Observeit V.7.0.0: Introduction and Installation Guide
Observeit V.7.0.0: Introduction and Installation Guide
0
Introduction and Installation Guide
ObserveIT Introduction and Installation Guide
Contents
Introduction .............................................................................................................................. 3
Product Version ....................................................................................................................... 3
Trial Limitations ....................................................................................................................... 4
System Requirements ............................................................................................................. 4
ObserveIT “All-in-One” Management Server............................................................................................ 5
ObserveIT Windows Agent ....................................................................................................................... 6
Unix/Linux Agent....................................................................................................................................... 6
Mac OSX Agent ......................................................................................................................................... 7
Web Categorization Module ..................................................................................................................... 8
Architecture Overview ............................................................................................................. 9
Important Considerations.......................................................................................................10
ObserveIT component network interaction ........................................................................................... 10
Permissions Required for all Computers ................................................................................................ 10
Firewall Permissions................................................................................................................................ 10
Privacy and Legal Considerations............................................................................................................ 10
Installation Package Overview ...............................................................................................11
Using PowerShell ....................................................................................................................18
Installing SQL Express ...........................................................................................................19
Configure SQL Express to Accept TCP/IP Connections ......................................................23
Installing the ObserveIT Software..........................................................................................25
Installing an ObserveIT Agent on a Microsoft Windows-based Computer .........................29
Installing an ObserveIT Agent on a *NIX-based Computer ..................................................33
Installing an ObserveIT Agent on a Mac Computer ..............................................................34
Verifying Successful User Activity Recording ......................................................................35
Copyright .................................................................................................................................36
2
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
Introduction
The ObserveIT User Behavior Monitoring and Analytics platform is designed to help security,
incident response, infrastructure, compliance, and legal teams easily identify and eliminate
Insider threat. This document describes the steps necessary to set up and effectively deploy the
ObserveIT software for a self-guided trial.
Product Version
ObserveIT version v.7.0.0. features a number of major improvements over version 6.7.2.
This document was written for ObserveIT Enterprise version 7.0.0. This document uses screenshots and
procedures written for Windows Server 2012 R2 and SQL Express Server 2012.
3
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
Trial Limitations
ObserveIT will provide an Not for resale (NFR) license viable for a 15-day trial period. All self-
guided trials are limited in license scope to:
• 1 Windows Terminal Server License
• 2 Windows Server Licenses
• 5 Windows Desktop Licenses
• 5 Mac Desktop Licenses
• 5 Linux/Unix Multi-Purpose Licenses
System Requirements
Before running the ObserveIT install package, please review the necessary minimum
requirements.
4
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
Note: It is the responsibility of the customer to provide all hardware/virtual machines, storage and all
networking requirements for the test environment to be ready for the installation of the ObserveIT
platform.
5
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
Software Requirements
• Microsoft Windows Server 2008/2008 R2/2012/2012 R2,
Windows Vista, Windows 7, Windows 8/8.1, Windows 10 (It is
recommended that you always use the latest service pack for
your operating system)
• .NET Framework (version 3.5.1 and 4.5.2 must always be
installed)
Unix/Linux Agent
The *NIX Agent runs in user mode and is triggered when an interactive session is created on a
monitored machine (connected via SH, Telnet, Rlogin, etc.) It records user activity inside the
sessions, including interactive user activity and system functions such as OPEN, EXEC,
CHMOD and others.
The ObserveIT agent can be installed on all Unix or Linux-based systems which require
monitoring. The Unix or Linux Agent installer is a self-extracting file which includes the package
and an installation script.
You can deploy ObserveIT Agents on the following Unix/Linux-based operating systems:
▪ Solaris ▪ AIX
▪ HP-UX ▪ RHEL/CentOS
▪ Oracle Linux ▪ SLES (SuSE Linux Enterprise Server)
▪ Ubuntu ▪ Debian
▪ Amazon Linux
6
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
Note: If you require additional *NIX minimum requirements please review our detailed documentation.
Software Requirements
• OSX 10.10 Yosemite
• OSX 10.11 El Capitan
• MacOS Sierra 10.12
• On MacOS Sierra 10.12 the logger permissions must be
granted manually through system perferences.
7
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
8
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
Architecture Overview
9
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
Important Considerations
ObserveIT component network interaction
1. Each monitored desktop or server runs the ObserveIT Agent which is installed locally on
the computer.
2. The Agent captures information about user activity, secures it, and sends it to the
Application Server.
3. If high availability is a requirement and there is more than one Application Server, they
should be load balanced by using either a software or hardware-based device. In that
case the Agents will communicate with the load balancer’s virtual IP (VIP).
4. The Application Server analyzes and compresses received data, then it stores it by
splitting the textual data in the SQL Server database.
5. An administrator can connect to the Web Console Web-based interface using a web
browser, and search for, replay, run reports and inspect alerts based on the captured
user activity.
6. Any component of the data transfer or data storage process can be encrypted, if
needed.
Permissions Required for all Computers
1. All computers are members of the same Active Directory domain
2. Logon permissions to these computers with administrative permissions
3. Permissions to access the SQL Server database engine (SYSADMIN permissions)
4. Full network connectivity
Firewall Permissions
On default configuration ObserveIT agents utilize HTTP port 4884 to communicate with the
application Server and the Application Server uses port 1433 to communicate with the
Database server. If firewalls are enabled, please make sure to create firewall permissions fo
these ports.
Opening the firewall ports can be done via Command prompt using the following rules:
1. For Agent to App Server: netsh advfirewall firewall add rule name="OIT Application
Server (TCP 4884)" dir=in action=allow protocol=TCP localport=4884
2. For App Server to Database: netsh advfirewall firewall add rule name="SQL Server (TCP
1433)" dir=in action=allow protocol=TCP localport=1433
10
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
11
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
• Server Manager
• Powershell
12
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
13
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
14
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
5. Scroll down to the Management Tools folder in the Roles list, and select the Application
Development Role.
Make sure that the following roles are selected:
o .NET Extensibility 3.5
o .NET Extensibility 4.5
o ASP .NET 3.5
o ASP .NET 4.5
o ISAPI Extensions
o ISAPI Filters
15
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
o Scroll down to Management Tools and select the following [Link] 6 Management
Compatability
o IIS 6 Scripting Tools
o IIS 6 WMI Compataibility
16
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
6. Confirm that the following roles have been selected prior to installation of the components.
17
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
Using PowerShell
To install IIS 8.0 and relevant components on Windows Server 2012 R2 using PowerShell
Open a PowerShell prompt with elevated credentials, and type the following command:
Import-Module ServerManager
Type the following command in one line. You can copy the command and paste it in the
PowerShell window.
If it is not installed, you will also need to install the .NET Framework 3.5 Features. Open a
Command Prompt, and type the following command in one line:
Add-WindowsFeature NET-Framework-Features, NET-Framework-Core
18
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
1. Navigate to the SQLExpress folder and to begin installation, run the SQL setup as an
administrator.
19
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
2. Click through the Microsoft update, product updates, install setup files, and install rules.
Once you get to Installation Type make sure to click on the “Perform a new installation
of SQL Server 2014”.
3. Accept the license terms and move on to the Express features to install. The features
required for ObserveIT are the Database Engine Services, Full-text and Semantic
Extractions for Search, and the Management Tools – Basic and Complete, click
Next.
20
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
4. You can choose to either leave the instance name on default or name it as needed. In
the example below the SQL instance is named “TestObserveIT”.
5. Click through Server Configuration leaving the settings on default. On the Database
Engine Configuration, switch the Authentication Mode to Mixed Mode and set a
password for your Server Authentication (SA) account.
21
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
Note: On this screen you can also change the Data Directories path and FILESTREAM options.
6. On the “Reporting Services Configuration” leave options as default and click Next.
7. Click “Next and the Installation Progress” will begin. When it is finished review any
warning or alerts and move on to the next step.
22
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
2. Expand the “SQL Server Network Configuration” tab and select the Protocols for your
SQL Instance then on the right hand side right click on the “TCP/IP” protocol name and
select “Enable”.
23
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
3. Confirm the successful installation of your SQL instance by opening SQL Server
Management Studio and logging in to your SQL instance with the Server Authentication
account.
24
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
1. Navigate back to the ObserveIT installation folder and run the [Link] as an
Administrator to launch the ObserveIT one-click installer.
25
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
2. Configuring ObserveIT to install to the correct SQL Server requires you to put in the new
SQL instance that you have created. Since this is a local SQL instance you can use .\<SQL
Instance name>. Next in the SQL Server authentication section select “SQL Server” and
put in your Server Authentication (SA) credentials.
3. Under the Web Console selection, leave the ObserveIT Application (Port 4884) and select
whether or not you’d like to secure access to the web console.
Note: ObserveIT creates a self-signed certificate created in IIS. If you have your own
Digital Certificate you can use it to replace the self-signed cert after the installation.
4. Make sure you have your ObserveIT license ready (if not you can email
licenses@[Link]) and plug it into the “Insert License:” field.
26
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
5. As the final step, hit on “I Agree” for the Terms of Service and click Install. The ObserveIT
install process will first deploy the ObserveIT databases, then the Application Server, Web
Console, and finally an ObserveIT agent.
Note: If the installation fails or does not go as expected, don’t worry! You are not alone. You should
reach out to one of our friendly support engineers at support@[Link].
6. Congratulations! You have completed the installation. The ObserveIT web console will
automatically launch.
27
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
7. After closing the installation window, the ObserveIT web console opens automatically.
The login page appears, in which you can configure the initial admin password.
Note: You can refer to the User Guide located within the Web Console for configuration
and other useful settings.
28
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
1. Navigate to the original ObserveIT installation folder and locate the two Windows Agent
installation folders. Copy the relevant file folders either manually to a target machine or
to an easily accessible network share.
• On a Windows 64-bit operating system, use the “WinAgent64bit” folder from the
ObserveIT installation folder.
• On a windows 32-bit operating system, use the “WinAgent32bit” folder from the
ObserveIT installation folder.
2. Once copied over, open the file folder and right-click the “[Link]” file, and select
“Run as Administrator” then click “Next”.
29
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
3. Select “I accept” on the End-User License Agreement stage and click “Next”.
4. On the next screen fill-in the “Server” text box, type the name of the ObserveIT
Application Server. It is preferred that you use the server’s fully qualified domain name
(FQDN) or IP address.
Enter the TCP port number. By default, ObserveIT listens to TCP port 4884. When
accepting the default settings during the installation of the ObserveIT Application Server.
Click “Test Connection” to make sure that the communication is not obstructed by a
firewall (if there is no connection, refer to Firewall permissions under the Precautions
section on page 7)
If the configuration was correct, you will be notified that it was successful. Click “Ok”.
30
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
31
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
6. Set the Recording Policy to Default Windows-based Policy. You can also change
other settings such as the installation folder, the registration state, and whether to hide
the agent from the Add/Remove Programs / Uninstall a Program applet in Control
Panel. When you finish configuration click Next.
32
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
1. When installation is complete, click ‘Finish” and note the Agent’s blue icon in the tray area.
2. Log in to the target server with root permissions; or, alternatively, use
the pfexec command.
3. Run the ls –l command and verify that the file has execute permissions (-rwxr-xr-x).
Otherwise, use chmod +x for the Agent’s file name.
33
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
After installing the Agent, you should check the Agent's registration and health status in the
ObserveIT web console.
Important Note!
1. If there are no execute permissions on the /tmp directory, installation will fail when the self-
extracting script attempts to deploy the packages. To prevent installation failure in this
case, run the installation command using the ––target option, as follows:
where /work/tmp is the location of the new directory, if the /work/directory does not exist
you must create it manually.
Where <ServerIP> is the IP address or FQDN of the ObserveIT Application Server and
<Port> is the TCP port used by the ObserveIT Application Server
4. After successful installation, you can log in to the ObserveIT web Console and begin
recording sessions.
34
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
1. By default ObserveIT will open up to the ObserveIT management console, you should
immediately see recorded sessions as well as the Trial duration at the top right of the
screen.
2. Go ahead and familiarze yourself with the layout of the console and expand the recorded
sessions by clicking the to make sure matadata is being collected. Then click on the
video replay button to verify session recording.
35
2017.04 (Rev. 3.0)
ObserveIT Introduction and Installation Guide
Now you’re done! You should check out the Quick Help guide in the ObserveIT console as
well as the documents in the Installation Folder for configuration, usage, and setup.
Documentation Feedback
The following online documentation will provide you with guidance for specific aspects, including
system requirements and installation procedures:
[Link]
Copyright
Copyright * 2016, ObserveIT Inc. All rights reserved.
The information in this document is subject to change without notice. No part of this document may be
reproduced, stored or transmitted in any form or by any means, electronic or mechanical, for any purpose
without the express written permission of:
ObserveIT Inc.
ObserveIT Inc. assumes no liability for any damages incurred, directly or indirectly, from any errors,
omissions or discrepancies between the software and the information contained in this document.
36
2017.04 (Rev. 3.0)