EventSentry supports a number of authentication types which are accessed and stored in the authentication manager. The authentication manager can be accessed through the ribbon (Tools -> Authentication Manager) as well as through various features in the management console when assigning credentials to features.
EventSentry supports the following credentials types:
Type |
Used By |
Applied To |
Description |
Windows |
Management Console (Remote Update) Heartbeat Agent (Agent Status Monitoring) |
Globally Groups Hosts |
Windows credentials are mainly used by the management console when managing and/or deploying agents if the currently logged-on user does not hold sufficient privileges. The Heartbeat agent may also utilize assigned credentials when not using the collector (not recommended) |
SSH |
Heartbeat Agent (Non-Windows monitoring) Management Console (Remote Update) |
Globally Groups Hosts |
SSH credentials are only used by the heartbeat agent when monitoring non-Windows devices like Linux hosts. SSH credentials are used to obtain extended system information (not available via SNMP) and to monitor daemons (services). |
SNMP |
Heartbeat Agent (Non-Windows monitoring) Network Services (NetFlow) Management Console (Remote Update) |
Globally Groups Hosts |
SNMP credentials are primarily used by the heartbeat agent when monitoring remote non-Windows devices to obtain disk space, system information, network interfaces and other data. The NetFlow component also utilizes SNMP to obtain information about network interfaces from the NetFlow sender in order to calculate interface bandwidth. The management console also uses SNMP to check connectivity and access to remote devices. |
Microsoft Cloud |
Sync Service (Azure log download) |
Log Files |
Microsoft Cloud credentials can be assigned to log files which use a log file definition where a URL is defined. The Sync Service uses these credentials to download cloud-based logs. |
OAuth |
Agent Collector |
Email Action HTTP Action |
OAuth credentials can be applied to both SMTP and HTTP actions and are utilized either by the collector or the agent, depending on the action configuration. |
|
Important Info for Windows Credentials & Heartbeat Monitoring Windows credentials entered will be encrypted in the registry, and can only be decrypted by the user who encrypted them. E.g., if user Bulls\DerrickR configures credentials for hosts, then the EventSentry Heartbeat Monitor service needs to also run under the Bulls\DerrickR user account.
Note that the Heartbeat Agent, when utilizing the collector, does not need to utilize Windows credentials. |
Adding Accounts EventSentry credentials are identified by a unique "Account Name" and are case sensitive. An account is added by clicking the + icon in the authentication manager.
Windows / SSH Specify a valid user name, including the domain when necessary (Windows only), as well as a password.
EventSentry automatically determines whether to use Windows or SSH credentials depending on the group / host type.
LAPS Support Windows credentials can be configured to use LAPS by checking the "Use LAPS" check box. LAPS is only utilized by the management console (for agent management), the heartbeat agent does not have the ability to dynamically retrieve LAPS passwords from AD.
SNMP For SNMP v1 and v2c only a community needs to be specified.
For SNMP v3, a user name and either Authentication, Encryption or both Authentication and Encryption can be specified.
Microsoft Cloud Requires an Application ID (aka client), Directory ID (aka tenant) and client credentials (secret). A test button can be used to validate the entered credentials.
OAuth Requires a Client ID, Client Secret, Server Auth & Server Token URLs as well as a scope. Clicking Initialize will obtain an access token and refresh token (if available). Read-only check boxes will indicate which tokens are currently available. |
|
Assigning Credentials
Credentials can be assigned to the selected entity by either selecting an account name from the list or by adding a new account to the authentication manager with the + icon. A green check mark next to an account name indicates that the account is assigned to the currently selected entity.
Removing Credentials
Credentials can be removed from a selected entity by clicking "Set Authentication" in the ribbon or the context menu and subsequently clicking "Clear Selection" in the authentication manager.
