SecurityExpressions Server User Guide
Table Of Contents Contacting Us ...................................................................................................................... 1 Technical Support ................................................................................................................ 3 Contacting Technical Support............................................................................................. 3 Other Products........................................................................................
SecurityExpressions Server User Guide Policy File Library............................................................................................................ 18 Library Synchronization ................................................................................................ 18 About Policy Files............................................................................................................ 19 How System Scores are Calculated ........................................................
Table Of Contents Device Type Scopes..................................................................................................... 39 IP Range Scopes ......................................................................................................... 39 Machine List Scopes..................................................................................................... 39 Windows Domain Scopes .............................................................................................
SecurityExpressions Server User Guide Adding Policies ............................................................................................................ 57 Editing Policies ............................................................................................................ 58 Deleting Policies .......................................................................................................... 59 Configuring with Run-Time Policy Variables...............................................
Table Of Contents Adding a New Audit Results Report Profile ..................................................................... 81 Editing Audit Report Results Profiles.............................................................................. 83 Deleting Audit Report Results Profiles............................................................................ 83 Scheduled Audits Log Report ...........................................................................................
Contacting Us Symantec Corporation 20330 Stevens Creek Blvd. Cupertino, CA 95014 USA http://www.symantec.
Technical Support Symantec Technical Support maintains support centers globally. Technical Support’s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion.
Other Products SecurityExpressions Console This product enables you to quickly and effectively lock down Windows systems using guidelines similar to ones established by Microsoft, NSA, SANS, and others. Use it to verify the security settings on local and remote systems across your enterprise. See how well your systems are protected by comparing their current configuration against the Microsoft Security White Paper.
Overview About SecurityExpressions Audit & Compliance Server SecurityExpressions Audit & Compliance Server is a Web-based application that runs on a server with Microsoft IIS and an ASP.NET infrastructure installed. From a Web browser on any computer, you can securely perform most audit and compliance functions, such as audit scheduling, reporting, and browsing audit results. The server automatically updates timesensitive audit policies such as patch, antivirus, and vulnerabilities.
Self-Service Audit What is Self-Service Auditing? Self-service auditing lets anyone audit just their local Windows computer. Typically, a person performing self-service audits is not a SecurityExpressions user, but must have administrator privileges on the computer they're auditing. A designated Web page gives self-service auditors access to self-service features only. A self-service audit runs a local system audit against a policy and then allows you to view the resulting system assessment.
SecurityExpressions Server User Guide check your system against several policy files during one audit. If the administrator of this product created an Audit-on-Connect scope that contains your system, you may use this method to start an audit on your system. Audit results are automatically recorded for review and reporting. If the administrator of this product did not create an Audit-on-Connect scope that contains your system, you can only select Self-audit using a specific policy file. 3.
Configure Servers About Server Configuration Before you can audit systems using the server application, you must configure server settings. From fundamental settings such as database connection and policy-file-library synchronization to specific settings that drive scheduled and Audit-on-Connect, the Settings tab provides a central location for configuring the server. To access the Settings tab, click Configure Servers on the application's home page.
SecurityExpressions Server User Guide Viewing Audit Results SecurityExpressions generates audit results through the following kinds of audits. To view results from each kind of audit, a user needs rights to view results from key configurable items (machine lists, policies, and scopes) involved in the audit.
Configure Servers We recommend you don’t use SQL Server's master database as the SecurityExpressions database. To establish a valid database connection: 1. In the Database Type drop-down list, select the manufacturer of the database software you use. 2. In the Database Server Name box, type the name of the computer containing the database software you use. If you’re not connecting to the default instance of the database, enter the server name in computername\databaseinstance format. 3.
SecurityExpressions Server User Guide If the system on which you installed the server software is not running Windows 2000 Server, skip this procedure. 1. On the Windows 2000 server, open Control Panel and double-click Administrative Tools and then Internet Information Services to open the IIS Administrative Panel. 2. In the Web Site folder, right-click Default Web Site and choose Properties. 3. On the Directory Security tab, in the Secure communications section, click Server Certificate. 4.
Configure Servers Once you create a credential store, you can't modify it. To create a credential store: 1. In the Application Setup page, click Add New. 2. In the New Credential Store User Name box, type a user name for logging in to this credential store. 3. Optional: In the New Credential Store User Full Name box, type a descriptive name. 4. Optional: In the New Credential Store User Description box, type any information about this credential store other users might find helpful. 5.
SecurityExpressions Server User Guide Session Duration Session duration is a time-out period that sets the maximum number of minutes for a Web session. The session lasts until this time passes or a different Browser accesses the server. When the session expires, local session information, including authentication, is lost. Many settings, once initialized, remain through the session duration. Once you open a new Browser, the session duration resets to the configured time period.
Configure Servers Item Rights The Item Rights options, found on the Page Access page, let you list which Windows User Groups are allowed to do the following: Edit Private Items Allow others to modify items that are normally exclusive to the user who created them, such as My Machine Lists and scheduled tasks. Miscellaneous Target Usually, the View Audit Results setting for scopes and machine lists controls access to most audit results, since most audits involve a scope or machine list.
SecurityExpressions Server User Guide When you schedule an audit, you can specify which computers to audit by selecting machine lists created on the My Machine Lists page and machine lists created in the console application (global machine lists). You can grant or restrict access to My Machine Lists and the results from audits using them with the Windows Group Access options on the My Machine Lists page.
Configure Servers To check for frequent policy file updates, you may choose to Check for policy file updates during a specific time period (days, minutes, hours). If updates exist, they will be downloaded for the SecurityExpressions Audit & Compliance Server to use. Check Now updates the policy files immediately. 3. Click Update to store the policy file library configuration. The settings are stored but can be modified.
SecurityExpressions Server User Guide (weighted total of OK results ÷ (weighted total of OK rules + weighted total of Not OK rules)) × 100 Example An audit contains four rules: • 1 High Priority • 1 Medium Priority • 1 Low Priority • 1 no priority or impact, and no Weight key exists The weight values are: • High:1.5 • Medium:1.0 • Low:0.5 The rule with no priority or impact set assumes a weight of 1.0, which happens to also be the default Medium priority weight in this example.
Configure Servers 3. Agent - Uses the audit agent to remotely execute scripts and programs. Before auditing, make sure to install the agent on the remote computer or check the Automatically install Agent if required in order to execute scripts and programs remotely box. Automatically install Agent if required to execute scripts and programs remotely Check this box to automatically install the agent on the remote system when the agent is necessary to complete an audit.
SecurityExpressions Server User Guide Database Cleanup The database stores data about audits, as well as console and server events. You might decide that it is unnecessary to use database space to retain this data permanently. The Database Cleanup settings allow you to automatically delete data from the database on a schedule. You can also use the Clean Now button to perform an unscheduled cleanup.
Configure Servers target for every week, month, year, or overall. If you select Yearly, for example, the database will retain the last audit performed on every policy file and on every target audited for every year you've audited using this database. Because cleanups occur nightly, the last audit saved during the current year could potentially change nightly until the year ends.
SecurityExpressions Server User Guide Clean Now Click this button to perform an unscheduled cleanup on audit data. Then click Delete to confirm the action or Cancel to cancel it. Self-Service Audit Agreement An organization may require the acceptance of corporate agreement text before allowing an audit. Your organization can customize an agreement and include it in the Self-Service Audit settings.
Configure Servers Select this check box to enable SecurityExpressions' Web-services layer. To learn more about the Web-services layer, see SecurityExpressions Web Services API guide, included in your installation package. Allow Remediation Select this check box to allow Web-services remediation functions to apply fixes to computers audited through Web services. Session Duration Session duration is a time-out period that sets the maximum number of minutes for a Web session.
Audit-On-Connect What is Audit-on-Connect? Audit-on-Connect is an optional feature of SecurityExpressions Audit & Compliance Server that is sold separately. It enables you to audit systems as they connect to the network rather than on a fixed schedule. This allows you to audit systems that might not be regularly or predictably connected to the network such as field-user laptops. This also allows for systems that are missed in a scheduled audit to be automatically picked up the next time they connect.
SecurityExpressions Server User Guide Description Policy File Last Updated Configure Windows Group Use Access Windows Group Remediation Access Windows Group Results Access Use on Link Type (Audit-On-Connect only) Device Types (Audit-On-Connect only) Posture Condition (Fail If) (Audit-On-Connect only) Cache Pass For (Audit-On-Connect Only) 28 scope or scheduled task. Optional statement about the policy. Name of the policy file (.sif), from the policy file library or a customized policy file.
Audit-On-Connect Cache Fail For (Audit-On-Connect Only) to control how often a system gets audited — as long as a posture result remains valid, the software won't attempt to audit a system if it connects to the network again. Instead, it returns a posture result of Pass. Specify how long posture results remain valid when the system fails an audit based on this policy.
SecurityExpressions Server User Guide policy. This establishes which users can access this policy and its audit results due to their role. If a Windows User Group isn't on the local computer, you'll need to enter the group in domain\groupname format. • In the Use Policy field, enter the Windows groups who should be able to modify the policy. • In the Remediate field, enter the Windows groups who should be able to remediate audit results generated using this policy.
Audit-On-Connect 6. Check the Policy is kept up to date with Policy File Library box if you want to regularly update the SIF files in this policy using the policy file library available on line. This option is available only if the server can access a Policy File Library. 7. If you want the policy to be available to use in audits, check the Make this policy active box. Clear the check box to make the policy unavailable to use in audits without deleting the policy. 8.
SecurityExpressions Server User Guide 1. The name for the new rule must be .CONFIGURE. 2. The check type can be blank, or you can type CONFIGURE. 3. In the Parameters tab, the Config parameter is set to .CONFIGURE (Config=.CONFIGURE). When you set the Config key, the WizParams tab appears. On this tab you can type text using the WizParams syntax that controls the available text, input options, and parameters to modify in the Wizard. 4.
Audit-On-Connect and modify the .CONFIGURE rule. When you create a new Policy and select an associated policy file, the server application determines if a .CONFIGURE rule exists and displays prompts for modifications. This rule may require synchronization between the database and the policy file. To synchronize the database and the new file, save the policy file in the database with a new name with new parameters for the .CONFIGURE rule, if previously saved in the database.
SecurityExpressions Server User Guide All scope types except Expression can accept as many values as you want to enter, listing one value per line. Scope type Expression only accepts one expression. 6. Fast. Indicate if the network link speed of the systems in this scope are Unspecified, Slow or If all systems in the scope use a fast connection, for example, indicating this in the scope's definition prevents the need to check each system's speed during audits.
Audit-On-Connect Device Connect Notifications - Sends selected notifications when a device is detected in this Scope, regardless of audit posture. This value may be blank. Pass Notifications - Sends selected notifications if the audit's group posture result is Pass. Fail Notifications - Sends selected notifications if the audit's group posture result is Fail. Error Notifications - Sends selected notifications if the audit's group posture result is Error.
SecurityExpressions Server User Guide • notifications • Windows Group access Credential Precedence: If your organization uses the console application and someone delegated one or more database machine lists to the server application, and if one of the systems identified in this scope is also listed in one of those database machine lists, the server uses the database machine list's credentials to access the system rather than the scope credentials you enter here. 3.
Audit-On-Connect Pass Notifications Fail Notifications Error Notifications Connection Error Notifications SE Console Notifications Windows Group Results Access blank. Notifications to run when the Group Posture of an audit in this scope is PASS. This value may be blank. Notifications to run when the Group Posture of an audit in this Scope is FAIL. This value may be blank. Notifications to run when the Group Posture of an audit in this Scope is ERROR. This value may be blank.
SecurityExpressions Server User Guide Supported Functions Function Argument iprange a valid IP range domain a windows domain in Netbios or DNS format machinelist devicetype a database machine list created using the console application a valid device type fqdnmatch a shell expression ou the name of an OU in Microsoft shorthand, and optionally an LDAP URL specifying what directory and credentials should be queried a method for detecting systems on the network detectionmethod aocserver a shell e
Audit-On-Connect Audits can detect systems on the network using the following methods: DHCP, EVENTLOG, NAC, self-service (for self-service audits). A system matches this scope if the connection monitor used to connect to it matches the value entered. Device Type Scopes Lets you indicate a kind of system to audit. Choices are Windows, UNIX, or Unknown. A system matches this scope if it's the kind of system selected. Selecting Unknown includes all systems.
SecurityExpressions Server User Guide Creating New Command Notifications To create a new command notification: 1. Click Add New. 2. Provide a Notification Name, a customized name of the notification to appear in the table. 3. Select Command as the Type. 4. Type the Command to run, which may be a URL. Include the command Arguments. You can pass variables to the command. If the command is a program, programs expect dependent files to be in the \system32\ folder. 5. Click Add New.
Audit-On-Connect To edit a Notification, click the Edit hyperlink on the Notifications table to select the row to edit. Make the necessary modifications and click Update. To Edit an email notification, make the necessary modifications to: • Notification Name • To – person receiving the notification. This address appears as the Value in the table. • Subject – Notification topic • Message – Text of the email notification, including variables.
SecurityExpressions Server User Guide To create a new command notification: 1. Click Add New in the Notifications page. 2. Provide a Notification Name, a customized name of the notification to appear in the table. 3. Select Command as the Type. 4. Type the Command to run, which may be a URL. Include the command Arguments. You can pass variables to the command. If the command is a program, programs expect dependent files to be in the \system32\ folder. 5. Click Add New.
Audit-On-Connect A Subject or Message may contain text such as "Latest SecurityExpressions audit located at %RESULTLINK%." Exceptions Exceptions Exceptions prevent certain systems from ever getting audited, even if they fall within a scope. When a system connects to the network, the server software checks all scopes to see if the system falls within one. If it does, the server software then checks all exceptions to see if the system is listed in an exception. If it is, the system does not get audited.
SecurityExpressions Server User Guide To edit Exceptions: 1. Click the Edit hyperlink on the Exceptions table to select the row to edit. 2. Modify the Exception parameters (Type, Value, Expiration Date, Group Posture Result) 3. Click Update. Deleting Exceptions To delete an Exception: 1. Click the Edit hyperlink on the Exceptions table to select the row to remove. 2. When you delete an Exception, you remove it from the database.
Audit-On-Connect Specify and confirm a password. SecurityExpressions Audit & Compliance Server generates an encrypted password that you must add the to the configuration files for each of the Connection Monitors. Include the encrypted password in the [Options] section of the configuration file with the Password option.
SecurityExpressions Server User Guide Password = AES: cb789817f8d99c7e5a1e5beb8510bf71 Once you enable the connection monitor, it can be processed at any time. Connection Monitor Configuration File Connection Monitors use a text file named dmconfig.txt that resides in the same directory as the Connection Monitor (\Program Files\Altiris\Security Management\SecurityExpressions Connection Monitors). The file contains four sections. You must complete the IP Range and Options sections.
Audit-On-Connect Comma-Separated List of Servers Includes the names of the audit servers. A comma separates each server name. Options The Options section of the configuration file contains any settings needed to control the Connection Monitors, such as enabling logging and identifying the location and name of the log file. Port The port you want a connection monitor to use to communicate with the server software. This entry must match the server's configuration, which is 9009.
SecurityExpressions Server User Guide Active Directory (Active Directory Connection Monitor only) Set the Active Directory (event log) monitoring options. IncludeAllDomainControllers Retrieves names of all Domain Controllers on the Domain system where the monitor resides and monitors the event logs of all Domain Controllers. One (1) is the default setting. If IncludeAllDomainControllers=0 you must add the Include key and identify the device to monitor.
Audit-On-Connect DistributionMethod=Round Robin Comment=Home office ip addresses [IP_RANGE_2] IPRange=10.0.2.0:254 AuditServers=server3,server1,server2 DistributionMethod=First Available Comment=California office ip's [Default] IPRange=Default AuditServers=server1,server2 DistributionMethod=Round Robin Comment=Catch anything not explicitly specified [Options] Port = 9009 Password = AES: cb789817f8d99c7e5a1e5beb8510bf71 LogEnable=True LogFile=c:\temp\dhcpdetect.
SecurityExpressions Server User Guide Enabling slow link detection might extend processing time. Trace Route Information Trace route is a TCP/IP utility that allows the user to determine the route that packets are taking to a particular host. Your notifications can include a trace route if you select this optional setting, Make trace route information available to notifications. Determining trace route information may be slow.
Audit-On-Connect A managed system is a system on the network that the server software can connect to and audit using the appropriate credentials. It is a target system or potential target system. Initial Token Sends the posture token you select to ACS if a system receives a posture result of Fail. Both Managed and Unmanaged Network Access Device (NAD) Polling Select how often ACS should poll the server software for the latest status of target systems.
SecurityExpressions Server User Guide A read-only line that reminds you to configure ACS so that NAD redirects users who try to connect to the network from quarantined systems to the URL listed. Redirection Web Page Behavior Select the information and resources the redirection Web page should provide to users on quarantined systems if URL redirection is configured in ACS. The options are: • Display a message that the user must contact an administrator for access and leave in quarantine.
Audit-On-Connect To trace Audit on Connect activity: 1. Determine when the suspect activity will start and how long it will take to finish. 2. When the suspect activity is about to begin, type the hours and minutes you expect the activity to take in the Run AOC Trace for fields and click Start Trace. If you type 0 hours and 0 minutes, the trace will not occur. 3. Click Refresh any time you want to check on the activity that's occurred so far. This displays the latest trace data on the page.
Audit-On-Schedule What is Audit-on-Schedule? Audit-on-Schedule is an auditing method that audits a group of systems at scheduled intervals. You create a scheduled task that audits all systems in a machine list based on a policy. When the audit is finished, the task can send notifications indicating the audit is done and where to view audit results.
SecurityExpressions Server User Guide Description Policy File Last Updated Configure Windows Group Use Access Windows Group Remediation Access Windows Group Results Access Use on Link Type (Audit-On-Connect only) Device Types (Audit-On-Connect only) Posture Condition (Fail If) (Audit-On-Connect only) Cache Pass For (Audit-On-Connect Only) 56 Optional statement about the policy. Name of the policy file (.sif), from the policy file library or a customized policy file.
Audit-On-Schedule Cache Fail For (Audit-On-Connect Only) posture result remains valid, the software won't attempt to audit a system if it connects to the network again. Instead, it returns a posture result of Pass. Specify how long posture results remain valid when the system fails an audit based on this policy. This is a way to control how often a system gets audited — as long as a posture result remains valid, the software won't attempt to audit a system if it connects to the network again.
SecurityExpressions Server User Guide a Windows User Group isn't on the local computer, you'll need to enter the group in domain\groupname format. • In the Use Policy field, enter the Windows groups who should be able to modify the policy. • In the Remediate field, enter the Windows groups who should be able to remediate audit results generated using this policy. • In the View Audit Results field, enter the Windows groups who should be able to view results from audits using the policy.
Audit-On-Schedule This option is available only if the server can access a Policy File Library. 7. If you want the policy to be available to use in audits, check the Make this policy active box. Clear the check box to make the policy unavailable to use in audits without deleting the policy. 8. If you want to policy to be available to use in self-service audits, check the Available for use in self-service audits box. 9.
SecurityExpressions Server User Guide 3. In the Parameters tab, the Config parameter is set to .CONFIGURE (Config=.CONFIGURE). When you set the Config key, the WizParams tab appears. On this tab you can type text using the WizParams syntax that controls the available text, input options, and parameters to modify in the Wizard. 4. View the WizParams tab to see the syntax that defines the Wizard's display for the rule.
Audit-On-Schedule modifications. This rule may require synchronization between the database and the policy file. To synchronize the database and the new file, save the policy file in the database with a new name with new parameters for the .CONFIGURE rule, if previously saved in the database. Notifications Notifications You can opt to receive email or program-output notifications when audits occur.
SecurityExpressions Server User Guide The group posture result is %GROUPPOSTURERESULT%. Click here for the report: %RESULTLINK% 5. Select Attach trace route information for Audit-on-Connect for the message body to include the trace route. The message body always includes a link to the report for the audit that caused this notification. 6. Recommended: Click Send Test to make sure the notification will send as configured. 7. Click Add New.
Audit-On-Schedule folder. 5. Click Add New. Creating New Email Notifications To create a new email notification: 1. Click Add New. 2. Provide a Notification Name, a customized name of the notification to appear in the table. 3. Select Email as the Type. 4. Complete the following email information: To – person receiving the notification. This address appears as the Value in the table. Or Select allows you to select a previously entered email address. Subject – Notification topic.
SecurityExpressions Server User Guide The following three variables will only return a value if statistics are available: %COUNTPROBLEMS% - number of errors encountered during the audit %COUNTRULES% - number of rules used to audit the machine list %SCORE% - the overall score resulting from the audit The following four variables will only return a value if the task only audited one system: %IP% - IP address or name of the system being audited, depending which represents the system in the machine list %COMPUT
Audit-On-Schedule Windows Group Use Access Windows Group Results Access Windows User Groups who can use this machine list. Windows User Groups who can view results from audits using this machine list. Adding Machine Lists To create a machine list: 1. Click the Audit-On-Schedule tab and then the My Machine Lists link. 2. Click the Add button to create a machine list. The Add/Update settings appear below the table. 3. In the List Name box, type a name for the machine list. 4.
SecurityExpressions Server User Guide Make sure you type the system names or IP addresses correctly. If you did not type a system's name or address correctly or somehow entered an invalid system, the audit skips the system and moves on to the next system in the list. 5. Set Windows Group Access. Enter Windows groups, separated by a comma, that can use this machine list and view audit results for it. This establishes which users can access this machine list and its audit results because of their role.
Audit-On-Schedule The Scheduled Tasks table contains the following information: Column Run Now/Stop/Initializing Edit Delete Description Machine Lists Policies Run On Last Ran Current Schedule Notifications Windows Group Edit Access Windows Group Run Access Hosts Done Successful Connection Error Not Found Description Click this button to start or stop the task in this row. This column also displays "Initializing" when a task is in the middle of a process. Click this link to edit the task in this row.
SecurityExpressions Server User Guide Policies page. Only the policies to which you have Use access rights appear for selection. Access rights for individual policies are set in the Windows Group Access options on the Policies page. If you can't find a policy you need to use, ask the policy's creator to add you to one of the Windows User Groups with Use access rights to the policy. 5. Select which machine list(s) you want to audit every time this task runs.
Audit-On-Schedule Run Once – The scheduled task executes once on this day and does not repeat. In the calendar, choose the date on which you want to run the task. Run Weekly – The task executes once every week on the day(s) you select. Check the days of the week on which you want to run the task. Run Monthly – The task executes only during the months you select on the date you select. 8.
SecurityExpressions Server User Guide restart would take. B. If you want to set a time limit on how long the task can attempt reaudits, type the number of hours you want to allot for reaudits in the Attempt re-audit for this many hours after initial audit box. A reaudit cycle could go on indefinitely if a system is off or never connects. Setting a time limit keeps the reaudit cycle from continuing indefinitely. C.
Audit-On-Schedule 15. If you want to use specific credentials to access all systems whenever this audit task runs, type those credentials in the Login box. If you do not want to specify credentials, skip to step 18. 16. step. In the Password box, type the password of the credentials you specified in the previous 17.
SecurityExpressions Server User Guide Only the machine lists to which you have Use access rights appear for selection. Access rights are set in the Windows Group Access options on the My Machine Lists page and the ML Access page (global machine lists). If you can't find a machine you need to use, ask the machine list's creator or administrator to add you to one of the Windows User Groups with Use access rights to the machine list.
Audit-On-Schedule If you selected Not Scheduled in the previous step, these options don't appear. Notifications 9. If you want to send notifications when this scheduled task executes, select one or more notifications from the Notifications list or the Console Notifications list. The Notifications list contains the notifications created using the Notifications page in this application.
SecurityExpressions Server User Guide A reaudit cycle could go on indefinitely if a system is off or never connects. Limiting the number of times the task can attempt to reaudit systems keeps the reaudit cycle from continuing indefinitely. Both steps B and C provide end points to the reaudit cycle. You may use one method or the other, or both. If you use both methods together, whichever limit is reached first ends the audit cycle.
Audit-On-Schedule In the Edit Task field, enter the Windows groups who should be able to modify the task. In the Run Task field, enter the Windows groups who should be able to use the task to perform audits. To grant all users access, type Everyone. To restrict all users, type None. 19. Click the Update button to create this scheduled task. The updated task appears in the table at the top of the Scheduled Tasks page.
View Audit-On-Connect Activity Browse Audit-On-Connect Activity Audit-On-Connect activity reports show Audit-On-Connect connection events as they were logged over time. Use these reports to troubleshoot and optimize Audit-on-Connect configurations. SecurityExpressions Audit & Compliance Server dynamically generates reports based on preconfigured or user-defined report profiles.
SecurityExpressions Server User Guide 2. Select one or more Detection Methods. The detection method identifies the Connection Monitor types. 3. Define filters that cause only certain events that meet your criteria to display in the report. Click the links and set the criteria. You may set as many kinds of filters as you like. The report's contents are based on a combination of all filters you set.
View Audit-On-Connect Activity 2. When you delete a report profile, you remove it from the database. A warning appears to remind you that you are about to this particular report profile from the database. Cancel the action or delete the record. Audit-On-Connect Error Log Report The Audit-On-Connect Error Log Report displays the errors for each server at a specific time as they were written to the Windows error log.
View Audit Results Browse Audit Results This page shows audit results in the form of reports. It features results from almost all kinds of auditing methods, including: • Audit-on-Schedule • Audit-on-Connect • self-service audits based on multiple policy files and Audit-on-Connect scopes • audits performed on any consoles connected to the same database as the server application SecurityExpressions Audit & Compliance Server dynamically generates reports based on preconfigured report profiles.
SecurityExpressions Server User Guide • Data Grid - Generates a highly interactive HTML report with lots of opportunities to drill down. Click the links and set the criteria. You may set as many kinds of filters as you like. The report's contents are based on a combination of all filters you set.
View Audit Results • Open or closed range beginning on a specific day - Includes in the report a range of connection activity starting on a specific date. You may specify an end for the date range or let the report display all activity available after the starting date. • Relative range from the current date - Includes in the report a range of connection activity prior to the day the report ran. Enter how many days, hours and minutes worth of prior data you want to display in the report. 8. data.
Glossary # .CONFIGURE: Some policy files, such as the NSA Guidelines for Windows XP and Windows 2000, contains special rule named .CONFIGURE. The .CONFIGURE rule allows you to configure your policy files and set global parameters for policy files at run time. A Active Directory Connection Monitor: Connection monitor for Active Directory domains that detects computers coming on the network Audit Service: Back-end Windows service that performs audits.
SecurityExpressions Server User Guide P policy: A Security Policy is a set of objectives, rules of behaviour for users and administrators, and requirements for system configuration and management that collectively are designed to ensure Security of computer systems in an organization. Priority: Importance of applying the rule. Priority may be a key in a rule. proxy: A Windows computer running the Agent. S scheduled audit: Audit performed by the Scheduler service.
Index . creating policies................................29, 57 .CONFIGURE...............................31, 59, 66 Credential Store................................14, 15 .sif .................................................. 27, 55 Crystal Reports.................................81, 83 A D access and user roles ..................11, 16, 17 database...................................... 7, 12, 81 Active ................................................... 36 database cleanup .....................
SecurityExpressions Server User Guide H notifications .......................................... 42 https..................................................... 13 notifications .......................................... 42 I notifications .......................................... 61 IIS ........................................................ 13 notifications .......................................... 63 IP address ............................ 33, 44, 45, 48 notifications ..........................
Index rule weights........................................... 19 slow link ............................................... 49 run-time policy variable .................... 31, 59 SSH Agent Authentication....................... 20 S SSL ...................................................... 13 scheduled audits .........................55, 66, 81 synchronization ..................................... 18 scheduled audits log............................... 83 T Scheduled tasks time-out period ........
