LevelBlue Knowledge Base » Knowledgebase » Legacy Products » SIEM

Changing a SIEM LME/SE Hostname

Andrew Davies — Wed, 12 Apr 2017 13:02:11 GMT

This article applies to:

SIEM LME/SE 2.3.x

Question:

How can I update SIEM when the hostname must be changed?

Procedure:

This article addresses procedures needed to update the host name information and SSL certificate for hostname changes to single-tier and multi-tier SEIM LME/SE installations.

Collect certificate information, such as whether the certificate used is a third party or self-signed certificate, and the certificate details: Country Code, State or Province, Locality, Organization, Organizational Unit, Common Name, and Email Address.
Log in to the SIEM UI as Administrator.
Navigate to Configuration > Nodes. Select DA tier and navigate to Network > Domain/Hosts.
- For a single-tier installation, select the single-tier and navigate to Network > Domain/Hosts.
Edit the DNS Domain Name field for this tier as desired.
Save the configuration and restart Network Service. For a single-tier, skip Step 6.
Repeat Steps 2 and 3 for each tier, saving the SDW tier as last.
Log out of the SIEM UI.
Log in to the SDW Command line interface (CLI) as root. Change directory:
cd /opt/nsm/certificate/bin
Run ./certgen.sh postinstall
Create a certificate using the information collected in Step 1.
- Note that if the installed certificate was a third-party signed certificate, you will need to request a new certificate from the signing Certificate Authority.

Notes:

See the appropriate Administration Guide for further details on certificate generation.

Why are my alerts not getting aggregated?

Thaddeus Corrigan — Thu, 06 Apr 2017 17:27:36 GMT

This article applies to:

SIEM OE 5.7
SIEM OE 5.9
SIEM OE 5.9.1

Question:

Why are my alerts not getting aggregated?

Information:

In any of the alert views on the SOC (Security Operations Center) server, SIEM will aggregate the alerts and increase the event count to keep the alert views from being too busy or verbose to look at.

On the TE (Threat Evaluator) server, SIEM tracks alerts "in state" (within the running application), and will increment the count for any alerts currently being held in state. To determine whether an alert should be aggregated, SIEM uses a compound key that is made up of the following two fields:

[composite_key] = [alert_registration_id]-[alert_id_key]

The alert_id_key is also a composite key created in an earlier rule (te:/system/te/output/validate/) :

[alert_id_key] = [generator_column]-[source_column]-[target_column]-[user_id]-[malware_id]-[event_id]

An alert will aggregate if all of the following keys are the same as an alert being held in state:

[alert_registration_id]
[generator_column] (g_hostname)
[source_column] (source_hostname)
[target_column] (target_hostname)
[user_id]
[malware_id]
[event_id]

Occasionally a correlation will produce alerts that are too unique and will not aggregate on the SOC, making your alert views too busy.

To resolve this issue, you can construct a custom rule in te:/local/te/output/ . Filter for alerts from a certain correlation or escalation (alert_registration_id) and reconstruct the alert_id_key before it is sent to the SOC tier. For each correlation that requires an adjustment to summarization you can create a separate custom rule.

For assistance in creating custom rules, contact Trustwave TAC.

Changing the Server IP Addresses on SIEM Enterprise (SE)

Andrew Davies — Thu, 15 Dec 2016 15:34:00 GMT

This article applies to:

SIEM SE 2.x
SIEM LME 2.x

Question:

How do I correctly change the IP address of the SIEM SE/LME after installation?

Procedure:

If an IP address within the SE configuration changes (for example, if the network IP address changes), you can run this procedure to make sure that the new IP address is registered with all tiers in the configuration. If required, you can change the IP addresses of all servers.

Log in to the SIEM UI
Navigate to Configuration > Nodes > Node Type [Select SDW] (Network | Interfaces sub-tab).
Select the interface whose IP address you want to change, and then click Save.

(click image to enlarge)
The Save Network Settings dialog box displays.
Select an Individual interfaces restart option, and then select the interface related to the IP address you just changed and click Save. Alternatively you can restart the Network Service by clicking Network Service and clicking Save).
- Warning: If you need routes to access SIEM and if they are not persistent routes, then restarting Network Service might make SIEM inaccessible via SSH and UI
Click Save.
- Note: If you changed the SDW eth1 active IP address, and see a network settings error, close the browser and run the script (in step 7) on the command line of the machine with the new active IP address.
Only run the following command when the server IP address of eth1 has changed (the active IP):
/opt/nsm/util/bin/change_local_ip.sh<newip> <interface>.

<newip> is the new IP address to set
<interface> is the interface with the new IP address (for example, eth1)

If this command is run on the SDW (assuming this is the active IP), it is propagated to all other tiers.
For non-SDW servers, run this script on the server where the IP address was changed in step 1,2 and 3
Log on to the web interface and ensure the IP addresses in the Node configuration are up to date (if the SDW active IP address was changed, log on to the web interface using the new active IP in the URL).

Notes:

This information is taken from the Trustwave_SIEM_Enterprise_2.4_Administration_Guide - Page 179

Trustwave SIEM Version Support Policy

Andrew Davies — Wed, 14 Dec 2016 17:26:37 GMT

Introduction

Trustwave is a global expert in real-time threat protection and the industry’s leading Security Incident and Event Management (SIEM) provider. As an industry leader, Trustwave strives to deliver to its customers the most innovative solutions available. The company also invests in updating its products to adjust to evolving market needs by releasing on-going versions.

This document describes the company support policy for its SIEM versions and appliances, and the phasing-out process for each version or appliance. This policy is aligned with Trustwave’s commitment to communicate to its customers relevant and timely information on the product’s lifecycle.

General

The support guidelines outlined in this document will apply only to products that were covered by a support contract for SIEM appliances as at the End-of-Sale date. Such support contracts can be renewed until the End-of-Life date.
The support guidelines outlined in this document apply only to End-of-Life or End-of-Sale announcements made on or after Q4 2015.
All policies applied to support contracts will be considered on a case-by-case basis.

Policy Guidelines

Trustwave will announce the EOS date of a product at least 3 months prior to the EOS date.
A Hardware warranty will be available for a period of 3 years following the End-of-Sale date, depending on a valid support contract for the specific Hardware version.
For any customer’s support specific issues refer to the Trustwave Support Policy.

For SIEM Software releases:

Trustwave will provide technical support and bug fixes to a Software major or minor releases for a period of at least 24 months starting from the general availability date of the underlying version.
Trustwave will announce the EOM date for a Software release at least 3 months prior to the date.
The EOL date will occur 6 months following the effective EOM date. Security patches will be provided until the EOL date.
Trustwave will designate a specific (minor or major) version as an Extended Support Version. Trustwave will provide bug fixes for the Extended Support Version for at least 36 months from the release date of the applicable upgrade version.
Trustwave will provide bug fixes and service packs for the most recent Maintenance Release (x.y.z). Therefore, Trustwave customers are advised to upgrade to the latest Maintenance Release of a specific Minor Release.

Glossary

SIEM Software Release Versioning:

Major Release (x): Includes major architectural and functional changes.
Minor Release (x.y):Includes new enhancements to product functionalities.
Maintenance Release (x.y.z): Includes bug fixes and minor product enhancements.

End-of-Life (EOL):
The last day that Trustwave will support a specified hardware model or software version.
End-of-Sale (EOS):
The last day the specified Product will be available for sale.
End-of-Maintenance (EOM):
The last day Trustwave will provide bug fixes for a specified Software release.
Extended Support Version:
A designated Software release for which Trustwave will provide bug fixes for an extended period of time.

Legal Notice

All rights reserved. This document is protected by copyright and any distribution, reproduction, copying, or decompilation is strictly prohibited without the prior written consent of Trustwave. No part of this document may be reproduced in any form or by any means without the prior written authorization of Trustwave. While every precaution has been taken in the preparation of this document, Trustwave assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.
The most current version of this document may be obtained by contacting:
Trustwave Technical Support:
https://www.trustwave.com/Company/Support/
Email: siemsupport@trustwave.com

Collecting all logs for Troubleshooting for LME 1.2.1, 2.0 and SE 2.2

Alhad Bhadekar — Mon, 28 Nov 2016 16:48:56 GMT

This article applies to:

SIEM LME 1.2.1, 2.0
SIEM Enterprise 2.2

Question:

How do I collect all the logs for troubleshooting purposes?

Procedure:

SIEM LME 1.2.1

In the GUI go to Admin > System Management > Get Logs
Click Get Logs.
A dialog will open. In 'Get Logs' Status you will see ==>Start Get Logs<==
After a few minutes another dialog will appear asking to save the *.bz file

SIEM LME 2.0 and SIEM 2.2

Log in to the GUI
Go to Configuration>Nodes

li>
Click Download Logs. A Save As dialog will display. Select a location and click Save.
A "Progress" Dialog will display to show you the logs are being downloaded

Downloading of logs for LME 2.0 and 2.2 if the GUI is unavailable

Log in to the server via SSH
cd to /opt/nsm/util/bin/getlogs.sh
Run the following command: ./getlogs.sh
cd /tmp for logs location e.g.: logs_2016_11_28_11-27.tar.bz2

Notes:

If the User Interface is unavailable for LME 1.2.1 you can run the get logs script manually. See Trustwave Knowledge Base article Q15613.

Verifying whether Checkpoint is using a SHA-1 or SHA-256 certificate

Andrew Davies — Tue, 01 Nov 2016 18:56:30 GMT

This article applies to:

SIEM
Checkpoint firewalls

Question:

How can I verify whether Checkpoint is using a SHA-1 or SHA-256 certificate?

Procedure:

The current version of the OPSEC SDK only supports certificates generated with SHA-1. If the Checkpoint device is using a SHA-256 certificate, SIEM will not be able to retrieve logs.

To verify whether Checkpoint is using SHA 1 or SHA 256, in the Checkpoint command line interface, run the following command:

grep ":signature_hash" $FWDIR/conf/InternalCA.C

If the result returns no output, the Checkpoint device is using a SHA-1 certificate.
If the result returns any output, the Checkpoint device is using a SHA-256 certificate.
In this case, to retrieve logs with SIEM it is necessary to re-generate a SHA-1 certificate in Checkpoint, and then recreate the opsec application.

Notes:

Trustwave plans to update the OPSEC SDK to support SHA-256. For more information, contact Trustwave TAC.
Use of SHA-1 for this purpose does not affect compliance.

Unable to use web apps from Administration Console when using proxy authentication

Andrew Davies — Thu, 29 Sep 2016 15:26:11 GMT

This article applies to:

SIME OE 5.9
SIEM OE 5.9.1

Question:

I am unable to access the webapps from Administration Console when using proxy authentication. All I get is a blank screen that says "This program cannot display the webpage"

Procedure:

You can fix this issue by logging in the Administration Console

Go to the Navigation Graph
TYPE: soc:/system/navigation/
in the address bar / URL
Turn on Edit mode
Right Click on the a node in that folder

Click on Attributes
Go to the Advanced tab
Find 'browser_position' and update it from 'popup' to 'iepopup2'
Click OK

Repeat on each node. If the node does not have the browser_position skip that one and move to the next.

Once complete you will need to restart the Administration Console. When you have done this you should be prompted with the login prompt for the proxy.

Changing the Server IP Addresses for OE 5.9

Andrew Davies — Wed, 27 Apr 2016 18:48:15 GMT

This article applies to:

SIEM OE 5.9
SIEM OE 5.9.1

Question:

How can I change the IP address of an active server?

Procedure:

If necessary, you can change the IP addresses of all servers.

Shut down all SIEM OE services:

/opt/nsm/common/nsm-all stop
Change the IP addresses on the server (Red Hat configuration). Ensure that you update the configurations in /etc/hosts if they exist.
Change the IP addresses following the examples provided in "IP Address Change Examples" below.
- Help is available by running ./ipchange_post.sh -h
Restart the SIEM OE services:

/opt/nsm/common/nsm-all restart
Run the SDW post-install script:

/opt/nsm/cs/bin/update_ism.sh

IP Address Change Examples:

DA, SOC, TD and TE

On the server, (DA, SOC, TD or TE) run ./ipchange_post.sh [server] [new_ip]

where
- [server] represents the name you gave to the DA, SOC, TD or TE when you installed SIEM
- [new_ip] represents the new IP address you are assigning to the server
On the SDW, run ./ipchange_post.sh [server] [new_ip]

If installing on a single server, you can also use all in place of [server] to update all the IP addresses.

SDW

On the SDW, run ./ipchange_post.sh all [new_sdw_ip]

where [new_sdw_ip] is the new IP address you are assigning to the SDW.
On the other servers, run ./ipchange_post.sh sdw [new_sdw_ip]

Notes:

When the IP address is changed on the SDW, you should regenerate the SSL certificate, to reference the new IP address. See the Trustwave SIEM Operations Edition Installation Guide for instructions.

Upgrading LME 1.2.1 to the Latest Version

Andrew Davies — Tue, 26 Apr 2016 15:00:36 GMT

This article applies to:

LME 1.2.1

Question:

How do I upgrade from Log Management Enterprise 1.2.1 to the current version?

Procedure:

This article will cover how to upgrade LME 1.2.1 to the current DM and SP.

You can get the files to upgrade from the File Library on the Product Support Portal at https://login.trustwave.com/. They are stored under Private -> SIEM -> SIEM - Log Management Enterprise (LME) -> LME-1.2.1

Customers should have access to these files. If you do not have access, contact Trustwave TAC.

Install the SPs and DMs in the following order:

LME_1.2.1_SP23

Dependencies: Trustwave SIEM 1.2.1 SP-17 DM-16
Support Package Files: SP-23.tgz, SP-.tgz.md5, SIEM_1.2.1_SP23_release_notes.pdf
LME_1.2.1_DM18

Dependencies: Trustwave SIEM 1.2.1 SP-17 and DM17
Support Package Files: DM-18.tgz
LME_1.2.1_DM19

Dependencies: Trustwave SIEM 1.2.1 SP-17 and DM18
Support Package Files: DM-19.tgz
LME_1.2.1_DM20

Dependencies: Trustwave SIEM 1.2.1 SP-17 and DM19
Support Packages: DM-20.tgz, DM-20.tgz.md5, Trustwave SIEM 1.2.1 DM-20.docx

New Data Modules & Solution Content:
- Safensoft TPSecure via DB
- Symantec Brightmail via EM Syslog
- Microsoft Sharepoint via Flatfile
- Splunk Audit via Syslog/Flatfile
- Enghouse IP Call Recording via Flatfile
- AirWatch MDM via Syslog
LME_1.2.1_DM21

Dependencies: Trustwave SIEM 1.2.1 SP-18 and DM20
Support Packages: DM-21.tgz, DM-21.tgz.md5, Trustwave SIEM 1.2.1 DM-21.pdf

New Data Modules & Solution Content:
- Accellion Kiteworks
- Hitachi Unified Storage
- IBM Sterling B2B Integrator
- IBM Tivoli Access Manager
- McAfee OTP Server
- Modirum MDpay MPI
- Sophos Secure Web Gateway
- Trustwave FIM
LME_1.2.1_DM22

Dependencies: Trustwave SIEM 1.2.1 SP-20 and DM21
Support Packages: DM-22.tgz, DM-22.tgz.md5, Trustwave SIEM 1.2.1 DM-22.pdf

New Data Modules & Solution Content:
- ACI Worldwide PRM
- Aloha Configuration Center
- AppSecInc DbProtect
- EMC Centera
- McAfee Stonesoft NGN
- Sophos Cyberoam UTM Firewall
- Trustwave Antivirus
New Acquisition Methods:
- Microsoft Windows Non-Security Logs 2000-2008 EM/Snare/Splunk/Balabit/Lasso/Datagram
- Microsoft Windows Security Log 2008 - WinCollect
LME_1.2.1_DM23

Dependencies: Trustwave SIEM 1.2.1 SP-23 and DM22
Support Packages: DM-23.tgz, DM-23.tgz.md5, Trustwave SIEM 1.2.1 DM-23.pdf

New Data Modules & Solution Content:
- Catbird vSecurity
- ExtremeNetworks ExtremeXOS
- NCR RPOS
- Zscaler NSS
- ZyXel ZyWALL
New Acquisition Methods:
- IBM iSeries via Halcyon Syslog
Enhanced Data Modules
- Juniper JunOS
LME_1.2.1_SP24

Dependencies: Trustwave SIEM 1.2.1 DM-21 SP-16 to SP-23
Support Packages: SP-24.tgz, SP-24.tgz.md5, Trustwave SIEM 1.2.1 SP-24.pdf
LME_1.2.1_SP25

Dependencies: Trustwave SIEM 1.2.1 DM-21 SP-24
Support Packages: SP-25.tgz, SP-25.tgz.md5, Trustwave SIEM 1.2.1 SP-25.pdf
LME_1.2.1_SP26

Dependencies: Trustwave SIEM 1.2.1 DM-21 SP-25
Support Packages: SP-26.tgz, SP-26.tgz.md5, Trustwave SIEM 1.2.1 SP-26.pdf
LME_1.2.1_SP27

Dependencies: Trustwave SIEM 1.2.1 DM-21 SP-26
Support Packages: SP-27.tgz, SP-27.tgz.md5, Trustwave SIEM 1.2.1 SP-27.pdf
LME_1.2.1_DM24

Dependencies: Trustwave SIEM 1.2.1 SP-23 and DM23
Support Packages: DM-24.tgz, DM-24.tgz.md5, Trustwave SIEM 1.2.1 DM-24.pdf

New Data Modules & Solution Content:

Actian Ingres via Flatfile

Apache Qpid via Syslog

Cylance Protect via Syslog

Network Box UTM via Syslog

Trustwave SEG via EM

VASCO IAS via Flatfile

Vormetric DSM via Syslog
New Acqusition Methods:

ISC Bind via Flatfile

Update Instructions:

Download the Support Update from the Support Portal.
Log on to the SIEM appliance as an administrator.
On the Admin tab, open System Management | File Manager.
On the File Manager tab, scroll down to Support Package Upload.
Expand the item and click Add.
Browse to the file you want to add, and select it.
Click Upload. When the ‘successful upload’ window appears, close the window.
Check that the Support Package has been installed by viewing the install.log under Common Logs on the File Manager tab. Look for entries that show the time-stamps of when you added the file.

Fixing a time zone change issue after SP-27 installation

Andrew Davies — Wed, 23 Mar 2016 17:15:50 GMT

This article applies to:

SIEM 1.2.1 SP-27

Question:

Time zone was incorrectly set to EST
How can I correct the time zone after installing SIEM SP-27?

Procedure:

The SIEM SP-27 installation script changes the time zone setting to EST.

Below is an extract from an example install.log:

Tue Mar 8 13:36:07 IST 2016
installing patch SP-27.tar
...
[20160308-133848] Deploying CPIO packages...
[20160308-030850] Update RPM DB...
...
[20160308-031434] Tue Mar 8 03:14:34 EST 2016
master_script is done
finished patch SP-27.tar

As a result the time zone has been changed to EST.

Workaround:

Log in to the system with an account with administrative privileges.
From the SIEM interface, select Admin > System Management > Date /Time
In the time zone menu, you will see the original (correct) timezone.
Choose a different timezone, and then click Save.
Choose the original desired time zone, and then click Save.

Notes:

This issue will be corrected in SP-28. SP-27 has been withdrawn from release and will be replaced by SP-28.

HA cluster - Not receiving notification when the secondary node becomes master

Andrew Davies — Tue, 24 Nov 2015 18:16:13 GMT

This article applies to:

SIEM LP/LME 1.2.x HA cluster setup

Question:

I don't receive notification when the secondary node becomes master
How can I set up notification of failover?

Procedure:

If you receive notification when one of the nodes become master, but you do not receive notification when the second one becomes master, you can adjust Alert Manager settings on the "silent" node.

Open the GUI and navigate to Admin tab > System Management > Alarm Manager.
On the top of the right pane, click Go to Alarm Manager Advanced Config.
On the advanced configuration page, check the Groups and Actions tabs and ensure that the settings are the same on both nodes. If not, copy the settings from the node with working notifications.
On the Categories tab, select the Resources Error Alarm category and set up Current Alarm Actions.
Save your changes.

To check that the applied settings work, force fail-over and look for the desired notification.

Notes:

To set up Alarm Manager, use Internet Explorer or Firefox browser. Under Chrome this section is not visible.

Sample syslog-ng filter for Generic Unix Syslogs for SIEM OE

Andrew Davies — Fri, 07 Aug 2015 19:06:56 GMT

This article applies to:

SIEM OE 5.7
SIEM OE 5.9

Question:

What is an example syslog-ng filter for Generic Unix Syslogs for SIEM OE?

Reply:

The following filter provides a generic format and can be used as a starting point.

filter f_gen_unix { (host("\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|^[A-Za-z0-9-]+")
and (program("adclient|anacron|apple|atd|authexec|autofs|audit|automount|boot")
or program("crond|chkpwd|chrootsh|date|dhcpd|dhclient|dmgt|fsck|fstab|ftp")
or program("init|irqbalance|kcheckpass|klogind|imapd|inetd|jobid")
or program("lmtpunix|login|logrotate|lsb_log_message|microcode_ctl")
or program("nbproxy|network|netfs|nfslock|nscd|pam|passwd|portmap")
or program("radiusd|rcp|rdistd|reboot|remshd|rexecd|rlogind|roathkr|root|rpc\.|rpcimapd|rshd|rssh")
or program("savecore|SecurityAgent|shutdown|slapd|sshd|ssh-server-g3|start_udev|su|sudo|sysctl|sysinit|syslog")
or program("tcpredirect|tsm|unix|useradd|userdel|userhelper|usermod|vgchange|wrappers|xinetd|xlock|xscreensaver|webmin")
or program("runuser|cimserver|klogd|cron"))
and not(match("eventmonitor-|LOG_USER|umask to 022|allowing scp|LOGLOGIC|NetScreen|DOT1X|genunix:|LWAPP|vxfsckd"))); };

Testing the connection from the AC (workstation) to the SDW tier in SIEM OE

Andrew Davies — Fri, 07 Aug 2015 19:05:58 GMT

This article applies to:

SIEM OE 5.7
SIEM OE 5.9

Question:

How can I test connection from the AC (workstation) to the SDW tier in SIEM OE?

Procedure:

To test the connection from a workstation to SD, use Telnet:

telnet 172.2.2.2 443
Trying 172.2.2.2...
Connected to sdwserver.abc.local (172.2.2.2).

Escape character is '^]'.
Connection closed by foreign host.

Notes:

To activate telnet on a Windows 7 workstation:

Navigate to Control Panel --> Programs --> Turn Windows Features On or Off
Find Telnet Client in list and select it (check the box)
Click OK to activate

Testing that an LP/LA is able to forward files to another LP or OE

Andrew Davies — Fri, 07 Aug 2015 19:05:03 GMT

This article applies to:

SIEM LP 1.2.1

Question:

How do I test that an LP/LA is able to forward files to another LP or OE?

Procedure:

To manually SCP a file from an LP/LA to another LP or OE:

scp -i /opt/nsm/udp/keys/id_dsa -v /tmp/test.txt itactics@10.1.6.6:/tmp

(Substitute the name of an existing file, and the correct IP address of the target)

If you are unable to manually SCP a file then confirm the Public Key (id_dsa.pub) is accurate

Check dates on both id_dsa and id_dsa.pub are the same
- ssh-keygen -y -f id_dsa (will generate and display the public key)
- cat id_dsa.pub (will show the existing public key file)
Compare the output from the twocommands

Note:

For reference, the locations of SSH Keys and Authorized Keys Files are:

/opt/nsm/udp/keys/id_dsa
/opt/nsm/udp/keys/id_dsa.pub
/home/itactics/.ssh/authorized_keys

Checking what services are running on a SIEM appliance

Andrew Davies — Fri, 07 Aug 2015 19:04:02 GMT

This article applies to:

SIEM LP/XL/LA 1.2.X

Question:

How do I verify what services are running on my SIEM appliance?

Procedure:

Run the following command from the CLI:

service nsmim status all

The results will show you what services are running and will look something like:

SIEM DP (svc_id 1) (pid ppid 16326 16227) is running ...

SIEM DP (svc_id 21) (pid ppid 16568 16476) is running ..

SIEM DL (svc_id 2) (pid ppid 15136 15046) is running ...

SIEM DL (svc_id 15) (pid ppid 15329 15239) is running ...

SIEM DL (svc_id 16) (pid ppid 15522 15432) is running ...

SIEM DL (svc_id 17) (pid ppid 15715 15625) is running ...

SIEM DL (svc_id 18) (pid ppid 15909 15818) is running ...

SIEM RG (svc_id 13) (pid ppid 17295 17196) is running ...

SIEM US (svc_id 23) (pid ppid 17938 17848) is running ...

SIEM HM (svc_id 6) (pid ppid 13011 12901) is running ...

SIEM DLA (svc_id 3) (pid ppid 16104 16013) is running ...

SIEM LLM (svc_id 12) (pid ppid 16818 16726) is running ...

SIEM SSHD (svc_id 10) (pid ppid 17503 17413) is running ...

SIEM PSTAT (svc_id 24) (pid ppid 17074 16978) is running ...


To verify mysql, use the following command:

 service ismdb status

Checking the version of a SIEM appliance

Andrew Davies — Fri, 07 Aug 2015 19:03:40 GMT

This article applies to:

SIEM LP/XL/LA 1.2.X

Question:

How do I check the version of my SIEM?

Procedure:

The simplest way to check your SIEM version is through the graphical user interface.

Log in to SIEM.
In the upper right hand corner, click About.

The version information displays in a popup.

It is also possible to check the version from the command line interface. Issue the following command:

mysql -u[user] -p[userpassword] -e "SELECT * FROM UI.help;"

This will return the version information.

Checking the status of a SP or DM Install

Andrew Davies — Fri, 07 Aug 2015 19:03:25 GMT

This article applies to:

SIEM LP/XL/LA 1.2.X

Question:

How do I check the status of a DM or SP update?

Procedure:

To see details of upgrade progress, view the contents of the file install.log under /var/log/nsm/common

cat /var/nsm/common/install.log

You can also follow the updates in a terminal window using tail:

tail -f /var/nsm/common/install.log

Locking a SIEM OE HA Cluster for Maintenance

Andrew Davies — Fri, 07 Aug 2015 19:02:30 GMT

This article applies to:

SIEM OE 5.7 or 5.9 in HA

Question:

How do I lock a SIEM OE High Availability Cluster for maintenance ?

Procedure:

Lock the cluster:

clusvcadm -Z
Perform any maintenance (for instance, install Hotfixes)
Unlock the cluster:

clusvcadm –U

syslog-ng does not start after updating a DMFD

Charles Creegan — Fri, 07 Aug 2015 19:01:48 GMT

This article applies to:

SIEM 5.7, 5.9

Question:

Why won't syslog-ng start up?
Updating a DFMD causes a problem with syslog-ng

Information:

The update procedure provided in the PDF document for DMFDs instructs you to copy and paste some text into your syslog-ng.conf file.

If you copy and paste the exact text, you will also copy incorrect line breaks or white space.

You must remove these incorrect characters from your conf file in order to start syslog-ng.

For example, the following text is a direct copy and paste from a DMFD readme:

destination d_cyberark_vault_syslog {file("/var/nsm/inbox/app/cyberark/vault/syslog/cyberark_vault_syslog-$R_MONTH$R_DAY$R_HOUR$R_MIN"); };filter f_cyberark_vault_syslog { match("Cyber-Ark"); };log { source(local); filter(f_cyberark_vault_syslog);destination(d_cyberark_vault_syslog); }/;log { source(remote); filter(f_cyberark_vault_syslog);destination(d_cyberark_vault_syslog); };

The above example is incorrect (note extra line breaks). The corrected text is as follows (enclosed in a scrolling box to maintain line breaks):

destination d_cyberark_vault_syslog { file("/var/nsm/inbox/app/cyberark/vault/syslog/cyberark_vault_syslog-$R_MONTH$R_DAY$R_HOUR$R_MIN"); };filter f_cyberark_vault_syslog { match("Cyber-Ark"); };log { source(local); filter(f_cyberark_vault_syslog);destination(d_cyberark_vault_syslog); };log { source(remote); filter(f_cyberark_vault_syslog);destination(d_cyberark_vault_syslog); };

After the incorrect line breaks and white space are removed, syslog-ng will start.

Using dbquery.sh to test connectivity with databases

Andrew Davies — Fri, 07 Aug 2015 19:01:12 GMT

This article applies to:

SIEM LP/OE (All versions)

Question:

Is there a way to test Database connections?
I have validated the Database reader I am using in LP but I see no events
I know I am using the correct username and password, but no events are showing in the system

Procedure:

The dbquery.sh script helps to verify that the connections are setup correctly. Here is the procedure to use this tool:

Download the tool from the zip file attached to this article.
Using a SCP client, copy dbquery.sh to the system
From the bash prompt run this command:
Connect to the system via SSH
From the bash prompt run this command: chmod 755 dbquery.sh
From the bash prompt run this command:

   ./dbquery.sh "net.sourceforge.jtds.jdbc.Driver" "jdbc:jtds:sqlserver://<hostname/IP>:1433/<name_db" "<user_name>" "<password>" "<query>" 

The quotes are part of the command. Replace the <parameters> with your values. See the example below.
If there are connection issues or authentication issues this command will give you a message

Example:

 ./dbquery.sh "net.sourceforge.jtds.jdbc.Driver" "jdbc:jtds:sqlserver://192.168.10.23:1433/EPO-4" "admin" "password" “select max(autoid) from EPOEvents" 

Administration Console Login Prompt does not disapear after logging in

Andrew Davies — Fri, 07 Aug 2015 19:00:53 GMT

This article applies to:

SIEM OE 5.6, 5.7

Symptoms:

I logged in to the Administration Console and the login prompt is still on the screen.
I also see my domain in the "log on to" box

Cause:

This issue can be caused by a fault in Java.

Procedure:

Start a ssh session and check the following log file: /var/log/nsm/soc/server.log
Look for recent entries with the following message: java.lang.OutOfMemory

If you find this is the problem, you can resolve it as follows:

Close the Administration Console
Open Task Manager > Processes
Look for javaw.exe (for 64 bit systems, javaw.exe *32)
Select this item and click End Process
Restart the SOC service (service nsmsoc restart)
Launch the Administration Console

Notes:

The Administration Console connects in the following order in 5.6 and 5.7: SDW, SOC, DA, TD, TE

The 2 most critical tiers are the SDW and SOC, as these two tiers have user tables.

Changing the warning statement on the SIEM login screen

Andrew Davies — Fri, 07 Aug 2015 19:00:22 GMT

This article applies to:

SIEM LP

Question:

How can I change the warning statement on the SIEM login screen?

Procedure:

Log in to the appliance using a ssh connection as a root user.
Edit the file

/opt/tomcat/webapps/itactics/WEB-INF/classes/web.properties
Look for the existing entry LoginWarningText, and change the line after the =

LoginWarningText = This is my custom warning text, all on one line.

Note:

Restart services if needed:

#service tomcat restart
#service httpd restart

Database reader enabled but no connection attempts

Andrew Davies — Fri, 07 Aug 2015 18:59:56 GMT

This article applies to:

SIEM OE 5.5.1, 5.6, 5.7 and 5.9

Symptoms:

Reader enabled but tcpdump is not showing outgoing connections
(to check, run tcpdump -nn host <IP>)
Error in the DA nsm log: Critical [io.DBReaderNGSQLSource.connect] /system/da/input/<device>/<vendor>/<product> failed to load the database driver

Causes:

jtds-1.2.5 driver is not installed

Resolution:

In 5.5.1 verify that the jtds-1.2.5.jar file is in the following locations:
- /opt/nsm/common/thirdparty
- /opt/NSM/server/lib/support
In 5.6 and newer versions
- /opt/nsm/common/thirdparty

Notes:

5.5.1 is the only OE version that will need this file in both locations.
Here is the download location for the driver:

http://sourceforge.net/projects/jtds/files/jtds/1.2.5/

Finding active supported devices on SIEM LP with a SQL Query

Andrew Davies — Fri, 07 Aug 2015 18:59:13 GMT

This article applies to:

SIEM LP

Question:

I need a list of the active supported devices from my LP. Is there a simple way to list those from MySQL?

Procedure:

mysql> use sdw

Database changed

mysql> SELECT supported_devices.device_id,name,expiry_after FROM supported_devices JOIN device_data_expiry ON supported_devices.device_id=device_data_expiry.device_id;

These commands will display a list of the supported devices for a particular installation. This will also display the expiry time.

Sample output:

+-----------+----------------------------------------------------+--------------+| device_id | name                                               | expiry_after |+-----------+----------------------------------------------------+--------------+|         1 | McAfeeePO                                          |          180 ||         3 | Symantec AntiVirus - Flatfile                      |         NULL ||         4 | OracleAudit Trail                                  |          180 ||         5 | CheckPoint Firewall                                |         NULL ||         6 | CiscoASA/PIX                                       |          180 ||        11 | JuniperSSL VPN                                     |          180 |

Here is an additional example of the output:

Applying Updates with the Dark Site Package Manager

Andrew Davies — Fri, 07 Aug 2015 18:58:42 GMT

This article applies to:

SIEM LP

Question:

How do I use the DarkSite Package upload manager to apply packages?

Procedure:

To begin the process of applying a package through the DarkSite package upload manager, go to the Admin tab in the LP UI interface, select "System Management", then "File Manager":
Once the File Manager is loaded, select the file category "+dark site packages":
Under "+dark site packages", click "Upload". A new window will open to allow you to browse to the package you need to upload:
Once the file has been uploaded through the DarkSite Package manager, navigate to the Update Manager under System Management in the Admin tab and choose "Available Updates". Place a check in the box next to the package and click "Extract". The DarkSite packages are the only types of packages you need to extract prior to installation; DMs and SPs do not need to be extracted.
Once the extraction is complete, click over to the "Updates to Install" tab. Your uploaded file should appear and be available for you to select and install.

Notes:

Upgrade packages in the following folder must also be applied with the "Update Manager" from the UI:
- /usr/local/neiagent/DarkStore
Regular support package uploads go into /var/nsm/uploads to manually apply