This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Community question about views in orion

tszilagyi over 3 years ago

So with everything that has happened security wise in the last few weeks I assume I'm not the only person that has been given the directive to rebuild the server from scratch.

As I'm doing this, I'm also taking this as an opportunity to try to improve my setup. I have already worked with support and received links to a large number of documents for setting up the environment securely and following best practices, with the exception of being unable to track down a current copy of the antivirus exclusions that doesn't require a login that is for some reason not the THWACK or Customer Portal credentials.

I'll link the info I have to share if it will help anyone else in a follow up comment.

This brings me now to my question for the Community. As I am rebuilding with the requirement that NOTHING can be copied from the original server so it's a completely manual process, what are the really cool things people have setup for user views in the system or device specific etc. Any custom monitors and alerts for general servers and network devices. Also from a default view setup what do you pull out or add to built in views to make them better and who do you target them to.

To give a IT dept setup example we have the following groups: Service Desk, Network Team, Server Team, Application Team.

And for our site we currently only use NPM, NCM, and SAM. I would love to add in SMAN and VMAN but getting that approved, especially now will be interesting.

What kind of views do you setup and why for these generic types of groups. Understanding that each site is different so as much info for the who and why you setup things that way is great.

Also I had trolled through long ago and pulled information from the forums on setting up custom CPU monitors and alerts for virtual hosts that are "right sized" so they almost alway run high CPU but that's not really an issue unless a secondary windows performance counter is high.

Any custom monitors and alerts like this are great.

Just looking to have the community share their general knowledge so that we can all make the software the best it can be for ourselves.

Top Replies

tszilagyi over 3 years ago +1

Links to security related documents in no particular order, might have some duplicates. Once again i have received all this via communication with support but MAKE SURE you understand how any of this will…

0 tszilagyi over 3 years ago
Links to security related documents in no particular order, might have some duplicates.
Once again i have received all this via communication with support but MAKE SURE you understand how any of this will apply / affect your own site before moving forward with it.
Ongoing advisory updates -
SolarWinds Security Advisory: www.solarwinds.com/securityadvisory
SolarWinds Security Advisory FAQs: www.solarwinds.com/securityadvisory/faq
SolarWinds CERT Advisory: www.solarwinds.com/certadvisory
CISA - https://us-cert.cisa.gov/ncas/alerts/aa20-352a
CISA - https://cyber.dhs.gov/ed/21-01/
Orion Databases - Permissions – LA/NTA/Orion Main - https://support.solarwinds.com/SuccessCenter/s/article/SQL-permission?language=en_US
SAM Non-Administrator - https://support.solarwinds.com/SuccessCenter/s/article/How-to-create-a-non-administrator-user-for-SAM-polling?language=en_US
Securing Orion Latest - https://support.solarwinds.com/SuccessCenter/s/article/Secure-Configuration-for-the-Orion-Platform?language=en_US
Password Storage - https://support.solarwinds.com/SuccessCenter/s/article/Credentials-are-securely-encrypted-in-Orion-Platform-products?language=en_US
SolarWinds Folder Access - https://support.solarwinds.com/SuccessCenter/s/article/Required-permissions-on-folders-accessed-by-SolarWinds?language=en_US
Other Links
Orion Platform Administrators Guide - https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/orion_platform_administrator_guide.htm
SQL DB - Best Practices - https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Core-SQL-Server-Configuration-Best-Practices-sw1430.htm
Windows Port exhaustion - https://support.solarwinds.com/SuccessCenter/s/article/Tweaking-Windows-Server-performance-to-prevent-port-exhaustion-when-using-Orion-modules?language=en_US
Multi-Module system guideline - https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Core-Multi-Module-System-Guidelines.htm
HTTPS - https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Core-Enabling-and-Requiring-Secure-Channels-with-SSL-sw1514.htm

Security
Security software exclusions and best practices
https://support.solarwinds.com/SuccessCenter/s/article/Files-and-directories-to-exclude-from-antivirus-scanning-for-Orion-Platform-products
Required folder permissions in Orion
https://support.solarwinds.com/SuccessCenter/s/article/Required-permissions-on-folders-accessed-by-SolarWinds?language=en_US
Use Orion permissions checker tool and how to manually change permissions.
Please note, the permissions checker tool is prone to show false positives and negatives:
https://support.solarwinds.com/SuccessCenter/s/article/Check-permissions-using-the-Orion-Permission-Checker

Disable DEP Data Execution's Policy on all poling engines
https://support.solarwinds.com/SuccessCenter/s/article/Disable-Data-Execution-Prevention?language=en_US
Turn off automatic root certificates update
https://support.solarwinds.com/SuccessCenter/s/article/Turn-off-automatic-root-certificates-update?language=en_US

Developers recommend disabling user account control to prevent issues with SolarWinds
https://support.solarwinds.com/SuccessCenter/s/article/Disable-User-Account-Control-UAC?language=en_US

How to configure Orion web console to use SSL
https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Core-Enabling-and-Requiring-Secure-Channels-with-SSL-sw1514.htm
Troubleshoot SSL certificate
https://support.solarwinds.com/Success_Center/Orion_Platform/Knowledgebase_Articles/Troubleshoot_issues_with_the_Orion_Web_Consoles_SSL_certificate
Setup SSL authentication (Also works with non-smart card setups)
https://thwack.solarwinds.com/t5/Group-Archive/Setup-Smart-Card-CAC-PKI-User-Authentication-and-STIG-Securing/gpm-p/535682

TLS
Enable TLS 1.2 using Nartac utility:
https://www.nartac.com/Products/IISCrypto/Download
Enable TLS 1.2 on Windows via registry.
https://support.solarwinds.com/SuccessCenter/s/article/Enable-TLS-in-Orion-Platform-products

Why the SA account should be used
https://thwack.solarwinds.com/t5/NPM-Documents/Why-i-need-SQL-SA-level-account-credentials-for-Configuration/ta-p/520049
SQL required user permissions:
https://support.solarwinds.com/SuccessCenter/s/article/SQL-permission
SQl permissions based errors and how to fix them:
https://support.solarwinds.com/Success_Center/Network_Performance_Monitor_(NPM)/Knowledgebase_Articles/Database_permission_error_in_the_Configuration_Wizard
Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.
Check database collation

How to encrypt Orion Database with an SSL connection
https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-encrypt-database-connections-with-ssl.htm

OrionLog_LogEntry
Change or Use custom port on SQL server that is not 1433
https://support.solarwinds.com/SuccessCenter/s/article/Using-Orion-with-a-MS-SQL-server-listening-on-a-custom-port
Cancel
Vote Up +1 Vote Down

Cancel
0 tszilagyi over 3 years ago

Place holder for other data
Cancel
Vote Up 0 Vote Down

Cancel