3. Administration

This chapter focuses on the initial setup of your Management Center, installing agents and performing routine tasks in the Web UI.

Contents

• 3.1. Initial Tasks
  • 3.1.1. Change the Admin Password
  • 3.1.2. License Installation
• 3.2. System Status
  • 3.2.1. Status Overview
  • 3.2.2. Diagnostics
  • 3.2.3. Logs
• 3.3. ASGARD Agent Deployment
  • 3.3.1. Windows Agent Deployment
  • 3.3.2. Linux Agent Deployment
  • 3.3.3. macOS Agent Deployment
    • 3.3.3.1. macOS Full Disk Access
• 3.4. Uninstall ASGARD Agents
  • 3.4.1. Uninstall ASGARD Agents on Windows
  • 3.4.2. Uninstall ASGARD Agents on Linux
  • 3.4.3. Uninstall ASGARD Agents on macOS
    • 3.4.3.1. Uninstall ASGARD Service Controller
• 3.5. Asset Management
  • 3.5.1. Asset Overview
  • 3.5.2. Column Visibility
  • 3.5.3. Asset Labels
    • 3.5.3.1. Export Asset List
    • 3.5.3.2. Import Labels
  • 3.5.4. ASGARD Search Query
  • 3.5.5. Asset Migration
  • 3.5.6. Delete Assets
• 3.6. Scan Control
  • 3.6.1. Managing Scan Templates
  • 3.6.2. THOR Excludes and False-Positive Filters
• 3.7. Scan a Single System
  • 3.7.1. Create a Single Scan
  • 3.7.2. Stopping a Single Scan
  • 3.7.3. Download Scan Results
• 3.8. Scan a Group of Systems
  • 3.8.1. Create Group Scans
  • 3.8.2. List of all Group Scans
  • 3.8.3. Starting a Group Scan
  • 3.8.4. Details of a Group Scan
• 3.9. Scheduled Group Scan
• 3.10. Syslog Forwarding
• 3.11. Response Control
  • 3.11.1. Opening a Remote Console on an endpoint
  • 3.11.2. Response Control with Pre-Defined Playbooks
  • 3.11.3. Response Control for Groups of Systems
  • 3.11.4. Response Control with Custom Playbooks
  • 3.11.5. Change the Asset(s) Proxy
• 3.12. Service Control
  • 3.12.1. Service Controller Installation
  • 3.12.2. Service Controller Update
• 3.13. Aurora
  • 3.13.1. Aurora Overview
  • 3.13.2. Deploy Aurora on Asset
  • 3.13.3. Change Service for an Asset
  • 3.13.4. Create a Custom Aurora Configuration
  • 3.13.5. Process Excludes
  • 3.13.6. False Positive Filters
  • 3.13.7. Response Action Logs
  • 3.13.8. Best Practices for Managing Aurora
• 3.14. Sigma
  • 3.14.1. What is Sigma
  • 3.14.2. Creating a Ruleset
  • 3.14.3. Choosing which Rules to activate
  • 3.14.4. False Positive Tuning of Sigma Rules
  • 3.14.5. Adding Custom Rules
  • 3.14.6. Rule and Response Updates
  • 3.14.7. How to activate Responses
• 3.15. IOC Management
  • 3.15.1. Integrating Custom IOCs
  • 3.15.2. Scan only with Custom IOCs
  • 3.15.3. Integrating IOCs through MISP
    • 3.15.3.1. MISP Attributes used by ASGARD
• 3.16. Evidence Collection
  • 3.16.1. Collected Evidences
  • 3.16.2. Bifrost Quarantine
• 3.17. Download Links
  • 3.17.1. Use Case 1 - Share th URL without Hostname
  • 3.17.2. Use Case 2 - Share th URL with Hostname
  • 3.17.3. Use Case 3 - Use the URL in Scripts
• 3.18. Licensing
• 3.19. Updates
  • 3.19.1. ASGARD Updates
  • 3.19.2. Updates of THOR and THOR Signatures
  • 3.19.3. Agent Updates
• 3.20. User Management
  • 3.20.1. Roles
  • 3.20.2. Rights
  • 3.20.3. Restrictions
  • 3.20.4. LDAP Configuration
• 3.21. Additional Settings
  • 3.21.1. Rsyslog Forwarding
  • 3.21.2. TLS Certificate Installation
  • 3.21.3. Manage Services
  • 3.21.4. NTP Configuration
  • 3.21.5. Settings for Bifrost
  • 3.21.6. Link Analysis Cockpit
  • 3.21.7. Link MASTER ASGARD
  • 3.21.8. Link MISP
  • 3.21.9. Change Proxy Settings
• 3.22. Advanced Settings
• 3.23. User Settings
  • 3.23.1. Changing your password
  • 3.23.2. Two Factor Authentication
    • 3.23.2.1. Enable Two Factor Authentication
    • 3.23.2.2. Disable Two Factor Authentication
  • 3.23.3. API Key