### Download Quickstart Bundle (26.03.1 Example) Source: https://docs.netwrix.com/docs/privilegesecurediscovery/2_22/installation/containerbaseddeployment/deploysecureone Example command for downloading the quickstart bundle for version 26.03.1. ```bash wget https://releases.netwrix.com/products/privilegesecure-discovery/26.03/privilegesecure-discovery-quickstart-26.03.1.zip ``` -------------------------------- ### Download Quickstart Bundle (2.22.13 Example) Source: https://docs.netwrix.com/docs/privilegesecurediscovery/2_22/installation/containerbaseddeployment/deploysecureone Example command for downloading the quickstart bundle for version 2.22.13. ```bash wget https://releases.netwrix.com/products/privilegesecure-discovery/2.22/privilegesecure-discovery-quickstart-2.22.13.zip ``` -------------------------------- ### PostgreSQL Setup on Ubuntu Source: https://docs.netwrix.com/docs/pingcastle/3_5/enterpriseinstall Installs PostgreSQL, starts the service, creates a user, and sets a password for PingCastle Enterprise on Ubuntu. ```bash sudo apt-get install postgresql postgresql-contrib sudo /etc/init.d/postgresql start # Create user and database sudo -u postgres createuser pingcastle sudo -u postgres psql ``` ```sql ALTER USER pingcastle WITH PASSWORD 'pingcastle'; CREATE DATABASE pingcastle OWNER pingcastle; ``` -------------------------------- ### Install Quickstart Requirements Source: https://docs.netwrix.com/docs/privilegesecurediscovery/2_22/gettingstarted Run this command to install the necessary Python packages for the Quickstart script. Ensure Python 2.7 and PIP are installed beforehand. ```bash pip install -r requirements.txt ``` -------------------------------- ### Installing and Starting PostgreSQL on Ubuntu Source: https://docs.netwrix.com/docs/pingcastle/3_5/proinstall Commands to install PostgreSQL and its contrib package, and then start the PostgreSQL service on Ubuntu. Assumes default configurations. ```bash sudo apt-get install postgresql postgresql-contrib sudo /etc/init.d/postgresql start ``` -------------------------------- ### Example Download URL for Version 26.06.0 Source: https://docs.netwrix.com/docs/privilegesecurediscovery/2_22/administration/configuration/quickstartscript Specific example URL for downloading the QuickStart tools archive for version 26.06.0. ```text https://releases.netwrix.com/products/privilegesecure-discovery/26.06/privilegesecure-discovery-quickstart-tools-26.06.0.zip ``` -------------------------------- ### Install Python Dependencies Source: https://docs.netwrix.com/docs/privilegesecurediscovery/2_22/administration/configuration/quickstartscript Command to install the required Python dependencies for the QuickStart script from the `requirements.txt` file. Ensure you are in the script's directory. ```bash pip install --trusted-host pypi.org --trusted-host files.pythonhosted.org -r requirements.txt ``` -------------------------------- ### Run the Access Analyzer Installer Source: https://docs.netwrix.com/docs/accessanalyzer/2601/install/quickinstall Execute the dspm-installer command to start the interactive installation wizard. Ensure you have all prerequisites ready before proceeding. The installation process typically takes 15-30 minutes. ```bash sudo dspm-installer ``` -------------------------------- ### Example: Create Role for Manual FPolicy Configuration Source: https://docs.netwrix.com/docs/activitymonitor/10_0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity An example demonstrating the creation of a role named 'activitymonitor' for manual FPolicy setup. ```bash useradmin role -add activitymonitor -c "Role for Activity Monitor" -a login-http-admin,api-system-api-list,api-system-get-version,api-cifs-share-list-iter-*,api-volume-list-info-iter-*,cli-fpolicy* ``` -------------------------------- ### Example: Create Role for Automatic FPolicy Configuration Source: https://docs.netwrix.com/docs/activitymonitor/10_0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity An example demonstrating the creation of a role named 'activitymonitor' for automatic FPolicy setup. ```bash useradmin role -add activitymonitor -c "Role for Activity Monitor" -a login-http-admin,api-system-api-list,api-system-get-version,api-cifs-share-list-iter-*,api-volume-list-info-iter-*,api-fpolicy*,cli-fpolicy* ``` -------------------------------- ### Example of a Blocked Inline Command Source: https://docs.netwrix.com/docs/policypak/components/leastprivilegemanager/manual/windows/securerun/inlinecommands This command, which creates a directory and copies a file, is an example of an inline command that PolicyPak SecureRun will block by default. It may be used during application installations or program setups. ```cmd cmd /c "mkdir C:\TEST & copy c:\Windows\notepad.exe C:\TEST" ``` -------------------------------- ### Download Quickstart Bundle (Generic) Source: https://docs.netwrix.com/docs/privilegesecurediscovery/2_22/installation/containerbaseddeployment/deploysecureone Use this command to download the quickstart bundle. Replace and with the specific release details. ```bash cd ~ wget https://releases.netwrix.com/products/privilegesecure-discovery//privilegesecure-discovery-quickstart-.zip ``` -------------------------------- ### Basic Command-Line Installation Source: https://docs.netwrix.com/docs/passwordsecure/current/installation/installationclient/installation_with_parameters Use this command to initiate the client installation via the command line. Replace MSI-FILE.msi with the actual name of your installer file. ```bash MSI-FILE.msi [PARAMETER] ``` -------------------------------- ### QuickStart Script Help Source: https://docs.netwrix.com/docs/privilegesecurediscovery/2_22/administration/configuration/advancedfields Displays all available command-line arguments and their descriptions for the reports.py script. ```bash reports.py --help ``` -------------------------------- ### msiexec Deployment with FQDN and Logging Source: https://docs.netwrix.com/docs/endpointprotector/kb/deployment-and-installation/how_to_deploy_the_client_using_sccm_or_msiexec This example demonstrates deploying the client using a Fully Qualified Domain Name (FQDN) for the server and includes logging for troubleshooting. Ensure the installer name is accurate and remove any IP address from it if present. ```bash msiexec.exe /i "EPPClientSetup.5.6.1.1_x86_64.msi" /qn /l*v "c:\temp\EPP_inst.log" WSIP="mycompany.endpointprotector.server.com" WSPORT="443" ``` -------------------------------- ### System Alerts GET Request Example Source: https://docs.netwrix.com/docs/endpointprotector/admin/API%20Logs/apispecification Example of a GET request to retrieve system alert logs. Filters can be applied using date ranges. ```http GET /system-alert-logs?start_date=2023-01-01&end_date=2023-01-31 ``` -------------------------------- ### Content Filtering Logs GET Request Example Source: https://docs.netwrix.com/docs/endpointprotector/admin/API%20Logs/apispecification Example of a GET request to retrieve Content-Aware Protection logs. Filters can be applied similarly to device control logs. ```http GET /content-aware-protection?start_date=2023-01-01&end_date=2023-01-31&machine_name=DESKTOP-123&client_name=JohnDoe&use_last_partition=true ``` -------------------------------- ### docker-credential-pass output example Source: https://docs.netwrix.com/docs/privilegesecurediscovery/2_22/installation/dockercredentials Example of the expected output from `docker-credential-pass get` after successful authentication. ```json { "ServerURL": "176947481038.dkr.ecr.us-west-2.amazonaws.com", "Username": "AWS", "Secret": "" } ``` -------------------------------- ### Optional Configuration using config.json Source: https://docs.netwrix.com/docs/privilegesecurediscovery/2_22/administration/configuration/quickstartscript Example of an optional `config.json` file for configuring the QuickStart script. This file should be in the same directory as the script and uses double quotes for all keys and string values. ```json { "baseUrl": "https://localhost/api/v1", "userId": "59057412c4e92dccc356552c", "provisionUser": "jita.universal" } ``` -------------------------------- ### Content Filtering Alerts GET Request Example Source: https://docs.netwrix.com/docs/endpointprotector/admin/API%20Logs/apispecification Example of a GET request to retrieve content filtering alert definitions. Filters can be applied by event ID, content policy, and department ID. ```http GET /content-filtering-alerts?event_id=123&content_policy=PolicyName&department_id=456 ``` -------------------------------- ### Device Control Logs GET Request Example Source: https://docs.netwrix.com/docs/endpointprotector/admin/API%20Logs/apispecification Example of a GET request to retrieve device control logs. Filters can be applied to narrow down the results by date, machine name, client name, and partition usage. ```http GET /device-control?start_date=2023-01-01&end_date=2023-01-31&machine_name=DESKTOP-123&client_name=JohnDoe&use_last_partition=true ``` -------------------------------- ### Install Chocolatey Package Manager Source: https://docs.netwrix.com/docs/policypak/components/softwarepackage/technotes/winget This one-line PowerShell command installs the Chocolatey package manager on your server. Follow the official Chocolatey installation guide for up-to-date instructions. ```powershell Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')) ``` -------------------------------- ### Install and Enable SSH Server Source: https://docs.netwrix.com/docs/privilegesecurediscovery/2_22/installation/containerbaseddeployment/prerequisites Installs the OpenSSH server package and enables it to start automatically on boot. Ensure SSH is installed if it's not already present on your nodes. ```bash sudo apt install openssh-server sudo systemctl enable --now ssh ``` -------------------------------- ### Example Command-Line for .application Source: https://docs.netwrix.com/docs/policypak/components/leastprivilegemanager/technotes/tipsappsscenarios/applicationextension This is an example of the full command-line used to launch a .application file, which is needed when configuring Least Privilege Manager rules. ```powershell "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication C:\Users\EastSalesUser1\Desktop\test.application ``` -------------------------------- ### Upload Freeze Mode Configuration using Quickstart Source: https://docs.netwrix.com/docs/privilegesecurediscovery/2_22/requirements/technicalpreparation/freeze_mode Execute the upload command without --dry-run to apply the Freeze Mode configuration to the target machines. ```bash python reports_2.9.py --insecure --protect-mode-file Freeze_Mode_Upload.xlsx ``` -------------------------------- ### Distribute Bundle to Secondary Nodes (Direct Download) Source: https://docs.netwrix.com/docs/privilegesecurediscovery/2_22/installation/containerbaseddeployment/deploysecureone Download and extract the quickstart bundle directly on each secondary node. Ensure both 'secureone.sh' and 'secureone.tar.gz' are in the home directory. ```bash cd ~ wget https://releases.netwrix.com/products/privilegesecure-discovery//privilegesecure-discovery-quickstart-.zip unzip privilegesecure-discovery-quickstart-.zip ``` -------------------------------- ### Get User Status Example Source: https://docs.netwrix.com/docs/directorymanager/11_1/managementshell/userlifecycle/getstatus Use this command to get the status of a user and information about the next profile validation date. ```powershell Get-Status –Manager "Richard" ``` -------------------------------- ### Create New User Example Source: https://docs.netwrix.com/docs/directorymanager/11_1/managementshell/user/newuser Demonstrates how to create a new user with essential properties like name, organizational unit, logon name, password, and display name. ```powershell New-User -Name "OsamaUser" -OrganizationalUnit "OU=osamamu,DC=naveed,DC=local" -SAMAccountName "OsamaUser11" -Password "password123" -FirstName "Osama" -LastName "Shahbaz" -DisplayName "Osama" ``` -------------------------------- ### Run MSI Installer with Destination Directory Variable Source: https://docs.netwrix.com/docs/policypak/components/remoteworkdeliverymanager/manual/remoteworkdelivery/tips/specialvariables Use this snippet to install specific software from a directory after it has been delivered. This example installs a 7-zip MSI. The %DestinationDir% variable does not require quotes. ```cmd msiexec.exe /i %DestinationDir%\7zip.msi /qn ``` -------------------------------- ### Allow and Log Rule for OneDriveSetup.exe Source: https://docs.netwrix.com/docs/policypak/components/leastprivilegemanager/manual/windows/securerun/avoiduac This example demonstrates a Combo rule that allows OneDriveSetup.exe to run by specifying both a Path Condition and a Command-line Condition, with the action set to Allow and Log. This is useful for applications that frequently update in the background. ```text Path Condition: C:\\Users\\\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveSetup.exe Command-line Condition: /update Action: Allow and Log ``` -------------------------------- ### Install New Client Package Source: https://docs.netwrix.com/docs/endpointprotector/kb/deployment-and-installation/upgrade_linux_clients_without_uninstalling_and_reinstalling Install the new Endpoint Protector client package from the unpacked directory using apt. ```bash sudo -E apt install ./pkgs/*.deb ``` -------------------------------- ### Get PolicyPak Client-Side Extension Names and GUIDs Source: https://docs.netwrix.com/docs/policypak/tipstricksandfaqs/powershell Use Get-PPCses to list all PolicyPak client-side extension names and their corresponding GUIDs. ```powershell Get-PPCses ```