Skip to main content

Choose Appropriate Execution Scenario

The Add-on runs on any computer in your environment. For example, you can run the add-on on the computer where Auditor is installed or on a remote server. Depending on the execution scenario you choose, you have to define a different set of parameters.

Netwrix suggests the following execution scenarios:

ScenarioExample
The add-on runs on the Auditor Server with the current user credentials and writes data to a remote ArcSight through the UDP protocol.C:\Add-ons\NetwrixAuditor_Add-on_for_HPE ArcSight.ps1 -ArcSightHost 172.28.6.18
The add-on runs on the Auditor Server with the current user credentials and writes data to a remote ArcSight through the TCP protocol.C:\Add-ons\NetwrixAuditor_Add-on_for_HPE ArcSight.ps1 -TCP -ArcSightHost 172.28.6.18
The add-on runs on the Auditor Server with the explicitly specified user credentials and writes data to a remote ArcSight using a non-default UDP port.C:\Add-ons\NetwrixAuditor_Add-on_for_HPE ArcSight.ps1 -ArcSightHost 172.28.6.18:9999 -NetwrixAuditorUserName enterprise\NAuser - NetwrixAuditorPassword NetwrixIsCool
The add-on runs on a remote computer with the current user credentials, retrieves data from a remote Auditor repository, and writes it to a remote ArcSight.C:\Add-ons\NetwrixAuditor_Add-on_for_HPE ArcSight.ps1 -ArcSightHost 172.28.6.24 - NetwrixAuditorHost 172.28.6.15
The add-on runs on a remote computer, retrieves data from a remote Auditor repository using the explicitly specified user credentials, and writes it to a remote ArcSight.C:\Add-ons\NetwrixAuditor_Add-on_for_HPE ArcSight.ps1 -ArcSightHost 172.28.6.24 - NetwrixAuditorHost 172.28.6.15 -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool

For security reasons, Netwrix recommends running the script with current user credentials (skipping user credentials). Create a special user account with permissions to both Auditor data and event log and use it for running the script.