Symantec Security Expressions Server instruction

SecurityExpressions Server User Guide
Adding Policies	57
Editing Policies	58
Deleting Policies	59
Configuring with Run-Time Policy Variables	59
Notifications	61
Notifications	61
Creating New Command Notifications	62
Creating New Email Notifications	63
Deleting Notifications	63
Notification Variables	63
My Machine Lists	64
My Machine Lists	64
Adding Machine Lists	65
Editing Machine Lists	65
Deleting Machine Lists	66
Editing Global Machine Lists	66
Scheduled Tasks	66
Scheduled Tasks	66
Adding Scheduled Tasks	67
Editing Scheduled Tasks	71
Deleting Scheduled Tasks	75
View Audit-On-Connect Activity	77
Browse Audit-On-Connect Activity	77
Audit-On-Connect Activity Table	77
Adding a New Audit-On-Connect Report Profile	77
Editing Report Profiles	78
Deleting Report Profiles	78
Audit-On-Connect Error Log Report	79
Audit-On-Connect Exceptions Report	79
View Audit Results	81
Browse Audit Results	81
vi

Image 6

Symantec Security Expressions Server manual

Contents

SecurityExpressions Server User Guide Page Table Of Contents Page Table Of Contents Page Vii Page Contacting Us Page Technical Support Contacting Technical SupportPage Other Products SecurityExpressions ConsolePage Overview About SecurityExpressions Audit & Compliance ServerPage Self-Service Audit Agreement Self-Service AuditWhat is Self-Service Auditing? How to Audit your Local Computer Displays on the page. No detailed audit results appear Local Server Settings Configure ServersAbout Server Configuration Pages with Role Settings Setup Viewing Audit ResultsDatabase Connection Secure Connection Windows 2000 Servers Click OK on the Default Web Site Properties window Credential Store UserCreating Credential Stores Software Registration Enable Web ServicesSecurityExpressions Console Credential Stores Site Preferences Access Global Machine List Access User Roles Item Rights Policy File Library Library SynchronizationCheck the Synchronize with a policy file library box About Policy Files How System Scores are Calculated Agent & Service Configuration Default method for remote execution on WindowsTarget Options SSH Agent Authentication Database Cleanup Policies Update TaskCancel Add Task Agent Downloads Site PreferencesClick Use the Following Agreement Allow Remediation Page Policies What is Audit-on-Connect?Audit-On-Connect Policies TablePage Adding Policies Editing Policies Configuring with Run-Time Policy Variables Deleting PoliciesPage Scopes ScopesAdd a New Scope Page Edit a Scope Scopes Table Expression Scopes Deleting ScopesDNS Domain Name Scopes Supported Operators Supported Functions Org Unit ScopesDetection Method Scopes Notifications Click Add New Creating New Command NotificationsCreating New Email Notifications Editing Notifications Click Add New Creating New Command Notifications Deleting Notifications Notification Variables Exceptions Table Column Description ExceptionsExceptions Adding Exceptions Deleting Exceptions Specify Password and Encrypted PasswordConnection Monitors Connection Monitors Configuring Connection Monitors RemoveEnabling Connection Monitors Connection Monitor Configuration File IP Range Section Default Options Processing the Configuration File Configuration File SyntaxActive Directory Active Directory Connection Monitor only Network Slow Links Unmanaged Systems Trace Route InformationNetwork Admissions Control Initial Token Reaudit if quarantined HealthyQuarantined/Unknown Redirection Web Audit on Connect Tracing Redirection Web Page BehaviorAudit on Connect Tracing Page Page What is Audit-on-Schedule? Audit-On-SchedulePage Adding Policies Editing Policies Deleting Policies Page Notifications Click Add New Click Add New Deleting Notifications My Machine Lists My Machine Lists Adding Machine Lists Editing Machine Lists Editing Global Machine Lists Scheduled TasksDeleting Machine Lists Scheduled Tasks Basic Settings Adding Scheduled Tasks Schedule Settings Hosts Not Connected Settings Other Options Settings Credentials Settings Windows Group Access Editing Scheduled Tasks Schedule Settings Notifications Other Options Settings Deleting Scheduled Tasks Page Audit-On-Connect Activity Table Column Description View Audit-On-Connect ActivityBrowse Audit-On-Connect Activity Adding a New Audit-On-Connect Report Profile Editing Report Profiles Deleting Report Profiles Audit-On-Connect Error Log Report Audit-On-Connect Exceptions ReportPage View Audit Results Browse Audit ResultsAdding a New Audit Results Report Profile Page Editing Audit Report Results Profiles Scheduled Audits Log ReportAdding Custom Reports to the Server Application Deleting Audit Report Results ProfilesPage Glossary Page Configure Index IP address 33, 44, 45 Rule weights