Welcome to ASGARD Analysis Cockpit Manual's documentation!

Contents:

• 1. Introduction
• 2. Requirements
  • 2.1. Hardware Requirement
  • 2.2. Network Requirements
  • 2.3. Internet Access during Installation
  • 2.4. Other Optional Requirements
• 3. Architecture
• 4. Quick Setup Guide
  • 4.1. Setup a New ESX VM and Mount the ISO
  • 4.2. Analysis Cockpit Installation
  • 4.3. Network Configuration
  • 4.4. Partitioning of the Hard Disk
  • 4.5. Proxy Configuration
  • 4.6. Install the Analysis Cockpit Services
• 5. First Steps
  • 5.1. Change User Password for the Console Logon
  • 5.2. Change User Password for the Web Frontend
  • 5.3. Migrate from Cockpit v2.8.x to Cockpit v3.x
• 6. Basic Concepts
  • 6.1. Section Events and Baselining
  • 6.2. Log Processing and Cases
  • 6.3. Understanding Users, Roles, Rights and Case Status
• 7. Setup
  • 7.1. License Installation
  • 7.2. System Update
  • 7.3. Set Users and User Rights
  • 7.4. Configure Canned Recommendations
  • 7.5. Syslog Forwarding
  • 7.6. Install a Certificate
  • 7.7. Configure LDAP
  • 7.8. Configure Notifications
  • 7.9. Log File Import
  • 7.10. Connect to ASGARD Management Center
  • 7.11. Asset View
• 8. Maintenance
  • 8.1. Regain Disk Space
• 9. Baselining Best Practices
  • 9.1. Customize Your View
  • 9.2. Manual Case Creation
  • 9.3. Create Cases Automatically
  • 9.4. Add to Case
  • 9.5. Customizing the Detailed View of Log Lines
  • 9.6. More Information on Assets and Cases
• 10. Case Management Best Practices
  • 10.1. Open a Case for Editing
  • 10.2. Case Dispatching
  • 10.3. Closing a Case
  • 10.4. Generate and Review auto_case_ids
  • 10.5. More Information about Cases
  • 10.6. Bulk Edit / Bulk Delete
• 11. API
• 12. Typical Pitfalls
  • 12.1. Certificate Validation Failed
  • 12.2. Log File Import of Previous Years
  • 12.3. Recover from a Full Disk
  • 12.4. ElasticSearch Index Locked Due to Low Free Disk Space
  • 12.5. Debug Failed File Imports
  • 12.6. Fixing a Broken Proxy Configuration
• 13. FAQs
  • 13.1. It seems that events are not visible or have been lost. What can I do to verify that they’re still in the database?
  • 13.2. I have created a case but it seems that no new incoming events are assigned to that existing case. How can I check what’s wrong?
  • 13.3. What is the password used to protect file downloads?
  • 13.4. My disk is getting full soon. What options do I have?
  • 13.5. I am using a Reverse Proxy to access the Analysis Cockpit. What do I have to take care of?
  • 13.6. I am using Internet Explorer and the Analyst Cockpit seems to run into a timeout. What can I do?
• 14. Glossary
  • 14.1. Baselining
  • 14.2. Cases
  • 14.3. Invisible (Backend)

Indices and tables

• Search Page