Stirling provides better protection by automatically responding to security threats at multiple layers in the enterprise:

• Clients
  
• Messaging & collaboration servers
  
• The network edge
  

This improved protection makes it possible for administrators to save time while proactively securing the environment.

Stirling provides a single management console for configuring security across all the assets in your network, including clients, messaging and collaboration servers, and the network edge. Stirling easily integrates with existing infrastructure, such as Microsoft Active Directory® directory service, System Center Operations Manager, and Windows Server® 2008 Network Access Protection.

Stirling provides in-depth reporting and remediation of threats, vulnerabilities, and configuration risks through a single Dashboard. 

All components within the integrated security system share assessments about the security state of assets in an organization. Assessments provide you with prioritized, actionable information about the risks that impact your organization.

The assessments contain a variety of information, including:

• The computer or user that triggered the security assessment.
  
• The extent of the damage or risk of damage.
  
• The likelihood that the assessment represents a real threat.
  

These assessments are shared across the enterprise security assessment channel, of which all components of Stirling are a part. For each assessment, the protection technologies in Stirling can independently respond by sharing additional assessments concerning the asset in question, or by responding with a protection action.

Groups in Stirling are collections of assets that have dynamic memberships based on the results of a query. The query that defines the membership of a group can be based on:

• Computer name
  
• Active Directory Domain Services organizational unit location
  
• Group Definition Language query
  

For more information about groups, see Working with groups.

A policy in Stirling is a collection of settings that you can apply to one or more assets.

Policies are created by enabling the sections of a policy that represent the individual protection technologies. These sections are called policy units. When the policy unit is enabled, you can configure the settings in the policy unit and then save the policy.

When you create a policy, the configuration settings that you select do not automatically affect your assets. You must first link the policy to a target group. This process is called binding the policy to the group, and it deploys the policy.

For more information about policies, see Working with policies.

In this walkthrough, you create Stirling groups and Stirling policies. You then deploy Stirling policies to configure the Forefront Client Security agent on the assets. After verifying the result of the policies on the assets, you then view the result of the policy on the Stirling Dashboard. Finally, using sample malware, you test the Client Security agent on the asset and view the result on the Stirling Dashboard.

This walkthrough builds on the previous one, using the groups created in the "Protecting assets from malware - Walkthrough" topic. You create Windows Firewall policies in the Stirling console, and then deploy them to your assets. After verifying the results on the assets, you then view the results of the policy on the Stirling Dashboard. Finally, using a sample application that receives communication from the network, you test the Windows Firewall policy.

This walkthrough also builds on the first one, using the groups created in the "Protecting assets from malware - Walkthrough" topic. You create Stirling Security State Assessment (SSA) policies in the Stirling console, and then deploy them to your assets. After verifying the results on the assets, you then view the results of the policy on the Stirling Dashboard. To see a configuration problem display on the Dashboard, you implement a noncompliant Internet Explorer® setting, run a manual SSA scan, and then view those results on the Dashboard.

This walkthrough also builds on "Protecting assets from malware - Walkthrough", in addition to building on "Using Security State Assessments - Walkthrough". You first create and test Stirling policies that automatically remediate security configuration problems. Finally, you edit Stirling policies and test manual remediation of security configuration problems.

This walkthrough introduces assessments and response. Building on the previous walkthroughs, you create an additional group for servers, and you create and configure both manual and automatic security response policies for the desktops and the servers. You then deploy the policies and test the policies with sample malware.

This walkthrough guides you through configuring Windows Server 2008 Network Access Protection (NAP) to integrate with Stirling. After configuring NAP and configuring the Stirling server to be a remediation server, you configure the asset for NAP. You then view the asset's NAP status in the Stirling Dashboard, and then configure a Stirling policy that enforces NAP restriction based on the results of the Stirling policy. After you deploy the policy, you view the results of the policy both on the asset and in the Stirling Dashboard. You then configure the policy to require manual remediation, deploy the policy, and then manually remediate the asset by using the Stirling Dashboard.

In this walkthrough, you work with the Stirling snap-in in the Windows PowerShell™ environment. This walkthrough is similar to the first walkthrough, but you perform all Stirling commands in a PowerShell console with the Stirling snap-in, and you use PowerShell cmdlets in order to send tasks to the Stirling asset.

In this walkthrough, you create Stirling groups and Stirling policies for managing Forefront Security for Exchange Server. You then edit the policy in order to configure antivirus, file filter, and signature update settings for Forefront Security for Exchange Server, and then you deploy the policy to the managed Microsoft Exchange servers.  On the Stirling Dashboard, you then view the result of the policy.