3. Administration

This chapter contains information on various administrative tasks and general information on how to use ASGARD Management Center.

Contents

• 3.1. Licensing
  • 3.1.1. License Management
  • 3.1.2. Provide an THOR Incident Response License (optional)
• 3.2. System Status
  • 3.2.1. Status Overview
  • 3.2.2. Diagnostics
  • 3.2.3. Logs
• 3.3. ASGARD Agent Deployment
  • 3.3.1. MacOS Full Disk Access
  • 3.3.2. Uninstall ASGARD Agents
    • 3.3.2.1. Uninstall ASGARD Agents on Windows
    • 3.3.2.2. Uninstall ASGARD Agents on Linux
    • 3.3.2.3. Uninstall ASGARD Agents on macOS
• 3.4. Asset Management
  • 3.4.1. Asset Overview
  • 3.4.2. Column Visibility
  • 3.4.3. Asset Labels
  • 3.4.4. Export Asset List
  • 3.4.5. Import Labels
• 3.5. Asset Query
• 3.6. Asset Migration
  • 3.6.1. Delete Assets
• 3.7. Scan Control
  • 3.7.1. Managing Scan Templates
• 3.8. Scan a Single System
  • 3.8.1. Create a Single Scan
  • 3.8.2. Create a Single Scan for multiple Assets
  • 3.8.3. Stopping a Single Scan
  • 3.8.4. Download Scan Results
• 3.9. Scan Groups of Systems
  • 3.9.1. Create Grouped Scans
  • 3.9.2. List of all Group Scans
  • 3.9.3. Starting a Group Scan
  • 3.9.4. Starting a Scheduled Group Scan
  • 3.9.5. Details of a Group Scan
• 3.10. THOR Excludes and False-Positive Filters
• 3.11. Syslog Forwarding
• 3.12. Response Control
  • 3.12.1. Opening a Remote Shell on an endpoint
  • 3.12.2. Response Control with Pre-Defined Playbooks
  • 3.12.3. Response Control for Groups of Systems
  • 3.12.4. Response Control with Custom Playbooks
  • 3.12.5. Change the Asset(s) Proxy
• 3.13. Service Control
  • 3.13.1. Service Controller Installation
  • 3.13.2. Service Controller Update
  • 3.13.3. Uninstall ASGARD Service Controller
• 3.14. Sigma
  • 3.14.1. What is Sigma
  • 3.14.2. Creating a Ruleset
  • 3.14.3. Choosing which Rules to activate
  • 3.14.4. False Positive Tuning of Sigma Rules
  • 3.14.5. Adding Custom Rules
  • 3.14.6. Rule and Response Updates
  • 3.14.7. How to activate Responses
• 3.15. Aurora
  • 3.15.1. Aurora Overview
  • 3.15.2. Deploy Aurora on Assets
  • 3.15.3. Change Service for an Asset
  • 3.15.4. Creating a Custom Aurora Service Configuration
  • 3.15.5. Process Excludes
  • 3.15.6. False Positive Filters
  • 3.15.7. Response Action Logs
  • 3.15.8. Best Practices for Managing Aurora
• 3.16. LogWatcher Service
  • 3.16.1. Prerequisites
  • 3.16.2. Windows Audit Policy
  • 3.16.3. Sysmon Configuration Template
  • 3.16.4. Sysmon Installation
• 3.17. Logwatcher Operation
  • 3.17.1. LogWatcher Overview
  • 3.17.2. Enable Service for an Asset
  • 3.17.3. Creating a Custom Logwatcher Service Configuration
• 3.18. IOC Management
  • 3.18.1. Integrating Custom IOCs
  • 3.18.2. Scan only with Custom IOCs
  • 3.18.3. Integrating IOCs through MISP
  • 3.18.4. MISP Attributes used by ASGARD
• 3.19. Evidence Collection
  • 3.19.1. Collected Evidence
  • 3.19.2. Bifrost Quarantine
  • 3.19.3. Generate Download Links
    • 3.19.3.1. Use Case 1 - Share th URL without Hostname
    • 3.19.3.2. Use Case 2 - Share th URL with Hostname
    • 3.19.3.3. Use Case 3 - Use the URL in Scripts
• 3.20. Updates
  • 3.20.1. ASGARD Updates
  • 3.20.2. Updates of THOR and THOR Signatures
  • 3.20.3. Agent Updates
• 3.21. User Management
  • 3.21.1. Roles
  • 3.21.2. Rights
  • 3.21.3. Restrictions
  • 3.21.4. LDAP Configuration
• 3.22. Additional Settings
  • 3.22.1. Rsyslog Forwarding
  • 3.22.2. TLS Certificate Installation
  • 3.22.3. Manage Services
  • 3.22.4. NTP Configuration
  • 3.22.5. Settings for Bifrost
  • 3.22.6. Link Analysis Cockpit
  • 3.22.7. Link MISP
  • 3.22.8. Change Proxy Settings
  • 3.22.9. Link MASTER ASGARD
  • 3.22.10. Advanced
• 3.23. Account Settings
  • 3.23.1. Changing your password
  • 3.23.2. Two Factor Authentication
    • 3.23.2.1. Enable Two Factor Authentication
    • 3.23.2.2. Disable Two Factor Authentication
  • 3.23.3. API Key