Tuesday, December 27, 2016

Filtering Tricks - Notes on a Folder



One of the very handy features of Varonis DatAdvantage is the ability to add Notes to folders and other objects in the Work Area.  An example of where we use Notes on a regular basis is at the start of a remediation project.  We will have a standard security structure that we are going to apply to the folders that we care about.  For example, we will make sure that there is a group with Modify privileges, a group with Read Only privileges, and an Administrative group.  If there are problems with making that change immediately (let’s say that are number of direct user permissions or a number of groups with List permissions) the analyst can Add a Note to the folder and we can come back to it later to discuss with data owner and server teams.

This allows the analyst to maintain his focus on reviewing the server security and make sure that we have a comprehensive issues list that can be reviewed with other members of the organization.

One thing we would like to do is to be able to produce a list of all of folders that have Notes on them.  We are typically going to use the 4f – File System Objects List as are starting point.  However with the Notes on access path filter there is no ability to do a binary selection on whether a folder has a Note or not.  So what we do is create a selection that looks for vowels.



This way, if you utilize words in all of your notes then this will produce just folders that have notes.  We typically create this once, save as a filter and then whenever you need this functionality, just import the filter when you start building the report.

Happy filtering!

Saturday, May 7, 2016

Vera - New Data Protection Solution

Saw a demo of a very interesting product from Vera yesterday.  They have a solution that protects a document (and other files) throughout the entire lifecycle of the data.   The protection and encryption stays with the document, yet users are still able to use native applications to work with the file; as long as they are authorized.  We are going to start a trial of the solution next week and I will keep you posted on our thoughts.

Sunday, January 3, 2016

Running into Mr. Robot

Ran into Mr. Robot in the middle of Manhattan on December 18th.  Christian Slater was very nice.  He indicated that they have yet to start shooting season two.  Loved Season 1 and am anxiously awaiting what dark twists this show will take.


Monday, December 21, 2015

Can Varonis Capture "Copy" Events?



I get asked regularly if Varonis DatAdvantage can identify when a user copies a file?  

It depends. 

  • If the user opens a file on a server and copies it to his desktop, Varonis DOES NOT record the copy to the desktop, only that the file on the server was opened.  
  • If the user copies a file from one folder to another on the same server, we will see a rename event.
  • If the user copies a file from one server to another server, you will see a File Open on the first server and a File Create on the second server.

Based on how must people ask the question, the answer is no.  To really know what the user did with the file you need a Data Loss Prevention solution like Digital Guardian (our choice) or Symantec DLP.

Friday, November 13, 2015

Identifying Distribution Groups within Security Groups

It is important to identify Active Directory distribution groups that are embedded in AD security groups, since it is not best practice to use distro groups for file server permissions.  Unfortunately within Varonis DatAdvantage the 3a Group Members report does not have a filter to sort by Group Type.  Here is a workaround that I have used; identifying group types by their email properties.


There are several caveats here.  It is possible that a Security group has an email address and it is possible that a distribution list does not have an email address assigned.  To get a truly comprehensive picture we would have to create a CSV file from the 3d report of all distribution groups, create a CSV file from the 3a report just looking for Groups embedded in groups, and then use Excel or PowerShell to merge the data to identify the distribution group members.












Wednesday, August 19, 2015

Varonis Connection lost to a server

If Varonis DatAdvantage is no longer collecting events from a server, the Varonis probe will send out error messages on a regular basis that look something like this:

Subject: [VARONISPROBE] Varonis: Connection lost between SERVER (48) and XXXXXXXXX (IDU Probe) (code 13002)

They generally are caused in one of several ways:

1) The server no longer exists. (Then you should disable it in or remove it from Varonis)
2) Someone has upgraded or rebuilt the server and therefore the agent no longer exists on the box. (Then you should manually install the agent)
3) Someone has disabled or removed the Varonis services (After uncovering the reason for the change you can manually reinstall the agent)
4) There are connectivity problems getting to the server. (This needs to get fixed outside of the Varonis infrastructure.

If you have administrative credentials to the monitored server, it is helpful to run Computer Management from the probe and connect to the monitored server from the probe.  The results of using the Computer Management tool from the probe may provide additional clues to the problem.  Looking through the Varonis Event logs on the monitored server via the Event viewer on the Probe can also be helpful.