diff --git a/docs/accessanalyzer/26.1/install/adcs-tls-certificates.md b/docs/accessanalyzer/26.1/install/adcs-tls-certificates.md new file mode 100644 index 0000000000..2ae22aa569 --- /dev/null +++ b/docs/accessanalyzer/26.1/install/adcs-tls-certificates.md @@ -0,0 +1,86 @@ +--- +title: AD CS TLS Certificates +description: Let Access Analyzer obtain and renew its TLS certificate automatically from your on-premises Active Directory Certificate Services (AD CS) enterprise certificate authority. +sidebar_position: 4.6 +--- + +The `adcs` mode hands certificate issuance and renewal to your own Active Directory Certificate Services (AD CS) enterprise certificate authority (CA), instead of a certificate you rotate by hand or one from a public CA like Let's Encrypt. See [Automatic TLS Certificates](automatic-tls-certificates.md) for the full list of automatic modes and how they compare. + +cert-manager submits enrollment requests to your AD CS server's `/certsrv` web enrollment endpoint using NT LAN Manager (NTLM) authentication. The certificate AD CS issues lands at the same location Access Analyzer already reads its TLS certificate from, and cert-manager renews it before it expires — no maintenance window, no `update-cert` runs. + +This mode fits enterprises that already run a Microsoft public key infrastructure (PKI) and want Access Analyzer's certificate to come from it rather than from a public CA. + +## Before you start + +The `adcs` mode requires: + +1. **The AD CS enrollment details.** + + | Flag | Requirement | + |---|---| + | `--adcs-url` | The AD CS server's `/certsrv` web enrollment endpoint URL. Required. | + | `--adcs-username` | An NTLM enrollment account. Required. | + | `--adcs-password` | The account's password. Required. Pass it through the `DSPM_ADCS_PASSWORD` environment variable rather than the flag when scripting — see [Install with AD CS certificates](#install-with-ad-cs-certificates). | + | `--adcs-template` | The certificate template to request. Defaults to `WebServer`. | + | `--adcs-ca-bundle` | A PEM bundle for TLS to the AD CS server itself, separate from `--ca-bundle`. | + + See [Certificate Manager Flags](installer-reference.md#certificate-manager-flags) for full details on each flag. + +2. **A bootstrap certificate.** As with the `acme` mode, the web server needs something to serve before the first AD CS certificate arrives. Pass `--generate-self-signed-cert` to create a temporary self-signed pair, or supply `--tls-cert`/`--tls-key` with existing files instead. See [Before you start](automatic-tls-certificates.md#before-you-start) for the same requirement in the `acme` mode. + +:::warning +Set Extended Protection for Authentication (EPA) on the AD CS server's `/certsrv` endpoint to **Off** or **Allow**, not **Required**. The `adcs` issuer authenticates over NTLM without channel-binding tokens, so a `/certsrv` endpoint that requires EPA rejects every enrollment attempt with HTTP 401. +::: + +:::note +cert-manager's certificate signing request carries only Common Name and Organization in the subject. If the certificate template you name with `--adcs-template` requires Organizational Unit, Country, State, or Locality, AD CS rejects the enrollment. +::: + +## Install with AD CS certificates + +Follow [Install Access Analyzer](run-the-installer.md) as usual, adding the AD CS flags. You can skip the "Copy the TLS Certificate to the Server" step — `--generate-self-signed-cert` replaces it. + +```bash +export DSPM_ADCS_PASSWORD='' + +sudo -E dspm-installer \ + --hostname dspm.corp.example.com \ + --first-admin-email admin@corp.example.com \ + --cert-manager-issuer-mode adcs \ + --adcs-url https://ca.corp.example.com/certsrv \ + --adcs-username svc-adcs-enroll \ + --adcs-template WebServer \ + --generate-self-signed-cert +``` + +- `--cert-manager-issuer-mode adcs` turns on AD CS issuance. +- `--adcs-url`, `--adcs-username`, and `--adcs-password` (here set through `DSPM_ADCS_PASSWORD`) are required. +- Setting the password through the environment variable instead of `--adcs-password` keeps it out of shell history and process listings. +- `--generate-self-signed-cert` provides the bootstrap certificate. + +The install proceeds exactly as [Install Access Analyzer](run-the-installer.md) describes. When the services are up, the cluster requests the certificate from your AD CS server; issuance typically completes within a minute or two. Browsers connecting during that window see the self-signed bootstrap certificate and show a trust warning — the warning stops when the AD CS certificate is in place. + +:::note +The installer doesn't save the issuance mode to `/etc/dspm/installer.yaml`. Every installer run uses exactly the `--cert-manager-issuer-mode` you pass it; omitting the flag means manual certificates. Upgrading never changes the mode. +::: + +## Confirm the certificate + +From any machine with a browser, open `https://` — there should be no certificate warning. To check from a shell: + +```bash +openssl s_client -connect :443 -servername /dev/null \ + | openssl x509 -noout -subject -issuer -dates +``` + +The issuer should name your AD CS CA. If the issuer is still your own hostname, the bootstrap certificate is still serving. Check the certificate and challenge status on the server: + +```bash +sudo kubectl describe certificate dspm-tls -n access-analyzer +``` + +The certificate's events show what AD CS returned, including an HTTP 401 from an EPA-hardened endpoint or a rejected enrollment from a template requiring unsupported subject fields. + +## Switch an existing installation + +Switching to, from, or between automatic modes works the same way for `adcs` as it does for the other modes. See [Switch an existing installation](automatic-tls-certificates.md#switch-an-existing-installation) for the full procedure. diff --git a/docs/accessanalyzer/26.1/install/automatic-tls-certificates.md b/docs/accessanalyzer/26.1/install/automatic-tls-certificates.md new file mode 100644 index 0000000000..c736479fbe --- /dev/null +++ b/docs/accessanalyzer/26.1/install/automatic-tls-certificates.md @@ -0,0 +1,124 @@ +--- +title: Automatic TLS Certificates +description: Let Access Analyzer obtain and renew its TLS certificate automatically from Let's Encrypt or another ACME certificate authority, or from an internal chain it manages itself. +sidebar_position: 4.5 +--- + +Instead of supplying a certificate file and rotating it by hand, you can hand certificate issuance and renewal to the cluster itself. Pass `--cert-manager-issuer-mode` to the installer and Access Analyzer obtains its own certificate, renews it before it expires, and reloads it without a restart — no maintenance window, no `update-cert` runs. + +Three automatic modes are available: + +| Mode | Certificate comes from | Best for | +|---|---|---| +| `acme` | Let's Encrypt (default) or any ACME-compatible certificate authority | Servers reachable from the internet, or organizations running a private ACME CA | +| `adcs` | Your Active Directory Certificate Services CA | Enterprises with an existing Microsoft public key infrastructure (PKI) | +| `selfsigned` | An internal CA the cluster creates and manages itself | Demos, labs, and isolated environments | + +If you don't pass the flag, nothing changes: the installer uses the certificate files you supply, and you rotate them yourself with [`update-cert`](rotate-the-tls-certificate.md). + +This page covers the `acme` mode. For `adcs`, see [AD CS TLS Certificates](adcs-tls-certificates.md). For `selfsigned`, see the [Installer reference](installer-reference.md). + +## About Let's Encrypt and ACME + +The nonprofit Internet Security Research Group operates [Let's Encrypt](https://letsencrypt.org), a free, publicly trusted certificate authority (CA). There are no fees and no account to create ahead of time — you only provide an email address for expiry and incident notices. All mainstream browsers and operating systems trust its certificates, so users see no certificate warnings. + +Let's Encrypt issues certificates over Automatic Certificate Management Environment (ACME), an open protocol in which the certificate authority verifies that you control the domain before issuing. Access Analyzer uses the HTTP-01 challenge: the certificate authority connects to `http:///.well-known/acme-challenge/` on port 80 and checks for a response only your server could produce. The cluster answers this challenge automatically — you never handle the token. + +Certificates are valid for 90 days and Access Analyzer renews them automatically 30 days before expiry, using the same challenge. As long as your DNS record and firewall rules stay in place, no one has to update the certificate again. + +The `acme` mode works with any ACME-compatible certificate authority, not only Let's Encrypt — see [Use a private ACME certificate authority](#use-a-private-acme-certificate-authority). + +## Before you start + +The `acme` mode with Let's Encrypt has requirements the manual certificate path doesn't: + +1. **Public DNS.** The hostname you install with must resolve on public DNS to this server. Let's Encrypt looks the name up itself and connects to whatever address it finds — an entry in `/etc/hosts` or on your internal DNS isn't enough. + +2. **Inbound ports 80 and 443 open from the internet.** The HTTP-01 challenge arrives on port 80; Access Analyzer serves the application itself on port 443. If a firewall or NAT blocks either, issuance never completes. + +3. **An email address** for the ACME account. Let's Encrypt sends certificate expiry warnings and incident notices there. + +4. **A bootstrap certificate.** The web server needs something to serve during the minute or two before the first Let's Encrypt certificate arrives. The simplest choice is `--generate-self-signed-cert`, which creates a temporary self-signed pair; you can pass `--tls-cert`/`--tls-key` with existing files instead. Use `--tls-cert-validity-days` (alias `--cert-days`) to set the bootstrap certificate's validity period — the default is 365 days, and the maximum is 36500. See the [Installer reference](installer-reference.md) for both flags. + +:::warning +The installer checks that the ACME flags are present, but it can't check that Let's Encrypt can actually reach your server. If DNS or the firewall is wrong, the install completes but the certificate stays pending and the site keeps serving the bootstrap certificate. See [If the certificate stays pending](#if-the-certificate-stays-pending). +::: + +## Install with automatic certificates + +Follow [Install Access Analyzer](run-the-installer.md) as usual, adding the ACME flags. You can skip the "Copy the TLS Certificate to the Server" step — `--generate-self-signed-cert` replaces it. + +```bash +sudo -E dspm-installer \ + --hostname dspm.example.com \ + --first-admin-email admin@example.com \ + --cert-manager-issuer-mode acme \ + --acme-email ops@example.com \ + --generate-self-signed-cert +``` + +- `--cert-manager-issuer-mode acme` turns on automatic issuance. +- This mode requires `--acme-email`. +- `--generate-self-signed-cert` provides the bootstrap certificate. + +Each flag also has an environment variable (`CERT_MANAGER_ISSUER_MODE`, `ACME_EMAIL`, `ACME_SERVER`), listed in the [Installer reference](installer-reference.md). + +The install proceeds exactly as [Install Access Analyzer](run-the-installer.md) describes. When the services are up, the cluster requests the certificate from Let's Encrypt; issuance typically completes within a minute or two. Browsers connecting during that window see the self-signed bootstrap certificate and show a trust warning — the warning stops when the Let's Encrypt certificate is in place. + +:::note +The installer doesn't save the issuance mode to `/etc/dspm/installer.yaml`. Every installer run uses exactly the `--cert-manager-issuer-mode` you pass it; omitting the flag means manual certificates. Upgrading never changes the mode. +::: + +## Confirm the certificate + +From any machine with a browser, open `https://` — there should be no certificate warning. To check from a shell: + +```bash +openssl s_client -connect :443 -servername /dev/null \ + | openssl x509 -noout -subject -issuer -dates +``` + +The issuer should name Let's Encrypt (for example `issuer=C=US, O=Let's Encrypt, CN=...`), and the dates should show a 90-day window. If the issuer is still your own hostname, the bootstrap certificate is still serving — see [If the certificate stays pending](#if-the-certificate-stays-pending). + +## If the certificate stays pending + +If the site keeps serving the bootstrap certificate more than a few minutes after install, the challenge is failing. On the server: + +```bash +sudo kubectl describe certificate dspm-tls -n access-analyzer +sudo kubectl get challenges -A +``` + +The certificate's events and the challenge's status show what Let's Encrypt saw. The common causes: + +- **The hostname doesn't resolve publicly**, or resolves to a different address. Check with a resolver outside your network: `dig +short @1.1.1.1`. +- **Port 80 is blocked.** The challenge always arrives on port 80, even though the application serves on 443. Test from outside your network: `curl -I http:///.well-known/acme-challenge/test` should return an HTTP response (a 404 is fine — a timeout is the problem). +- **Rate limits.** Let's Encrypt limits how many certificates it issues per domain per week. Repeated reinstalls against the same hostname can hit them; the challenge status names the limit explicitly. Wait, or test against the [staging environment](#use-a-private-acme-certificate-authority) instead. + +Fix the cause and the cluster retries automatically — no reinstall needed. + +## Use a private ACME certificate authority + +If your organization runs its own ACME-compatible certificate authority (for example smallstep `step-ca`), point `--acme-server` at its directory URL and supply that CA's root chain with `--ca-bundle` so Access Analyzer's own services trust the certificates it issues: + +```bash +sudo -E dspm-installer \ + --hostname dspm.corp.example.com \ + --cert-manager-issuer-mode acme \ + --acme-server https://ca.corp.example.com/acme/acme/directory \ + --acme-email pki-admins@corp.example.com \ + --ca-bundle /etc/dspm/corp-root-ca.pem \ + --generate-self-signed-cert +``` + +With a private CA the public-DNS requirement relaxes to: the hostname must resolve, and ports 80 and 443 must be reachable, **from the CA's network** rather than from the internet. + +:::note +Let's Encrypt's **staging** environment (`https://acme-staging-v02.api.letsencrypt.org/directory`) counts as a private CA here: its certificates chain to deliberately untrusted test roots. Use it to test the flow without consuming production rate limits, and pass its roots as the `--ca-bundle`. +::: + +## Switch an existing installation + +**From manual certificates to ACME** — re-run the installer with the `acme` flags. The new certificate replaces the existing one automatically at first issuance; you don't need any manual cleanup, and the web server loads it without a restart. If the previous setup used `--ca-bundle` and you're moving to public Let's Encrypt, also delete the `ca-bundle` line from `/etc/dspm/installer.yaml` so the installer doesn't reapply the old trust anchor. + +**From ACME back to manual certificates** — re-run the installer without `--cert-manager-issuer-mode` (or with `none`), supplying `--tls-cert`/`--tls-key` as usual, plus `--ca-bundle` if a private CA issued the certificate. From then on you rotate it yourself with [`update-cert`](rotate-the-tls-certificate.md). diff --git a/docs/accessanalyzer/26.1/install/installer-reference.md b/docs/accessanalyzer/26.1/install/installer-reference.md index 4e2573fece..d428659f95 100644 --- a/docs/accessanalyzer/26.1/install/installer-reference.md +++ b/docs/accessanalyzer/26.1/install/installer-reference.md @@ -30,6 +30,9 @@ Two environment variable names need care: `--hostname` reads `DSPM_HOSTNAME`, no | `--tls-cert` | `TLS_CERT_FILE` | `/etc/dspm/tls.crt` | PEM TLS certificate file, full chain with the leaf certificate first. Requires `--tls-key`. | | `--tls-key` | `TLS_KEY_FILE` | `/etc/dspm/tls.key` | PEM TLS private key file. Requires `--tls-cert`. | | `--ca-bundle` | `TLS_CA_BUNDLE_FILE` | none | PEM certificate authority (CA) bundle. Needed when a private CA issued the certificate. | +| `--generate-self-signed-cert` (alias `--self-signed`) | `DSPM_GENERATE_SELF_SIGNED_CERT` | `false` | Generate a one-time self-signed certificate and key pair at the resolved TLS paths instead of requiring one on disk. Requires `--hostname`. The installer only generates a certificate when none already exists at those paths — it never overwrites an existing one — and skips this under `--dry-run`. | +| `--tls-cert-validity-days` (alias `--cert-days`) | `DSPM_TLS_CERT_VALIDITY_DAYS` | `365` | Validity period, in days, for a certificate `--generate-self-signed-cert` generates. Maximum `36500`. | +| `--cert-manager-issuer-mode` (alias `--issuer-mode`) | `CERT_MANAGER_ISSUER_MODE` | `none` | Hand issuance and renewal of the `dspm-tls` certificate to cert-manager instead of managing it yourself: `none`, `selfsigned`, `adcs`, or `acme`. See [Automatic TLS Certificates](automatic-tls-certificates.md) for the `acme` mode. The installer doesn't save this to `/etc/dspm/installer.yaml` — see [Configuration File](#configuration-file). | | `--size` | `SIZE` | `medium` | Deployment size: `small`, `medium`, `large`, or `enterprise`. Case-insensitive. See [Size](requirements.md#size) for the CPU, RAM, and disk each size requires. | | `--target-revision` | `TARGET_REVISION` | `1.*` | Release version to install, such as `1.5.0`. The default installs the latest 1.x release. Also appears as **Target Revision** under **Show advanced settings?**. | | `--accept-warnings` | `ACCEPT_WARNINGS` | `false` | Continue past preflight warnings without asking. | @@ -41,6 +44,7 @@ Two environment variable names need care: `--hostname` reads `DSPM_HOSTNAME`, no | `--clickhouse-data-dir` | `CLICKHOUSE_DATA_DIR` | none | Custom directory for the analytics store's data. | | `--log-exports-storage` | `LOG_EXPORTS_STORAGE` | none | Persistent volume claim (PVC) size for log exports, such as `10Gi`. | | `--skip-preflight` | `SKIP_PREFLIGHT` | `false` | Skip the preflight checks. For testing only. | +| `--preflight` | `DSPM_PREFLIGHT` | `false` | Run the preflight checks only, then exit without installing. See [Preflight-only mode](#preflight-only-mode). | | `--version` | — | — | Print the installer version and exit. | | `--help` | — | — | Print flag help and exit. | @@ -73,6 +77,33 @@ These flags control the underlying Kubernetes platform, ArgoCD, and Helm chart t A custom data directory must be an absolute path to an existing, writable directory. It can't be `/`, can't sit under `/bin`, `/sbin`, `/boot`, `/dev`, `/etc`, `/lib`, `/lib64`, `/proc`, `/root`, `/run`, `/sys`, `/usr`, or `/var/log`, and can't contain quotes, backslashes, dollar signs, or backticks. +### Certificate Manager Flags + +The installer only reads the following flags when `--cert-manager-issuer-mode` selects the matching mode: the Automatic Certificate Management Environment (ACME) flags apply to `acme`, and the Active Directory Certificate Services (AD CS) flags apply to `adcs`. See [Automatic TLS Certificates](automatic-tls-certificates.md) for `acme` and `selfsigned`, and [AD CS TLS Certificates](adcs-tls-certificates.md) for `adcs`. + +| Flag | Environment variable | Default | Description | +|---|---|---|---| +| `--acme-email` | `ACME_EMAIL` | none | Email address for the ACME account. Required in `acme` mode. | +| `--acme-server` | `ACME_SERVER` | Let's Encrypt production | ACME directory URL. Point this at a private ACME certificate authority (CA) for internal issuance. | + +| Flag | Environment variable | Default | Description | +|---|---|---|---| +| `--adcs-url` | `ADCS_URL` | none | The Active Directory Certificate Services (AD CS) server's `/certsrv` web enrollment endpoint URL. Required in `adcs` mode. | +| `--adcs-username` | `ADCS_USERNAME` | none | NT LAN Manager (NTLM) enrollment account for the AD CS server. Required in `adcs` mode. | +| `--adcs-password` | `DSPM_ADCS_PASSWORD` | none | Password for `--adcs-username`. Required in `adcs` mode. The installer never persists it to the configuration file or logs it. | +| `--adcs-template` | `ADCS_TEMPLATE` | `WebServer` | Certificate template to request from the AD CS server. | +| `--adcs-ca-bundle` | `ADCS_CA_BUNDLE` | none | PEM bundle for TLS to the AD CS server itself. This is separate from `--ca-bundle`, which covers Access Analyzer's own certificate chain. | + +:::warning +Set Extended Protection for Authentication (EPA) on the AD CS server's `/certsrv` endpoint to **Off** or **Allow**, not **Required**. The `adcs` issuer authenticates over NTLM without channel-binding tokens, so a `/certsrv` endpoint that requires EPA rejects every enrollment attempt with HTTP 401. +::: + +:::note +cert-manager's certificate signing request carries only Common Name and Organization in the subject. If the AD CS certificate template you name with `--adcs-template` requires Organizational Unit, Country, State, or Locality, AD CS rejects the enrollment. +::: + +There's no interactive wizard step for `adcs` mode — configure it with flags only. + ### Value Checks The installer rejects bad values before it changes anything on the server. @@ -89,7 +120,7 @@ The installer rejects bad values before it changes anything on the server. The installer keeps its answers in `/etc/dspm/installer.yaml`. It writes the file itself: after every confirmed prompt in an interactive run, or once after license validation in a flag-driven run. On the first save it prints `Progress saved to /etc/dspm/installer.yaml — future runs will pre-fill these values.` A later run reads the file and asks only for what's still missing, so a canceled install resumes where it stopped. -Keys are the flag names. The installer writes `license-key`, `hostname`, `first-admin-email`, `first-admin-name`, `tls-cert`, `tls-key`, and `ca-bundle`, plus `target-revision` when you pin a version other than `1.*`. It keeps any keys you add, and never saves operational flags such as `--accept-warnings`, `--assume-yes`, `--dry-run`, and `--skip-preflight`. You can also write the file by hand before the first run. +Keys are the flag names. The installer writes `license-key`, `hostname`, `first-admin-email`, `first-admin-name`, `tls-cert`, `tls-key`, and `ca-bundle`, plus `target-revision` when you pin a version other than `1.*`. It keeps any keys you add, and never saves operational flags such as `--accept-warnings`, `--assume-yes`, `--dry-run`, `--skip-preflight`, `--preflight`, and `--cert-manager-issuer-mode`. You can also write the file by hand before the first run. ```yaml title="/etc/dspm/installer.yaml" license-key: XXXX-XXXX-XXXX-XXXX-XXXX-V3 @@ -146,6 +177,20 @@ When the `antivirus` check finds a product, add these paths to that product's ex The [Requirements](requirements.md) page lists the 18 hosts the `network` check connects to and the CPU, RAM, and disk figures for each size. +### Preflight-only mode + +Pass `--preflight` to run the preflight checks and exit, without installing k3s, creating the cluster, or writing a configuration file. Use it to validate a server before you commit to an install. + +`--preflight` runs the same checks listed in this section, plus a certificate check: the PEM certificate and key at the resolved TLS paths must exist, match, and not be expired. A certificate expiring within 30 days still passes, because a real install would also proceed on it. Pass `--hostname` to also verify the certificate's Subject Alternative Names cover it, and `--size` to check RAM, CPU, and disk against the size you intend to install. Under `--dry-run`, the installer skips the certificate check, matching a dry-run install. + +You can't combine `--preflight` with `--uninstall` or `--skip-preflight`. It writes the same `/var/log/dspm-installer.log` and `/var/log/dspm-preflight.json` files a regular install writes, except under `--dry-run`, where the installer doesn't write the JSON report. + +| Code | Meaning | +|---|---| +| 0 | Every check passed, or the installer raised only warnings and you passed `--accept-warnings`. | +| 80 | A check failed, or the installer raised warnings and you didn't pass `--accept-warnings`. | +| 1 | You combined `--preflight` with `--uninstall` or `--skip-preflight`, or the checks themselves couldn't run. | + ## RHEL and CentOS Preparation Complete these steps on a Red Hat Enterprise Linux (RHEL) or CentOS server before you run the installer. diff --git a/docs/accessanalyzer/26.1/install/run-the-installer.md b/docs/accessanalyzer/26.1/install/run-the-installer.md index 5c9b9bcccf..78251f22fe 100644 --- a/docs/accessanalyzer/26.1/install/run-the-installer.md +++ b/docs/accessanalyzer/26.1/install/run-the-installer.md @@ -48,6 +48,10 @@ Keep the `channel=stable` parameter. Without it, the registry returns the newest The installer expects the certificate at `/etc/dspm/tls.crt` and the private key at `/etc/dspm/tls.key`. If you keep them somewhere else, enter the paths when the installer prompts for them, or pass them with `--tls-cert` and `--tls-key`. +:::tip +Supplying your own certificate isn't the only option. `--generate-self-signed-cert` has the installer generate one for you, so you can skip this section. Or hand issuance and renewal to a certificate authority instead: see [Automatic TLS Certificates](automatic-tls-certificates.md) for Let's Encrypt or another Automatic Certificate Management Environment (ACME) certificate authority, and [AD CS TLS Certificates](adcs-tls-certificates.md) for an on-premises Active Directory Certificate Services (AD CS) CA. +::: + 1. Create the directory. ```bash diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md index 05a22e0b35..4e9362eeb2 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsource.md @@ -14,8 +14,6 @@ To add a content source: **Step 1 –** In administrative web console, navigate to **Content** →Sources → General and click **Add** to launch the Add source wizard. -![add_source_wizard_thumb_0_0](/images/dataclassification/5.7/admin/sources/add_source_wizard_thumb_0_0.webp) - **Step 2 –** Select the source you need and configure its settings. See detailed instructions for the sources: @@ -23,8 +21,10 @@ the sources: - [Add Single Database](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsingledatabase/addsingledatabase.md) (Microsoft SQL Server, MySQL, PostgreSQL, or Oracle database) - [Add SQL Server](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addsqlserversource/addsqlserversource.md) (All Microsoft SQL Server, MySQL, PostgreSQL, or Oracle databases on a server) - [Dropbox](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/adddropbox.md) -- [Exchange Server](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserver.md) or - [Exchange Mailbox](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailbox.md) +- [Exchange Server (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md) or + [Exchange Mailbox (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md) +- [Exchange Server (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md) or + [Exchange Mailbox (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md) - [File System](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/overview.md) (includes Folder and File) - [Google Drive Source](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/addgdsource.md) - [Outlook Mail Archive](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/outlookmailarchive.md) @@ -33,8 +33,8 @@ the sources: The **Sources** section lists all your content sources. :::note -When adding a source or managing source configuration, the most commonly used source -settings are displayed by default. However, some source types have additional configuration options -that can be displayed by clicking the Advanced Settings ("wrench" icon). You can -set the Advanced Settings to display by default in User Preferences, accessible by clicking on the username. +When you add a source or manage source configuration, the console displays the most commonly used +source settings by default. However, some source types have additional configuration options +that appear when you click the Advanced Settings ("wrench" icon). You can +set the Advanced Settings to display by default in User Preferences, which you open by clicking the username. ::: diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailbox.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md similarity index 71% rename from docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailbox.md rename to docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md index fb4bb787ab..942383ef15 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailbox.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md @@ -1,18 +1,20 @@ --- -title: "Exchange Mailbox" -description: "Exchange Mailbox" +title: "Exchange Mailbox (EWS)" +description: "Exchange Mailbox (EWS)" sidebar_position: 30 --- -# Exchange Mailbox +# Exchange Mailbox (EWS) -Use the **Exchange Mailbox** source to enable the crawling and classification of content stored in a -single Exchange mailbox on the on-premises Exchange server or Exchange Online. +Use the **Exchange Mailbox (EWS)** source to crawl and classify content stored in a +single Exchange mailbox on an on-premises Exchange server or in Exchange Online, using Exchange Web Services (EWS). +Microsoft is deprecating EWS for Exchange Online and will fully disable it in April 2027. Netwrix recommends using [Exchange Mailbox (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md) +for any new sources intended to crawl Exchange Online mailboxes. **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. -**Step 2 –** Select **Exchange Mailbox** source type and in the properties window specify the +**Step 2 –** Select the **Exchange Mailbox (EWS)** source type and in the properties window specify the necessary settings. ## Authentication type: Modern authentication @@ -22,38 +24,36 @@ specify the following: | Option | Description | | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Authentication type | Select **Modern (Exchange Online)** | +| Authentication type | Select **Modern (O365)** | | Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | | Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | -![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) - ## Authentication type: Basic -If you plan to use this authentication type, you will need to specify the following: +To use this authentication type, specify the following: | Option | Description | Comments | | ------------------------ | ------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Email Address / Password | **Administrator** account that has been assigned both: 1. **Impersonation** right 2. **Discovery Management** role | See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details on the rights assignment. | +| Email Address / Password | An **Administrator** account with both: 1. **Impersonation** right 2. **Discovery Management** role | See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details on the rights assignment. | ## Other configuration settings -By default, only basic settings are displayed. To view advanced options, click the "wrench" icon at +By default, only basic settings appear. To view advanced options, click the "wrench" icon at **Settings** in the bottom. | Option | Description | Comments | | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Basic settings** | | | -| Mailbox | Mailbox to be crawled. | When using impersonation, the settings can be like the following example:
  • Email Address
  • administrative account granted Impersonation right, e.g. _administrator@cs.com_
  • Mailbox
  • target mailbox, e.g. _test@cs.com_.
| -| Crawl Range | Define what portions of data should be retrieved from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each object.
| | +| Mailbox | The mailbox to crawl. | When you use impersonation, the settings can be like the following example:
  • Email Address
  • administrative account granted Impersonation right, e.g. _administrator@cs.com_
  • Mailbox
  • target mailbox, e.g. _test@cs.com_.
| +| Crawl Range | Define the time period to crawl:
  • Select **Date Range** to crawl a static set of data within the specified interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date onwards, taking into account the last crawl date for each object.
| | | Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | Applies to Exchange Online. | -| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • document images will not be processed
  • **Default**
  • defaults to the source setting (if configuring a path) or the global setting (if configured on a source)
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | -| Source Group | Select the source group (if any). | | +| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • skip processing document images
  • **Default**
  • defaults to the global setting
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | +| Source Group | Select the source group to add this source to. If no source groups exist, the product automatically creates one named after the source. | | | Pause source on creation | Select if you want to make other configuration changes before data collection occurs. | | | **Advanced settings** | | | -| Build Search Index | Select if you want search index to be created. | | -| Re-Index Period | Specify how often the source should be checked for changes. Default is **7** days. | Netwrix recommends using default values. | -| Priority | Set priority for this data source to be crawled. Select the priority level from the list values:
  • Highest
  • High
  • Normal
  • Low
  • Lowest
| | -| Document Type | Specify a value that you can use to restrict queries when using the Netwrix Data Classification search index. | | +| Build Search Index | Select to create a search index. | | +| Re-Index Period | Specify how often to check the source for changes. Default is **7** days. | Netwrix recommends using default values. | +| Priority | Set the crawl priority for this data source. Select the priority level from the list values:
  • Highest
  • High
  • Normal
  • Low
  • Lowest
| | +| Document Type | Specify a value to restrict queries when using the Netwrix Data Classification search index. | | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md new file mode 100644 index 0000000000..4c1682bc71 --- /dev/null +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md @@ -0,0 +1,48 @@ +--- +title: "Exchange Mailbox (Graph)" +description: "Exchange Mailbox (Graph)" +sidebar_position: 35 +--- + +# Exchange Mailbox (Graph) + +Use the **Exchange Mailbox (Graph)** source to crawl and classify content stored in a single Exchange Online mailbox using the Microsoft Graph API. For on-premises Exchange mailboxes, use [Exchange Mailbox (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md) instead. + +**Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click +**Add**. + +**Step 2 –** Select **Exchange Mailbox (Graph)** source type and in the properties window specify the +necessary settings. + +## Authentication + +You must specify the following: + +| Option | Description | +| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | +| Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | +| Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details of the permissions to grant to the application. | + + +## Other configuration settings + +By default, only basic settings appear. To view advanced options, click the "wrench" icon at +**Settings** in the bottom. + +| Option | Description | Comments | +| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **Basic settings** | | | +| Cloud Environment | Select the Azure environment that hosts your Exchange Online tenant. | | +| Mailbox | The mailbox to crawl. | E.g. _test@cs.com_. | +| Crawl Range | Define the time period to crawl:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each object.
| | +| Crawl In-Place Archive | Select this option if you want to crawl Exchange Online in-place archive mailboxes. | | +| OCR Processing Mode | Set the processing mode for document images:
  • **Disabled**
  • skip processing document images
  • **Default**
  • defaults to the global setting
  • **Normal**
  • process the images with normal quality settings
  • **Enhanced**
  • upscale the images further to allow more accurate results.
| The **Enhanced** mode will provide better accuracy but can lead to longer processing time if the images don't contain text. | +| Source Group | Select the source group to add this source to. If no source groups exist, the product automatically creates one named after the source. | | +| Pause source on creation | Select if you want to make other configuration changes before data collection occurs. | | +| **Advanced settings** | | | +| Build Search Index | Select to create a search index. | | +| Re-Index Period | Specify how often to check the source for changes. Default is **7** days. | Netwrix recommends using default values. | +| Priority | Set the crawl priority for this data source. Select the priority level from the list values:
  • Highest
  • High
  • Normal
  • Low
  • Lowest
| | +| Document Type | Specify a value to restrict queries when using the Netwrix Data Classification search index. | | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserver.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md similarity index 55% rename from docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserver.md rename to docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md index 672ebb45df..9dc7133467 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserver.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md @@ -1,70 +1,68 @@ --- -title: "Exchange Server" -description: "Exchange Server" +title: "Exchange Server (EWS)" +description: "Exchange Server (EWS)" sidebar_position: 40 --- -# Exchange Server +# Exchange Server (EWS) -Use the Exchange Server source configuration screen to enable the crawling and classification -of multiple Exchange mailboxes from the same Exchange server. +Use the Exchange Server (EWS) source configuration screen to crawl and classify +multiple Exchange mailboxes from the same Exchange server, using the Exchange Web Services (EWS). "Microsoft is deprecating EWS for Exchange Online and will fully disable it in April 2027. Netwrix recommends using [Exchange Server (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md) for any new sources intended to crawl Exchange Online. -**IMPORTANT** Automatic detection, crawling, and classification of multiple Exchange mailboxes from -the same Exchange server (and, respectively, _Exchange Server_ content source configuration) is only -supported for Exchange Server 2013 or later due to limitations in the Microsoft APIs. For earlier -versions, consider using _Exchange Mailbox_ content source. +:::note +Automatic detection, crawling, and classification of multiple Exchange mailboxes from +the same Exchange server—and therefore the _Exchange Server (EWS)_ content source—works +only with Exchange Server 2013 or later, due to limitations in the Microsoft APIs. For earlier +versions, consider using the _Exchange Mailbox (EWS)_ content source. +::: -You can use Match Rules to include and exclude the certain mailboxes. +You can use Match Rules to include or exclude specific mailboxes. -To configure an Exchange Server source, follow these steps. +To configure an Exchange Server (EWS) source, follow these steps. **Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click **Add**. -**Step 2 –** Select **Exchange** source type and in the properties window specify the necessary +**Step 2 –** Select the **Exchange Server (EWS)** source type and in the properties window specify the necessary settings. -**Step 3 –** To display all settings, click the "wrench" icon next to **Settings**. +**Step 3 –** To display all settings, click the "wrench" icon next to **Settings** in the bottom-left corner. ## Authentication type: Modern authentication -:::note -For Email Address / Password, the Administrator account that has been assigned the right -of the Discovery Management role and be given the Mailbox Search and MailboxSearchApplication -permissions. -::: - - If you plan to use this authentication type, specify the following: | Option | Description | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Authentication type | Select **Modern (Exchange Online)** | +| Authentication type | Select **Modern (O365)** | | Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | | Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | | Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | | Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). | -![exchangeonline_cfg_modern_auth_thumb_0_0](/images/dataclassification/5.7/admin/sources/exchangemailbox/exchangeonline_cfg_modern_auth_thumb_0_0.webp) - ## Authentication type: Basic -If you plan to use this authentication type, you will need to specify the following: +:::note +For Email Address / Password, use an Administrator account that has the Discovery Management +role and the Mailbox Search and MailboxSearchApplication permissions. +::: + +To use this authentication type, specify the following: | Option | Description | | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Email Address / Password | Administrator account that has been assigned the right of Impersonation as well as the Discovery Management role. See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details on the rights assignment. | +| Email Address / Password | Administrator account with the Impersonation right and the Discovery Management role. See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details on the rights assignment. | ## Other configuration settings -The following settings are also required in both cases: +Both authentication types also require the following settings: | Option | Description | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Exchange API URL | By default, the crawling engine will attempt to locate the necessary URL of Exchange Web Services API by using the _Exchange AutoDiscover_ functionality. So, typically, you can leave this field blank. If, however, the _Exchange AutoDiscover_ isn't available, then you should specify the Exchange API URL explicitly as follows: `https:///EWS/Exchange.asmx`. | -| Crawl Range | Define what portions of data should be retrieved from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| -| Match Rules | Define which mailboxes will be crawled as part of an Exchange Server source. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter if you want all mailboxes to be crawled | -| Detection Period | Specify how often the source should be checked for changes. Default period is 1 day. | +| Exchange API URL | By default, the crawling engine uses the _Exchange AutoDiscover_ functionality to locate the Exchange Web Services API URL, so you can typically leave this field blank. If _Exchange AutoDiscover_ isn't available, specify the Exchange API URL explicitly: `https:///EWS/Exchange.asmx`. | +| Crawl Range | Define which portions of data to retrieve from the Exchange server:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| +| Match Rules | Define rules with regular expressions to limit which mailboxes the product crawls. You must define at least one match rule. Examples: 1. `.*@netwrix.com`— enter the wildcard (\*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter to crawl all mailboxes | +| Detection Period | Specify how often to check the source for changes. Default period is 1 day. | -Having specified all the necessary settings, click the **Save** button. +After specifying all the necessary settings, click **Save**. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md new file mode 100644 index 0000000000..09c68c4203 --- /dev/null +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md @@ -0,0 +1,47 @@ +--- +title: "Exchange Server (Graph)" +description: "Exchange Server (Graph)" +sidebar_position: 45 +--- + +# Exchange Server (Graph) + +Use the Exchange Server (Graph) source configuration screen to crawl and classify +multiple Exchange mailboxes in the same tenant. The Graph source type connects only to Exchange Online. To crawl mailboxes on an on-premises Exchange server, use [Exchange Server (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md). + +You can use Match Rules to include or exclude specific mailboxes. + +To configure an Exchange Server (Graph) source, follow these steps. + +**Step 1 –** In Netwrix Data Classification management console, open the **Sources** view and click +**Add**. + +**Step 2 –** Select **Exchange Server (Graph)** source type and in the properties window specify the necessary +settings. + +**Step 3 –** To display all settings, click the "wrench" icon next to **Settings** in the bottom-left corner. + +## Authentication + +You must specify the following: + +| Option | Description | +| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| Admin Username | Specify the administrative account for the required Exchange Online organization. The user must have a mailbox connected to it to crawl Exchange. | +| Tenant ID | Enter the **Tenant ID** you obtained at [Step 5: Obtain Tenant ID](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-5-obtain-tenant-id). | +| Certificate thumbprint | Enter the certificate thumbprint you prepared at [Step 4: Configure Certificates & secrets](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md). | +| Application ID | Enter the app ID you got at application registration at [Step 2: Create and Register a new app in Azure AD](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md#step-2-create-and-register-a-new-app-in-azure-ad) (you can find it in the Azure AD app properties >**Overview**). See [Configure Microsoft Exchange for Crawling and Classification](/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md) for details of the permissions to grant to the application. | + +## Other configuration settings + +Specify the following settings: + +| Option | Description | +| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Cloud Environment | Select the Azure environment that hosts your Exchange Online tenant. | +| Crawl Range | Define which portions of data to retrieve from Exchange Online:
  • Select **Date Range** to crawl a static set of data within the required interval.
  • Select **Since** if you want to periodically re-crawl content from the specified date, taking into account the last crawl date for each artifact.
| +| Match Rules | Define rules with regular expressions to limit which mailboxes the product crawls. You must define at least one match rule. Examples: 1. `.*@netwrix.com`— enter the wildcard (.*) and the domain (here `netwrix.com`) to restrict crawling to a set of domain mailboxes 2. `.*`—enter to crawl all mailboxes. | +| Detection Period | Specify how often to check the source for changes. Default period is 1 day. | + + +After specifying all the necessary settings, click **Save**. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md index c6a746c0fc..ad88fcc4c3 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/sharepointonline.md @@ -6,14 +6,14 @@ sidebar_position: 100 # SharePoint Online -Office 365 customers can configure the collector service to automatically detect and queue their -employees SharePoint Online sites hosted in Office 365. An account with Tenant administration rights -must be supplied, and the frequency of the detection of new SharePoint Online sites must be set. It -is also possible to provide a filter expression to ensure that certain SharePoint Online paths are -included and others excluded as required. - -Optionally, you can set up the resources necessary to ensure Netwrix Data -Classification is enabled and configured on the detected SharePoint Online sites. Templating allows +If you're an Office 365 customer, you can configure the collector service to automatically detect and queue your +employees' SharePoint Online sites hosted in Office 365. You must supply an account with Tenant +administration rights and set how often the service detects new SharePoint Online sites. You can +also provide a filter expression to include certain SharePoint Online paths and exclude others as +required. + +Optionally, you can set up the resources needed to enable and configure Netwrix Data +Classification on the detected SharePoint Online sites. Templating allows an administrator to preconfigure classification settings for site collections. For more information, review the associated templating guide. @@ -27,11 +27,12 @@ Complete the following fields: | Option | Description | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| SharePoint URL | The root of the site collections to be added, by clicking the “(Multiple Urls)” link you can add multiple SharePoint Online Site Collections to be crawled against the same credentials. | +| SharePoint URL | The root of the site collections to add. Click the “(Multiple Urls)” link to add multiple SharePoint Online Site Collections that use the same credentials for crawling. | +| Cloud Environment | Select the Azure instance that hosts your SharePoint Online tenant. | | Username | Enter username in the following formats: DOMAIN\USERNAME and USERNAME@DOMAIN. | | Password | Enter your password for SharePoint Online. | -| Match Rules | Enter the site collections' path for crawling the documents. At least one match rule must be included. Match rules are regular expressions, for example, https:\/\/example.sharepoint.com\/sites\/. | +| Match Rules | Enter the site collections' path for crawling the documents. You must include at least one match rule. Match rules are regular expressions, for example, https:\/\/example.sharepoint.com\/sites\/. | | Classification template | Specify the required Classification template for writing classifications. See the [Enable Write Classifications](/docs/dataclassification/5.7/contentconfigurationoverview/taxonomies/enablewriteclassifications.md) and [Working with SharePoint templates](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/introduction/workwithtemplates.md) topics for more information. | -| Detection Period | Specify how often you will detect new site collections. Default period is 1 day. | +| Detection Period | Specify how often to detect new site collections. Default period is 1 day. | After configuring the settings, click the **Save** button. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md index 866ff6b9ad..d6d8e8f323 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/manage/exchangemailbox.md @@ -1,47 +1,47 @@ --- -title: "Exchange Mailbox" -description: "Exchange Mailbox" +title: "Exchange" +description: "Exchange" sidebar_position: 40 --- -# Exchange Mailbox +# Exchange -For the Exchange Mailbox source, you can configure the list of folders/emails to exclude from +For the Exchange sources, you can configure the list of folders/emails to exclude from processing. Do the following: -1. In the management console, click **Sources** →**Exchange Mailbox**, then Collection Exclusion - will be displayed. +1. In the management console, click **Sources** →**Exchange Mailbox (EWS)** or **Exchange Mailbox (Graph)**. The Collection Exclusion page + appears. 2. To create an exclusion, click **Add**. 3. ![boxexclusions](/images/dataclassification/5.7/admin/sources/database/boxexclusions.webp) 4. In the **Details** window, on the **Filter** tab enter the name of the entity to exclude. Consider the following: - - If you specify a folder name (e.g. “Drafts”) with no special characters, then any folders with - that specific name will be excluded. + - If you specify a folder name (e.g. “Drafts”) with no wildcards, then the product excludes + any folders with that specific name. :::note - Adding an exclusion of this type will match any folders with the name provided, wherever they are within the mailbox. + Adding an exclusion of this type will match any folders with the name you provide in all configured sources. ::: - When you wrap the exclusion in wildcard indicators (e.g. “\*Deleted\*”), the system will match any folder/email with “Deleted” somewhere in the title. :::note - You can optionally enter exclusion location in the **Test Path** field to verify the + You can optionally enter an example exclusion location or path in the **Test Path** field to verify the new filter, and click **Test**. ::: -5. If needed, you can use metadata conditions to restrict when an exclusion filter should be - applied. For that, click **Condition** tab and click **Add**. Then select how the exclusion - conditions will work: it can check if metadata field of the document has any value, isn't - specified, or matches a specific metadata value. +5. If needed, you can use metadata conditions to restrict when the product applies an exclusion + filter. For that, click **Condition** tab and click **Add**. Then select how the exclusion + conditions will work: it can check whether the document's metadata field has any value, has no + value, or matches a specific metadata value. | Criteria | Condition | | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | Comparison | Compare a value in the document metadata field with the value set by condition. With this criteria selected, you will then need to specify: - **Field name** — document metadata field to check - **Comparison** — operator to use (for example, "doesn't contain") - **Value** — value to compare against For example, to exclude documents tagged with year 2018, set the condition as follows: - **Field Name** — _DocYear_ - **Comparison** — _equals_ - **Value** — _2018_ | - | Has any value | Exclude the document if its metadata field has any value. With this criteria selected, specify **Field Name**. | - | Has no values | Exclude the document if metadata field value isn't specified. With this criteria selected, specify **Field Name**. | + | Comparison | Compare a value in the document metadata field with the value the condition sets. When you select this criteria, specify: - **Field name** — document metadata field to check - **Comparison** — operator to use (for example, "doesn't contain") - **Value** — value to compare against For example, to exclude documents tagged with year 2018, set the condition as follows: - **Field Name** — _DocYear_ - **Comparison** — _equals_ - **Value** — _2018_ | + | Has any value | Exclude the document if its metadata field has any value. When you select this criteria, specify **Field Name**. | + | Has no values | Exclude the document if the metadata field has no value. When you select this criteria, specify **Field Name**. | When finished, click **Add**. diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchange.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md similarity index 60% rename from docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchange.md rename to docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md index 4a88313921..b2d2d0d312 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchange.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md @@ -1,25 +1,28 @@ --- -title: "Dynamic Source Groups — Exchange" -description: "Dynamic Source Groups — Exchange" +title: "Dynamic Source Groups — Exchange (EWS)" +description: "Dynamic Source Groups — Exchange (EWS)" sidebar_position: 10 --- -# Dynamic Source Groups — Exchange +# Dynamic Source Groups — Exchange (EWS) -This section contains information on how to configure Exchange and Exchange Online dynamic source +:::warning +Microsoft is deprecating Exchange Web Services (EWS) and will fully disable it in April 2027. +For all new Exchange Online dynamic source groups, Netwrix recommends using the [Exchange (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md) dynamic source group. +::: + +This section describes how to configure Exchange and Exchange Online dynamic source groups. Toggle between Basic and Advanced configuration settings by clicking the icons in the Settings button in the bottom left corner of the page. -![dynamicsourcegroupex](/images/dataclassification/5.7/admin/sources/sourcegroups/dynamicsourcegroups/dynamicsourcegroupex.webp) - -The following options can be configured for Exchange Dynamic Source Groups: +You can configure the following options for Exchange (EWS) Dynamic Source Groups: | Option | Description | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Authentication Type | Basic — With **Credentials**, users authenticate using email address and password credentials Modern (O365) — With **Modern (O365)**, users authenticate using Tenant ID | | Exchange API Url | Enter a URL for an Exchange API for data collection. Leave this field blank to autodetect Exchange APIs. | | Crawl Range | Configure whether to crawl data over a date range or from a specific date onwards. | -| Match Rules | At least one match rule must be included, match rules are Regular expressions, such as:
  • `.*@mydomain.com`
  • `.*@mydomain.co.uk`
| +| Match Rules | You must include at least one match rule. Match rules are regular expressions, such as:
  • `.*@mydomain.com`
  • `.*@mydomain.co.uk`
| | Crawl In-Place Archive | Check the box to enable crawling the Exchange In-Place Archive for data. Uncheck the box to disable this option. | -| Detection Period | The Detection Period set here will apply to all Exchange and Exchange Online source groups configured under the URL set in the URL text field. Use the slider to change the Detection Period. To disable detection, set the period to **0** days and **0** hours. | -| Re-Index Period | The Re-Index Period set here will apply to all Exchange and Exchange Online source groups configured under the URL set in the URL text field. Use the slider to change the Re-Index Period. To disable re-indexing, set the period to **0**. | +| Detection Period | The Detection Period you set here applies to all Exchange and Exchange Online source groups configured under the URL you enter in the URL text field. Use the slider to change the Detection Period. To disable detection, set the period to **0** days and **0** hours. | +| Re-Index Period | The Re-Index Period you set here applies to all Exchange and Exchange Online source groups configured under the URL you enter in the URL text field. Use the slider to change the Re-Index Period. To disable re-indexing, set the period to **0**. | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md new file mode 100644 index 0000000000..ea65762505 --- /dev/null +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md @@ -0,0 +1,24 @@ +--- +title: "Dynamic Source Groups — Exchange (Graph)" +description: "Dynamic Source Groups — Exchange (Graph)" +sidebar_position: 15 +--- + +# Dynamic Source Groups — Exchange (Graph) + +This section describes how to configure Exchange Online dynamic source +groups. Toggle between Basic and Advanced configuration settings by clicking the icons in the +Settings button in the bottom left corner of the page. + +Use Exchange (Graph) dynamic source groups for all new Exchange Online source groups. To crawl on-premises Exchange servers, use Dynamic Source Groups — Exchange (EWS). + +You can configure the following options for Exchange (Graph) Dynamic Source Groups: + +| Option | Description | +| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Cloud Environment | Select the Azure environment that hosts your Exchange Online tenant. | +| Crawl Range | Configure whether to crawl data over a date range or from a specific date onwards. | +| Match Rules | You must include at least one match rule. Match rules are regular expressions, such as:
  • `.*@mydomain.com`
  • `.*@mydomain.co.uk`
| +| Crawl In-Place Archive | Check the box to enable crawling the Exchange In-Place Archive for data. Uncheck the box to disable this option. | +| Detection Period | The Detection Period you set here applies to all Exchange Online Mailbox sources created by this dynamic source group. Use the slider to change the Detection Period. To disable detection, set the period to **0** days and **0** hours. | +| Re-Index Period | The Re-Index Period you set here applies to all Exchange Online Mailbox sources created by this dynamic source group. Use the slider to change the Re-Index Period. To disable re-indexing, set the period to **0**. | diff --git a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md index 8bddad9853..b2337e2ec9 100644 --- a/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md +++ b/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/overview.md @@ -6,18 +6,18 @@ sidebar_position: 60 # Source Groups -Source groups provide a way of logically grouping specific sources, perhaps by type, or perhaps by -an internal business specification. +Source groups logically group specific sources, perhaps by type or by an internal business +specification. A group can either be "mixed", which allows it to contain all source types, or source-specific. For example, you could create a source group named "Demo Content", which only supports the addition of SharePoint sources. When you create a source, any existing source groups that support that source type appear in a dropdown in the source configuration screen. -Certain source types are treated as source groups. See [Dynamic Source Groups](#dynamic-source-groups) for the available +Netwrix Data Classification treats certain source types as source groups. See [Dynamic Source Groups](#dynamic-source-groups) for the available group types and configuration options. -Select the cog icon on the main sources grid screen for a source group to amend the -group settings: +To amend the group settings, select the cog icon for that source group on the main sources grid +screen: ![editgroup](/images/dataclassification/5.7/admin/sources/sourcegroups/editgroup.webp) @@ -25,28 +25,28 @@ Here you can: - Amend the group name - Delete the group -- Disable Search Index — When disabled, content will not be processed into the core search index - (classification will occur as normal, although content will be excluded from Browse / Search / - Suggestions). -- Discovery mode — This allows a source to be fully enumerated before any files are processed. +- Disable Search Index — When you disable this option, the product doesn't process content into the + core search index (classification occurs as normal, although Browse, Search, and Suggestions + exclude the content). +- Discovery mode — The product fully enumerates a source before processing any files. - _(SharePoint only)_ Supply regular expression rules to support automatically assigning sources to a specific group -- Enable Text Extraction - Allows reading the documents and run classification rules against their - content. By unticking the checkbox, the system can fetch only the metadata without crawling the - entire document. After this you can run a workflow to remove the old data, using **Document Age** - option. Unlike Discovery Mode, you can still run workflows if the workflow is triggered solely by - metadata. See [Step 3. Specify Conditions for Processing](/docs/dataclassification/5.7/contentconfigurationoverview/workflows/manage/addworkflowwizard/step3specifyconditions.md) for instructions on configuring metadata-only workflows. +- Enable Text Extraction - Allows reading the documents and running classification rules against + their content. If you untick the checkbox, the system fetches only the metadata without crawling + the entire document. After this you can run a workflow to remove the old data, using the + **Document Age** option. Unlike in Discovery Mode, you can still run workflows if metadata alone + triggers the workflow. See [Step 3. Specify Conditions for Processing](/docs/dataclassification/5.7/contentconfigurationoverview/workflows/manage/addworkflowwizard/step3specifyconditions.md) for instructions on configuring metadata-only workflows. :::note -Credentials will only be supported if the source group is type-specific. +The product supports credentials only if the source group is type-specific. ::: Deleting a group will remove all existing items from the group leaving them unassigned. You can also remove specific sources from a group by selecting the source group in the grid and then -selecting Remove from Group for the required sources. Source groups can also be created and -assigned as part of the source creation process. +selecting Remove from Group for the required sources. You can create and assign source groups +as part of the source creation process. -By going to the Settings of the Source Group, you can: +In the Source Group settings, you can: - Set the Re-index period, priority, and credentials for a single source in the group or configure these options for all sources in this group using the "Apply changes to all sources in Source @@ -62,12 +62,12 @@ By going to the Settings of the Source Group, you can: ## Dynamic Source Groups -Dynamic Source Groups are used to add a collection of sources at once. These source groups are -accessed through the Add page in the Auto-Detect a Set of Sources section. Each Dynamic Source Group -will have different options depending on which one is being configured. The Dynamic Source Groups -are: +Use Dynamic Source Groups to add a collection of sources at once. You access these source groups +through the Add page in the Auto-Detect a Set of Sources section. Each Dynamic Source Group has +different options depending on which one you configure. The Dynamic Source Groups are: -- [Dynamic Source Groups — Exchange](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchange.md) +- [Dynamic Source Groups — Exchange (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangeews.md) +- [Dynamic Source Groups — Exchange (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/exchangegraph.md) - [Dynamic Source Groups — File Servers](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/file.md) - [Dynamic Source Groups — Google Drive Organization](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/googledrive.md) - [Dynamic Source Groups — SharePoint Online](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/sourcegroups/sharepoint.md) diff --git a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md index 879a987ab8..40a0fba79b 100644 --- a/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md +++ b/docs/dataclassification/5.7/introduction/introduction/exchange/exchange.md @@ -9,51 +9,21 @@ sidebar_position: 30 When preparing your Exchange Server for data classification: :::note -On-premise Exchange servers support Basic authentication for crawling accounts, while Exchange Online supports either Modern or Basic authentication. The following sections describe both scenarios. +On-premise Exchange servers support Basic authentication for crawling accounts, while Exchange Online requires Modern authentication. The following sections describe both scenarios. ::: ## Basic Authentication -This method is supported for Exchange Online and on-premise Exchange organizations. You should -configure sufficient permissions that will allow the crawling account to impersonate the mailboxes -that you want to crawl. This requires the setup of two permissions: +On-premise Exchange servers support this method. Configure sufficient permissions that allow the +crawling account to impersonate the mailboxes that you want to crawl. This requires two +permissions: - ApplicationImpersonation—Allows the crawling account to impersonate each of the mailboxes / users configured for collection - Mailbox Search—Allows the crawling account to enumerate mailboxes (automatic discovery of mailboxes) -Review the related procedure that corresponds to your Exchange deployment: - -- Exchange Online -- Exchange Server (On-Premise) - -### Exchange Online - -**Step 1 –** Log in to the -[Office 365 Exchange Admin Portal](https://admin.microsoft.com/Adminportal/Home?source=applauncher#office-365-exchange-admin-portal)[.](https://admin.microsoft.com/Adminportal/Home?source=applauncher#) - -**Step 2 –** Go to Roles > **Role Assignments** > **Exchange**. - -**Step 3 –** Select **Add new role**. - -**Step 4 –** In the Set up basics step, enter the Name and Description -'_NetwrixCrawlerImpersonation_'. Click **Next**. - -**Step 5 –** On the **Add Permission** step, select ApplicationImpersonation and Mailbox Search -permissions. Click **Next**. - -**Step 6 –** Select the users to assign to this role group. They will have permissions to manage the -roles that you assigned in the previous step. - -**Step 7 –** Finish adding the permissions by selecting \_**\_Add role group\_\_**. - -**Step 8 –** Go to the **DiscoveryManagement** Role. - -**Step 9 –** Add your user as a member and/or assign your user for Modern Authentication set up to -this Role as well. - -## Exchange Server (On-Premise) +### Exchange Server (On-Premise) 1. Log in to one of the Exchange servers (RDP). 2. Open a Powershell window. @@ -65,34 +35,37 @@ this Role as well. New-ManagementRoleAssignment –Name "NetwrixCrawlerSearch" –Role "Mailbox Search" –User ADMINUSERNAME -:::note -If crawling Microsoft Office 365 for Small Business or many hosted Exchange systems, then -it isn't possible to set up Application Impersonation. -::: - - ## Modern Authentication -Starting with version 5.5.3, Netwrix Data Classification allows for crawling Microsoft Exchange +Starting with version 5.5.3, Netwrix Data Classification can crawl Microsoft Exchange Online organization mailboxes using Modern authentication. For that, it uses an Azure AD application -which can use Microsoft API to connect to Exchange Online organization. +that connects to the Exchange Online organization through the Microsoft API. :::note -To access via Modern Authentication, you need to use an admin username. +To access Exchange using Modern Authentication, you need to use an admin username. ::: +Configure sufficient permissions that allow the crawling account to access and read the +mailboxes that you want to crawl. The permissions required depend on whether you use the Exchange Web Services (EWS) or Graph source types. + +To use the Graph source types, you must grant the following permissions: + +- Mail.Read—Allows the application to read the full contents of all mailboxes +- Mail.ReadWrite—Allows the application to move and delete mail in all mailboxes - necessary for the Exchange workflow actions +- User.Read.All—Allows the application to discover all users associated with an Exchange Online server -You should configure sufficient permissions that will allow the crawling account to impersonate the -mailboxes that you want to crawl. This requires the setup of two permissions: +To use the EWS source types, you must grant the following permissions: - ApplicationImpersonation—Allows the crawling account to impersonate each of the mailboxes / users configured for collection - Mailbox Search—Allows the crawling account to enumerate mailboxes (automatic discovery of mailboxes) -If you plan to implement the scenario that involves modern authentication, you should do the -following: +If you plan to use modern authentication, do the following: 1. [Create Azure AD app for Modern Authentication](/docs/dataclassification/5.7/introduction/introduction/exchange/azureappexchangeonlinemfa.md) -2. Configure [Exchange Server](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserver.md) source - settings. +2. Configure source settings for one or more of the following: + - [Exchange Server (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeservergraph.md) + - [Exchange Server (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangeserverews.md) + - [Exchange Mailbox (Graph)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxgraph.md) + - [Exchange Mailbox (EWS)](/docs/dataclassification/5.7/contentconfigurationoverview/introduction/addsource/exchangemailboxews.md) diff --git a/docs/dataclassification/5.7/introduction/upgrade.md b/docs/dataclassification/5.7/introduction/upgrade.md index 41f3381356..d204aea093 100644 --- a/docs/dataclassification/5.7/introduction/upgrade.md +++ b/docs/dataclassification/5.7/introduction/upgrade.md @@ -24,44 +24,50 @@ Classification resides. If not, download it from Microsoft website: - In the Object Explorer, right-click the database and select **Tasks** > **Back Up**. - Wait for the process to complete. -**Step 3 –** Back up the Index files. Netwrix recommends the following: +**Step 3 –** Stop all NDC services. Netwrix recommends the following: -- On the computer where Netwrix Data Classification is installed, start the Netwrix Data +- On the computer where Netwrix Data Classification resides, start the Netwrix Data Classification Service Viewer tool. Select **Stop** next to each service. -- Locate the folder containing index files (the default location is _C:\Program - Files\Netwrix\Data Classification\Index_) and back it up. +- If you upgrade a Distributed Query Server (DQS) environment, stop all services on all instances before upgrading any instance. + +:::warning +If any services are running while the upgrade occurs, database schema updates may fail to apply correctly. If this occurs, Netwrix recommends contacting Netwrix Support for help. +::: + +**Step 4 –** Back up the Index files. Locate the folder containing the index files (the default location is _C:\Program +Files\Netwrix\Data Classification\Index_) and back it up. :::note -For versions of 5.7 before 5.7.10, all NDC services and the NDC IIS Application Pool had to run as the same service account. For 5.7.10 onwards this is no longer necessary, but if upgrading from an earlier version of 5.7, complete the upgrade to 5.7.10 _before_ changing the service account to prevent any possible issues with the upgrade process. +For versions of 5.7 before 5.7.10, all NDC services and the NDC IIS Application Pool had to run as the same service account. For 5.7.10 onwards this is no longer necessary, but if you upgrade from an earlier version of 5.7, complete the upgrade to 5.7.10 _before_ changing the service account to avoid upgrade issues. ::: ## Upgrade Process You can upgrade directly to Netwrix Data Classification 5.7 only from versions 5.5 and newer. -To upgrade your deployment, after taking the preceding preparatory steps, run the product -setup and follow the wizard steps. When finished, all solution components will be running. +After taking the preceding preparatory steps, run the product setup and follow the wizard +steps. When the upgrade finishes, all solution components are running. -If you need to upgrade from an earlier version, you will need to perform a staged upgrade: first upgrade -to version 5.5, then perform a second upgrade to version 5.7. +To upgrade from an earlier version, perform a staged upgrade: first upgrade to version 5.5, then +upgrade to version 5.7. ## Upgrading a DQS Environment -When upgrading an NDC environment which uses the **Distributed Query Server** (DQS) functionality to 5.7.10 or later, -the primary server must be upgraded before upgrading the secondary instances. Secondary instances will -attempt to resynchronize with the primary instance during the upgrade process, which will fail if the primary -instance has not been upgraded. +When upgrading to 5.7.10 or later in an NDC environment that uses the **Distributed Query Server** (DQS) functionality, +upgrade the primary server before the secondary instances. Secondary instances +attempt to resynchronize with the primary instance during the upgrade process, and this resynchronization +fails if you haven't upgraded the primary instance. When upgrading to 5.7.10 or later from an earlier version of 5.7, you should run the installer as the NDC service account if possible so that the installer can synchronize the DQS instances automatically. -If this isn't done, you will need to perform a DQS resynchronization when upgrading each secondary DQS instance. For further details on this process, +If you don't, you must resynchronize DQS when upgrading each secondary DQS instance. For further details on this process, see the [Configuring NDC Servers Cluster and Load Balancing with DQS Mode](/docs/dataclassification/5.7/introduction/deployment/ndcserverandclient/dqsmode.md) page. ## After the Upgrade During the upgrade from previous versions, Netwrix Data Classification preserves its configuration, so you can classify your data right after finishing the upgrade. However, -there are several steps you may need to take after upgrading. +you may need to take several steps after upgrading. To update taxonomies manually: