CourtesyIT · Managing Director · ✭✭✭✭✭

You will need to incrementally upgrade if you are going to stay on the same server install. This might take you some time depending on how far back you are. Depending on how long it has been in an operational status, you may want to start refresh with a clean install. byrona​ is correct in your back ups and it would be a…

ok, thanks, I have to work on the regular expression piece of it. 

Look for this on the Shared on Thwack. See if this might lead you in the right direction for now.

they are not built in because the STIGs have the ability to change/modify/removed by the reporting agency.

You can find them on NCM > Compliance > Manage Policies > Shared on Thwack tab. or you can go to my profile > content > documents. Thanks,

What are you trying to do with your IPAM? 

feel free to contact me at solarwinds@courtesyit.com and I can help you with your solution.

dassey​ please refer to this thread to clear the issue. I am not sure when you downloaded the STIGs but the Cisco ones should be good as I fixed several issues a couple weeks ago. Compliance report stuck in cashing

Which one did you import? 

All, I have made some corrections and additions to the Cisco STIG Page. I have added a report that will evaluate all physical ports on your network for the various stigs and requirements. Please feel free to download, modify for you, and let me know about any changes. Enjoy.

ecklerwr1​, You are correct when apply DISA STIGs to the server. Most of the issue is focused around .NET and IIS. I always request a phased approcach to application of Server STIGs to my servers. I have them do a small batch 5-15 at a time so we can go back and fix if needed. I do not have a list of exceptions to give but…

piratemike‌ what is the error you are getting when you attempt to import from Shared on Thwack? 

michael.t.koehler.ctr@mail.mil‌ You may need to bring the template down from inside NCM as opposed to the forum. Then move it over to your other network and import. Thanks, Eric

I am attempting to recreate the issue. cvachovecj‌ I wanted to see if you had similar issues. Download the files, move them to disc, move files from disc to another desktop, upload into NCM via compliance "Import" button. Question: Are you downloading from Thwack or from inside NCM?

Good question, I was wondering if there was a "global setting" on a per device model basis.

do not forget: domain\username

Doing this type of action may have a negative effect on your SolarWinds performance and operations. David Smith is correct in that you need to find out how long the job will take on average per node. If you decide to move forward, incrementally increase until you see where performance will be impacted. Small steps. 

cnorborg‌ The rule above looks great. Thank you for working this issue so intently. This approach looks a lot cleaner and with the explanation of how the regex was used is very helpful for those of us that are learning.

It usually takes a week after the mission was closed. But since we are in the Holiday Season it may be a little longer. the point will be there. 

lindberg16‌ - The way I run my network is that I use a Configuration Template to remove all Logging servers and then re-configure the ones I want. Then I go to different devices and copy-paste the logging I want into a notepad doc. I use .*\n to go from line to line and list exactly what I do want. Then at the bottom I…

You could also try just doing a search for 4 logging servers. I do this with usernames and ntp servers. I know what I need/have to have. logging host.*\nlogging host.*\nlogging host.*\nlogging host you can put IP addresses in there but some things they do not always follow in order. 

I get nervous when I have the system automatically make changes that I did not specifically push. I tend to shy away from automated remediation scripts and prefer to use Configuration Templates to make changes.

Ok, This is how I would do it. Try this and let me know. If not found then trigger alert block 1. must contain logging host x.x.x.x.*\nlogging host y.y.y.y.*\nlogging host z.z.z.z block 2. and must not contain logging host x.x.x.x.*\nlogging host y.y.y.y.*\nlogging host z.z.z.z.*\nlogging host a.a.a.a

What is the correct Text/Entry suppose to be? 

Glad to help out. 

Cut and paste this into a note pad document then into a single box within the compliance rule. Mark as must contain & regular expression. I always use notepad or notepad++ to edit text then cut and paste into solarwinds. I wish the boxes in SW were bigger but in due time. Only users authorized by MYCOMPANY may…

Yes, I have been able to do it. Takes a little time but doable. If you are looking for the DOD banner please send me an email and I can assist you from there. If this is for a non-goverment, can you put the banner here my any company information. 

I am as well, my father fusses about the Software from a Physicians point of view all the time.

I take it the Engineer did not like you scanning his subnets? Were the scans to frequent? What is the policy concerns scans? I would ask more questions before revving up the chainsaw. I am sure there is always a way to get to "Yes". Thanks, CourtesyIT

If you have any questions please feel free to drop me a line. CorutesyIT