windows firewall remote management powershell

The same goes for other local host firewall agents. The configuration of the Windows firewall GPO is not in the scope of this article. If using the Windows firewall, make sure to create a relevant Group Policy Object (GPO) to allow traffic on the relevant ports. Take into consideration both the network firewall and the localhost firewall. To the hosts on which you want to run the integration. Your XSOAR server will require access on ports 5985,5986 TCP If you decide to use basic authentication keep in mind it isn`t considered a secure authentication method however, since the whole session is encrypted via SSL this compensates for the less secure authentication method. PowerShell remoting does encrypt the session even on HTTP however, the initial connection is unencrypted. The integration in its current version works with HTTP using NTLM authentication or HTTPS using basic authentication. Also it's important to note that WinRM has security implications to consider as described here. We highly recommend you perform all actions listed here on test/staging environments prior to implementing on production environments. Keep in mind that WinRM is entirely a Microsoft feature. Your required configuration may vary if using a different Windows Server version. This article provides configuration instructions for this environment. Before You Start #ĭisclaimer: The integration was created and tested on Windows Server 2016 with PowerShell version 3.3866. The PowerShell Remoting content pack includes the following content item. Pack Workflow #įollow the instructions in this article to configure your Windows environment and the PowerShell Remoting integration.Īfter configuring the integration you will be able to perform various tasks on Windows hosts, including running PowerShell commands and scripts, as well as gather forensic data. By using PowerShell Remoting, the SOC analyst or incident responder is able to connect to the Windows host in order to perform various tasks such as gathering data, remediating the host, move files to and from the host to XSOAR, and much more. PowerShell Remoting is a built-in feature in Windows hosts that enables connecting to hosts remotely in order to execute scripts and PowerShell commands.

Windows firewall remote management powershell