Skip to main content

Pre-Created Templates

Threat Prevention comes with several pre-created policy templates that cover a wide range of event monitoring and lockdown. You can create new policy templates or duplicate existing ones.

When you upgrade Threat Prevention, new policy templates and updates to existing templates become available for import. You must import them manually during installation of the latest version. See the Upgrade Policy Templates topic for additional information on updating existing templates for a new release.

When you launch the Administration Console for the first time, you're prompted to import pre-created policy templates. If you skip this step, you can import the templates later. See the Import Templates topic for more information. After you import the templates, they're available through an organized folder structure.

Template Folders​

The pre-created policy templates are organized in an easy-to-navigate folder structure under Templates in the Templates Interface.

  • The Actions folder contains several pre-configured PowerShell scripts that can be used as response actions to alerts.

  • The ADCS folder contains several pre-configured templates to detect and prevent AD Certificate Services attacks.

  • The templates that Netwrix engineers deem most useful are located within subfolders in the Best Practices folder:

    • Active Directory
    • Exchange
    • File System
    • Object Lockdown

  • The Domain Persistence folder contains templates of policies that detect an attacker's attempt to gain persistent administrative access to Active Directory.

  • The HIPAA folder contains templates focused on monitoring for HIPAA regulations. These templates are organized in subfolders:

    • 164.306 – Security Standards
    • 164.308 (a)(1)(i) – Security Management Process
    • 164.308 (a)(1)(ii) – Implementation Specifications
    • 164.308 (a)(3)(i) – Workforce Security
    • 164.308 (a)(3)(ii) – Authorization and Supervision
    • 164.308 (a)(4) – Information Access Management
    • 164.308 (a)(5)(ii)(C) – Log-In Monitoring
    • 164.308 (a)(5)(ii)(D) – Password Management
    • 164.312 (a)(1) – Access Control
    • 164.312 (b) – Audit Controls
    • 164.312 (c) – Integrity
    • 164.312 (d) – Authentication

  • The LDAP folder contains templates that monitor LDAP queries.

  • Templates that are focused on monitoring and locking down events in a Microsoft environment are located within subfolders in the Microsoft folder:

    • Active Directory
    • DNS
    • Exchange
    • File System
    • Group Policy Objects
    • LSASS

  • The Netwrix Threat Manager folder contains templates used by Netwrix Threat Manager to perform threat detection.

  • The Privilege Escalation folder contains templates that detect an attacker's attempt to escalate the privileges of a compromised user to gain Domain Admin rights in Active Directory.

  • The Ransomware folder contains templates that detect the creation of files known to be associated with a Ransomware attack.

  • The Reconnaissance folder contains templates that detect an attacker's attempt to discover useful resources to escalate permissions, gain Domain Amin persistence, or exfiltrate information.

  • The Schema and Configuration folder contains templates that audit changes that happen to data stored in the schema or configuration container, such as site creation or attributes being indexed.

  • The SIEM folder contains templates that monitor the most common events sent to SIEM products.

Import Templates​

The pre-created policy templates are stored in the SI_Templates_All.xml file. If they weren't imported when the Administration Console is first launched, you can import them later by following these steps.

Step 1 – Click Tools > Import on the menu. The Import window opens.

Step 2 – In the Select Import File box, click the ellipsis (…) to open the browser window. The location of the default templates is:

…\Netwrix\Netwrix Threat Prevention\SIWinConsole

Step 3 – To import all the available Threat Prevention policy templates, select the SI_Templates_All.xml file. Click Open.

Import window

Step 4 – The Import window auto-fills with the import file details. Don't change the defaults settings. Click Import.

note

The import process can take a few minutes to complete as there are several hundred templates to import and configure.

Step 5 – When the operation is complete, click OK.

The templates are now available in the Templates Interface.