Symantec Security Expressions Server manual Connection Monitors, Deleting Exceptions

Page 52

SecurityExpressions Server User Guide

To edit Exceptions:

1.Click the Edit hyperlink on the Exceptions table to select the row to edit.

2.Modify the Exception parameters (Type, Value, Expiration Date, Group Posture Result)

3.Click Update.

Deleting Exceptions

To delete an Exception:

1.Click the Edit hyperlink on the Exceptions table to select the row to remove.

2.When you delete an Exception, you remove it from the database. A warning appears to remind you that you are about to delete a record from the database. Cancel the action or delete the record.

Connection Monitors

Connection Monitors

Connection Monitors are services that are installed on DHCP Servers, Active Directory Servers, or other servers that coordinate Audit-on-Connect sequences. They determine when a device connects to the network and then send a request to a server to perform an audit on that device. Each Connection Monitor uses a configuration file (dmconfig.txt) to store a list of audit servers to contact. This list includes a particular range of IP addresses, along with a distribution method to balance the load among the audit servers.

Most of the configuration work is in editing the configuration file (dmconfig.txt). The settings described here are only part of the process.

The SecurityExpressions Audit & Compliance Sever includes three types of Connection Monitors:

•DHCP Network Connection Monitor with access to network traffic, installed on any server, monitors network packets for those containing DHCP protocols.

•Microsoft DHCP Server Plug-In Connection Monitor, installed on the device running Windows DHCP server.

•Active Directory Connection Monitor, installed on any server on the domain, monitors Active Directory activity for when a new device appears on the network.

IP Address or Fully Qualified Name

List the IP address or fully-qualified name of the computer hosting a Connection Monitor.

You must configure the SecurityExpressions Audit & Compliance Sever with a list of the known Connection Monitors that will be listened to. If the IP address or the fully-qualified name of the Connection Monitor does not appear in the Device Connection Monitor list, the module is not listened to.

Add or remove the name of a new computer that hosts a Connection Monitor.

Specify Password and Encrypted Password

44

Page 51 Page 53
Image 52
Page 51 Page 53
Contents SecurityExpressions Server User Guide Page Table Of Contents Page Table Of Contents Page Vii Page Contacting Us Page Technical Support Contacting Technical SupportPage Other Products SecurityExpressions ConsolePage Overview About SecurityExpressions Audit & Compliance ServerPage Self-Service Audit What is Self-Service Auditing?Self-Service Audit Agreement How to Audit your Local ComputerDisplays on the page. No detailed audit results appear Configure Servers About Server ConfigurationLocal Server Settings Pages with Role SettingsViewing Audit Results SetupDatabase Connection Secure Connection Windows 2000 ServersCredential Store User Click OK on the Default Web Site Properties windowCreating Credential Stores Enable Web Services SecurityExpressions Console Credential StoresSoftware Registration Site PreferencesAccess Global Machine List Access User Roles Item RightsLibrary Synchronization Policy File LibraryCheck the Synchronize with a policy file library box About Policy Files How System Scores are CalculatedDefault method for remote execution on Windows Agent & Service ConfigurationTarget Options SSH Agent Authentication Database Cleanup Update Task CancelPolicies Add TaskSite Preferences Agent DownloadsClick Use the Following Agreement Allow Remediation Page What is Audit-on-Connect? Audit-On-ConnectPolicies Policies TablePage Adding Policies Editing Policies Configuring with Run-Time Policy Variables Deleting PoliciesPage Scopes ScopesAdd a New Scope Page Edit a Scope Scopes Table Deleting Scopes DNS Domain Name ScopesExpression Scopes Supported OperatorsOrg Unit Scopes Supported FunctionsDetection Method Scopes Notifications Creating New Command Notifications Creating New Email NotificationsClick Add New Editing NotificationsClick Add New Creating New Command Notifications Deleting Notifications Notification VariablesExceptions ExceptionsExceptions Table Column Description Adding ExceptionsSpecify Password and Encrypted Password Connection MonitorsDeleting Exceptions Connection MonitorsRemove Configuring Connection MonitorsEnabling Connection Monitors Connection Monitor Configuration File IP Range SectionDefault OptionsConfiguration File Syntax Processing the Configuration FileActive Directory Active Directory Connection Monitor only Network Slow LinksTrace Route Information Network Admissions ControlUnmanaged Systems Initial TokenHealthy Quarantined/UnknownReaudit if quarantined Redirection WebRedirection Web Page Behavior Audit on Connect TracingAudit on Connect Tracing Page Page What is Audit-on-Schedule? Audit-On-SchedulePage Adding Policies Editing Policies Deleting Policies Page Notifications Click Add New Click Add New Deleting Notifications My Machine Lists My Machine ListsAdding Machine Lists Editing Machine ListsScheduled Tasks Deleting Machine ListsEditing Global Machine Lists Scheduled TasksBasic Settings Adding Scheduled TasksSchedule Settings Hosts Not Connected Settings Other Options Settings Credentials SettingsWindows Group Access Editing Scheduled TasksSchedule Settings Notifications Other Options Settings Deleting Scheduled Tasks Page View Audit-On-Connect Activity Browse Audit-On-Connect ActivityAudit-On-Connect Activity Table Column Description Adding a New Audit-On-Connect Report ProfileEditing Report Profiles Deleting Report ProfilesAudit-On-Connect Error Log Report Audit-On-Connect Exceptions ReportPage Browse Audit Results View Audit ResultsAdding a New Audit Results Report Profile Page Scheduled Audits Log Report Adding Custom Reports to the Server ApplicationEditing Audit Report Results Profiles Deleting Audit Report Results ProfilesPage Glossary Page Configure IndexIP address 33, 44, 45 Rule weights
Top Page Image Contents