Options, Default | Symantec Security Expressions Server manual

Audit-On-Connect

Comma-Separated List of Servers

Includes the names of the audit servers. A comma separates each server name.

Options

The Options section of the configuration file contains any settings needed to control the Connection Monitors, such as enabling logging and identifying the location and name of the log file.

Port

The port you want a connection monitor to use to communicate with the server software. This entry must match the server's configuration, which is 9009.

LogEnable

Typing True turns logging on. Typing False turns logging off.

LogFile

Identifies the log file location and file name.

Password

Add the encrypted password.

DropPXE

Enables you to ignore PXE DHCP requests if using the DHCP Network Connection Monitor or Microsoft DHCP Server Connection Monitor. When the PXE gets a DHCP request, Audit-on- Connect is triggered. When PXE is done and Windows restarts, Audit-on-Connect is triggered once more, not necessarily using the same IP address.

If set to 1, PXE DHCP packets are ignored. If set to 0, they are processed.

Default

The Default section identifies all IP addresses not previously placed in one of the IP range groups.

IPRange

Set to default.

AuditServers

Comma-separated name of the servers.

DistributionMethod

Set to Round Robin or First Available.

47

Image 55

Symantec Security Expressions Server manual Options, Default

Contents

SecurityExpressions Server User Guide Page Table Of Contents Page Table Of Contents Page Vii Page Contacting Us Page Contacting Technical Support Technical SupportPage SecurityExpressions Console Other ProductsPage About SecurityExpressions Audit & Compliance Server OverviewPage How to Audit your Local Computer Self-Service AuditWhat is Self-Service Auditing? Self-Service Audit Agreement Displays on the page. No detailed audit results appear Pages with Role Settings Configure ServersAbout Server Configuration Local Server Settings Viewing Audit Results SetupDatabase Connection Windows 2000 Servers Secure Connection Credential Store User Click OK on the Default Web Site Properties windowCreating Credential Stores Site Preferences Enable Web ServicesSecurityExpressions Console Credential Stores Software Registration Access Item Rights Global Machine List Access User Roles Library Synchronization Policy File LibraryCheck the Synchronize with a policy file library box How System Scores are Calculated About Policy Files Default method for remote execution on Windows Agent & Service ConfigurationTarget Options SSH Agent Authentication Database Cleanup Add Task Update TaskCancel Policies Site Preferences Agent DownloadsClick Use the Following Agreement Allow Remediation Page Policies Table What is Audit-on-Connect?Audit-On-Connect PoliciesPage Adding Policies Editing Policies Deleting Policies Configuring with Run-Time Policy VariablesPage Scopes ScopesAdd a New Scope Page Edit a Scope Scopes Table Supported Operators Deleting ScopesDNS Domain Name Scopes Expression Scopes Org Unit Scopes Supported FunctionsDetection Method Scopes Notifications Editing Notifications Creating New Command NotificationsCreating New Email Notifications Click Add New Click Add New Creating New Command Notifications Notification Variables Deleting Notifications Adding Exceptions ExceptionsExceptions Exceptions Table Column Description Connection Monitors Specify Password and Encrypted PasswordConnection Monitors Deleting Exceptions Remove Configuring Connection MonitorsEnabling Connection Monitors IP Range Section Connection Monitor Configuration File Options Default Configuration File Syntax Processing the Configuration FileActive Directory Active Directory Connection Monitor only Slow Links Network Initial Token Trace Route InformationNetwork Admissions Control Unmanaged Systems Redirection Web HealthyQuarantined/Unknown Reaudit if quarantined Redirection Web Page Behavior Audit on Connect TracingAudit on Connect Tracing Page Page Audit-On-Schedule What is Audit-on-Schedule?Page Adding Policies Editing Policies Deleting Policies Page Notifications Click Add New Click Add New Deleting Notifications My Machine Lists My Machine Lists Editing Machine Lists Adding Machine Lists Scheduled Tasks Scheduled TasksDeleting Machine Lists Editing Global Machine Lists Adding Scheduled Tasks Basic Settings Schedule Settings Hosts Not Connected Settings Credentials Settings Other Options Settings Editing Scheduled Tasks Windows Group Access Schedule Settings Notifications Other Options Settings Deleting Scheduled Tasks Page Adding a New Audit-On-Connect Report Profile View Audit-On-Connect ActivityBrowse Audit-On-Connect Activity Audit-On-Connect Activity Table Column Description Deleting Report Profiles Editing Report Profiles Audit-On-Connect Exceptions Report Audit-On-Connect Error Log ReportPage Browse Audit Results View Audit ResultsAdding a New Audit Results Report Profile Page Deleting Audit Report Results Profiles Scheduled Audits Log ReportAdding Custom Reports to the Server Application Editing Audit Report Results ProfilesPage Glossary Page Index Configure IP address 33, 44, 45 Rule weights