Skip to main content

PowerShell API Integration

Using PowerShell, you can obtain information on or manipulate specific policy, collection, and Netwrix Threat Manager integration configurations in the Threat Prevention Administration Console without having it open. You can do this on the same machine or from a remote server where the Enterprise Manager isn't located. You can use the following PowerShell APIs:

  • Initial Configuration:

    • Connect-SIEnterpriseManager

  • Informative APIs

    note

    These APIs don't require any additional configuration. They display Agent status from the Agents Interface and a list of available PowerShell APIs the user can use.

    • Get-SIAgentStatus – Displays Agent status from the Agent grid columns on the Agents Interface
    • Get-SI Help – Lists available PowerShell APIs for Threat Prevention
    • Get-SIHelp [API Name] – Displays detailed information about the PowerShell API

  • Policies and Collections:

    • Get-SIPolicy
    • Enable-SIPolicy
    • Remove-SIPolicy
    • Export-SIPolicy
    • Import-SIPolicy
    • Get-SICollection
    • Remove-SICollection
    • Export-SICollection
    • Import-SICollection

  • Enterprise Password Enforcement (EPE):

    • Test-ValidatePassword
    • Export-SICharacterSubstitution
    • Import-SICharacterSubstitution
    • Export-SICharacterSubstitutionWords
    • Import-SICharacterSubstitutionWords
    • Export-SIPasswordsDictionary
    • Import-SIPasswordsDictionary
    • Set-SIPwnedDB

  • Threat Manager Event Sink Tab

    • Get-SIDefendConfig
    • Set-SIDefendConfig

  • LDAP Deception for Threat Manager:

    • Get-SILdapDeception
    • Set-SILdapDeception

Prerequisites​

You must meet the following prerequisites before using the APIs:

  • The PowerShell service account must be an Active Directory account with the Threat Prevention administrator role assigned to it. You assign the role through the Users and Roles Window.
  • You must load the Threat Prevention PowerShell module (SI.SIMonitor.PowerShell.dll) into PowerShell. Threat Prevention stores this module in the installation directory within the Enterprise Manager folder:

*…\Netwrix\Netwrix Threat Prevention\SIEnterpriseManager*

To disallow the use of the PowerShell module, remove the module from the Enterprise Manager folder.

  • You execute PowerShell commands through a PowerShell console on either the Enterprise Manager server or on a remote server. When you use PowerShell on a remote server without the Enterprise Manager installed, see the Remote PowerShell Connection section for requirements.

Not a Policy XML Expert​

To compare two XML files as exported from Threat Prevention:

Step 1 – Craft the policy you want in the Administration Console and export as a XML file.

Step 2 – In the Administration Console, edit the same policy settings and filters through the Event Type tab. Export as a second XML file with a different name.

Step 3 – Open both XML files and compare the XML to see how Threat Prevention alters policies.

After you identify how Threat Prevention modifies XML files, you can apply that to the Add or Modify Policies instructions.