3. Administration

This chapter covers the initial setup of your Management Center, agent installation, and routine tasks in the Web UI.

Contents

• 3.1. System Status
  • 3.1.1. Status Overview
  • 3.1.2. Diagnostics
  • 3.1.3. Logs
• 3.2. ASGARD Agent Deployment
  • 3.2.1. Windows Agent Deployment
  • 3.2.2. Linux Agent Deployment
  • 3.2.3. macOS Agent Deployment
    • 3.2.3.1. macOS Full Disk Access
• 3.3. Uninstall ASGARD Agents
  • 3.3.1. Uninstall ASGARD Agents on Windows
  • 3.3.2. Uninstall ASGARD Agents on Linux
  • 3.3.3. Uninstall ASGARD Agents on macOS
• 3.4. Asset Management
  • 3.4.1. Asset Overview
  • 3.4.2. Asset Labels
    • 3.4.2.1. Export Asset List
    • 3.4.2.2. Import Labels
  • 3.4.3. ASGARD Search Query
  • 3.4.4. Asset Migration
  • 3.4.5. Delete Assets
• 3.5. Scan Control
  • 3.5.1. Managing Scan Templates
  • 3.5.2. THOR Excludes and False-Positive Filters
  • 3.5.3. Live Event Streaming
• 3.6. Scan a Single System
  • 3.6.1. Create a Single Scan
  • 3.6.2. Stopping a Single Scan
  • 3.6.3. Download Scan Results
• 3.7. Scan a Group of Systems
  • 3.7.1. Create Group Scans
  • 3.7.2. List of all Group Scans
  • 3.7.3. Starting a Group Scan
  • 3.7.4. Details of a Group Scan
• 3.8. Scheduled Group Scan
• 3.9. Syslog Forwarding
• 3.10. Response Control
  • 3.10.1. Opening a Remote Console on an endpoint
  • 3.10.2. Response Control with Pre-Defined Playbooks
  • 3.10.3. Response Control for Groups of Systems
  • 3.10.4. Response Control with Custom Playbooks
  • 3.10.5. Change the Asset(s) Proxy
• 3.11. Aurora
  • 3.11.1. Aurora Overview
  • 3.11.2. Deploy Aurora on Asset
  • 3.11.3. Change Service for an Asset
  • 3.11.4. Create a Custom Aurora Configuration
  • 3.11.5. Process Excludes
  • 3.11.6. False Positive Filters
  • 3.11.7. Response Action Logs
  • 3.11.8. Best Practices for Managing Aurora
• 3.12. Sigma
  • 3.12.1. What is Sigma?
  • 3.12.2. Creating a Ruleset
  • 3.12.3. Choosing which Rules to Activate
  • 3.12.4. False Positive Tuning of Sigma Rules
  • 3.12.5. Adding Custom Rules
  • 3.12.6. Rule and Response Updates
  • 3.12.7. How to Activate Responses
• 3.13. IOC Management
  • 3.13.1. Integrating Custom IOCs
  • 3.13.2. Scan only with Custom IOCs
  • 3.13.3. Integrating IOCs through MISP
    • 3.13.3.1. MISP Attributes used by ASGARD
• 3.14. Evidence Collection
• 3.15. Thunderstorm
  • 3.15.1. Thunderstorm License
  • 3.15.2. Thunderstorm Logs
  • 3.15.3. Thunderstorm Configuration
• 3.16. Download Links
  • 3.16.1. Use Case 1 - Share the URL without Hostname
  • 3.16.2. Use Case 2 - Share the URL with Hostname
  • 3.16.3. Use Case 3 - Use the URL in Scripts
• 3.17. Licensing
  • 3.17.1. Thunderstorm
• 3.18. Updates
  • 3.18.1. ASGARD Updates
  • 3.18.2. Version Pinning
  • 3.18.3. Agent Updates
• 3.19. User Management
  • 3.19.1. User Defaults
  • 3.19.2. Roles
  • 3.19.3. Rights
  • 3.19.4. Restrictions
  • 3.19.5. LDAP Configuration
• 3.20. Additional Settings
  • 3.20.1. Rsyslog Forwarding
  • 3.20.2. TLS Certificate Installation
  • 3.20.3. Manage Services
  • 3.20.4. NTP Configuration
  • 3.20.5. Link Analysis Cockpit
  • 3.20.6. Link MASTER ASGARD
  • 3.20.7. Link MISP
  • 3.20.8. Change Proxy Settings
• 3.21. Advanced Settings
  • 3.21.1. Preview Signatures
• 3.22. User Settings
  • 3.22.1. Changing Your Password
  • 3.22.2. Two-Factor Authentication
    • 3.22.2.1. Enable Two-Factor Authentication
    • 3.22.2.2. Disable Two-Factor Authentication
  • 3.22.3. API Key