108 lines
3.4 KiB
Markdown
108 lines
3.4 KiB
Markdown
# NinjaOne Organization Report Playbook
|
|
|
|
> Legacy: This playbook documents the older shared-folder organization reporting model. For the recommended replacement, use the V2 n8n-based design in `attacktracer-ninja-v2-architecture.md`.
|
|
|
|
## Goal
|
|
|
|
Build a central AttackTracer overview as a local HTML report generated from mirrored device reports.
|
|
|
|
## Recommended design
|
|
|
|
### Device layer
|
|
|
|
Each endpoint continues to write these device custom fields:
|
|
|
|
- `attacktracerstatus`
|
|
- `attacktracerreason`
|
|
- `attacktracerbasestatus`
|
|
- `attacktracerevents`
|
|
- `attacktraceruniqueips`
|
|
- `attacktracercvecritical`
|
|
- `attacktracercvetotal`
|
|
- `attacktracermode`
|
|
- `attacktracertriggered`
|
|
- `attacktracerlastscanutc`
|
|
|
|
Each endpoint can also mirror its JSON report to a shared folder:
|
|
|
|
```powershell
|
|
& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode status -MirrorRoot "\\fileserver\AttackTracer\OrgA"
|
|
```
|
|
|
|
That will create one JSON file per machine, such as:
|
|
|
|
- `\\fileserver\AttackTracer\OrgA\WSUS.json`
|
|
- `\\fileserver\AttackTracer\OrgA\MILSRV222.json`
|
|
|
|
## Central report host
|
|
|
|
Use one always-on Windows server as the central report host:
|
|
|
|
- stable network path access to the mirrored report share
|
|
- enough permissions to read every mirrored JSON file
|
|
- optional browser/file access for opening the rendered HTML report
|
|
|
|
This host only builds the local HTML report. It does not write organization-level custom fields back into NinjaOne.
|
|
|
|
If your NinjaOne environment exposes `Set-NinjaOrganizationProperty` or `Ninja-Organization-Property-Set`, the same script can also update these text-based organization fields:
|
|
|
|
- `attacktracerorgstatus`
|
|
- `attacktracerorgsummary`
|
|
- `attacktracerorglastupdate`
|
|
|
|
## Org report generator
|
|
|
|
Use the organization generator script on the delegate machine:
|
|
|
|
- [scripts/build-attacktracer-org-report.ps1](C:\Users\Besitzer\Documents\AttackTracerNinjaVersion\scripts\build-attacktracer-org-report.ps1)
|
|
|
|
Installed path after setup:
|
|
|
|
- `C:\Program Files\AttackTracerNinja\scripts\build-attacktracer-org-report.ps1`
|
|
|
|
### Generate HTML only
|
|
|
|
```powershell
|
|
& "C:\Program Files\AttackTracerNinja\scripts\build-attacktracer-org-report.ps1" `
|
|
-ReportsRoot "\\fileserver\AttackTracer\OrgA" `
|
|
-OutputPath "..\reports\attacktracer-org-report.html"
|
|
```
|
|
|
|
### Recommended production command
|
|
|
|
```powershell
|
|
& "C:\Program Files\AttackTracerNinja\scripts\build-attacktracer-org-report.ps1" `
|
|
-ReportsRoot "\\fileserver\AttackTracer\OrgA" `
|
|
-OutputPath "\\fileserver\AttackTracer\OrgA\attacktracer-org-report.html"
|
|
```
|
|
|
|
### Optional: also update organization summary fields
|
|
|
|
```powershell
|
|
& "C:\Program Files\AttackTracerNinja\scripts\build-attacktracer-org-report.ps1" `
|
|
-ReportsRoot "\\fileserver\AttackTracer\OrgA" `
|
|
-OutputPath "\\fileserver\AttackTracer\OrgA\attacktracer-org-report.html" `
|
|
-WriteNinjaOrgSummary
|
|
```
|
|
|
|
## What the HTML contains
|
|
|
|
The generated HTML report includes:
|
|
|
|
- scanned device count
|
|
- alerting device count
|
|
- critical device count
|
|
- total event count
|
|
- unique source IP count
|
|
- an alert table with the most relevant rows
|
|
- a compact `Log sauber` device list
|
|
|
|
## Operational recommendation
|
|
|
|
Schedule it in two stages:
|
|
|
|
1. run the endpoint monitor script on all managed servers and mirror JSON output to the organization share
|
|
2. run the organization report generator on the central report host a few minutes later
|
|
|
|
This keeps the device logic simple and gives you one stable HTML organization summary to open locally or from the share.
|