VMware NSX Network Detection and Response System Administration Operations

From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

lastline@lastline-manager:~$ lastline_setup

If you are prompted for the sudo password, use the password for the default lastline user account.

To check the current network settings, type network.

-> network
network dns_nameservers = 8.8.8.8 8.8.4.4
network gateway = 10.0.2.2
network netmask = 255.255.255.0
network address = 10.0.2.15
network interface = eth0
network method = static

To enable DHCP addressing, type network method dhcp.

-> network method dhcp
network method = dhcp  # changed; original value: static

After you provide all the required parameters, save your configuration.

-> save

The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

lastline@lastline-manager:~$ lastline_setup

If you are prompted for the sudo password, use the password for the default lastline user account.

To check the current network settings, type network. This example shows the VMware NSX Network Detection and Response appliance is currently using DCHP:

-> network
network interface = eth0
network method = dhcp

To enable a static IP address, type network method static.

-> network method static
network method = static  # changed; original value: dhcp

This step is only needed if the appliance is currently using DCHP.

To set the IP address, type network address ip_address. Use an IPv4 address of four octets.

-> network address 10.0.2.15
network address = 10.0.2.15  # changed; original value:

To set the netmask, type network netmask netmask. Use an IPv4 netmask of four octets.

-> network netmask 255.255.255.0
network netmask = 255.255.255.0  # changed; original value:

To set the gateway IP address, type network gateway ip_address. Use an IPv4 address of four octets.

-> network gateway 10.0.2.2
network gateway = 10.0.2.2  # changed; original value:

To set the DNS server IP address, type network dns_nameservers ip_address [ip_address]. Use an IPv4 address of four octets for each address.

-> network dns_nameservers 10.2.1.1 10.2.2.1
network dns_nameservers = 10.2.1.1 10.2.2.1  # changed; original value:

After you provide all the required parameters, save your configuration.

-> save

The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

lastline@lastline-manager:~$ lastline_setup

If you are prompted for the sudo password, use the password for the default lastline user account.

To re-enable the default mode of AnonVPN, set the lastline parameter of the anonvpn_mode option.

-> anonvpn_mode lastline
anonvpn_mode = lastline  # changed; original value:

After you provide all the required parameters, save your configuration.

-> save

The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

lastline@lastline-manager:~$ lastline_setup

If you are prompted for the sudo password, use the password for the default lastline user account.

To enable the honeypot mode of AnonVPN, set the honeypot parameter of the anonvpn_mode option.

-> anonvpn_mode honeypot
anonvpn_mode = honeypot  # changed; original value: lastline

After you provide all the required parameters, save your configuration.

-> save

The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

lastline@lastline-manager:~$ lastline_setup

If you are prompted for the sudo password, use the password for the default lastline user account.

To enable the custome mode of AnonVPN, set the custom parameter of the anonvpn_mode option.

-> anonvpn_mode custom
anonvpn_mode = custom  # changed; original value: lastline

To select the interface to use for the custom VPN connection, type anonvpn_upstream_ifname interface-name.

For example, using a virtual interface such as OpenVPN:

-> anonvpn_upstream_ifname tun0
anonvpn_upstream_ifname = tun0  # changed; original value:

For example, using a physical interface:

-> anonvpn_upstream_ifname eth3
anonvpn_upstream_ifname = eth3  # changed; original value:

To select the DNS server to use for the custom VPN connection, type anonvpn_dns_server_ip ip_address. Use an IPv4 address of four octets. For example, 8.8.4.4 for the public Google DNS servers.

-> anonvpn_dns_server_ip 8.8.4.4
anonvpn_dns_server_ip = 8.8.4.4  # changed; original value:

You must specify a gateway when you use a physical interface for the custom VPN connection. It is optional for virtual interfaces.

To select the gateway, type anonvpn_upstream_gateway_ip ip_address. Use an IPv4 address of four octets.

-> anonvpn_upstream_gateway_ip 10.0.0.1
anonvpn_upstream_gateway_ip = 10.0.0.1  # changed; original value:

After you provide all the required parameters, save your configuration.

-> save

The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

From the Main navigation menu, click Admin. On the Admin page, select Accounts from left sidebar menu. Then on the Accounts page, click the All accounts tab.

The quick search field above the list provides fast, as-you-type search. It filters the rows in the list, displaying only those rows that have text, in any field, that matches the query string.

By default, the list is sorted by Username. You can sort the list by Name, Email, or Blocked. Click the icon in the header beside each column title.

Click the icon for the selected user. Then edit the settings for that user account on the Account Settings page.

Click the icon. Then click Yes in the Delete confirmation pop-up.

To block a user, click the icon. Then click Yes in the Confirm block pop-up.

To later unlock a blocked user. Click the icon again.

From the Main navigation menu, click Admin. On the Admin page, select Accounts from left sidebar menu. Then on the Accounts page, click the Add account tab.

In the Username field, type a user name. We recommend that the user name be an email address, however any text string is a valid user name.

In the Password field, type a password.

In the Confirm password field, re-enter the password.

In the First, last name fields respectively, type the user's first and last name.

In the Email address field, type the user's email address.

Select the Default timezone for the user from the pull-down menu. This timezone is used as the default timezone for all security-related reporting for the user.

Click Create to add the new user account.

From the Main navigation menu, click Admin. On the Admin page, select Accounts from left sidebar menu. Then on the Accounts page, click the All accounts tab.

Scroll through the users list until you find the appropriate account, username. Click the icon for that user.

Scroll down and click the icon to open the Advanced settings section. Then click the Make username the primary account button.

From the Main navigation menu, click Admin. On the Admin page, select Accounts from left sidebar menu. Then on the Accounts page, click the All accounts tab.

Click the add roles button to add a role to a user account. In the roles dialog, select the Administrator, Analyst, or Read only role to be added. You can assign more than one role to a user.

To remove a role, click on the role to be removed. In the Confirm role removal prompt, click Remove role.

By default, permissions are only enabled at the Customer tier. If you want to restrict a user to a specific license or subkey, you must first enable those tiers.

To add a permission, click the add permission button. In the permission dialog, select the permissions to be added.

To remove a permission, click on the permission to be removed. In the Confirm permission removal prompt, click Remove permission.

In the Password field, enter a new password.

In the Confirm password field, re-enter the password.

In the First, last name fields respectively, update the user's first and last name.

In the Email address field, update the user's email address.

Modify the Default timezone from the pull-down menu.

From the Main navigation menu, click Admin. On the Admin page, select Accounts from left sidebar menu. Then on the Licensing page, click the Licenses tab.

Click to reset the API token for the license.

For an On-Premises installation, you need to perform this request on the appliance. You can only reset the API token of secondary licenses. To reset the API token of your main license, contact VMware Support.

If there are sensors associated with the license, click the icon or the license key to view the sensors.

On the Licenses tab, click the icon or the license key or click the Sensors tab.

By default, a Sensor is set to Active. You can toggle it to Inactive. The system prompts you that toggling an active Sensor to inactive takes effect immediately.

Click the icon to create a new Sensor license. On the Add sensor tab, perform the following steps:

Click in the Group column header. The Sensor groups tab is loaded.

On the Sensors tab, click in the Group column header or click the Sensor groups tab.

To create a new sensor group in the Add group section, perform the following steps

Click to expand the Sensor groups list. In the Add sensor to group section, select a Sensor from the pull-down menu. The block below the menu displays the sensor parameters.

Click Add sensor to group.

To remove a sensor, click the Remove sensor button. Then click the Confirm remove sensor button.

From the Main navigation menu, click Admin. On the Admin page, select Appliances from left sidebar menu. Then on the Appliances tab, click Configuration. Initially, no appliance is selected on the Configuration tab. Click the Appliance: None Selected link and select the Manager from the Select Appliance pop-up.

Alternatively, from the Appliances → Overview tab, scroll to the row for the Manager, click the Quick links button, and select Configuration from the pull-down menu.

On the Configuration: System tab, you can set the following options:

• Auto Update is Enabled by default. The Manager automatically updates when new software versions are released by VMware.

• Install daily OS security updates automatically is Enabled by default. The Manager automatically installs new security updates when they are released by Ubuntu.

• Syslog streaming is Disabled by default. If you set it to Enabled, you can stream the system logs from the Ubuntu server hosting the appliance to a remote syslog server. This feature streams all files from the /var/logs directory (such as auth.log, kernel.log, etc.). It can be used for enhanced security. For example, by setting a policy of using sudo to run privileged commands combined with syslog streaming, the history of all privileged commands run on the system will be logged to the remote log server.

  You must define at least one destination server in the displayed Syslog Destinations list. For each destination, select the Protocol (UDP or TCP) then enter a Host (IP address or FQDN) and Port (default is port 514).

  Use the Actions to delete the entry (click ) or reset the port (click ).

The VMware NSX Network Detection and Response generates and stores a lot of data during normal processing. On the Configuration: Data retention tab, you can modify the default data retention values.

• The Database retention section defines how long data is retained in number of months. You can modify the following options:

  • Appliance log

  • Endpoint detection

  • Mail detection

  • Network detection

  • Network detection metadata

  • Network log

  • Network analysis

  • Network analysis log

  The allowed range is 1 to 22 months. Enter a value or click the icon to change the value. Click the icon to set the retention value to Unlimited. If you have changed the value, click the Default button to reset it.

• The Analysis artifacts retention section defines the number of days that analysis reports are retained. This includes detailed analysis results, such as the sandbox reports (or any metadata files, such as screenshots of network traffic captures). Enter a value or click the icon to change the value. Click the icon to set the retention value to Unlimited. If you have changed the value, click the Default button to reset it.

The VMware NSX Network Detection and Response detects malicious artifacts that attempt to gain access to your environment. If your system encounters a novel artifact, sharing this information will help VMware and the wider security community. This feature is designed so that there is very little risk of exposing confidential or sensitive information.

On the Configuration: Data sharing tab, you can enable and configure the level of sharing you are comfortable with. By default, Upload malicious files is Disabled. When Enabled, your system will share its detection of a malicious artifact by uploading the artifact content to the VMware backend. You can configure at what level of maliciousness the file is shared with the other options on this tab:

• Minimum score for documents

• Minimum score for executables

• Minimum score for Java files

• Minimum score for SWF files

• Upload connection metadata

• Upload protocol metadata

For the minimum score options, enter a value or use the icon to change the score. The value can be from 0 to 100. Click the icon to select Never upload.

Toggle the connection and protocol metadata options to Enabled to share with the VMware backend.

From the Main navigation menu, click Admin. On the Admin page, select Appliances from left sidebar menu. Then on the Appliances tab, click Configuration. Initially, no appliance is selected on the Configuration tab. Click the Appliance: None Selected link and select the Data Node from the Select Appliance pop-up.

Alternatively, from the Appliances → Overview tab, scroll to the row for the Data Node, click the Quick links button, and select Configuration from the pull-down menu.

On the Configuration: System tab, you can set the following options:

• Auto Update is Enabled by default. The Data Node automatically updates when new software versions are released by VMware.

• Install daily OS security updates automatically is Enabled by default. The Data Node automatically installs new security updates when they are released by Ubuntu.

• Syslog streaming is Disabled by default. If you set it to Enabled, you can stream the system logs from the Ubuntu server hosting the appliance to a remote syslog server. This feature streams all files from the /var/logs directory (such as auth.log, kernel.log, etc.). It can be used for enhanced security. For example, by setting a policy of using sudo to run privileged commands combined with syslog streaming, the history of all privileged commands run on the system will be logged to the remote log server.

  You must define at least one destination server in the displayed Syslog Destinations list. For each destination, select the Protocol (UDP or TCP) then enter a Host (IP address or FQDN) and Port (default is port 514).

  Use the Actions to delete the entry (click ) or reset the port (click ).

From the Main navigation menu, click Admin. On the Admin page, select Appliances from left sidebar menu. Then on the Appliances tab, click Configuration. Initially, no appliance is selected on the Configuration tab. Click the Appliance: None Selected link and select the Engine from the Select Appliance pop-up.

Alternatively, from the Appliances → Overview tab, scroll to the row for the Engine, click the Quick links button, and select Configuration from the pull-down menu.

On the Configuration: System tab, you can set the following options:

• Auto Update is Enabled by default. The Engine automatically updates when new software versions are released by VMware.

• Install daily OS security updates automatically is Enabled by default. The Engine automatically installs new security updates when they are released by Ubuntu.

• Syslog streaming is Disabled by default. If you set it to Enabled, you can stream the system logs from the Ubuntu server hosting the appliance to a remote syslog server. This feature streams all files from the /var/logs directory (such as auth.log, kernel.log, etc.). It can be used for enhanced security. For example, by setting a policy of using sudo to run privileged commands combined with syslog streaming, the history of all privileged commands run on the system will be logged to the remote log server.

  You must define at least one destination server in the displayed Syslog Destinations list. For each destination, select the Protocol (UDP or TCP) then enter a Host (IP address or FQDN) and Port (default is port 514).

  Use the Actions to delete the entry (click ) or reset the port (click ).

From the Main navigation menu, click Admin. On the Admin page, select Backup from left sidebar menu. Then on the Backup page, click the Configure storage tab.

If your storage back-end is an SSH server, generate an SSH key.

Click the New SSH key button to add a backup configuration. If there is an existing SSH key, click the icon to add another.

In the Add SSH Key pop-up, provide the following:

• Key name — Enter a name for the key.

• Key size — Select the size from the pull-down menu. The recommended key size is 2048 bits. For more security, you can select 4096 or 8192. The system will warn you of the longer processing time to generate a larger key.

Click the Generate key button. When the process completes, click the Close button.

Click the New storage button to add a storage back-end. If there is an existing storage back-end defined, click the icon to add another.

The Add storage pop-up is displayed.

Enter a Name for the storage back-end.

From the Type drop-down menu, select the storage type. Select Amazon S3 or SSH.

If you select Amazon S3, fill in the Amazon S3 configuration section:

• Bucket name — Enter the name of the S3 Bucket to be used for backup.

• AWS key ID — Enter the access key ID generated by AWS for the account.

• AWS secret key — Enter the secret access key generated by AWS for the account.

• Destination — Select the destination from the pull-down menu. Select Amazon AWS cloud (the default) or Private cloud. If you select Private cloud, the following additional fields are added to the pop-up.

• Host — Enter the hostname or IP address of the private cloud provider.

• Port — Select the port number to use. By default, this is port 443.

• Use System Proxy — Set the toggle to determine if the system proxy is to be used.

If you select SSH, fill in the SSH configuration section:

• Server name — Set the hostname or IP address of SSH server.

• Server base — Enter the base path where the backups will be stored on the SSH server. This directory must exist on the SSH server and be writable by the configured user.

• Username — Enter the username of the account that will be used to access the SSH server. This user must exist on the SSH server and support login with public key authentication using the configured SSH Key.

• SSH key — From the pull-down menu, select the SSH key to use to authenticate to the SSH server. If there is no SSH key available or you want to use a different key, click to add a new SSH key.

  To enable access for the backup to the SSH server, you must add the SSH key to the SSH server. From the SSH Key Management list, click the View pub key button to view the key. Then copy and paste it into the ~/.ssh/authorized_keys file in the home directory of the configured user.

• SSH port — Select the SSH port to use to connect to the SSH server. The default port is 22.

Once the storage location for either Amazon S3 or SSH is properly configured, click the Add button to save your changes and dismiss the pop-up.

From the Configure storage tab on the Backup page, click the Configure backup tab.

Click the New configuration button to add a backup configuration. If there is an existing backup defined, click the icon to add another.

The Add backup configuration pop-up is displayed.

Enter a Name for the backup configuration.

From the Storage drop-down menu, select the storage back-end. The menu is populated with the storage back-end defined in 3 through 5.

In the Encryption key enter a text string to use as an encryption key. The VMware NSX Network Detection and Response uses aes256 CBC to encrypt the backup data before it is transferred to the backup storage.

To speed up the backup process, you can enable the Essential files only toggle (disabled by default). When you enable this toggle, the system will only backup the VMware backend database but not any PCAP or analysis files.

Click the Full Backup Configuration link and provide the following:

• Full Backup Frequency — Select when to perform a backup from the pull-down menu. If you select Manual (the default), the configuration is complete. If you select Yearly, Monthly, Weekly, or Daily, then you must provide specific date and time parameters.

Click the Incremental Backup Configuration link and provide the following:

• Incremental Backup Frequency — Select when to perform a backup from the pull-down menu. If you select Manual (the default), the configuration is complete. If you select Yearly, Monthly, Weekly, or Daily, then you must provide specific date and time parameters.

Once the backup is properly configured, click the Add Config button to save your changes and dismiss the Add backup configuration pop-up.

From the Main navigation menu, click Admin. On the Admin page, select Backup from left sidebar menu. Then on the Backup page, click the Restore tab.

By default, the Date range is one month prior to the current date. The other parameters are blank.

Select Storage from the associated pull-down menu. Select Hostname from the associated pull-down menu. Click the From or To buttons to open a calendar widget. You can also enter a date directly in the From or To textboxes using the format YYYY-MM-DD. Then click the Apply button to search for relevant backup jobs.

The User Portal displays a Restore backups list. It includes the following fields:

• Timestamp — The date and time the backup was performed.

• Config name — The name of the backup configuration.

• Storage name — The name of the backup storage location.

• Backup type — The type of backup (for example, Full or Incremental).

• Path — The path to the backup on the storage location.

• Encrypted — If the backup is encrypted, this is True. At the end of the row is the Restore backup button.

Select the backup to restore from the Restore backups list. Click the Restore backup button of its row. Since this is a destructive action, the system forces you to confirm before the restore is started.

The Restore backup confirmation pop-up displays the Storage name, Configuration name, Backup timestamp, Backup path, Backup type, and Encryption status. Click the before the prompt Yes, I am sure I want to restore this backup.. Then click the Restore button.

From the Main navigation menu, click Admin. On the Admin page, select Notifications from left sidebar menu. The Email notification tab is the default on the Notifications page.

Click the icon to add a notification.

In the Appliance field, select the appliance or sensor that triggers the notifications.

Use the License pull-down menu to select from a license:

• All licenses — Automatically selects all sensors and disables the Sensor pull-down menu.

• All sensors — Use the Sensor pull-down menu to select a sensor from any license.

• Specific license — Use the Sensor pull-down menu to select All sensors for that license or any specific sensor.

In the Daily limit field, set the maximum number of notifications to send within a 24 hour period. 0 (zero) means unlimited.

Select the Timezone within which daily limits are computed. By default, the current system timezone is selected.

When the Enable/disable notification button is Enabled, notifications are enabled upon being saved. This is the default. Notifications can be enabled or disabled at any time.

The Template Overrides allow you to configure what the email subject will look like when the triggers send email.

The different overrides are broken down by the matching trigger type:

• Network

• Mail

• Appliance

• Audit

• Intel

• Intrusion

If you don't provide an override, the Default Template for the trigger type is used.

List the Recipients of the email notifications. This can be either an individual user or a list of users. A valid email address must be specified for each recipient.

This field is prepopulated with a drop-down menu of the email addresses of the known users. You can select one or more entries from the menu or directly enter an email address.

Select the appropriate triggers for the notification.

• When Appliance triggers are Enabled, notifications are sent when an appliance check-in occurs or a status message is received.

• When Audit triggers are Enabled, notifications are sent when an audit event occurs.

• When Network triggers are Enabled, notifications are sent when a drive-by attack was detected, fake Anti-virus software communication was detected, malware Command & Control traffic was detected, a malicious file was downloaded, suspicious activity was detected, a suspicious or malicious URL was accessed, unwanted software (such as adware) was detected, or a test event was triggered

• When Intrusion triggers are set to Enabled, notifications are sent when an intrusion event occurs.

• When Mail triggers are set to Enabled, notifications are sent when analysis detected a suspicious email, a malicious email attachment, or a malicious URL in an email message.

• When Intelligence triggers are Enabled, notifications are sent when an intelligence rule is matched against an analysis task.

  Note:

  The Intelligence triggers are available only when All licenses is selected.

• When Network IoC triggers are Enabled, notifications are sent when a domain name or an IP address was identified as a potential Indicator of Compromise.

For further information, see About notification triggers. Also see Sensor group notifications for some caveats about notifications and sensor groups.

Once the notification is properly configured, click the Save button to apply the changes. The Email notification configuration summary pop-up is displayed. When you close it, the Email notifications list is displayed in the Email notification tab.

From the Main navigation menu, click Admin. On the Admin page, select Notifications from left sidebar menu. Then on the Notifications page, click Generic HTTP notification.

Click the icon to add a notification.

In the Appliance field, select the appliance or sensor that triggers the notifications.

Use the License pull-down menu to select from a license:

• All licenses — Automatically selects all sensors and disables the Sensor pull-down menu.

• All sensors — Use the Sensor pull-down menu to select a sensor from any license.

• Specific license — Use the Sensor pull-down menu to select All sensors for that license or any specific sensor.

In the Daily limit field, set the maximum number of notifications to send within a 24 hour period. 0 (zero) means unlimited.

Select the Timezone within which daily limits are computed. By default, the current system timezone is selected.

When the Enable/disable notification button is Enabled, notifications are enabled upon being saved. This is the default. Notifications can be enabled or disabled at any time.

In the POST URL section, specify the URL that the notification will be posted to:

• Select the protocol, HTTPS:// or HTTP://, from the pull-down menu.

• Enter a fully qualified domain name or an IP address.

• By default, the Port is selected for HTTPS (443) or HTTP (80). Change this if the host is listening on another port.

• Provide the Path (which may be a path, query strings, or both) required for the POST request to succeed.

When HTTP Proxy is Enabled, the POST request uses the configured system proxy.

When Verify SSL Cert is Enabled, the SSL certificate must be valid in order for the POST request to succeed.

In the HTTP Source section, select the source from the pull-down menu. Select Manager or Sensor.

Selecting Manager allows you to centralize your notification source at the Manager.

Selecting Sensor allows you to distribute the notifications across your network to the specific Sensor that generated the alert.

In the Post Body Format section, select the format of the body of the POST request from the pull-down menu. Select JSON or XML.

When Include PCAP is Enabled, notification messages include a base-64-encoded dump of the packet capture associated with the event.

Select the appropriate triggers for the notification.

• When Appliance triggers are Enabled, notifications are sent when an appliance check-in occurs or a status message is received.

• When Audit triggers are Enabled, notifications are sent when an audit event occurs.

• When Network triggers are Enabled, notifications are sent when a drive-by attack was detected, fake Anti-virus software communication was detected, malware Command & Control traffic was detected, a malicious file was downloaded, suspicious activity was detected, a suspicious or malicious URL was accessed, unwanted software (such as adware) was detected, or a test event was triggered

• When Intrusion triggers are set to Enabled, notifications are sent when an intrusion event occurs.

• When Mail triggers are set to Enabled, notifications are sent when analysis detected a suspicious email, a malicious email attachment, or a malicious URL in an email message.

• When Intelligence triggers are Enabled, notifications are sent when an intelligence rule is matched against an analysis task.

  Note:

  The Intelligence triggers are available only when All licenses is selected.

• When Network IoC triggers are Enabled, notifications are sent when a domain name or an IP address was identified as a potential Indicator of Compromise.

For further information, see About notification triggers. Also see Sensor group notifications for some caveats about notifications and sensor groups.

For a Hosted installation, Audit and Intelligence events occur on the VMware backend. A proxy device is required to relay notifications when these triggers are Enabled. The Proxy sensor setting allows you to select a Sensor to relay the notifications:

• Select a License from the pull-down menu. Select All licenses or a specific license.

• Select a Sensor from the pull-down menu.

Once the notification is properly configured, click the Save button to apply the changes. The Generic HTTP notification configuration summary pop-up is displayed. When you close it, the Generic HTTP notifications list is displayed in the Generic HTTP notification tab.

From the Main navigation menu, click Admin. On the Admin page, select Notifications from left sidebar menu. Then on the Notifications page, click Streaming API.

Click the icon to add a notification.

In the Appliance field, select the appliance or sensor that triggers the notifications.

Use the License pull-down menu to select from a license:

• All licenses — Automatically selects all sensors and disables the Sensor pull-down menu.

• All sensors — Use the Sensor pull-down menu to select a sensor from any license.

• Specific license — Use the Sensor pull-down menu to select All sensors for that license or any specific sensor.

In the Daily limit field, set the maximum number of notifications to send within a 24 hour period. 0 (zero) means unlimited.

Select the Timezone within which daily limits are computed. By default, the current system timezone is selected.

When the Enable/disable notification button is Enabled, notifications are enabled upon being saved. This is the default. Notifications can be enabled or disabled at any time.

Enter a unique name for the stream in the Stream name textbox.

When Include PCAP is Enabled, notification messages include a base-64-encoded dump of the packet capture associated with the event.

Select the appropriate triggers for the notification.

• When Appliance triggers are Enabled, notifications are sent when an appliance check-in occurs or a status message is received.

• When Audit triggers are Enabled, notifications are sent when an audit event occurs.

• When Network triggers are Enabled, notifications are sent when a drive-by attack was detected, fake Anti-virus software communication was detected, malware Command & Control traffic was detected, a malicious file was downloaded, suspicious activity was detected, a suspicious or malicious URL was accessed, unwanted software (such as adware) was detected, or a test event was triggered

• When Intrusion triggers are set to Enabled, notifications are sent when an intrusion event occurs.

• When Mail triggers are set to Enabled, notifications are sent when analysis detected a suspicious email, a malicious email attachment, or a malicious URL in an email message.

• When Intelligence triggers are Enabled, notifications are sent when an intelligence rule is matched against an analysis task.

  Note:

  The Intelligence triggers are available only when All licenses is selected.

• When Network IoC triggers are Enabled, notifications are sent when a domain name or an IP address was identified as a potential Indicator of Compromise.

For further information, see About notification triggers. Also see Sensor group notifications for some caveats about notifications and sensor groups.

Once the notification is properly configured, click the Save button to apply the changes. The Streaming API notification configuration summary pop-up is displayed. When you close it, the Streaming API notifications list is displayed in the Streaming API tab.

From the Main navigation menu, click Admin. On the Admin page, select Notifications from left sidebar menu. Then on the Notifications page, click Syslog.

Click the icon to add a notification.

In the Appliance field, select the appliance or sensor that triggers the notifications.

Use the License pull-down menu to select from a license:

• All licenses — Automatically selects all sensors and disables the Sensor pull-down menu.

• All sensors — Use the Sensor pull-down menu to select a sensor from any license.

• Specific license — Use the Sensor pull-down menu to select All sensors for that license or any specific sensor.

In the Daily limit field, set the maximum number of notifications to send within a 24 hour period. 0 (zero) means unlimited.

Select the Timezone within which daily limits are computed. By default, the current system timezone is selected.

When the Enable/disable notification button is Enabled, notifications are enabled upon being saved. This is the default. Notifications can be enabled or disabled at any time.

In the SIEM Server, the Location is the hostname/IP address of the SIEM appliance that the SIEM messages will be sent to. If the SIEM source is a Sensor, this is the address for a SIEM appliance accessible by the Sensor. Otherwise it is an appliance accessible by the Manager.

The Port is the port on which the Manager/Sensor will send SIEM syslog messages for the associated appliance.

Provide a SIEM Hostname. The hostname that will show up in the prefix of the syslog message in the format timestamp {SIEM Hostname} siem_message. In the following example, the SIEM Hostname is example_ll_sensor:

20:47:12 CDTSep 04 02:13:16 example_ll_sensor CEF:0|Lastline|Defender|9.1|test-event|User triggered test event|1|cn1=10 cn1Label=impact cn2=44 cn2Label=notification_config_id devTime=Sep 03 2019 21:13:16 CDT devTimeFormat=MMM dd yyyy HH:mm:ss z externalId=4fac11b7611643e094ae910d155a0f8e

From the Transport protocol pull-down menu, select either TCP or UDP.

Use the SIEM source pull-down menu to select the source of the SIEM logs in your network. Select either Manager or Sensor.

• Selecting Manager allows you to centralize your log source at the Manager.

• Selecting Sensor allows you to distribute the log source across your network to the Sensor that generated the alert.

Use the SIEM log format pull-down menu to choose the format in which the SIEM logs are sent to the appliance. Select either CEF or LEEF.

When Include PCAP is Enabled, notification messages include a base-64-encoded dump of the packet capture associated with the event.

PCAP information can only be included when the log format is LEEF.

Select the appropriate triggers for the notification.

• When Appliance triggers are Enabled, notifications are sent when an appliance check-in occurs or a status message is received.

• When Audit triggers are Enabled, notifications are sent when an audit event occurs.

• When Network triggers are Enabled, notifications are sent when a drive-by attack was detected, fake Anti-virus software communication was detected, malware Command & Control traffic was detected, a malicious file was downloaded, suspicious activity was detected, a suspicious or malicious URL was accessed, unwanted software (such as adware) was detected, or a test event was triggered

• When Intrusion triggers are set to Enabled, notifications are sent when an intrusion event occurs.

• When Mail triggers are set to Enabled, notifications are sent when analysis detected a suspicious email, a malicious email attachment, or a malicious URL in an email message.

• When Intelligence triggers are Enabled, notifications are sent when an intelligence rule is matched against an analysis task.

  Note:

  The Intelligence triggers are available only when All licenses is selected.

• When Network IoC triggers are Enabled, notifications are sent when a domain name or an IP address was identified as a potential Indicator of Compromise.

For further information, see About notification triggers. Also see Sensor group notifications for some caveats about notifications and sensor groups.

Once the notification is properly configured, click the Save button to apply the changes. The Syslog notification configuration summary pop-up is displayed. When you close it, the Syslog notifications list is displayed in the Syslog tab.

From the Main navigation menu, click Admin. On the Admin page, select Notifications from left sidebar menu. Then on the Notifications page, click TippingPoint.

Click the icon to add a notification.

In the Appliance field, select the appliance or sensor that triggers the notifications.

Use the License pull-down menu to select from a license:

• All licenses — Automatically selects all sensors and disables the Sensor pull-down menu.

• All sensors — Use the Sensor pull-down menu to select a sensor from any license.

• Specific license — Use the Sensor pull-down menu to select All sensors for that license or any specific sensor.

In the Daily limit field, set the maximum number of notifications to send within a 24 hour period. 0 (zero) means unlimited.

Select the Timezone within which daily limits are computed. By default, the current system timezone is selected.

When the Enable/disable notification button is Enabled, notifications are enabled upon being saved. This is the default. Notifications can be enabled or disabled at any time.

Using the Seconds Valid field, define for how long a notification is valid after being sent. A lower impact notification will not be sent for a host so long as a higher impact one was sent for it no longer than so many seconds in the past. The goal is to avoid overwriting reputation information about a high impact threat with less critical information.

A value of 0 will disable this filter. VMware recommends values of a day or above.

In the SMS Server field, set the location and port of the TippingPoint SMS server.

• Location is the hostname/IP address of the server.

• Port is the port on which the server is listening.

Use the Protocol pull-down menu to select protocol used to connect to the to the TippingPoint SMS server. Select HTTP or HTTPS.

Using the SMS Username/Password fileds, set the credentials used to connect to the TippingPoint SMS server.

TippingPoint SMS only supports Network triggers. Notifications are sent when a drive-by attack was detected, fake Anti-virus software communication was detected, malware Command & Control traffic was detected, a malicious file was downloaded, suspicious activity was detected, a suspicious or malicious URL was accessed, unwanted software (such as adware) was detected, or a test event was triggered

For further information, see About notification triggers. Also see Sensor group notifications for some caveats about notifications and sensor groups.

Once the notification is properly configured, click the Save button to apply the changes. The TippingPoint notification configuration summary pop-up is displayed. When you close it, the TippingPoint notifications list is displayed in the TippingPoint tab.

From the Main navigation menu, click Admin. On the Admin page, select Notifications from left sidebar menu. Then on the Notifications page, click Reports.

Click the New button to add a new scheduled report. The Add Scheduled Report page is displayed.

In the Sensor field, select the License then select the Sensor from the pull-down menus.

In the Periodicity field, select the frequency of the report from the pull-down menus. Select Daily report, Weekly report, Monthly report, or Quarterly report.

In the Format field, select the format, HTML or PDF, from the pull-down menus.

In the Timezone field, select the timezone from the pull-down menu. By default, the current system timezone is selected.

In the Recipients field, enter a comma separated list of email addresses. If no recipient addresses are provided, the reports are sent to your default e-mail address.

By default the report is Enabled. Click the to disable the scheduled report.

Click Save when you are done. Then click Back to reports list.

From the Main navigation menu, click Admin. On the Admin page, select Data sources from left sidebar menu. The Active directory tab is the default view on the Data sources page.

Enter a valid Sensor UUID in the Appliance UUID textbox or click and select a compatible appliance from the pop-up.

Click the Add domain controller button to configure a Domain Controller. If you want to add another Domain Controller to an already existing configuration, click the icon.

On the Add domain controller page, fill in the following:

• Enter a Source Name. This is the name of the domain controller, another way of manually identifying a configured Domain Controller. It can be useful in the event of configuring multiple Domain Controller servers.

• In the Hostname field, enter the hostname or IP address of the domain controller.

• Set a Polling interval. The default is 60 seconds.

• Enter a Username in the format USERNAME. This is the account used to authenticate with the Domain Controller.

• Enter a Password. The password used to validate the username to the Domain Controller. Enter it a second time in the Confirm password field.

When you are done, click Add.

From the Main navigation menu, click Admin. On the Admin page, select Data sources from left sidebar menu. Then on the Data sources page, click DHCP collection.

Click the Appliance: button and select the appropriate Sensor from the Select Appliance pop-up.

Click the button to configure a collector in the DHCP collectors list. Fill in the following:

• Enter a Name. This name uniquely identifies the data generator. This field is required. A string of lowercase characters is expected.

• The Generator IP(s) field is optional. This is the IP address of the generator as seen by the collector (to enable firewall filtering). If set, the collector will only accept records from sources at the specified IP address(es). Any records from other IP addresses are discarded. If left unset, the collector will accept records sent from any IP address.

• Set the Port number. This is the port on the sensor where the DHCP log data will be received. This field is required. It accepts values from 1024 to 65535.

When you are done, click Save.

From the Main navigation menu, click Admin. On the Admin page, select Data sources from left sidebar menu. Then on the Data sources page, click Flow collection.

Click the Appliance button at the top right of the tab, then select the appropriate appliance from the Select appliances pop-up. Click the icon in the Name column to select a specific appliance. Then click Apply to dismiss the pop-up.

On the Flow collection tab, click over the Flow Collectors list to add an Amazon CloudWatch collector.

To delete a flow collector, click the icon in the Actions column.