Downloading and saving an Alerts log | IBM Partner Pavilion 2.3

Downloading and saving an Alerts log

Use the Alerts page in the Proventia Manager to save an alert log file to use for forensic purposes.

About this task

The Alert log is saved in three comma-separated values (CSV) files. The three files refer to the data displayed in the Alerts log:

Table 39. Alert log files

File	Description

filename_eventdata.csv	v The distinct records that match the alert
	record number
	v The event name and the risk level
filename_eventinfo.csv	The data listed in the event specific
	information section of the alert.

filename_eventresp.csv	The data from the responses executed
	section of the alert.

Procedure

1.Log on to the Proventia Manager for the Enterprise Scanner agent.

2.Click Logs → Alerts in the navigation pane.

3.Click Generate new log file from Alerts.

4.Select a file to download, and then click Download.

5.At the prompt, click OK.

6.Click Save, and then click OK.

7.Go to the folder where you want to save the file.

8.Type a file name, and then click Save.

128Enterprise Scanner: User Guide

Image 136

IBM Partner Pavilion 2.3 Downloading and saving an Alerts log, Click Generate new log file from Alerts, File Description

Contents

User Guide Version Copyright statement Trademarks and Disclaimer Iv Enterprise Scanner User Guide Contents Part 3. Maintenance Part 4. Appendixes 163 Audience About this bookTopics Related publications Technical support contacts Part 1. Scanning from the Proventia Manager Chapters Enterprise Scanner User Guide Section B Policy configuration Section a Network configurationAd hoc scanning in the Proventia Manager Section a Network configuration Configuring the management network interfaceProcedure About this task Configuring the scanning network interface Option Description InterfaceMaximum IPs per discovery subtask Maximum assets per assessment subtask Configuring scanning interface DNS settings Configuring routes for perspective Assigning perspective to a scanning interfaceOption Description Perspective Destination Network Section B Policy configuration Defining assets for a discovery scanBefore you begin Option Metric Description Displaying assessment checks by groups If you want to Then Clear groupingsClick Clear Groupings Create groupings interactively Displaying information about assessment checks Selecting assessment checks with filters Click the Common Settings tab Option Description Discover and report TCP servicesDiscover and report UDP services Option Description Ports to scan with generic TCP checks Default Option Description Ports to scan with generic UDP checksOption Description Dynamically determine OS if previously Obtained information is older than Option Description Verify account access level before using Local group membership to verify accessAccess domain controllers to verify access Access level Lockout Allowed is enabled. When Option Description Allowed account lockoutTemporary lockout allowed Enterprise Maximum Allowable Lockout Duration Defining assessment credentials for a policy Option Description Account Type SSH Local Account Type SSH DomainDomain/Host Account Level Defining the service names associated with TCP and UDP ports Defining ports or assets to exclude from a scan If you want to Then Exclude portsExclude assets Excluded Hosts box Scan policy Required Interpreting scan results in the Proventia Manager Running an ad hoc scan Monitoring the status of a scan Action Icon Description Exporting scan results from Proventia Manager Viewing the results of an ad hoc scanClick View/Manage Log Files Purging scan data from the database Field Description Enterprise Scanner User Guide Part 2. Scanning from the SiteProtector Console Enterprise Scanner User Guide Enterprise Scanner policies Inheritance indicators Initially blank or unconfigured?Policy inheritance with Enterprise Scanner policies General inheritance behavior Enterprise Scanner policies About this task Viewing asset or agent policies for Enterprise Scanner Select Network Enterprise Scanner from the Agent Type list Important Do not click Open Contents of an agent policy Agent policies for Enterprise ScannerAgent policy descriptions for Enterprise Scanner Policy inheritance with agent policies Network Locations policy Configuring routes for perspective Assigning perspective to a scanning interface Notification policy Event notification settings for Enterprise ScannerClick the Event Notification tab Access policy Configuring advanced parameters for event notificationClick the Advanced Parameters tab Account Purpose Configuring the management network interface Networking policy Configuring the scanning network interface Configuring scanning interface DNS settings Services policy Enable the network time protocol NTP Time policyIf you want to Then Change the date and time for the agent Network Time Protocol section Asset policies for Enterprise Scanner Update Settings policyAsset policy descriptions for Enterprise Scanner Discovery policy Policy contentsScope Defining assets to discover Before you begin Assessment policy Displaying information about assessment checks Displaying assessment checks by groups Selecting assessment checks with filters Configuring common assessment settings Option Description Dynamically determine OS if SiteProtector Information is older than Try to confirm the access level Option Description Allowed account lockout Assessment Credentials policy Defining assessment credentials for a policy Option Description Account Type Windows Scan Control policy Option Description Job name Cycle start dateCycle duration Current cycle start date Scan Window policy Important consideration for multiple agents Defining when scanning is allowed Scan Exclusion policy Defining ports or assets to exclude from a scan Network Services policy Default settingsService definition Policy inheritance Configuring a Network Services policy Ad Hoc Scan Control policy Configuration optionsRunning an ad hoc discovery scan with Enterprise Scanner Running an ad hoc assessment scan with Enterprise Scanner Click the Debug Settings tab Click Generate Support Data File Understanding scanning processes in SiteProtector What is perspective? Policy How to use Applies to Defining perspectivesPlacing agents in the correct perspective Perspectives in policies Network locations and perspectives Scan jobs and related terms DefinitionsAssets with unassigned criticality Term Description Types of tasks Scheduled and running scansImportance of tasks and subtasks Common management tasks Priorities for running tasks Tasks per type of scanCriticality and assessment tasks Scan type Number of tasks Stages of a scanning process Task prioritizationDynamic prioritization Type of scan Reason for prioritization Process for a scanning cycle Stage Description Size of scan windows Calibration considerationsDiscovery cycle duration Assessment cycle duration Achieving the right balance Enterprise Scanner User Guide Background scanning in SiteProtector Determining when background scans run How policies apply to ad hoc and background scans Asset policies and ad hoc scansChanging assessment and discovery policies Type of scan Description Scan Control policy Scan window and refresh cycle examples Checklist for background discovery scanning Background scanning checklists for Enterprise ScannerChecklist for background assessment scanning Enabling background scanning Defining when scanning is allowed Option Description Next cycle start date Procedure Type a series of individual IP addresses, a Defining network services Defining assessment credentials for a policy Option Description Account Type SSH Local Monitoring scans in SiteProtector Viewing your scan jobs Viewing discovery job results Viewing assessment job results Assessment subtask explanationThis part of the description Describes Finished Assessment On ScanGroupName for hosts with Enterprise Scanner User Guide Managing scans in SiteProtector Command Impact Stopping and restarting scan jobsImpact of stopping scan jobs Impact of restarting scan jobs Suspending and enabling all background scans Registration and authentication Minimum scanning requirementsSteps to initiate a scan Type of scan Steps to initiate Troubleshooting scanning behaviors for ad hoc scans Scanning behaviors for ad hoc scansInheritance Priority Expected scanning behaviors for background scans Managing scans in SiteProtector Enterprise Scanner User Guide Interpreting scan results in SiteProtector OS identification Osid certainty What determines certainty?Sources of Osid Certainty of Osid sources How Osid is updated in Enterprise Scanner Conditions for reassessing OsidException Rules for updating Osid Setting up a Summary view for vulnerability management Summary page for vulnerability managementVulnerability management options Portal Description Portal Description Viewing vulnerabilities by asset in Enterprise Scanner About vulnerability assessmentCreating custom views Benefits Field descriptions Field Description Viewing vulnerabilities by detail in Enterprise Scanner Field Description Viewing vulnerabilities by object in Enterprise Scanner Field Vulnerability view by vulnerability name Field Description Running reports in the SiteProtector Console Types of assessment reportsReport descriptions Report Description Report Description Procedure Enterprise Scanner User Guide Logs and alerts Log files and alert notification Two types of log filesTwo types of information Log size System logs System log descriptions Getting log status information Enterprise Scanner ES logsLog descriptions Statistic Description Changing logging detail Downloading Enterprise Scanner ES log files DownloadDelete a log file Click View/Manage Log Files Delete Alerts log Risk level iconsEvent information icons Icon Description Click Generate new log file from Alerts Downloading and saving an Alerts logFile Description Finding specific events in the Alerts log Clearing the Alerts logClick Clear current Alerts from event log Enterprise Scanner User Guide Number If you want to Then Search the Alert log file by Alert IDSearch by Alert Id# box Enterprise Scanner User Guide Ticketing and remediation Ticketing and Enterprise Scanner TicketsVulnerability auto ticketing Custom categories Remediation process overview for Enterprise Scanner Scanning recommendations Remediation tasks for Enterprise Scanner Task overview Option Tab Description Task 6 Close the ticket Part 3. Maintenance Enterprise Scanner User Guide Performing routine maintenance Shutting down your Enterprise Scanner Removing an agent from SiteProtector Types of backups If you restore a system before you make backupsDate of last system backup Options for backing up Enterprise Scanner Backing up configuration settings Making full system backups Click the Full Backup tab Choose an option Updating Enterprise Scanner Types of updates Update locationsType of update Content Update location Description Update options Installation options with scheduled updatesRollbacks and backups Updating options Configuring explicit-trust authentication with an XPU server Authentication method Advantages and Disadvantages Configuring an Alternate Update location Select the Use Alternate Update Server check boxOption Description Host or IP Name Option Description Trust Level CA Certificate Configuring notification options for XPUs Configuring an Http ProxySelect Enable Proxy Scheduling a one-time firmware update Configuring automatic updatesClick the Update Settings tab Option Description Check for updates daily or weekly Option Description Check for updates at given intervals Option Description Do Not InstallAutomatically Install Updates Delayed Manually installing updates Viewing the status of the Enterprise Scanner agent Proventia Manager Home System statusNetwork interface status Model Protection status Updates statusHeader Viewing agent status in the SiteProtector Console Viewing agent status Module or process Description Troubleshooting option Troubleshooting the Enterprise Scanner sensorViewing the status of the CAM modules Module or process Description Troubleshooting option Part 4. Appendixes Enterprise Scanner User Guide 165 Enterprise Scanner User Guide Product handling information Product safety labels World trade safety information Laser compliance Laser safety informationProduct recycling and disposal Battery return program For Taiwan For the European Union For California Electronic emissions noticesFederal Communications Commission FCC Statement European Union EU Electromagnetic Compatibility Directive Canadian Department of Communications Compliance StatementEC Declaration of Conformity In German People’s Republic of China Class a Compliance Statement Japan Class a Compliance Statement Korean Class a Compliance Statement Enterprise Scanner User Guide Index 177 Reassessing 105 Rules Sources Scan job