# Advanced Settings

## Overview

**Evidence:** Advanced Settings\
**Description:** ESXi Advanced Settings\
**Category:** System\
**Platform:** esxi\
**Short Name:** advsettings\
**Is Parsed:** Yes\
**Sent to Investigation Hub:** Yes\
**Collect File(s):** No

## Background

ESXi advanced settings provide granular control over hypervisor behavior, including security policies, resource allocation, logging verbosity, and feature toggles. These settings can be weaponized by attackers to weaken security, disable logging, or modify system behavior for persistence.

## Data Collected

This collector gathers structured data about advanced settings.

### Advanced Settings Data

| Field                  | Description           | Example                   |
| ---------------------- | --------------------- | ------------------------- |
| `AccessTime`           | Access Time           | 2023-10-15 14:30:25+03:00 |
| `AccessCount`          | Access Count          | 123                       |
| `URL`                  | URL                   | Example value             |
| `Browser`              | Browser               | Example value             |
| `Title`                | Title                 | Example value             |
| `VisitDuration`        | Visit Duration        | Example value             |
| `Referrer`             | Referrer              | Example value             |
| `TypedCount`           | Typed Count           | 123                       |
| `IsHidden`             | Is Hidden             | true                      |
| `TransitionType`       | Transition Type       | Example value             |
| `VisitID`              | Visit ID              | 123                       |
| `TransitionQualifiers` | Transition Qualifiers | Example value             |
| `User`                 | User                  | Example value             |
| `Profile`              | Profile               | Example value             |
| `HistoryFilePath`      | History File Path     | Example value             |

## Collection Method

This collector parses advanced system settings, extracting configuration keys, current values, default values, and setting descriptions from the ESXi advanced options database.

## Forensic Value

Advanced settings analysis reveals security weakening modifications, identifies disabled security features, detects altered logging configurations that hide attacker activity, and exposes non-standard settings that may indicate compromise. Comparing against security baselines highlights suspicious deviations.