.. Reminder for header structure: Parts (H1) : #################### with overline Chapters (H2) : ******************** with overline Sections (H3) : ==================== Subsections (H4) : -------------------- Subsubsections (H5) : ^^^^^^^^^^^^^^^^^^^^ Paragraphs (H6) : """""""""""""""""""" .. meta:: :description: Using the WAPT packages and audit data into plugins for external services :keywords: WAPT, advanced, features, documentation, GLPI, Cyberwatch .. |enterprise_feature| image:: wapt-resources/icon_wapt_enterprise.png :scale: 3% :alt: WAPT Enterprise feature only .. |ok| image:: wapt-resources/icon-ok.png :scale: 5% :alt: Feature available .. |nok| image:: wapt-resources/icon-nok.png :scale: 5% :alt: Feature not available ######################################################################################################## Using audit data into plugins for WAPT package compliance and for external services |enterprise_feature| ######################################################################################################## ******************************************************************* Displaying host audit data in the WAPT Console |enterprise_feature| ******************************************************************* You can manage audit output and display the audit result if you activate the option in the :menuselection:`View --> Display Preferences` Tab. Check the :guilabel:`Show host audit data tab` to see the tab :guilabel:`Audit Data` on each client. .. figure:: wapt-resources/wapt_console_advanced-display-preferences.png :align: center :alt: Window showing the advanced preferences Window showing the advanced preferences To use audits in WAPT packages, visit :ref:`this page to manage audit_data `. Displaying encrypted data with a certificate in the audit data tab ================================================================== With audit function, it is possible to encrypt sensitive data coming from remote hosts; it will be possible to read the encrypted sensitive with a certificate installed on the WAPT Administrator's host. This way, the WAPT Server may store sensitive inventory data without the WAPT Server becoming a sensitive asset. This method is particularly useful for example for securely managing :abbr:`LAPS (Local Administrator Password Service)` random passwords in WAPT. In :file:`setup.py`, you can use a function to encrypt data with a certificate. If you have the private key matching the certificate that was used to encrypt the data, the data will be decrypted and it will appear in a readable form. Here is an example of code: .. code-block:: python # -*- coding: utf-8 -*- from setuphelpers import * from waptcrypto import print_encrypted_data def audit(): randompassword = '1234' print_encrypted_data(randompassword, glob.glob('*.crt')) This code will encrypt the password *1234* with all certificates present on the host that is used to manage WAPT. From the WAPT Console, you will see in the :guilabel:`audit_data` tab the crypted version and you can decipher the data with your private key associated to the public certificate that was used to encrypt the data. .. figure:: wapt-resources/wapt_console_advanced-decrypted-audit-data.png :align: center :alt: Audit data result showing crypted and decrypted version .. _wapt_glpi: *********************************************************** Synchronizing WAPT inventories to GLPI |enterprise_feature| *********************************************************** Working principle ================= WAPT Enterprise offers synchronization between the inventories of your hosts and `GLPI `_ :abbr:`ITSM (IT Service Management)` Software. The method automatically synchronizes changes on your IT infrastructure with the GLPI server. WAPT can synchronize with GLPI 10 using the native JSON API. WAPT can synchronize with GLPI version 9.x using the **FusionInventory** plugin with XML format. .. attention:: GPLI on WAPT does not work with Kerberos authentification for GLPI. If you use Kerberos for GLPI, exclude :file:`glpi/plugins/fusioninventory/` from the :program:`Nginx` authentification. Installing the required dependencies for GLPI 9.x ================================================= In order to receive inventories on the GLPI server, the **FusionInventory** plugin will need to be installed on the GLPI server. This is not required for GLPI 10 which has its own native JSON API. .. note:: You can `follow this guide to install FusionInventory `_. After installing :program:`FusionInventory` on the GLPI server, an **endpoint** needs to be configured on the WAPT Server to send the inventories to the GLPI server: .. code-block:: ini http:/glpi.mydomain.lan/glpi/plugins/fusioninventory/ Configuring WAPTAgent and sync package ====================================== Install and configure the WAPT Agent on the computer that will run the synchronization. The WAPTAgent is installed by default on the WAPTServer, it just need to be configured. To configure the WAPTAgent, please refer to the corresponding documentation. Then you need to install the GLPI sync package: * for GLPI 9.x, you need to install the package `tis-glpi-plugin-export-to-glpi9 `_ * for GLPI 10.x, you need to install the package `tis-glpi-plugin-export-to-glpi10 `_ You need to configure an audit schedule on the agent .. code-block:: ini [global] ... waptaudit_task_period=120m ... With the chosen package, it will create two ini file in your $WAPT_INSTALL_DIR/private (linux : :file:`/opt/wapt/private`, windows : :file:`C:\Program Files (x86)\wapt\private``). Connect to the host and modify :file:`glpi.ini` and :file:`wapt_api.ini` files. * For GLPI9: .. code-block:: ini [glpi] username = glpi password = xxxxxxx url = https://glpi.xx.xxxxx.xx/plugins/fusioninventory/ * For GLPI10: .. code-block:: ini [glpi] username = glpi password = xxxxxxx url = https://glpi.xx.xxxxx.xx/front/inventory.php For GLPI10, please also ensure inventory is enabled. For both GLPI9 and GLPI10: .. code-block:: ini [wapt] username = waptregister password = waptregister2023! url = https://srvwapt.ad.tranquil.it To test the current configuration, you can trigger an audit .. code-block:: bash wapt-get audit tis-glpi-plugin-export-to-glpi9 # or wapt-get audit tis-glpi-plugin-export-to-glpi10 Current items sent by WAPT to the GLPI server ============================================= .. list-table:: Description of items :header-rows: 1 :stub-columns: 1 :widths: auto :align: center * - Value - Sent - Not sent * - Computer name - |ok| - * - User name - |ok| - * - Description - |ok| - * - OS name - |ok| - * - OS version - |ok| - * - Language - |ok| - * - CPU - |ok| - * - Memory - |ok| - * - Battery - |ok| - * - Chassis type - |ok| - * - Physical or virtual - |ok| - * - Network card configuration - |ok| - * - Printer list and properties - |ok| - * - Installed software [#f1]_ - |ok| - * - Network drives - |ok| - * - Environment variables [#f2]_ - |ok| - * - Display screens references - |ok| - * - Mouse and keyboard references - - |nok| * - Controllers card references (except graphic card) - - |nok| * - Antivirus version - - |nok| * - Firewall state - - |nok| * - Local group list - - |nok| * - Memory bank list and state - - |nok| * - USB ports list and connected devices - - |nok| * - Printer status - - |nok| * - Card readers - - |nok| * - System wide Appx list - - |nok| .. rubric:: Footnotes .. [#f1] Not including system wide Appx install .. [#f2] Currently both system and system-wide user environment variables are included. Possible errors in reported inventory on the GLPI server ======================================================== Inventories uploaded by the WAPT Server to the GLPI server may be incomplete or may have errors when compared to inventories uploaded directly by the FusionInventory agent deployed on hosts. One reason is that WAPT aims to report only the most important values. If you feel that important items are missing or are reported in a wrong way, please report the issue to the Tranquil IT dev team. To report the issue, you will need to send 2 :file:`.xml` files. 1. First, install `the FusionInventory agent `_ on the computer on which you are observing a missing or wrongly reported inventory item. 2. Run the FusionInventory agent and extract the report into a :file:`.xml` file. .. tabs:: .. code-tab:: bash Windows "C:\Program Files\FusionInventory-Agent\fusioninventory-inventory" > %TEMP%\inventory.xml .. code-tab:: bash Linux fusioninventory-inventory > /tmp/inventory.xml .. code-tab:: bash MAC fusioninventory-inventory > /tmp/inventory.xml 1. Set the debug directory in the :ref:`waptserver.ini `. .. code-block:: ini glpi_inventory_debug_directory = /tmp/glpi 4. Restart the WAPT Server 5. Retrieve the :file:`/tmp/glpi/UUID.xml` file from the WAPT Server, the UUID being the identifier of the host. 6. Send the 2 files to the Tranquil IT dev team. .. _wapt_cyberwatch: *************************************************************************************** Synchronizing WAPT inventories to Cyberwatch for security breaches |enterprise_feature| *************************************************************************************** Working principle ================= WAPT Enterprise offers synchronization between the inventories of your hosts and `Cyberwatch `_ :abbr:`ISVM (Information Security Vulnerability Management)` Software. The method automatically synchronizes information about updates or installed softwares to Cyberwatch tool in order to scan and alert you about detected vulnerabilities. Configuring Cyberwatch server side ================================== * Connect to your Cyberwatch server and go to your profile. * In the API section, click on **See my API Keys**. * Click on :guilabel:`Add` and name your API access key for WAPT. .. figure:: wapt-resources/cyberwatch_api_keys3.png :align: center :alt: Enter API key name, access_level and expiration * Set the **access level** to Full and give an expiration date. If you don't give one, the key will *never* expire. This key with its **API access key ID** will allow you to use the Cyberwatch API for our WAPT package. Configuring WAPTAgent and sync packages ======================================= Install and configure the WAPT Agent on the computer that will run the synchronization. The WAPTAgent is installed by default on the WAPTServer, it just need to be configured. To configure the WAPTAgent, please refer to the corresponding documentation. Yu can have two packages : * if you have the Cyberwatch agent, you can import from Cyberwatch installing the package `tis-cyberwatch-plugin-import-from-cyberwatch `_, it will give you information directly on your WAPT Console. * for agentless devices, you still can export to your Cyberwatch server information of you WAPT hosts installing the package `tis-cyberwatch-plugin-export-to-cyberwatch-airgap `_, it will give you information to your Cyberwatch Console without Cyberwatch agent installed. You need to configure an audit schedule on the agent .. code-block:: ini [global] ... waptaudit_task_period=120m ... With the package, whichever you chose (you can oblviously choose both), it will create two ini files in your $WAPT_INSTALL_DIR/private (linux : :file:`/opt/wapt/private`, windows : :file:`C:\Program Files (x86)\wapt\private``). Connect to the host and modify :file:`cyberwatch_api.ini` and :file:`wapt_api.ini` files. .. code-block:: ini [cyberwatch] api_key = secret_key = url = https://cyberwatch.mydomain.lan .. code-block:: ini [wapt] username = waptregister password = waptregister2023! url = https://srvwapt.ad.tranquil.it To test the current configuration, you can trigger an audit .. code-block:: bash wapt-get audit tis-cyberwatch-plugin-import-from-cyberwatch # and/or wapt-get audit tis-cyberwatch-plugin-export-to-cyberwatch-airgap