7696081846

ilienvault

■ creators of ossirr

1 Introduction

We are using WMI to remotely collect Microsoft Windows events and data in an agent-less way. To get these logs to the AlienVault Unified SIEM (OSSIM) you have to configure a few things on OSSIM and also on the Windows machines if you want morę security. We are using WMI to remotely collect Microsoft Windows events and data in an agentless way. To get these logs to the AlienVault Unified SIEM (OSSIM) you have to configure a few things on OSSIM and also on the Windows machines if you want morę security.

2 Configure Windows

In any case you should create a separated limited user on Windows for security reason. Don't use the administrator account in an productive environment just use it for testing. In this scenario I created a limited user called wmiuser with the password wmi. To give that limited user access to remotely login and for capturing the logs, we have to configure a few permissions in the DCOM settings. To enable the using of SDEE you must have direct access to Cisco device and also administrator credentials to change configuration. Follow the next steps:

2.1. Grant DCOM remote launch and activate permissions for the new user

1.    Click Start, click Run, type DCOMCNFG, and then click OK.

2.    In the Component Services dialog box, expand Component Services, expand Computers, and then right-dick My Computer and click Properties.

3.    Go to My ComputerDD Properties dialog box, click the COM Security tab.

4.    Under Launch and Activation Permissions (picture 1), click Edit Limits.

5.    In the Launch Permission dialog box, follow these steps to add our "wmiuser" user:

6.    In the Launch Permission dialog box, click Add.

7.    In the "Select Users, Computers, or Groups" dialog box, add your name in the "Enter the object names to select" box, and then click OK.

8.    In the Launch Permission dialog box, select our user in the "Group or user names" box. In the Allow column under Permissions for User, select Remote Launch, Local Activation and Remote Activation, and then click OK.

ujujuj. VQult.com