Skip to main content

​
Before you start

Neo calls your Orion server through the SolarWinds Information Service (SWIS) REST API, which listens on port 17774 of your main polling engine. Neo reaches it over the internet, so it must answer on HTTPS with a certificate from a public certificate authority, at a public address. SWIS’s own certificate is self-signed, so most MSPs publish it through a reverse proxy.

​
Publish SWIS through a reverse proxy

Publish only the API, not the web console. Put a reverse proxy at your network edge that:
  • answers on a public name over HTTPS, with a certificate from a public certificate authority;
  • forwards only /SolarWinds/InformationService/v3/Json/ to https://<your Orion server>:17774, and refuses every other path;
  • accepts connections only from Neo’s addresses;
  • passes the Authorization header through to SWIS.
Save the proxy’s public address in Neo, with its port when it is not 443 (for example https://orion-api.example.com or https://orion.example.com:17774).

​
1. Create an Orion account for Neo

1

Create the account

In the Orion web console, open Orion’s account manager (the Manage Accounts link on its All Settings page) and add an Orion individual account for Neo with a strong password. A Windows account works too: enter it as DOMAIN\user in Neo.
2

Give it the rights your agents need

Any account can read through SWIS. Turn on only the rights for the changes you want agents to make:Use account limitations to keep the account to the nodes Neo should see.

​
2. Add the account in Neo

1

Open Integrations

In the Neo Dashboard, open Integrations → SolarWinds Orion, under Networking.
2

Save the address and account

Enter the address that publishes SWIS, the user name and the password, then click Save settings. Neo signs in and runs one query before saving, so a wrong address or port, a self-signed certificate, or a refused account is rejected straight away.

​
3. Turn SolarWinds Orion on per agent

Open the agent, go to its Tools & Settings tab, click Networking, and expand the SolarWinds Orion block. Agents see only what Neo’s Orion account can see.

​
Pick a preset

Read Only

Read nodes, alerts, events, statistics and history. Nothing is changed.

Helpdesk

Acknowledge, note and clear alerts without approval. Muting, unmanaging and changing nodes wait on a technician. Every other change is off.

IT Admin

Alerts, muting, nodes, applications, virtualization, IP addresses and dashboards change without approval, except deleting a node. Alert definitions, agents, server and VM actions, network configuration, security, credentials, accounts and settings wait on a technician.

Full Automation

Every change runs without approval, except the changes that always ask a technician.

​
Or set each area by hand

Monitoring Data can be Disabled or Read Only. Every other area holds changes only, so it is Disabled or Read/Write, with its own technician approval setting.

​
Changes that always ask a technician

These wait on a technician under every profile, whatever the area’s own approval setting:
  • Any change to stored credentials or Orion accounts, and deciding an NCM change approval.
  • Any change that stores or sends a credential: a password, an SNMP community or key, a token, a setting whose name says it is a credential, or the user name and password in a URL.
  • Any change that names a stored credential, such as attaching a Windows credential to a node or restarting a service with one, because Orion signs in with it.
  • Changing the address Orion connects to, such as a node’s IP address or DNS name, because Orion sends the record’s stored credentials there.
  • Deleting a node, which removes its history and alerts.
  • Deleting a configuration backup, and deleting or terminating a cloud instance.

​
What Neo never sends

  • A call that returns a credential or a decrypted value, or device configuration and script text, such as a configuration diff or search.
  • An export or import of alert definitions, templates, dashboards, policies or recordings, which can carry credentials and many changes at once.
  • Raw SQL against the Orion database, a subscription that sends data to another address, and uninstalling Orion.
  • A bulk action that names no records, such as deleting all vulnerability data.

​
Troubleshooting