8.2. Configuring the NDR

8.2.1. Introduction

8.2.1.1. The `Assets and users tracking` and `Relationship tracking` functions

The NDR database stores information about:

the various alerts on the network classified by risk score and type.
the active equipment management interface presents a list of the various equipment present on the network classified by risk score.
The different alerts present on the network and displayed in the `Alerts` dashboard classified by risk score (for more information on the dashboard, see WebUI `Alerts` screen)
The different assets present on the network and displayed in the `Assets` dashboard classified by risk score (for more information on the dashboard, see WebUI `Assets` screen)
The different users present on the network and displayed in the `Users` dashboard classified by risk score (for more information on the dashboard, see WebUI `Users` screen)

The `Assets and users tracking` and ` Relationship tracking` functions include:

Function	Status	Description	See
`Assets and users tracking`	Activable	Synchronization between the NDR WebUI's `Assets` and `Users` dashboards with the data available in Elasticsearch	See Procedure to enable the `Assets and users tracking` and `Relationship tracking` functions.
`Assets and users tracking`	Can disable	The NDR `Assets` and `Users` dashboards are disabled. Data is no longer stored in Elasticsearch.	See Procedure to disable the `Assets and users tracking` and `Relationship tracking` functions.
`Relationship tracking	Activable	synchronization between the NDR `Relations` dashboard in the WebUI and the data available in Elasticsearch	See Procedure to enable the `Assets and users tracking` and `Relationship tracking` functions.
`Relationship tracking`	Can disable	The NDR `Relations` dashboard is disabled. Data is no longer stored in Elasticsearch.	See Procedure to disable the `Assets and users tracking` and `Relationship tracking` functions.

8.2.1.2. Elasticsearch retention period

The retention time of Elasticsearch depends on the maximum space allocated (in Gb) to store the logs (see the `Retention policy` screen).
Therefore, the data retention period in Elasticsearch depends on the amount of logs generated by the GCaps.
The retention period of Elasticsearch can be changed: see the Procedure to configure the Elasticsearch retention.

8.2.2. Links associated

See the `Global settings` screen.

The configuration interface is described in the WebUI `Assets` screen.

8.2.3. Prerequisites

User: member of Administrator group

8.2.4. Preliminary operations

Login to GCenter via a browser (see Connecting to the GCenter web interface via a web browser)

8.2.5. Procedure to access the `Data Exports` window for an administrator account

In the navigation bar, successively click on:

The `Administration` menu

The `Global settings export` command in the `System` category

The `Global settings` screen is displayed.

8.2.6. Procedure to enable the `Assets and users tracking` and `Relationship tracking` functions

Use the `Assets and users tracking` selector (4) to enable tracking of active assets (`Assets`) and users (`users`).

The functions visible by pressing the `Assets` and `users` buttons in the WebUI are now accessible if the license enables it.
Use the `Relationship tracking` selector (10) to enable tracking relations between active devices and view these relations.

The functions visible by pressing the `Relations` button are now accessible if the license enables it.
Click on the `Save changes` button (13).

8.2.7. Procedure to disable the `Assets and users tracking` and `Relationship tracking` functions

To disable the tracking of relations only, use the `Relationships tracking` selector (10).

The functions visible by pressing the `Relations` button are now inaccessible.
To disable all the functions of the `Assets and users tracking` (4) and `Relationship tracking` (10), use the `Assets and users tracking` selector (1).

The functions visible by pressing the `Assets` and `users` buttons in the WebUI are now inaccessible.
Click on the `Save changes` button (13).

8.2.8. Procedure to configure the Elasticsearch retention

In the navigation bar, successively click on:

The `Administration` menu

The `Retention policy` command in the `Data` category

The `Retention policy` window is displayed.

Configure the Elasticsearch retention with `Data retention` cursor (5) of the `Elasticsearch max data retention (in Go)` zone (2).
Use the selector (7) of the `Synchronize NDR boards with elasticsearch retention` zone (6) to enable synchronizing NDR dashboards with data in Elasticsearch.
Click on the `Save changes` button (9).