data-patterns/group-actions.webp) + +You can't edit or delete built-in groups. Scans and the default set refer to groups by name. After you rename a custom group, reselect it in any scan that picks its own groups, and check its **Scanned by default** switch. + +## Manage the Patterns in a Group + +1. In the **Pattern Groups** panel, open the group's actions menu. +2. Click **Manage patterns**. +3. Under **Add existing patterns**, select one or more patterns in **Select patterns to add**. +4. Click **Add Selected**. +5. To remove a pattern, click the remove icon next to it under **Current patterns**. +6. Click **Close**. + +A message confirms each change: **Patterns added to the group.** or **Pattern removed from the group.** Changes apply immediately; there is no separate save. + +**Manage patterns** works on custom patterns only, in built-in and custom groups alike. Built-in patterns keep the memberships they ship with, so in a built-in group you can add your own patterns but can't change the built-in ones. A group with nothing added yet shows **No patterns in this group yet.** + +:::tip + +If a custom pattern you expect isn't offered in **Select patterns to add**, open the pattern with **Edit pattern** and add the group in its **Groups** field instead. Both paths produce the same membership. + +::: + +## Test a Group's Patterns + +1. In the **Pattern Groups** panel, open the group's actions menu. +2. Click **Test patterns**. +3. Select **Line by line** or **Multiline**. +4. In **Sample text**, paste text that should trigger the group's patterns. +5. Click **Test**. + +![Test patterns dialog for a pattern group](/images/accessanalyzer/26.1/sensitive-data-patterns/group-test-patterns.webp) + +The **Test Group — ``** dialog shows one highlighted section per pattern in the group, headed by the pattern name, so you can see which patterns fired on which parts of the text. A pattern that fails to compile shows its error in red inside its own section, and the other patterns still run. + +A group test shares a single 2-second limit across every pattern in the group, so keep samples short for large groups such as **GDPR** (General Data Protection Regulation). See [Test patterns](index.md#test-patterns) for the modes and result formats. + +## Scanned by Default + +Every group row has a **Scanned by default** switch. Together, the groups with the switch on form the global default set: the groups a Sensitive data scan classifies against when it inherits the global configuration rather than choosing its own. + +The switch saves as soon as you turn it on or off, for built-in and custom groups alike. If the save fails, a message reports it: **Failed to update the default scan setting for "``".** + +Turning every switch off doesn't stop classification. A scan that inherits an empty default set classifies against all groups; see [How a scan picks its groups](#how-a-scan-picks-its-groups). + +## How a Scan Picks Its Groups + +On a Sensitive data scan's **Configure** step, the **Sensitive data classification** section has two cards. **Configuration source** holds the **Inherit from global configuration** switch, on for new scans. While it's on, the alert **Using global configuration with `` pattern groups enabled.** tells you how many groups the default set holds. Turn it off to pick groups for this scan alone in **Sensitive Data Pattern Groups to Classify**, where you can search, select individual groups, or click **Select All**. + +![Sensitive data scan settings with pattern groups to classify](/images/accessanalyzer/26.1/scans/create-scan-sensitive-3-configure.webp) + +When the scan runs, it resolves its groups like this: + +```mermaid +flowchart LR + A[Scan starts] --> B{Scan selects its own groups?} + B -- Yes --> C[Use the scan's groups] + B -- No --> D{Inherit from global configuration?} + D -- Yes --> E[Use the Scanned by default groups] + D -- No --> F[No groups] + C --> G{Any groups?} + E --> G + F --> G + G -- Yes --> H[Record findings only for those groups] + G -- No --> I[Record findings for all groups] +``` + +Two things follow from this: + +- An empty set means everything, not nothing. If no group is scanned by default and a scan inherits, or a scan overrides with no groups selected, the scan classifies against all groups, built-in and custom. +- The scan matches groups by name. When the set isn't empty, it keeps findings only for patterns in groups with those names, so a scan that names a deleted group records nothing for it. + +For the other **Configure** settings and their defaults, see [Scan types](../scans/scan-types.md); for creating, editing, and running a scan, see [Scans](../scans/index.md). + +## Delete a Pattern Group + +1. In the **Pattern Groups** panel, open the group's actions menu. +2. Click **Delete**. +3. Confirm the deletion. + +A message confirms the deletion: **Pattern group "``" was deleted successfully.** Deleting a group doesn't delete its patterns: they keep their other memberships, and a pattern with no other group moves to **Ungrouped**. You can't delete built-in groups. + +:::warning + +You can delete a group even when scans select it or its **Scanned by default** switch is on. A scan whose own selection still names the deleted group records no findings for that name, and if that was its only group, the scan records no findings at all until you edit its group selection. + +::: diff --git a/docs/accessanalyzer/2601/configurations/service-accounts/_category_.json b/docs/accessanalyzer/26.1/service-accounts/_category_.json similarity index 81% rename from docs/accessanalyzer/2601/configurations/service-accounts/_category_.json rename to docs/accessanalyzer/26.1/service-accounts/_category_.json index 25ffc0442b..1cb8d82372 100644 --- a/docs/accessanalyzer/2601/configurations/service-accounts/_category_.json +++ b/docs/accessanalyzer/26.1/service-accounts/_category_.json @@ -1,6 +1,6 @@ { "label": "Service Accounts", - "position": 10, + "position": 40, "collapsed": true, "collapsible": true } diff --git a/docs/accessanalyzer/26.1/service-accounts/client-id-certificate.md b/docs/accessanalyzer/26.1/service-accounts/client-id-certificate.md new file mode 100644 index 0000000000..6d43ec7e91 --- /dev/null +++ b/docs/accessanalyzer/26.1/service-accounts/client-id-certificate.md @@ -0,0 +1,130 @@ +--- +title: Client ID and Certificate +description: Create a Client ID/certificate service account for SharePoint Online sources, with a certificate Access Analyzer generates or one you upload. +sidebar_position: 3 +--- + +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + +A Client ID/certificate account holds the application (client) ID and tenant ID of an app registration in Microsoft Entra ID, plus a certificate whose private key proves the application's identity. SharePoint Online sources use this type; they don't accept a client secret. The form labels this type **Client ID/certificate**. + +Access Analyzer holds the private key, and the app registration holds the matching public certificate. Both halves must be in place before a scan can authenticate, so update the app registration whenever you change the certificate here. + +## Certificate Options + +When you create the account, the **Certificate** section offers two choices. + +| Option | What happens | Choose it when | +|---|---|---| +| **Generate for me** (default) | Access Analyzer creates a self-signed certificate with a 2048-bit RSA key when you click **Add account**. It's valid for one year. You download the public certificate and upload it to the app registration. | You want the quickest path and your organization accepts self-signed certificates for app authentication. | +| **Upload my own** | You provide one `.pem` file containing the certificate and its unencrypted private key. | Your organization issues certificates from its own certificate authority, or the app registration already has the certificate. | + +Whichever you choose, Access Analyzer keeps the private key. You can't download it, and Access Analyzer discards it when you regenerate or replace the certificate. + +### Requirements for an Uploaded PEM File + +| Requirement | Detail | +|---|---| +| File | A single `.pem` file, up to 1 MB, with the certificate and the private key in the same file. | +| Certificate | At least one `CERTIFICATE` block. The first is the account's certificate; Access Analyzer keeps any further blocks as its chain. The certificate must not be expired. | +| Private key | Exactly one key block in Public-Key Cryptography Standards (PKCS) #1 format (`RSA PRIVATE KEY`) or PKCS #8 format (`PRIVATE KEY`). The key must match the certificate. | +| Not accepted | Passphrase-protected keys, elliptic-curve (EC) keys, and PFX or PKCS #12 files. | + +The form checks the file before you can continue and shows one of these messages when it finds a problem. + +| Message | Cause | +|---|---| +| **No certificate found in the file. Upload a combined PEM containing both the certificate and its private key.** | The file has no `CERTIFICATE` block. | +| **No private key found in the file. Upload a combined PEM containing both the certificate and its private key.** | The file has no key block. | +| **The private key is encrypted. Upload a PEM with an unencrypted private key.** | The key is passphrase-protected. | + +The form can't detect every problem. An EC key, a key that doesn't match the certificate, or an expired certificate fails after you click **Add account**, and the panel reads **Certificate upload failed** with the reason. If your certificate and key are in separate files, combine them into one file first. + +## Fields + +| Field | Required | Notes | +|---|---|---| +| **Name** | Yes | The name shown in the list and on sources. | +| **Service account type** | Yes | Select **Client ID/certificate**. | +| **Client (application) ID** | Yes | The app registration's application ID, a globally unique identifier (GUID) in the form `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. | +| **Tenant ID** | Yes | The directory (tenant) ID of your Entra tenant, also a GUID. For SharePoint Online, the tenant ID lives here on the account, not on the source. | +| **Certificate** | — | Defaults to **Generate for me**. Select **Upload my own** to add a `.pem` file in the **Upload a combined PEM file** area instead; a file is then required. | + +Validation runs when you leave a field. An ID that isn't a GUID shows **Client (Application) ID must be a valid GUID (e.g. xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)** or **Tenant ID must be a valid GUID (e.g. xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)**; choosing **Upload my own** without a file shows **Certificate file is required**. + +![Add service account dialog with Client ID/certificate selected](/images/accessanalyzer/26.1/service-accounts/add-client-id-certificate.webp) + +## Create a Client ID/Certificate Service Account + + + + +1. Go to **Configuration > Service accounts**. +2. Click **Add service account**. +3. In **Name**, enter a name, for example `sharepoint-online-scanner`. +4. In **Service account type**, select **Client ID/certificate**. +5. In **Client (application) ID** and **Tenant ID**, paste the values from the app registration. +6. Under **Certificate**, leave **Generate for me** selected. +7. Click **Add account**. + + Access Analyzer creates the account and then the certificate. The panel moves to a certificate step headed **Account created and certificate generated**, showing the certificate's thumbprint and **Expires** followed by the date. + +8. Click **Download certificate (.pem)**. Access Analyzer names the file after the account, for example `sharepoint-online-scanner-certificate.pem`, and includes the public certificate only. +9. To keep the thumbprint for comparison, click the **Copy thumbprint** icon next to it. +10. Click **Done**. +11. In the Microsoft Entra admin center, open the app registration. +12. Go to **Certificates & secrets**. +13. Upload the file you downloaded. +14. Compare the thumbprint Entra shows with the one you copied. If you need it again, open the account with **Actions > Edit**; the **Certificate** section shows it. + +Until the public certificate is on the app registration, scans that use this account can't authenticate. + +If certificate generation fails, the panel reads **Certificate generation failed** and shows the reason. The account exists but has no certificate. Click **Try again**, or click **Close** and add a certificate later by editing the account (see [Manage the certificate](#manage-the-certificate)). + + + + +1. Go to **Configuration > Service accounts**. +2. Click **Add service account**. +3. In **Name**, enter a name, for example `sharepoint-online-scanner`. +4. In **Service account type**, select **Client ID/certificate**. +5. In **Client (application) ID** and **Tenant ID**, paste the values from the app registration. +6. Under **Certificate**, select **Upload my own**. +7. Add your combined `.pem` file in the **Upload a combined PEM file** area. +8. Click **Add account**. + +Access Analyzer creates the account and uploads the certificate. On success, the message **Service account created** appears with the detail **Certificate uploaded**, and the panel closes. + +Register the same certificate on the app registration under **Certificates & secrets** if it isn't already there. If you need the public part again, edit the account and click **Download**. + +If the upload fails, the panel reads **Certificate upload failed** with the reason, and the upload area reappears. Fix the file and click **Try again**, or click **Close** and add a certificate later by editing the account. + + + + +Then create or edit the SharePoint Online source, select this account in **Service account**, and click **Test connection**. For the source settings, see [Microsoft 365](../sources/microsoft-365.md); for the whole path from app registration to first scan, see [Scan Microsoft 365](../guides/microsoft-365.md). + +## Manage the Certificate + +Open the account with **Actions > Edit**. The **Certificate** section shows the current thumbprint and expiry date with three buttons. Unlike the rest of the form, these act right away: **Download** on click; **Regenerate** and **Replace** as soon as you confirm their dialogs. You don't need to click **Save changes**. + +| Button | What it does | +|---|---| +| **Download** | Downloads the public certificate as `-certificate.pem`, where the account name appears in lowercase with hyphens between words. Use it when you need to register the certificate on another app registration or no longer have the earlier download. | +| **Regenerate** | Creates a new self-signed certificate and private key, discarding the old ones. The **Regenerate certificate** dialog warns that scans using this account fail until you upload the new public certificate to the app registration. After you confirm, download the new certificate and upload it under **Certificates & secrets**. | +| **Replace** | Lets you upload a different combined `.pem` file that meets the [requirements for an uploaded PEM file](#requirements-for-an-uploaded-pem-file). Click **Upload and replace**, then confirm in the **Replace certificate** dialog. Scans fail unless the app registration already has the new certificate. | + +If the account has no certificate, for example because generation failed when you created it, the section shows **Generate certificate** and **Upload certificate** buttons together with the warning **No certificate is attached to this account. Scans can't authenticate until you add one.** + +## Renew the Certificate Before It Expires + +A generated certificate is valid for one year from the day you create it. The **Certificate** section shows **Expires** and the date; after the date passes, it shows **Expired** in red. Plan to renew before then: + +1. Open the account with **Actions > Edit**. +2. Click **Regenerate**. +3. In the **Regenerate certificate** dialog, click **Regenerate** to confirm. +4. Click **Download**. +5. Upload the new certificate to the app registration under **Certificates & secrets**. + +Scans that use the account fail between step 3 and step 5, so complete all the steps without a break. If you uploaded your own certificate, use **Replace** with the renewed file from your certificate authority instead. diff --git a/docs/accessanalyzer/26.1/service-accounts/client-id-secret.md b/docs/accessanalyzer/26.1/service-accounts/client-id-secret.md new file mode 100644 index 0000000000..9f1c6378f6 --- /dev/null +++ b/docs/accessanalyzer/26.1/service-accounts/client-id-secret.md @@ -0,0 +1,61 @@ +--- +title: Client ID and Secret +description: Create a Client ID/secret service account for Entra ID sources from an app registration's application ID and client secret. +sidebar_position: 2 +--- + +A Client ID/secret account holds the application (client) ID and a client secret of an app registration in Microsoft Entra ID. Entra ID sources use it to sign in as the application and read the directory. No user signs in, and the account holds no user password; the application permissions granted to the app registration decide what the account can read. The form labels this type **Client ID/secret**. + +## When to Use It + +Use a Client ID/secret account for Entra ID sources. It's the only type that works for them; the source form doesn't stop you from picking another type, but a scan that uses one fails when it runs. + +SharePoint Online sources don't use this type. They authenticate with a certificate; see [Client ID and certificate](client-id-certificate.md). + +:::note + +This account is for scanning. Letting your team sign in to Access Analyzer with their Entra ID identities is a separate setup, described in [Single sign-on](../settings/single-sign-on.md). + +::: + +## What You Need From the App Registration + +- Its **Application (client) ID**, a globally unique identifier (GUID). +- A client secret, created under **Certificates & secrets** on the app registration. Copy the secret's value. + +You don't enter the tenant ID on this account. It belongs to the Entra ID source, together with the **Azure cloud** setting. For the source settings and the permissions the app registration needs, see [Entra ID](../sources/entra-id.md). + +## Create a Client ID/Secret Service Account + +1. Go to **Configuration > Service accounts**. +2. Click **Add service account**. +3. In **Name**, enter a name, for example `entra-id-scanner`. +4. In **Service account type**, select **Client ID/secret**. +5. In **Client (application) ID**, paste the app registration's application ID. +6. In **Client secret**, paste the secret's value. +7. Click **Add account**. + +![Add service account dialog with Client ID/secret selected](/images/accessanalyzer/26.1/service-accounts/add-client-id-secret.webp) + +Next, select this account in **Service account** on the Entra ID source and click **Test connection**. [Scan Entra ID](../guides/entra-id.md) walks through the whole setup, from app registration to first scan. + +## Rotate the Client Secret + +When you create a new secret on the app registration, update the account before the old secret expires. + +1. On the account's row, click **Actions > Edit**. +2. In **Client secret**, paste the new value. The field starts empty. +3. Click **Save changes**. + +If scans already use this account, the **Confirm service account update** dialog lists them before the change goes through. When you continue, running executions restart with the new secret. [Service accounts](index.md#the-confirm-service-account-update-dialog) explains what the dialog does. + +## Fields + +| Field | Required | Notes | +|---|---|---| +| **Name** | Yes | The name shown in the list and on sources. | +| **Service account type** | Yes | Select **Client ID/secret**. | +| **Client (application) ID** | Yes | A GUID in the form `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. | +| **Client secret** | Yes | The secret's value. Masked as you type. | + +Validation runs when you leave a field. An ID that isn't a GUID shows **Client (Application) ID must be a valid GUID (e.g. xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)**; an empty secret shows **Client secret is required**. diff --git a/docs/accessanalyzer/26.1/service-accounts/index.md b/docs/accessanalyzer/26.1/service-accounts/index.md new file mode 100644 index 0000000000..37b7f98764 --- /dev/null +++ b/docs/accessanalyzer/26.1/service-accounts/index.md @@ -0,0 +1,106 @@ +--- +title: Service Accounts +description: Store the credentials Access Analyzer uses to read your sources and deploy agents, and manage them from one page. +--- + +A service account is a saved credential that Access Analyzer uses on your behalf: a Windows account that can read a file server, an app registration that can query Entra ID or SharePoint Online, or an SSH key that can sign in to a Linux machine. You create the account once, attach it to the sources that need it, and every scan of those sources authenticates with it. Rotate a password in one place and every source that uses it picks up the change. + +Service accounts that read a source need read-only permissions. Access Analyzer collects metadata and permissions from your systems; it doesn't need to change anything there. The exception is the SSH username/key account used to deploy an agent: Access Analyzer signs in with it to install the agent software, so that user needs passwordless `sudo` on the target machine. See [Deploy an agent](../agents/deploy-agent.md). + +Manage them at **Configuration > Service accounts**. + +![Service accounts list with Name, Account Type, and Created At columns](/images/accessanalyzer/26.1/service-accounts/list.webp) + +## The Service Accounts Page + +The page lists every account in a table. Enter text in **Search service accounts…** to filter the list, and click **Clear filters** next to it to reset. **Add service account** opens the form. + +| Column | What it shows | +|---|---| +| **Name** | The name you gave the account. Sources and the CSV import refer to accounts by this name. | +| **Account Type** | One of the four types; see [Service account types](#service-account-types). | +| **Created At** | When you created the account. The list sorts by this column, newest first, until you click another header. | +| **Last Updated** | When you last saved the account. | +| **Actions** | A menu with **Edit** and **Delete**. | + +**Rows per page** offers 10, 25, 50, or 100 rows. Before you add anything, the page reads **No service accounts yet**; if a search matches nothing, it reads **No service accounts match your filters**. + +![Service account row menu with Edit and Delete](/images/accessanalyzer/26.1/service-accounts/row-actions.webp) + +## Service Account Types + +Each account has one type. You choose it when you create the account, and it stays fixed from then on. The type decides which fields the form asks for and which systems the account can authenticate to. + +| Type (as shown in the form) | Use it for | Details | +|---|---|---| +| **Username/password** | File Server sources and Active Directory sources | [Username and password](username-password.md) | +| **Client ID/secret** | Entra ID sources | [Client ID and secret](client-id-secret.md) | +| **Client ID/certificate** | SharePoint Online sources | [Client ID and certificate](client-id-certificate.md) | +| **SSH username/key** | Deploying agents | [SSH username and key](ssh-key.md) | + +For example, a File Server source pointing at `fs01.corp.example.com` needs a Username/password account for a domain user that can read the shares you want to scan. A SharePoint Online source needs a Client ID/certificate account for an app registration in the same tenant. + +:::warning + +The **Service account** list on a source shows every account, whatever its type. Use the type from the preceding table for the source you're configuring. Access Analyzer doesn't reject a mismatched account when you save the source; the scan fails when it runs. + +::: + +## Secret Handling + +Access Analyzer treats passwords, client secrets, SSH private keys, and certificate private keys as write-only. After you save an account, Access Analyzer never displays the value again, in the list or in the edit form. When you edit an account, the secret fields are empty. Leave a field empty to keep the stored value, or enter a new value to replace it. + +Access Analyzer keeps secret values in a secret store on the server, separate from the product database, which holds only a reference to each one. Scans receive the reference and resolve it when they run. For certificate accounts, you can download only the public certificate, never the private key. + +If you bulk-add sources with a CSV file, the file names the service account to attach and never contains credentials. See [Import sources from a CSV file](../sources/import-sources.md). + +## Add a Service Account + +1. Go to **Configuration > Service accounts**. +2. Click **Add service account**. The **Add service account** form opens. +3. In **Name**, enter a name that tells you what the account is for, such as `corp-file-servers`. +4. In **Service account type**, select a type. The form preselects **Username/password**. + + ![Service account type dropdown listing the four account types](/images/accessanalyzer/26.1/service-accounts/add-type-menu.webp) + +5. Fill in the fields for that type, as described in [Username and password](username-password.md), [Client ID and secret](client-id-secret.md), [Client ID and certificate](client-id-certificate.md), or [SSH username and key](ssh-key.md). +6. Click **Add account**. + +If you change the type after you've started filling in fields, the **Confirm service account type change** dialog warns that the change clears the values you entered. After you save the account, you can't change its type; create a new account instead. + +## Edit a Service Account + +1. In the account's **Actions** menu, click **Edit**. +2. Change the name or the non-secret fields as needed. +3. To rotate a secret, enter the new value in the empty field. Leave it empty to keep the current one. +4. Click **Save changes**. + +![Edit service account dialog](/images/accessanalyzer/26.1/service-accounts/edit.webp) + +### The Confirm Service Account Update Dialog + +If any scan or Identity sync uses the account, the **Confirm service account update** dialog opens before Access Analyzer saves the change. It lists the affected scans and syncs by name (the first five, with a count of the rest) and spells out what happens when you continue: + +- Access Analyzer stops any running executions of those scans and syncs. +- It reconfigures the scans and syncs with the new credentials. +- It restarts the stopped executions. A scheduled execution restarts right away and then continues on its normal schedule. A manually started execution restarts once; after that, you run it manually as before. + +Click **Yes, update service account** to continue, or **Cancel** to leave the account as it was. To follow the restarted executions, see [Scan executions](../scans/scan-executions.md). + +## Delete a Service Account + +1. In the account's **Actions** menu, click **Delete**. +2. In the **Delete Service account** dialog, confirm that it names the account you mean to delete. +3. Click **Delete Service account**. + +The message **Service account deleted** confirms the removal. + +### Why a Delete Can Fail + +You can't delete an account that's attached to a source. Access Analyzer refuses the request and shows **Failed to delete service account** with a message that sources are using the account. Nothing warns you in advance: the list has no in-use column, and **Delete** stays available in the menu. + +To remove such an account: + +1. Go to **Configuration > Sources**. The **Service account** column shows which account each source uses. +2. For each source that uses the account, change **Service account** to another account or to **None**. See [Sources](../sources/index.md). +3. Delete the account. diff --git a/docs/accessanalyzer/26.1/service-accounts/ssh-key.md b/docs/accessanalyzer/26.1/service-accounts/ssh-key.md new file mode 100644 index 0000000000..2c57ed46f7 --- /dev/null +++ b/docs/accessanalyzer/26.1/service-accounts/ssh-key.md @@ -0,0 +1,72 @@ +--- +title: SSH Username and Key +description: Create an SSH username/key service account that Access Analyzer uses to deploy agents onto Linux machines. +sidebar_position: 4 +--- + +An SSH username/key account is a Linux username and an SSH private key. Access Analyzer uses it for one purpose: deploying agents. When you deploy an agent, Access Analyzer signs in to the target machine over SSH with this account, runs the preflight checks, and installs the agent software. Scans never use SSH accounts. Agent deployment authenticates with a key only; the **Service account** list in the **Deploy agent** panel shows SSH username/key accounts and nothing else. + +## Requirements on the Target Machine + +The user must be able to sign in over SSH with the key you paste and run `sudo` without a password prompt, because the deployment installs system software. The preflight checks also expect `bash` and `curl` on the machine. For the full host requirements, see [Deploy an agent](../agents/deploy-agent.md). + +## Key Formats + +The form accepts a PEM-framed private key: the text must start with `-----BEGIN ` and contain an `-----END ` line. If it doesn't, the form shows **SSH key must be in PEM or OpenSSH format**. Three common formats meet this rule. + +| Format | First line | +|---|---| +| OpenSSH | `-----BEGIN OPENSSH PRIVATE KEY-----` | +| Public-Key Cryptography Standards (PKCS) #1 | `-----BEGIN RSA PRIVATE KEY-----` | +| PKCS #8 | `-----BEGIN PRIVATE KEY-----` | + +Access Analyzer doesn't support passphrase-protected keys. There's no field for a passphrase, and deployment rejects an encrypted key with the message **passphrase-protected SSH private keys aren't supported; provide an unencrypted key**. Create a key without a passphrase and dedicate it to agent deployment. + +## SSH Host Key + +The service account identifies Access Analyzer to the machine. The machine's own identity, its SSH host key, isn't part of the account. You enter it per agent, in the **SSH host key** field of the **Deploy agent** panel, next to **SSH host** and **SSH port**. One account can therefore deploy any number of agents. [Deploy an agent](../agents/deploy-agent.md#get-the-host-key) explains how to collect the host key from the machine. + +![Deploy agent panel with Name, SSH host, SSH host key, SSH port, Service account, and Labels](/images/accessanalyzer/26.1/agents/deploy-agent.webp) + +## Create an SSH Username/Key Service Account + +1. Go to **Configuration > Service accounts**. +2. Click **Add service account**. +3. In **Name**, enter a name, for example `agent-deploy`. +4. In **Service account type**, select **SSH username/key**. +5. In **SSH username**, enter the Linux username. +6. In **SSH key**, paste the private key. +7. Click **Add account**. + +![Add service account dialog with SSH username/key selected](/images/accessanalyzer/26.1/service-accounts/add-ssh-username-key.webp) + +### Create the Account While Deploying an Agent + +You can also create the account from the **Deploy agent** panel. + +1. Next to **Service account**, click the **Add new service account** icon. The **Add service account** panel opens with the type fixed to **SSH username/key** and the description **Add SSH credentials for agent deployment**. +2. In **Name**, enter a name. +3. In **SSH username**, enter the Linux username. +4. In **SSH key**, paste the private key. +5. Click **Add account**. The new account appears in the **Service account** list. + +To change a selected account without leaving the panel, click the **Edit credentials** icon next to it. The same panel opens in edit mode, titled **Edit service account**. + +## Replace the Key + +1. In the account's **Actions** menu, click **Edit**. +2. In **SSH key**, paste the new private key. +3. Click **Save changes**. + +The **SSH key** field opens empty. To change other fields without replacing the key, leave it empty. + +Replacing the key doesn't affect agents that are already deployed. Access Analyzer uses the key only while it deploys an agent. + +## Fields + +| Field | Required | Notes | +|---|---|---| +| **Name** | Yes | The name shown in the list and in the **Deploy agent** panel. | +| **Service account type** | Yes | Select **SSH username/key**. | +| **SSH username** | Yes | The Linux username, for example `deploy`. | +| **SSH key** | Yes | The private key, pasted in full including its `-----BEGIN` and `-----END` lines. The field is a multi-line text box. | diff --git a/docs/accessanalyzer/26.1/service-accounts/username-password.md b/docs/accessanalyzer/26.1/service-accounts/username-password.md new file mode 100644 index 0000000000..c90b981c1a --- /dev/null +++ b/docs/accessanalyzer/26.1/service-accounts/username-password.md @@ -0,0 +1,76 @@ +--- +title: Username and Password +description: Create a Username/password service account for File Server and Active Directory sources, and choose the right username format. +sidebar_position: 1 +--- + +A Username/password account is a domain or local account and its password. It's the type that File Server and Active Directory sources use. The form labels this type **Username/password**. + +## When to Use It + +Use a Username/password account for: + +- **File Server sources.** Access Analyzer signs in to the SMB server with the username and password, enumerates the shares, walks the folders, and reads their permissions. Sensitive data scans also read file contents. +- **Active Directory sources.** Access Analyzer binds to a domain controller over the Lightweight Directory Access Protocol (LDAP) and reads users, groups, and organizational units. + +One account can serve many sources. Create separate accounts when sources live in different domains, or when you want to rotate their passwords independently. + +## Required Permissions + +Grant the account only the access it needs to read what you want to scan. + +On a file server, the account needs **Read** access to every share and folder you want to scan: **List folder / Read data**, **Read attributes**, and **Read permissions**. The scan records an error for folders the account can't read and moves on. Adding the account to the server's **Backup Operators** or **Administrators** group lets it read folders it otherwise couldn't open. For the full list of permissions, see [SMB file servers](../sources/smb-file-servers.md). + +In Active Directory, a regular domain user with the default read access to the domain is enough to read users, groups, and organizational units. See [Active Directory](../sources/active-directory.md). + +## Create a Username/Password Service Account + +1. Go to **Configuration > Service accounts**. +2. Click **Add service account**. +3. In **Name**, enter a name, for example `corp-file-servers`. +4. In **Service account type**, leave **Username/password** selected. +5. In **Username**, enter the account, for example `CORP\svc-accessanalyzer`. See [Username format](#username-format). +6. In **Password**, enter the password. +7. Click **Add account**. + +![Add service account dialog with Username/password selected](/images/accessanalyzer/26.1/service-accounts/add-username-password.webp) + +The account appears in the list with **Account Type** set to Username/password. To use it, select it in the source's **Service account** field and click **Test connection** on the source to confirm that the credentials work. [SMB file servers](../sources/smb-file-servers.md) and [Active Directory](../sources/active-directory.md) cover the source settings. For the whole path from account to first scan, follow [Scan SMB file servers](../guides/smb-file-servers.md) or [Scan Active Directory](../guides/active-directory.md). + +## Change the Password + +When you rotate the password in your directory, update it in Access Analyzer: + +1. On the account's row, click **Actions > Edit**. +2. In **Password**, enter the new password. +3. Click **Save changes**. + +The **Password** field opens empty because Access Analyzer never shows the stored password. **Username** keeps its stored value, so change it only if the account itself has changed. To change **Name** or **Username** without touching the password, leave **Password** empty. + +If scans already use this account, the **Confirm service account update** dialog lists them. Confirming restarts any running scan executions with the new password. [Service accounts](index.md#the-confirm-service-account-update-dialog) explains what the dialog does. + +## Fields + +| Field | Required | Notes | +|---|---|---| +| **Name** | Yes | The name shown in the list and on sources. | +| **Service account type** | Yes | Select **Username/password** (the default). | +| **Username** | Yes | `DOMAIN\username` or `username@domain`. See [Username format](#username-format). | +| **Password** | Yes | Masked as you type. Click the eye icon to show it. | + +Validation runs when you leave a field. An empty field shows **Name is required**, **Username is required**, or **Password is required**. + +### Username Format + +There's no separate domain field. If you need to specify a domain, put it in the username. + +| Form | Example | +|---|---| +| Down-level | `CORP\svc-accessanalyzer` | +| User principal name | `svc-accessanalyzer@corp.example.com` | +| Account name only | `svc-accessanalyzer` | + +Which form to use depends on the source type: + +- **File Server sources**: use `DOMAIN\username`. Access scans accept all three forms, and a bare name takes its domain from the source's **Domain** setting. Sensitive data scans recognize the domain only in the `DOMAIN\username` form. +- **Active Directory sources**: enter the account name on its own. The source's **Domain** setting supplies the domain. diff --git a/docs/accessanalyzer/2601/gettingstarted/entra-id/_category_.json b/docs/accessanalyzer/26.1/settings/_category_.json similarity index 53% rename from docs/accessanalyzer/2601/gettingstarted/entra-id/_category_.json rename to docs/accessanalyzer/26.1/settings/_category_.json index 03206793dc..0e03e274c7 100644 --- a/docs/accessanalyzer/2601/gettingstarted/entra-id/_category_.json +++ b/docs/accessanalyzer/26.1/settings/_category_.json @@ -1,6 +1,6 @@ { - "label": "Entra ID", - "position": 40, + "label": "Settings", + "position": 90, "collapsed": true, "collapsible": true } diff --git a/docs/accessanalyzer/26.1/settings/application.md b/docs/accessanalyzer/26.1/settings/application.md new file mode 100644 index 0000000000..4e01fa2fc4 --- /dev/null +++ b/docs/accessanalyzer/26.1/settings/application.md @@ -0,0 +1,124 @@ +--- +title: Application Settings +description: Deployment-wide defaults for classification and Netwrix Activity Monitor on the Settings > Application tab, with each setting's default, range, and effect. +sidebar_position: 1 +--- + +## What the Application Tab Holds + +**Settings > Application** is where deployment-wide defaults live. There are two cards: **Classification** and **Netwrix Activity Monitor**. At the bottom of the Netwrix Activity Monitor card, Admins also see an **Enrollment token** panel. Admins can change everything on the tab. Viewers can open the tab and edit fields, but their saves fail with the message **Some settings weren't saved**. + +![Application settings tab, full page](/images/accessanalyzer/26.1/settings/application-full.webp) + +Each row is one setting. The row label is the setting's key, exactly as the following tables give it, with a one-line description underneath. Two badges can appear next to the key: + +- **Overridden** means the saved value differs from the shipped default. +- **Modified** means you've edited the value but haven't saved yet. + +Number fields show their allowed range as a hint under the field. Any row whose value differs from the shipped default also gets a reset icon; see [Reset a setting to its default](#reset-a-setting-to-its-default). + +As soon as you edit a row, a bar appears at the bottom of the page. It counts your edits (**1 unsaved change**, **3 unsaved changes**) or, if a value is invalid, names the field (**1 field has an invalid value:** followed by the key). You can't save while a field is invalid. + +## Change a Setting + +1. Go to **Settings > Application**. +2. Edit the setting. For a number, enter the new value; for an extension list, see [Edit an extension list](#edit-an-extension-list). +3. Correct any field the bar flags as invalid. +4. Click **Save changes**, or press Ctrl+S (Cmd+S on a Mac). + +A message confirms the result: **1 setting saved** or **3 settings saved**. If any value fails to save, the message reads **Some settings weren't saved**. + +To drop every unsaved edit, click **Discard**. If you navigate away with unsaved edits, an **Unsaved changes** dialog asks "You have unsaved changes that will be lost if you leave. Are you sure you want to leave?" Click **Stay** to keep editing or **Leave** to drop the edits. + +### Validation Messages + +| Message | Cause | +|---|---| +| **Value is required** | The field is empty. | +| **Must be a whole number** | The value has a decimal point or non-numeric characters. | +| **Must be between `{min}` and `{max}`** | The value is outside the setting's range. | + +### Edit an Extension List + +The extension lists are chip editors: each extension is a separate chip in the field. + +To add an extension: + +1. Click the field. +2. Enter the extension, for example `.bak`. +3. Press Enter. + +To remove an extension, click the remove icon on its chip, or press Backspace. + +Pasting text separated by spaces, commas, or semicolons adds one chip per extension. The editor drops duplicates, ignoring case, so `.PDF` and `.pdf` count as the same entry. + +### Reset a Setting to Its Default + +When a value differs from the shipped default, a reset icon appears on the row. Its tooltip reads **Reset to default**, followed by the default value in parentheses for number settings. + +1. Click the reset icon on the row. The default value appears in the field. If the row shows **Overridden**, it also shows **Modified** until you save. +2. Click **Save changes**. + +## Classification + +These defaults govern how Sensitive data scans classify content. You can override one of them, the worker count, per scan; the rest apply everywhere. + +| Setting | Default | Range | What it affects | +|---|---|---|---| +| `classification_workers_default` | 15 | 1–50 | Default number of concurrent classification workers per scan. Applies when a Sensitive data scan doesn't set its own **Workers** value. | +| `file_server_excluded_extensions` | See the default list | — | File extensions to skip when classifying File Server content. Matching is case-insensitive. An empty list excludes nothing. | +| `file_server_file_size_max_mb` | 10 | 1–100 | Maximum file size, in MB, to classify for File Server sources. Scans skip larger files. | +| `sharepoint_excluded_extensions` | See the default list | — | File extensions to skip when classifying SharePoint Online content. Matching is case-insensitive. | +| `sharepoint_file_size_max_mb` | 10 | 1–100 | Maximum file size, in MB, to classify for SharePoint Online sources. Scans skip larger files. | + +A Sensitive data scan on a File Server source has its own **Workers** field (1–20), which shows 3 by default. If you leave it at 3, the scan uses `classification_workers_default`. If you change it, the scan saves your value and uses it instead of the global default. See [Scan types](../scans/scan-types.md). + +The two extension lists ship with media, binaries, fonts, disk images, and similar files that rarely carry text worth classifying. The SharePoint Online list adds web-page formats on top of the File Server list. + +
+Default value of `file_server_excluded_extensions` + +```text +.aac .aiff .asd .avi .bat .bin .bmp .cab .cdf-ms .chm .cmd .com .cpl .cur .dib +.dll .dmg .dmp .drv .eot .exe .flac .flv .gfa .gif .giff .heic .heif .hlp .ico +.img .iso .jfi .jfif .jif .jpe .jpeg .jpg .lnk .m4a .m4v .mkv .mov .mp3 .mp4 +.mpeg .mpg .msi .msp .otf .ova .ovf .pdb .png .qcow2 .scr .svn-base .sys .tif +.tiff .tmp .ttf .vdi .vhd .vhdx .vmdk .wav .wbk .webm .webp .wim .wma .wmv +.woff .woff2 +``` + +
+ +
+Default value of `sharepoint_excluded_extensions` + +Everything in the File Server list, plus: + +```text +.asp .aspx .css .htm .html .url .xaml +``` + +
+ +## Netwrix Activity Monitor + +These settings tune the listener that Netwrix Activity Monitor agents connect to. For the integration itself, see [Netwrix Activity Monitor](../integrations/netwrix-activity-monitor.md). + +| Setting | Default | Range | What it affects | +|---|---|---|---| +| `activitymonitor_connection_timeout` | 900 | 5–3600 | Seconds of inactivity before the listener drops an idle Netwrix Activity Monitor client. | +| `activitymonitor_enrollment_ban_duration_seconds` | 10 | 5–300 | Seconds to ban a source IP after it presents an invalid enrollment code. | +| `activitymonitor_enrollment_first_message_timeout_seconds` | 10 | 5–60 | Seconds to wait for the first message from a newly connected Netwrix Activity Monitor agent. | +| `activitymonitor_max_message_size` | 16777216 | 65536–67108864 | Maximum size in bytes of a single Netwrix Activity Monitor message. The default is 16 MB. | + +### Enrollment Token + +Only Admins see the **Enrollment token** panel. Click **Generate token** to issue a token. The token appears in a read-only field with a copy icon, followed by **Expires:** and the expiry time. A token is valid for 1 hour. + +After the first token, the button reads **Generate new token**. Each new token invalidates the one before it, so give the current token to the person enrolling the agent before you generate another. + +If the panel is disabled and shows **NAM listener certificate isn't configured on this server**, the Netwrix Activity Monitor (NAM) listener has no TLS certificate yet. [Netwrix Activity Monitor](../integrations/netwrix-activity-monitor.md) covers that setup and how the agent uses the token. + +## When Changes Take Effect + +You don't need to restart anything. Services pick up new values within 5 minutes. Classification settings apply to Sensitive data scans that start after the services pick up the new value, which can take up to 5 minutes; a running scan keeps the values it started with. Netwrix Activity Monitor settings apply to connections opened after the change; Activity Monitor agents already connected keep their current session. diff --git a/docs/accessanalyzer/26.1/settings/backups.md b/docs/accessanalyzer/26.1/settings/backups.md new file mode 100644 index 0000000000..92de2078dd --- /dev/null +++ b/docs/accessanalyzer/26.1/settings/backups.md @@ -0,0 +1,72 @@ +--- +title: Backups +description: Daily backups of the Access Analyzer configuration database from the Settings > System tab, including destinations, retention counts, schedule, file naming, and what to do if you need to restore. +sidebar_position: 5 +--- + +## What a Backup Contains + +A backup is a compressed copy of the Access Analyzer configuration database, including settings and user accounts. It doesn't include scan results, the analytics store behind dashboards and reports, or the server's own configuration. A backup lets you recover a working configuration. + +Backups are off until an Admin turns them on. Only [Admins](./users.md) see the **Backups** card on **Settings > System**. + +![System settings with Backups and Single sign-on](/images/accessanalyzer/26.1/settings/system.webp) + +## Turn On Daily Backups + +1. On **Settings > System**, find the **Backups** card. +2. Turn on **Enable daily backups**. +3. In **Destination**, select **Local disk** or **S3-compatible storage**. +4. Fill in the fields for that destination, listed under [Local disk](#local-disk) or [S3-compatible storage](#s3-compatible-storage). +5. Under **Retention**, set how many files to keep in each tier: **Daily**, **Weekly**, and **Monthly**. Each must be at least 1; the defaults are 7, 4, and 12. +6. Click **Save**. + +A confirmation message appears after you save. To discard your edits without saving, click **Cancel**. If you navigate away with unsaved edits, the **Unsaved changes** dialog asks whether to stay or leave. + +### Local Disk + +| Field | What to enter | +|---|---| +| **Local path** | Required. A path you record for your own reference. Backups always write to the volume mounted at install time, so the path you enter doesn't change where files land. | + +### S3-Compatible Storage + +Any object store that uses the Amazon Simple Storage Service (S3) protocol works, including Amazon S3 itself. + +| Field | What to enter | +|---|---| +| **S3 bucket** | Required. The bucket name, for example `my-backup-bucket`. | +| **S3 endpoint (optional)** | The service URL for a non-Amazon store, for example `https://s3.example.com`. Leave empty for Amazon S3. | +| **S3 region (optional)** | The bucket's region, for example `us-east-1`. | +| **Access key ID** | Under **S3 credentials**. Enter it together with the secret; the form rejects one without the other. | +| **Secret access key** | Under **S3 credentials**. Access Analyzer never shows it again after you save. | + +After you save credentials, the **S3 credentials** heading shows a **Configured** badge and both credential fields show **Configured** as their placeholder. + +To remove them, click **Clear credentials**. Until you save, the card shows **Credentials will be removed when you save** with an **Undo** link. + +If you don't store credentials, Access Analyzer uses whatever credentials are available to the server itself, such as an attached cloud identity. + +### Validation Messages + +| Message | Cause | +|---|---| +| **Daily retention must be at least 1** | **Daily** is less than 1. The same message exists for **Weekly** and **Monthly**. | +| **Daily retention must be a number** | **Daily** isn't a number. The same message exists for **Weekly** and **Monthly**. | +| **Local path is required when destination is local disk** | You selected **Local disk** and left **Local path** empty. | +| **S3 bucket is required when destination is S3** | You selected **S3-compatible storage** and left **S3 bucket** empty. | +| **Both access key ID and secret access key are required** | You filled only one of the two credential fields. | + +## Backup Schedule and File Names + +Backups run once a day at 02:00 Coordinated Universal Time (UTC). You can't change the time from the Access Analyzer settings, and no backup runs while **Enable daily backups** is off. + +Every backup is a single file named `pg_backup_TZ.sql.gz`, with the timestamp in UTC, for example `pg_backup_20260906T020000Z.sql.gz`. Access Analyzer compresses each file, checks its integrity after writing, and makes it readable only by the owner. + +Each run writes into a `son/` folder, which is the daily tier. On Sundays the run also writes the same file to `father/`, the weekly tier, and on the first day of the month to `grandfather/`, the monthly tier. The three folders sit at the root of the backup volume for **Local disk**, or at the root of the bucket for **S3-compatible storage**. + +The **Retention** counts control how many files each folder keeps. With the defaults, `son/` holds the 7 most recent daily backups, `father/` the 4 most recent Sunday backups, and `grandfather/` the 12 most recent first-of-month backups. When a folder exceeds its count, Access Analyzer removes the oldest file first. + +## Restores and On-Demand Runs + +Access Analyzer has no control to restore a backup, download one, or run one on demand, and the **Backups** card shows no status for past runs. A restore is a manual procedure on the server, outside Access Analyzer. diff --git a/docs/accessanalyzer/26.1/settings/feature-flags.md b/docs/accessanalyzer/26.1/settings/feature-flags.md new file mode 100644 index 0000000000..3aa70b0558 --- /dev/null +++ b/docs/accessanalyzer/26.1/settings/feature-flags.md @@ -0,0 +1,37 @@ +--- +title: Feature Flags +description: The experimental toggles on the Settings > Feature flags tab, including the classification pattern execution budget and how to change it. +sidebar_position: 2 +--- + +Feature flags switch experimental behavior on or off for the whole deployment. Admins can change them; Viewers can open the tab but can't save. The tab carries this warning: + +> Experimental feature flags. These should be used at your own risk and either in conjunction with the Netwrix engineering team or the Netwrix community. Support shouldn't be expected for experimental features. + +![Feature flags tab showing enable_pattern_execution_budget](/images/accessanalyzer/26.1/settings/feature-flags.webp) + +## Change a Flag + +1. Go to **Settings > Feature flags**. +2. Click the switch next to the flag. The row shows a **Modified** badge, and a bar appears at the bottom of the page with the count of unsaved changes. +3. Click **Save changes**, or press Ctrl+S (Cmd+S on a Mac). + +A message confirms **1 setting saved**. To drop an unsaved change instead, click **Discard**. To restore the default, set the switch to the default listed in [Available flags](#available-flags), then click **Save changes**. If you leave the page with an unsaved change, the same **Unsaved changes** dialog as on [Application settings](application.md#change-a-setting) asks whether to stay or leave. + +You don't need to restart anything. The classification engine rechecks the flag on its own; allow up to 6 minutes for the change to take effect. Documents classified after that point use the new setting. + +## Available Flags + +| Flag | Default | What it does | +|---|---|---| +| `enable_pattern_execution_budget` | On | Logs and counts any built-in pattern that takes more than 250 milliseconds (ms) on a single document, and keeps the matches it found in that time. | + +### `enable_pattern_execution_budget` + +During a Sensitive data scan, each [sensitive data pattern](../sensitive-data-patterns/index.md) runs against each document. Occasionally an unusual document makes a single pattern take implausibly long, and the scan waits on it. + +With the flag on, each built-in pattern gets a budget of 250 ms per document. When a pattern runs past its budget on a document, the engine logs and counts the overrun, and it keeps the matches the pattern found within the budget. A document the engine processes in one pass still gets complete results from that pattern; a document processed in several passes may get partial results from it. This flag doesn't apply to custom patterns. + +With the flag off, the engine enforces no budget and doesn't report slow patterns. + +Leave the flag on unless you're working through a classification problem with the Netwrix engineering team or the Netwrix community and they ask you to turn it off. diff --git a/docs/accessanalyzer/26.1/settings/index.md b/docs/accessanalyzer/26.1/settings/index.md new file mode 100644 index 0000000000..b25ff48a50 --- /dev/null +++ b/docs/accessanalyzer/26.1/settings/index.md @@ -0,0 +1,35 @@ +--- +title: Settings +description: The Settings page holds deployment-wide defaults, feature flags, user accounts, single sign-on, backups, and system logs across five tabs, each shown only to the roles that can use it. +--- + +Settings holds what applies to the whole installation rather than to one source or scan: classification and Netwrix Activity Monitor defaults, feature flags, user accounts, single sign-on, backups, and system logs. Open **Configuration > Settings** in the sidebar. Every role can open the page, but it shows only the tabs your role can use. + +![Application settings tab with Classification defaults](/images/accessanalyzer/26.1/settings/application.webp) + +## Tabs + +| Tab | What it holds | Who sees it | +|---|---|---| +| [**Application**](application.md) | Deployment-wide defaults for classification and Netwrix Activity Monitor, plus the enrollment token used to enroll Netwrix Activity Monitor agents | Admin, Viewer | +| [**Feature flags**](feature-flags.md) | Experimental toggles for optional scan features | Admin, Viewer | +| [**Users**](users.md) | User accounts, their roles, and whether each account is active | Admin, User admin | +| **System** | [Backups](backups.md) and [single sign-on](single-sign-on.md) | Admin, User admin | +| [**System logs**](system-logs.md) | Application logs from every component, with search, filter, and download | Admin | + +## Permissions by Role + +**Admin** reads and changes everything on every tab. Two controls are Admin-only even on a shared tab: the **Enrollment token** panel on Application and the **Backups** card on System. Admins land on the Application tab when they open Settings. + +**User admin** gets the Users and System tabs and lands on Users when opening Settings. On System, a User admin sees the **Single sign-on** card but not the **Backups** card. A User admin also can't grant the Admin role or change an existing Admin's account. + +**Viewer** gets the Application and Feature flags tabs but can't save changes on either. The controls look editable, but every save fails with the message **Some settings weren't saved**. + +[Users and roles](users.md#roles) describes each role and what it can do across the rest of the product. + +## Timing of Saved Changes + +Saving an Application setting or a feature flag doesn't restart anything. Access Analyzer picks up the change on its own within 5 minutes; a feature flag can take about a minute longer to reach the classification engine. That has two consequences: + +- Classification settings apply to Sensitive data scans that start after the change takes effect. A scan that's already running keeps the values it started with. +- Netwrix Activity Monitor settings apply to connections opened after the change takes effect. An Activity Monitor agent that's already connected keeps its current session. diff --git a/docs/accessanalyzer/26.1/settings/single-sign-on.md b/docs/accessanalyzer/26.1/settings/single-sign-on.md new file mode 100644 index 0000000000..573613cabb --- /dev/null +++ b/docs/accessanalyzer/26.1/settings/single-sign-on.md @@ -0,0 +1,166 @@ +--- +title: Single Sign-on +description: How to connect Active Directory or Entra ID as an identity provider through the setup flow, how federated users sign in, and how to rotate the directory service account password from Settings > System. +sidebar_position: 4 +--- + +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + +## Ways to Sign In + +Access Analyzer supports three kinds of sign-in. Local sign-in always stays available, and you can connect one directory provider alongside it: + +- **Local accounts** hold a password inside Access Analyzer. The first Admin created by the installer is a local account. +- **Active Directory (AD)** lets people sign in with their domain username and password. Access Analyzer checks them against a domain controller over Lightweight Directory Access Protocol (LDAP) secured with TLS, known as LDAPS. +- **Entra ID** lets people sign in with their Microsoft work account through a **Sign in with Microsoft** button. + +Connecting a directory is what the product calls single sign-on (SSO), and users who sign in that way are **Federated (SSO)** accounts in [Users and roles](users.md). You connect one provider, once, through the setup flow. After that, **Settings > System > Single sign-on** is where you rotate the AD service account password. + +## Before You Begin + +Whichever provider you connect, you need an Access Analyzer account with the Admin or User admin role. The flow signs you out when it finishes. + +For **Active Directory**, gather: + +- The fully qualified domain name of your AD forest. The Access Analyzer server must be able to reach the domain controller on port 636, and the domain controller must have LDAPS enabled. +- The certificate of the certificate authority (CA) that issued the domain controller's LDAPS certificate, as a PEM, CRT, or CER file of at most 1 MB. Access Analyzer trusts the domain controller only through this CA. +- A read-only service account and its password. The account must be able to bind over LDAPS, read the directory root, and read user objects with their `mail`, `userPrincipalName`, `sAMAccountName`, `objectGUID`, `givenName`, `sn`, `displayName`, and `title` attributes. Access Analyzer never writes to your directory. + +For **Entra ID**, gather: + +- Your tenant's ID as a globally unique identifier (GUID), from **Overview** in the Entra admin center. +- An app registration in that tenant with a client secret. Access Analyzer doesn't support certificate credentials. Note its **Application (client) ID**. +- Two redirect Uniform Resource Identifiers (URIs) added to the registration under **Authentication > Redirect URIs** before you start, both using your Access Analyzer hostname: `https:///setup/entra-consent-callback` and `https:///idps/callback`. +- Someone with the Global Administrator or Privileged Role Administrator role in the tenant to approve admin consent during setup. + +## Open the Setup Flow + +The setup flow opens automatically for an Admin who signs in before anyone connects an identity provider, until someone completes it or clicks **Set up later**; see [Sign in for the first time](../install/first-sign-in.md). To reach it from Settings: + +1. Go to **Settings > System**. +2. On the **Single sign-on** card, click **Go to set up**. Before you connect a provider, the card reads "No external authentication providers are connected. Connect a service first." +3. On the **Connect an identity provider** page, click **Set up identity provider**. + +![System settings with Backups and Single sign-on](/images/accessanalyzer/26.1/settings/system.webp) + +The steps that follow have **Back**, a button that continues to the next step, and **Set up later**, which takes you into the app; **Go to set up** brings you back whenever you're ready. + +![Connect an identity provider page with Set up identity provider and Set up later](/images/accessanalyzer/26.1/integrations/identity-provider-setup.webp) + +## Choose the Identity Provider + +The **Connect Access Analyzer to your directory** step offers two cards. The **Active Directory** card reads "On-prem AD over LDAPS. Recommended for most existing deployments." + +![Identity provider selection step with Active Directory and Entra ID](/images/accessanalyzer/26.1/integrations/identity-provider-choose.webp) + +1. Select **Active Directory** or **Entra ID**. +2. Click **Continue**. + +## Connect the Provider + + + + +The **Connect your AD server** step asks for your AD domain name, read-only service-account credentials, and the CA certificate that issued the domain controller's LDAPS certificate. + +![Active Directory connection form in the identity provider setup](/images/accessanalyzer/26.1/integrations/identity-provider-active-directory.webp) + +1. In **AD domain name**, enter the fully qualified domain name of your AD forest, for example `corp.example.com`. Access Analyzer connects on port 636; the form takes one name. +2. In **Service account**, enter the account to bind with, for example `aa26-svc@corp.example.com`. +3. In **Password**, enter the service account's password. +4. Under **AD Authentication certificate**, upload the CA certificate that issued the domain controller's LDAPS certificate. +5. Click **Test connection and continue**. The button stays disabled until all four fields have a value. + +The button changes to **Testing connection…** and a checklist runs through **Resolve hostname**, **TCP reachability on port 636**, **TLS handshake**, and **LDAP bind with service account**. When the header reads **Connected to domain controller** and the button reads **Connection verified**, the flow moves to the next step on its own. + +The test also fills in two settings for you. Access Analyzer reads the base distinguished name (DN) from the directory root, so you never enter it. It detects the sign-in attribute by sampling user objects: it picks `mail` or `userPrincipalName`, whichever more users have populated, and uses that attribute to match directory users to Access Analyzer accounts by email. Users can then sign in with either their `sAMAccountName` or that email attribute. + +If the header reads **Connection failed**, or Access Analyzer couldn't save the certificate after a successful test, the button changes to **Try again**. The message tells you where it stopped. + +| Message | What to check | +|---|---| +| Couldn't reach the domain controller on port 636. Check the address is correct, resolvable from the cluster, and that LDAPS is open. | DNS for the domain name from the Access Analyzer server, and the firewall path to port 636. | +| The TLS handshake failed — the domain controller's certificate isn't trusted by the certificate you supplied. Upload the CA that issued the DC's LDAPS certificate and test again. | That the uploaded file is the CA that issued the domain controller's LDAPS certificate. | +| The domain controller rejected the credentials. Check the service account (for example `aa26-svc@corp.example.com`) and its password. | The service account name or password. | +| The bind succeeded but the directory didn't return a base DN. Check the service account can read the directory root. | The service account's read permission on the directory root. | +| The connection succeeded, but saving the certificate failed. Try again. | Nothing on your side; Access Analyzer couldn't save the CA file after a passing test. Click **Try again**. | + + + + +The **Authorize Access Analyzer** step asks you to sign in once as a tenant administrator to grant Access Analyzer read access to your directory. The fields sit under the heading **Microsoft Entra ID tenant**. + +![Entra ID connection form in the identity provider setup](/images/accessanalyzer/26.1/integrations/identity-provider-entra-id.webp) + +1. In **Tenant ID**, enter your tenant's GUID. Entering the primary domain instead shows the error "Enter the tenant's GUID, not its primary domain — find it in the Entra admin center under Overview." +2. In **Application (client) ID**, enter the app registration's client ID. +3. In **Client secret**, enter a secret generated under **Certificates & secrets** on the app registration. +4. Confirm that both URIs in the **Redirect URIs** block exist under **Authentication > Redirect URIs** on the app registration. Each URI has a copy button. +5. Click **Sign in with Microsoft and continue**. A Microsoft window opens for admin consent, and the button reads **Waiting for Microsoft…** until it closes. +6. In the Microsoft window, sign in as a Global Administrator or Privileged Role Administrator. +7. Approve the consent request. + +Access Analyzer uses the first URI, ending in `/setup/entra-consent-callback`, only during this step to obtain admin consent. It uses the second, ending in `/idps/callback`, for every later sign-in through this identity provider. + +When Microsoft grants consent, the flow moves to the next step on its own. If it doesn't, one of these messages appears: + +| Message | What to do | +|---|---| +| Consent was denied. A Global Administrator or Privileged Role Administrator must approve this app. | Ask someone with one of those roles to sign in when the Microsoft window opens. | +| Microsoft didn't grant consent. try again. | Click the button again. | +| Your browser blocked the sign-in popup. Allow popups for this site and try again. | Allow popups for your Access Analyzer hostname and click the button again. | +| The sign-in window was closed before consent finished. try again. | Click the button again and leave the Microsoft window open until consent finishes. | + + + + +## Add Administrators + +The **Add Access Analyzer admins** step creates or promotes Admin accounts so that at least one person can sign in through the new provider with full rights. People listed here can manage settings, integrations, and other administrators, and you can add or remove admins later from Settings. + +The field under **Admin accounts** depends on the provider. With Active Directory, **Search your directory** matches name, username, or the detected sign-in attribute after you type at least three characters, and it also accepts an email address typed directly. With Entra ID, **Enter an email address** takes the address only. + +1. Under **Admin accounts**, enter each administrator. +2. Press Enter or comma to confirm each entry. +3. Click **Finish setup**. If you leave the list empty, the button reads **Continue without admins** instead. + +Each address becomes an Access Analyzer user with the Admin role and Active status. If a user with that email exists, Access Analyzer promotes them to Admin and reactivates them. With Active Directory, the step reminds you which attribute sign-in uses, so the address you add must be the value of that attribute on the user's directory object. + +## Finish + +The **Applying configuration** page works through **Configuring identity provider**, **Adding administrators**, and then either **Restarting the authentication service** (Active Directory) or **Verifying configuration** (Entra ID). For Active Directory, the sign-in service restarts so it trusts your domain controller; this usually takes under a minute, so keep the page open. + +When it's done, the **You are all set** page shows a **Setup summary** with the **Identity provider**, **AD Authentication certificate**, and **Administrators** rows, plus **AD domain** for Active Directory. Click **log in to Access Analyzer**. This signs you out; sign in again with your local account, or with a directory account you added as an administrator. + +If a step fails, the page says which one: "We couldn't configure the identity provider. Check the connection details and try again." or "We couldn't add the administrators. Check the addresses and try again." An **Edit connection**, **Edit identity provider**, or **Edit administrators** link takes you back to the relevant step. If the restart takes longer than expected, the page shows "The sign-in service didn't finish restarting in time. It may still be starting — keep checking, or try again." + +## How Federated Users Sign In + +Access Analyzer never creates a user on its own. Before a directory user can sign in, an Admin or User admin must add them in **Settings > Users** as a **Federated (SSO)** account with the email address the directory reports for them, or list them in [Add administrators](#add-administrators) during setup. At sign-in, Access Analyzer matches the directory identity to that row by email, ignoring case. The row must be **Active**. + +The user's role is the one on the row, Viewer by default. Access Analyzer doesn't map directory groups to roles. Once a federated user has signed in, Access Analyzer locks their name and email; only their role and status stay editable. + +![Access Analyzer sign-in page with Username and Password fields](/images/accessanalyzer/26.1/overview/sign-in.webp) + +- **Active Directory** users type their `sAMAccountName` or their email attribute into **Username**, and their domain password into **Password**, on the same form local users use. There is no separate Active Directory button. After two failed directory sign-in attempts for the same username within 30 minutes, Access Analyzer refuses further attempts with the message "Too many sign-in attempts. Wait a few minutes and try again, or contact your administrator." A successful sign-in clears the count. +- **Entra ID** users click **Sign in with Microsoft**, which appears below an **or** divider under the password form after you connect Entra ID. If Microsoft sends them back before sign-in completes, the form shows "Microsoft sign-in didn't complete. try again." + +A directory user with no matching row sees **Access denied** and "Your account isn't authorized to access this application. contact your administrator." A user whose row is Inactive sees "Your account is inactive. contact your administrator." + +Disabling someone in your directory stops them from signing in to Access Analyzer; their Access Analyzer row stays until you deactivate or delete it. Deleting a federated user in Access Analyzer removes only the Access Analyzer account. The password length rule in [Users and roles](users.md#password-policy-and-lockout) applies to local accounts only; the directory governs its own passwords. + +## Rotate the Directory Service Account Password + +When your Active Directory service account's password changes, update it on the **Single sign-on** card. **Directory hosts** and **Bind DN** show the connection from setup; you can't edit them. Nothing restarts. + +1. Go to **Settings > System**. +2. In **Service account password**, replace the masked value with the new password. +3. Click **Test connection**. The button reads **Testing…** while Access Analyzer binds to the directory with the new password. On success, the page shows "Connection test passed — ready to apply." +4. Click **Apply**. The button stays disabled until a test passes, and editing the password again requires a new test. It reads **Applying…**, then the message "Service account password updated" confirms the change. + +The card manages only an Active Directory connection. If you connected Entra ID, the card still shows the not-connected message, and you can't update the Entra ID client secret from the web app. + +## What You Can't Do From the Web App + +After you connect a provider, you can't reopen the setup flow, and Settings has no control to disconnect the provider, replace it with a different one, connect a second provider, change the AD domain name, or upload a new CA certificate. If you need any of those, keep a record of your current configuration and contact Netwrix support. diff --git a/docs/accessanalyzer/26.1/settings/system-logs.md b/docs/accessanalyzer/26.1/settings/system-logs.md new file mode 100644 index 0000000000..15a7373439 --- /dev/null +++ b/docs/accessanalyzer/26.1/settings/system-logs.md @@ -0,0 +1,62 @@ +--- +title: System Logs +description: Search, filter, inspect, and download Access Analyzer application logs from the Settings > System logs tab, with a 30-day retention window and a 10,000-row export cap. +sidebar_position: 6 +--- + +## What the System Logs Tab Shows + +**Settings > System logs** is a single searchable view of application logs from every Access Analyzer component, kept for 30 days. Only Admins can open it. Look here when Netwrix Activity Monitor events stop arriving, or when a scan execution's own logs don't explain a failure. + +![System logs tab with search, filters, and log table](/images/accessanalyzer/26.1/settings/system-logs.webp) + +| Column | What it shows | +|---|---| +| **Timestamp** | When Access Analyzer wrote the entry. Sortable; newest first by default. | +| **Level** | A colored chip: **Error** (red), **Warn** (orange), **Info** (blue), or **Debug** (gray). | +| **Component** | The component that wrote the entry, or **—** when the entry names none. | +| **Message** | The log message on one line. Hover to read a long message in full. Entries that carry an error detail show it as a second line in red beneath the message. | + +The table shows 25 rows per page by default; 10, 50, and 100 are also available. Click a row to open the **Log details** drawer. It repeats the level, timestamp, and component, shows the full text under **MESSAGE**, and lists every attribute recorded with the entry as key-value pairs under **DETAILS**. + +## Search and Filter + +The toolbar narrows the table, and every filter also applies to downloads. + +| Control | What it does | +|---|---| +| **Search logs…** | Case-insensitive substring match on the message, up to 1,000 characters. | +| **Level** | One level: **All levels**, **Error**, **Warn**, **Info**, or **Debug**. | +| **Component** | Any number of components, chosen with checkboxes. The list holds only components that appear in the retained logs. | +| **From** and **To** | A date and time range, picked as day/month/year with a 12-hour clock. There are no preset ranges. | +| **Clear filters** | Clears the active filters. Unavailable when no filter is active. | + +The view doesn't refresh on its own; reload the page or change a filter to pick up new entries. + +:::tip + +When troubleshooting Netwrix Activity Monitor, select only `nam-listener` (the Activity Monitor listener) under **Component** to see its messages alone. See [Netwrix Activity Monitor](../integrations/netwrix-activity-monitor.md). + +::: + +## Download Logs + +Downloads come as JavaScript Object Notation (JSON) or CSV files. + +1. Set the filters so the table shows what you want to keep. +2. Click **Download**. +3. Click **Download as JSON** or **Download as CSV**. The button reads **Downloading…** until the file is ready. + +The server builds the export and sends it to your browser as `system-logs-.json` or `system-logs-.csv`. It holds at most 10,000 entries that match the current filters. If you need more, split the time range with **From** and **To** and download each part. + +JSON exports include the full entry: the timestamp, level, message, log attributes, resource attributes, trace ID, and span ID. CSV exports are flatter and carry these columns only: + +```csv +Timestamp,SeverityText,Body,TraceID,SpanID +``` + +The component and the attributes shown in the **Log details** drawer aren't part of the CSV; use JSON when you need them. If the page shows **Export not found or expired**, click **Download** again. + +## Retention + +Access Analyzer keeps log entries for 30 days and then removes them. You can't change the period. Download anything you need to keep longer. diff --git a/docs/accessanalyzer/26.1/settings/users.md b/docs/accessanalyzer/26.1/settings/users.md new file mode 100644 index 0000000000..007d703595 --- /dev/null +++ b/docs/accessanalyzer/26.1/settings/users.md @@ -0,0 +1,191 @@ +--- +title: Users and Roles +description: Understand the Admin, User admin, and Viewer roles, manage accounts on the Users tab, and secure your own account with a password and an authenticator app. +sidebar_position: 3 +--- + +## Roles + +Access Analyzer has exactly three roles. Every user holds one of them, and there are no custom roles. + +| Role | What it can do | +|---|---| +| **Admin** | Everything. Only Admins can change **Application** settings, feature flags, sources, scans, sensitive data patterns, agents, service accounts, backups, and enrollment tokens, and only Admins can open the **System logs** tab. | +| **User admin** | User management only: the **Users** tab, the **Single sign-on** card on the **System** tab, and the identity provider setup flow. A User admin can't grant the Admin role and can't edit, deactivate, delete, or reset the password of an existing Admin. User admins have no access to dashboards, sources, or scans, and land on **Settings > Users** after signing in. | +| **Viewer** | Read-only access across the product, including the **Application** and **Feature flags** tabs. Viewers can stop, pause, and resume scan executions. They can't see the **Users**, **System**, or **System logs** tabs, and can't open **Sensitive data patterns**. | + +If someone opens a page their role doesn't allow, Access Analyzer redirects them away without an error message. + +The **Add user** form labels the Admin role **Administrator**; the Users list and the rest of the product show it as **Admin**. + +## The Users Tab + +**Settings > Users** lists every account. Admins and User admins can open it. + +![Users tab listing local accounts with role and status](/images/accessanalyzer/26.1/settings/users.webp) + +| Column | What it shows | +|---|---| +| **Name** | The user's display name. | +| **Email** | The sign-in identity. For federated accounts this must match the email the directory reports. | +| **Role** | **Admin**, **User admin**, or **Viewer**. | +| **Status** | **Active** or **Inactive**. Inactive users can't sign in. | +| **Last login** | When the user last signed in. | +| **Actions** | The row menu; see [Row actions](#row-actions). | + +The toolbar has a **Search users…** box, a **Role** filter (**All roles**, **Admin**, **User admin**, **Viewer**), a **Status** filter (**All statuses**, **Active**, **Inactive**), **Clear filters**, and **Add user**. The table shows 10, 25, 50, or 100 rows per page. + +### Row Actions + +Each row has an **Actions** menu. + +![User row menu with Edit, Deactivate, and Delete](/images/accessanalyzer/26.1/settings/user-actions.webp) + +| Action | What it does | Shown for | +|---|---|---| +| **Edit** | Opens the **Edit user** form to change name, email, and role. | Every account | +| **Deactivate** | Blocks sign-in and ends the user's sessions. | Active accounts | +| **Activate** | Lets the user sign in again. | Inactive accounts | +| **Reset password** | Issues a new password, either generated or typed, and ends the user's sessions. | Local accounts | +| **Unlock** | Clears the lockout from repeated failed sign-ins. Doesn't reset the password. | Local accounts | +| **Delete** | Removes the account permanently and ends the user's sessions. | Every account | + +You can't deactivate or delete your own account, or the last remaining active Admin or User admin, so you can't lock everyone out. + +## Add a User + +Decide two things before you start: the role, and whether the person signs in with a local password or through your identity provider. You can't change the account type later. + +1. Go to **Settings > Users**. +2. Click **Add user**. +3. Under **Account information**, enter the **Name** (2 to 100 characters) and **Email**. +4. Under **Role**, select **Administrator**, **User admin**, or **Viewer**. The default is **Viewer**. +5. Under **Account type**, select **Federated (SSO)** for single sign-on (SSO) through your identity provider, or **Local (password)**. Federated is the default when you've connected an identity provider. If you haven't, Access Analyzer disables that option, shows "No identity provider is configured yet", and selects **Local (password)** for you. +6. For a local account, under **Security > Password**, keep **Generate** or select **Set explicitly**. +7. If you selected **Set explicitly**, enter a password of at least 12 characters in the **Password** field that appears. +8. Leave **Require password change at next sign-in** on. It's on by default and appears only for local accounts. +9. Click **Create user**. + +![Add user dialog with account information, role, account type, and password options](/images/accessanalyzer/26.1/settings/add-user.webp) + +If you chose **Generate**, the **Password generated** dialog appears. It reads "This password is shown once and can't be retrieved again. Copy it now and deliver it to the user through a secure channel." + +1. Click the copy icon next to the password. +2. Select the **I have copied this password** checkbox. +3. Click **Done**. + +Generated passwords are at least 20 characters long. If you close the dialog without copying, use **Reset password** on the row to issue a new one. + +A federated user doesn't get a password. They sign in through Active Directory or Entra ID, and Access Analyzer matches them to this row by email. See [How federated users sign in](single-sign-on.md#how-federated-users-sign-in). + +### Validation Messages + +| Message | Cause | +|---|---| +| **Name must be at least 2 characters** | The name is too short. | +| **Name is too long** | The name is over 100 characters. | +| **Invalid email format** | The email isn't a valid address. | +| **Password is required when setting it explicitly** | **Set explicitly** is selected and the password is empty. | +| **Password must be at least 12 characters** | The typed password is too short. | + +## Edit a User + +1. On the user's row, click **Actions > Edit**. +2. Change the **Name**, **Email**, or **Role**. +3. Click **Update user**. + +Once a federated user has signed in for the first time, the form locks **Name** and **Email**, and you can change only **Role**. You can never change the account type. + +## Deactivate or Reactivate a User + +On the row, click **Actions > Deactivate**. The user's sessions end immediately and their status changes to **Inactive**. A message confirms **User "``" deactivated**. To let them back in, click **Actions > Activate**. + +Deactivating is the right choice when someone leaves temporarily or you want to keep their row for reference. For a federated user your directory has disabled, deactivating the Access Analyzer row is optional: the directory already blocks their sign-in. + +## Reset a Password + +Only local accounts have a password to reset. There is no self-service password reset on the sign-in page, so this is how a user who has forgotten their password gets back in. + +1. On the row, click **Actions > Reset password**. The **Reset password for ``** dialog opens. +2. Under **Password**, keep **Generate** or select **Set explicitly**. +3. If you selected **Set explicitly**, enter a new password of at least 12 characters. +4. Turn **Require password change at next sign-in** on or off. +5. Click **Reset password**. + +If you chose **Generate**, the **Password generated** dialog appears as it does when creating a user. The user's existing sessions end, and a message confirms **Password reset**. + +## Unlock a User + +An account locks after three consecutive wrong passwords or five consecutive wrong two-factor verification codes. The sign-in page then shows "Account locked. Contact your administrator." An Admin or User admin clears the lock with **Unlock**. + +On the row, click **Actions > Unlock**. A message confirms **User "``" unlocked**. Unlocking doesn't change the password; if the user has forgotten it, also click **Actions > Reset password**. + +## Delete a User + +1. On the row, click **Actions > Delete**. +2. In the **Delete user** dialog, confirm the deletion. + +The user's sessions end, the row disappears, and a message confirms **User "``" deleted**. Deleting a federated user removes only the Access Analyzer account; nothing changes in Active Directory or Entra ID. + +## Password Policy and Lockout + +Local passwords must be at least 12 characters. There are no character-class rules, and you can't edit the policy in the web app. For federated users, their directory governs passwords, not Access Analyzer. + +An account locks after repeated failed sign-ins; the thresholds and how to clear the lock are in [Unlock a user](#unlock-a-user). + +When a user signs in with **Require password change at next sign-in** set, a **Change password** step appears with **New password** and **Confirm password** fields and a **Start over** button. It reads "You must set a new password before continuing." The step rejects these entries: + +| Message | Cause | +|---|---| +| **Passwords don't match.** | **New password** and **Confirm password** differ. | +| **Password doesn't meet complexity requirements.** | The new password is under 12 characters. | +| **New password can't be the same as your current password.** | The new password matches the current one. | + +The first Admin created by the installer goes through this step on their first sign-in; see [Sign in for the first time](../install/first-sign-in.md). + +## Sessions + +A session ends after 4 hours of inactivity or 8 hours after signing in, whichever comes first. Deactivating a user, deleting them, or resetting their password ends their sessions immediately. + +## Security Settings for Your Own Account + +If you have a local account, you can manage your own password and two-factor authentication. Open the avatar menu in the top-right corner and click **Security settings**. The menu also shows your name and email (Admins see an **Admin** badge next to the name), and holds **Log out**. Federated users don't see **Security settings**; their password and any second factor belong to the directory. + +![User menu showing the signed-in user's name, role, email, Security settings, and Log out](/images/accessanalyzer/26.1/overview/user-menu.webp) + +The **Security settings** page has two cards: **Authenticator app (TOTP)**, for two-factor authentication with a time-based one-time password app, and **Change password**. + +![Security settings page for the signed-in user](/images/accessanalyzer/26.1/settings/security-settings.webp) + +### Set Up an Authenticator App + +Two-factor authentication is optional and per user; no role can make it mandatory. It works with any TOTP authenticator app. + +1. On the **Authenticator app (TOTP)** card, click **Set up**. +2. In the **Set up authenticator app** dialog, scan the Quick Response (QR) code with your authenticator app, or use the copy icon (**Copy secret**) next to the secret and enter the secret manually. +3. In **6-digit code**, enter the code your app shows. +4. Click **Verify**. + +The card then reads "An authenticator app is configured. You will be prompted for a code on sign-in." At your next sign-in, after **Username** and **Password**, a **Two-factor verification** step asks for the **Verification code**; click **Verify** to continue. + +:::warning + +There are no recovery codes, and the **Users** tab has no action to remove another user's authenticator app. If you lose access to your authenticator app, you can't sign in until someone removes the app from your account on the server, outside the web app. Remove the app from this page before you replace or reset your device. + +::: + +### Remove an Authenticator App + +1. On the **Authenticator app (TOTP)** card, click **Remove**. +2. In the **Remove authenticator app** dialog, enter your **Current password**. +3. Click **Remove**. + +A message confirms **Authenticator app removed**. + +### Change Your Password + +1. On the **Change password** card, enter your **Current password**. +2. Enter the **New password** and repeat it in **Confirm new password**. +3. Click **Change password**. + +A message confirms **Password changed**. diff --git a/docs/accessanalyzer/2601/connectors/entra-id/_category_.json b/docs/accessanalyzer/26.1/sources/_category_.json similarity index 73% rename from docs/accessanalyzer/2601/connectors/entra-id/_category_.json rename to docs/accessanalyzer/26.1/sources/_category_.json index 83c1bf103d..8356bb02a9 100644 --- a/docs/accessanalyzer/2601/connectors/entra-id/_category_.json +++ b/docs/accessanalyzer/26.1/sources/_category_.json @@ -1,5 +1,5 @@ { - "label": "Entra ID", + "label": "Sources", "position": 30, "collapsed": true, "collapsible": true diff --git a/docs/accessanalyzer/26.1/sources/active-directory.md b/docs/accessanalyzer/26.1/sources/active-directory.md new file mode 100644 index 0000000000..2750304c56 --- /dev/null +++ b/docs/accessanalyzer/26.1/sources/active-directory.md @@ -0,0 +1,86 @@ +--- +title: Active Directory +description: Add an Active Directory source to sync the users, groups, and memberships of a domain over LDAP or LDAPS. +sidebar_position: 2 +--- + +An **Active Directory** source points Access Analyzer at one Active Directory domain. Identity syncs read the domain's users, groups, group memberships, and organizational units over the Lightweight Directory Access Protocol (LDAP) and store them for the [Identity reports](../dashboards-reports/reports/identity.md) and the [Active Directory dashboard](../dashboards-reports/dashboards/active-directory.md). + +An Active Directory source also completes your file server data. Access scans of File Server sources record who has access as security identifiers (SIDs); syncing the domain those accounts belong to turns the SIDs into names in the reports. See [SMB file servers](smb-file-servers.md). + +One source covers one domain. Access Analyzer reads the domain partition of the domain controller you point it at; it doesn't follow trusts or query the Global Catalog. For a forest with several domains, add one source per domain. + +For an end-to-end walkthrough, see [Scan Active Directory](../guides/active-directory.md). + +## Prerequisites + +### Service Account + +Active Directory sources use a [Username and password](../service-accounts/username-password.md) service account. The sync only reads, so a regular domain user with the default read access to the domain is enough for a full sync. + +When you create the service account, enter the plain username without a domain prefix, for example `svc-access-analyzer`. The domain goes in the source's **Domain** field; Access Analyzer combines the two in the form the domain controller expects for the port you connect on. + +### Network + +The agent that runs the sync connects to the domain controller on the port you enter in **Port**: + +| Port | Protocol | What happens | +|---|---|---| +| 389 | LDAP | Access Analyzer authenticates with DIGEST-MD5 and negotiates encryption, falling back to signing only, then to a simple bind. This satisfies domain controllers that require LDAP signing. Use the domain controller's fully qualified domain name (FQDN) in **Host**; DIGEST-MD5 doesn't work with an IP address. | +| 636 | LDAP over SSL (LDAPS) | Access Analyzer opens a TLS 1.2 connection and performs a simple bind inside it. The certificate the domain controller presents must pass validation unless you select **Ignore SSL errors**. | + +Access Analyzer treats any port other than 636 as plain LDAP and uses the 389 behavior. + +You choose the agent that runs the sync when you create the scan; see [Agents](../agents/index.md). + +## Add an Active Directory Source + +1. Go to **Configuration > Sources**. +2. Click **Add source**. +3. In **Source type**, select **Active Directory**. +4. Under **Details**, enter a **Name** and, optionally, a **Description** and **Labels**; see [Labels](labels.md). +5. Under **Connection**, fill in the fields in the following table. +6. Under **Access**, in **Service account**, select the account you set up for this domain. +7. Click **Test connection** and wait for **Connection successful**. +8. Click **Add source**. + +![Add source dialog with Active Directory selected](/images/accessanalyzer/26.1/sources/add-active-directory.webp) + +| Field | Required | What to enter | Default | +|---|---|---|---| +| **Host** | Yes | The hostname or IP address of a domain controller, for example `dc01.example.com`. Use the FQDN when connecting on port 389. | None | +| **Port** | Yes | The LDAP port: 389, or 636 for LDAPS. | 389 | +| **Ignore SSL errors** | No | Select to skip certificate validation when connecting over LDAPS. Leave clear unless the domain controller uses a certificate the agent doesn't trust, such as a self-signed one. | Clear | +| **Domain** | Yes | The DNS name of the Active Directory domain, for example `corp.example.com`. | None | + +:::note + +Changing **Host** or **Domain** on an existing source shows the warning **Existing scan data won't follow this change**. Data already synced stays with the previous host and domain. To rename the source, change **Name** instead. + +::: + +## What Test Connection Checks + +**Test connection** connects to the domain controller on the selected port and binds with the service account's credentials, using the same sequence as a real sync. The button becomes available after you've entered **Host**, **Port**, and **Domain** and selected a service account. + +Success shows the message **Connection successful**. Failure shows **Connection failed** with the reason. Two failures are common: + +- On port 389 with an IP address in **Host**, authentication can fail; the message then asks you to use an FQDN instead of an IP address. +- On port 636, a TLS failure usually means the domain controller isn't offering LDAPS on that port or presents a certificate the agent doesn't trust. Check that the domain controller offers LDAPS on 636 and that its certificate validates, select **Ignore SSL errors** to skip validation, or connect on port 389 instead. + +## What the Sync Collects + +An **Identity sync** reads three kinds of objects: + +| Object | What Access Analyzer records | +|---|---| +| Users: identifiers | Account name, SID, globally unique identifier (GUID), distinguished name, and user principal name | +| Users: profile | Display and contact details, title, department, company, manager, and employee ID | +| Users: security settings | Account control flags, password last set, account expiry, logon hours, allowed workstations, delegation settings, and service principal names | +| Users: activity | Last logon, last logoff, bad password count and time, and lockout time | +| Groups | Name, SID, group type, description, mail, and the member list | +| Organizational units | Distinguished name | + +Each sync records group memberships and flags whether each one is direct or inherited through a nested group; a follow-up step runs after the sync to refresh effective memberships for the reports. The sync doesn't read computers, Group Policy objects, or password hashes. The last logon value comes from the domain controller the source points at, so it reflects the logons that controller has seen. + +With **Enable differential scan** turned on (the default), each run reads only objects changed since the previous run; turn it off on the scan to read the whole domain every time. See [Scan types](../scans/scan-types.md) for the Identity sync options. diff --git a/docs/accessanalyzer/26.1/sources/entra-id.md b/docs/accessanalyzer/26.1/sources/entra-id.md new file mode 100644 index 0000000000..9f2e938bc7 --- /dev/null +++ b/docs/accessanalyzer/26.1/sources/entra-id.md @@ -0,0 +1,82 @@ +--- +title: Entra ID +description: Add an Entra ID source to sync the users, groups, directory roles, and memberships of a Microsoft Entra ID tenant. +sidebar_position: 3 +--- + +An **Entra ID** source points Access Analyzer at one Microsoft Entra ID tenant. Identity syncs sign in to the tenant as an app registration and read its users, groups, directory roles, and memberships through Microsoft Graph. The sync is read-only. + +Besides feeding the identity reports, an Entra ID source completes your SharePoint Online data. After a SharePoint Online scan, Access Analyzer expands Entra ID group memberships using the most recent completed Entra ID sync of the same tenant. Without one, it calculates effective permissions from SharePoint data alone. See [Microsoft 365](microsoft-365.md). + +:::note + +This source collects directory data for reports. It's unrelated to signing in to Access Analyzer with Microsoft Entra ID, which you configure separately; see [Single sign-on](../settings/single-sign-on.md). The two can use different app registrations. + +::: + +For an end-to-end walkthrough, see [Scan Entra ID](../guides/entra-id.md). + +## Prerequisites + +### App Registration + +The sync uses the OAuth 2.0 client credentials flow, so no user signs in. In the Microsoft Entra admin center: + +1. Register an application in the tenant you want to scan. +2. On the app's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**. +3. Under **Certificates & secrets**, create a client secret. +4. Copy the secret value before you leave the page. +5. Under **API permissions**, add the Microsoft Graph application permissions that grant read access to users, groups, and directory roles. +6. Grant admin consent for the permissions you added. A tenant administrator must approve the consent. + +### Service Account + +Entra ID sources use a [Client ID and secret](../service-accounts/client-id-secret.md) service account. Enter the app registration's **Client (application) ID** and the **Client secret** value. The tenant ID isn't part of this service account type; it goes on the source. + +### Network + +The agent that runs the sync needs outbound HTTPS access to Microsoft's sign-in service and to Microsoft Graph for the cloud you select. You choose the agent on the scan, not on the source; see [Agents](../agents/index.md). + +## Add an Entra ID Source + +1. Go to **Configuration > Sources**. +2. Click **Add source**. +3. In **Source type**, select **Entra ID**. +4. Under **Details**, enter a **Name**. +5. Add a **Description** and **Labels** if you want them; see [Labels](labels.md). +6. Under **Connection**, fill in the fields described in the following table. +7. Under **Access**, in **Service account**, select the **Client ID/secret** account you set up for this app registration. +8. Click **Test connection** and wait for **Connection successful**. +9. Click **Add source**. + +| Field | Required | What to enter | Default | +|---|---|---|---| +| **Tenant ID** | Yes | The **Directory (tenant) ID** of the tenant, a globally unique identifier (GUID) such as `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. | None | +| **Azure cloud** | No | The cloud that hosts the tenant: **Azure (Commercial)**, **Azure Government (GCC)**, **Azure Government (GCC High)**, **Azure Government (DoD)**, or **Azure China (21Vianet)**. | Azure (Commercial) | + +![Add source dialog with Entra ID selected](/images/accessanalyzer/26.1/sources/add-entra-id.webp) + +Changing **Tenant ID** on an existing source shows the warning **Existing scan data won't follow this change**: data already synced stays with the old tenant. If you only want a different display name, change **Name** instead. + +## What Test Connection Checks + +**Test connection** signs in to the tenant with the service account's client ID and secret, then checks that the app registration has the permissions the sync needs. The button becomes available after you enter a **Tenant ID** and select a service account. + +Success shows the message **Connection successful**. Failure shows **Connection failed** with the reason. If Access Analyzer has no specific reason to report, the message is **Entra ID connection validation failed.** + +## What the Sync Collects + +An **Identity sync** has no options for this source type. + +| Object | What Access Analyzer records | +|---|---| +| Users: identity | Display name, user principal name, sign-in names, email, first name, and last name | +| Users: organization | Job title, department, company, office, manager, address, and phone numbers | +| Users: account | Account state (disabled, locked, lock reason, and lock time), user type, creation type, creation date, and last activity | +| Users: credentials | Password settings (required, expiry, last changed, and change forced at next sign-in) and whether the user has multi-factor authentication (MFA) configured | +| Users: licenses and sync | Assigned licenses and, for synced accounts, the on-premises object ID and last sync time | +| Groups | Display name, group type, and for dynamic groups, the membership rule | +| Directory roles | Display name, role template ID, whether the role is built in, enabled, and privileged, and the principal types you can assign it to | +| Memberships | Which users and groups belong to which group or hold which role, and, for nested groups, the group Access Analyzer expanded the membership from | + +The synced data drives the [Identity reports](../dashboards-reports/reports/identity.md). diff --git a/docs/accessanalyzer/26.1/sources/import-sources.md b/docs/accessanalyzer/26.1/sources/import-sources.md new file mode 100644 index 0000000000..82ac1f1c97 --- /dev/null +++ b/docs/accessanalyzer/26.1/sources/import-sources.md @@ -0,0 +1,161 @@ +--- +title: Import Sources From a CSV File +description: Create many sources at once by uploading a CSV file that lists them, with one row per source and columns for each type's connection fields. +sidebar_position: 6 +--- + +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + +**Import CSV** on the Sources page creates sources in bulk from a CSV file. One file can mix every source type: each row names its type and fills in only the columns that type needs. The file refers to service accounts by name, so it never contains a password, secret, or key. + +The import validates every row before it creates anything, imports the rows that pass, and hands you a report of the rows it skipped so you can fix them and import the report. + +## Before You Start + +- Create the [service accounts](../service-accounts/index.md) the sources need. The import skips any row that names a service account that doesn't exist. +- Check the connection requirements for each type on its page: [SMB file servers](smb-file-servers.md) (the **File Server** source type), [Active Directory](active-directory.md), [Entra ID](entra-id.md), and [Microsoft 365](microsoft-365.md) (the **SharePoint Online** source type). The import doesn't test connections; it only creates the sources. +- Keep the file to 5 MB and 5,000 data rows at most. Split larger inventories into several files. + +Users with the Viewer role don't see the **Import CSV** button. + +## Import a File + +1. Go to **Configuration > Sources**. +2. Click **Import CSV**. +3. Click **Download CSV template** if you want a starting point. The template has the header row and one example row per source type. + + ![Import CSV dialog for bulk-adding sources](/images/accessanalyzer/26.1/sources/import-csv.webp) + +4. Drop your file on the upload area, or click the area to browse for it. The upload accepts only `.csv` files. +5. Review the preview. Each row shows a **Status** of **Valid** or **Error**. Error rows appear first, with the reason in the **Problem** column. The summary above the table shows how many rows the import creates and how many it skips. +6. Click **Import N valid rows**, where N is the number of rows that passed. To start over instead, click **Choose a different file**. +7. Keep the dialog open while the progress bar runs. +8. Check the result. It shows how many sources the import created. If any rows failed, it also shows how many it skipped and a **Download skipped rows report** link. +9. Click **Done**. + +If you try to close the dialog before the import finishes, a warning says **If you close now, this import will be discarded.** Click **Stay** to continue or **Discard import** to abandon it. + +## File Format + +The file is a standard CSV with a header row. The import matches header names after trimming and lowercasing them, so `Name`, `name`, and `NAME` all work and column order doesn't matter. It ignores columns it doesn't recognize, trims every cell, and skips empty lines. Only `name` and `type` are required columns; leave out any other column when no row needs it. + +### Columns + +| Column | Required | Used by | Notes | +|---|---|---|---| +| `name` | Yes | All types | Must be unique among existing sources and within the file, ignoring case. | +| `type` | Yes | All types | The source type; see [Values for `type`](#values-for-type). | +| `description` | No | All types | Free text. | +| `service_account` | No | All types | The name of an existing service account, matched ignoring case. Leave empty to assign one later. | +| `labels` | No | All types | `key=value` pairs separated by `;`, for example `env=production;team=finance`. Same rules as [labels](labels.md) set on a source: one value per key, at most 50 labels, no `=`, `;`, or `,` inside a key or value. | +| `host` | For File Server and Active Directory | File Server, Active Directory | Hostname or IP address of the SMB server or domain controller. | +| `port` | For Active Directory | File Server, Active Directory | Port number. Optional for File Server, where an empty cell means 445. Required for Active Directory: 389 for LDAP, or 636 for LDAPS. | +| `domain` | For Active Directory | File Server, Active Directory | Windows domain or workgroup name for File Server; DNS name of the domain for Active Directory. | +| `ignore_ssl_errors` | No | Active Directory | `true` or `false`, ignoring case. Empty means `false`. | +| `tenant_id` | For Entra ID | Entra ID | The directory (tenant) ID. | +| `azure_cloud` | No | Entra ID, SharePoint Online | `AzurePublic`, `AzureUsGovernmentGcc`, `AzureUsGovernmentGccHigh`, `AzureUsGovernmentDoD`, or `AzureChina`. The default is `AzurePublic`. | +| `sharepoint_domain` | For SharePoint Online | SharePoint Online | The SharePoint Online domain, such as `contoso.sharepoint.com`. | + +The header row in the downloaded template is the authoritative list of connection columns for your installation. + +### Values for `type` + +Each type accepts its record name, its underscore alias, or the display name shown in Access Analyzer. Matching ignores case. The record name is the safest choice because the template uses it. + +| Source type | Record name | Alias | Display name | +|---|---|---|---| +| File Server | `cifs` | `file_server` | `File Server` | +| Active Directory | `active-directory` | `active_directory` | `Active Directory` | +| Entra ID | `entra-id-ccf` | `entra_id` | `Entra ID` | +| SharePoint Online | `sharepoint-online-ccf` | `sharepoint_online` | `SharePoint Online` | + +## Examples + +Each example uses only the columns its type needs. You can include the full header from the template instead and leave the unused cells empty. + + + + +```csv title="file-servers.csv" +name,type,description,service_account,labels,host,port,domain +Finance file server,cifs,HQ finance shares,fs-scan,env=production;team=finance,fs01.corp.example.com,445,CORP +HR file server,cifs,,fs-scan,env=production;team=hr,fs02.corp.example.com,,CORP +Lab NAS,cifs,Engineering lab,lab-scan,env=dev;team=engineering,10.20.30.40,,WORKGROUP +``` + + + + +```csv title="domains.csv" +name,type,description,service_account,labels,host,port,ignore_ssl_errors,domain +Corp domain,active-directory,Production forest root,ad-reader,env=production,dc01.corp.example.com,389,false,corp.example.com +Lab domain,active-directory,,ad-reader-lab,env=dev,dc01.lab.example.com,636,true,lab.example.com +``` + + + + +```csv title="tenants.csv" +name,type,description,service_account,labels,tenant_id,azure_cloud +Contoso Entra ID,entra-id-ccf,,entra-app,env=production,00000000-0000-0000-0000-000000000000,AzurePublic +``` + + + + +```csv title="sharepoint.csv" +name,type,description,service_account,labels,sharepoint_domain,azure_cloud +Contoso SharePoint,sharepoint-online-ccf,Includes OneDrive,spo-app,env=production;data=confidential,contoso.sharepoint.com,AzurePublic +``` + + + + +```csv title="sources.csv" +name,type,description,service_account,labels,host,port,domain,ignore_ssl_errors,tenant_id,azure_cloud,sharepoint_domain +Finance file server,cifs,HQ finance shares,fs-scan,env=production;team=finance,fs01.corp.example.com,445,CORP,,,, +Corp domain,active-directory,,ad-reader,env=production,dc01.corp.example.com,389,corp.example.com,false,,, +Contoso Entra ID,entra-id-ccf,,entra-app,env=production,,,,,00000000-0000-0000-0000-000000000000,AzurePublic, +Contoso SharePoint,sharepoint-online-ccf,,spo-app,env=production,,,,,,AzurePublic,contoso.sharepoint.com +``` + + + + +## Validation + +### File-Level Errors + +These stop the import before the preview: + +| Message | Fix | +|---|---| +| **The file couldn't be read. Check that it is a valid CSV.** | Save the file as plain CSV. Check for unbalanced quotes. | +| **Missing required column: name.** / **Missing required column: type.** | Add the column to the header row. | +| **The file contains no data rows.** | Add at least one row under the header. | +| **File exceeds 5,000 rows.** | Split the file. | + +### Row-Level Errors + +The import checks each row in the following order and shows only the first problem it finds in the **Problem** column. Fixing that problem can reveal the next. + +| Message | Meaning | +|---|---| +| **Name is required.** | The `name` cell is empty. | +| **Unknown type "X". Use one of: …** | The `type` cell matches no source type. The message lists the record names. | +| **Missing required field: host.** (or another column) | A required connection column for that type is empty. | +| **"X" isn't a valid hostname or IP address.** | The `host` cell fails the hostname and IPv4 checks. Other fields show their own format message. | +| **ignore_ssl_errors must be true or false.** | A boolean column holds something other than `true` or `false`. | +| **Duplicate name — first used on row N.** | Another row in the file uses the same name, ignoring case. | +| **A source named "X" already exists.** | A source with that name exists in Access Analyzer. | +| **Service account "X" not found.** | No service account has that name. | +| **Invalid labels — use key=value pairs separated by ";".** | A pair in `labels` is malformed or contains a forbidden character. | +| **Duplicate label key "X" — a key can have only one value.** | The same key appears twice in `labels`. | +| **At most 50 labels per source.** | Too many pairs in `labels`. | + +## Partial Success and the Skipped Rows Report + +An import never fails as a whole because of one bad row. The import leaves out rows marked **Error** in the preview and creates the valid rows. A row that passes the preview can still fail when the import saves it, for example if someone created a source with the same name in the meantime. The result counts that row as skipped, and the skipped rows report shows it with a **Server error:** message. + +The skipped rows report is a CSV with the same columns as your file plus a final `error` column holding the message for each row. Fix the cells and import the report as it is; the import ignores the `error` column like any other column it doesn't recognize. Because the rows that succeeded aren't in it, importing it again creates no duplicates. diff --git a/docs/accessanalyzer/26.1/sources/index.md b/docs/accessanalyzer/26.1/sources/index.md new file mode 100644 index 0000000000..d52e8d13da --- /dev/null +++ b/docs/accessanalyzer/26.1/sources/index.md @@ -0,0 +1,104 @@ +--- +title: Sources +description: A source is a file system or identity system that Access Analyzer scans; add, edit, label, and delete sources from the Sources page. +--- + +A source is one system that Access Analyzer connects to and scans: a file server, an Active Directory domain, an Entra ID tenant, or a SharePoint Online tenant. Every source has a type and a connection (where the system is), and usually a service account (how Access Analyzer signs in to it). Scans then run against one or more sources and store what they collect for the dashboards and reports. + +Manage sources at **Configuration > Sources**. Users with the Viewer role see a read-only list without the add, import, edit, or delete controls; see [Users and roles](../settings/users.md). + +![Sources list showing three File Server sources with service accounts and labels](/images/accessanalyzer/26.1/sources/list.webp) + +## Source Types + +Four source types are available. The first column shows the name you select in the **Source type** list when you add a source. + +| Source type | System | What its scans collect | Scan types | Service account type | +|---|---|---|---|---| +| **File Server** | SMB file servers | Shares, folders, and files with their owners and attributes; share and folder permissions, plus file permissions when the scan's file-level permission option is on; file contents matched against sensitive data patterns | Access scan, Sensitive data scan | Username/password | +| **Active Directory** | One Active Directory domain | Users, groups, group memberships, and organizational units | Identity sync | Username/password | +| **Entra ID** | One Microsoft Entra ID tenant | Users, groups, directory roles, and memberships | Identity sync | Client ID/secret | +| **SharePoint Online** | One SharePoint Online tenant | Site collections, lists, libraries, documents, OneDrive personal sites (when the scan's Collect OneDrive option is on, the default), sharing settings, permissions, and SharePoint groups; document contents matched against sensitive data patterns | Access scan, Sensitive data scan | Client ID/certificate | + +Each type has its own page with prerequisites, the fields to fill in, and what the scans return: [SMB file servers](smb-file-servers.md), [Active Directory](active-directory.md), [Entra ID](entra-id.md), and [Microsoft 365](microsoft-365.md). + +Identity sources do more than feed the identity reports. File Server scans record who has access as security identifiers (SIDs); an Active Directory source for the same domain is what turns those SIDs into account and group names in the reports. + +## Add a Source + +1. Go to **Configuration > Sources**. +2. Click **Add source**. +3. In **Source type**, select the type. The list is alphabetical: Active Directory, Entra ID, File Server, SharePoint Online. + + ![Source type dropdown listing Active Directory, Entra ID, File Server, and SharePoint Online](/images/accessanalyzer/26.1/sources/add-type-menu.webp) + +4. In **Details**, enter a **Name** and, if you want, a **Description** and **Labels**. +5. In **Connection**, fill in the fields for the type. Each type's page, linked under [Source types](#source-types), lists them. +6. In **Access**, select a **Service account**. +7. Click **Test connection**. +8. When **Connection successful** appears, click **Add source**. + +The **Name** is required, can be up to 128 characters, and must be unique across all sources regardless of case. The form warns with **A source with this name already exists** before you save. **Description** is optional. **Labels** are optional `key=value` pairs; see [Labels](labels.md). + +**Service account** lists every service account by name, with **None** first. The list includes accounts of every type, so pick one of the type that the source needs (see [Source types](#source-types)). You can save a source without a service account, but **Test connection** stays disabled until you select one. + +**Test connection** becomes available when you've filled every required connection field and selected a service account. A successful test shows the message **Connection successful**. A failed test shows **Connection failed** in the form with the error text from the connection attempt. Changing any connection field or the service account clears the result, so test again after edits. + +To add many sources at once, use [Import sources from a CSV file](import-sources.md). + +## Edit a Source + +1. Click **Edit source** in the row. The form opens with the same sections as when adding. + + ![Edit source dialog for a File Server source](/images/accessanalyzer/26.1/sources/edit-file-server.webp) + +2. Change the fields you need. **Source type** is locked: to move a system to a different type, add a new source. +3. Click **Test connection** to check the values in the form. +4. Click **Save changes**. + +Changing the field that identifies the system, such as **Host**, **Domain** (Active Directory), **Tenant ID**, or **SharePoint domain**, shows the warning **Existing scan data won't follow this change**. Data already collected stays with the old target, and future scans store data under the new one. If you only want a different display name, change **Name** instead. + +## Delete a Source + +1. Click **Delete source** in the row. +2. Click **Delete Source** to confirm. You can't undo a deletion. + +Access Analyzer refuses to delete a source in two cases: + +- A scan execution is running or pending on the source. The dialog says a scan is running; stop it from [Scan executions](../scans/scan-executions.md) or wait for it to finish, then try again. +- The source has scan history. A source that scans have run against, or that a scan references, stays in place. + +## Work With Several Sources at Once + +Select rows with the checkboxes to open the bulk action bar. It shows the number of selected rows, a **Clear selection** link, and two actions. The selection survives paging but clears when you change the search, filters, or sort order. + +![Sources list with a selected row](/images/accessanalyzer/26.1/sources/list-row-selected.webp) + +- **Edit labels** adds labels to, or removes labels from, every selected source in one step. See [Labels](labels.md). +- **Delete** removes the selected sources. The dialog lists each source. After you confirm, a **Deletion results** view shows **Deleted** for each removed source, or the reason it stayed: **Scan in progress**, **Has scan history**, or **Source not found**. Sources that stayed remain selected so you can retry, for example after a running scan finishes. + +## The Sources Page + +The list shows one row per source. + +| Column | Contents | +|---|---| +| **Name** | The name you gave the source. Sortable; the default sort. | +| **Type** | The source type. Sortable. | +| **Connection** | The system the source points at: the host (and port, if not the default) for a file server, the domain controller for Active Directory, the tenant ID for Entra ID, or the SharePoint domain for SharePoint Online. | +| **Service account** | The service account the source signs in with, or a dash when the source has none. | +| **Labels** | The source's labels as `key=value` chips. | +| **Updated** | When the source last changed. Sortable. | + +At the end of each row, the **Edit source** and **Delete source** buttons open the edit form and the delete confirmation. + +The toolbar filters the list: + +- **Search sources…** matches the source name and the connection target. Searching for `example.com` finds every source whose host or SharePoint domain contains that text. +- **Type** narrows the list to one source type. The default is **All types**. +- **Filter by labels (all must match)** shows only sources that carry every label you pick. Selecting `env=production` and `team=finance` shows the sources that have both. +- **Clear filters** resets the search and both filters. + +The list shows 25 rows per page by default; you can switch to 10, 50, or 100. + +When no source exists yet, the page shows **No sources yet** with a prompt to add one or import several from a CSV file. When filters hide everything, it shows **No sources match your filters**. diff --git a/docs/accessanalyzer/26.1/sources/labels.md b/docs/accessanalyzer/26.1/sources/labels.md new file mode 100644 index 0000000000..f462a3a80c --- /dev/null +++ b/docs/accessanalyzer/26.1/sources/labels.md @@ -0,0 +1,82 @@ +--- +title: Labels +description: Tag sources with key=value labels to filter the Sources page and to target scans at every source that matches. +sidebar_position: 5 +--- + +A label is a `key=value` pair attached to a source, such as `env=production` or `team=finance`. Labels do two jobs: they let you filter the Sources page, and they let a scan target "every source with these labels" instead of a fixed list. Label a new file server `env=production` and the production scans pick it up on their next run without anyone editing them. + +Labels on sources are separate from labels on agents, which decide where scans run; see [Agent labels and scan routing](../agents/agent-labels.md). + +## The Label Model + +- A label has a key and a value. Both are required. +- A source can carry up to 50 labels, and each key appears at most once per source. `env=production` and `env=staging` can't both be on the same source. +- Keys can be up to 63 characters and values up to 255. Neither can contain `=`, `;`, or `,`. Spaces, slashes, colons, and non-Latin characters are fine. +- Access Analyzer trims leading and trailing whitespace and compares labels case-insensitively: `Env=Production` and `env=production` are the same label. When you enter a key or value that already exists in another casing, the editor snaps it to the existing form. +- Labels form a shared vocabulary. Attaching `env=production` to a second source reuses the same label, and the editor suggests known keys and, after you pick a key, its known values. + +### A Labeling Scheme That Works + +Pick a small set of keys, decide their values up front, and use them on every source. The following scheme answers most of the questions people ask of the Sources page and gives scans something stable to target. + +| Key | Example values | Use it for | +|---|---|---| +| `env` | `production`, `staging`, `dev` | Scheduling: nightly Sensitive data scans on production only | +| `team` | `finance`, `hr`, `engineering` | Ownership; filtering the list when a team asks what's scanned | +| `region` | `emea`, `us-east`, `apac` | Splitting scans by region so each runs in its own maintenance window | +| `data` | `confidential`, `internal`, `public` | Deciding which sources need Sensitive data scans at all | +| `owner` | `jane.doe` | Who to call when a scan fails | + +With this scheme, a scan targeting `env=production` and `data=confidential` covers every confidential production source, including any you add later. + +## Ways to Set Labels + +- In the **Labels** field in the **Details** section of the source form, when you add or edit a source. See [Add a source](index.md#add-a-source). +- In bulk: select several sources on the Sources page and click **Edit labels**. See [Edit labels on several sources](#edit-labels-on-several-sources). +- In a CSV import: the `labels` column takes `key=value` pairs separated by `;`. See [Import sources from a CSV file](import-sources.md). + +### The Label Editor + +The editor is a two-column grid with **Key** and **Value** headers, a remove button at the end of each row, and an always-present empty row at the bottom for the next label. There's no add button; filling in the empty row creates a new one below it. + +Both cells offer autocomplete from the existing vocabulary: keys in the **Key** cell, and the values already used with that key in the **Value** cell. When nothing matches, the list says **No matching keys.** or **No matching values.** Keep typing to create a new label. Pasting `key=value` into the **Key** cell splits it into both cells. + +The editor rejects mistakes inline: + +| Message | Cause | +|---|---| +| **This label is already added** | The same `key=value` pair is on another row | +| **This key is already added** | Another row uses the same key | +| **Label key is required** / **Label value is required** | A row has only a key or only a value when you save | +| **Label key must be at most 63 characters** / **Label value must be at most 255 characters** | Too long | +| **Label key must not contain "=", ";", or ","** (or the value equivalent) | A forbidden character | + +## Edit Labels on Several Sources + +1. On the Sources page, select the sources with the row checkboxes. +2. In the bulk action bar, click **Edit labels**. The dialog title shows how many sources you're editing. +3. Under **Add labels**, enter the labels every selected source should get. +4. Under **Remove labels**, select the labels to remove. The list offers only labels that at least one selected source carries. If none of the selected sources has a label, the field reads **The selected sources have no labels to remove.** +5. Click **Apply to N sources**. The button shows the number of sources you selected, for example **Apply to 3 sources**. + +You must add or remove at least one label. If an addition would take a source past 50 labels, the dialog names that source and rejects the whole update, so none of the sources change. After the update, the dialog switches to **Label update results** and lists each source as **Updated** or with the reason it failed. + +## Filter the Sources Page by Labels + +The **Filter by labels (all must match)** box in the Sources toolbar takes one or more labels and shows only the sources that carry every one of them. Selecting `env=production` and `team=finance` shows the sources that have both, not either. The page URL carries the active filter, so you can bookmark a filtered view or send the link to a colleague. Click **Clear filters** to remove it and any other active filter. + +## Target Scans at Labels + +When you create a scan, the **Target** step asks **Which sources should this scan cover?** and offers two answers: + +- **Specific sources**: pick exactly which sources to scan. The list stays fixed until you edit the scan. +- **Sources matching labels**: target every source that carries all of the labels you enter. Access Analyzer re-evaluates the set at each run. + +With **Sources matching labels**, enter the labels under **Source labels**. A source must carry all of them for the scan to cover it: `env=production` plus `team=finance` targets production finance sources only. As you type, the step shows how many sources match right away, so you can check the selection before saving. + +A scan can match nothing yet. The step shows **No sources match these labels yet** with the reminder **You can still create this scan — it will target any sources that match when it runs.** This is how you set up a scan before you add the sources it covers. + +Each run resolves the labels again. A source you add or relabel into the set joins the next run; a source you delete or relabel out of it drops out. When a source drops out, Access Analyzer removes its executions for that scan as well. If a matching source is of a type that the scan can't handle, such as an Active Directory source matched by an Access scan, the step warns you, and the run skips that source without failing. + +See [Scans](../scans/index.md) for the rest of the scan settings. diff --git a/docs/accessanalyzer/26.1/sources/microsoft-365.md b/docs/accessanalyzer/26.1/sources/microsoft-365.md new file mode 100644 index 0000000000..8c982e0388 --- /dev/null +++ b/docs/accessanalyzer/26.1/sources/microsoft-365.md @@ -0,0 +1,110 @@ +--- +title: Microsoft 365 +description: Add a SharePoint Online source to scan the sites, documents, sharing settings, and permissions of a Microsoft 365 tenant, including OneDrive. +sidebar_position: 4 +--- + +A **SharePoint Online** source points Access Analyzer at the SharePoint Online service of one Microsoft 365 tenant. Access scans crawl the tenant's site collections, including OneDrive personal sites, and record documents, sharing settings, permissions, and SharePoint groups. Sensitive data scans open the documents and look for sensitive data patterns. + +Authentication uses an app registration with a certificate rather than a client secret, so the setup has one extra step: you upload the service account's public certificate to the app registration in the Microsoft Entra admin center. + +For an end-to-end walkthrough, see [Scan Microsoft 365](../guides/microsoft-365.md). + +## Prerequisites + +### App Registration + +In the Microsoft Entra admin center, register an application in the tenant that owns the SharePoint Online sites. The scan uses the OAuth 2.0 client credentials flow, so no user signs in. On the app registration: + +1. Copy the **Application (client) ID** and the **Directory (tenant) ID** from **Overview**. +2. Add the application permissions that give the app access to the tenant's SharePoint Online sites, their content, and their permissions. +3. Grant admin consent for the tenant. +4. Leave **Certificates & secrets** for later: you upload the certificate after creating the service account in Access Analyzer. + +### Service Account + +SharePoint Online sources use a [Client ID and certificate](../service-accounts/client-id-certificate.md) service account. It carries the **Client (application) ID**, the **Tenant ID**, and a certificate. The tenant ID belongs to the service account, not the source; the source records only the SharePoint domain and the cloud. Under **Certificate**, choose one of two options: + +- **Generate for me** (default). Access Analyzer generates a self-signed RSA-2048 certificate, valid for one year, when you save the account. Click **Download certificate (.pem)** on the confirmation step. +- **Upload my own**. Provide a single `.pem` file, up to 1 MB, containing the certificate and its unencrypted private key. Access Analyzer doesn't accept `.pfx` files or password-protected keys. + +After you save the account, upload the public certificate to the app registration: + +1. In the Microsoft Entra admin center, open the app registration. +2. Go to **Certificates & secrets**. +3. Upload the public certificate. + +Scans can't authenticate until the certificate is on the app registration. Repeat the upload whenever you regenerate or replace the certificate. + +### Entra ID Sync for Effective Permissions + +An **Effective Permissions Calculation** step determines who has access to each object. It expands Entra ID group memberships using the most recent completed Identity sync of an [Entra ID](entra-id.md) source for the same tenant. If no such sync exists, the step still runs but calculates effective permissions from SharePoint data only, without expanding Entra ID groups. Add an Entra ID source for the tenant and sync it before your first SharePoint Online scan. + +### Network + +The agent that runs the scan needs outbound HTTPS access to Microsoft's sign-in service, to Microsoft Graph, and to the tenant's SharePoint domains: the one you enter in **SharePoint domain** and its OneDrive counterpart, for example `contoso.sharepoint.com` and `contoso-my.sharepoint.com`. You choose the agent in the scan's **Agent** field; see [Agents](../agents/index.md). + +## Add a SharePoint Online Source + +1. Go to **Configuration > Sources**. +2. Click **Add source**. +3. In **Source type**, select **SharePoint Online**. +4. Under **Details**, enter a **Name**. +5. Add a **Description** and **Labels** if you want them; see [Labels](labels.md). +6. Under **Connection**, enter the **SharePoint domain**. +7. If the tenant isn't in the commercial cloud, change **Azure cloud**. +8. Under **Access**, select the service account you created. +9. Click **Test connection** and wait for **Connection successful**. +10. Click **Add source**. + +![Add source dialog with SharePoint Online selected](/images/accessanalyzer/26.1/sources/add-sharepoint-online.webp) + +The **Connection** fields: + +| Field | Required | What to enter | Default | +|---|---|---|---| +| **SharePoint domain** | Yes | The tenant's SharePoint Online domain, for example `contoso.sharepoint.com`. | None | +| **Azure cloud** | No | The Azure cloud environment that hosts the tenant: **Azure (Commercial)**, **Azure Government (GCC)**, **Azure Government (GCC High)**, **Azure Government (DoD)**, or **Azure China (21Vianet)**. | Azure (Commercial) | + +Changing **SharePoint domain** on an existing source shows the warning **Existing scan data won't follow this change**: data already collected stays with the old domain. To rename the source, change **Name** instead. + +## Test Connection + +**Test connection** signs in to the tenant with the service account's client ID and certificate. The button becomes available after you enter a **SharePoint domain** and select a service account. + +Success shows the message **Connection successful**. Failure shows an alert titled **Connection failed** with the reason. If Access Analyzer has no specific reason to report, the message is **SharePoint connection validation failed.** + +## What the Scans Collect + +### Access Scans + +Access scans crawl everything within the scope you set on the scan, on every run; there is no differential mode for this source type. + +| Object | What Access Analyzer records | +|---|---| +| Tenant sharing settings | External sharing capability for the tenant and for OneDrive, whether the Everyone and All Users claims are visible, and the sharing domain allow and block lists | +| Site collections | Site and web IDs, type (Team, Communication, or Personal), template, external sharing capability at that scope, guest access, read-only and lock state, and whether the site blocks custom scripts | +| Lists and libraries | List ID and template type | +| Documents | Document ID, version label, and the user who has it checked out | +| Permissions | Which principal holds which permission level on which object, the numeric permission mask, and the sharing type | +| SharePoint groups and memberships | Site groups with their numeric IDs and members | + +The scan's options control the scope: + +| Option | Default | Effect | +|---|---|---| +| **Workers** | 4 | Concurrent crawlers. Higher values shorten the scan but increase load on the tenant. | +| **Include site collections** | Empty (all) | Exact URLs of the site collections to scan. No wildcards. | +| **Exclude site collections** | Empty | Site collections to skip. Supports the `*` wildcard. | +| **Exclude object URLs** | Empty | URL patterns for documents, folders, and lists to skip within site collections. Supports the `*` wildcard; a URL without a wildcard matches nothing, so append `/*` to exclude a whole site. Exclude rules take precedence over include rules. | +| **Collect OneDrive** | On | Include OneDrive personal sites in the crawl. | + +Raise **Workers** only if the tenant has SharePoint Online prioritization or adaptive throttling enabled, and treat 32 as the practical maximum. Beyond that, heavier throttling can cancel out the gain. + +See [Scan types](../scans/scan-types.md) for how these options appear when you create a scan. + +### Sensitive Data Scans + +Sensitive data scans read the contents of the documents an Access scan found and match them against the enabled [sensitive data patterns](../sensitive-data-patterns/index.md). The scan skips documents larger than `sharepoint_file_size_max_mb` (10 MB by default) and documents whose extension appears in `sharepoint_excluded_extensions`; you set both in [Application settings](../settings/application.md). When the tenant throttles requests, the scan backs off and retries. + +The collected data drives the [Data security dashboard](../dashboards-reports/dashboards/data-security.md) and the SharePoint [Data reports](../dashboards-reports/reports/data.md). diff --git a/docs/accessanalyzer/26.1/sources/smb-file-servers.md b/docs/accessanalyzer/26.1/sources/smb-file-servers.md new file mode 100644 index 0000000000..fb7be4ba0f --- /dev/null +++ b/docs/accessanalyzer/26.1/sources/smb-file-servers.md @@ -0,0 +1,90 @@ +--- +title: SMB File Servers +description: Add a File Server source to scan the shares, permissions, and file contents of an SMB file server. +sidebar_position: 1 +--- + +A **File Server** source points Access Analyzer at one SMB file server: a Windows file server, NetApp, Dell PowerScale (formerly Isilon), or Nutanix Files. Access scans walk its shares and record who can reach which folders and files; Sensitive data scans open the files and look for sensitive data patterns. Connections use SMB 2 or 3; Access Analyzer doesn't support SMB 1. + +Add one source per server, using the server's own hostname or IP address. Access Analyzer doesn't follow Distributed File System (DFS) namespaces; when a DFS link points at a share it can't reach, the scan records an error on that object and continues. + +For an end-to-end walkthrough from source to first report, see [Scan SMB file servers](../guides/smb-file-servers.md). + +## Prerequisites + +### Service Account + +File Server sources use a [Username and password](../service-accounts/username-password.md) service account. Enter the username as `DOMAIN\username`; the `username@domain` form works for Access scans but not for Sensitive data scans. For a server that isn't domain-joined, use the server's workgroup name in place of the domain, for example `WORKGROUP\username`, or enter it in the source's **Domain** field. + +The account needs the following rights on the file server: + +| Right | Why | +|---|---| +| **Read** on every share, folder, and file to scan (List folder / Read data, Read attributes, and Read permissions) | Access scans list folders and read their permission entries; Sensitive data scans read file contents. | +| Membership in the local **Backup Operators** group (optional) | Lets the scan open folders the account has no explicit permission on; membership in the local **Administrators** group grants the same. Without either, the scan records those folders with an error status and skips their contents. | +| Membership in the local **Administrators** group (optional) | Lets the scan read each share's local path. Without it, the scan still collects the share list, but without paths. | + +The account doesn't need write rights. The scans only read. + +### Network + +The agent that runs the scan connects to the file server over Transmission Control Protocol (TCP) port 445. Connections use SMB 2 or 3 and require signing but not encryption. + +:::note + +Access scans can use any port you enter in **Port**. Sensitive data scans work only on port 445; against a source on another port, the scan runs but can't read any files. + +::: + +You select the agent on the scan, not on the source; see [Agents](../agents/index.md). + +## Add a File Server Source + +1. Go to **Configuration > Sources**. +2. Click **Add source**. +3. In **Source type**, select **File Server**. +4. Under **Details**, enter a **Name**. +5. Add a **Description** and **Labels** if you want them; see [Labels](labels.md). +6. Under **Connection**, fill in the fields described in the following table. +7. Under **Access**, in **Service account**, select the account you set up for this server. +8. Click **Test connection**. A **Connection successful** message confirms the account can reach the server and list its shares. +9. Click **Add source**. + +![Add source dialog with File Server selected](/images/accessanalyzer/26.1/sources/add-file-server.webp) + +| Field | Required | What to enter | Default | +|---|---|---|---| +| **Host** | Yes | The hostname or IPv4 address of the SMB server, for example `fileserver.example.com`. | None | +| **Port** | No | The TCP port for the SMB connection, 1 to 65535. Leave the default unless the server listens elsewhere; Sensitive data scans require 445. | 445 | +| **Domain** | No | The Windows domain or workgroup name, for example `CORP`. Applies when the username doesn't include a domain. | None | + +## Test Connection + +**Test connection** opens an SMB session on the host and port with the service account's credentials and lists the first page of shares. The button becomes available after you fill in **Host** and select a service account. + +A successful test shows the message **Connection successful**. A failed test shows **Connection failed** with a hint about the cause: + +| Hint | What to check | +|---|---| +| Connection timed out | The host is reachable and the port is open | +| Connection refused | An SMB service is listening on the port you entered | +| Permission denied | The account can sign in to the server and list its shares | +| SMB protocol version not supported by server or client | The server allows SMB 2 or 3; Access Analyzer doesn't support SMB 1 | + +## What the Scans Collect + +### Access Scans + +Access scans enumerate the server's shares, then walk each share's folders down to the configured depth. For every share, folder, and file, they record the path, name, owner, size, timestamps, and attributes, plus, for shares and folders, the permission entries: which security identifier (SID) is allowed or denied which rights, and whether each entry is inherited or explicit. The results also flag conditions such as access granted to Everyone or Authenticated Users, explicit deny entries, and folders where inheritance is broken. + +Access scans collect file-level permission entries only when you turn on **Enable File-Level Permission Scanning** in the scan's settings; otherwise they record permissions for shares and folders. + +Access scans treat shares whose names end in `$`, such as `C$` or `ADMIN$`, as system shares and skip them by default. To scan a share whose name ends in `$`, either clear **Exclude system shares** in the scan's settings or list the share under **Include shares**, which scans only the shares you name. See [Scan types](../scans/scan-types.md) for every File Server scan option. + +Access scans record each trustee (the account or group named in a permission entry) as a SID. Add an [Active Directory](active-directory.md) source for the same domain and run an Identity sync on it so that reports show names for domain accounts and groups instead. Server-local accounts and groups stay as SIDs. + +### Sensitive Data Scans + +Sensitive data scans read the contents of the files a completed Access scan inventoried and match them against the enabled [sensitive data patterns](../sensitive-data-patterns/index.md). Run an Access scan on the source first. The scan skips files larger than the maximum file size set in [Application settings](../settings/application.md). With **Differential scan** turned on, the scan reads only files added or changed since the last Sensitive data scan. + +The collected data drives the [Data security dashboard](../dashboards-reports/dashboards/data-security.md) and the file system [Data reports](../dashboards-reports/reports/data.md). diff --git a/docs/accessanalyzer/26.1/whats-new.md b/docs/accessanalyzer/26.1/whats-new.md new file mode 100644 index 0000000000..6174a8c82c --- /dev/null +++ b/docs/accessanalyzer/26.1/whats-new.md @@ -0,0 +1,51 @@ +--- +title: What's New in 26.1 +description: A tour of what you can do in Access Analyzer 26.1, from installation to dashboards, reports, and the Netwrix Activity Monitor integration. +sidebar_position: 2 +--- + +Access Analyzer 26.1 is a web application that runs on a Linux server you own, instead of a desktop console. You install it once, open it in a browser, and every administrator works in the same place. + +Here is what you can do, area by area. + +## Installation + +One installer binary sets up the whole product on a single Linux server. You pick a size (small, medium, large, or enterprise) and supply a TLS certificate for the server's hostname. The installer prints a temporary password for the first administrator, who changes it at first sign-in and can optionally connect Active Directory or Entra ID then or later. See [Installation](install/index.md). + +## Sources + +A source is a system Access Analyzer scans: File Server, Active Directory, Entra ID, or SharePoint Online. You can tag sources with `key=value` labels such as `env=production` to filter the list and to point scans at every source that matches, and import many at once from a CSV file. See [Sources](sources/index.md). + +## Service Accounts + +A Service Account is a saved credential for reading a source or deploying an agent: Username/password, Client ID/secret, Client ID/certificate, or SSH username/key. For a certificate account, Access Analyzer can generate a self-signed certificate valid for one year, or you can upload your own. Access Analyzer never displays a secret again after you save it. See [Service Accounts](service-accounts/index.md). + +## Agents + +An Agent is a Linux machine that _runs_ your Access Scans. The System agent on the Access Analyzer server is there from the start. To reach a segmented network or keep scan traffic local, deploy more agents over SSH and route scans to them with labels. See [Agents](agents/index.md). + +## Scans + +A Scan says: +1. what to collect +2. from which source +3. on which agent +4. and when + +An Access Scan inventories shares, folders, files (and their metadata), sites, and their permissions. A Sensitive Data Scan classifies file content against sensitive data patterns. An Identity Sync pulls users, groups, and memberships from a directory service. A Scan targets specific sources or every source matching a set of labels, and runs on demand or on an hourly, daily, weekly, or monthly schedule. Each run creates one execution per source, which you can pause, resume, or stop; completed executions stay in the history for 90 days. See [Scans](scans/index.md). + +## Sensitive Data Patterns + +Sensitive Data Patterns are regular expressions that you can group by compliance program, data category, or any other system you choose. Add your own patterns and groups, place custom patterns in built-in groups, and test any pattern against sample text before saving. See [Sensitive data patterns](sensitive-data-patterns/index.md). + +## Dashboards and Reports + +Two dashboards give the wide view: Data security for File Server and SharePoint Online sources, and Active Directory for your domain. Reports answer one question at a time on three pages: Data, Identity, and Compliance. Both open in a single view with filters. See [Dashboards and reports](dashboards-reports/index.md). + +## Settings + +Settings holds what applies to the whole application: classification and Netwrix Activity Monitor defaults, feature flags, and user accounts with the Admin, User admin, and Viewer roles. People sign in with local accounts, and you can connect Active Directory or Entra ID alongside them. Daily backups of the configuration database go to local disk or S3-compatible storage, and System logs gathers logs from every component. See [Settings](settings/index.md). + +## Netwrix Activity Monitor Integration + +Netwrix Activity Monitor records who did what on file servers, in SharePoint Online, in Microsoft 365 Copilot, and more. Connect it and that activity feed streams into Access Analyzer so you can see which users touched sensitive files on an open share. Enrollment is one step: generate an enrollment token in Settings and enter it in the Activity Monitor agent with the server address and port 4504. See [Netwrix Activity Monitor](integrations/netwrix-activity-monitor.md). diff --git a/docs/accessanalyzer/2601/configurations/activity-monitor-integration.md b/docs/accessanalyzer/2601/configurations/activity-monitor-integration.md deleted file mode 100644 index be4f315fd7..0000000000 --- a/docs/accessanalyzer/2601/configurations/activity-monitor-integration.md +++ /dev/null @@ -1,311 +0,0 @@ ---- -title: "Activity Monitor Integration" -description: "Configure Netwrix Activity Monitor to stream real-time file system, SharePoint, and Copilot activity events into Access Analyzer" -sidebar_position: 85 ---- - -# Activity Monitor Integration - -## Overview - -Access Analyzer integrates with **Netwrix Activity Monitor (NAM)** to ingest real-time file system, SharePoint Online, and Microsoft 365 Copilot activity events. After you configure the integration, these events populate the activity reports in AA2601 and power anomaly detection and sensitive data activity tracking. - -The integration works through a built-in TCP listener that NAM agents connect to over a secure, mutually authenticated TLS 1.3 channel. Events stream continuously from NAM agents into AA2601's analytics database (ClickHouse), where they become available in reports. - -### Architecture - -``` -NAM Agent(s) - │ - │ TLS 1.3 (default port 4504) - │ mTLS — client certificate required - ▼ -AA2601 NAM Listener (core-api) - │ - │ Validated & buffered in memory - ▼ -ClickHouse (analytics database) - │ - ▼ -AA2601 Reports (file system activity, SharePoint, Copilot) -``` - -### Event Types - -| Event Type | Content | -| --- | --- | -| **File System Events** | SMB/CIFS file access, reads, writes, renames, permission changes | -| **SharePoint Online Events** | SharePoint file and folder activity | -| **Copilot Events** | Microsoft 365 Copilot interactions — accessed resources | - -### Security Model - -Authentication uses **mutual TLS with Subject Public Key Info (SPKI) hash pinning**: - -- AA2601 requires TLS 1.3 and rejects older protocol versions. -- Both products perform mutual authentication by matching hashes of each other's certificate public key (SPKI hash) against a persistent allowlist in their configuration. - -SPKI hashes survive certificate renewal as long as the key pair is unchanged. Re-enroll only when an agent generates a new key pair. - ---- - -## Prerequisites - -Before connecting NAM agents to AA2601: - -- **Netwrix Activity Monitor** must be installed and monitoring the hosts or services for which you want real-time activity in AA2601. Confirm monitoring is active before adding the AA2601 output. -- **TLS certificates** must be provisioned on the AA2601 server. The environment variables `SYSLOG_TLS_CERT_PATH` and `SYSLOG_TLS_KEY_PATH` specify the server certificate and private key paths. Contact your infrastructure team if the listener isn't starting. -- **Network connectivity** must allow NAM agents to reach AA2601 on TCP port 4504 (default) through any firewalls or network policies. -- You must have **Administrator** access to AA2601 to generate enrollment tokens and view enrolled agents. - -:::note -Activity data flows from NAM to AA2601 — AA2601 doesn't initiate the connection. Ensure firewalls allow outbound traffic from each NAM agent host to the AA2601 server on the configured listener port. -::: - ---- - -## Setup - -### Step 1 — Verify the Listener Is Running - -The listener starts automatically when AA2601 starts, provided TLS certificates are present and the `enable_activitymonitor_ingestion` feature flag is enabled (it is by default). - -To confirm it is active: - -1. Go to **Configuration > Application Settings > Feature Flags**. -2. Verify `enable_activitymonitor_ingestion` is set to `true`. - -If the listener isn't running, check the application logs for the reason — missing certificate, disabled feature flag, or a startup error. - -### Step 2 — Generate an Enrollment Token - -1. Go to **Configuration > Application Settings**. -2. Scroll to the **Activity Monitor** section. -3. Under **Enrollment Token**, click **Generate Token**. -4. Copy the token using the clipboard icon. - -:::note -Tokens expire after **1 hour**. Generating a new token immediately invalidates any previously issued token. A single token can enroll multiple agents and outputs simultaneously — plan your enrollment session and generate the token immediately before you begin. -::: - -### Step 3 — Add the AA2601 Output in Netwrix Activity Monitor - -Add an AA2601 output to each monitored host or service in NAM you want to stream into AA2601. - -:::note -The following steps describe the general configuration flow. Exact menu labels and field names in the NAM console may differ depending on your NAM version. Verify the steps against the NAM documentation for your installed version. -::: - -1. Open the Netwrix Activity Monitor console. -2. Navigate to the monitored host or service. -3. Add a new output and select the **Netwrix Access Analyzer 26** output type. -4. Enter the hostname or IP address of your AA2601 instance and the listener port (default: 4504). -5. Enter the enrollment token you generated in Step 2 and select **Enroll**. Ensure the connection is successful. -6. Save the output configuration. -7. Repeat for each monitored host or service. - -:::note -You can add an output in bulk by selecting multiple hosts/services and selecting **Add Output**. -::: - -The NAM agent connects to AA2601, validates AA2601's certificate by comparing it to the hash embedded in the enrollment token, -presents its client certificate, and sends an enrollment request. AA2601 validates the token, adds the agent's SPKI hash to the trusted agents allowlist, and confirms enrollment. -The NAM agent also adds AA2601's SPKI hash to the allowlist. -After that, the agent reconnects and begins streaming events. You no longer need the enrollment token unless the agent generates a new key pair. - -### Step 4 — Verify Enrollment - -After enrollment, the agent appears in AA2601's trusted agents list. You can view enrolled agents via the API: - -``` -GET /api/v1/nam-listener/agents -``` - -Each entry shows the agent's hostname, source IP, and enrollment timestamp. - -To confirm AA2601 is receiving events: - -1. Log in to Access Analyzer. -2. Navigate to the resource or host that NAM is monitoring. -3. Review the activity data for recent file events. - -If no events appear after a few minutes, see [Troubleshooting](#troubleshooting). - ---- - -## Application Settings Reference - -All Activity Monitor settings are at **Configuration > Application Settings > Activity Monitor**. Settings take effect immediately when you save them — no restart required. Each setting shows its current value, default, and an **Overridden** badge when changed from the default. Use the reset (↺) button to restore an individual setting to its default. - -### Connection Settings - -| Setting | Default | Range | Description | -| --- | --- | --- | --- | -| `activitymonitor_tcp_port` | 4504 | 1 – 65535 | TCP port the listener binds to. Must match the port configured in NAM agent settings. | -| `activitymonitor_max_connections` | 100 | 10 – 1000 | Maximum simultaneous agent connections. AA2601 rejects connections beyond this limit at the TCP layer. | -| `activitymonitor_connection_timeout` | 900 | 5 – 3600 | Seconds of inactivity before AA2601 drops an idle agent connection. Set this to be comfortably longer than your NAM polling interval. | - -### Performance and Throughput Settings - -| Setting | Default | Range | Description | -| --- | --- | --- | --- | -| `activitymonitor_reactor_threads` | 0 (auto) | 0 – 32 | Async input/output threads for handling connections. `0` automatically uses one thread per CPU core — correct for almost all deployments. | -| `activitymonitor_buffer_threads` | 8 | 1 – 16 | Writer threads that drain the in-memory event buffer to ClickHouse. More threads help sustain high write rates. | -| `activitymonitor_buffer_max_size` | 10,000 | 1,000 – 500,000 | Maximum events held in memory at once. When full, AA2601 holds new arrivals at the TCP layer (backpressure to agents) rather than dropping them. | -| `activitymonitor_batch_size` | 100 | 10 – 1,000 | Events grouped per internal processing batch. | -| `activitymonitor_batch_interval_seconds` | 10 | 1 – 60 | Maximum seconds between batch flushes to ClickHouse. The primary control for **data freshness** — lower values mean events appear in reports sooner, at the cost of more frequent small writes. | -| `activitymonitor_clickhouse_batch_size` | 10,000 | 1,000 – 100,000 | Events per ClickHouse write operation. Larger batches are more efficient but increase memory usage during the write. | -| `activitymonitor_max_concurrent_jobs` | 3 | 1 – 10 | Maximum parallel batch processing jobs. | - -### Security and Enrollment Settings - -| Setting | Default | Range | Description | -| --- | --- | --- | --- | -| `activitymonitor_enrollment_first_message_timeout_seconds` | 10 | 5 – 60 | Seconds AA2601 waits for the first message after a new connection is established. AA2601 closes connections that send nothing within this window. | -| `activitymonitor_enrollment_ban_duration_seconds` | 10 | 5 – 300 | Seconds AA2601 blocks a source IP after a protocol violation (invalid enrollment code, malformed JSON, or unexpected message format). | -| `activitymonitor_max_message_size` | 16,777,216 (16 MB) | 65,536 – 67,108,864 | Maximum byte size of a single message from a NAM agent. If a message exceeds this size without a line delimiter, AA2601 drops the connection. | - -### Shutdown Settings - -| Setting | Default | Range | Description | -| --- | --- | --- | --- | -| `activitymonitor_shutdown_drain_timeout_seconds` | 300 | 10 – 3,600 | Maximum seconds AA2601 waits for buffered events to finish writing to ClickHouse during a graceful shutdown. After this window, AA2601 force-terminates remaining writer threads and loses any events still in the buffer. | - ---- - -## Best Practices - -### Port Configuration - -Use the default port (4504) unless you have a conflict. If you must change it: - -- Update NAM agent configuration to match **before** saving the new port in AA2601. -- Update firewall rules and network policies before making the change. -- Changing the port requires all connected agents to reconnect. - -### TLS Certificate Management - -- **Monitor certificate expiration.** AA2601 logs a warning when the server certificate is within 30 days of expiry, and again within 7 days. Treat the 30-day warning as actionable. -- **NAM agents use self-signed certificates by default** — this is expected and supported. If you replace them with CA-signed certificates, re-enroll the agent. -- **Key pair rotation requires re-enrollment.** If a NAM agent generates a new key pair, its previous SPKI hash entry will no longer match. Re-enroll the agent using a new enrollment token. Remove the stale entry via the API: `DELETE /api/v1/nam-listener/agents/:spki_hash`. - -### Enrollment Token Practices - -- **Generate the token immediately before enrollment.** The 1-hour window is intentionally short. -- **Don't share tokens in email or chat.** Treat enrollment tokens like temporary passwords — use a secure transfer method. -- **For bulk enrollment**, all agents can use the same token as long as they enroll within the 1-hour window. -- **Revoke stale entries** when decommissioning a NAM agent host. An enrolled agent with a stale SPKI entry poses no security risk, but maintaining a clean allowlist helps with auditing. - -### Performance Tuning - -Start with defaults. Only adjust if you observe specific symptoms. - -**If events appear in reports with high latency (> 30 seconds):** -- Lower `activitymonitor_batch_interval_seconds` (for example, from 10 to 5). -- Check `activitymonitor_buffer_max_size` — if the buffer is routinely full, ClickHouse writes may be the bottleneck. - -**If you have a high-volume environment (many agents, high event rate):** -- Increase `activitymonitor_buffer_max_size` to 50,000 – 100,000 to absorb burst traffic. -- Increase `activitymonitor_clickhouse_batch_size` to 25,000 – 50,000 to reduce write frequency. -- Increase `activitymonitor_buffer_threads` to 12 – 16 to parallelize writes. -- Leave `activitymonitor_reactor_threads` at `0` (auto). - -**If you have many agents connecting simultaneously:** -- Raise `activitymonitor_max_connections` to at least the number of expected concurrent agents, with 20–30% headroom. - -**Don't lower `activitymonitor_connection_timeout` below your NAM polling interval.** If NAM sends events every 5 minutes and the timeout is less than 300 seconds, AA2601 drops agents between batches and forces them to reconnect constantly. The default of 900 seconds provides safe headroom for most polling configurations. - -### Kubernetes Shutdown Considerations - -The `activitymonitor_shutdown_drain_timeout_seconds` setting (default: 300 seconds) controls how long AA2601 waits during graceful shutdown to flush buffered events to ClickHouse. - -In Kubernetes deployments, the pod's `terminationGracePeriodSeconds` must be greater than this value plus a small buffer for the rest of the shutdown sequence. If `terminationGracePeriodSeconds` is less than the drain timeout, Kubernetes will force-kill the pod before drain completes, losing any buffered events. - -### Disabling the Integration - -To temporarily disable ingestion without removing agent configurations: - -1. Go to **Configuration > Application Settings > Feature Flags**. -2. Set `enable_activitymonitor_ingestion` to `false` and save. - -The listener stops accepting new connections. Existing agents will see their connections close and queue events locally per NAM's own buffering. When you re-enable ingestion, agents reconnect and resume streaming. - -:::note -Disabling and re-enabling doesn't cause data loss for events that occurred while disabled, as long as NAM agents have sufficient local buffering. -::: - ---- - -## Troubleshooting - -### The listener isn't starting - -- Verify `enable_activitymonitor_ingestion` is `true` in **Configuration > Application Settings > Feature Flags**. -- Verify the TLS certificate environment variables (`SYSLOG_TLS_CERT_PATH`, `SYSLOG_TLS_KEY_PATH`) are set and the files are readable. The application logs report a specific error if a certificate is missing, unreadable, or expired. -- Verify another process isn't already using the configured port. - -The listener retries startup up to 5 times with exponential backoff (starting at 0.5s, capping at 30s). Check logs for `"Failed to start NAM Listener"` messages with retry counts. - -### A NAM agent can't connect - -- Verify network connectivity from the agent host to AA2601 on the configured port (default: 4504). -- Verify the agent is configured with the correct hostname and port. The port in NAM agent configuration must match `activitymonitor_tcp_port`. -- Verify the agent has a valid TLS client certificate. AA2601 rejects connections without a client certificate and temporarily bans the source IP. - -### An agent connected but isn't sending data - -- Verify the agent enrolled successfully. AA2601 silently rejects data connections from agents that have not completed enrollment because their SPKI hash isn't in the allowlist. Re-enroll using a new token. -- Verify `activitymonitor_connection_timeout` isn't shorter than the agent's event polling interval. If agents idle longer than the timeout, AA2601 drops them between batches and they must reconnect. - -### Events aren't appearing in reports - -- Verify ClickHouse is healthy and reachable from AA2601. Writer threads log errors if ClickHouse writes fail. -- Check `activitymonitor_batch_interval_seconds` — at the default of 10 seconds, there is a short delay between an event occurring and appearing in a report. -- Check application logs for buffer queue depth statistics. If the buffer is full, ClickHouse writes may be lagging — consider increasing `activitymonitor_buffer_max_size` or `activitymonitor_clickhouse_batch_size`. - -### An agent keeps getting banned - -Protocol violations trigger repeated IP bans (governed by `activitymonitor_enrollment_ban_duration_seconds`): invalid enrollment codes, malformed JSON, or unexpected message formats. - -- Verify the agent is sending the correct enrollment payload. The agent should be a supported Netwrix Activity Monitor version. -- Verify the enrollment token has not expired (1-hour TTL). An expired token causes an invalid-code rejection and a short ban. Generate a new token and retry. - -Bans are short (default: 10 seconds) and reset on pod restart. For persistent issues, check NAM agent logs for the specific error response AA2601 sends during enrollment. - -### Enrolled agents list has stale entries - -Decommissioned or reinstalled agents may leave stale entries in the allowlist. These are harmless — the old SPKI hash will never match a new agent's certificate. Remove them using the API: - -``` -DELETE /api/v1/nam-listener/agents/:spki_hash -``` - -List all enrolled agents at: - -``` -GET /api/v1/nam-listener/agents -``` - ---- - -## Settings Quick Reference - -| Scenario | Setting | Recommended Change | -| --- | --- | --- | -| High event volume | `activitymonitor_buffer_max_size` | Increase to 50,000 – 100,000 | -| High event volume | `activitymonitor_clickhouse_batch_size` | Increase to 25,000 – 50,000 | -| High event volume | `activitymonitor_buffer_threads` | Increase to 12 – 16 | -| Many agents (> 100) | `activitymonitor_max_connections` | Set to agent count + 30% headroom | -| Improve report freshness | `activitymonitor_batch_interval_seconds` | Decrease to 3 – 5 | -| Long agent idle intervals | `activitymonitor_connection_timeout` | Increase to 1800 – 3600 | -| Kubernetes slow shutdown | `activitymonitor_shutdown_drain_timeout_seconds` | Decrease; align `terminationGracePeriodSeconds` | -| Maintenance window | `enable_activitymonitor_ingestion` | Set to `false`, re-enable when done | -| Port conflict | `activitymonitor_tcp_port` | Change to available port; update NAM agents and firewall rules first | - ---- - -## Related Resources - -- [Netwrix Activity Monitor Documentation](https://docs.netwrix.com/docs/activitymonitor) -- [Hardware and System Requirements](/docs/accessanalyzer/2601/install/system/requirements) -- [Network and Port Requirements](/docs/accessanalyzer/2601/install/system/network) diff --git a/docs/accessanalyzer/2601/configurations/application-settings.md b/docs/accessanalyzer/2601/configurations/application-settings.md deleted file mode 100644 index 2fb8eb5235..0000000000 --- a/docs/accessanalyzer/2601/configurations/application-settings.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: "Application Settings" -description: "Managing application settings in the Configuration node" -sidebar_position: 80 ---- - -# Application Settings - -The Application Settings page exposes configurable options that control scan behavior, file scanning limits, feature availability, Activity Monitor integration, and application branding. Navigate to **Configuration** > **Application Settings** to view and modify these settings. - -:::note -This page is available to users with the **Administrator** role only. -::: - -## Setting categories - -| Category | What it controls | -| --- | --- | -| **Feature Flags** | Enable or disable product features and integrations | -| **Scanning** | Execution history retention for scans and identity syncs | -| **File Scanning** | File size limits and excluded extensions for SMB and SharePoint scans | -| **Activity Monitor** | TCP listener behavior and enrollment token for Netwrix Activity Monitor (NAM) agent connections | -| **Branding** | Company name and support email displayed in the application | - -## Feature Flags - -Feature flags enable or disable specific product capabilities. Changes take effect immediately — no restart required. - -| Flag | Default | Description | -| --- | --- | --- | -| **MIP Labeling** | Enabled | Enables Microsoft Information Protection (MIP) sensitivity label management for SMB file shares and SharePoint Online. When disabled, the label handling options on the Sensitive Data page are hidden and no labels are applied to or read from files during scans. | - -:::note -Disabling MIP Labeling doesn't remove existing labels from files. It stops Access Analyzer from applying or updating labels in future scans. -::: - -## File Scanning - -These settings control which files are included in content classification during sensitive data scans. Adjusting them can reduce scan duration in environments with large binary or media files. - -:::note -Access Analyzer always collects file metadata — name, size, permissions, and owner — regardless of file size or extension settings. These limits apply only to content classification during sensitive data scans. -::: - -### SMB / CIFS - -| Setting | Default | Range | Description | -| --- | --- | --- | --- | -| **Maximum file size** | 10 MB | 1–100 MB | Files larger than this limit are skipped during content classification. | -| **Excluded extensions** | `.exe, .msi, .bat, .png, .jpg, .jpeg, ...` | — | Comma-separated list of file extensions to skip. Add extensions to reduce scan time on known binary or media content. | - -### SharePoint Online - -| Setting | Default | Range | Description | -| --- | --- | --- | --- | -| **Maximum file size** | 1 MB | 1–50 MB | Files larger than this limit are skipped during content classification. | -| **Excluded extensions** | `.exe, .msi, .bat, .png, .jpg, .jpeg, ...` | — | Comma-separated list of file extensions to skip. | - -## Scanning — Execution History Retention - -Access Analyzer automatically purges old execution records on a nightly schedule based on these thresholds. - -| Setting | Default | Range | Description | -| --- | --- | --- | --- | -| **Scan execution retention** | 90 days | 7–365 days | How long scan execution records are retained before automatic deletion. | -| **Sync execution retention** | 90 days | 7–365 days | How long identity sync execution records are retained before automatic deletion. | - -:::note -Reducing retention frees database storage. Increasing it extends the history available in **Configuration** > **Source Groups** > **Scan Executions**. -::: - -## Activity Monitor - -The Activity Monitor category contains settings for the built-in TCP listener and the enrollment token used when connecting NAM agents to Access Analyzer. - -### Enrollment Token - -The enrollment token is a short-lived credential that NAM agents present during their first connection to Access Analyzer. You generate it here and paste it into the NAM agent output configuration. - -1. Scroll to the **Activity Monitor** section and locate **Enrollment Token**. -2. Click **Generate Token**. -3. Copy the token using the clipboard icon. -4. Paste the token into your NAM agent output configuration before it expires. - -:::note -Tokens expire after **1 hour**. Generating a new token immediately invalidates any previously issued token. A single token can enroll multiple agents simultaneously — generate it immediately before starting your enrollment session. -::: - -For the full step-by-step setup walkthrough, see [Activity Monitor Integration](activity-monitor-integration.md). - -### Listener settings - -The remaining settings in the Activity Monitor category control TCP listener behavior — connection limits, batch sizes, buffer sizes, and timeouts. The defaults are appropriate for most deployments. For a description of each setting and guidance on tuning, see the [Activity Monitor Integration — Application Settings Reference](activity-monitor-integration.md#application-settings-reference) section. - -## Branding - -| Setting | Default | Description | -| --- | --- | --- | -| **Company name** | Netwrix | Displayed in the application interface. | -| **Support email** | support@netwrix.com | Email address shown to users when they need assistance. Update this to your internal helpdesk address after initial setup. | - -## Resetting and cache behavior - -**Resetting to default:** Each setting has a reset action that restores the factory default value. Resetting one setting doesn't affect any other settings. - -**Cache:** Access Analyzer caches Application Settings for up to 5 minutes. Changes take effect immediately on the instance that applied them. Other running instances pick up the change within 5 minutes. To force an immediate refresh across all instances, click **Refresh Cache** at the top of the page. diff --git a/docs/accessanalyzer/2601/configurations/identity-provider.md b/docs/accessanalyzer/2601/configurations/identity-provider.md deleted file mode 100644 index afdab8dac3..0000000000 --- a/docs/accessanalyzer/2601/configurations/identity-provider.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: "Identity Provider" -description: "Configure single sign-on with an external Identity Provider in Access Analyzer" -sidebar_position: 75 ---- - -# Identity Provider - -Access Analyzer supports federation with your organization's identity system so that users can sign in with their existing corporate credentials. Your identity provider handles authentication; you manage roles and permissions within Access Analyzer. - -Setting up an identity provider connection is a two-part process: first you configure the integration in your identity system, then you prepare user accounts inside Access Analyzer. - -:::note -Before continuing, confirm that the infrastructure and network requirements for your identity provider (IdP) type are in place. See [Network and Port Requirements](../install/system/network.md) and [TLS Certificate Requirements](../install/system/certificates.md). -::: - -## Supported integration types - -| Type | Description | -| --- | --- | -| **Active Directory** | Access Analyzer connects directly to your Active Directory over LDAPS. Users enter their directory credentials on the Access Analyzer login page — no redirect occurs. | -| **Entra ID** | Access Analyzer redirects users to Microsoft Entra ID (formerly Azure AD) to authenticate, then signs them in on return. | - -## Setting up an identity provider - -The installer provisions a local administrator account so you can sign in and start using Access Analyzer immediately — you don't need to connect an identity provider to complete installation. See [Quick Install](../install/quickinstall.md) for the installation steps. - -On first sign-in, the setup wizard prompts you to connect Active Directory or Entra ID: - -- **Connect now** — select **Active Directory** or **Entra ID** and complete the fields in [Part 1](#part-1-configure-your-identity-provider). -- **Set up later** — skip the wizard and go directly into the app using the local admin account. You keep full access, and you can revisit the wizard anytime at `/setup`. - -## Part 1: Configure your identity provider - -### Active Directory - -Active Directory doesn't require an application registration. Prepare the following before connecting. - -**Service account:** Create a dedicated, read-only service account in your directory. Access Analyzer never writes to your directory. - -**Certificate:** Have the CA certificate that issued your domain controller's LDAPS certificate ready as a PEM file. The setup wizard requires it to complete the connection test. - -**Network access:** The Access Analyzer cluster must be able to reach a domain controller in your AD forest over LDAPS (port 636). - -Collect the following values: - -| Value | Description | -| --- | --- | -| **AD domain name** | Fully qualified domain name of your AD forest — for example, `corp.example.com`. Access Analyzer connects over LDAPS (port 636) automatically. | -| **Service account** | A read-only service account, in User Principal Name (UPN) format — for example, `aa26-svc@corp.example.com` | -| **Service account password** | — | -| **AD authentication certificate** | The CA certificate (PEM) that issued the domain controller's LDAPS certificate | - -You don't need to look up the users base DN or the email attribute yourself. After you enter the domain, service account, and certificate, the wizard tests the connection and discovers both automatically. - -### Entra ID - -Complete the following steps in the Azure Portal before connecting Access Analyzer. - -1. Open **Azure Portal** > **Entra ID** > **App registrations** > **New registration**. -2. Name the application and click **Register**. -3. Open the registration > **Authentication** > **Add a platform** > **Web**, and add two redirect URIs: - - The URI shown on the Access Analyzer setup wizard's **Entra ID** step (`https:///setup/entra-consent-callback`) — used once, during the admin-consent step. - - `https:///idps/callback` — used every time a user signs in with Entra ID. -4. Go to **Certificates & secrets** > **New client secret**. Set an expiry that fits your rotation policy and copy the value immediately — the portal shows it only once. - -Collect the following values: - -| Value | Where to find it | -| --- | --- | -| **Tenant ID** | Azure Portal > Entra ID > Overview > Directory (tenant) ID — the GUID, not the primary domain | -| **Application (client) ID** | App registration > Overview > Application (client) ID | -| **Client secret** | Created in step 4 | - -Enter these values in the Access Analyzer setup wizard and click **Sign in with Microsoft and continue**. A popup prompts a **Global Administrator** or **Privileged Role Administrator** to sign in and grant consent for Access Analyzer to read the directory. - -:::note -Register both redirect URIs before anyone signs in with Entra ID. The setup wizard's callback completes the connection; `/idps/callback` is Microsoft's redirect target for every subsequent sign-in — omitting it lets you finish setup but blocks sign-in with an `AADSTS50011` redirect URI mismatch. -::: - -## Part 2: Prepare Access Analyzer - -### First sign-in - -The installer provisions a local first administrator account during installation — the person whose email you entered at the **First Admin Email** prompt can sign in immediately using the temporary password shown in the installation summary. See [First admin account](../install/quickinstall.md#first-admin-account). - -Navigate to `https://` and sign in with the first admin's email and temporary password, then set a new password when prompted. The setup wizard then prompts you to connect Active Directory or Entra ID — or select **Set up later** to go directly into the app and revisit the wizard anytime at `/setup`. - -### Pre-provision user accounts - -Before a user can sign in through the identity provider, their account must exist in Access Analyzer. The application successfully authenticates them against your IdP but denies access if no matching account exists. - -:::note -The email address you enter during pre-provisioning must exactly match the address the IdP sends or the address in the LDAP `mail` attribute, including case. A mismatch causes sign-in to fail. -::: - -1. Navigate to **Configuration** > **Users**. -2. Click **Add User**. -3. Enter the user's **Name** and **Email** address. -4. Select a **Role**: **Administrator**, **User Admin**, or **Viewer** (see [Roles](#roles)). -5. Click **Create User**. - -Pre-provisioned accounts don't require a password. For details on managing users, see [Users](users.md). - -### Roles - - - - -Access Analyzer has three roles. The installer assigns the first admin account the Administrator role, so it can pre-provision the rest of your users. - -| Role | Description | -| --- | --- | -| **Administrator** | Full access: system configuration (sources, scans, connectors, application settings) and user management (create, edit, activate, deactivate, and delete users; assign roles; pre-provision federated users). | -| **User Admin** | User and role management rights only: create, edit, activate, deactivate, and delete users; assign roles; pre-provision federated users. Does **not** have system configuration rights. | -| **Viewer** | Read-only access to data and reports. No configuration or user management rights. | - - - -## How sign-in works after IdP configuration - -When identity provider integration is active, the Access Analyzer login page presents a credential form that validates against your directory. - -On first sign-in, Access Analyzer matches the email address from the IdP token or LDAP directory to the pre-provisioned account and permanently links the IdP identity to that account. On all subsequent sign-ins, Access Analyzer uses the user's unique IdP identifier directly. - -Sessions are valid for up to 8 hours from sign-in and expire after 4 hours of inactivity. - -## Constraints - -| Item | Detail | -| --- | --- | -| **Pre-provisioning required** | Users must have an account in Access Analyzer before their first sign-in. | -| **Email must match exactly** | The email you enter during pre-provisioning must match what the IdP or LDAP directory sends, including case. | -| **Roles managed in Access Analyzer** | You set roles and permissions in Access Analyzer, not in your IdP or directory. | -| **Local accounts coexist** | The administrator account created at deployment remains a local account and continues to sign in with a password. | -| **Password reset unavailable for federated accounts** | The **Reset Password** action in the Users page is available for local accounts only. Federated users manage their credentials through your IdP. | -| **Name and email locked after first sign-in** | Once a user has signed in at least once, their name and email come from the IdP token; you can't change them in the Access Analyzer UI. Update them in your IdP instead. | diff --git a/docs/accessanalyzer/2601/configurations/logs.md b/docs/accessanalyzer/2601/configurations/logs.md deleted file mode 100644 index f093db1b9b..0000000000 --- a/docs/accessanalyzer/2601/configurations/logs.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: "System Logs" -description: "Viewing, filtering, and downloading system logs in Access Analyzer" -sidebar_position: 90 ---- - -# System Logs - -The System Logs page displays application-wide log entries that Access Analyzer services generate. Use it to monitor activity, investigate scan failures, and collect diagnostic information for support. - -Navigate to **Configuration** > **System Logs** to open the page. - -## Log entry fields - -Each log entry contains the following fields. - -| Field | Description | -| --- | --- | -| **Timestamp** | The date and time the log entry was generated. | -| **Level** | The severity of the entry: **Error**, **Warn**, **Info**, or **Debug**. | -| **Component** | The internal service that generated the entry (for example, `core-api`, `connector-api`, or `scanner`). Displays **—** if not available. | -| **Source** | The data source associated with the entry, if any. Displays **—** for entries not tied to a specific source. | -| **Message** | The log message text. Hover over a truncated message to see the full text. | - -## Filter logs - -The toolbar above the log table provides five independent filters. All active filters combine — the table shows only entries matching all conditions. The page URL preserves filter state, so you can bookmark or share a filtered view. - -**Search** - -Type in the search field to filter by message text. Results update after a short pause while you type. - -**Level** - -Select a severity level to show only entries at that level. The default shows all levels. - -| Level | Description | -| --- | --- | -| **Error** | Failures that require attention. | -| **Warn** | Conditions that may indicate a problem. | -| **Info** | General operational events. | -| **Debug** | Detailed diagnostic output. | - -**Component** - -Select one or more components to show entries from those services only. The component list includes services that have generated logs. - -**Source** - -Select a data source to show only log entries associated with it. The source list includes sources that have activity in the past seven days. - -**Date range** - -Use the **From** and **To** fields to restrict entries to a specific time window. Both fields are optional — set only one to filter from or until a given time. - -## Sort and paginate - -Access Analyzer sorts the log table by timestamp, newest first by default. Click the **Timestamp** column header to reverse the sort order. - -Use the rows-per-page control to display 10, 25, 50, or 100 entries per page. - -## Download logs - -To export log entries for offline review or to provide to support: - -1. Apply any filters you want to include in the export. -2. Click the **Download** button in the toolbar. -3. Select **JSON** or **CSV** from the dropdown. - -Access Analyzer names the export file `system-logs-{timestamp}`; the file reflects all active filters. Access Analyzer limits exports to 10,000 entries. - -CSV exports include the following columns: Timestamp, Level, Message, Trace ID, Span ID, and Attributes. - -## Common troubleshooting scenarios - -### Investigate a scan failure - -When a scan doesn't complete as expected: - -1. Set the **Source** filter to the data source the scan was running against. -2. Set the **Level** filter to **Error**. -3. Set the **Date range** to the window when the scan ran. -4. Review the **Message** column for error details. - -If no error-level entries appear, clear the **Level** filter and check for **Warn** entries that may indicate a configuration or connectivity issue. - -### Review logs for a specific time window - -1. Enter the start time in the **From** field. -2. Enter the end time in the **To** field. -3. Leave other filters clear to see all activity in that window. - -Use this approach to identify what was happening in the system around the time of an observed issue. - -### Isolate logs from a specific service - -1. Open the **Component** dropdown. -2. Select the service you want to focus on. - -You can select multiple components at the same time to compare activity across services. - -### Collect logs for a support case - -1. Set the **Date range** to cover the period when the issue occurred. -2. If the issue is tied to a specific data source, set the **Source** filter. -3. Click **Download** and select **JSON** to preserve full attribute metadata. - -Provide the downloaded file along with your support request. diff --git a/docs/accessanalyzer/2601/configurations/sensitive-data.md b/docs/accessanalyzer/2601/configurations/sensitive-data.md deleted file mode 100644 index c3ac3d023f..0000000000 --- a/docs/accessanalyzer/2601/configurations/sensitive-data.md +++ /dev/null @@ -1,154 +0,0 @@ ---- -title: "Sensitive Data" -description: "Configure sensitive data scanning settings in Access Analyzer" -sidebar_position: 30 ---- - -# Sensitive Data - -The Sensitive Data configuration page defines which types of sensitive content Access Analyzer identifies during scans, whether to run optical character recognition (OCR) on images, and how Access Analyzer applies Microsoft Information Protection (MIP) sensitivity labels to matching files. These settings apply globally and serve as the default for all sensitive data scans. - -Navigate to **Configuration** > **Sensitive Data** to view and update the configuration. - -The page has two sections: - -- **Microsoft Information Protection (MIP) Configuration** — connects an Entra ID tenant so Access Analyzer can retrieve your organization's MIP sensitivity labels. -- **Sensitive Data Types** — controls which data types are active for scanning and optionally maps each type to a MIP label. - -## MIP configuration - -The MIP configuration section connects Access Analyzer to a Microsoft Entra ID tenant. After you connect a tenant, Access Analyzer retrieves the sensitivity labels defined in your organization's MIP policy and makes them available for mapping in the Sensitive Data Types table. - -### Select a tenant - -1. In the **Tenant ID** dropdown, select the Entra ID source that represents the tenant whose MIP labels you want to use. -2. Click **Save Configuration**. - -The dropdown lists Entra ID source groups that have completed at least one **Users, Groups, and Roles** scan. If the dropdown is empty, either no Entra ID source group exists or the scan has not run yet. Run the scan first, then return to this page to select the tenant. - -After you select a tenant, Access Analyzer retrieves the associated MIP labels. The status bar below the dropdown shows: - -| Indicator | Meaning | -| --- | --- | -| Labels loaded count | The number of MIP labels retrieved from the selected tenant. | -| Invalid mappings count | The number of data types whose previously saved label no longer exists in MIP. | -| Last synced time | How long ago the labels were last synchronized from Entra ID. | - -MIP labels sync automatically from Entra ID at regular intervals. If a label is removed from MIP after you save a mapping, the **MIP Label** column shows the old label name with a warning indicator, and the **Status** column shows **Label Missing**. Update or clear those mappings before saving. - -:::note -The label selector and status badges in the Sensitive Data Types table are disabled until you select a tenant and labels finish loading. -::: - -## Sensitive data types - -The Sensitive Data Types table lists all data types that Access Analyzer can detect. Enable a data type to include it in sensitive data scans. If MIP labels are available, you can also map each data type to a specific label so Access Analyzer applies that label to files that match the data type. - -### Data types - -| Data Type | Description | Includes | -| --- | --- | --- | -| **CCPA** | California Consumer Privacy Act | Social Security numbers, driver's licenses, payment card data, email addresses, IP addresses, personal identifiers for California and Canadian residents | -| **CMMC** | Cybersecurity Maturity Model Certification | Controlled Unclassified Information (CUI) markings, DoD distribution statements (B–F), export control warning labels | -| **Credentials** | Passwords, API keys, and authentication secrets | Private keys (RSA, DSA, EC), passwords, AWS, Azure, and Google Cloud connection strings, PGP key blocks, Kerberos tickets, Slack tokens, SSH authorized keys | -| **Financial Records** | Banking and financial account data | ABA routing numbers, IBAN, SWIFT codes, US bank account numbers | -| **GDPR** | General Data Protection Regulation | National IDs, passports, driver's licenses, and personal identifiers for EU and EEA member states (30 countries including Austria, France, Germany, Italy, Spain, and others) | -| **GDPR Restricted** | Special categories of personal data under GDPR | Health data, political opinions, racial or ethnic origin, religious beliefs, sexual orientation, trade union membership | -| **GLBA** | Gramm-Leach-Bliley Act | Payment card numbers, cardholder names, expiration dates, security codes (Visa, Mastercard, AMEX, Discover, and others), ABA routing numbers, Social Security numbers | -| **HIPAA** | Health Insurance Portability and Accountability Act | ICD-10 diagnosis codes, prescription drug names, medical record numbers, national drug codes, Medicare numbers, Social Security numbers, patient identifiers | -| **PCI DSS** | Payment Card Industry Data Security Standard | Payment card numbers, cardholder names, expiration dates, security codes (Visa, Mastercard, AMEX, Diners Club, Discover, JCB, UnionPay) | -| **PHI** | Protected Health Information | ICD-10 codes, prescription drug names, medical record numbers, country-specific healthcare IDs for 20+ countries including UK NHS numbers, Australian Medicare numbers, and EU health insurance identifiers | -| **PII** | Personally Identifiable Information | Social Security numbers, passports, driver's licenses, full names, dates of birth, home addresses, and national identity documents for 60+ countries | - -### Table columns - -| Column | Description | -| --- | --- | -| Checkbox | Enables or disables the data type for scanning. Select the header checkbox to enable or disable all types at once. | -| **Data Type** | The name of the sensitive data type. | -| **Description** | A short description of what the data type covers. | -| **MIP Label** | The MIP sensitivity label to apply when the data type is detected. Select a label from the dropdown, or select **— No Label —** to detect the data type without applying a label. Available only when a tenant is connected and labels are loaded. | -| **Status** | Reflects the current mapping state for the row. | - -### Status values - -| Status | Color | Meaning | -| --- | --- | --- | -| **No MIP Label** | Gray | No tenant is connected, or labels haven't loaded. No label can be assigned. | -| **Unmapped** | Yellow | A tenant is connected and labels are loaded, but no label is assigned to this data type. | -| **Mapped** | Green | A label is assigned and present in the connected tenant. | -| **Label Missing** | Red | A label was previously assigned but no longer exists in MIP. Update or clear the mapping. | - -### Enable data types - -1. In the Sensitive Data Types table, select the checkbox next to each data type you want to activate. - - To activate all data types at once, select the checkbox in the table header. - - To deactivate all data types at once, clear the header checkbox when all types are selected. -2. Click **Save Configuration**. - -### Assign MIP labels - -You can assign a MIP label to each enabled data type. When Access Analyzer finds a file that matches a data type, it applies the mapped label to that file according to the label handling behavior settings. - -1. Connect a tenant in the MIP Configuration section and wait for labels to load. -2. In the **MIP Label** column for a data type, select a label from the dropdown. - - Labels are grouped into **Default Labels** (Personal, Public, General, Confidential) and **Custom Labels** (labels specific to your organization). - - Select **— No Label —** to detect the data type without applying a label. -3. Repeat for each data type you want to map. -4. Click **Save Configuration**. - -:::note -Enabling a data type and assigning a label are independent. Even without an assigned label, Access Analyzer still detects the data type during scans — it identifies matching files but doesn't apply a MIP label to them. -::: - -## OCR - -The **Run OCR to improve classification of images** option enables optical character recognition during scans. When enabled, Access Analyzer extracts text from images, screenshots, and scanned documents and applies the same classification rules to that text. - -Enabling OCR increases scan processing time. - -1. Select or clear the **Run OCR to improve classification of images** checkbox. -2. Click **Save Configuration**. - -## Label handling behavior - -The **Label Settings** drawer controls whether Access Analyzer writes MIP sensitivity labels back to files during sensitive data scans, and how it handles files that already carry a label. To open it, click **Label Settings** in the upper-right corner of the Sensitive Data Types card. - -These settings apply globally, and you can override them per scan in the scan configuration. - -:::note -Label write-back applies to **File Server and SharePoint Online sensitive data scans only**. Entra ID and Active Directory scans don't support label application. -::: - -:::note -Label write-back only occurs when you meet **both** conditions: you map a MIP label to the detected data type in the Sensitive Data Types table, **and** you enable the relevant option in [Options](#options). All options are off by default, so Access Analyzer detects and classifies files but doesn't write any labels to them. -::: - -### Options - -**Clear label if no longer sensitive** -When enabled, Access Analyzer removes the MIP label from a file if a subsequent scan finds the file no longer matches any enabled sensitive data type. Off by default. - -**Allow overwriting existing labels** -When enabled, Access Analyzer applies the mapped label to files that already have a MIP label assigned. When disabled, Access Analyzer skips files that already carry any MIP label — only unlabeled files receive a label. Off by default. - -- **Allow downgrading labels** *(requires Allow overwriting existing labels to be on)* - When enabled, Access Analyzer can replace a higher-priority label with a lower-priority one (for example, replacing "Confidential" with "General"). When disabled, Access Analyzer applies only upgrades or equal-priority replacements. This option is unavailable when **Allow overwriting existing labels** is off. Off by default. - -To configure label handling: - -1. Click **Label Settings**. -2. Select or clear the options as needed. -3. Click **Done** to close the drawer. -4. Click **Save Configuration** to apply all pending changes. - -## Save and cancel - -The **Save Configuration** and **Cancel** buttons are inactive until you make a change. - -- **Save Configuration** — saves all pending changes, including data type selections, MIP label mappings, the OCR setting, and label handling behavior. -- **Cancel** — discards all pending changes and restores the form to the last saved state. - -:::note -If you navigate away from the page with unsaved changes, Access Analyzer displays a confirmation dialog before leaving. -::: diff --git a/docs/accessanalyzer/2601/configurations/service-accounts/client-id-certificate.md b/docs/accessanalyzer/2601/configurations/service-accounts/client-id-certificate.md deleted file mode 100644 index 123216bd34..0000000000 --- a/docs/accessanalyzer/2601/configurations/service-accounts/client-id-certificate.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: "Client ID/Certificate" -description: "Client ID and certificate credentials for SharePoint Online source groups" -sidebar_position: 4 ---- - -# Client ID/Certificate - -The Client ID/Certificate credential type authenticates with SharePoint Online using certificate-based authentication. Use this credential type when configuring SharePoint Online source groups. - -This requires a registered application in your Entra ID tenant. The source group wizard generates the certificate itself — you don't create or upload it here. - -## Create a Client ID/Certificate service account - -1. Navigate to **Configuration** > **Service Accounts**. -2. Click **Add Service Account**. -3. In the **Name** field, enter a descriptive name for this service account. -4. From the **Service account type** dropdown, select **Client ID/Certificate**. - - ![Add service account form showing Client ID/Certificate fields: name, client application ID, and tenant ID](/images/accessanalyzer/2601/configurations/add-service-account-certificate.png) - -5. In the **Client Application ID** field, enter the Application (client) ID from your Entra ID app registration. -6. In the **Tenant ID** field, enter the Directory (tenant) ID of your Entra ID tenant. -7. Click **Add account**. - -## Fields - -| Field | Description | -| --- | --- | -| **Name** | A display name that identifies this service account in Access Analyzer. | -| **Client Application ID** | The Application (client) ID of your registered Entra ID application. Find this in the Azure portal under **Azure Active Directory** > **App registrations** > your app > **Overview**. | -| **Tenant ID** | The Directory (tenant) ID of your Entra ID tenant. Find this in the Azure portal under **Azure Active Directory** > **Overview**. | - -## Certificate - -You don't enter the certificate in the service account form. When you set up a SharePoint Online source group, the wizard includes a **Generate and Download Certificate** step that creates the certificate and downloads it to your machine. You then upload the certificate to your registered Entra ID application in the Azure portal before testing the connection. - -If you update the service account on an existing source group, you must upload the new account's certificate to the registered app before saving. - -For steps to register the application and upload the certificate, see [SharePoint Online Connector Requirements](../../connectors/sharepoint-online/overview.md). diff --git a/docs/accessanalyzer/2601/configurations/service-accounts/client-id-secret.md b/docs/accessanalyzer/2601/configurations/service-accounts/client-id-secret.md deleted file mode 100644 index 254fd2415c..0000000000 --- a/docs/accessanalyzer/2601/configurations/service-accounts/client-id-secret.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: "Client ID/Secret" -description: "Client ID and secret credentials for Entra ID source groups" -sidebar_position: 3 ---- - -# Client ID/Secret - -The Client ID/Secret credential type authenticates with Microsoft Entra ID via the Microsoft Graph API. Use this credential type when configuring Entra ID source groups. - -This requires a registered application in your Entra ID tenant with the appropriate API permissions. - -## Create a Client ID/Secret service account - -1. Navigate to **Configuration** > **Service Accounts**. -2. Click **Add Service Account**. -3. In the **Name** field, enter a descriptive name for this service account. -4. From the **Service account type** dropdown, select **Client ID/Secret**. - - ![Add service account form showing Client ID/Secret fields: name, client application ID, and client secret](/images/accessanalyzer/2601/configurations/add-service-account-client-secret.png) - -5. In the **Client Application ID** field, enter the Application (client) ID from your Entra ID app registration. -6. In the **Client Secret** field, enter a client secret value generated for the registered application. -7. Click **Add account**. - -## Fields - -| Field | Description | -| --- | --- | -| **Name** | A display name that identifies this service account in Access Analyzer. | -| **Client Application ID** | The Application (client) ID of your registered Entra ID application. Find this in the Azure portal under **Azure Active Directory** > **App registrations** > your app > **Overview**. | -| **Client Secret** | A client secret generated for the registered application. Create one in the Azure portal under your app's **Certificates & secrets**. | - -For steps to register the application and grant the required API permissions, see [Entra ID Requirements](../../connectors/entra-id/overview.md). diff --git a/docs/accessanalyzer/2601/configurations/service-accounts/overview.md b/docs/accessanalyzer/2601/configurations/service-accounts/overview.md deleted file mode 100644 index d8d8a0d429..0000000000 --- a/docs/accessanalyzer/2601/configurations/service-accounts/overview.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: "Overview" -description: "How service accounts work in Access Analyzer and which credential type each data source requires" -sidebar_position: 1 ---- - -# Overview - -Service accounts store the credentials Access Analyzer uses to authenticate against data sources during scans. Each data source connector requires a specific credential type, and the source group wizard automatically selects the correct type when you set up a new source group. - -Navigate to **Configuration** > **Service Accounts** to manage service accounts. - -![Service Accounts list showing existing accounts by name, type, source group, and creation date](/images/accessanalyzer/2601/configurations/service-accounts-list.png) - -## Credential types by data source - -| Data Source | Credential Type | -| --- | --- | -| Active Directory | [Username and Password](./username-password.md) | -| File Server | [Username and Password](./username-password.md) | -| Entra ID | [Client ID/Secret](./client-id-secret.md) | -| SharePoint Online | [Client ID/Certificate](./client-id-certificate.md) | -| SSH-based sources | [SSH Username/Key](./ssh-username-key.md) | - -## Creating a service account - -You can create a service account in two ways: - -- **In advance from Configuration** — Navigate to **Configuration** > **Service Accounts** and click **Add Service Account**. Select the credential type and enter the required fields. -- **Inline during source group setup** — Click **+** next to the **Service Account** field in the source group wizard. The wizard locks the credential type to match the connector being configured. - -## Editing service accounts - -Access Analyzer never pre-populates credential fields — passwords and client secrets — when you edit an existing service account. You must re-enter them each time you save changes. - -Updating the service account on an existing source group replaces the credentials used for all future scans in that source group. Ensure the replacement account has the required permissions before saving. diff --git a/docs/accessanalyzer/2601/configurations/service-accounts/ssh-username-key.md b/docs/accessanalyzer/2601/configurations/service-accounts/ssh-username-key.md deleted file mode 100644 index 07bd38a7cd..0000000000 --- a/docs/accessanalyzer/2601/configurations/service-accounts/ssh-username-key.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -title: "SSH Username/Key" -description: "SSH username and private key credentials for source groups that require SSH-based authentication" -sidebar_position: 5 ---- - -# SSH Username/Key - -The SSH Username/Key credential type authenticates using an SSH username and private key. Use this credential type for source groups that connect to hosts over SSH. - -## Create an SSH Username/Key service account - -1. Navigate to **Configuration** > **Service Accounts**. -2. Click **Add Service Account**. -3. In the **Name** field, enter a descriptive name for this service account. -4. From the **Service account type** dropdown, select **SSH Username/Key**. - - ![Add service account form showing SSH Username/Key fields: name, SSH username, and SSH key](/images/accessanalyzer/2601/configurations/add-service-account-ssh.png) - -5. In the **SSH Username** field, enter the username for the SSH account. -6. In the **SSH Key** field, paste the SSH private key. -7. Click **Add account**. - -## Fields - -| Field | Description | -| --- | --- | -| **Name** | A display name that identifies this service account in Access Analyzer. | -| **SSH Username** | The username of the SSH account on the target host. | -| **SSH Key** | The SSH private key used to authenticate. Paste the full private key including the header and footer lines. | diff --git a/docs/accessanalyzer/2601/configurations/service-accounts/username-password.md b/docs/accessanalyzer/2601/configurations/service-accounts/username-password.md deleted file mode 100644 index 75b349dc07..0000000000 --- a/docs/accessanalyzer/2601/configurations/service-accounts/username-password.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: "Username and Password" -description: "Username and password service accounts for Active Directory and file server source groups" -sidebar_position: 2 ---- - -# Username and Password - -Active Directory and file server source groups use the Username and Password credential type. Both require a domain account whose credentials Access Analyzer uses to connect and authenticate during scans. - -## Create a Username/Password service account - -1. Navigate to **Configuration** > **Service Accounts**. -2. Click **Add Service Account**. -3. In the **Name** field, enter a descriptive name for this service account. -4. From the **Service account type** dropdown, select **Username/Password**. - - ![Add service account form showing Username/Password fields: name, username, and password](/images/accessanalyzer/2601/configurations/add-service-account-username-password.png) - -5. In the **Username** field, enter the domain account in `DOMAIN\username` or `username@domain` format. -6. In the **Password** field, enter the account password. -7. Click **Add account**. - -## Fields - -| Field | Description | -| --- | --- | -| **Name** | A display name that identifies this service account in Access Analyzer. | -| **Username** | The domain user account in `DOMAIN\username` or `username@domain` format. | -| **Password** | The password for the domain account. | - -## Active Directory - -Active Directory source groups use the service account to connect to domain controllers over LDAP or LDAPS and read directory objects. The account must have Read access to the Active Directory directory tree. - -For full permission requirements, see [Active Directory Connector Requirements](../../connectors/activedirectory.md). - -## File Server - -File server source groups use the service account to connect to Windows file servers over SMB and enumerate shares, permissions, and file contents. The account must be a member of the same domain as the target file servers. The specific permissions required depend on the scan types you enable — access scanning and sensitive data scanning have different requirements. - -For full permission requirements, see [CIFS / SMB File Share](../../connectors/file-servers/cifs.md). diff --git a/docs/accessanalyzer/2601/configurations/source-groups/_category_.json b/docs/accessanalyzer/2601/configurations/source-groups/_category_.json deleted file mode 100644 index e3bbafe95d..0000000000 --- a/docs/accessanalyzer/2601/configurations/source-groups/_category_.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "label": "Source Groups", - "position": 20, - "collapsed": true, - "collapsible": true -} diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scan-executions.md b/docs/accessanalyzer/2601/configurations/source-groups/scan-executions.md deleted file mode 100644 index cb16302bb1..0000000000 --- a/docs/accessanalyzer/2601/configurations/source-groups/scan-executions.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Scan Executions" -description: "Understanding scan execution status and history in Access Analyzer" -sidebar_position: 3 ---- - -# Scan Executions - -A scan execution is a single run of a scan at a specific point in time. Each time Access Analyzer runs a scan — whether triggered by a schedule or manually — it creates a new scan execution record. Access Analyzer retains execution history per source so you can review past run outcomes. - -Scan executions are distinct from scan configurations. The [scan configuration](scans.md) defines what to collect and when. The scan execution records what happened during a specific run. - -## Execution status values - -| Status | Meaning | -| --- | --- | -| **Pending** | The execution is queued and waiting to start. This occurs when the Max Concurrent Scans limit is reached and additional executions are waiting their turn. | -| **Running** | The scanner is actively collecting data from the source. | -| **Pausing** | A pause was requested. The execution is finishing its current operation before pausing. | -| **Paused** | The execution has paused mid-run and can be resumed. | -| **Resuming** | A resume was requested. The execution is restarting from where it paused. | -| **Stopping** | A stop was requested. The execution is finishing its current operation before terminating. | -| **Post-processing** | Data collection is complete. Results are being processed and written to the database. | -| **Completed** | The execution finished successfully. | -| **Stopped** | The execution was manually stopped before completing. Partial results may have been collected. | -| **Cancelled** | The execution was cancelled before it started or early in the run. No results were collected. | -| **Failed** | The execution encountered an error and didn't complete. Check the execution log for details. | - -## Source group scan status - -The source groups list displays an aggregate scan status for each group. Access Analyzer computes this from the most recent scan execution across all sources in the group, using the following priority order: - -1. **Paused** — One or more sources has a paused execution, and none are running. -2. **Running** — One or more sources has an execution in a pending, running, pausing, resuming, stopping, or post-processing state. -3. **Failed** — One or more sources has a failed execution, and none are running or paused. -4. **Completed** — All sources have completed their most recent execution successfully. -5. **Completed with errors** — One or more sources has a stopped or cancelled execution, and none meet the preceding criteria. -6. **Not run yet** — No scan executions exist for any source in the group. - -This means a group shows **Running** even if only one source is actively scanning, and it shows **Failed** only when no scans are still in progress. - -## Blocked operations during active executions - -Access Analyzer blocks several operations while a source has an execution in an active state (pending, running, pausing, paused, resuming, stopping, or post-processing): - -- **Deleting a source group** — Stop all active scans before deleting the group. -- **Removing a source from a group** — Stop the source's active scan before removing it. - -Wait for the execution to reach a terminal state (completed, stopped, cancelled, or failed), or use the **Stop** action to terminate it, before proceeding with the blocked operation. diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scanners/_category_.json b/docs/accessanalyzer/2601/configurations/source-groups/scanners/_category_.json deleted file mode 100644 index 1f2304bcca..0000000000 --- a/docs/accessanalyzer/2601/configurations/source-groups/scanners/_category_.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "label": "Scanners", - "position": 40, - "collapsed": true, - "collapsible": true -} diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scanners/best-practices.md b/docs/accessanalyzer/2601/configurations/source-groups/scanners/best-practices.md deleted file mode 100644 index 8aab2b0e06..0000000000 --- a/docs/accessanalyzer/2601/configurations/source-groups/scanners/best-practices.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: "Scanner Best Practices" -description: "Best practices for configuring and running scanners in Access Analyzer" -sidebar_position: 50 ---- - -# Scanner Best Practices - -## Use scanner labels to isolate scan traffic - -Scanner labels route scan executions to specific scanner pools. Use them to keep scan traffic between environments isolated and prevent resource contention. - -Common labeling patterns: - -| Use case | Example label | -|----------|---------------| -| Separate production and non-production scanning | `environment=production`, `environment=staging` | -| Route by geographic region | `region=us-east`, `region=eu-west` | -| Dedicate scanners to high-sensitivity source groups | `tier=restricted` | - -Define a labeling scheme before deploying scanners and apply it consistently. All scan executions in a source group use the labels assigned to that group — you don't need to set them per source. - -### Label matching behavior - -When a source group has multiple labels configured, Access Analyzer routes a scan to any scanner that matches **at least one** of those label pairs — not all of them. Design your label scheme with this in mind: a scanner carrying `region=us-east` will receive jobs from a source group labeled `region=us-east, tier=restricted` even if the scanner doesn't carry the `tier=restricted` label. - -For strict isolation, use a single label per source group or ensure scanners are labeled precisely to match only the intended groups. - -### Label key and value constraints - -Label keys and values entered in the Deploy Scanner wizard must follow these rules: - -| Field | Allowed characters | Max length | -|-------|-------------------|------------| -| Key | Letters, digits, hyphens | 53 characters | -| Value | Letters, digits, hyphens, underscores, dots | 63 characters | - -Both key and value must start with a letter or digit. Access Analyzer stores labels with a `dspm.netwrix.com/scanner-` prefix internally — you don't need to include this prefix when entering labels in the wizard. - -:::note -Access Analyzer reserves the label `scanner-default` for the built-in system scanner; you can't apply it to custom scanners. -::: - -## Plan for scanner redundancy - -Assign the same label to multiple scanners that cover the same environment. Scanners sharing a label form a pool, and Access Analyzer routes each scan job to any available scanner in the pool. If one scanner is offline, unhealthy, or busy, the job routes to another scanner carrying the same label automatically. - -A single scanner per label is a single point of failure. For production environments, deploy at least two scanners per label. This also distributes scan load across the pool when multiple source groups target the same label simultaneously. - -## Set Workers conservatively - -The **Workers** setting controls the number of concurrent enumeration threads a scan uses when reading from a target. The default is `3` and the valid range is `1–20`. - -Start at the default and increase only after validating that the target environment can handle parallel connections. - -Before increasing Workers: - -- Confirm the domain controller, file server, or other target can sustain simultaneous authenticated connections without degraded performance. -- Verify the network path between the scanner and the target has sufficient bandwidth for parallel data transfer. -- Consider the number of source groups that may run at the same time — multiple groups can run simultaneously across the same scanner, multiplying the actual connection count on the target. - -A safe approach is to increase by 2–3 at a time and monitor scan completion times and target resource utilization before increasing further. - -## Monitor scanner health - -Check the Scanners page regularly to review scanner health status. A scanner in Warning state is under resource pressure — disk, memory, or CPU — and scan performance may degrade. A scanner in Error state has reported health issues and needs investigation before running additional scans. - -Common causes of Warning and Error states: - -- Disk space consumed by k3s container images or log files — clean up unused images if disk pressure is persistent -- Memory pressure from running multiple large scans in parallel — reduce Workers or stagger scan schedules -- Network connectivity issues between the scanner host and the Access Analyzer server on port 6443 - -See [Manage Scanners](./manage-scanners.md) for a full reference of health status values. - -## Group sources by environment and sensitivity - -Group sources that share the same operational profile — same environment (production vs. staging), same geographic location, and similar sensitivity level. Avoid mixing high-sensitivity and low-priority sources in a single group. - -This lets you assign dedicated scanner pools and service accounts to each group based on security requirements, and keeps aggregate scan status meaningful. - -## Use least-privilege service accounts - -Each source group requires a service account for authentication against the targets it scans. Assign an account that has only the permissions required for the connectors in that group. - -- Don't share a single service account across source groups that scan different environments. -- Don't reuse a service account between source groups with different sensitivity levels. -- Review service account permissions when adding new sources to an existing group — the account must have access to each new source. - -## Follow a consistent naming convention - -Source group names appear in the list view, in scan execution logs, and in reporting. A consistent naming convention makes groups easier to identify and manage. - -A useful pattern: `--`. For example: - -- `ad-production-us-east` -- `fileserver-staging-eu-west` -- `fileserver-production-eu-central` - -Names are case-insensitive and must be unique across all source groups. Avoid names that embed credentials, IP addresses, or other values that change over time. diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scanners/deploy-scanner.md b/docs/accessanalyzer/2601/configurations/source-groups/scanners/deploy-scanner.md deleted file mode 100644 index 3838a52a4c..0000000000 --- a/docs/accessanalyzer/2601/configurations/source-groups/scanners/deploy-scanner.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: "Deploy a Scanner" -description: "Register a custom scanner node in Access Analyzer" -sidebar_position: 30 ---- - -# Deploy a Scanner - -Deploying a scanner registers a remote Linux host as a custom scanner node in Access Analyzer. After deployment, the scanner appears in the Scanners table and becomes available for selection in source group configuration. - -## Before you begin - -- Confirm the scanner host meets all [requirements](./requirements.md). -- Create an **SSH Username / SSH Key** service account in Access Analyzer with access to the scanner host. You can also create it inline during the wizard — see step 7. -- Have the scanner host's public SSH host key ready. You can retrieve it by running the following command from any machine that can reach the host, replacing `` with the scanner's hostname or IP address: - - ```bash - ssh-keyscan - ``` - - Copy the line that begins with the host's address followed by the key type (for example, `ecdsa-sha2-nistp256`) and the key value. - -## Deploy the scanner - -1. Navigate to **Configuration** > **Scanners**. -2. Click **Deploy Scanner**. The Deploy Scanner drawer opens. -3. In the **Name** field, enter a display name for the scanner (for example, `Production Scanner`). This name identifies the scanner in the Scanners table and in source group configuration. -4. In the **SSH Host** field, enter the hostname or IP address of the scanner host (for example, `node01.company.com` or `192.168.1.50`). -5. In the **SSH Host Key** field, paste the public SSH host key you retrieved during preparation. Access Analyzer uses this key to verify the host identity during registration. -6. In the **SSH Port** field, enter the SSH port if your scanner host uses a non-standard port. Defaults to `22` if left blank. -7. In the **Service Account** dropdown, select the SSH Username / SSH Key account that has access to the scanner host. - - - To create a new service account without leaving the wizard, click **+** next to the dropdown. The wizard pre-sets the account type to SSH Username / SSH Key. After saving, it automatically selects the new account and preserves all other fields. - - To edit the selected account, click the pencil icon. The SSH key field is blank in edit mode — you must re-enter the private key before saving. - -8. Under **Labels**, add at least one label. You must add at least one label before you can deploy the scanner — the **Deploy** button remains disabled until you apply a label. - - - Enter a key and a value, then click **Add**. The label appears as a chip. - - To add additional labels, repeat the process. - - To remove a label, click the **×** on its chip. - - Access Analyzer automatically normalizes label keys and values to lowercase and converts spaces to hyphens. - - :::tip - Previously used labels appear as chips you can click to pre-fill the key and value fields. This helps you apply consistent labels across multiple scanners. - ::: - -9. Optionally, click **Test connection** to verify that Access Analyzer can reach the scanner host over SSH before deploying. A green indicator confirms connectivity; a red indicator with a message identifies the problem. - -10. Click **Deploy**. Access Analyzer connects to the scanner host over SSH and runs the registration script. - -## What happens during registration - -Registration runs automatically and typically completes within five minutes. During registration, Access Analyzer: - -1. Runs a preflight check on the scanner host to verify it meets all requirements (curl, bash, passwordless sudo, disk space, memory, and CPU). -2. Downloads and installs k3s (a lightweight Kubernetes distribution) on the scanner host. -3. Joins the scanner host to the Access Analyzer Kubernetes cluster as a worker node. -4. Applies the labels you specified. - -If registration takes longer than five minutes, check network connectivity and confirm the scanner host can reach `https://get.k3s.io`. Slow networks or resource-constrained hosts may require additional time. - -## After deployment - -The scanner appears immediately in the Scanners table. Its health status shows **Healthy** when the node has fully joined the cluster. - -To use the scanner, assign it to a source group by selecting **Custom scanner** under **Scanner Location** when setting up or editing a source group, and matching its label. See [Set Up File Server Source Group](../../../gettingstarted/file-servers/set-up-source-group.md) or the equivalent guide for your connector. - -## Edit a scanner - -To update a scanner's labels or service account after deployment: - -1. Navigate to **Configuration** > **Scanners**. -2. Click the edit icon on the scanner row. The Deploy Scanner drawer opens with the scanner's current configuration pre-filled. -3. Update the labels or service account as needed. -4. Click **Save Changes**. - -Changes appear immediately in the Scanners table and in the scanner selection dropdown in source group configuration. diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scanners/manage-scanners.md b/docs/accessanalyzer/2601/configurations/source-groups/scanners/manage-scanners.md deleted file mode 100644 index f0461512dd..0000000000 --- a/docs/accessanalyzer/2601/configurations/source-groups/scanners/manage-scanners.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: "Manage Scanners" -description: "View scanner health, edit scanner configuration, and delete scanners in Access Analyzer" -sidebar_position: 40 ---- - -# Manage Scanners - -The Scanners page lists all registered scanner nodes and their current status. Navigate to **Configuration** > **Scanners** to access it. - -## Scanners table - -Each row in the table represents one registered scanner. - -| Column | Description | -|--------|-------------| -| Name / IP | Hostname or IP address of the scanner host | -| Labels | Labels assigned to the scanner, displayed as chips. If a scanner has more than two labels, the first two are shown with an overflow count (for example, **+3**). Hover over the count to see all labels. | -| Source Groups | Number of source groups that target this scanner | -| Sources | Total number of sources assigned to this scanner | -| Scanning | Number of sources being scanned at this time | -| Health Status | Current health of the scanner node | -| Scan Status | Whether the scanner is idle or actively running a scan | -| Version | Scanner software version. If an update is available, an **Update** action appears. | - -## Health status - -| Status | Color | Meaning | -|--------|-------|---------| -| Healthy | Green | The scanner node is reachable and operating normally | -| Warning | Yellow | The node is reachable but under resource pressure (disk, memory, or CPU) | -| Error | Red | The node is reachable but in an unhealthy state | -| Offline | Gray | The node isn't reachable from the Access Analyzer server | - -Scans may perform poorly on a scanner in Warning state — consider resolving the resource pressure before scheduling large scans. Investigate the scanner host when the status is Error. An Offline scanner can't run scans — source groups that target it will not execute until the scanner comes back online or a different scanner with the matching label becomes available. - -## Scan status - -| Status | Color | Meaning | -|--------|-------|---------| -| Idle | Gray | No scans are running on this scanner | -| In Progress | Blue | One or more scans are running | - -## Search scanners - -Use the search field at the top of the page to filter the scanner list. The search matches against scanner names, IP addresses, and label values. Results update as you type. - -## Connect a scanner to source groups - -If a scanner has no associated source groups, a **+ Connect source** action appears on its row. Click it to assign source groups that will use this scanner. - -To route scans from a source group to a specific scanner or scanner pool, set the scanner location when configuring the source group. Match the source group's scanner selection to the label on the scanner you want to use. - -## Delete a scanner - -:::warning -Deleting a scanner removes it from the cluster. Source groups that target the deleted scanner's labels will not be able to run scans unless another scanner with the same labels is available. -::: - -To delete a scanner: - -1. Navigate to **Configuration** > **Scanners**. -2. Click the delete icon on the scanner row. -3. Confirm the deletion. - -You can only delete a scanner when no scan jobs are running on it. If scans are in progress, wait for them to complete before deleting. You can't delete the system scanner (built-in scanner on the Access Analyzer server). diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scanners/overview.md b/docs/accessanalyzer/2601/configurations/source-groups/scanners/overview.md deleted file mode 100644 index a3ff3a1650..0000000000 --- a/docs/accessanalyzer/2601/configurations/source-groups/scanners/overview.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: "Scanners Overview" -description: "Overview of scanner types, architecture, and how to use them in Access Analyzer" -sidebar_position: 10 ---- - -# Scanners Overview - -Scanners are the execution nodes that run scan workloads in Access Analyzer. Every scan runs on a scanner — either the built-in system scanner or a custom scanner you deploy on a remote host. - -## Scanner types - -Access Analyzer provides two scanner types: - -**System scanner** — The built-in scanner that runs on the Access Analyzer server itself. It's available immediately with no configuration and is the default for all source groups. Use it when the Access Analyzer server can reach your target resources directly over the network. - -**Custom scanners** — Scanners you deploy on separate Linux hosts closer to your data sources. Use custom scanners when: - -- Target file servers or Active Directory domain controllers are in network segments the Access Analyzer server can't reach directly -- You want to reduce scan traffic over wide area network (WAN) links between sites -- You need to distribute scan load across multiple machines for large environments - -## Supported connectors - -Scanners are available for the following connectors: - -- Active Directory -- File Server (all supported file server types) - -Entra ID and SharePoint Online connectors connect directly from the Access Analyzer service and don't use scanners. - -## Architecture - -Scanners run as Kubernetes Jobs — short-lived containers that start on demand to perform a scan and terminate when the scan completes. There is no persistent agent process running on the scanner host between scans. - -Custom scanner hosts join the Access Analyzer Kubernetes cluster as worker nodes during deployment. Access Analyzer schedules scan jobs to those nodes using standard Kubernetes job dispatch. The scanner host needs outbound connectivity to the Access Analyzer server on port 6443 (Kubernetes API) to receive and run jobs. - -This is a different architecture from the Proxy and Applet modes in legacy Netwrix Access Analyzer (NAA) v12: - -| | Legacy NAA (v12) | Access Analyzer | -|---|---|---| -| Distributed scanning | Proxy server / applet deployment | Kubernetes-deployed scanner containers | -| Deployment model | Manual, persistent agent | On-demand Kubernetes Jobs | -| Supported targets | All file system types | Active Directory, all supported file server types | - -## Scanner labels - -Labels are key-value pairs you assign to custom scanners. Source groups use labels to target specific scanners or scanner pools — scans from that source group run only on scanners that carry matching labels. - -Labels let you: - -- Isolate scan traffic by environment (`environment=production`, `environment=staging`) -- Route scans to geographically local scanners (`region=us-east`, `region=eu-west`) -- Dedicate scanners to high-sensitivity source groups (`tier=restricted`) - -Every custom scanner requires at least one label. Multiple scanners can share the same label — when a source group targets a label that multiple scanners carry, any of those scanners can run the job. - -The system scanner doesn't use labels. Selecting **System scanner** in a source group always uses the built-in scanner on the Access Analyzer server. - -## Related pages - -- [Requirements](./requirements.md) — System requirements for deploying a custom scanner -- [Deploy a Scanner](./deploy-scanner.md) — Register a new custom scanner -- [Manage Scanners](./manage-scanners.md) — View health, edit, and delete scanners -- [Best Practices](./best-practices.md) — Labeling schemes, concurrency, and naming conventions diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scanners/requirements.md b/docs/accessanalyzer/2601/configurations/source-groups/scanners/requirements.md deleted file mode 100644 index dbb0260d36..0000000000 --- a/docs/accessanalyzer/2601/configurations/source-groups/scanners/requirements.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: "Scanner Requirements" -description: "System requirements and prerequisites for deploying a custom scanner in Access Analyzer" -sidebar_position: 20 ---- - -# Scanner Requirements - -These requirements apply to any Linux host you want to register as a custom scanner. The system scanner built into Access Analyzer has no additional requirements. - -## Operating system - -Access Analyzer supports any Linux distribution as a scanner host. Netwrix recommends Ubuntu 20.04 LTS or later. - -Access Analyzer registers the scanner by connecting over SSH and running an automated installation script. The script installs [k3s](https://k3s.io/) — a lightweight Kubernetes distribution — and joins the host to the Access Analyzer cluster as a worker node. - -## Hardware - -| Resource | Minimum | -|----------|---------| -| CPU | 2 cores | -| Available RAM | 512 MB | -| Free disk space | 5 GB (on `/`) | - -## Software and access - -The registration script runs automatically over SSH. Before registering a scanner, confirm the following on the target host: - -- `curl` is installed -- `bash` is installed -- The SSH service account used during registration has passwordless `sudo` access - -### Preflight checks - -When you click **Deploy** in the Deploy Scanner wizard, Access Analyzer runs the following preflight checks on the target host before installing k3s. All checks must pass for registration to proceed. - -| Check | Requirement | -|-------|-------------| -| `curl` available | `curl` must be installed and on the system PATH | -| `bash` available | `bash` must be installed and on the system PATH | -| Passwordless sudo | The SSH service account must be able to run `sudo` without a password prompt | -| Internet access | The host must be able to reach `https://get.k3s.io` to download the k3s installer | -| Disk space | At least 5 GB free on `/` | -| Memory | At least 512 MB available RAM | -| CPU | At least 2 CPU cores | - -## Network requirements - -### Ports - -| Port | Protocol | Direction | Purpose | -|------|----------|-----------|---------| -| 22 | TCP | Access Analyzer → Scanner | SSH connection during registration only | -| 6443 | TCP | Scanner → Access Analyzer | Kubernetes API — ongoing job dispatch | - -Access Analyzer only requires port 22 during the initial registration. After registration completes, the scanner host connects outbound to the Access Analyzer server on port 6443 to receive and run scan jobs. You can restrict or close port 22 after registration completes. - -:::note -The SSH port defaults to **22** but is configurable in the Deploy Scanner wizard. If your scanner host runs SSH on a non-standard port, enter it in the **SSH Port** field during deployment. -::: - -### Internet access - -The registration script downloads the k3s installer from `https://get.k3s.io`. The scanner host must be able to reach this URL **during registration only**. After registration completes, normal scan operation doesn't require internet access. - -## Service account - -Scanner deployment requires an **SSH Username / SSH Key** service account in Access Analyzer. This account must: - -- Have SSH access to the scanner host -- Use an **unencrypted** private key in PEM format - -:::warning -Access Analyzer doesn't support passphrase-protected private keys. The registration script will fail if the key requires a passphrase. Use a key generated without a passphrase, or strip the passphrase before creating the service account. -::: - -See [SSH Username / SSH Key](../../service-accounts/ssh-username-key.md) to create this account. You can also create it inline from the Deploy Scanner wizard using the **+** button next to the Service Account field without navigating away. diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scans.md b/docs/accessanalyzer/2601/configurations/source-groups/scans.md deleted file mode 100644 index 834c3abccc..0000000000 --- a/docs/accessanalyzer/2601/configurations/source-groups/scans.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: "Scans" -description: "Scan types, configuration, scheduling, and scan location in Access Analyzer source groups" -sidebar_position: 2 ---- - -# Scans - -A scan defines what Access Analyzer collects from a source and how often it runs. Each source in a group can have one or more scans, one per scan type. Scans are persistent configurations — each run of a scan produces a [scan execution](scan-executions.md). - -## Scan types - -The scan types available depend on the source type: - -| Source Type | Available Scan Types | -| --- | --- | -| **File Server** | Access Scan, Sensitive Data Scan | -| **SharePoint Online** | Access Scan, Sensitive Data Scan | -| **Active Directory** | Active Directory Inventory | -| **Entra ID** | Users, Groups, and Roles | - -### Access Scan - -Enumerates permissions, folder-level ACLs, sharing links, and access rights across File Server and SharePoint Online sources. Identifies who has access to what across your data sources. - -Access scans include a **concurrent** option that scans multiple file paths or objects within a single source in parallel. Enable this when scanning large file servers or SharePoint sites to reduce total scan time. - -### Sensitive Data Scan - -Classifies file and document content against the detection patterns configured under **Configuration** > **Sensitive Data**. Identifies files containing PII, PHI, credentials, financial records, and other sensitive data across File Server and SharePoint Online sources. - -Sensitive Data Scans include a **concurrent** option that classifies multiple files simultaneously within a single source. Enable this on sources with large file counts to improve throughput. - -### Active Directory Inventory - -Synchronizes users, groups, group memberships, and security-relevant attributes from Active Directory domains. Access Analyzer uses the inventory to resolve identity information across all other scan types and to populate the Active Directory dashboard. - -### Users, Groups, and Roles - -Synchronizes users, groups, and role assignments from your Microsoft Entra ID (Azure AD) tenant. This scan type also collects Microsoft Information Protection (MIP) sensitivity labels applied across the tenant. - -## Scan configuration - -When you create a source group, the setup wizard collects scan parameters on page 3 and creates scan configurations that apply to all sources added to the group. Each scan configuration includes: - -- **Scan type** — the type of scan to run (see [Scan types](#scan-types)) -- **Concurrent** — whether to parallelize scanning within a single source (Access Scan and Sensitive Data Scan only) -- **Scan location** — which scanner handles the scan (see [Scan location](#scan-location)) -- **Schedule** — when and how often the scan runs automatically (see [Schedule](#schedule)) -- **Scan parameters** — source-type-specific settings such as scope, depth, and included paths. These vary by connector. - -Individual sources can override the group-level scan configuration if their requirements differ from the group default. - -## Scan location - -The **Scan location** setting determines which scanner component executes the scan. You configure it per scan type during source group creation. - -| Location | Description | Applicable Source Types | -| --- | --- | --- | -| **System scanner** | The Access Analyzer service connects directly to the source. This is the default and requires no additional configuration. | Entra ID, SharePoint Online | -| **Scanner label** | Routes the scan to a registered edge scanner pool that matches the specified label. The edge scanner connects to the source on behalf of Access Analyzer. | Active Directory, File Server | - -For Active Directory and File Server source groups, selecting a scanner label routes all scans in that group to the matching edge scanner pool. If no edge scanners carry that label, the scan can't run. See [Scanners](scanners/overview.md) for setup and label management. - -:::note -Entra ID and SharePoint Online source groups always use the system scanner. The scan location setting isn't configurable for those source types. -::: - -## Schedule - -The schedule determines when a scan runs automatically. You configure the schedule on page 3 of the source group creation wizard. The same scheduling options are available for all source types and scan types. - -### Scheduling options - -| Option | Description | -| --- | --- | -| **Run scan now** | Starts the scan immediately when you save the source group. No recurring schedule applies. | -| **Run scan at** | Schedules a single one-time run at a specific date and time. The scan doesn't repeat after that run. | -| **Advanced** | Sets a recurring schedule using a cron expression. Use this for daily, weekly, or custom interval schedules. | - -### Cron schedule format - -Advanced scheduling uses standard 5-field cron syntax: - -``` -┌───── minute (0–59) -│ ┌───── hour (0–23) -│ │ ┌───── day of month (1–31) -│ │ │ ┌───── month (1–12) -│ │ │ │ ┌───── day of week (0–6, Sunday = 0) -│ │ │ │ │ -* * * * * -``` - -**Examples:** - -| Expression | Schedule | -| --- | --- | -| `0 2 * * *` | Daily at 2:00 AM | -| `0 2 * * 0` | Weekly on Sunday at 2:00 AM | -| `0 2 1 * *` | Monthly on the 1st at 2:00 AM | -| `0 */6 * * *` | Every 6 hours | - -Access Analyzer evaluates schedule times in the server's local timezone. - -:::note -If you don't configure a schedule, the scan doesn't run automatically. Run it manually from the source groups list using the **Run** action. -::: diff --git a/docs/accessanalyzer/2601/configurations/source-groups/source-groups.md b/docs/accessanalyzer/2601/configurations/source-groups/source-groups.md deleted file mode 100644 index 3a208b6b43..0000000000 --- a/docs/accessanalyzer/2601/configurations/source-groups/source-groups.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: "Source Groups" -description: "Managing source groups in Access Analyzer — create, configure, and operate groups of data sources" -sidebar_position: 1 ---- - -# Source Groups - -A source group is a named container that organizes data sources of the same type for coordinated scanning. All sources in a group share a service account, and you can run or stop scans across all sources in the group with a single action. - -Navigate to **Configuration** > **Source Groups** to view, create, and manage source groups. - -## Source groups list - -The source groups list displays all configured source groups. Each row shows: - -| Column | Description | -| --- | --- | -| **Name** | The source group name. | -| **Source Type** | The type of data source in the group (Active Directory, File Server, Entra ID, or SharePoint Online). | -| **Service Account** | The service account used to authenticate scans in this group. | -| **Status** | Whether the group is **Active** or **Inactive**. Inactive groups are excluded from scheduled scan runs. | -| **Scan Types** | The scan types configured for this group. Varies by source type — see [Scan types](scans.md#scan-types). | -| **Scanner Labels** | Key-value labels used to route scans to specific scanner pools. Displayed only for Active Directory and File Server groups. | -| **Last Scan** | The timestamp of the most recent completed scan execution across all sources in the group. | - -Use the search field to filter by name. You can sort by any column and filter by source type, status, service account, or scan status. - -## Create a source group - -1. Click **Add Source Group**. -2. Enter a **Name** and optional **Description**. Names must be unique (case-insensitive) and between 1 and 255 characters. -3. Select the **Source Type**. This value is permanent — you can't change it after you create the group. -4. Select or create a **Service Account**. The wizard filters available accounts to those compatible with the selected source type. To create a new account inline, click **+** next to the field. -5. For Active Directory and File Server groups, optionally add **Scanner Labels** to route scans to a specific scanner pool. See [Scanners](scanners/overview.md). -6. Add sources and configure scan parameters. You can also add sources later from the group detail view. -7. Click **Save**. - -:::warning -You can't change the source type after you create a source group. If you need a different source type, create a new source group and delete the original. -::: - -## Edit a source group - -1. In the source groups list, click the actions menu for a group and select **Edit**. -2. Modify any of the following fields: - - Name and description - - Service account - - Scanner labels - - Status (Active or Inactive) -3. Click **Save**. - -You can't change the source type. If you update the service account, the new credentials apply to all future scans in the group — verify the replacement account has the required permissions before saving. - -## Add sources to a group - -1. In the source groups list, click the actions menu for a group and select **View Sources**. -2. Click **Add Source**. -3. Complete the source configuration form. Required fields vary by source type. -4. Click **Save**. - -Sources you add inherit the group's service account and scan configuration unless you override them at the source level. - -## Remove sources from a group - -1. In the source groups list, click the actions menu for a group and select **View Sources**. -2. In the sources drawer, click the actions menu for a source and select **Remove**. - -You can't remove a source that has a scan in a pending, running, pausing, paused, resuming, stopping, or post-processing state. Wait for the scan to complete or stop it first. - -## Run scans - -To start scans across all sources in a group, click the **Run** button in the actions menu for the group. Access Analyzer queues scan executions for every configured scan in the group. - -To run scans for a single source, open the source from the **View Sources** drawer and use the source-level run action. - -## Stop scans - -To stop all running and pending scans in a group, click **Stop** in the actions menu. Access Analyzer sends a stop signal to every active scan execution in the group. Scans in a stopping or post-processing state continue until they reach a terminal state. - -## Delete a source group - -1. In the source groups list, click the actions menu for a group and select **Delete**. -2. Confirm the deletion. - -:::warning -Deleting a source group permanently deletes all sources it contains. You can't undo this action. -::: - -You can't delete a source group while any of its scans are in a pending, running, pausing, paused, resuming, stopping, or post-processing state. Stop all active scans before deleting. - -## Constraints - -| Setting | Constraint | -| --- | --- | -| **Name** | 1–255 characters; must be unique (case-insensitive) across all source groups | -| **Description** | Maximum 10,000 characters | -| **Source type** | Set at creation; can't be changed afterward | -| **Delete** | Blocked while any source has an active scan execution | -| **Remove source** | Blocked while that source has an active scan execution | diff --git a/docs/accessanalyzer/2601/configurations/users.md b/docs/accessanalyzer/2601/configurations/users.md deleted file mode 100644 index 7ceb78f36a..0000000000 --- a/docs/accessanalyzer/2601/configurations/users.md +++ /dev/null @@ -1,176 +0,0 @@ ---- -title: "Users" -description: "Managing users in the Configuration node" -sidebar_position: 70 ---- - -# Users - -The Users page lets you create and manage the accounts that have access to Netwrix Access Analyzer. Navigate to **Configuration** > **Users** to view and manage all users. - -:::note -This page is available to users with the **User Admin** or **Administrator** role. Users with the Viewer role can't access this page. -::: - -## Users list - -The users list displays all accounts in the system. Each row shows: - -| Column | Description | -| --- | --- | -| **Username** | The display name for the account. | -| **Email** | The email address used to sign in. | -| **Role** | The account's role: **Administrator**, **User Admin**, or **Viewer**. | -| **Status** | Whether the account is **Active** or **Inactive**. | -| **Last Login** | The date of the most recent successful sign-in, or **Never** if the user hasn't signed in yet. | - -Use the search field to filter by name or email. You can sort by any column. - -## Roles - -Access Analyzer has three roles: - -| Role | Description | -| --- | --- | -| **Administrator** | Full access: system configuration (sources, scans, connectors, application settings) and user management (create, edit, activate, deactivate, and delete users; assign roles; pre-provision federated users). | -| **User Admin** | User and role management rights only: create, edit, activate, deactivate, and delete users; assign roles; pre-provision federated users. Does **not** have system configuration rights. | -| **Viewer** | Read-only access to data and reports. No configuration or user management rights. | - -A user can only hold one role at a time. - -## Bootstrap admin account - -Access Analyzer seeds a built-in account, `admin@dspm.local`, during installation. Access Analyzer assigns this account the **User Admin** role for first-time user provisioning only. - -To retrieve the bootstrap admin password: - -```bash -sudo kubectl get secret -n access-analyzer dspm-bootstrap-admin \ - -o jsonpath='{.data.password}' | base64 -d; echo -``` - -On first login, Access Analyzer prompts you to enroll an authenticator app for MFA and set a display name. Don't change the email address. - -:::note -Keep the bootstrap account active as an emergency recovery account, but don't use it for routine user management. Create at least one named User Admin account during initial setup and use that account for ongoing administration. -::: - -For the full first-login walkthrough, see [Quick Install — Step 6](/docs/accessanalyzer/2601/install/quickinstall#step-6-sign-in). - -## Recommended initial setup - -After installation, complete the following steps in order before handing the product to your team. - -| Step | Action | Notes | -| --- | --- | --- | -| **1** | Sign in as `admin@dspm.local` | Uses the bootstrap User Admin account. Retrieve the password using the kubectl command in [Bootstrap admin account](#bootstrap-admin-account). | -| **2** | Create at least one named **User Admin** | Provides a dedicated account for user management with no system configuration access. Use this account for ongoing user administration so that routine user changes don't require Administrator accounts. | -| **3** | Create at least one **Administrator** | Grants full access — system configuration and user management. This is typically the person responsible for setting up and maintaining the product. | -| **4** | Create **Viewer** accounts as needed | Optional. Add Viewer accounts for stakeholders who need read-only access to dashboards and reports. | -| **5** | Sign out of the bootstrap account | Do day-to-day work from named accounts. | - -## Add a user - -The form for adding a user differs depending on whether your deployment uses an external Identity Provider (IdP) for authentication. - -### Add a user (local authentication) - -Use this procedure when Access Analyzer manages passwords directly. - -1. Click **Add User**. -2. Enter a **Name**. Names must be between 2 and 100 characters. -3. Enter an **Email** address. Email addresses must be unique across all users (case-insensitive). -4. Select a **Role**: **Administrator**, **User Admin**, or **Viewer**. The default is **Viewer**, an intentionally conservative choice. Only assign Administrator or User Admin after confirming the user's responsibilities. -5. Enter a **Password** and confirm it. -6. Click **Create User**. - -Password requirements for local accounts: - -- Minimum 18 characters -- At least one uppercase letter (A–Z) -- At least one lowercase letter (a–z) -- At least one number (0–9) -- At least one special character (`!@#$%^&*(),.?":{}|<>`) -- Can't contain the user's email address -- Can't be a commonly used password - -### Add a user (Identity Provider) - -When you configure your deployment to use an external Identity Provider, you can pre-provision an account before the user's first sign-in. Access Analyzer creates the account record and links it to the user's IdP identity when they sign in for the first time. - -1. Click **Add User**. -2. Enter a **Name**. Names must be between 2 and 100 characters. -3. Enter an **Email** address. The email must match the address the user has in your IdP exactly, including case. -4. Select a **Role**: **Administrator**, **User Admin**, or **Viewer**. The default is **Viewer**, an intentionally conservative choice. Only assign Administrator or User Admin after confirming the user's responsibilities. -5. Click **Create User**. - -No password is required. The account is ready for the user to sign in through your IdP. - -:::note -If a user authenticates through your IdP without a pre-provisioned account in Access Analyzer, Access Analyzer blocks their sign-in and they see an access error. Pre-provision the account first, then the user can sign in successfully. -::: - -## Edit a user - -1. In the users list, click the actions menu for a user and select **Edit**. -2. Modify the fields as needed. -3. Click **Update User**. - -What you can change depends on the account type: - -| Account type | Editable fields | -| --- | --- | -| Local (password-based) | Name, Email, Role | -| Identity Provider — pre-provisioned (hasn't signed in yet) | Name, Email, Role | -| Identity Provider — provisioned (has signed in at least once) | Role only | - -Access Analyzer locks name and email for provisioned IdP accounts because those values come from the IdP token. To change them, update the user's profile in your IdP. - -## Activate a user - -1. In the users list, click the actions menu for an inactive user and select **Activate**. - -The account becomes active immediately. The user can sign in and use the application according to their assigned role. - -## Deactivate a user - -1. In the users list, click the actions menu for an active user and select **Deactivate**. - -Deactivating a user revokes all of their active sessions immediately. Access Analyzer preserves the account record; you can reactivate it later. - -:::note -You can't deactivate your own account or the last active User Admin account. -::: - -## Reset a user's password - -:::note -The **Reset Password** action is available for local accounts only. It doesn't appear for accounts that authenticate through an Identity Provider. -::: - -1. In the users list, click the actions menu for a user and select **Reset Password**. - -Access Analyzer generates a password reset token for the user. The user must set a new password before they can sign in again. Reset tokens expire after 2 hours. - -## Delete a user - -1. In the users list, click the actions menu for a user and select **Delete**. -2. Confirm the deletion. - -:::warning -Deleting a user is permanent; you can't undo it. -::: - -You can't delete your own account or the last active User Admin account. - -## Constraints - -| Setting | Constraint | -| --- | --- | -| **Name** | 2–100 characters | -| **Email** | Must be unique across all users (case-insensitive); must be a valid email address | -| **Role** | Administrator, User Admin, or Viewer; defaults to Viewer | -| **Password** | Minimum 18 characters; must include uppercase, lowercase, number, and special character; can't match the user's email; can't be a commonly used password | -| **Deactivate** | Blocked for your own account and the last active User Admin | -| **Delete** | Blocked for your own account and the last active User Admin | -| **Reset Password** | Local accounts only; tokens expire after 2 hours | diff --git a/docs/accessanalyzer/2601/connectors/_category_.json b/docs/accessanalyzer/2601/connectors/_category_.json deleted file mode 100644 index 67fabb3b53..0000000000 --- a/docs/accessanalyzer/2601/connectors/_category_.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "label": "Connector Requirements", - "position": 14, - "collapsed": true, - "collapsible": true -} diff --git a/docs/accessanalyzer/2601/connectors/activedirectory.md b/docs/accessanalyzer/2601/connectors/activedirectory.md deleted file mode 100644 index 481abb347c..0000000000 --- a/docs/accessanalyzer/2601/connectors/activedirectory.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: "Active Directory" -description: "Requirements for the Active Directory connector" -sidebar_position: 30 ---- - -# Active Directory - -The Active Directory connector reads domain controllers remotely over LDAP to collect identity data from your Active Directory domains. The connector doesn't require agent installation on domain controllers. - -The connector collects: - -- Users (including disabled and stale accounts) -- Groups and group memberships (including nested groups and circular membership chains) -- Domains - -## Supported versions - -- Windows Server 2016 and later -- Windows Server 2003 forest functional level or higher - -## Requirements - -### Service account - -The connector authenticates using a service account with a username and password. The account must be a member of the domain you're scanning and have: - -- Read access to the directory tree -- List Contents and Read Property on the Deleted Objects container - -:::note -For information on granting access to the Deleted Objects container, see the Microsoft [Searching for Deleted Objects](https://technet.microsoft.com/en-us/library/cc978013.aspx) article and [Dsacls](https://technet.microsoft.com/en-us/library/cc771151(v=ws.11).aspx) reference. -::: - -### Ports - -Open the following ports on all domain controllers you want to scan: - -| Port | Protocol | Description | -|------|----------|-------------| -| 389 | TCP | LDAP | -| 636 | TCP | LDAPS (when SSL is enabled) | -| 135–139 | TCP | RPC | -| 49152–65535 | TCP | RPC dynamic ports | - -## Next steps - -After you meet the requirements, see [Set Up Active Directory Source Group](../gettingstarted/active-directory/set-up-source-group.md) to configure your first scan. diff --git a/docs/accessanalyzer/2601/connectors/entra-id/app-registration-secret.md b/docs/accessanalyzer/2601/connectors/entra-id/app-registration-secret.md deleted file mode 100644 index 998720b323..0000000000 --- a/docs/accessanalyzer/2601/connectors/entra-id/app-registration-secret.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: "Client Secret Configuration" -description: "Configure a client secret for the Microsoft Entra ID app registration" -sidebar_position: 30 ---- - -# Client Secret Configuration - -Access Analyzer authenticates to Microsoft Entra ID using a client secret. You generate the client secret within your registered Microsoft Entra ID application and provide it to Access Analyzer when configuring the Entra ID connector. - -## Generate a client secret - -1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/). - -2. Navigate to **Identity** > **Applications** > **App registrations**. - -3. Click the **All applications** tab and select your registered application. - -4. Click **Certificates & secrets** under the Manage section. - -5. On the **Client secrets** tab, click **New client secret**. - -6. Specify the following: - - - **Description** — Enter a description for the secret - - **Expires** — Select an expiration period - -7. Click **Add**. Access Analyzer displays the client secret value in the **Value** column. - -:::warning -Copy the client secret value immediately. After you navigate away from this page, you can't retrieve the value and you'll need to create a new secret. -::: - -## Assign roles to the app - -You must assign the registered application to the **Global Administrator** role for Entra ID data collection. - -1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/). - -2. Navigate to **Identity** > **Applications** > **App registrations**. - -3. Click the **All applications** tab and select your registered application. - -4. Click **Roles and administrators** under the Manage section. - -5. On the All roles page, search for **Global Administrator**. - -6. Click the **Global Administrator** role. The Assignments page opens. - -7. Click **Add assignments** in the top toolbar. - -8. Search for and select your registered application. - -9. Click **Add**. Access Analyzer lists the application on the Assignments page. diff --git a/docs/accessanalyzer/2601/connectors/entra-id/entra-requirements.md b/docs/accessanalyzer/2601/connectors/entra-id/entra-requirements.md deleted file mode 100644 index aea5e67688..0000000000 --- a/docs/accessanalyzer/2601/connectors/entra-id/entra-requirements.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: "Entra tenant requirements" -description: "Configure Microsoft Entra ID requirements for connectivity" -sidebar_position: 20 ---- - -# Entra tenant requirements - -Access Analyzer connects to Microsoft Entra ID through a registered application using OAuth2 client credentials. You must register a dedicated Microsoft Entra ID application for Access Analyzer and grant it the required permissions before adding Entra ID as a data source. - -:::note -You need a user account with the **Global Administrator**, **Application Administrator**, or **Cloud Application Administrator** role to register an application and grant admin consent for permissions. -::: - -:::note -You must assign the registered application to the **Global Administrator** role for Entra ID data collection. -::: - -## Register an app in Microsoft Entra ID - -1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/). - -2. On the left navigation menu, navigate to **Identity** > **Applications** > **App registrations**. - -3. On the App registrations page, click **New registration** in the top toolbar. - -4. Specify the following on the Register an application page: - - - **Name** — Enter a display name for the application, for example, *Access Analyzer Entra ID* - - **Supported account types** — Select **Accounts in this organizational directory only** - - **Redirect URI (optional)** — Leave blank - -5. Click **Register**. - -The Overview page for the newly registered application opens. Copy the following values — you'll need them when configuring the Entra ID connector in Access Analyzer: - -- **Application (client) ID** -- **Directory (tenant) ID** - -## Grant permissions to the app - -1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/). - -2. Navigate to **Identity** > **Applications** > **App registrations**. - -3. Click the **All applications** tab and select the application you registered. - -4. Click **API permissions** under the Manage section. - -5. Click **Add a permission**. The Request API permissions pane opens. - -6. Click **Microsoft Graph**, then click the **Application permissions** tab. - -7. Select the required permissions (see [Required permissions](#required-permissions)). - -8. Click **Add Permissions**. - -9. Click **Grant admin consent for ``** to apply the permissions. - -### Required permissions - -| API | Permission | Description | -| --- | --- | --- | -| Microsoft Graph | `Directory.Read.All` | Read directory data — users, groups, and role assignments | -| Microsoft Graph | `Policy.Read.All` | Read your organization's policies | -| Microsoft Graph | `InformationProtectionPolicy.Read.All` | Read your organization's information protection policies — required for MIP label retrieval | diff --git a/docs/accessanalyzer/2601/connectors/entra-id/overview.md b/docs/accessanalyzer/2601/connectors/entra-id/overview.md deleted file mode 100644 index fd2a7c368a..0000000000 --- a/docs/accessanalyzer/2601/connectors/entra-id/overview.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: "Entra ID" -description: "Requirements for connecting Access Analyzer to Microsoft Entra ID" -sidebar_position: 1 ---- - -# Entra ID - -Access Analyzer connects to Microsoft Entra ID using OAuth2 client credentials through a pre-configured Microsoft Entra ID application. It accesses Entra ID through Microsoft Graph to synchronize users, groups, role assignments, and Microsoft Information Protection (MIP) sensitivity labels. - -Before adding Entra ID as a data source, you must register a dedicated Microsoft Entra ID application and grant it the required permissions. - -## Scan types - -| Scan type | Description | -| --- | --- | -| **Users, Groups, and Roles** | Synchronizes users, groups, and role assignments from the Entra ID tenant. The first scan runs in full; subsequent scans collect only changes since the last run. Also retrieves MIP sensitivity labels automatically when the scan runs. | - -## Before you begin - -You need the following before adding Entra ID as a data source: - -- A user account with the **Global Administrator**, **Application Administrator**, or **Cloud Application Administrator** role in Microsoft Entra ID, to register an application and grant admin consent for permissions -- A registered Microsoft Entra ID application with the required API permissions — see [Entra Tenant Requirements](entra-requirements.md) -- A client secret generated for the registered application — see [Client Secret Configuration](app-registration-secret.md) - -When configuring the Entra ID source in Access Analyzer, you need the following values from your registered application: - -- **Application (client) ID** -- **Directory (tenant) ID** -- **Client secret value** - -## Network requirements - -| Protocol | Port | Destination | -| --- | --- | --- | -| HTTPS | 443 | Microsoft identity platform (`login.microsoftonline.com`) | -| HTTPS | 443 | Microsoft Graph API (`graph.microsoft.com`) | diff --git a/docs/accessanalyzer/2601/connectors/file-servers/celerra.md b/docs/accessanalyzer/2601/connectors/file-servers/celerra.md deleted file mode 100644 index 73229e8d4c..0000000000 --- a/docs/accessanalyzer/2601/connectors/file-servers/celerra.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: "Dell EMC Celerra" -description: "Supported platforms, permissions, and network ports for Dell EMC Celerra CIFS/SMB scanning" -sidebar_position: 50 ---- - -# Dell EMC Celerra - -The Dell EMC Celerra connector reads file shares over SMB to collect share permissions, folder and file ACLs, and file contents for sensitive data classification. The connector doesn't require agent installation on the storage system. - -Dell EMC Celerra serves CIFS/SMB file shares through Data Movers. You must license and configure the CIFS service on each Data Mover you want to scan. - -## Supported versions - -- Celerra series (DART OS 6.x and later) - -## Requirements - -### Service account - -The connector authenticates using a service account with a username and password. The account must have: - -- Read access to the shares you want to scan -- Read permission on object security descriptors (to enumerate ACLs) - -The account can be a local user on the Data Mover or a domain account from an Active Directory domain joined to the Data Mover. - -### Ports - -| Port | Protocol | Description | -|------|----------|-------------| -| 445 | TCP | SMB file sharing | - -## Set up - -To add a Dell EMC Celerra Data Mover to Access Analyzer, see [Set Up File Server Source Group](../../gettingstarted/file-servers/set-up-source-group.md). Add each Data Mover as a separate server entry using its IP address or hostname. The connector connects to each Data Mover independently. diff --git a/docs/accessanalyzer/2601/connectors/file-servers/cifs.md b/docs/accessanalyzer/2601/connectors/file-servers/cifs.md deleted file mode 100644 index 8cd41acaf7..0000000000 --- a/docs/accessanalyzer/2601/connectors/file-servers/cifs.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: "CIFS / SMB File Share" -description: "Supported platforms, permissions, and network ports for CIFS/SMB scanning" -sidebar_position: 10 ---- - -# CIFS / SMB File Share - -The CIFS / SMB connector reads file servers over SMB to collect share permissions, folder and file ACLs, and file contents for sensitive data classification. The connector doesn't require agent installation on the target file server. - -## Supported versions - -- Windows Server 2012 R2 and later -- Any SMB-compatible server (Samba, network-attached storage (NAS) appliances) - -## Requirements - -### Service account - -The connector authenticates using a service account with a username and password. The account must have: - -- Read access to the shares you want to scan -- Read permission on object security descriptors (to enumerate ACLs) - -### Ports - -| Port | Protocol | Description | -|------|----------|-------------| -| 445 | TCP | SMB file sharing | - -## Set up - -To add a Windows file server or SMB-compatible server to Access Analyzer, see [Set Up File Server Source Group](../../gettingstarted/file-servers/set-up-source-group.md). - -## DFS namespaces - -For domain-based Distributed File System (DFS) namespaces, the scan targets the default domain controller for the domain. For standalone namespaces or multiple namespaces, add the server or servers hosting the namespace directly to the source group. - -## Sensitive Data Discovery - -The scanner infrastructure handles Sensitive Data Discovery (SDD). The target file server doesn't need additional software. diff --git a/docs/accessanalyzer/2601/connectors/file-servers/dell-unity.md b/docs/accessanalyzer/2601/connectors/file-servers/dell-unity.md deleted file mode 100644 index fe36433953..0000000000 --- a/docs/accessanalyzer/2601/connectors/file-servers/dell-unity.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: "Dell Unity" -description: "Supported platforms, permissions, and network ports for Dell Unity CIFS/SMB scanning" -sidebar_position: 40 ---- - -# Dell Unity - -The Dell Unity connector reads file shares over SMB to collect share permissions, folder and file ACLs, and file contents for sensitive data classification. The connector doesn't require agent installation on the storage system. - -Dell Unity serves CIFS/SMB shares through NAS servers. You must configure the CIFS protocol on each NAS server you want to scan. - -## Supported versions - -- Unity OE 4.x and later - -## Requirements - -### Service account - -The connector authenticates using a service account with a username and password. The account must have: - -- Read access to the shares you want to scan -- Read permission on object security descriptors (to enumerate ACLs) - -The account can be a local user on the NAS server or a domain account from an Active Directory domain joined to the NAS server. - -### Ports - -| Port | Protocol | Description | -|------|----------|-------------| -| 445 | TCP | SMB file sharing | - -## Set up - -To add a Dell Unity NAS server to Access Analyzer, see [Set Up File Server Source Group](../../gettingstarted/file-servers/set-up-source-group.md). Add each NAS server as a separate server entry using its IP address or hostname. The connector connects to each NAS server independently. diff --git a/docs/accessanalyzer/2601/connectors/file-servers/isilon-powerscale.md b/docs/accessanalyzer/2601/connectors/file-servers/isilon-powerscale.md deleted file mode 100644 index a1bca8dff4..0000000000 --- a/docs/accessanalyzer/2601/connectors/file-servers/isilon-powerscale.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: "Dell Isilon / PowerScale" -description: "Supported platforms, permissions, and network ports for Dell Isilon and PowerScale CIFS/SMB scanning" -sidebar_position: 30 ---- - -# Dell Isilon / PowerScale - -The Dell Isilon / PowerScale connector reads file shares over SMB to collect share permissions, folder and file ACLs, and file contents for sensitive data classification. The connector doesn't require agent installation on the storage system. - -Dell Isilon / PowerScale (based on the OneFS operating system) organizes SMB shares within access zones. You must enable the SMB service on each access zone you want to scan. - -## Supported versions - -- OneFS 8.0 and later - -## Requirements - -### Service account - -The connector authenticates using a service account with a username and password. The account must have: - -- Read access to the shares you want to scan -- Read permission on object security descriptors (to enumerate ACLs) - -The account can be a local user on the OneFS cluster or a domain account from an Active Directory domain joined to the access zone. - -### Ports - -| Port | Protocol | Description | -|------|----------|-------------| -| 445 | TCP | SMB file sharing | - -## Set up - -To add a Dell Isilon / PowerScale access zone to Access Analyzer, see [Set Up File Server Source Group](../../gettingstarted/file-servers/set-up-source-group.md). Add each access zone as a separate server entry using the access zone's IP address or hostname. The connector connects to each access zone independently. diff --git a/docs/accessanalyzer/2601/connectors/file-servers/netapp.md b/docs/accessanalyzer/2601/connectors/file-servers/netapp.md deleted file mode 100644 index 9fb5a87116..0000000000 --- a/docs/accessanalyzer/2601/connectors/file-servers/netapp.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: "NetApp ONTAP" -description: "Supported platforms, permissions, and network ports for NetApp ONTAP CIFS/SMB scanning" -sidebar_position: 20 ---- - -# NetApp ONTAP - -The NetApp ONTAP connector reads file shares over SMB to collect share permissions, folder and file ACLs, and file contents for sensitive data classification. The connector doesn't require agent installation on the storage system. - -NetApp ONTAP serves CIFS/SMB shares through Storage Virtual Machines (SVMs). Each SVM has its own CIFS server that the connector connects to independently. You must license and enable the CIFS service on each SVM you want to scan. - -## Supported versions - -- ONTAP 9.0 and later -- ONTAP 8.3 with CIFS license - -## Requirements - -### Service account - -The connector authenticates using a service account with a username and password. The account must have: - -- Read access to the shares you want to scan -- Read permission on object security descriptors (to enumerate ACLs) - -The account can be a local ONTAP user or a domain account from an Active Directory domain joined to the SVM. - -### Ports - -| Port | Protocol | Description | -|------|----------|-------------| -| 445 | TCP | SMB file sharing | - -## Set up - -To add a NetApp ONTAP SVM to Access Analyzer, see [Set Up File Server Source Group](../../gettingstarted/file-servers/set-up-source-group.md). Add each SVM as a separate server entry using the SVM's CIFS server hostname or IP address. The connector connects to each SVM independently. - -## Known behavior - -NetApp ONTAP may return invalid timestamp values on some systems due to a Year 2038 overflow issue in the ONTAP CIFS implementation. Access Analyzer detects this automatically and records affected timestamps as empty instead of causing a scan error. diff --git a/docs/accessanalyzer/2601/connectors/file-servers/vnx.md b/docs/accessanalyzer/2601/connectors/file-servers/vnx.md deleted file mode 100644 index d1d8de521a..0000000000 --- a/docs/accessanalyzer/2601/connectors/file-servers/vnx.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: "Dell EMC VNX" -description: "Supported platforms, permissions, and network ports for Dell EMC VNX file server CIFS/SMB scanning" -sidebar_position: 60 ---- - -# Dell EMC VNX - -The Dell EMC VNX connector reads file shares over SMB to collect share permissions, folder and file ACLs, and file contents for sensitive data classification. The connector doesn't require agent installation on the storage system. - -Dell EMC VNX serves CIFS/SMB file shares through Data Movers. You must license and configure the CIFS service on each Data Mover you want to scan. - -## Supported versions - -- VNX2 series (NAS code 8.x) -- VNX series (NAS code 7.x) - -VNX2 is the second-generation platform; VNX is the original series. Both use the same Data Mover architecture, and you configure them identically in Access Analyzer. - -## Requirements - -### Service account - -The connector authenticates using a service account with a username and password. The account must have: - -- Read access to the shares you want to scan -- Read permission on object security descriptors (to enumerate ACLs) - -The account can be a local user on the Data Mover or a domain account from an Active Directory domain joined to the Data Mover. - -### Ports - -| Port | Protocol | Description | -|------|----------|-------------| -| 445 | TCP | SMB file sharing | - -## Set up - -To add a Dell EMC VNX Data Mover to Access Analyzer, see [Set Up File Server Source Group](../../gettingstarted/file-servers/set-up-source-group.md). Add each Data Mover as a separate server entry using its IP address or hostname. The connector connects to each Data Mover independently. diff --git a/docs/accessanalyzer/2601/connectors/sharepoint-online/_category_.json b/docs/accessanalyzer/2601/connectors/sharepoint-online/_category_.json deleted file mode 100644 index aebbe26706..0000000000 --- a/docs/accessanalyzer/2601/connectors/sharepoint-online/_category_.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "label": "SharePoint Online", - "position": 50, - "collapsed": true, - "collapsible": true, - "link": { - "type": "doc", - "id": "connectors/sharepoint-online/overview" - } -} diff --git a/docs/accessanalyzer/2601/connectors/sharepoint-online/azure-permissions.md b/docs/accessanalyzer/2601/connectors/sharepoint-online/azure-permissions.md deleted file mode 100644 index 61cfb61677..0000000000 --- a/docs/accessanalyzer/2601/connectors/sharepoint-online/azure-permissions.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: "App Permissions in Entra" -description: "Configure Microsoft Entra ID app permissions for SharePoint Online connectivity" -sidebar_position: 10 ---- - -# App Permissions in Entra - -Access Analyzer connects to SharePoint Online through a Microsoft Entra ID registered application using certificate-based authentication. You must register a dedicated application for Access Analyzer and grant it the required API permissions before adding SharePoint Online as a data source. - -:::note -You need a user account with the Global Administrator, Application Administrator, or Cloud Application Administrator role to register an application and grant admin consent for permissions. -::: - -## Register an app in Microsoft Entra ID - -1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/). - -2. On the left navigation menu, navigate to **Identity** > **Applications** > **App registrations**. - -3. On the App registrations page, click **New registration** in the top toolbar. - -4. Specify the following on the Register an application page: - - - **Name** — Enter a display name for the application, for example, *Access Analyzer SharePoint Online* - - **Supported account types** — Select **Accounts in this organizational directory only** - - **Redirect URI (optional)** — Leave blank - -5. Click **Register**. - -The Overview page for the newly registered application opens. Note the following values — you'll need them when configuring the SharePoint Online connector in Access Analyzer: - -- **Application (client) ID** -- **Directory (tenant) ID** - -## Grant permissions to the app - -1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/). - -2. Navigate to **Identity** > **Applications** > **App registrations**. - -3. Click the **All applications** tab and select the application you registered. - -4. Click **API permissions** under the Manage section. - -5. Click **Add a permission**. The Request API permissions pane opens. - -6. Click an API to access its permissions, then click the **Application permissions** tab. - -7. Select the required permissions for each API. See [Required permissions](#required-permissions). - -8. Click **Add Permissions**. - -9. Repeat steps 6–8 for each API listed in the table. - -10. Click **Grant admin consent for ``** to apply the permissions. - -### Required permissions - -| API | Permission | Type | Description | -| --- | --- | --- | --- | -| Microsoft Graph | `Sites.Read.All` | Application | Read items in all site collections | -| Microsoft Graph | `Directory.Read.All` | Application | Read directory data | -| SharePoint | `Sites.FullControl.All` | Application | Full control of all site collections | diff --git a/docs/accessanalyzer/2601/connectors/sharepoint-online/overview.md b/docs/accessanalyzer/2601/connectors/sharepoint-online/overview.md deleted file mode 100644 index 2e8c60e2fa..0000000000 --- a/docs/accessanalyzer/2601/connectors/sharepoint-online/overview.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: "SharePoint Online" -description: "Requirements for connecting Access Analyzer to SharePoint Online" -sidebar_position: 1 ---- - -# SharePoint Online - -Access Analyzer connects to SharePoint Online using certificate-based authentication through a pre-configured Microsoft Entra ID application. It accesses SharePoint Online through Microsoft Graph and the SharePoint REST API to enumerate sites, libraries, permissions, and sharing links. - -Before adding SharePoint Online as a data source, you must register a dedicated Microsoft Entra ID application, grant it the required permissions, and upload a certificate generated by Access Analyzer. - -## Scan types - -Access Analyzer supports two scan types for SharePoint Online: - -| Scan type | Description | -| --- | --- | -| **Access scan** | Enumerates sites, document libraries, folders, and files. Collects permissions, ACLs, sharing links, and Microsoft Information Protection (MIP) sensitivity labels applied to SharePoint items. The first scan runs in full; subsequent scans collect only changes since the last run. | -| **Sensitive Data scan** | Reads file contents to classify sensitive data. Requires a completed Access scan — it uses the site and file inventory from the Access scan as its input. | - -## Before you begin - -You need the following before adding SharePoint Online as a data source: - -- A user account with the **Global Administrator**, **Application Administrator**, or **Cloud Application Administrator** role in Microsoft Entra ID, to register an application and grant admin consent for permissions -- A registered Microsoft Entra ID application with the required API permissions — see [App Permissions in Entra](azure-permissions.md) -- Access to the Microsoft Entra admin center to upload the certificate generated during source group setup — see [Certificate Configuration](tenant-certificate-config.md) - -When configuring the SharePoint Online source in Access Analyzer, you need the following values from your registered application: - -- **Application (client) ID** -- **Directory (tenant) ID** - -Access Analyzer generates the certificate during source group setup. You download it and upload it to your registered Microsoft Entra ID application before you can test the connection. diff --git a/docs/accessanalyzer/2601/connectors/sharepoint-online/tenant-certificate-config.md b/docs/accessanalyzer/2601/connectors/sharepoint-online/tenant-certificate-config.md deleted file mode 100644 index eea9bd85ae..0000000000 --- a/docs/accessanalyzer/2601/connectors/sharepoint-online/tenant-certificate-config.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: "Certificate Configuration" -description: "Upload a certificate to your Microsoft Entra ID app registration for SharePoint Online authentication" -sidebar_position: 20 ---- - -# Certificate Configuration - -Access Analyzer authenticates with SharePoint Online using certificate-based authentication. Access Analyzer generates the certificate during source group setup — you download the public certificate file and upload it to your registered Microsoft Entra ID application. - -## Upload a certificate - -1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/). - -2. Navigate to **Identity** > **Applications** > **App registrations**. - -3. Click the **All applications** tab and select your registered application. - -4. Click **Certificates & secrets** under the Manage section. - -5. Click the **Certificates** tab. - -6. Click **Upload certificate**. - -7. Click the file icon next to the **Select a File** field. - -8. Browse to and select the certificate file you downloaded from Access Analyzer (`.cer` or `.pem`), then click **Open**. - -9. Enter a description for the certificate. - -10. Click **Add** to upload the certificate to the registered application. - -After uploading, return to the Access Analyzer source group wizard and click **Test Connection** to verify the authentication. diff --git a/docs/accessanalyzer/2601/dashboards-reports/my-reports.md b/docs/accessanalyzer/2601/dashboards-reports/my-reports.md deleted file mode 100644 index d661678944..0000000000 --- a/docs/accessanalyzer/2601/dashboards-reports/my-reports.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: "My Reports" -description: "Save, manage, and reload filtered report views in Netwrix Access Analyzer" -sidebar_position: 30 ---- - -# My Reports - -My Reports is a personal workspace for saving filtered report views. When you configure a report with specific filters — a particular share, user, or time range — you can save that configuration as a named report and reload it later without reapplying the filters manually. - -Saved reports are private to the user who created them. Other users can't view or modify your saved reports. - -Navigate to **Reports** > **My Reports** to view your saved reports. - -## Save a report - -You can save any report that has the **Save Report** button in its toolbar. The button appears on File System and SharePoint report pages. - -1. Navigate to the report you want to save — for example, **Reports** > **File System** > **Access**. -2. Select a report type from the selector — for example, **Share Audit**. -3. Apply the filters you want to capture. -4. Click **Save Report** in the toolbar. -5. In the **Save Report** dialog, enter a name for the report. Names are required, must be unique (case-insensitive) within your saved reports, and can't exceed 100 characters. -6. Review the **Current Filters** section to confirm the active filters are correct. -7. Click **Save Report**. - -After you save the report, Access Analyzer redirects you to **My Reports**, where the new report appears in the list. - -:::note -If you don't apply filters before clicking **Save Report**, the dialog indicates that no filters are active. You can still save the report, but it will open with the default unfiltered view. -::: - -## Open a saved report - -1. Navigate to **Reports** > **My Reports**. -2. In the **My Saved Reports** table, click the row for the report you want to open. - -The report opens with its saved filter configuration applied. A banner at the top of the report displays the report name and a **Back to My Reports** button. - -To return to the **My Reports** list, click **Back to My Reports** in the banner. - -## Rename a saved report - -1. Navigate to **Reports** > **My Reports**. -2. In the **Actions** column for the report you want to rename, click the actions icon (**⋮**). -3. Select **Rename**. -4. Edit the name in the inline text field. The name can't exceed 100 characters. -5. Press **Enter** or click the check icon to save the new name. Press **Escape** or click the X icon to cancel. - -## Delete a saved report - -1. Navigate to **Reports** > **My Reports**. -2. In the **Actions** column for the report you want to delete, click the actions icon (**⋮**). -3. Select **Delete**. - -:::warning -Deleting a saved report is permanent. There's no confirmation step and no undo. -::: - -## My Saved Reports table - -The **My Saved Reports** table lists all reports you've saved. - -| Column | Description | -| --- | --- | -| **Name** | The name of the saved report. Click a row to open the report. | -| **Parent Report** | The report type this was saved from — for example, **Share Audit** or **Broken Inheritance**. Displays a dash if the source can't be identified. | -| **Created** | The date the report was saved. | -| **Actions** | Opens a menu with **Rename** and **Delete** options. | - -When you haven't saved any reports yet, the table displays: - -> *You haven't saved any reports yet. Go to Access, Content, or Activity reports, apply filters, and click "Save Report" to save them here.* - -The table paginates when it contains more than 10 reports. You can display 10 or 25 rows per page. - -## Report name constraints - -| Constraint | Detail | -| --- | --- | -| **Required** | A name is required to save a report. | -| **Maximum length** | 100 characters. | -| **Uniqueness** | Names must be unique within your saved reports (case-insensitive). | diff --git a/docs/accessanalyzer/2601/dashboards-reports/reports.md b/docs/accessanalyzer/2601/dashboards-reports/reports.md deleted file mode 100644 index fc48660abf..0000000000 --- a/docs/accessanalyzer/2601/dashboards-reports/reports.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: "Reports" -description: "All pre-built dashboards and reports available in Netwrix Access Analyzer" -sidebar_position: 10 ---- - -# Reports - -Netwrix Access Analyzer includes pre-built dashboards and reports that surface findings from your scans. Reports become available after the first scan of a source group completes and update each time a scan runs. - -Reports are organized by data source type and grouped by category in the navigation under **Dashboards** and **Reports**. - -## Dashboards - -| Dashboard | Description | -| --- | --- | -| **Data Security** | An overview of data security posture across all connected data sources. | -| **Active Directory** | An overview of Active Directory scan results for one or more domains. Shows inventory counts for users, groups, and group memberships alongside security risk data, including risk breakdowns by type and severity and a ranked list of the objects with the highest number of associated risks. Filter by domain to focus on a specific part of your environment. | - -## File Server reports - -For full details on these reports, see [File Server Reports](/docs/accessanalyzer/2601/gettingstarted/file-servers/reports). - -### Access - -| Report | Description | -| --- | --- | -| **Broken Inheritance** | Lists shares and folders where permission inheritance is broken, meaning the folder's ACL no longer follows its parent. Use this report to find locations where custom permission assignments may have introduced inconsistencies or unexpected access. | -| **Domain User ACLs** | Shows share and folder permissions assigned directly to domain user accounts. Use this report to identify accounts with direct ACL entries that should be managed through groups instead. | -| **High Risk ACLs** | Identifies folders where broad trustees such as Everyone, Authenticated Users, or Domain Users appear in the access control list. Use this report to locate and remediate over-permissioned folders that expose data to wide audiences. | -| **Local Administrators** | Lists local administrator accounts and the hosts where they hold that privilege. Use this report to identify non-standard or unauthorized local administrator assignments across your file servers. | -| **Missing Full Control** | Lists folders where no trustee holds Full Control permission. Use this report to identify folders that may lack a clear owner or administrator and address potential access management gaps. | -| **Open Access** | Identifies folders and shares accessible to broad groups or where sensitive data is reachable without restriction. Use this report to prioritize remediation of the most exposed locations in your file server environment. | -| **Probable Owner** | Identifies the most likely owner for each share based on access patterns and file activity. Use this report to assign data ownership and support data governance workflows. | -| **Share Audit** | Provides a detailed breakdown of share-level attributes including scan status, last scanned date, file counts, object counts, and active users. Use this report to confirm scan coverage and review the overall state of each share. | - -### Activity - -| Report | Description | -| --- | --- | -| **Activity Investigation** | Displays file system events filtered by date range, user, path, and event type. Use this report to trace the actions of a specific user or investigate changes to a specific file or folder. | - -### Content - -| Report | Description | -| --- | --- | -| **Empty Shares** | Lists shares that contain no files. Use this report to identify shares that can be reviewed for decommissioning or consolidation. | -| **Largest Shares** | Ranks file shares by total size. Use this report to identify shares that consume the most storage and prioritize them for review or cleanup. | -| **Nested Shares** | Identifies shares nested inside other shares, creating multiple access paths to the same data with potentially different permissions. Use this report to find and resolve configurations that complicate permission management and access auditing. | -| **Stale Content** | Identifies files and shares that haven't been accessed within a configurable threshold. Use this report to locate data that may be a candidate for archiving, deletion, or access review. | - -### Sensitive Data - -| Report | Description | -| --- | --- | -| **Sensitive Data Activity** | Shows file system events involving files that contain sensitive data, filtered by date range, event type, user, and classification taxonomy. Use this report to identify who is reading, modifying, or deleting sensitive files and to detect potential data exfiltration or misuse. | -| **Sensitive Data Overview** | Provides a high-level summary of sensitive data scan findings across CIFS/SMB file shares, including the number of files with matches, classification terms found, and distribution by host and share. Use this report as a starting point for understanding where sensitive data lives in your file server environment. | -| **Share Audit** | Shows share-level details in the context of sensitive data findings, including which shares contain files with sensitive data matches. Use this report to understand sensitive data distribution across shares and prioritize remediation. | -| **Stale Data** | Identifies files containing sensitive data that haven't been accessed recently. Use this report to find aging sensitive content that may no longer be actively used but still carries exposure risk. | - -## SharePoint Online reports - -For full details on these reports, see [SharePoint Online Reports](/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/reports). - -### Access - -| Report | Description | -| --- | --- | -| **Shared Links Report** | Shows all sharing links across your SharePoint environment, with breakdowns by sharing scope (organization, anonymous, specific people), active status, sensitive data type, and site. Use this report to identify overly broad sharing and links that expose sensitive files. | - -### Content - -| Report | Description | -| --- | --- | -| **ROT Analysis** | Identifies Redundant, Obsolete, and Trivial (ROT) data across your SharePoint sites, including stale files not modified in over a year, duplicate files by content hash, and stale files containing sensitive data. Use this report to prioritize data cleanup and reduce unnecessary exposure of aging content. | -| **Scan Overview** | Summarizes the results of the most recent scan across all sites, including total site count, file count, total storage, and files with sensitive data. Use this report to confirm scan coverage and quickly identify which sites hold the most sensitive content. | diff --git a/docs/accessanalyzer/2601/gettingstarted/_category_.json b/docs/accessanalyzer/2601/gettingstarted/_category_.json deleted file mode 100644 index 3cefeac060..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/_category_.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "label": "Quick Start Guides", - "position": 20, - "collapsed": true, - "collapsible": true -} diff --git a/docs/accessanalyzer/2601/gettingstarted/active-directory/_category_.json b/docs/accessanalyzer/2601/gettingstarted/active-directory/_category_.json deleted file mode 100644 index 78b3bd0452..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/active-directory/_category_.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "label": "Active Directory", - "position": 20, - "collapsed": true, - "collapsible": true -} diff --git a/docs/accessanalyzer/2601/gettingstarted/active-directory/active-directory.md b/docs/accessanalyzer/2601/gettingstarted/active-directory/active-directory.md deleted file mode 100644 index ce3c07fa51..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/active-directory/active-directory.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: "Active Directory Scanning Overview" -description: "Overview of Active Directory scanning capabilities and prerequisites in Access Analyzer" -sidebar_position: 1 ---- - -# Active Directory Scanning Overview - -Access Analyzer scans Active Directory to inventory users, groups, and group memberships across one or more domains. It detects security risks including stale accounts, privileged account exposure, excessive group nesting, and accounts with unusual delegation settings. Findings surface in the AD Scan Summary dashboard, giving security teams a clear picture of their identity posture and the data they need to prioritize remediation. - -## Prerequisites - -Before setting up an Active Directory source group, confirm that your environment meets the following requirements. The source group wizard connects to your domain controllers over LDAP or LDAPS, so the Access Analyzer server must be able to reach them on the network and a domain service account must be available with the appropriate read permissions. - -### Service account - -Access Analyzer uses a domain service account to authenticate against your Active Directory domain controllers and read directory objects. The account must be a member of the domain you're scanning and have read access to the directory tree. - -See [Username and Password](../../configurations/service-accounts/username-password.md) to create the service account and [Active Directory Connector Requirements](../../connectors/activedirectory.md) for the full list of required permissions. - -### Network requirements - -| Port | Protocol | Destination | -| --- | --- | --- | -| 389 | TCP | Domain controllers in the source group (LDAP) | -| 636 | TCP | Domain controllers in the source group (LDAPS, if using SSL) | -| 135–139 | TCP | Domain controllers in the source group (RPC) | -| 49152–65535 | TCP | Domain controllers in the source group (RPC dynamic ports) | - -### Before you begin - -- The fully qualified domain name (FQDN) of each domain controller you plan to add. Access Analyzer doesn't support IP addresses — DIGEST-MD5 authentication requires a resolvable hostname and fails if you provide an IP address. -- A Username and Password service account created in Access Analyzer with Read access to the domain. -- Network connectivity from the Access Analyzer server to port 389 or 636 on each domain controller confirmed. diff --git a/docs/accessanalyzer/2601/gettingstarted/active-directory/reports.md b/docs/accessanalyzer/2601/gettingstarted/active-directory/reports.md deleted file mode 100644 index bf602f10d4..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/active-directory/reports.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Reports" -description: "Pre-built dashboard available for Active Directory source groups in Access Analyzer" -sidebar_position: 50 ---- - -# Reports - -After the first Active Directory scan completes, the **AD Scan Summary** dashboard becomes available under **Dashboards**. Use the **Domain** filter at the top of the dashboard to focus on a specific domain. - -## AD Scan Summary - -The dashboard has four sections: a summary row at the top, a **Users** section, a **Groups** section, and an **All Risks** section. - -### Summary row - -| Card | Description | -|------|-------------| -| **Domains** | Number of domains scanned in this source group. | -| **Users** | Total number of user objects collected. | -| **Enabled Users** | Number of enabled user accounts. | -| **Groups** | Total number of group objects collected. | -| **Direct Memberships** | Total number of direct group membership relationships. | - -### Users - -| Card | Description | -|------|-------------| -| **Administrator Accounts** | Number of accounts with a non-zero `adminCount` attribute, indicating current or past AdminSDHolder protection. | -| **New Users** | Number of user accounts created in the past 7 days. | -| **Users with Associated Risks** | Number of users who have at least one detected risk. | -| **User Risks** | Table listing each user with associated risks, including the user name, domain, and risk count. | - -### Groups - -| Card | Description | -|------|-------------| -| **Security Groups** | Number of security groups collected. | -| **DLs** | Number of distribution lists (DLs) collected. | -| **Groups with Associated Risks** | Number of groups that have at least one detected risk. | -| **Group Risks** | Table listing each group with associated risks, including the group name, domain, and risk count. | - -### All Risks - -| Card | Description | -|------|-------------| -| **Risks by Level** | Pie chart showing the distribution of detected risks by severity level (High, Medium, Low). | -| **Riskiest Objects** | Table ranking users and groups by the number of associated risks. | -| **Active Directory Risks** | Full table of all detected risks. Columns include risk type, entity name, domain, detection timestamp, risk level, risk category, and risk description. | diff --git a/docs/accessanalyzer/2601/gettingstarted/active-directory/scanning-options.md b/docs/accessanalyzer/2601/gettingstarted/active-directory/scanning-options.md deleted file mode 100644 index f940fdae3c..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/active-directory/scanning-options.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -title: "Available Scanning Options" -description: "Available scan types for Active Directory source groups" -sidebar_position: 2 ---- - -# Available Scanning Options - -| Scan Option | Description | Available Configurations | -| --- | --- | --- | -| **Active Directory Inventory** | Scans users, groups, and group memberships from all domain controllers in the source group. The first scan runs in full; subsequent scans run differentially, collecting only changes since the last run. | None | diff --git a/docs/accessanalyzer/2601/gettingstarted/active-directory/schema-reference.md b/docs/accessanalyzer/2601/gettingstarted/active-directory/schema-reference.md deleted file mode 100644 index 44a6fc5b0f..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/active-directory/schema-reference.md +++ /dev/null @@ -1,273 +0,0 @@ ---- -title: "Active Directory Schema Reference" -sidebar_position: 40 ---- - -# Active Directory Schema Reference - -Access Analyzer stores Active Directory scan data in the `access_analyzer` ClickHouse database. Access Analyzer creates these tables when you set up an Active Directory source group and run a scan. Use this reference when querying scan data directly or integrating Access Analyzer data with external tools. - -:::note -All tables use the `ReplacingMergeTree` engine. Duplicate rows with the same primary key are deduplicated at merge time. Query the `_latest` views to return only the most recent version of each record. -::: - -## Metadata columns - -All tables include the following columns, which Access Analyzer populates during each scan: - -| Column | Type | Description | -|--------|------|-------------| -| `scan_id` | `String` | Identifier of the source group that produced this record. | -| `scan_execution_id` | `String` | Identifier of the specific scan run. | -| `scanned_at` | `DateTime` | Timestamp when the record was written. | - ---- - -## Tables - -### Active Directory User - -Stores one row per user object discovered in an Active Directory scan. - -**Primary key:** `object_guid` - -#### Core identity fields - -| Column | Type | Description | -|--------|------|-------------| -| `object_guid` | `UUID` | Globally unique identifier for the user object. | -| `object_sid` | `String` | Security identifier (SID) of the user. | -| `distinguished_name` | `String` | Full distinguished name (DN) of the user in the directory. | -| `canonical_name` | `Nullable(String)` | Optional. Canonical form of the distinguished name. | -| `sam_account_name` | `String` | Pre-Windows 2000 logon name (sAMAccountName). | -| `user_principal_name` | `Nullable(String)` | Optional. User principal name (UPN) in `user@domain` format. | -| `display_name` | `Nullable(String)` | Optional. Display name shown in directory listings. | -| `given_name` | `Nullable(String)` | Optional. First name of the user. | -| `surname` | `Nullable(String)` | Optional. Last name of the user. | -| `enabled` | `Bool` | Whether the user account is enabled. | -| `when_created` | `Nullable(DateTime)` | Optional. Timestamp when the account was created in the directory. | -| `when_changed` | `Nullable(DateTime)` | Optional. Timestamp of the most recent change to the account. | -| `description` | `Nullable(String)` | Optional. Description field set on the user object. | -| `admin_count` | `Nullable(Int32)` | Optional. Value of the `adminCount` attribute; non-zero values indicate the account is or was protected by AdminSDHolder. | -| `primary_group_id` | `Nullable(Int32)` | Optional. Relative identifier (RID) of the user's primary group. | -| `domain_name` | `Nullable(String)` | Optional. NetBIOS or DNS name of the domain. | -| `domain_canonical_name` | `Nullable(String)` | Optional. Canonical (DNS) name of the domain. | -| `cn` | `Nullable(String)` | Optional. Common name (CN) attribute of the user object. | - -#### Contact information - -| Column | Type | Description | -|--------|------|-------------| -| `mail` | `Nullable(String)` | Optional. Email address. | -| `telephone_number` | `Nullable(String)` | Optional. Office telephone number. | -| `mobile` | `Nullable(String)` | Optional. Mobile telephone number. | -| `office` | `Nullable(String)` | Optional. Office location. | -| `street_address` | `Nullable(String)` | Optional. Street address. | -| `city` | `Nullable(String)` | Optional. City. | -| `state` | `Nullable(String)` | Optional. State or province. | -| `postal_code` | `Nullable(String)` | Optional. Postal or ZIP code. | -| `country` | `Nullable(String)` | Optional. Country or region. | - -#### Organizational information - -| Column | Type | Description | -|--------|------|-------------| -| `job_title` | `Nullable(String)` | Optional. Job title. | -| `department` | `Nullable(String)` | Optional. Department. | -| `company` | `Nullable(String)` | Optional. Company or organization name. | -| `manager_dn` | `Nullable(String)` | Optional. Distinguished name of the user's manager. | -| `employee_id` | `Nullable(String)` | Optional. Employee identifier. | - -#### Security information - -| Column | Type | Description | -|--------|------|-------------| -| `user_account_control` | `Nullable(Int32)` | Optional. Bitmask value of the `userAccountControl` attribute controlling account behavior and flags. | -| `password_last_set` | `Nullable(DateTime)` | Optional. Timestamp when the password was last changed. | -| `password_never_expires` | `Nullable(Bool)` | Optional. Whether the password is set to never expire. | -| `account_expires` | `Nullable(String)` | Optional. Expiration date of the account, stored as a string representation of the directory value. | -| `logon_hours` | `Nullable(String)` | Optional. Bitmask string representing the hours during which the user is permitted to log on. | -| `logon_workstations` | `Array(String)` | List of workstations the user is permitted to log on to; empty array indicates no restriction. | -| `smartcard_required` | `Nullable(Bool)` | Optional. Whether the account requires a smart card to log on. | -| `mfa_enforced` | `Nullable(Bool)` | Optional. Whether multi-factor authentication is enforced for this account. | -| `is_deleted` | `Boolean` | Whether the user object has been soft-deleted. Rows where `is_deleted = 1` are excluded from the `active_directory_user_latest` view. | - -#### Activity information - -| Column | Type | Description | -|--------|------|-------------| -| `last_logon` | `Nullable(DateTime)` | Optional. Most recent logon timestamp from the domain controller that serviced the last logon. Not replicated across domain controllers. | -| `last_logon_timestamp` | `Nullable(DateTime)` | Optional. Replicated logon timestamp (`lastLogonTimestamp`); updated at intervals and may lag behind the actual last logon by up to 14 days. | -| `bad_pwd_count` | `Nullable(Int32)` | Optional. Number of consecutive failed logon attempts. | -| `bad_password_time` | `Nullable(DateTime)` | Optional. Timestamp of the last failed logon attempt. | -| `lockout_time` | `Nullable(DateTime)` | Optional. Timestamp when the account was locked out; `NULL` or zero indicates the account isn't locked. | -| `last_logoff` | `Nullable(DateTime)` | Optional. Timestamp of the last logoff. | - -#### Delegation information - -| Column | Type | Description | -|--------|------|-------------| -| `ms_ds_allowed_to_act_on_behalf_of` | `Array(String)` | List of security descriptors for accounts permitted to delegate to this account using resource-based constrained delegation. | -| `ms_ds_allowed_to_delegate_to` | `Array(String)` | List of service principal names (SPNs) this account is permitted to delegate to using constrained delegation. | -| `ms_ds_supported_encryption_types` | `Nullable(Int32)` | Optional. Bitmask of Kerberos encryption types supported by this account. | -| `service_principal_name` | `Array(String)` | List of SPNs registered to this account. | -| `legacy_exchange_dn` | `Nullable(String)` | Optional. Legacy Exchange distinguished name, used for mail routing compatibility. | -| `ms_ds_user_account_control_computer` | `Nullable(Int32)` | Optional. Computer-specific `userAccountControl` flags stored on the user object in hybrid environments. | - -**Relations** - -| Related table | Join column | Description | -|---|---|---| -| `active_directory_group_membership` | `object_sid` via `foreign_sid` | Resolves groups that include this user when the user was added by SID from a foreign domain. | -| `active_directory_group_membership` | `distinguished_name` via `member_dn` | Resolves groups that include this user when the user was added by DN. | -| `active_directory_user_custom_attribute` | `object_guid` | Returns custom attribute values collected for this user. | -| `active_directory_effective_group_membership` | `object_guid` via `member_object_guid` | Returns all groups this user belongs to, including nested memberships. | - ---- - -### Active Directory Group - -Stores one row per group object discovered in an Active Directory scan. - -**Primary key:** `object_guid` - -| Column | Type | Description | -|--------|------|-------------| -| `object_guid` | `UUID` | Globally unique identifier for the group object. | -| `object_sid` | `String` | Security identifier (SID) of the group. | -| `distinguished_name` | `String` | Full distinguished name (DN) of the group in the directory. | -| `sam_account_name` | `Nullable(String)` | Optional. Pre-Windows 2000 name of the group. | -| `name` | `Nullable(String)` | Optional. Display name of the group. | -| `group_scope` | `Nullable(String)` | Optional. Scope of the group: `DomainLocal`, `Global`, or `Universal`. | -| `group_type` | `Nullable(String)` | Optional. Type of the group: `Security` or `Distribution`. | -| `admin_count` | `Nullable(Int32)` | Optional. Value of the `adminCount` attribute; non-zero values indicate the group is or was protected by AdminSDHolder. | -| `primary_group_id` | `Nullable(Int32)` | Optional. Relative identifier (RID) associated with this group when it is used as a primary group. | -| `domain_name` | `Nullable(String)` | Optional. NetBIOS or DNS name of the domain. | -| `domain_canonical_name` | `Nullable(String)` | Optional. Canonical (DNS) name of the domain. | -| `cn` | `Nullable(String)` | Optional. Common name (CN) attribute of the group object. | -| `mail` | `Nullable(String)` | Optional. Email address associated with the group. | -| `is_deleted` | `Boolean` | Whether the group object has been soft-deleted. Rows where `is_deleted = 1` are excluded from the `active_directory_group_latest` view. | - -**Relations** - -| Related table | Join column | Description | -|---|---|---| -| `active_directory_group_membership` | `distinguished_name` via `group_dn` | Lists the direct members of this group. | -| `active_directory_effective_group_membership` | `object_guid` via `group_object_guid` | Lists all effective members of this group, including nested members. | - ---- - -### Active Directory Group Membership - -Stores one row per direct membership relationship between a group and a member object (user or group). Nesting isn't flattened in this table; use `active_directory_effective_group_membership` for flattened membership. - -**Primary key:** `(group_dn, member_dn)` - -| Column | Type | Description | -|--------|------|-------------| -| `group_dn` | `String` | Distinguished name (DN) of the group. | -| `member_dn` | `String` | Distinguished name (DN) of the member object. | -| `foreign_sid` | `Nullable(String)` | Optional. SID of the member when the member is from a foreign (trusted) domain and a DN isn't available. | - -**Relations** - -| Related table | Join column | Description | -|---|---|---| -| `active_directory_group` | `group_dn` = `distinguished_name` | Resolves the group record for this membership row. | -| `active_directory_user` | `member_dn` = `distinguished_name` | Resolves the user record for this membership row when the member is a user. | -| `active_directory_group` | `member_dn` = `distinguished_name` | Resolves the group record for this membership row when the member is a nested group. | -| `active_directory_user` | `foreign_sid` = `object_sid` | Resolves a foreign-domain user by SID when `foreign_sid` is set. | -| `active_directory_group` | `foreign_sid` = `object_sid` | Resolves a foreign-domain group by SID when `foreign_sid` is set. | - ---- - -### Active Directory User Custom Attribute - -Stores custom Active Directory attribute values collected for user objects during a scan. Each row represents one attribute key-value pair for one user. An attribute with no value produces a row with `attr_value = NULL`. - -**Primary key:** `(object_guid, attr_name)` - -| Column | Type | Description | -|--------|------|-------------| -| `object_guid` | `UUID` | Globally unique identifier of the user object. Joins to `active_directory_user.object_guid`. | -| `attr_name` | `String` | LDAP attribute name, as configured in the source group settings. | -| `attr_value` | `Nullable(String)` | Optional. String representation of the attribute value. | - -**Relations** - -| Related table | Join column | Description | -|---|---|---| -| `active_directory_user` | `object_guid` | Returns the full user record for this custom attribute row. | - ---- - -### Active Directory Effective Group Membership - -Stores the fully flattened, transitively resolved group membership graph. The `active_directory_effective_group_membership_mv` materialized view populates this table and refreshes on a schedule after each scan. Each row represents one effective membership relationship at a given nesting depth. - -**Engine:** `MergeTree` (not `ReplacingMergeTree`). Access Analyzer rebuilds the table on each refresh rather than deduplicating it by version. - -**Primary key:** `(group_object_guid, member_object_guid)` - -| Column | Type | Description | -|--------|------|-------------| -| `group_object_guid` | `UUID` | Globally unique identifier of the group. Joins to `active_directory_group.object_guid`. | -| `member_object_guid` | `UUID` | Globally unique identifier of the effective member (user or group). Joins to `active_directory_user.object_guid` or `active_directory_group.object_guid`. | -| `nesting_level` | `Int32` | Depth of the membership relationship. A value of `0` indicates direct membership; higher values indicate the number of intermediate groups. | - -**Relations** - -| Related table | Join column | Description | -|---|---|---| -| `active_directory_group` | `group_object_guid` = `object_guid` | Resolves the group name and attributes for this membership row. | -| `active_directory_user` | `member_object_guid` = `object_guid` | Resolves the user record when the effective member is a user. | -| `active_directory_group` | `member_object_guid` = `object_guid` | Resolves the group record when the effective member is a nested group. | - ---- - -## Views - -Access Analyzer creates views that simplify common queries. Use views in preference to querying base tables directly. - -### Deduplication views - -These views apply `FINAL` to the underlying `ReplacingMergeTree` tables to return only the most recent version of each record. Use these as the starting point for any query against Active Directory data. - -| View | Base table | Description | -|------|------------|-------------| -| `active_directory_user_latest` | `active_directory_user` | Returns the most recent version of each user record, deduplicated by `object_guid`, excluding soft-deleted users (`is_deleted = 1`). | -| `active_directory_group_latest` | `active_directory_group` | Returns the most recent version of each group record, deduplicated by `object_guid`, excluding soft-deleted groups (`is_deleted = 1`). | -| `active_directory_group_membership_latest` | `active_directory_group_membership` | Returns the most recent version of each group membership row, deduplicated by `(group_dn, member_dn)`. | -| `active_directory_user_custom_attribute_latest` | `active_directory_user_custom_attribute` | Returns the most recent version of each custom attribute row, deduplicated by `(object_guid, attr_name)`. | - -### Resolution views - -These views resolve raw membership data into UUID-keyed relationships. - -| View | Description | -|------|-------------| -| `active_directory_group_membership_resolved` | Joins `active_directory_group_membership_latest` to the user and group tables to produce a resolved membership graph keyed by `(group_object_guid, member_object_guid)`. Handles both same-domain members (matched by DN) and foreign-domain members (matched by SID). Excludes deleted objects. Used as the source for `active_directory_effective_group_membership_mv`. | - -### Risk views - -These views surface specific account and group hygiene conditions. Each view returns rows in a common shape: `risk_type`, `entity_id`, `entity_name`, `domain`, `detection_timestamp`, and `additional_context`. The `active_directory_risks_summary` view aggregates all risk views into a single result set enriched with catalog metadata. - -| View | Description | -|------|-------------| -| `active_directory_empty_groups` | Groups that have no effective members. | -| `active_directory_single_member_groups` | Groups that have exactly one effective member. | -| `active_directory_large_groups` | Groups that have more than 500 effective members. | -| `active_directory_duplicate_groups_mv` | Groups whose effective membership set is identical to that of at least one other group. | -| `active_directory_circular_nesting_mv` | Groups involved in circular nesting or with a nesting depth of 10 or more. | -| `active_directory_stale_users` | Enabled user accounts with no logon activity in the past 90 to 365 days. | -| `active_directory_very_stale_users` | Enabled user accounts with no logon activity for more than 365 days. | -| `active_directory_isolated_users` | Enabled user accounts that belong to no groups. | -| `active_directory_no_logon_users` | Enabled user accounts with no recorded logon timestamp. | -| `active_directory_password_never_expires` | Enabled user accounts configured with a non-expiring password. | -| `active_directory_password_not_required` | Enabled user accounts where the `PASSWD_NOTREQD` flag is set in `user_account_control`. | -| `active_directory_old_passwords` | Enabled user accounts whose password has not changed in more than 90 days. | -| `active_directory_dc_logon_rights` | Enabled users who are effective members of privileged groups that grant domain controller logon rights (for example, Domain Admins, Enterprise Admins). | -| `active_directory_risks_summary_mv` | Union of all individual risk views. Returns one row per detected risk. | -| `active_directory_risks_summary` | Enriches `active_directory_risks_summary_mv` with risk level, category, and description from the `active_directory_risk_catalog` reference table. Use this view to query all risks with their human-readable metadata. | -| `active_directory_risks_by_domain` | Aggregates risk counts by domain and risk type, sourced from `active_directory_risks_summary_mv`. | -| `active_directory_group_member_counts` | Returns the total effective member count for each group. Intermediate view used by the group risk views. | diff --git a/docs/accessanalyzer/2601/gettingstarted/active-directory/set-up-source-group.md b/docs/accessanalyzer/2601/gettingstarted/active-directory/set-up-source-group.md deleted file mode 100644 index 4304eb9741..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/active-directory/set-up-source-group.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: "Set Up Active Directory Source Group" -description: "Configure an Active Directory source group in Access Analyzer" -sidebar_position: 3 ---- - -# Set Up Active Directory Source Group - -1. Navigate to **Configuration** > **Source Groups** and click **Add Source**. The source group wizard opens. -2. Select **Active Directory** and click **Next**. -3. Enter a **Source Group Name**. -4. Select a service account from the **Service Account** dropdown, or click **+** to create one inline. Service accounts store the credentials Access Analyzer uses to connect to your domain controllers. See [Service Accounts](../../configurations/service-accounts/overview.md) for details. -5. Click **Add** under **Domain Controllers**, then select **Add Manually**. -6. Enter the following for each domain controller: - - **Server Name / IP** — The fully qualified domain name (FQDN) of the domain controller (for example, `dc01.corp.example.com`). Access Analyzer doesn't support IP addresses. To add multiple domain controllers, separate entries with a comma or press **Enter** after each one. - - **Domain** — The DNS domain name (for example, `corp.example.com`). Applies to all domain controllers you added in this step. - - **Port** — The LDAP port. Default is `389`. Use `636` for LDAPS. -7. Click **Add domain controller**, then click **Done**. Repeat steps 5–7 for each additional domain. -8. If your domain controllers use self-signed certificates on port 636, select **Ignore SSL errors**. -9. Click **Test Connection** to verify connectivity. Each domain controller displays a **Connected** or **Failed** status. Resolve any failures before proceeding. -10. Click **Next**. -11. Under **Scanner Location**, select **System scanner** to run scans from the Access Analyzer service, or select **Custom scanner** to use a deployed scanner. See [Scanners](../../configurations/source-groups/scanners/overview.md) for details. -12. Under **Scan Schedule**, select when to run the scan: - - **Now** — Starts the scan immediately after setup completes. - - **At** — Runs the scan once at a specific date and time. - - **Advanced** — Runs the scan on a recurring schedule defined by a cron expression. -13. Click **Complete Setup**. - -## What happens next - -Access Analyzer creates the source group and a scan for each domain controller you added. If you selected **Now**, the Active Directory Inventory scan starts immediately. - -To check scan progress, navigate to **Configuration** > **Scan Executions**. - -## Edit a source group - -To modify an existing Active Directory source group, navigate to **Configuration** > **Source Groups**, select the source group, and click **Edit**. The wizard reopens with your current configuration pre-populated. You can update the source group name, service account, domain controllers, and scan schedule. - -:::note -Updating the service account affects all domain controllers in the source group, as they share a single set of credentials. -::: diff --git a/docs/accessanalyzer/2601/gettingstarted/entra-id/entra-id.md b/docs/accessanalyzer/2601/gettingstarted/entra-id/entra-id.md deleted file mode 100644 index 0ff6b763f0..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/entra-id/entra-id.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: "Entra ID Scanning Overview" -description: "Overview of Entra ID scanning capabilities and prerequisites in Access Analyzer" -sidebar_position: 1 ---- - -# Entra ID Scanning Overview - -Access Analyzer connects to Microsoft Entra ID to synchronize users, groups, role assignments, and Microsoft Information Protection (MIP) sensitivity labels from your tenant. Access Analyzer retrieves MIP labels — defined in Microsoft Purview — during the scan and makes them available in the Sensitive Data configuration, where you can map them to sensitive data types for use in file server and SharePoint Online scans. - -:::note -Access Analyzer collects MIP sensitivity labels during the Entra ID sync, and they become available for use in **File Server** and **SharePoint Online** Sensitive Data scans. Run the Entra ID scan at least once before enabling MIP label detection in those source groups. -::: - -## Prerequisites - -Before setting up an Entra ID source group, confirm that your environment meets the following requirements. The source group wizard connects to Microsoft Entra ID over HTTPS using a registered application's client credentials, so the Access Analyzer server must be able to reach the Microsoft identity platform, and you must configure an app registration in your tenant with the required API permissions. - -### Service account - -Access Analyzer uses a Client ID and Secret service account to authenticate with Microsoft Entra ID via the Microsoft Graph API. This requires a registered application in your Entra ID tenant with the appropriate API permissions granted and a client secret generated for that application. - -See [Client ID/Secret service account](../../configurations/service-accounts/client-id-secret.md) to create the service account and [Entra ID](../../connectors/entra-id/overview.md) for instructions on registering the application and granting the required permissions. - -### Network requirements - -| Protocol | Port | Destination | -| --- | --- | --- | -| HTTPS | 443 | Microsoft identity platform (`login.microsoftonline.com`) | -| HTTPS | 443 | Microsoft Graph API (`graph.microsoft.com`) | - -### Before you begin - -- A registered application in your Entra ID tenant with the required API permissions granted, including `InformationProtectionPolicy.Read.All` for MIP label retrieval. -- The application's **Tenant ID** and **Client ID**. -- A client secret generated for the application. -- A Client ID and Secret service account created in Access Analyzer. -- Network connectivity from the Access Analyzer server to port 443 confirmed. diff --git a/docs/accessanalyzer/2601/gettingstarted/entra-id/reports.md b/docs/accessanalyzer/2601/gettingstarted/entra-id/reports.md deleted file mode 100644 index b829ef2d77..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/entra-id/reports.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: "Reports" -description: "Pre-built dashboard available for Entra ID source groups in Access Analyzer" -sidebar_position: 50 ---- - -# Reports - -After the first Entra ID scan completes, the **Entra ID Scan Summary** dashboard becomes available under **Dashboards**. Use the **Tenant** filter at the top of the dashboard to focus on a specific Entra ID tenant. - -## Entra ID Scan Summary - -The dashboard is organized into three sections: a summary row at the top, an **Identities** section, and a **MIP Labels** section. - -### Summary row - -| Card | Description | -|------|-------------| -| **Users** | Total number of user objects synced from the tenant. | -| **Groups** | Total number of group objects synced from the tenant. | -| **Roles** | Total number of Azure AD role definitions retrieved. | -| **MIP Labels** | Total number of Microsoft Information Protection (MIP) sensitivity labels retrieved from the tenant. | - -### Identities - -| Card | Description | -|------|-------------| -| **Guest Users** | Number of user accounts with `userType = Guest`. | -| **MFA Configured** | Number of users with multi-factor authentication configured. | -| **Group Memberships** | Total number of direct group membership records. | -| **Role Assignments** | Total number of role assignment records (user or group assigned to a role). | - -### MIP Labels - -| Card | Description | -|------|-------------| -| **Active Labels** | Number of sensitivity labels active in the tenant. | -| **Label List** | Table listing all retrieved labels, including label name, classification level, and whether the label is active. | - -:::note -You can find the MIP labels retrieved here under **Configuration** > **Sensitive Data**, where you can map them to sensitive data types for use in File Server and SharePoint Online scans. -::: diff --git a/docs/accessanalyzer/2601/gettingstarted/entra-id/scanning-options.md b/docs/accessanalyzer/2601/gettingstarted/entra-id/scanning-options.md deleted file mode 100644 index 85098ecc6d..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/entra-id/scanning-options.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: "Scanning options" -description: "Available scan types for Entra ID source groups" -sidebar_position: 2 ---- - -# Scanning options - -| Scan type | Description | -| --- | --- | -| **Users, Groups, and Roles** | Synchronizes users, groups, and role assignments from the Entra ID tenant. The first scan runs in full; subsequent scans collect only changes since the last run. Access Analyzer automatically retrieves Microsoft Information Protection (MIP) sensitivity labels as part of every scan. | - -## MIP label retrieval - -When an Entra ID source group runs, Access Analyzer automatically retrieves Microsoft Information Protection (MIP) sensitivity labels defined in the tenant. You can find these labels on the **Configuration** > **Sensitive Data** page, where you can map them to sensitive data types for use in file server and SharePoint Online scans. - -There are no per-source-group configuration options for MIP label retrieval — it runs automatically as part of every scan. To configure how labels are applied to files, see [Sensitive Data Configuration](../../configurations/sensitive-data.md). diff --git a/docs/accessanalyzer/2601/gettingstarted/entra-id/schema-reference.md b/docs/accessanalyzer/2601/gettingstarted/entra-id/schema-reference.md deleted file mode 100644 index e558b9fa2a..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/entra-id/schema-reference.md +++ /dev/null @@ -1,122 +0,0 @@ ---- -title: "Schema reference" -sidebar_position: 40 ---- - -# Entra ID schema reference - -Access Analyzer stores Entra ID scan data in the `access_analyzer` ClickHouse database. Access Analyzer populates the following tables when you set up an Entra ID source group and run a scan. Use this reference when querying scan data directly or integrating Access Analyzer data with external tools. - -Access Analyzer stores Entra ID data in shared tables that serve multiple connector types. The `tenancyReference` column scopes each row to your tenant and corresponds to your Entra ID tenant. - -:::note -All tables use the `ReplacingMergeTree` engine, which deduplicates rows with the same primary key at merge time. Use the `FINAL` keyword or query the available `_latest` views to return only the most recent version of each record. -::: - -## Metadata columns - -All tables include the following columns populated by Access Analyzer during each scan: - -| Column | Type | Description | -|--------|------|-------------| -| `tenancyReference` | `UUID` | Identifier of the Entra ID tenant that produced this record. | -| `connectorReference` | `UUID` | Identifier of the connector job run. | -| `fullCrawlTimestampUtc` | `DateTime64(6)` | Timestamp of the most recent full sync for this tenant. | -| `crawlTimestampUtc` | `DateTime64(6)` | Timestamp when this record was written. Used as the version column for deduplication. | - ---- - -## Tables - -### principals - -Stores users, groups, and roles synced from the Entra ID tenant. Each row represents one identity object. - -**Primary key:** `entityId` - -#### Core identity fields - -| Column | Type | Description | -|--------|------|-------------| -| `entityId` | `UUID` | Unique identifier for this identity object within Access Analyzer. | -| `sourceSystemId` | `String` | Object ID from Entra ID (the Azure AD `objectId`). | -| `name` | `String` | Internal name of the object. | -| `displayName` | `String` | Display name as it appears in Entra ID. | -| `emailAddress` | `Nullable(String)` | Optional. Primary email address. | -| `firstName` | `Nullable(String)` | Optional. Given name (users only). | -| `lastName` | `Nullable(String)` | Optional. Surname (users only). | -| `isDeleted` | `Bool` | Whether the object has been soft-deleted. | -| `deletedDate` | `Nullable(DateTime64(6))` | Optional. Timestamp when the object was deleted. | -| `lastModified` | `Nullable(DateTime64(6))` | Optional. Timestamp of the most recent change. | -| `lastActive` | `Nullable(DateTime64(6))` | Optional. Timestamp of the most recent sign-in activity. | - -#### User-specific fields - -| Column | Type | Description | -|--------|------|-------------| -| `azureAdUserPrincipalName` | `Nullable(String)` | Optional. User principal name (UPN) in `user@domain` format. | -| `azureAdUserType` | `Nullable(String)` | Optional. Type of user account: `Member` or `Guest`. | -| `azureAdMfaConfigured` | `Nullable(Bool)` | Optional. Whether MFA is configured for the user. | -| `disabled` | `Nullable(Bool)` | Optional. Whether the user account is disabled. | -| `department` | `Nullable(String)` | Optional. Department attribute from Entra ID. | -| `jobTitle` | `Nullable(String)` | Optional. Job title attribute from Entra ID. | -| `lastDirSyncTime` | `Nullable(DateTime64(6))` | Optional. Last directory sync timestamp for hybrid-joined accounts. | - -#### Group-specific fields - -| Column | Type | Description | -|--------|------|-------------| -| `azureAdGroupType` | `Nullable(String)` | Optional. Group type: `Security`, `Distribution`, or `M365`. | -| `isSecurityEnabled` | `Nullable(Bool)` | Optional. Whether the group is security-enabled. | -| `isMailEnabled` | `Nullable(Bool)` | Optional. Whether the group is mail-enabled. | -| `memberCount` | `Nullable(Int32)` | Optional. Number of direct members. | -| `dynamicMembershipEnabled` | `Nullable(Bool)` | Optional. Whether the group uses dynamic membership rules. | - -#### Role-specific fields - -| Column | Type | Description | -|--------|------|-------------| -| `azureRoleTemplateId` | `Nullable(String)` | Optional. Stable template ID for built-in roles (consistent across tenants). | -| `azureRoleAllowedPrincipalTypes` | `Nullable(String)` | Optional. Principal types that can be assigned to this role. | - ---- - -### memberships - -Stores group membership records — both direct and nested. Each row represents one membership relationship. - -**Primary key:** `(groupId, memberId, role)` - -| Column | Type | Description | -|--------|------|-------------| -| `groupId` | `UUID` | `entityId` of the group. Joins to `principals.entityId`. | -| `memberId` | `UUID` | `entityId` of the member (user, group, or service principal). Joins to `principals.entityId`. | -| `membershipSource` | `String` | How the membership was established: `Direct`, `Nested`, or `Dynamic`. | -| `role` | `String` | Role of the member within the group: `Owner`, `Member`, or `Guest`. | -| `expandedFromGroupId` | `Nullable(UUID)` | Optional. For nested memberships, the intermediate group through which this membership was resolved. | -| `isDeleted` | `Bool` | Whether this membership record has been removed. | - ---- - -### sensitivity_labels - -Stores Microsoft Information Protection (MIP) sensitivity labels retrieved from the tenant during an Entra ID scan. - -**Primary key:** `sensitivitylabelId` - -| Column | Type | Description | -|--------|------|-------------| -| `sensitivitylabelId` | `UUID` | Unique identifier for this label within Access Analyzer. | -| `name` | `String` | Internal name of the label. | -| `displayName` | `String` | Display name shown to users in Microsoft 365 applications. | -| `description` | `Nullable(String)` | Optional. Description of the label's purpose. | -| `isActive` | `Bool` | Whether the label is active in the tenant. | -| `isDeleted` | `Bool` | Whether the label has been deleted. | -| `classificationLevel` | `Nullable(String)` | Optional. Classification level assigned to the label. | -| `priority` | `Int32` | Display order priority. Lower values appear first. | -| `parentLabelId` | `Nullable(UUID)` | Optional. For sublabels, the `sensitivitylabelId` of the parent label. | -| `labelId` | `Nullable(String)` | Microsoft GUID for the label as defined in Microsoft Purview. | - -:::note -Labels stored here are the source data for MIP label mapping in **Configuration** > **Sensitive Data**. After you map labels to sensitive data types, they are available for detection during File Server and SharePoint Online scans. -::: diff --git a/docs/accessanalyzer/2601/gettingstarted/entra-id/set-up-source-group.md b/docs/accessanalyzer/2601/gettingstarted/entra-id/set-up-source-group.md deleted file mode 100644 index 62e5af73db..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/entra-id/set-up-source-group.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "Set up an Entra ID source group" -description: "Configure an Entra ID source group in Access Analyzer" -sidebar_position: 3 ---- - -# Set up an Entra ID source group - -1. Navigate to **Configuration** > **Source Groups** and click **Add Source**. The source group wizard opens. - -2. Select **Entra ID** and click **Next**. - -3. Enter a **Source Group Name**. - -4. Select a service account from the **Service Account** dropdown, or click **+** to create one inline. Entra ID requires a **Client ID and Secret** service account type. See [Service Accounts](../../configurations/service-accounts/overview.md) for details. - -5. Enter the **Tenant ID** for your Entra ID directory. This must be a valid UUID (for example, `550e8400-e29b-41d4-a716-446655440000`). - -6. Click **Test Connection** to verify that Access Analyzer can authenticate to your Entra ID tenant. Resolve any failures before proceeding. - -7. Click **Next**. - -8. Under **Scan Schedule**, select when to run the scan: - - - **Now** — Starts the scan immediately after setup completes. - - **At** — Runs the scan once at a specific date and time. - - **Advanced** — Runs the scan on a recurring schedule defined by a cron expression. - -9. Click **Complete Setup**. - -## What happens next - -Access Analyzer creates the source group and begins syncing users, groups, and roles from your Entra ID tenant. If you selected **Now**, the scan starts immediately. Access Analyzer retrieves Microsoft Information Protection (MIP) sensitivity labels automatically as part of the scan. - -To check scan progress, navigate to **Configuration** > **Scan Executions**. - -## Edit a source group - -To modify an existing Entra ID source group, navigate to **Configuration** > **Source Groups**, select the source group, and click **Edit**. The wizard reopens with your current configuration pre-populated. You can update the source group name, service account, tenant ID, and scan schedule. - -:::note -Updating the service account replaces the client credentials used to authenticate with Entra ID. Ensure the new service account has the required API permissions before saving. -::: diff --git a/docs/accessanalyzer/2601/gettingstarted/file-servers/_category_.json b/docs/accessanalyzer/2601/gettingstarted/file-servers/_category_.json deleted file mode 100644 index dbe2c40136..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/file-servers/_category_.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "label": "File Servers", - "position": 30, - "collapsed": true, - "collapsible": true -} diff --git a/docs/accessanalyzer/2601/gettingstarted/file-servers/file-servers.md b/docs/accessanalyzer/2601/gettingstarted/file-servers/file-servers.md deleted file mode 100644 index 1eaab1b140..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/file-servers/file-servers.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: "File Server Scanning Overview" -description: "Overview of file server scanning capabilities and prerequisites in Access Analyzer" -sidebar_position: 1 ---- - -# File Server Scanning Overview - -Access Analyzer scans file servers over SMB to map share permissions, folder-level ACLs, and file ownership across your environment. It can also scan file contents to locate sensitive data and, if you configure activity monitoring, track file access events over time. Reports surface open access, broken inheritance, direct user permissions, and sensitive data exposure — giving security and compliance teams the visibility they need to reduce unnecessary access and meet data protection requirements. - -## Supported platforms - -Access Analyzer scans any SMB-compatible file server. For platform-specific requirements, see the connector page for your environment: - -- [CIFS / SMB File Share](../../connectors/file-servers/cifs.md) — Windows file servers and Samba -- [NetApp ONTAP](../../connectors/file-servers/netapp.md) -- [Dell Isilon / PowerScale](../../connectors/file-servers/isilon-powerscale.md) -- [Dell Unity](../../connectors/file-servers/dell-unity.md) -- [Dell EMC VNX](../../connectors/file-servers/vnx.md) -- [Dell EMC Celerra](../../connectors/file-servers/celerra.md) - -## Prerequisites - -Before setting up a file server source group, confirm that your environment meets the following requirements. The source group wizard connects to your file servers over SMB, so the Access Analyzer server must be able to reach them on the network and a service account must be available with read access to the shares you want to scan. - -### Service account - -Access Analyzer uses a service account with a username and password to authenticate against your file servers over SMB and enumerate shares, permissions, and file contents. The account needs read access to the shares and permission to read object security descriptors. - -See [Username and Password](../../configurations/service-accounts/username-password.md) to create the service account and [CIFS / SMB File Share](../../connectors/file-servers/cifs.md) for the full permission requirements. - -### Network requirements - -| Port | Protocol | Destination | -|------|----------|-------------| -| 445 | TCP | File servers in the source group | - -### Before you begin - -- The hostname or IP address of each file server you plan to add. -- A Username and Password service account created in Access Analyzer with read access to the target file servers. -- Network connectivity from the Access Analyzer server to port 445 on each file server confirmed. - -:::note -When you add a file server source group, Access Analyzer automatically creates a **Local Users and Groups** scan for each host. This scan collects local user and group accounts directly from the file server and runs alongside your Access and Sensitive Data scans. -::: - -:::note -File activity reports — including open, modify, and delete events, and anomaly detection — require a separate **Netwrix Activity Monitor** deployment. Without Activity Monitor, activity-related reports will show no data. See [File Activity Monitoring](../../overview/overview.md#key-capabilities) for details. -::: diff --git a/docs/accessanalyzer/2601/gettingstarted/file-servers/reports.md b/docs/accessanalyzer/2601/gettingstarted/file-servers/reports.md deleted file mode 100644 index 6cc8fd73ac..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/file-servers/reports.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: "Reports" -description: "Pre-built reports available for File Servers source groups in Access Analyzer" -sidebar_position: 50 ---- - -# Reports - -File Servers source groups include a set of pre-built reports that answer common security questions about permissions, sensitive data exposure, access patterns, and data content across your CIFS/SMB file shares. Reports are available under the Reports section after the first scan completes and update each time a scan runs. - -:::note -Activity reports (Activity Investigation and Sensitive Data Activity) require you to configure Netwrix Activity Monitor (NAM) so it streams events to Access Analyzer. See [Activity Monitor Integration](../../configurations/activity-monitor-integration.md) for setup instructions. -::: - -## Available reports - -| Location | Report | Description | -|----------|--------|-------------| -| Access / Broken Inheritance | Broken Inheritance | Lists shares and folders with broken permission inheritance, meaning the folder's ACL no longer follows its parent. Use this report to find locations where custom permission assignments may have introduced inconsistencies or unexpected access. | -| Access / Domain User ACLs | Domain User ACLs | Shows share and folder permissions assigned directly to domain user accounts. Use this report to identify accounts with direct ACL entries that should be managed through groups instead. | -| Access / High Risk ACLs | High Risk ACLs | Identifies folders where broad trustees such as Everyone, Authenticated Users, or Domain Users appear in the access control list. Use this report to locate and remediate over-permissioned folders that expose data to wide audiences. | -| Access / Local Administrators | Local Administrators | Lists local administrator accounts and the hosts where they hold that privilege. Use this report to identify non-standard or unauthorized local administrator assignments across your file servers. | -| Access / Missing Full Control | Missing Full Control | Lists folders where no trustee holds Full Control permission. Use this report to identify folders that may lack a clear owner or administrator and address potential access management gaps. | -| Access / Open Access | Open Access | Identifies folders and shares accessible to broad groups or where sensitive data is reachable without restriction. Use this report to prioritize remediation of the most exposed locations in your file server environment. | -| Access / Probable Owner | Probable Owner | Identifies the most likely owner for each share based on access patterns and file activity. Use this report to assign data ownership and support data governance workflows. | -| Access / Share Audit | Share Audit | Provides a detailed breakdown of share-level attributes including scan status, last scanned date, file counts, object counts, and active users. Use this report to confirm scan coverage and review the overall state of each share. | -| Activity / Activity Investigation | Activity Investigation | Displays file system events filtered by date range, user, path, and event type. Use this report to trace the actions of a specific user or investigate changes to a specific file or folder. | -| Content / Empty Shares | Empty Shares | Lists shares that contain no files. Use this report to identify shares that can be reviewed for decommissioning or consolidation. | -| Content / Largest Shares | Largest Shares | Ranks file shares by total size. Use this report to identify shares that consume the most storage and prioritize them for review or cleanup. | -| Content / Nested Shares | Nested Shares | Identifies shares that nest inside other shares, creating multiple access paths to the same data with potentially different permissions. Use this report to find and resolve configurations that complicate permission management and access auditing. | -| Content / Stale Content | Stale Content | Identifies files and shares that haven't been accessed within a configurable threshold. Use this report to locate data that may be a candidate for archiving, deletion, or access review. | -| Sensitive Data / Sensitive Data Activity | Sensitive Data Activity | Shows file system events involving files that contain sensitive data. You can filter results by date range, event type, user, and classification taxonomy. Use this report to identify who is reading, modifying, or deleting sensitive files and to detect potential data exfiltration or misuse. | -| Sensitive Data / Sensitive Data Overview | Sensitive Data Overview | Provides a high-level summary of sensitive data scan findings across CIFS/SMB file shares, including the number of files with matches, classification terms found, and distribution by host and share. Use this report as a starting point for understanding where sensitive data lives in your file server environment. | -| Sensitive Data / Share Audit | Share Audit | Shows share-level details in the context of sensitive data findings, including which shares contain files with sensitive data matches. Use this report to understand sensitive data distribution across shares and prioritize remediation. | -| Sensitive Data / Stale Data | Stale Data | Identifies files containing sensitive data that haven't been accessed recently. Use this report to find aging sensitive content that may no longer be actively used but still carries exposure risk. | diff --git a/docs/accessanalyzer/2601/gettingstarted/file-servers/scanning-options.md b/docs/accessanalyzer/2601/gettingstarted/file-servers/scanning-options.md deleted file mode 100644 index 6fb261c24a..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/file-servers/scanning-options.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -title: "Available Scanning Options" -description: "Available scan types and configuration options for file server source groups" -sidebar_position: 2 ---- - -# Available Scanning Options - -| Scan Option | Description | Available Configurations | -| --- | --- | --- | -| **Access** | Scans file server permissions and access controls to identify who has access to what. | Share selection (all shares or custom), file-level permissions, concurrent workers (1–20), scan depth | -| **Sensitive Data** | Scans file contents for sensitive data patterns such as personally identifiable information (PII), credentials, protected health information (PHI), and financial records. The first scan runs in full; subsequent scans run differentially, collecting only changes since the last run. | Share selection (all shares or custom), sensitive data types, optical character recognition (OCR), differential scan | - -## Scan Configuration - -**Access** - -- **Include Shares** — Select **All shares** to scan every share on the server, or **Custom selection** to specify which shares to include. -- **Exclude Shares** — Enter share paths to skip. This field supports wildcards (for example, `\\fileserver\*\temp*`). -- **Hidden shares** — Select **Automatically enumerate hidden shares** to include hidden shares. Use **Exclude Hidden Shares** to skip specific ones (for example, `ADMIN$, C$, IPC$`). -- **File-level permissions** — Select **Include file-level permission data** to collect permissions at the individual file level in addition to folder level. This increases scan time. -- **Workers** — Sets the number of concurrent enumeration threads. Default is `3`; valid range is `1–20`. Increase to improve scan speed; decrease to reduce load on the file server. -- **Scan Depth** — Sets the maximum number of directory levels the scan traverses. Default is `50`. Reduce this value to limit scanning to the top levels of a directory tree. - -**Sensitive Data** - -- **Include/Exclude Shares** — Same share selection options as the Access scan. -- **Sensitive data types** — Select **Inherit from Global Settings** to use the system-wide classification configuration, or disable this option to configure types for this source group. Enable each type you want to detect and assign a classification label. -- **OCR** — Select **Run OCR** to scan images, screenshots, and scanned documents for sensitive text using optical character recognition. This increases processing time. diff --git a/docs/accessanalyzer/2601/gettingstarted/file-servers/schema-reference.md b/docs/accessanalyzer/2601/gettingstarted/file-servers/schema-reference.md deleted file mode 100644 index 7f0b247ea4..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/file-servers/schema-reference.md +++ /dev/null @@ -1,201 +0,0 @@ ---- -title: "File Servers Schema Reference" -sidebar_position: 40 ---- - -# File Servers Schema Reference - -Access Analyzer stores File Server scan data in the `access_analyzer` ClickHouse database. Setting up a File Server source group and running a scan creates the following tables. Use this reference when querying scan data directly or integrating Access Analyzer data with external tools. - -:::note -All tables use the `ReplacingMergeTree` engine. The engine deduplicates rows with the same primary key at merge time. Query the `_latest` views to return only the most recent version of each record. -::: - -## Metadata columns - -All tables include the following columns, which Access Analyzer populates during each scan: - -| Column | Type | Description | -|--------|------|-------------| -| `scan_id` | `String` | Identifier of the source group that produced this record. | -| `scan_execution_id` | `String` | Identifier of the specific scan run. | -| `scanned_at` | `DateTime` | Timestamp when the record was written. | - ---- - -## Tables - -### CIFS Object - -Stores the file system inventory collected during a scan — one row per file, directory, or share discovered on a file server. - -| Column | Type | Description | -|--------|------|-------------| -| `host` | `String` | Hostname of the file server. | -| `share_name` | `String` | Name of the share on the file server. | -| `share_path` | `String` | Universal Naming Convention (UNC) path of the share root. | -| `path` | `String` | Full path of the object within the share. | -| `object_type` | `Enum8('FILE', 'DIRECTORY', 'SHARE')` | Whether the object is a file, directory, or share. | -| `parent_path` | `String` | Full path of the parent directory. | -| `name` | `String` | Name of the file or directory. | -| `file_extension` | `String` | File extension, if applicable. Empty string for directories and shares. | -| `file_size` | `UInt64` | Size of the file in bytes. Zero for directories and shares. | -| `owner_sid` | `String` | Security identifier (SID) of the file or directory owner. | -| `group_owner_sid` | `String` | SID of the primary group owner. | -| `created_time` | `Nullable(DateTime)` | Optional. Timestamp when the object was created. | -| `modified_time` | `Nullable(DateTime)` | Optional. Timestamp when the object was last modified. | -| `accessed_time` | `Nullable(DateTime)` | Optional. Timestamp when the object was last accessed. | -| `scan_status` | `Enum8('SUCCESS', 'ERROR')` | Whether the object was scanned successfully. | -| `error_message` | `String` | Error detail if `scan_status` is `ERROR`. Empty string on success. | -| `attributes` | `Array(Enum8('DIRECTORY', 'READONLY', 'HIDDEN', 'SYSTEM', 'ARCHIVE', 'COMPRESSED', 'ENCRYPTED'))` | Windows file attributes applied to the object. | -| `inheritance_flags` | `UInt16` | Bitmask representing ACL inheritance settings on the object. | -| `is_protected` | `Nullable(Bool)` | Optional. Whether the object's ACL is protected from inheritance. | -| `is_world_readable` | `Nullable(Bool)` | Optional. Whether any well-known open SID (for example, Everyone) has read access. | -| `is_world_writable` | `Nullable(Bool)` | Optional. Whether any well-known open SID has write access. | -| `is_admin_only` | `Nullable(Bool)` | Optional. Whether access is restricted to administrative accounts only. | -| `has_explicit_deny` | `Nullable(Bool)` | Optional. Whether the object has at least one explicit deny ACE. | -| `permission_count` | `UInt16` | Total number of ACEs on the object. | -| `unique_trustees_count` | `UInt16` | Number of distinct trustees with permissions on the object. | -| `permission_flags` | `UInt16` | Bitmask summarizing the permission state of the object. | -| `is_complete` | `Bool` | Whether the scan fully enumerated this object's permissions before the scan completed. | -| `hard_delete` | `Bool` | Internal flag used by `ReplacingMergeTree` to exclude deleted rows. Rows where `hard_delete = 1` are suppressed at query time when querying with `FINAL`. | - -**Relations** - -| Related table | Join column | Description | -|---------------|-------------|-------------| -| `cifs_permission` | `host`, `share_name`, `path` | Resolves NTFS permissions assigned to this file or directory. | -| `cifs_sensitive_data` | `host`, `share_name`, `path` | Resolves sensitive data findings for this file. | - ---- - -### CIFS Permission - -Stores NTFS access control entries (ACEs) for files and directories — one row per trustee per path. - -| Column | Type | Description | -|--------|------|-------------| -| `trustee_sid` | `String` | SID of the user or group that this ACE grants or denies access to. | -| `host` | `String` | Hostname of the file server. | -| `share_name` | `String` | Name of the share containing the object. | -| `path` | `String` | Full path of the object this ACE applies to. | -| `permissions` | `Array(Enum8('FILE_READ_DATA', 'FILE_WRITE_DATA', 'FILE_APPEND_DATA', 'FILE_READ_EA', 'FILE_WRITE_EA', 'FILE_EXECUTE', 'FILE_DELETE_CHILD', 'FILE_READ_ATTRIBUTES', 'FILE_WRITE_ATTRIBUTES', 'DIR_LIST', 'DIR_ADD_FILE', 'DIR_ADD_SUB_DIR', 'DIR_DELETE_CHILD', 'DELETE', 'READ_CONTROL', 'WRITE_DAC', 'WRITE_OWNER', 'GENERIC_ALL', 'GENERIC_EXECUTE', 'GENERIC_WRITE', 'GENERIC_READ'))` | Individual permission flags included in this ACE. | -| `normalized_permissions` | `FixedString(6)` | Six-character string encoding the effective permissions (for example, `RWXDMC`) for use in summary queries. | -| `access_type` | `Enum8('ALLOW', 'DENY')` | Whether this ACE allows or denies access. | -| `access_mask` | `UInt32` | Raw Windows access mask bitmask for this ACE. | -| `inheritance_flags` | `UInt16` | Bitmask describing how this ACE propagates to child objects. | -| `is_inherited` | `Bool` | Whether this ACE was inherited from a parent object rather than set explicitly. | -| `mip_label_id` | `Nullable(String)` | Optional. Microsoft GUID of the MIP sensitivity label applied to this object. | -| `mip_label_name` | `Nullable(String)` | Optional. Display name of the MIP sensitivity label applied to this object. | -| `hard_delete` | `Bool` | Internal flag used by `ReplacingMergeTree` to exclude deleted rows. | - -**Relations** - -| Related table | Join column | Description | -|---------------|-------------|-------------| -| `cifs_object` | `host`, `share_name`, `path` | Resolves file system object details for this ACE. | -| `cifs_share_permission` | `host`, `share_name` | Resolves the share-level permissions that apply in combination with this NTFS ACE. | - ---- - -### CIFS Share Permission - -Stores share-level ACEs — one row per trustee per share. Share permissions apply in addition to NTFS permissions; the effective access a user has is the intersection of both. - -| Column | Type | Description | -|--------|------|-------------| -| `trustee_sid` | `String` | SID of the user or group that this share ACE grants or denies access to. | -| `host` | `String` | Hostname of the file server. | -| `share_name` | `String` | Name of the share this ACE applies to. | -| `permissions` | `Array(Enum8('FILE_READ_DATA', 'FILE_WRITE_DATA', 'FILE_APPEND_DATA', 'FILE_READ_EA', 'FILE_WRITE_EA', 'FILE_EXECUTE', 'FILE_DELETE_CHILD', 'FILE_READ_ATTRIBUTES', 'FILE_WRITE_ATTRIBUTES', 'DIR_LIST', 'DIR_ADD_FILE', 'DIR_ADD_SUB_DIR', 'DIR_DELETE_CHILD', 'DELETE', 'READ_CONTROL', 'WRITE_DAC', 'WRITE_OWNER', 'GENERIC_ALL', 'GENERIC_EXECUTE', 'GENERIC_WRITE', 'GENERIC_READ'))` | Individual permission flags included in this share ACE. | -| `normalized_permissions` | `FixedString(6)` | Six-character string encoding the effective permissions for use in summary queries. | -| `access_type` | `Enum8('ALLOW', 'DENY')` | Whether this ACE allows or denies access at the share level. | -| `access_mask` | `UInt32` | Raw Windows access mask bitmask for this share ACE. | -| `mip_label_id` | `Nullable(String)` | Optional. Microsoft GUID of the MIP sensitivity label applied to this share. | -| `mip_label_name` | `Nullable(String)` | Optional. Display name of the MIP sensitivity label applied to this share. | -| `hard_delete` | `Bool` | Internal flag used by `ReplacingMergeTree` to exclude deleted rows. | - -**Relations** - -| Related table | Join column | Description | -|---------------|-------------|-------------| -| `cifs_permission` | `host`, `share_name` | Resolves NTFS ACEs that apply within this share. | - ---- - -### CIFS Sensitive Data - -Stores sensitive data classification findings — one row per taxonomy term match per file path. - -| Column | Type | Description | -|--------|------|-------------| -| `host` | `String` | Hostname of the file server. | -| `share_name` | `String` | Name of the share containing the file. | -| `path` | `String` | Full path of the file where sensitive data was detected. | -| `taxonomy_name` | `String` | Name of the taxonomy that contains the matched term (for example, `PII`). | -| `term_name` | `String` | Name of the classification term that matched (for example, `Social Security Number`). | -| `processing_time_seconds` | `Float32` | Time in seconds to classify the file. | -| `classification_method` | `Nullable(Enum8('SDK_AUTO', 'SDK_CUSTOM'))` | Optional. Whether detection used the built-in automatic classification engine (`SDK_AUTO`) or a custom classification configuration (`SDK_CUSTOM`). | -| `scan_status` | `Enum8('SUCCESS', 'ERROR')` | Whether the file was processed successfully. `SUCCESS` indicates the file was read and classified, regardless of whether sensitive data was found. `ERROR` indicates a processing failure such as a file conversion error, encryption, or unsupported format. | -| `error_message` | `Nullable(String)` | Optional. Error detail when `scan_status` is `ERROR`. Null on success. | -| `hard_delete` | `Bool` | Internal flag used by `ReplacingMergeTree` to exclude deleted rows. | - -**Relations** - -| Related table | Join column | Description | -|---------------|-------------|-------------| -| `cifs_object` | `host`, `share_name`, `path` | Resolves file system object details for this finding. | -| `cifs_sensitive_data_mip_labels` | `host`, `share_name`, `path` | Resolves MIP sensitivity label decisions applied to this file. | - ---- - -### CIFS Sensitive Data MIP Labels - -Stores Microsoft Information Protection (MIP) sensitivity label decisions for files that contain sensitive data findings. Each row records the label action Access Analyzer determined for a file based on its classification results. Access Analyzer sources MIP labels from an Entra ID source group configured in the same Access Analyzer instance and uses that source group to resolve label definitions and apply or recommend label changes. - -:::note -This table uses `ReplacingMergeTree(decision_timestamp)` rather than `scanned_at`. At merge time, the engine keeps the most recent decision per file (identified by `source_id`, `host`, `share_name`, and `path`). -::: - -| Column | Type | Description | -|--------|------|-------------| -| `source_id` | `UUID` | Identifier of the Entra ID source group used to resolve MIP label definitions. | -| `host` | `String` | Hostname of the file server. | -| `share_name` | `String` | Name of the share containing the file. | -| `path` | `String` | Full path of the file this label decision applies to. | -| `mip_is_protected` | `Bool` | Whether the file is protected by MIP encryption. | -| `taxonomy_id` | `Nullable(UUID)` | Optional. Identifier of the taxonomy that triggered this label decision. | -| `action` | `Enum8('upgrade', 'keep', 'downgrade', 'clear', 'none')` | The label action Access Analyzer determined: `upgrade` applies a higher-sensitivity label, `downgrade` applies a lower-sensitivity label, `keep` leaves the current label unchanged, `clear` removes the label, and `none` indicates no action was taken. | -| `label_id` | `Nullable(UUID)` | Optional. UUID of the MIP sensitivity label selected by the action. | -| `label_name` | `Nullable(String)` | Optional. Display name of the MIP sensitivity label selected by the action. | -| `reason` | `Nullable(String)` | Optional. Explanation of why this label action was chosen. | -| `decision_timestamp` | `DateTime` | Timestamp when Access Analyzer made this label decision. | -| `scanned_at` | `DateTime` | Timestamp when the record was written. | -| `applied_at` | `Nullable(DateTime)` | Optional. Timestamp when the label was successfully applied to the file. Null if not yet applied. | -| `apply_error` | `String` | Error message if the label application failed. Empty string when no error occurred. | -| `apply_attempts` | `UInt8` | Number of times Access Analyzer has attempted to apply this label decision. | -| `created_at` | `DateTime` | Timestamp when this record was first created. | -| `updated_at` | `DateTime` | Timestamp when this record was last updated. | - -**Relations** - -| Related table | Join column | Description | -|---------------|-------------|-------------| -| `cifs_sensitive_data` | `host`, `share_name`, `path` | Resolves the sensitive data findings that triggered this label decision. | - ---- - -## Views - -Access Analyzer creates views that simplify common queries. Use views instead of querying base tables directly. - -| View | Base table | Description | -|------|------------|-------------| -| `cifs_object_latest` | `cifs_object` | Returns the most recent version of each file system object, using `FINAL` to suppress duplicates. | -| `cifs_permission_latest` | `cifs_permission` | Returns the most recent version of each NTFS ACE, using `FINAL` to suppress duplicates. | -| `cifs_share_permission_latest` | `cifs_share_permission` | Returns the most recent version of each share-level ACE, using `FINAL` to suppress duplicates. | -| `cifs_sensitive_data_latest` | `cifs_sensitive_data` | Returns one aggregated row per file path, combining all taxonomy and term matches for that path. The `taxonomy_names` and `term_names` columns return arrays of distinct values grouped from individual rows. | -| `cifs_sensitive_data_mip_labels_latest` | `cifs_sensitive_data_mip_labels` | Returns the most recent label decision per file, using `FINAL` to suppress duplicates. | -| `cifs_sensitive_data_mip_labels_summary` | `cifs_sensitive_data_mip_labels` | Returns a summary of label decisions grouped by host, share, action, label name, and protection status. Includes decision counts and the timestamp range of first and last decisions. | -| `cifs_effective_permissions` | `cifs_permission_latest`, `cifs_share_permission_latest` | Joins NTFS and share permissions with resolved principal identities (local users, local groups, Active Directory users, Active Directory groups, and well-known SIDs) to produce one row per principal per path. Use this view to query who has access to a given path by name rather than by SID. | -| `cifs_effective_access` | `cifs_effective_permissions` | Computes the final effective access mask for each principal per path by combining NTFS allow and deny ACEs with share-level permissions. Use this view to determine the actual access a named user or group has to a file or directory. | diff --git a/docs/accessanalyzer/2601/gettingstarted/file-servers/set-up-source-group.md b/docs/accessanalyzer/2601/gettingstarted/file-servers/set-up-source-group.md deleted file mode 100644 index 14a5a50fba..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/file-servers/set-up-source-group.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Set Up File Server Source Group" -description: "Configure a file server source group in Access Analyzer" -sidebar_position: 3 ---- - -# Set Up File Server Source Group - -1. Navigate to **Configuration** > **Source Groups** and click **Add Source**. The source group wizard opens. -2. Select **File Server** and click **Next**. -3. Enter a **Source Group Name**. -4. Select a service account from the **Service Account** dropdown, or click **+** to create one inline. See [Service Accounts](../../configurations/service-accounts/overview.md) for details. -5. Optionally, enter a **Domain** name to apply to all file servers in this source group. Leave blank if your servers are in a workgroup or if you want to specify credentials without a domain prefix. -6. Click **Add** under **File Servers** and enter the hostname or IP address of each file server to include. Click **Done** when finished. -7. Click **Test Connection** to verify connectivity. Each server displays a **Connected** or **Failed** status. Resolve any failures before proceeding. -8. Click **Next**. -9. Enable the scan types you want to run: - - **Access scan:** - - - Toggle **Access** to enable scanning of file permissions and access controls. - - Under **Include Shares**, select **All shares** to scan every share on the server, or **Custom selection** to specify a list of shares to include. - - Optionally, add share paths to the **Exclude Shares** field to skip specific locations. The field supports wildcards (for example, `\\fileserver\*\temp*`). - - Select **Automatically enumerate hidden shares** to include hidden shares in the scan. Use the **Exclude Hidden Shares** field to exclude specific hidden shares (for example, `ADMIN$, C$, IPC$`). - - Select **Include file-level permission data** to collect permissions at the file level in addition to folder level. This increases scan time. - - Set **Workers** to control the number of concurrent threads used during enumeration. The default is `3`. The valid range is `1–20`. - - Set **Scan Depth** to limit how many directory levels deep the scan traverses. The default is `50`. - - **Sensitive Data scan:** - - - Toggle **Sensitive Data** to enable scanning of file contents for sensitive data patterns. - - Configure share selection using the same options as the Access scan. - - Select **Inherit from Global Settings** to use the sensitive data types configured at the system level, or disable this option to configure types for this source group specifically. - - If configuring types directly, enable each sensitive data type you want to detect and assign a classification label. - - Select **Run OCR** to scan images, screenshots, and scanned documents for sensitive text using optical character recognition (OCR). This increases processing time. - -10. Under **Scanner Location**, select **System scanner** to run scans from the Access Analyzer service, or select **Custom scanner** to use a deployed scanner. See [Scanners](../../configurations/source-groups/scanners/overview.md) for details. -11. Under **Scan Schedule**, select when to run the scan: - - **Now** — Starts the scan immediately after setup completes. - - **At** — Runs the scan once at a specific date and time. - - **Advanced** — Runs the scan on a recurring schedule defined by a cron expression. -12. Click **Complete Setup**. - -## What happens next - -Access Analyzer creates the source group and a scan for each file server you added. If you selected **Now**, the enabled scans start immediately. - -To check scan progress, navigate to **Configuration** > **Scan Executions**. - -## Edit a source group - -To modify an existing file server source group, navigate to **Configuration** > **Source Groups**, select the source group, and click **Edit**. The wizard reopens with your current configuration pre-populated. You can update the source group name, service account, file servers, and scan settings. diff --git a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/reports.md b/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/reports.md deleted file mode 100644 index 0c969c2a49..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/reports.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: "Reports" -description: "Pre-built reports available for SharePoint Online source groups in Access Analyzer" -sidebar_position: 50 ---- - -# Reports - -After the first scan of a SharePoint Online source group completes, three pre-built reports become available under the Reports section. These reports help you answer key security questions about your SharePoint environment: which files carry sensitive data, how broadly content is shared, and where stale or redundant data accumulates across your sites. - -## Available reports - -| Location | Report | Description | -|----------|--------|-------------| -| Access / Shared Links Report | Shared Links Report | Shows all sharing links across your SharePoint environment, with breakdowns by sharing scope (organization, anonymous, specific people), active status, sensitive data type, and site. Use this report to identify overly broad sharing and links that expose sensitive files. | -| Content / ROT Analysis | ROT Analysis | Identifies Redundant, Obsolete, and Trivial (ROT) data across your SharePoint sites, including stale files not modified in over a year, duplicate files by content hash, and stale files containing sensitive data. Use this report to prioritize data cleanup and reduce unnecessary exposure of aging content. | -| Content / Scan Overview | Scan Overview | Summarizes the results of the most recent scan across all sites, including total site count, file count, total storage, and files with sensitive data. Use this report to confirm scan coverage and quickly identify which sites hold the most sensitive content. | diff --git a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/scanning-options.md b/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/scanning-options.md deleted file mode 100644 index e3c0f3eab3..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/scanning-options.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: "Scanning options" -description: "Available scan types and configuration options for SharePoint Online source groups" -sidebar_position: 2 ---- - -# Scanning options - -| Scan type | Description | -| --- | --- | -| **Access scan** | Enumerates sites, document libraries, folders, and files. Collects permissions, ACLs, sharing links, and Microsoft Information Protection (MIP) sensitivity labels across the tenant. The first scan runs in full; subsequent scans collect only changes since the last run. | -| **Sensitive Data scan** | Reads file contents to classify sensitive data. Requires a completed Access scan — it uses the site and file inventory from the Access scan as its input. | - -## Access scan configuration - -| Option | Description | -| --- | --- | -| **Include site URLs** | Limits the scan to specific site collections. Enter one URL per line. Leave empty to scan all sites in the tenant. | -| **Exclude site URLs** | Excludes specific site collections from the scan. Enter one URL per line. Exclusions take precedence over inclusions. | -| **Scan OneDrive** | When enabled, includes OneDrive personal site collections in the scan. Enabled by default. | - -The Access scan also reads Microsoft Information Protection (MIP) sensitivity labels from SharePoint item metadata and stores them alongside the permission data. Access Analyzer reads existing labels only — it doesn't support writing or modifying MIP labels on SharePoint Online items. - -## Sensitive Data scan - -The Sensitive Data scan reads file contents to detect and classify sensitive information. It runs after the Access scan completes and uses the file inventory collected during that scan. - -You configure sensitive data classification policies, MIP label mappings, and optical character recognition (OCR) settings globally, and they apply to all source groups. To configure them, navigate to **Configuration** > **Sensitive Data**. See [Sensitive Data Configuration](../../configurations/sensitive-data.md) for details. diff --git a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/schema-reference.md b/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/schema-reference.md deleted file mode 100644 index 77f65abea0..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/schema-reference.md +++ /dev/null @@ -1,166 +0,0 @@ ---- -title: "Schema reference" -sidebar_position: 40 ---- - -# SharePoint Online schema reference - -Access Analyzer stores SharePoint Online scan data in the `access_analyzer` ClickHouse database. Setting up a SharePoint Online source group and running a scan creates the following tables. Use this reference when querying scan data directly or integrating Access Analyzer data with external tools. - -:::note -All tables use the `ReplacingMergeTree` engine. The engine deduplicates rows with the same primary key at merge time. Query the `_latest` views to return only the most recent version of each record. -::: - -## Metadata columns - -All tables include the following columns, which Access Analyzer populates during each scan: - -| Column | Type | Description | -|--------|------|-------------| -| `scan_id` | `String` | Identifier of the source group that produced this record. | -| `scan_execution_id` | `String` | Identifier of the specific scan run. | -| `scanned_at` | `DateTime` | Timestamp when the record was written. | - ---- - -## Tables - -### sharepoint_online_objects - -Stores one row per scanned SharePoint item — sites, lists, document libraries, and list items (files and folders). - -| Column | Type | Description | -|--------|------|-------------| -| `site_hostname` | `String` | Hostname of the SharePoint site collection (for example, `contoso.sharepoint.com`). | -| `site_id` | `String` | SharePoint identifier of the site collection. | -| `item_id` | `String` | Unique identifier of the item within the site. | -| `site_url` | `String` | Absolute URL of the site collection. | -| `drive_id` | `String` | Microsoft Graph drive identifier for the document library that contains this item. Empty for sites and lists that don't have a drive. | -| `drive_item_id` | `String` | Microsoft Graph drive item identifier. Empty for items that aren't drive items. | -| `item_type` | `Enum8` | Type of SharePoint item. Values: `SITE`, `LIST`, `LIBRARY`, `LIST_ITEM`. | -| `name` | `String` | Display name of the item. | -| `file_extension` | `String` | File extension, including the leading period (for example, `.docx`). Empty for non-file items. | -| `relative_url` | `String` | Server-relative URL path of the item. | -| `file_size` | `Nullable(Int64)` | Optional. File size in bytes. Null for items that aren't files. | -| `created_time` | `DateTime` | Timestamp when the item was created in SharePoint. | -| `created_by_id` | `String` | SharePoint user identifier of the user who created the item. | -| `created_by_email` | `String` | Email address of the user who created the item. | -| `modified_time` | `DateTime` | Timestamp of the most recent modification. | -| `modified_by_id` | `String` | SharePoint user identifier of the user who last modified the item. | -| `modified_by_email` | `String` | Email address of the user who last modified the item. | -| `parent_item_id` | `String` | `item_id` of the parent item. Empty for top-level sites. | -| `scan_status` | `String` | Result of scanning this item. Typical values: `SUCCESS`, `ERROR`. | -| `error_message` | `String` | Error detail when `scan_status` is `ERROR`. Empty on success. | -| `is_complete` | `Boolean` | Indicates whether the scan wrote all expected records for this item. Used internally to support scan resume. | - -**Primary key:** `(site_hostname, site_id, item_id)` - -**Relations** - -| Related table | Join columns | Description | -|---|---|---| -| `sharepoint_online_permissions` | `site_hostname`, `site_id`, `item_id` | All permissions assigned to this item. | -| `sharepoint_online_shared_links` | `site_hostname`, `site_id`, `item_id` | All sharing links created for this item. | -| `sharepoint_online_sensitive_data` | `drive_id`, `drive_item_id` | Classification results for this item. Only populated for drive items. | - ---- - -### sharepoint_online_permissions - -Stores one row per permission assignment. Each row represents a single principal (user or group) having a specific permission on a specific item. - -| Column | Type | Description | -|--------|------|-------------| -| `site_hostname` | `String` | Hostname of the site collection that contains the item. | -| `site_id` | `String` | SharePoint identifier of the site collection. | -| `item_id` | `String` | Identifier of the item this permission applies to. | -| `permission_id` | `String` | SharePoint identifier of the permission entry. | -| `share_id` | `String` | Identifier of the sharing link that granted this permission. Empty for direct permissions. | -| `principal_id` | `String` | Identifier of the user or group that holds the permission. | -| `principal_type` | `Enum8` | Type of the principal. Values: `USER`, `GROUP`, `SITE_USER`, `SITE_GROUP`. | -| `principal_name` | `String` | Display name of the principal. | -| `principal_email` | `String` | Email address of the principal. Empty for groups that don't have an email address. | -| `permission_type` | `Enum8` | How the permission was granted. Values: `DIRECT` (assigned directly to the item), `SHARED` (granted through a sharing link). | -| `permission_levels` | `Array(Enum8)` | Named permission levels assigned to the principal. Values: `OWNER`, `READ`, `WRITE`. | -| `effective_base_permissions` | `Array(Enum8)` | Full set of granular SharePoint base permissions the principal holds. Values include `VIEW_LIST_ITEMS`, `ADD_LIST_ITEMS`, `EDIT_LIST_ITEMS`, `DELETE_LIST_ITEMS`, `MANAGE_LISTS`, `MANAGE_PERMISSIONS`, `MANAGE_WEB`, and others as defined by the SharePoint permission model. | -| `normalized_permissions` | `FixedString(5)` | Compact bitmask representation of the permission levels. Used internally for permission comparison. | -| `parent_site_id` | `String` | Identifier of the site collection from which this permission is inherited. Empty for permissions that aren't inherited. | -| `parent_item_id` | `String` | `item_id` of the item from which this permission is inherited. Empty for permissions assigned directly to this item. | -| `is_site_admin` | `Bool` | `true` if the principal is a site collection administrator. | -| `is_external_user` | `Bool` | `true` if the principal is a guest or external user. | -| `mip_label_id` | `Nullable(String)` | Optional. Microsoft GUID of the Microsoft Information Protection sensitivity label applied to the SharePoint item at the time of the scan. | -| `mip_label_name` | `Nullable(String)` | Optional. Display name of the sensitivity label identified by `mip_label_id`. | - -**Primary key:** `(site_hostname, site_id, item_id, permission_id, principal_id)` - -**Relations** - -| Related table | Join columns | Description | -|---|---|---| -| `sharepoint_online_objects` | `site_hostname`, `site_id`, `item_id` | The item this permission applies to. | -| `sharepoint_online_shared_links` | `site_hostname`, `site_id`, `item_id`, `share_id` | The sharing link that granted this permission, when `permission_type` is `SHARED`. | - ---- - -### sharepoint_online_shared_links - -Stores one row per sharing link. A sharing link may grant access to one or more principals; the corresponding permission rows appear in `sharepoint_online_permissions`. - -| Column | Type | Description | -|--------|------|-------------| -| `site_hostname` | `String` | Hostname of the site collection that contains the item. | -| `site_id` | `String` | SharePoint identifier of the site collection. | -| `item_id` | `String` | Identifier of the item the sharing link points to. | -| `permission_id` | `String` | SharePoint permission identifier associated with the sharing link. | -| `share_id` | `String` | Unique identifier of the sharing link. | -| `link_type` | `Enum8` | Access level granted by the link. Values: `VIEW`, `EDIT`, `EMBED`, `REVIEW`. | -| `link_url` | `String` | Full URL of the sharing link. | -| `link_scope` | `Enum8` | Audience the link is accessible to. Values: `ANONYMOUS` (anyone with the link), `ORGANIZATION` (anyone in the organization), `USERS` (specific users only). | -| `expires_on` | `DateTime` | Expiration timestamp of the link. A zero value indicates the link doesn't expire. | -| `is_password_protected` | `Bool` | `true` if the link requires a password to access. | -| `prevent_download` | `Bool` | `true` if the link prevents recipients from downloading the file. | - -**Primary key:** `(site_hostname, site_id, item_id, permission_id, share_id)` - -**Relations** - -| Related table | Join columns | Description | -|---|---|---| -| `sharepoint_online_objects` | `site_hostname`, `site_id`, `item_id` | The item the sharing link provides access to. | -| `sharepoint_online_permissions` | `site_hostname`, `site_id`, `item_id`, `share_id` | Permissions granted through the sharing link. | - ---- - -### sharepoint_online_sensitive_data - -Stores classification results from the sensitive data scan option. Each row represents one taxonomy term matched in a drive item. Multiple rows may exist for the same item when the item matches terms from multiple taxonomies. - -| Column | Type | Description | -|--------|------|-------------| -| `drive_id` | `String` | Microsoft Graph drive identifier of the document library that contains the item. | -| `drive_item_id` | `String` | Microsoft Graph drive item identifier of the classified file. | -| `taxonomy_name` | `String` | Name of the classification taxonomy (for example, `PII`, `Financial Records`). | -| `term_name` | `String` | Name of the specific classification term within the taxonomy (for example, `Credit Card Number`, `Social Security Number`). | -| `processing_time_seconds` | `Float32` | Time in seconds that the classification engine spent processing this item. | -| `classification_method` | `Nullable(Enum8)` | Optional. Method used to classify this item. Values: `SDK_AUTO` (automatic classification by the built-in engine), `SDK_CUSTOM` (classification using custom rules). | - -**Primary key:** `(drive_id, drive_item_id, taxonomy_name, term_name)` - -**Relations** - -| Related table | Join columns | Description | -|---|---|---| -| `sharepoint_online_objects` | `drive_id`, `drive_item_id` | The scanned item that produced these classification results. | - ---- - -## Views - -Access Analyzer creates views that simplify common queries. Use views instead of querying base tables directly. - -| View | Base table | Description | -|------|------------|-------------| -| `sharepoint_online_objects_latest` | `sharepoint_online_objects` | Returns only the most recent version of each object record, deduplicated by `(site_hostname, site_id, item_id)`. | -| `sharepoint_online_permissions_latest` | `sharepoint_online_permissions` | Returns only the most recent version of each permission record, deduplicated by `(site_hostname, site_id, item_id, permission_id, principal_id)`. | -| `sharepoint_online_shared_links_latest` | `sharepoint_online_shared_links` | Returns only the most recent version of each sharing link record, deduplicated by `(site_hostname, site_id, item_id, permission_id, share_id)`. | -| `sharepoint_online_sensitive_data_latest` | `sharepoint_online_sensitive_data` | Returns one aggregated row per drive item, with `taxonomy_names` and `term_names` as arrays collecting all matched taxonomy and term names. Deduplicated by `(drive_id, drive_item_id)`. | diff --git a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/set-up-source-group.md b/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/set-up-source-group.md deleted file mode 100644 index 870ea325b1..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/set-up-source-group.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: "Set up a SharePoint Online source group" -description: "Configure a SharePoint Online source group in Access Analyzer" -sidebar_position: 3 ---- - -# Set up a SharePoint Online source group - -1. Navigate to **Configuration** > **Source Groups** and click **Add Source**. The source group wizard opens. - -2. Select **SharePoint Online** and click **Next**. - -3. Enter a **Source Group Name**. - -4. Select a service account from the **Service Account** dropdown, or click **+** to create one inline. SharePoint Online requires a **Client ID and Certificate** service account type with specific API permissions. See [Required permissions](../../connectors/sharepoint-online/azure-permissions.md#required-permissions) for the full list of permissions, and [Service Accounts](../../configurations/service-accounts/overview.md) for details on creating a service account. - -5. Enter the **Tenant ID** for your Microsoft Entra ID directory. This must be a valid UUID (for example, `550e8400-e29b-41d4-a716-446655440000`). - -6. Under **Certificate**, click **Generate and Download Certificate** to download a new certificate to your machine. Upload this certificate to your registered Entra ID application before proceeding. See [Certificate Configuration](../../connectors/sharepoint-online/tenant-certificate-config.md) for upload steps. - - :::note - If you click **Regenerate Certificate**, upload the new certificate to your Entra ID App Registration to replace the old one. Removing the old certificate from the App Registration is a manual step in the Azure portal — Access Analyzer can't remove it on your behalf. - ::: - -7. Click **Test Connection** to verify that Access Analyzer can authenticate to your SharePoint Online tenant. Resolve any failures before proceeding. - - :::warning - After you upload a new certificate to your Entra ID application, Microsoft Entra ID can take several minutes to propagate the certificate to its token-issuing endpoints. During that time, **Test Connection** can fail with an error similar to `AADSTS700027: The certificate with identifier used to sign the client assertion is not registered on application`. If that happens, wait a few minutes and try again before troubleshooting further. - ::: - -8. Click **Next**. - -9. Under **Scan Configuration**, configure the options for the scans you want to run: - - - **Include site URLs** — Limits the scan to specific site collections. Enter one URL per line. Leave empty to scan all sites in the tenant. - - **Exclude site URLs** — Excludes specific site collections from the scan. Exclusions take precedence over inclusions. - - **Scan OneDrive** — Includes OneDrive personal site collections in the scan. - - See [Scanning options](./scanning-options.md) for a full description of available scan types and options. - -10. Under **Scan Schedule**, select when to run the scan: - - - **Now** — Starts the scan immediately after setup completes. - - **At** — Runs the scan once at a specific date and time. - - **Advanced** — Runs the scan on the recurring schedule you define with a cron expression. - -11. Click **Complete Setup**. - -## What happens next - -Access Analyzer creates the source group and begins scanning your SharePoint Online environment. If you selected **Now**, the scan starts immediately. - -To check scan progress, navigate to **Configuration** > **Scan Executions**. - -## Edit a source group - -To modify an existing SharePoint Online source group, navigate to **Configuration** > **Source Groups**, select the source group, and click **Edit**. The wizard reopens and displays your current configuration. You can update the source group name, service account, tenant ID, scan configuration, and scan schedule. - -:::note -Updating the service account replaces the certificate that Access Analyzer uses to authenticate with SharePoint Online. Upload the new service account's certificate to your registered Entra ID application before saving. -::: diff --git a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/sharepoint-online.md b/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/sharepoint-online.md deleted file mode 100644 index 39a5e5b55f..0000000000 --- a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/sharepoint-online.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: "SharePoint Online Scanning Overview" -description: "Overview of SharePoint Online scanning capabilities and prerequisites in Access Analyzer" -sidebar_position: 1 ---- - -# SharePoint Online Scanning Overview - -Access Analyzer scans SharePoint Online sites to map permissions, enumerate sharing links, and locate sensitive data across your tenant's document libraries and sites. It surfaces over-permissioned sites, anonymous and organization-wide sharing links, and files that contain sensitive content — giving security teams the information they need to reduce external exposure, enforce sharing policies, and meet cloud data governance requirements. - -## Prerequisites - -Before setting up a SharePoint Online source group, confirm that your environment meets the following requirements. The source group wizard connects to SharePoint Online over HTTPS using certificate-based authentication, so the Access Analyzer server must be able to reach the Microsoft identity platform, and you must configure an app registration in your tenant. The wizard generates the certificate — you'll need the application's Client ID before you begin. - -### Service account - -Access Analyzer uses a Client ID and Certificate service account to authenticate with SharePoint Online. You enter only the Client ID when creating the service account — Access Analyzer generates the certificate automatically during source group setup when you click **Generate and Download Certificate**. You then upload the certificate to your registered Entra ID application before you can test the connection. - -See [Client ID/Certificate service account](../../configurations/service-accounts/client-id-certificate.md) to create the service account and [SharePoint Online Connector Requirements](../../connectors/sharepoint-online/overview.md) for instructions on registering the application. - -### Network requirements - -| Protocol | Port | Destination | -| --- | --- | --- | -| HTTPS | 443 | Microsoft identity platform (`login.microsoftonline.com`) | -| HTTPS | 443 | Microsoft Graph API (`graph.microsoft.com`) | -| HTTPS | 443 | SharePoint Online (`.sharepoint.com`) | - -### Before you begin - -- A registered application in your Entra ID tenant. -- The application's **Tenant ID** and **Client ID**. -- A Client ID and Certificate service account created in Access Analyzer. -- Network connectivity from the Access Analyzer server to port 443 confirmed. - -:::note -Access Analyzer reads Microsoft Information Protection (MIP) sensitivity labels on SharePoint Online files during Sensitive Data scans. It collects the labels and surfaces them in scan results, and it makes no changes to labels on any scanned file. -::: - -:::note -**Sensitive Data scans require a completed Access scan.** The Access scan builds the site and document library inventory that the Sensitive Data scan uses. Run the Access scan first, then enable Sensitive Data on a subsequent scan. Enabling both on the very first scan is supported but will extend the initial scan duration. -::: diff --git a/docs/accessanalyzer/2601/index.md b/docs/accessanalyzer/2601/index.md deleted file mode 100644 index 74e897b9fa..0000000000 --- a/docs/accessanalyzer/2601/index.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: "Netwrix Access Analyzer Documentation" -description: "Netwrix Access Analyzer 1.0 product documentation - on-premises DSPM platform for data security and access analysis" -sidebar_position: 1 ---- - -# Netwrix Access Analyzer Documentation - -Netwrix Access Analyzer is an on-premises Data Security Posture Management (DSPM) platform that helps organizations discover, classify, and monitor sensitive data across enterprise file systems. Deployed entirely within your own infrastructure, it provides comprehensive visibility into data access patterns, identifies compliance risks, and enables data governance — without sending data to the cloud. - -## Key Capabilities - -- **Data Source Scanning** — Connect to CIFS/SMB file shares and other on-premises data repositories to discover and analyze data -- **Sensitive Data Discovery** — Detect sensitive data using built-in and custom regex patterns with taxonomy-based classification -- **Identity and Access Management** — Sync users and groups from Active Directory and Entra ID to analyze permission paths -- **Dashboards and Reporting** — Visualize security posture with built-in dashboards and embedded Metabase reports - -## Documentation Sections - -- [Overview](overview/overview.md) — Introduction to the product, key concepts, requirements, and installation -- [Getting Started](gettingstarted/active-directory/active-directory.md) — Step-by-step guides for your first scans and syncs diff --git a/docs/accessanalyzer/2601/install/identity-provider.md b/docs/accessanalyzer/2601/install/identity-provider.md deleted file mode 100644 index 80c62fdb3b..0000000000 --- a/docs/accessanalyzer/2601/install/identity-provider.md +++ /dev/null @@ -1,553 +0,0 @@ ---- -title: "Configure Identity Provider" -description: "Deployment steps for connecting an Identity Provider to Access Analyzer using the installer" -sidebar_position: 50 -draft: true ---- - -# Configure Identity Provider - -:::note -This article is for the team performing the Access Analyzer deployment. It covers the installer flags required to connect an identity provider at install time. If you are an application administrator setting up user accounts after the IdP connection is in place, see [Identity Provider](../configurations/identity-provider.md). -::: - -**Related reading:** - -- [Quick Install](quickinstall.md) — Active Directory deployment using environment variables, end-to-end -- [Installer Command Reference](install-commands.md) — full catalog of every installer flag and environment variable -- [TLS Certificate Requirements](system/certificates.md) — certificate formats, SAN rules, CA bundle preparation - -Access Analyzer supports connecting an identity provider (IdP) so users authenticate through your organization's directory rather than with local credentials. IdP federation is **optional** — if you omit `--idp-type` at install time, Access Analyzer deploys without Keycloak and uses local accounts only. - -When you configure `--idp-type`, the installer automatically: - -1. Deploys Keycloak (v26.5.3) as part of the cluster -2. Waits for Keycloak to become healthy -3. Creates the IdP federation using the flags you provided -4. Enables OpenID Connect (OIDC) authentication in the Access Analyzer application - -## Before you begin - -Confirm the following before running the installer with IdP flags: - -- Your infrastructure meets the Access Analyzer cluster system requirements — see [Hardware and System Requirements](system/requirements.md) -- You have prepared and placed TLS certificates on the VM — see [TLS Certificate Requirements](system/certificates.md) -- You have collected the required credentials from the customer's IdP or directory administrator (see [Identity Provider — Part 1](../configurations/identity-provider.md#part-1-configure-your-identity-provider)) -- For LDAP/AD: the Access Analyzer server has network access to the LDAP server on port 636 (LDAPS) or 389 (LDAP) -- For a private CA certificate: you have the PEM file available on the server and will pass `--ca-bundle ` to the installer - -:::warning -`--hostname` is required and must: - -- Be a real DNS hostname (not an IP address — IPs will not work because the browser TLS handshake requires the hostname in the certificate's Subject Alternative Name (SAN)). -- Be lowercase, and match lowercase in the certificate SAN list. Keycloak derives its OIDC issuer URL from this value; a case mismatch between SAN and browser-normalized hostname produces HTTP 401 at sign-in. -- Resolve the same from client browsers and in-cluster pods. The installer configures the in-cluster rewrite automatically; the customer is responsible for the public DNS record or `/etc/hosts` entry that client browsers use. -- Avoid the `.local` and `.localhost` TLDs — both break in-cluster DNS resolution and silently break OIDC login flows. - -For full certificate format and preparation details, see [TLS Certificate Requirements](system/certificates.md). -::: - -## Choosing an IdP type - -| `--idp-type` value | Use case | -| --- | --- | -| `ad` | Active Directory via LDAP (on-premises) | -| `ldap` | Generic LDAP | - - - -:::note -`--idp-alias` must match `[A-Za-z0-9._-]+` — letters, digits, hyphens, underscores, and dots only. Spaces aren't allowed. The alias appears as the label on the login button. -::: - - - -## Configure Active Directory - -:::tip -For a step-by-step end-to-end walkthrough using environment variables (recommended for most customers), see the [Quick Install](quickinstall.md). This section is the flag-level reference. -::: - -**Required flags:** `--idp-type ad`, `--idp-alias`, `--ldap-url`, `--ldap-bind-dn`, `--ldap-users-dn` - -**Optional:** `--ldap-email-attribute` (default: `mail`) - -**Prompted secret:** LDAP bind credential — entered interactively, never written to disk or logs - -If an internal CA not in the OS trust store (typical for on-prem AD) signs your domain controller's LDAPS certificate, pass the root CA cert via `--ca-bundle`. Without it, Keycloak's LDAPS handshake to the DC will fail with a TLS trust error. The CA that signed the DC's LDAPS certificate may be different from the CA that signed your Access Analyzer server's TLS certificate — verify the DC's cert chain specifically. See [TLS Certificate Requirements](system/certificates.md) for details on assembling the CA bundle. - -```bash -export LICENSE_KEY='[YOUR_LICENSE_KEY]' - -curl -sLfo - "https://raw.pkg.keygen.sh/v1/accounts/netwrix/artifacts/dspm-install.sh?auth=license:$LICENSE_KEY" | bash -s -- \ - --hostname aa2601.corp.example.com \ - --tls-cert /opt/dspm-tls/aa2601.crt \ - --tls-key /opt/dspm-tls/aa2601.key \ - --ca-bundle /opt/dspm-tls/ca-bundle.crt \ - --idp-type ad \ - --idp-alias active-directory \ - --ldap-url ldaps://dc.corp.example.com:636 \ - --ldap-bind-dn "CN=svc-dspm,OU=ServiceAccounts,DC=corp,DC=example,DC=com" \ - --ldap-users-dn "OU=Users,DC=corp,DC=example,DC=com" -``` - -Replace the LDAP URL with the customer's domain controller address (LDAPS on port 636 recommended). When prompted, enter the bind account password. - -The `ad` type uses Active Directory–specific defaults: `sAMAccountName` for the username attribute and `objectGUID` for the UUID attribute. - -## Configure Generic LDAP - -Use this type for OpenLDAP and other non-AD LDAP directories. - -**Required flags:** `--idp-type ldap`, `--idp-alias`, `--ldap-url`, `--ldap-bind-dn`, `--ldap-users-dn` - -**Optional:** `--ldap-email-attribute` (default: `mail`) - -**Prompted secret:** LDAP bind credential - -```bash -export LICENSE_KEY='[YOUR_LICENSE_KEY]' - -curl -sLfo - "https://raw.pkg.keygen.sh/v1/accounts/netwrix/artifacts/dspm-install.sh?auth=license:$LICENSE_KEY" | bash -s -- \ - --hostname aa2601.corp.example.com \ - --tls-cert /opt/dspm-tls/aa2601.crt \ - --tls-key /opt/dspm-tls/aa2601.key \ - --ca-bundle /opt/dspm-tls/ca-bundle.crt \ - --idp-type ldap \ - --idp-alias ldap \ - --ldap-url ldaps://ldap.corp.example.com:636 \ - --ldap-bind-dn "CN=svc-dspm,OU=ServiceAccounts,DC=corp,DC=example,DC=com" \ - --ldap-users-dn "OU=Users,DC=corp,DC=example,DC=com" -``` - -As with the Active Directory section, pass `--ca-bundle` with the root CA cert that signed the directory's LDAPS certificate when it isn't in the OS trust store. - -The `ldap` type uses generic LDAP defaults: `uid` for the username attribute and `entryUUID` for the UUID attribute. - -## Recover from a failed IdP configuration - -If IdP configuration fails after the cluster is already running, use `--configure-idp-only` to retry without reinstalling K3s or ArgoCD: - -```bash -curl -sLfo - "https://raw.pkg.keygen.sh/v1/accounts/netwrix/artifacts/dspm-install.sh?auth=license:$LICENSE_KEY" | bash -s -- \ - --configure-idp-only \ - --idp-type ad \ - --idp-alias active-directory \ - --ldap-url ldaps://dc.corp.example.com:636 \ - --ldap-bind-dn "CN=svc-dspm,OU=ServiceAccounts,DC=corp,DC=example,DC=com" \ - --ldap-users-dn "OU=Users,DC=corp,DC=example,DC=com" -``` - -:::note -`--configure-idp-only` doesn't require `--license-key`. It skips all infrastructure provisioning steps and runs only the IdP configuration phase. -::: - -## Next steps - -After the installer completes IdP configuration, the application administrator must pre-provision user accounts in Access Analyzer before any users can sign in. See [Identity Provider](../configurations/identity-provider.md#pre-provision-user-accounts). - -## Manual configuration reference - -The installer automates all of the following steps. Use this section only if you need to reconfigure or troubleshoot an IdP connection on a cluster that is already running, without re-running the installer. - -### Authenticate to the Keycloak Admin CLI - -Run this step before any manual configuration. It authenticates the Keycloak Admin CLI inside the pod using the bootstrap credentials injected at deploy time. - -```bash -kubectl exec -n access-analyzer statefulset/keycloak -- bash -c ' - /opt/keycloak/bin/kcadm.sh config credentials \ - --server http://localhost:8080/auth \ - --realm master \ - --user "$KC_BOOTSTRAP_ADMIN_USERNAME" \ - --password "$KC_BOOTSTRAP_ADMIN_PASSWORD"' -``` - -:::note -Keycloak reads the bootstrap admin credentials from environment variables already present in the pod. Don't pass them as command-line arguments — they would appear in Kubernetes audit logs. -::: - - - -### Configure LDAP / Active Directory — manual - -**Required values:** LDAP server URL, service account DN, service account password, users base DN - -**Step 1 — Create the LDAP User Federation component** - -```bash -LDAP_ID=$(kubectl exec -i -n access-analyzer statefulset/keycloak -- bash <"]' \ - -s 'config.bindDn=[""]' \ - -s 'config.bindCredential=[""]' \ - -s 'config.usersDn=[""]' \ - -s 'config.usernameLDAPAttribute=["sAMAccountName"]' \ - -s 'config.rdnLDAPAttribute=["cn"]' \ - -s 'config.uuidLDAPAttribute=["objectGUID"]' \ - -s 'config.userObjectClasses=["person,organizationalPerson,user"]' \ - -s 'config.searchScope=["2"]' \ - -s 'config.importEnabled=["true"]' \ - -s 'config.syncRegistrations=["false"]' \ - -o --fields id | grep '"id"' | sed 's/.*"id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/' -EOF -) -``` - -**Step 2 — Add the email attribute mapper** - -```bash -kubectl exec -n access-analyzer statefulset/keycloak -- \ - /opt/keycloak/bin/kcadm.sh create components -r dspm \ - -s name=email-mapper \ - -s providerType=org.keycloak.storage.ldap.mappers.LDAPStorageMapper \ - -s providerId=user-attribute-ldap-mapper \ - -s "parentId=$LDAP_ID" \ - -s '{"ldap.attribute":["mail"],"is.mandatory.in.ldap":["false"],"always.read.value.from.ldap":["false"],"read.only":["true"],"user.model.attribute":["email"]}' -``` - -**Step 3 — Add the provider attribute mapper** - -```bash -kubectl exec -n access-analyzer statefulset/keycloak -- \ - /opt/keycloak/bin/kcadm.sh create components -r dspm \ - -s name=ldap-provider-attribute \ - -s providerType=org.keycloak.storage.ldap.mappers.LDAPStorageMapper \ - -s providerId=hardcoded-attribute-mapper \ - -s "parentId=$LDAP_ID" \ - -s '{"attribute.value":["ldap"],"user.model.attribute":["ldap_provider"]}' -``` - -**Step 4 — Add the realm protocol mapper** - -```bash -kubectl exec -n access-analyzer statefulset/keycloak -- \ - /opt/keycloak/bin/kcadm.sh create protocol-mappers/models -r dspm \ - --body '{ - "name": "ldap-identity-provider-claim", - "protocol": "openid-connect", - "protocolMapper": "oidc-usermodel-attribute-mapper", - "config": { - "user.attribute": "ldap_provider", - "claim.name": "identity_provider", - "jsonType.label": "String", - "id.token.claim": "true", - "access.token.claim": "true", - "userinfo.token.claim": "true" - } - }' -``` - -### Verify the configuration — manual - -**LDAP (component check only):** - -```bash -TYPE=ldap ./scripts/verify-idp-config.sh -``` - -**LDAP (with connectivity test):** - -```bash -TYPE=ldap \ -LDAP_URL= \ -LDAP_BIND_DN= \ -LDAP_BIND_CREDENTIAL= \ -./scripts/verify-idp-config.sh -``` - -## Troubleshooting IdP configuration - -IdP configuration runs as the final step of the installer, after Keycloak is healthy. A failure here means the cluster and applications are running correctly — only the identity federation is missing. - -### Check the installer log - -The installer log contains the full `kcadm.sh` output: - -```bash -grep -A 20 "Configuring IdP federation" /var/log/dspm-installer.log -``` - -### Common error messages - -| Message | Likely cause | -| --- | --- | -| `Failed to authenticate with Keycloak admin CLI` | Keycloak pod not ready; see [Check Keycloak pod health](#check-keycloak-pod-health) | -| `409 Conflict` from `kcadm.sh create` | An IdP with this alias already exists in Keycloak | -| `PKIX path building failed` in Keycloak logs (LDAP sign-ins fail silently) | CA bundle is missing the LDAPS DC's CA — see [TLS Certificate Requirements](system/certificates.md#multi-domain-and-multi-ca-environments) | - -### Check Keycloak pod health - -```bash -# Confirm the pod is running -kubectl get pods -n access-analyzer -l app=keycloak - -# Check for recent errors in the Keycloak logs -kubectl logs -n access-analyzer statefulset/keycloak --tail=50 -``` - -### Retry using --configure-idp-only - -If the cluster is healthy but IdP configuration failed, re-run the installer with `--configure-idp-only`. This skips K3s and ArgoCD entirely and retries only the Keycloak configuration: - -```bash -curl -sLfo - "https://raw.pkg.keygen.sh/v1/accounts/netwrix/artifacts/dspm-install.sh?auth=license:$LICENSE_KEY" | bash -s -- \ - --configure-idp-only \ - --hostname aa2601.corp.example.com \ - --ca-bundle /opt/dspm-tls/ca-bundle.crt \ - --idp-type \ - --idp-alias \ - # ...same --idp-* flags used during the original install -``` - -`--configure-idp-only` doesn't require `--license-key`. - -### If retry fails with 409 Conflict - -If a previous partial run created the IdP instance in Keycloak before failing (for example, during mapper creation), the retry fails with a `409 Conflict`. Remove the partial IdP first using `kcadm.sh` inside the Keycloak pod. - -Authenticate first: - -```bash -kubectl exec -n access-analyzer statefulset/keycloak -- \ - /opt/keycloak/bin/kcadm.sh config credentials \ - --server http://localhost:8080/auth --realm master \ - --user "$KC_BOOTSTRAP_ADMIN_USERNAME" \ - --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" -``` - -For **LDAP or AD** IdPs (child mappers cascade-delete automatically): - -```bash -LDAP_ID=$(kubectl exec -n access-analyzer statefulset/keycloak -- \ - /opt/keycloak/bin/kcadm.sh get components -r dspm \ - -q name= \ - -q type=org.keycloak.storage.UserStorageProvider \ - --fields id -c \ - | python3 -c "import sys,json; d=json.load(sys.stdin); print(d[0]['id'] if d else '')") - -kubectl exec -n access-analyzer statefulset/keycloak -- \ - /opt/keycloak/bin/kcadm.sh delete components/"${LDAP_ID}" -r dspm -``` - -Replace `` with the value you passed to `--idp-alias` during the failed install. Then re-run `--configure-idp-only`. diff --git a/docs/accessanalyzer/2601/install/install-commands.md b/docs/accessanalyzer/2601/install/install-commands.md deleted file mode 100644 index 9626d78acd..0000000000 --- a/docs/accessanalyzer/2601/install/install-commands.md +++ /dev/null @@ -1,302 +0,0 @@ ---- -title: "Installer Command Reference" -description: "Options you can pass to the Access Analyzer installer to customize your deployment" -sidebar_position: 20 -draft: true ---- - -# Installer Command Reference - -You install Access Analyzer using a single curl command that downloads and runs the installer. You can pass options to this command to customize how the installer deploys the product on your server. Most installations need only a license key and accept all defaults. - -## Before You Run the Installer - -### Set your license key - -Export your license key as an environment variable before running any installer command. This keeps the key out of your shell history and makes it available to the installer automatically. - -```bash -export LICENSE_KEY="[YOUR_LICENSE_KEY]" -``` - -Replace "[YOUR_LICENSE_KEY]" with the license key Netwrix provided. All examples on this page assume you have exported this variable. - -:::warning -Your license key authenticates access to the Netwrix package registry. Don't share it, commit it to version control, or leave it visible in script files. -::: - -### Choose an installer version - -If you don't specify a version, the installer downloads the latest stable release automatically. This is appropriate for initial deployments and any time you want the latest release: - -```bash -# Set the Keygen license key variable -export LICENSE_KEY='[YOUR_LICENSE_KEY]' - -# Download and install the DSPM installer binary for your Linux system architecture (x86_64 or ARM64) using your license key. -ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') -TMP_FILE=$(mktemp) -curl -sLf -o "$TMP_FILE" "https://raw.pkg.keygen.sh/v1/accounts/netwrix/artifacts/dspm-installer-linux-$ARCH?auth=license:$LICENSE_KEY&channel=stable" -sudo install -m 0755 "$TMP_FILE" "/usr/local/bin/dspm-installer" -rm -f "$TMP_FILE" - -# Launches the installer -sudo dspm-installer -``` - -Run `dspm-installer [command] --help` to view usage and available options for any command. - -Netwrix recommends pinning to a specific release to control when upgrades happen during your organization's patching cycle. **To pin to a specific release**, export the version before downloading and running the installer: - -```bash -# Set the Keygen license key variable -export LICENSE_KEY='[YOUR_LICENSE_KEY]' - -# Pin to a specific release version -export TARGET_REVISION='[VERSION]' - -# Download and install the DSPM installer binary for your Linux system architecture (x86_64 or ARM64) using your license key. -ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') -TMP_FILE=$(mktemp) -curl -sLf -o "$TMP_FILE" "https://raw.pkg.keygen.sh/v1/accounts/netwrix/artifacts/dspm-installer-linux-$ARCH?auth=license:$LICENSE_KEY&channel=stable" -sudo install -m 0755 "$TMP_FILE" "/usr/local/bin/dspm-installer" -rm -f "$TMP_FILE" - -# Launches the installer -sudo dspm-installer -``` - -Run `dspm-installer [command] --help` to view usage and available options for any command. - - -Version strings control which release the installer installs and what auto-upgrades apply: - -| Value | Behavior | -| --- | --- | -| (unset) | Defaults to 1.* — auto-upgrades within the 1.x line; a future 2.x release doesn't install automatically | -| `1.0.8` | Pins to exactly 1.0.8 — no auto-upgrade | -| `1.*` | Auto-upgrades to any 1.x version | - -For most deployments, either omit this variable to stay on the latest release or pin to a specific version, such as `1.0.8`. - -## Environment Variables - -You can set most options as environment variables instead of command-line flags. Netwrix recommends this style for scripted or automated deployments — see the [Quick Install](quickinstall.md) for an end-to-end example. - -Export the variables before running the installer. When you set the same option as both an environment variable and a command-line flag, the flag takes precedence. - -| Environment variable | Equivalent flag | Example | -| --- | --- | --- | -| `LICENSE_KEY` | `--license-key` | `NWRX-XXXX-XXXX-XXXX` | -| `DSPM_HOSTNAME` | `--hostname` | `aa2601.corp.example.com` | -| `TARGET_REVISION` | `--target-revision` | `1.0.8` (pinned) or omit for latest | -| `SIZE` | `--size` | `small`, `medium` (default), `large`, `enterprise` | -| `TLS_CERT_FILE` | `--tls-cert` | `/opt/dspm-tls/aa2601.crt` | -| `TLS_KEY_FILE` | `--tls-key` | `/opt/dspm-tls/aa2601.key` | -| `TLS_CA_BUNDLE_FILE` | `--ca-bundle` | `/opt/dspm-tls/ca-bundle.crt` | -| `IDP_TYPE` | `--idp-type` | `ad`, `ldap` | -| `IDP_ALIAS` | `--idp-alias` | `corporate-ad` (no spaces) | -| `LDAP_URL` | `--ldap-url` | `ldaps://dc01.example.com:636` | -| `LDAP_BIND_DN` | `--ldap-bind-dn` | `CN=svc-dspm,OU=ServiceAccounts,DC=example,DC=com` | -| `LDAP_USERS_DN` | `--ldap-users-dn` | `CN=Users,DC=example,DC=com` | -| `LDAP_EMAIL_ATTRIBUTE` | `--ldap-email-attribute` | `mail` (default) | -| `LDAP_BIND_PASSWORD` | (secret — see Quick Install) | (see Quick Install) | -| `POSTGRES_DATA_DIR` | `--postgres-data-dir` | `/mnt/ssd/postgres` | -| `CLICKHOUSE_DATA_DIR` | `--clickhouse-data-dir` | `/mnt/nvme/clickhouse` | -| `ACCEPT_WARNINGS` | `--accept-warnings` | `true` | -| `LOG_LEVEL` | `--log-level` | `info` (default), `debug`, `warn`, `error` | -| `HTTP_PROXY` / `HTTPS_PROXY` | (no flag) | `http://proxy.example.com:8080` | -| `NO_PROXY` | (no flag) | `localhost,127.0.0.1,.svc,.cluster.local` | -| `SKIP_AV_CHECK` | (no flag) | `true` | -| `DRY_RUN` | `--dry-run` | `true` | - -:::note -`LDAP_BIND_PASSWORD` is the only secret environment variable, and the installer ignores any exported value. The installer always reads the bind password from an interactive prompt or piped stdin. See [Quick Install — Step 4](quickinstall.md#step-4-run-the-installer) for the interactive prompt. -::: - -## Running the Installer - -When you run the curl command, the installer automatically: - -1. Runs preflight checks to verify your system meets requirements -2. Installs Kubernetes (k3s v1.33.4, the version Netwrix validated for this release) -3. Deploys ArgoCD as the GitOps controller -4. Pulls and deploys the Access Analyzer application stack from the Netwrix registry -5. Waits for all components to become healthy - -Installation typically takes 15–30 minutes depending on network speed and hardware. - ---- - ---- - -## Identity Provider Flags - -The following table lists every identity provider (IdP) flag the installer accepts. For end-to-end examples, see one of these walkthroughs: - -- [Quick Install](quickinstall.md) — Active Directory deployment using environment variables (recommended for most customers) -- [Configure Identity Provider](identity-provider.md) — example commands for Active Directory and LDAP, plus recovery with `--configure-idp-only` - -| Flag | Default | Description | -| --- | --- | --- | -| `--idp-type ` | — | Federation type: `ad`, `ldap` | -| `--idp-alias