Skip to main content

Security

By default, Netwrix Auditor API uses HTTPS for sending requests to its endpoints. Netwrix encrypts data with a self-signed automatically generated SSL (Secure Sockets Layer) certificate and strongly recommends that you replace it with a new secured certificate acquired from any reliable source.

The automatically generated Netwrix API certificate resides in the Personal store. To enable trust on remote computers, install this certificate in the Trusted Root Certification Authorities store.

certificatestore_thumb_0_0

Manage API security settings with APIAdminTool.exe​

Netwrix provides a command-line tool for managing Integration API. Use the tool to switch between HTTP and HTTPS, assign new certificates, and manage other API settings.

  1. On the computer where Auditor Server resides, start the Command Prompt.

  2. Navigate to the Netwrix Auditor installation folder, inside the Audit Core folder, and run the tool. For example:

    C:\>cd C:\Program Files (x86)\Netwrix Auditor\Audit Core

    C:\Program Files (x86)\Netwrix Auditor\Audit Core>APIAdminTool.exe

  3. Execute one of the following commands depending on your task. Review the tips for running the tool:

    • Some commands require parameters. Provide parameters with values (parameter= value) to use non-default values. E.g., APIAdminTool.exe api http port= 4431.
    • Append help to any command to see available parameters and sub-commands. E.g., APIAdminTool.exe api help.
To...Execute...
Disable APIAPIAdminTool.exe api disable This command duplicates the checkbox on the Integrations page in Netwrix Auditor.
Switch to HTTPAPIAdminTool.exe api http Netwrix recommends switching to HTTP only in safe intranet environments. To use a non-default port (9699), append the port parameter with a value to this command (e.g., port= 4431).
Switch to HTTPSAPIAdminTool.exe api https Run this command to continue using the Netwrix-generated certificate. To use a non-default port (9699), append the port parameter with a value to this command (e.g., port= 4431).
Assign a new SSL certificateAPIAdminTool.exe api https certificate Run this command to apply a new certificate instead of the default. You must add a certificate to the store before running this command. Provide parameters to specify a certificate:
  • For a certificate exported to a file:
  • path—Mandatory, defines certificate location.
  • store—Optional, defines the store name where the certificate resides. By default, Personal. For example: APIAdminTool.exe api https certificate path= C:\SecureCertificate.cef store= Personal
  • For a self-signed certificate:
  • subject—Mandatory, defines certificate name.
  • validFrom—Optional, defines a certificate start date. By default, today.
  • validTo—Optional, defines a certificate expiration date. By default, 5 years after a validFrom date. For example: APIAdminTool.exe api https certificate subject= New validTo= 01/01/2024 To create a new self-signed certificate for the default period of 5 years from the current date: APIAdminTool.exe api https certificate subject= "Netwrix Integration API"
  • For a certificate specified using thumbprint:
  • store—Optional, defines the store name where the certificate resides. By default, Personal.
  • thumbprint—Mandatory, defines a thumbprint identifier for a certificate. For example: APIAdminTool.exe api https certificate thumbprint= 3478cda8586675e420511dc0fdf59078093eeeda
Set the minimum TLS versionAPIAdminTool.exe api https minTlsVersion Use this command to set the minimum TLS (Transport Layer Security) version for connections (e.g., minTlsVersion= 1.2)

API access permissions​

API access follows the same role-based permissions as the rest of Netwrix Auditor. See the Role-Based Access and Delegation topic for details on configuring per-user access.