From 32177d436b1fab43d10c1d40795accc0c302742d Mon Sep 17 00:00:00 2001 From: Kevin Joyce Date: Thu, 6 Aug 2026 15:20:06 -0400 Subject: [PATCH] Restructure Activity Monitor integration page and add Azure Files support Splits the flat integration guidance into two sections grouped by output mechanism: Active Directory and Microsoft Entra ID (native Netwrix Threat Manager output via App Token) and file system activity (Threat Manager Syslog template). Documents that Azure Files storage accounts are monitored the same way as other file system sources, with a link to Activity Monitor's existing Azure Files monitored-host setup guide. Also fixes a stale external link: helpcenter.netwrix.com/category/ activitymonitor redirected to the Activity Monitor v8.0 docs instead of the current v10.0. Generated with AI Co-Authored-By: Claude Code --- .../install/integration/activitymonitor.md | 28 +++++++++++++------ 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/docs/threatmanager/3.3/install/integration/activitymonitor.md b/docs/threatmanager/3.3/install/integration/activitymonitor.md index beca7b8a12..33f4b36df6 100644 --- a/docs/threatmanager/3.3/install/integration/activitymonitor.md +++ b/docs/threatmanager/3.3/install/integration/activitymonitor.md @@ -6,17 +6,27 @@ sidebar_position: 10 # Netwrix Activity Monitor Integration -The Activity Monitor can be configured to send file system data and/or Active Directory and/or -Microsoft Entra ID data to Threat Manager. It must be installed and configured to monitor the target +The Activity Monitor can be configured to send file system, Active Directory, and Microsoft Entra +ID activity to Threat Manager. Install and configure the Activity Monitor to monitor the target environment. See the -[Netwrix Activity Monitor](https://helpcenter.netwrix.com/category/activitymonitor) documentation +[Netwrix Activity Monitor](https://docs.netwrix.com/docs/activitymonitor/10_0/) documentation for additional information. -For Threat Manager to receive the event stream data, you must configure the Activity Monitor accordingly. -For file system activity events, use the Threat Manager Syslog template for the -desired monitored host configuration. For Active Directory activity events, generate an App Token in -Threat Manager and then use that app token to configure the domain’s output to Threat Manager. +For Threat Manager to receive the event stream data, configure the Activity Monitor output for +each event source. + +## Active Directory and Microsoft Entra ID activity events + +Active Directory and Microsoft Entra ID activity events use the native Netwrix Threat Manager +output. Generate an App Token in Threat Manager, then use that app token to configure the domain's +or tenant's output to Threat Manager. The Threat Manager DC Sync threat is sourced by the Activity Monitor's Replication AD monitoring -configuration. Configure it to exclude domain controllers on the Host -(From) filter. +configuration. Configure it to exclude domain controllers on the Host (From) filter. + +## File system activity events + +File system activity events, including Windows file servers, NAS devices, and Azure Files storage +accounts, use the Threat Manager Syslog template for the desired monitored host configuration. See +the [Add Azure Files Storage Accounts](/docs/activitymonitor/10.0/admin/monitoredhosts/add/azurefiles.md) topic +to add Azure Files storage accounts as a monitored host.