docs(threatprevention): add 8.1 documentation - #1472
Open
alexei-belous wants to merge 13 commits into
Open
Conversation
Copy the 8.0 documentation set and images to 8.1 as a baseline for the 8.1.0 release, with internal links and image paths rewritten to 8.1. Content edits follow in later commits. Not registered in src/config/products.js yet, so 8.1 stays off the site until release. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Add the topics for what changed in 8.1 and update the existing ones the changes affect. New topics: - Log Files and Logging Configuration - the managed component logs, the timestamped archive names, and editing .log.config to enable feature-level logging. - AD Monitor Logging Configuration - EventTrace.log, the Logging.ini settings, the DebugFilter and EventFilter values, and the validation messages. - LSASS Hook Scan Tool - LsassHookScan.exe, for identifying third-party hooks in LSASS. - Policy Verifier Tool - SIPolicyVerifier.exe, for finding policy references to objects that no longer exist. - Trusted Domains Blacklist Window - excluding unreachable trusted domains from account resolution. Updated topics: - Process Guardian Monitor and Protect - folder and SHA-256 filtering, the options for an unresolved folder or an unavailable checksum, the Kernel Stack attribute, and Never Block Windows System Process (PID = 4). - Log Level Configuration Window - Get Agent Log now downloads a ZIP archive of the logs and ADMonitor_logs folders. Corrects the rollover description and notes that a log level now survives a restart. - Upgrade Procedure - the 8.1 upgrade paths, and a section on the logging changes to plan for, including the Logging.ini settings that need to be edited by hand. - Installer file names, and cross-references from the related topics. - Two KB articles on enabling debug logging, noting the 8.1 .log.config format. 8.1 is not registered in src/config/products.js, so none of this is published yet. Screenshots still show the 8.0 UI. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
alexei-belous
temporarily deployed
to
development
September 2, 2026 20:01 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
kdejoyce
previously approved these changes
Sep 2, 2026
tsarra59
previously approved these changes
Sep 2, 2026
Contributor
Auto-Fix Summary1756 issues fixed, 46 skipped across 296 files
Ask |
…d build Verified the new topics against a Threat Prevention 8.1.0.978 install and its Administration Console, and corrected what the written source got wrong. Adds real 8.1 screenshots for the affected topics. Process Guardian: - The unresolved-folder option and the PID 4 option are on the Requesting Processes tab, not Target Processes. Removes that claim and the cross-reference it added to the Target Processes section. - Restores "Monitor if Checksum Unavailable". It exists as a per-entry grid column, not a single option, alongside "Use Checksum" and "SHA-256". - There's no separate folder field: a name or a full image path goes in the same Process (name or path) column, and both are case insensitive. Rewrites the section accordingly and documents "Use Checksum". - Documents "Ignore Windows System Process (PID = 4)", the monitoring policy's counterpart to "Never Block Windows System Process (PID = 4)". - The filters are grids with Add, Remove, and Lookup buttons, not text boxes. Trusted Domains Blacklist: - The menu path is confirmed as Configuration > Trusted Domains Blacklist. - Rewrites the procedure for the real dialog: a grid of Source Domain (NetBIOS name, or * for every Agent) and Excluded Domains (DNS names separated by semicolons), with Add Row, Add from Agent..., and Delete. - Documents the Select Trusted Domains dialog, including the Agent (DC) list and Connect. AD Monitor logging: - Logging.ini and ADMonitor_logs live in the Agent installation folder, not an AD Monitor folder. Adds the real paths. - EventTrace.log does take the context prefix; a TermEventTrace file exists on a domain controller. Corrects the claim that it never does. - PagedSearch isn't a valid DebugFilter value in the shipped file. - Adds DotNetLoaderTrace.log, the rolled-over file naming, and a warning that EventTrace.log is always buffered, so an LSASS crash loses up to one flush interval. Also: plsahlp.sys ships with the Agent, not the Enterprise Manager, and LsassHookScan.exe isn't installed by either, so the LSASS hook scan topic now points at Support for the tool. Adds SIAgentUpdater to the managed log and configuration file lists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
… article structure
Corrects a product-name misattribution ("Netwrix Threat Manager" -> "Netwrix
Threat Prevention", confirmed against the source Salesforce KB article),
fixes frontmatter (products ID, missing kb tag), converts the new 8.1 :::note
to KB blockquote format, and restructures both articles from legacy
Summary/Issue/Module/Salesforce Article ID sections to Overview/Instructions.
Also fixes Vale heading-case and contraction warnings, Dale passive-voice and
wordiness findings, bolds action-target UI elements, drops an empty code
block with no source content, and rewrites a filename-only image alt text.
Explains what each option involves (direct file edit vs. console-based log level change) instead of just stating there are two, in both articles.
hilram7
previously approved these changes
Sep 3, 2026
Contributor
Auto-Fix Summary92 issues fixed, 67 skipped across 296 files
Ask |
Adds 8.1 to threatprevention.versions, promotes it to isLatest, and sets defaultVersion to 8.1. Without this, docs/threatprevention/8.1/ and sidebars/threatprevention/8.1.js are never picked up by the Docusoraus plugin generation, navbar, or KB copy script.
…med ready 8.1 is now registered and reachable via the version switcher, but stays isLatest: false so 8.0 remains the default landing version. Screenshots still show the 8.0 UI and a few facts (Trusted Domains Blacklist menu path, .log.config vs logconfig.xml naming, tab placement for the unresolved-folder/unavailable-checksum options) came from a written source rather than a verified build. Promote 8.1 to latest once those are confirmed.
The PR intentionally leaves 8.1 out of products.js until release day — per the PR description, this keeps the 296 new pages, screenshots (still showing 8.0 UI), and a few unverified facts (Trusted Domains Blacklist menu path, .log.config vs logconfig.xml naming, tab placement for the unresolved-folder/unavailable-checksum options) completely unreachable rather than just non-default. Registering 8.1 (even with isLatest: false) would make it publicly browsable and indexed, which is more exposure than intended. Registration remains a one-line change to make when the release ships.
Collaborator
|
Registered 8.1 in products.js per the earlier Code Review comment ("🔴 Blocking — 8.1 never gets built"), then reverted it. The PR description clarifies that leaving 8.1 unregistered is intentional. Registration remains a one-line change for release day. |
hilram7
previously approved these changes
Sep 3, 2026
# Conflicts: # docs/threatprevention/8.1/admin/policies/configuration/eventtype/lsassguardianmonitor.md # docs/threatprevention/8.1/admin/policies/configuration/eventtype/lsassguardianprotect.md
# Conflicts: # docs/threatprevention/8.1/admin/policies/configuration/eventtype/lsassguardianmonitor.md # docs/threatprevention/8.1/admin/policies/configuration/eventtype/lsassguardianprotect.md
alexei-belous
temporarily deployed
to
development
September 3, 2026 19:57 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
Auto-Fix Summary99 issues fixed, 48 skipped across 296 files
Ask |
Contributor
Code ReviewScope: correctness only (config, routing, scripts, workflows, structural integrity of the copied tree). Content and prose style are left to the editorial workflow. No workflow, script, or 1. Vale autofix lowercased sentence and heading starts (introduced by this PR)
The same class of rewrite hit five files mid-sentence, after a
18 lines in total. The equivalent pattern occurs zero times anywhere in 2.
3. Static assets ship even though 8.1 is unregistered The PR description says none of this is published yet, which holds for the markdown: Most are byte-identical copies of the 8.0 images, but four are not: Verified clean
Pre-existing, inherited by the copy (not introduced here)
🤖 Generated with Claude Code |
hilram7
approved these changes
Sep 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sets up the documentation for Netwrix Threat Prevention 8.1 and documents what changed in the release.
The first commit copies the 8.0 documentation set to
docs/threatprevention/8.1/as a baseline, with internal links and image paths rewritten. The second commit adds the topics for the 8.1 changes and updates the existing topics those changes affect.8.1 is deliberately not registered in
src/config/products.js, so none of this is published yet. Registering the version is a one-line change to make when the release ships.New topics
troubleshooting/logging.md.log.1, editing.log.configto turn on feature-level logging, and the removal of the SI Events Windows Event Log sourcetroubleshooting/admonitorlogging.mdEventTrace.log, the fullLogging.inireference, theDebugFilterandEventFiltervalues, worked configuration examples, and the validation messagestroubleshooting/lsasshookscan.mdLsassHookScan.exe, for identifying third-party hooks in LSASSadmin/tools/sipolicyverifier.mdSIPolicyVerifier.exe, for finding policy references to objects that no longer existadmin/configuration/trusteddomainsblacklist.mdUpdated topics
logsandADMonitor_logsfolders. Also corrects the rollover description, which still described the pre-8.1 engine, and notes that a log level now survives a service restart.8.1.x → 8.1.y,8.0 → 8.1,7.5 → 8.1), plus a section on the logging changes to plan for, including theLogging.inisettings that stop working silently and need editing by hand.install/agent/silent.mdstill referenced 7.4..log.configformat. They carry no links to 8.1 topics, since KB is shared across versions and 8.1 isn't registered yet.Before merge
Screenshots still show the 8.0 UI. The Process Guardian topics describe controls that aren't in the current images.
Three details came from a written source rather than a build, and are worth a check:
logconfig.xmland.log.config. The topics use.log.config, which is what appears on disk and what the KB articles already use.🤖 Generated with Claude Code
Closes #1473