itengineer · Senior Security Engineer · ✭✭✭✭✭

Would it be possible to monitor it using the AppInsight for AD: https://documentation.solarwinds.com/en/Success_Center/SAM/Content/SAM-AppInsight-for-AD-Intro.htm ?

@"zhymmer" Using the Global Administrator role as Service account is overkill and does not comply with the Security Best practice. Is there any update for the latest MS Graph API credentials?

Using Graph API?

What about the service account, can we use Global Reader account for the query, rather than using the Global Administrator?

OK, so in this case: Using the Linux Agent: It is free monitoring a part of the SAM license. Using VMAN: it is also free as part of the VM monitoring license. Using SAM Application Monitor requires AL license to be consumed.

Thank you for the suggestion and the pointer @"shuth".

I'm still using the older AL license. I wonder where do I find the location to create the "Windows Event Log component monitor"? I'm using SAM v2020.2

Yes, that's what I'd like to know, so I can remove the unused SQL server components in this existing Main Polling Engine. Also to reduce the SQL server cost.

that's great, thanks for the pointer. I will update the thread with the new thread.

Great, Thanks mate for the sharing and explanation.

Does one node can be a member of multiple groups or just one group only?

OK, so I can add the criteria to check for multiple Event ID per application template? and apply it to one node, then it is counted a 1x SAM license. Because AppInsight for AD cost 50 licenses.

Can we adjust how long for the duration before it is moving on to the next one?

Sadly, it is still an ongoing issue, as at the moment and escalated to the Developer team. even after following: https://support.solarwinds.com/SuccessCenter/s/article/Every-resource-and-widget-shows-error-rendering-and-tool-bars-are-missing

Yes, this is what I found very lacking of the basic functionality. even with the latest update 2019.4, no feature update to include this yet.

If we have both SAM & VMAN, how can this be combined together to create accurate report or real time alerting?

et me know if there is any steps or best practice in configuring it in SAM as I need some step by steps guide for that.

Hi All, Common application pools like ‘MSExchangeOWAAppPool’ or ‘MSExchangeECPAppPool’ are commonly hijacked by attackers through web shell deployment. Is there any powershell command to know when IIS webserver AppPool process executing net.exe, cmd.exe, and mshta.exe ?

@"wv5819" so which GPO option is this that you have modified?

@"neomatrix1217"thank you for the pointer. I guess, there is no way to monitor it without consuming the SAM AL license.

@"neomatrix1217"do I have to install the Solarwinds Linux agent to avoid creating Service account in each of the Linux system? I assume, there is no need to use SAM Licensed Component Monitors license with the above approach.

Yes, @"neomatrix1217" that does fits for my needs. Thanks man.

Is there any updated version to utilize MS Graph API for Monitoring Office 365 from On-premise Orion Platform?

Yes, Chris, I agree with you, the cost is very much more expensive and the benefits or gain is not that much compares to the smaller and more useful feature like VeeamOne.

Thanks @"jan", I will give it a try after upgrading the Orion Platform.

Without enabling that event ID GPO, does the events logged in Local PC or domain controllers?

Cool, that does make sense @"sturdyerde" I will disable this element and will continue with the rest of the monitoring elements. Thanks man.

Yes, that is correct. is that not recommended for the monitoring with this template?

@"shuth", can we pull or attach the Event Log body for any events logged in the Windows node? Using the ${N=SwisEntity;M=ComponentAlert.WindowsEventMessages} in the email alert body?

If yes, then this is your document to go to: https://www.solarwinds.com/-/media/solarwinds/swdcv2/licensed-products/orion-scalability-engines/resources/whitepapers/orion_scalability_tech_tips.ashx http://cdn.swcdn.net/creative/v3.8.1/pdf/Whitepapers/IT_Management_Scalability_for_the_Enterprise.pdf Solarwinds deployment is…