Skip to main content

Netwrix Access Analyzer integration

Netwrix Access Analyzer can send information about administrator accounts to Privilege Secure. You create an access role in Access Analyzer, add two service accounts in Privilege Secure, add an integration connector, and then import the data.

The connector template for this integration is named StealthAUDIT. This is the former product name, and it is the template that Netwrix Access Analyzer uses. StealthAUDIT is also the default template for a new connector.

Prerequisites​

Run these Access Analyzer job groups successfully before you import. Privilege Secure can't import data that the jobs haven't collected.

  • Active Directory Inventory job group
  • Windows > Privileged Accounts > Local Administrators job group

For the jobs themselves, see the following Access Analyzer pages:

Create the access role in Access Analyzer​

The access role gives Privilege Secure a Client ID and a Client secret that it uses to read data from Access Analyzer. For the full wizard, see Assign application access.

  1. In Access Analyzer, go to the Access node and select Add Access in the upper-right corner. The Access Role wizard opens.

  2. Select An application accessing data remotely through Web Service, and then click Next.

  3. On the Application Access page, select Tables and click Add. The Select Database Objects window opens.

  4. Select these objects. Use Filter objects by name to find them.

    TypeObjects
    TablesSA_ADInventory_Domains, SA_SG_LocalAdmins_Details
    ViewsSA_ADInventory_ComputersView, SA_ADInventory_UsersView

  5. Click OK, review the tables and views, and click Next.

  6. On the Application Details page, enter Privilege Secure as the application name.

  7. Set Access Expiration. Select Access expires within (the default is 72 hours) or Access expires on specified date.

  8. Select Generate, and copy the Client ID and the Client secret.

  9. Click Finish, and then click Save on the Access view.

warning

The client secret stops working when the access expiration passes. Set an expiration that suits how long you want the integration to run, and create a new access role before the old one expires.

Add the service accounts in Privilege Secure​

The connector uses two service accounts. For the add form and its fields, see Service accounts.

Service accountName (example)UsernamePasswordPlatform
API accessAccess Analyzer APIThe Client ID from the access roleThe Client secret from the access roleWindows
AdministratorAccess Analyzer AdminA local administrator account on the Access Analyzer serverThe password of that accountWindows

For the administrator account, set Domain to the domain that the Access Analyzer server is in. For the API account, leave Domain empty.

Add the connector​

  1. Select Configuration > Integration Connectors.
  2. Click + above the list.
  3. Enter a name for the connector and an optional description.
  4. In Connector Template, select StealthAUDIT.
  5. Fill in the fields in the table.
  6. Click Save.
FieldDescription
Server Hostname*The host name of the server that Access Analyzer is installed on. The default is localhost.
Port*The port of the Access Analyzer web service. The default is 8082.
REST Credentials*The service account that holds the Client ID and Client secret. Select Access Analyzer API from the example.
Power Shell CredentialsOptional. The service account for the Access Analyzer server administrator. Select Access Analyzer Admin from the example.

An asterisk (*) marks a required field. Both credential fields list the service accounts that you added.

The Add Integration Connector form with the StealthAUDIT template selected, showing Server Hostname, Port 8082, REST Credentials, and Power Shell Credentials.

Import the data​

  1. Select Configuration > Integration Connectors.
  2. Select the connector that you created.
  3. Click Sync StealthAUDIT below the connector settings. The button is unavailable while an import runs, and the log of the last run appears under it. The import can take some time.

To follow the progress, open the Action Service on the Service Nodes page. See Monitor service nodes.