VMware Monitoring Events

AccelOps generates the following events VMware related system monitoring events

VM level events

VM State Monitoring

VM Uptime Monitoring

VM CPU Monitoring

VM Per CPU Monitoring

VM Memory Monitoring

VM Datastore Utilization Monitoring

VM Disk I/O Monitoring

VM Datastore I/O Monitoring

VM Network I/O Monitoring

Disk Growth Trend – Daily

Disk Growth Trend – Weekly

Disk Growth Trend – Monthly

ESX level events

ESX State Monitoring

ESX CPU Monitoring

ESX Memory Monitoring

ESX Datastore Utilization Monitoring

ESX Disk I/O Monitoring

ESX Datastore I/O Monitoring

Cluster and resource pool events

VM Cluster CPU Utilization

VM Cluster Memory Utilization

VM Cluster Datastore I/O Utilization

VM Resource pool CPU Utilization

VM Resource pool Memory Utilization

VM State Monitoring

Event Type: PH_DEV_MON_VM_STATE

Description: Event containing VM State Source: All Key Attributes:

VM Uptime Monitoring

Event Type: PH_DEV_MON_VM_UPTIME

Description: Event containing VM Uptime Source: All Key Attributes:

VM CPU Monitoring Event

Event Type: PH_DEV_MON_VM_CPU_UTIL

Description: Event containing VM CPU metrics Source: All Key Attributes:

VM Per CPU Monitoring Event

Event Type: PH_DEV_MON_VM_PER_CPU_UTIL

Description: Event containing VM per CPU metrics Source: All Key Attributes:

VM Memory Monitoring

Event Type: PH_DEV_MON_VM_MEM_UTIL

Description: Event containing VM Memory utilization metrics Source: All Key Attributes:

VM Disk I/O Monitoring

Event Type: PH_DEV_MON_VM_DISK_IO

Description: Event containing VM Disk I/O performance metrics Source: All

Key Attributes:

Sample event:

VM Datastore Utilization Monitoring

Event Type: PH_DEV_MON_VM_DISK_UTIL

Description: Event containing VM Datastore utilization metrics Source: All

Key Attributes:

Sample event:

VM Datastore I/O Monitoring

Event Type: PH_DEV_MON_VM_STATE

Description: Event containing VM CPU metrics Source: All

Key Attributes:

Sample event:

VM Network IO Monitoring

Event Type: PH_DEV_MON_VM_STATE

Description: Event containing VM CPU metrics Source: All

Key Attributes:

Sample event:

<134>Feb 08 18:22:16 10.1.2.11 java:

[PH_DEV_MON_VM_NET_INTF_UTIL]:[eventSeverity]=PHL_INFO,[phyMachName

]=HOST-10.1.2.51,

[phyMachIpAddr]=10.1.2.51, [pollIntv]=180, [vmName]=CO159,

[morId]=vm-194, [hostName]=CO159, [hostIpAddr]=10.1.2.159,

[vSwitch]=vSwitch0, [intfName]=Network adapter 1, [sentPkts]=454,

[recvPkts]=939, [sentBytes]=102400, [recvBytes]=307200

VM Cluster CPU Utilization

VM Cluster Memory Utilization

VM Cluster Datastore I/O Utilization

VM Resource pool CPU Utilization

VM Resource pool Memory Utilization

ESX State Monitoring

ESX Datastore Utilization Monitoring

ESX Disk I/O Monitoring

<134>Oct 02 12:00:42 192.168.1.3 java:

[PH_DEV_MON_ESX_DISK_IO]:[eventSeverity]=PHL_INFO,

[hostName]=ESX3i-QA-01.prospecthills.net, [hostIpAddr]=192.168.1.3,

[pollIntv]=180, [morId]=ha-host, [diskName]=mpx.vmhba32:C0:T0:L0,

[diskReadKBytesPerSec]=9.9, [diskWriteKBytesPerSec]=0.3,

[diskReadReqPerSec]=1.215, [diskWriteReqPerSec]=0.045,

[devDiskRdLatency]=0.1, [devDiskWrLatency]=0.4, [kernDiskRdLatency]=0.0,

[totDiskRdLatency]=0.1, [totDiskWrLatency]=0.4, [kernDiskWrLatency]=0.0

ESX Datastore I/O Monitoring

Application Monitoring Events

Application Monitoring Events

AccelOps generates the following events related to application monitoring

Process Resource Utilization

Apache Performance Metrics

Microsoft ASP.NET Metrics

Exchange RPC Metrics

Exchange RPC Error Metrics

Exchange Mailbox Metrics

Exchange SMTP Metrics

Microsoft DNS Performance Metrics

Microsoft DHCP Performance Metrics

Microsoft Active Directory Performance Metrics

IP SLA VoIP Metrics

IP SLA HTTP metrics

IP SLA ICMP metrics

Generic IPSLA metrics

Tomcat Application Server Monitoring Metrics

Glassfish Application Server Monitoring Metrics

Weblogic Application Server Monitoring Metrics

Websphere Application Server Monitoring Metrics

JBOSS Application Server Monitoring Metrics

Process Resource Utilization

Network Flow Monitoring Events

Network Flow Events

These events are generated from Cisco Netflow and SFlow.

Event Type: IOS-NETFLOW-BI (BI standing for bidirecational: two unidirectional netflow messages are combined into one), SFLOW-BI

Description: Event containing netflow data Source: Cisco IOS (Netflow) Key Attributes:

Security Information Management

User Password Monitoring Events

AccelOps generates the following events related to user password monitoring during LDAP discoveries.

LDAP Password Never Expire Events

LDAP Password Not Required Events

LDAP Password Expiry Event

LDAP Password Stale Events

LDAP Password Not Required Events

Event Type: PH_DISCOV_ADS_PASSWORD_NOT_REQD

Description: Event contains users whose password is not required

Source: Windows Active Directory Discovery via LDAP Sample event

Key Attributes:

LDAP Password Expiry Event

Event Type: PH_DISCOV_ADS_PASSWORD_TO_EXPIRE

Description: Event contains users and the times when their passwords were last set and when their passwords are about to expire Source: Windows Active Directory Discovery via LDAP

Sample event

<174>Feb 12 12:09:29 PH-QA-AUTOTEST phDiscover[22677]: [PH_DISCOV_ADS_PASSWORD_TO_EXPIRE]:[eventSeverity]=PHL_INFO,[procNa me]=phDiscover,[fileName]=dirUser.cpp,[lineNumber]=1750,[hostIpAddr ]=192.168.0.10,[user]=testuser,[userFullName]=Testuser,[userDN]=CN=

Testuser,CN=Users,DC=acme,DC=net,[daysToPasswordExpiry]=0,[password

LastSet]=1360606672,[phLogDetail]=

Key Attributes:

Change management related

Change management related

Network Device Config Changes

Server Change

Network Device Config Changes

Change: Router Configuration Changes Detected From Log: This report provides details about router config changes Change: Router Run versus Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config

Change: Router Config Changes Detected Via Login: This report captures detected configuration changes via login

WLAN Config Change: This report tracks all software, hardware and device configuration changes at WLAN Access points and Base stations. The report includes Original Reporting Controller IP, Event Type and MAC address of the AP or Controller where the event happened. If the MAC address is empty then, the event happened at the reporting Controller.

Change: Firewall Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config

Change: Firewall Config Changes Detected Via Login: This report captures detected startup or running config changes – the changes are detected by logging into the device and hence is accurate.

Server Changes

Change: Database Server DDL Changes: Captures database DDL changes

Change: Top Windows Servers, Users by Account Modification Count: This report ranks the windows servers and their administrative users by the number of user account modification events

Change: Windows Server Account Modification Details: This report captures the details of windows account modification events.

Details include the administrative user, target user, the operation performed and the raw log

Change: Windows File Access Details: This report captures the details of windows server file access events. Details include the administrative user, file/directory, the operation performed and the raw log

Change: Top Windows Servers, Users By Config/Policy Modification Count: This report ranks the windows servers and their administrative users by the number of server configuration or policy modification events

Change: Windows Server Config Modification Details: This report captures the details of windows server configuration or policy

modification events. Details include the administrative user, file/directory, the operation performed and the raw log

Change: Local User Accounts Created: This report captures user accounts added on a server Change: Local User Accounts Deleted: This report captures user accounts removed from a server Change: User Accounts Modified: This report captures local user account modifications.

Change: Users Added To Local Groups: This report captures users added to local groups.

Change: Users Added To Global Groups: This report captures users added to global or univeral groups.

Change: Users Deleted From Local Groups: This report captures users deleted from local groups.

Change: Users Deleted From Global Groups: This report captures users deleted from global or univeral groups.

Change: Local Groups Deleted: This report captures local group deletions

Change: Local Groups Modified: This report captures local group modifications

Change: Global Groups Created: This report captures global group creations

Change: Global Groups Deleted: This report captures global group deletions

Change: Global Groups Modified: This report captures global group modifications

Change: Local Groups Created: This report captures local group creations

Change: Windows Server Password Changes: Tracks password changes

Change: Windows Server Account Lock/Unlock history: Captures account lockouts and unlocks on windows servers. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.

Change: Windows Audit Policy Changed: This report captures audit policy changes

Change: Windows File Access Failures: This report captures the details of windows server file access failures. Details include the administrative user, file/directory, the operation performed and the raw log

Change: Windows File Access Successes: This report captures the details of windows server file access successes. Details include the administrative user, file/directory, the operation performed and the raw log

Change: All Account/Group Change Events: This report lists all account/group change events

Change: Top Windows Domain Controllers, Users By Account Modification Count: Ranks Domain Controllers and their administrators by the number of account modifications performed

Change: Windows Domain Account Modification Details: Details windows domain account modifications

Change: Top Windows Domain Controllers, Users By File Modification Count: Ranks the Domain Controllers abd their administrators by the number of file modifications performed

Change: Windows Domain Controller File Modification Details: Provides details about domain controller file modifications Change: Top Windows Domain Controllers, Users By Config Modification Count: Ranks Domain Controllers and their administrators by the number of config modifications performed

Change: Windows Domain Controller Config Changes: Provides detailed windows domain controller config changes

Change: Computers added to domain: Captures computers added to a domain

Change: Computers deleted from domain: Captures computers removed from a domain Change: Domain user accounts created: Captures user accounts added to a domain Change: Domain user accounts deleted: Captures user accounts removed from a domain Change: Domain user accounts modified: Captures domain user account modifications.

Change: Domain groups created: Captures domain group creations

Change: Domain groups deleted: Captures domain group deletions

Change: Domain groups modified: Captures domain group modifications

Change: Users Added To Domain Groups: Tracks users added to domain groups

Change: Users Deleted From Domain Groups: Tracks users deleted from domain groups. The information contains who did it (User, Computer, Domain, Source IP) along with the deleted account (Target User) and group (Target User Group).

Change: Domain User Password Changes: Tracks password changes

Change: Domain Account Lock/Unlock history: Captures account lockouts and unlocks on domain accounts. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.

Change: Domain Account Unlocks: Captures account unlocks on domain accounts. Account unlocks happen after lockouts that may happen on repeated login failures

Change: Windows Domain Controller Audit Policy Changed: This report captures audit policy changes

Change: Unix Users Added To Group: Tracks user additions to groups

Change: Unix User Password Changed: Tracks password changes

Change: Audited file changes: Tracks user modifications to files and directories. Both the content and attribute modifications are captured. For actions on directories, the affected files in the directories are also captured.

Compliance related

Compliance related

PCI

COBIT

SOX

HIPAA

PCI

PCI 1.x: Top Reporting Firewalls By Event Count: Ranks the firewalls by the number of events sent

PCI 1.x: Firewall Config Changes Detected Via Login: This report captures detected startup or running config changes – the changes are detected by logging into the device and hence is accurate.

PCI 1.x: Router Config Changes Detected From Log: This report provides details about router config changes

PCI 1.x: Router Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config

PCI 1.x: Firewall Run vs Startup Config Difference Via Login: This report captures detected differences between a firewall’s running and startup config

PCI 1.x: Router/Switch Config Changes Detected Via Login: This report captures detected startup or running config changes – the changes are detected by logging into the device and hence is accurate.

PCI 1.x: Router Config Changes Detected Via Login: This report captures detected startup or running config changes – the changes are detected by logging into the device and hence is accurate.

PCI 1.x: Firewall Admin Activity Details: Provides details about firewall admin activity – logons, command executions and logoff

PCI 1.x: Router Admin Activity Details: Provides details about router admin activity – logons, command executions and logoff

PCI 1.x: Firewall NAT Translations: This report captures the NAT translations over a time window

PCI 1.x: Top Firewalls and Outbound Permitted Services By Connections, Bytes: Ranks firewalls and permitted outbound services by first the total number of connections and then by bytes for that service

PCI 1.x: Top Firewalls and Inbound Permitted Services By Connections, Bytes: Ranks firewalls and permitted inbound services by first the total number of connections and then by bytes for that service

PCI 1.x: Top Firewalls and Permitted High Port Services By Connections, Bytes: Tracks the high port services permitted by firewalls – these services may pose security risk

PCI 1.x: Top Firewalls and Permitted Uncommon Services By Connections, Bytes: Tracks uncommon services permitted by firewalls – common services include DNS, SMTP, Web

PCI 1.x: Top Firewalls and Permitted Vulnerable Low Port Services By Connections, Bytes: Tracks uncommon services permitted by firewalls – vulnerable services include Microsoft services such as MS-RPC (135), NETBIOS-SSN (139), MICROSOFT-DS (445), MS-SQL (1433,1434), FTP (23), TELNET (21)

PCI 1.x: Top Firewall Originated Or Destined Permitted Connections By Count: Ranks the firewall originated or destined

connections – these connections would be typically be for administrative and monitoring purposes PCI 5.x: Top Reporting Security Management Servers:

PCI 1.x: Virus found but not remediated by Host Antivirus: Captures events that indicate the viruses that Host Antivirus found but failed to remedy

PCI 5.x: Spyware found but not remediated by Host Antivirus:

PCI 5.x: Top hosts with Malware found by Host Antivirus:

PCI 5.x: Top IPs with Malware Found By IPS and Firewalls: Tracks IP addresses with Malware as found by IPS

PCI 5.x: Top IPs with Malware Found By Antivirus and Security Gateways: Tracks IP addresses with Malware as found by Host Anti-virus and Security Gateways

PCI 5.x: Non-compliant Hosts and Security Software License Expirations: Tracks non-compliant hosts and license expiry events from Security Management Gateways and Firewalls. Non-compliant hosts may not have proper security software running and therefore may pose a security threat. License expiration of security software may expose exploitable security vulnerabilities.

PCI 8.x,10.x: Detailed Successful Login At PCI Device: Captures detailed successful logins at any device or application including servers, network devices, domain controllers, VPN gateways, WLAN controllers and applications

PCI 8.x: Windows Server Account Lockouts: This report captures account lockouts on windows servers. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation

PCI 8.x: Windows Domain Account Lockouts: This report details windows domain account lockouts

PCI 8.x: Windows Server Account Lock/Unlock history: Captures account lockouts and unlocks on windows servers. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.

PCI 8.x: Domain Account Lock/Unlock history: Captures account lockouts and unlocks on domain accounts. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.

PCI 8.x: Server Password Changes: Tracks password changes

PCI 8.x: Local Windows User Accounts Created: This report captures user accounts added on a server

PCI 8.x: Local Windows User Accounts Deleted: This report captures user accounts removed from a server PCI 8.x: Local Windows User Accounts Modified: This report captures local user account modifications.

PCI 8.x: Users Added To Local Groups: This report captures users added to local groups.

PCI 8.x: Users Added To Global Groups: This report captures users added to global or univeral groups.

PCI 8.x: Users Deleted From Local Groups: This report captures users deleted from local groups.

PCI 8.x: Users Deleted From Global Groups: This report captures users deleted from global or univeral groups.

PCI 8.x: Local Windows Groups Deleted: This report captures local group deletions

PCI 8.x: Local Windows Groups Modified: This report captures local group modifications

PCI 8.x: Local Windows Groups Created: This report captures local group creations

PCI 8.x: Global Windows Groups Created: This report captures global group creations

PCI 8.x: Global Windows Groups Deleted: This report captures global group deletions

PCI 8.x: Global Windows Groups Modified: This report captures global group modifications

PCI 10.x: Detailed Failed Login At PCI System: Captures detailed failed logins at any device or application – servers, network devices, domain controllers, VPN gateways, WLAN controllers and applications

PCI 10.x: Privileged Windows Server Logon Attempts using the Administrator Account: This report details prvileged logon attempts to a windows server using the Administrator account

PCI 10.x: Remote Desktop Connections to Windows Servers: This report details successful and failed remote desktop connections PCI 10.x: Unix Server Privileged Logon: This report details UNIX server privileged logon (su) details with all parsed parameters and raw logs

PCI 10.x: Unix Server Privileged Command Execution: This report details privilege command execuations (sudo) at a Unix server

PCI 10.x: Successful Firewall Admin Logon Details: Details about successful firewall logons

PCI 10.x: Failed Firewall Admin Logon Details: Details about failed firewall logons

PCI 10.x: Successful Router Admin Logon Details: Details about successful router logons

PCI 10.x: Failed Router Admin Logon Details: Details about failed router logons

PCI 10.x: Successful VPN Admin Logon: Provides event details for all successful VPN admin logons

PCI 10.x: Failed VPN Admin Logon: Provides event details for all failed VPN admin logons

PCI 10.x: Successful WLAN Admin Logon: Tracks successful admin logons to the WLAN Controller

PCI 10.x: Failed WLAN Admin Logon: Tracks failed admin logons to the WLAN Controller

PCI 10.x: Network Device Down/Restart: Tracks network device down and restart events

PCI 10.x: Server Down/Restart: Tracks server down and restart events

PCI 10.x: Application Down/Restart: Tracks application stop and start events

PCI 10.x: Network Device Link Module Down/Up: Tracks network device miscellaneous module (e.g. fan, power etc.) down/up events

PCI 10.x: Network Device Errors: Tracks errors reported by network device

COBIT

COBIT AI2.4: Successful Database Server Logon Details: Captures successful database server logons

COBIT AI2.4: Failed Database Server Logon Details: Captures failed database server logons

COBIT AI2.4: Top App Servers By Current Uptime: Ranks App servers by current uptime (i.e. time since last reboot)

COBIT AI2.5: Server Installed Software Changes: This report captures detected installed software changes

COBIT DS3.x: Top Devices By CPU Util: Ranks the devices by average cpu utilization over a window

COBIT DS3.x: Top Devices By Memory Util: Ranks the devices by average memory utilization over a window

COBIT DS3.x: Top Devices By Disk Util: Ranks the devices by average system disk utilization over a window

COBIT DS3.x: Top Firewalls By Connections: Ranks the firewalls by average connection count over a window. The ratio of the connection count to the max connection count since startup is also provided. If the ratio is close 1 and the firewall is up for a long time, the the firewall must be busy from a firewalled connection point of view.

COBIT DS3.x: Top Device Intf By Util, Error, Discards: Ranks the devices and their network interfaces by first average inbound and then by outbound interface utilization. The utilization is computed by accounting for the link bandwidth.

COBIT DS3.x: Top Server Apps By CPU, Mem Util: Ranks the server processes by first average cpu utilization and then by memory utilization over a window

COBIT DS3.x: Top Network Device Processes By CPU, Mem Util: Ranks the host processes by average cpu utilization over a window COBIT DS3.x: Top App Servers By CPU Usage With Other Performance Metrics: Ranks App servers by the amount of CPU usage this report provides details on other performance aspects such as memory, threads and classes

COBIT DS3.x: All devices under performance monitoring: Captures all devices under performance monitoring

COBIT DS4.x: Device Ping Monitor Statistics: Tracks the PING response times and packet loss for the monitored devices

COBIT DS4.x: Network Device Down/Restart: Tracks network device down and restart events

COBIT DS4.x: Server Down/Restart: Tracks server down and restart events

COBIT AI2.4,DS4.x: Application Down/Restart: Tracks application stop and start events

COBIT DS4.x: Network Device Failover: Tracks network device failovers

COBIT DS4.x: Network Device Interface Down/Up: Tracks network device interface down and up events

COBIT AI2.4,DS4.x: Server Interface Down/Up: Tracks server network interface down and up events

COBIT DS4.x: Network Device License Expiry: Tracks network device license expiry events

COBIT DS4.x: Application License Expiry: Tracks application license expiry events

COBIT DS4.x: Network Device Link Module Down/Up: Tracks network device miscellaneous module (e.g. fan, power etc.) down/up events

COBIT DS4.x: Top Network Devices, Errors By Count: Ranks network devices by reported error count

COBIT DS4.x: Top Devices by Accumulated Downtime: Ranks the devices by total system downtime over the last week

COBIT AI2.4,DS4.x: Top Applications By Response Time: Ranks the services by average application level probe response times COBIT DS5.4: Windows Server Account Lock/Unlock history: Captures account lockouts and unlocks on windows servers. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.

COBIT DS5.4: Domain Account Lock/Unlock history: Captures account lockouts and unlocks on domain accounts. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.

COBIT DS5.4: Server Password Changes: Tracks password changes

COBIT DS5.4: Local Windows User Accounts Created: This report captures user accounts added on a server

COBIT DS5.4: Local Windows User Accounts Deleted: This report captures user accounts removed from a server COBIT DS5.4: Local Windows User Accounts Modified: This report captures local user account modifications.

COBIT DS5.4: Users Added To Local Windows User Groups: This report captures users added to local groups.

COBIT DS5.4: Users Added To Global Windows User Groups: This report captures users added to global or univeral groups.

COBIT DS5.4: Users Deleted From Local Windows User Groups: This report captures users deleted from local groups.

COBIT DS5.4: Users Deleted From Global Windows User Groups: This report captures users deleted from global or univeral groups.

COBIT DS5.4: Local Windows Groups Deleted: This report captures local group deletions

COBIT DS5.4: Local Windows Groups Modified: This report captures local group modifications

COBIT DS5.4: Local Windows Groups Created: This report captures local group creations

COBIT DS5.4: Global Windows Groups Created: This report captures global group creations

COBIT DS5.4: Global Windows Groups Deleted: This report captures global group deletions

COBIT DS5.4: Global Windows Groups Modified: This report captures global group modifications

COBIT DS5.4: Unix Users Added To Group: Tracks user additions to groups

COBIT DS5.4: Unix User Password Changed: Tracks password changes

COBIT DS5.5: Privileged Windows Server Logon Attempts using the Administrator Account: This report details prvileged logon attempts to a windows server using the Administrator account

COBIT DS5.5: Remote Desktop Connections to Windows Servers: This report details successful and failed remote desktop connections

COBIT DS5.5: Unix Server Privileged Logon: This report details UNIX server privileged logon (su) details with all parsed parameters and raw logs

COBIT DS5.5: Unix Server Privileged Command Execution: This report details privilege command execuations (sudo) at a Unix server

COBIT DS5.5: Successful Firewall Admin Logon Details: Details about successful firewall logons

COBIT DS5.5: Failed Firewall Admin Logon Details: Details about failed firewall logons

COBIT DS5.5: Successful Router Admin Logon Details: Details about successful router logons

COBIT DS5.5: Failed Router Admin Logon Details: Details about failed router logons

COBIT DS5.5: Successful VPN Admin Logon: Provides event details for all successful VPN admin logons

COBIT DS5.5: Failed VPN Admin Logon: Provides event details for all failed VPN admin logons

COBIT DS5.5: Successful WLAN Admin Logon: Tracks successful admin logons to the WLAN Controller

COBIT DS5.5: Failed WLAN Admin Logon: Tracks failed admin logons to the WLAN Controller

COBIT DS5.6: Top Incidents Ranked By Severity, Count: Ranks the incidents by first their severity and then by their count.

COBIT DS5.6: All Availability Incidents: Captures the availability incidents

COBIT DS5.6: Performance Incidents: Captures the performance related incidents

COBIT DS5.6: Security Incidents: Captures the security related incidents

COBIT DS5.9: Virus found but not remediated by Host Antivirus: Captures events that indicate the viruses that Host Antivirus found but failed to remedy

COBIT DS5.9: Spyware found but not remediated by Host Antivirus:

COBIT DS5.9: Top Hosts with Malware found by Host Antivirus:

COBIT DS5.9: Top Hosts with Malware Found By Network IPS and Firewalls: Tracks IP addresses with Malware as found by IPS

COBIT DS5.9: Top Hosts with Malware Found By Antivirus and Security Gateways: Tracks IP addresses with Malware as found by Host Anti-virus and Security Gateways

COBIT DS5.9: Non-compliant Hosts and Security Software License Expirations: Tracks non-compliant hosts and license expiry events from Security Management Gateways and Firewalls. Non-compliant hosts may not have proper security software running and therefore may pose a security threat. License expiration of security software may expose exploitable security vulnerabilities.

COBIT DS5.10: Top Firewalls and Permitted Outbound Services By Connections, Bytes: Ranks firewalls and permitted outbound services by first the total number of connections and then by bytes for that service

COBIT DS5.10: Top Firewalls and Permitted Inbound Services By Connections, Bytes: Ranks firewalls and permitted inbound services by first the total number of connections and then by bytes for that service

COBIT DS5.10: Top Firewalls and Permitted High Port Services By Connections, Bytes: Tracks the high port services permitted by firewalls – these services may pose security risk

COBIT DS5.10: Top Firewalls and Permitted Uncommon Services By Connections, Bytes: Tracks uncommon services permitted by firewalls – common services include DNS, SMTP, Web

COBIT DS5.10: Top Firewalls and Permitted Vulnerable Low Port Services By Connections, Bytes: Tracks uncommon services permitted by firewalls – vulnerable services include Microsoft services such as MS-RPC (135), NETBIOS-SSN (139), MICROSOFT-DS (445), MS-SQL (1433,1434), FTP (23), TELNET (21)

COBIT DS5.10: Top Firewall Originated Or Destined Permitted Connections By Count: Ranks the firewall originated or destined connections – these connections would be typically be for administrative and monitoring purposes

COBIT DS5.10: Top Blocked Internal Sources, Services, Destinations: Ranks blocked Internal Sources, Services, Destinations Ranked By Connection Count

COBIT DS5.10: Top Blocked Internal Destinations, Services Ranked By Connection Count: Ranks blocked Internal Destinations, Services Ranked By Connection Count

COBIT DS5.10: Top Network IPS events By Severity, Count: Ranks the network IPS events by count

COBIT DS5.10: Top Network Scanners By Event Count: Ranks the source IP addresses by detected network scan or reconnaissance events

COBIT DS5.10: Top Blocked Network Attacks By Count: Ranks the network attacks attacks blocked by network IPS

COBIT DS5.10: Top Web Users By Uncommon HTTP Method Connections: Ranks web users by uncommon HTTP methods used COBIT DS5.10: Top Web Users By HTTP POST Exchanged Bytes: Ranks web clients by HTTP POST byte count – can catch malware sending confidential information out

COBIT DS5.10: Top Visited Web Sites And Categories By Connections: Ranks (successfully) visited web sites and categories by the number of connections

COBIT DS5.10: Top Denied Web Sites And Categories By Connections: Ranks web sites and categories that were denied by policy, by the number of connections

COBIT DS5.10: Top Web Users, Denied Sites And Categories By Connections: Ranks users, web sites and categories that were denied by policy, by the number of connections

COBIT DS5.10: Top Inbound Blacklisted Mail Gateways By Connections: Ranks denied mail gateways by the number of attempted SMTP connections. The most common reason of denial is often the gateway being included in blacklists.

COBIT DS5.10: Top Inbound Blacklisted Mail Gateways and SMTP Error Types By Connections: Ranks denied mail gateways and the SMTP errors by the number of attempted connections. The most common SMTP error is often the gateway being included in mail blacklists.

COBIT DS5.10: Filtered Inbound Spam Count: Counts total inbound spam denied by spam filtering policy

COBIT DS5.10: Top Outbound Blacklisted Mail Gateways By Connections: Ranks denied mail gateways by the number of attempted SMTP connections. The most common reason of denial is often the gateway being included in blacklists.

COBIT DS5.10: Top Outbound Blacklisted Mail Gateways and SMTP Error Types By Connections: Ranks denied mail gateways and the SMTP errors by the number of attempted connections. The most common SMTP error is often the gateway being included in mail blacklists.

COBIT DS5.10: Filtered Outbound Spam Count: Counts total outbound spam denied by policy

COBIT DS5.10: Total Denied Web Connections By Policy: Counts denied web site connections because of policy violations

COBIT DS5.10: Top Mail Security Gateway Actions By Count: Ranks the actions taken by the mail security gateway – actions include blocking an inbound/outbound mail gateway because of RBL or other SMTP violations, blocking a mail because of spam or other policy violations and delivering a mail

COBIT DS9.x: Firewall Config Changes Detected Via Login: This report captures detected startup or running config changes – the changes are detected by logging into the device and hence is accurate.

COBIT DS9.x: Firewall Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config

COBIT DS9.x: Router/Switch Config Changes Detected Via Login: This report captures detected startup or running config changes the changes are detected by logging into the device and hence is accurate.

COBIT DS9.x: Firewall Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config

SOX

SOX (AI2.4): Successful Database Server Logons: Captures successful database server logons

SOX (AI2.4): Failed Database Server Logons: Captures failed database server logons

SOX (AI2.4,DS4.x): Top Applications By Response Time: Ranks the services by average application level probe response times

SOX (AI2.4): Top App Servers By Current Uptime: Ranks App servers by current uptime (i.e. time since last reboot)

SOX (AI2.4,DS4.x): Application Down/Restart: Tracks application stop and start events

SOX (AI2.4,DS4.x): Server Interface Down/Up: Tracks server network interface down and up events

SOX (AI2.5): Server Installed Software Changes: This report captures detected installed software changes

SOX (DS3.x): Top Devices By CPU Util: Ranks the devices by average cpu utilization over a window

SOX (DS3.x): Top Devices By Memory Util: Ranks the devices by average memory utilization over a window

SOX (DS3.x): Top Devices By Disk Util: Ranks the devices by average system disk utilization over a window

SOX (DS3.x): Top Firewalls By Connections: Ranks the firewalls by average connection count over a window. The ratio of the connection count to the max connection count since startup is also provided. If the ratio is close 1 and the firewall is up for a long time, the the firewall must be busy from a firewalled connection point of view.

SOX (DS3.x): Top Device Intf By Util, Error, Discards: Ranks the devices and their network interfaces by first average inbound and then by outbound interface utilization. The utilization is computed by accounting for the link bandwidth.

SOX (DS3.x): Top Server Apps By CPU, Mem Util: Ranks the server processes by first average cpu utilization and then by memory utilization over a window

SOX (DS3.x): Top Network Device Processes By CPU, Mem Util: Ranks the host processes by average cpu utilization over a window SOX (DS3.x): Top App Servers By CPU Usage With Other Performance Metrics: Ranks App servers by the amount of CPU usage this report provides details on other performance aspects such as memory, threads and classes

COBIT DS5.6: All Availability Incidents: Captures the availability incidents

SOX (DS5.6): Performance Incidents: Captures the performance related incidents

SOX (DS3.x): All devices under performance monitoring: Captures all devices under performance monitoring

SOX (DS5.4): Windows Server Account Lock/Unlock history: Captures account lockouts and unlocks on windows servers. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.

SOX (DS5.4,PCI1.x)): Domain Account Lock/Unlock history: Captures account lockouts and unlocks on domain accounts. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.

SOX (DS5.4,PCI1.x): Server Password Changes: Tracks password changes

SOX (DS5.4,PCI1.x): Local Windows User Accounts Created: This report captures user accounts added on a server

SOX (DS5.4,PCI1.x): Local Windows User Accounts Deleted: This report captures user accounts removed from a server SOX (DS5.4,PCI1.x): Local Windows User Accounts Modified: This report captures local user account modifications.

SOX (DS5.4,PCI1.x): Users Added To Local Windows User Groups: This report captures users added to local groups.

SOX (DS5.4): Users Added To Global Windows User Groups: This report captures users added to global or univeral groups.

SOX (DS5.4,PCI1.x): Users Deleted From Local Windows User Groups: This report captures users deleted from local groups. SOX (DS5.4,PCI1.x): Users Deleted From Global Windows User Groups: This report captures users deleted from global or univeral groups.

SOX (DS5.4,PCI1.x): Local Windows Groups Deleted: This report captures local group deletions

SOX (DS5.4,PCI1.x): Local Windows Groups Modified: This report captures local group modifications

SOX (DS5.4,PCI1.x): Local Windows Groups Created: This report captures local group creations

SOX (DS5.4,PCI1.x): Global Windows Groups Created: This report captures global group creations

SOX (DS5.4,PCI1.x): Global Windows Groups Deleted: This report captures global group deletions

SOX (DS5.4,PCI1.x): Global Windows Groups Modified: This report captures global group modifications

SOX (DS5.4,PCI1.x): Unix Users Added To Group: Tracks user additions to groups

SOX (DS5.4,PCI1.x): Unix User Password Changed: Tracks password changes

SOX (DS5.5,PCI1.x): Privileged Windows Server Logon Attempts using the Administrator Account: This report details prvileged

logon attempts to a windows server using the Administrator account

SOX (DS5.5,PCI1.x): Remote Desktop Connections to Windows Servers: This report details successful and failed remote desktop connections

SOX (DS5.5,PCI1.x): Unix Server Privileged Logon: This report details UNIX server privileged logon (su) details with all parsed parameters and raw logs

SOX (DS5.5,PCI1.x): Unix Server Privileged Command Execution: This report details privilege command execuations (sudo) at a Unix server

COBIT DS5.5: Successful Firewall Admin Logon Details: Details about successful firewall logons

COBIT DS5.5: Failed Firewall Admin Logon Details: Details about failed firewall logons

SOX (DS5.5,PCI1.x): Successful Router Admin Logon Details: Details about successful router logons

SOX (DS5.5,PCI1.x): Failed Router Admin Logon Details: Details about failed router logons

SOX (DS5.5,PCI1.x): Successful VPN Admin Logon: Provides event details for all successful VPN admin logons

SOX (DS5.5,PCI1.x): Failed VPN Admin Logon: Provides event details for all failed VPN admin logons

SOX (DS5.5,PCI1.x): Successful WLAN Admin Logon: Tracks successful admin logons to the WLAN Controller

SOX (DS5.5,PCI1.x): Failed WLAN Admin Logon: Tracks failed admin logons to the WLAN Controller

SOX (DS5.6): Security Incidents: Captures the security related incidents

SOX (DS5.9): Virus found but not remediated by Host Antivirus: Captures events that indicate the viruses that Host Antivirus found but failed to remedy

SOX (DS5.9): Spyware found but not remediated by Host Antivirus:

SOX (DS5.9): Top Hosts with Malware found by Host Antivirus:

SOX (DS5.9): Top Hosts with Malware Found By Network IPS and Firewalls: Tracks IP addresses with Malware as found by IPS

SOX (DS5.9): Top Hosts with Malware Found By Antivirus and Security Gateways: Tracks IP addresses with Malware as found by Host Anti-virus and Security Gateways

SOX (DS5.9): Non-compliant Hosts and Security Software License Expirations: Tracks non-compliant hosts and license expiry events from Security Management Gateways and Firewalls. Non-compliant hosts may not have proper security software running and therefore may pose a security threat. License expiration of security software may expose exploitable security vulnerabilities.

SOX (DS5.10): Top Firewalls and Permitted Outbound Services By Connections, Bytes: Ranks firewalls and permitted outbound services by first the total number of connections and then by bytes for that service

SOX (DS5.10): Top Firewalls and Permitted Inbound Services By Connections, Bytes: Ranks firewalls and permitted inbound services by first the total number of connections and then by bytes for that service

SOX (DS5.10): Top Firewalls and Permitted High Port Services By Connections, Bytes: Tracks the high port services permitted by firewalls – these services may pose security risk

SOX (DS5.10): Top Firewalls and Permitted Uncommon Services By Connections, Bytes: Tracks uncommon services permitted by firewalls – common services include DNS, SMTP, Web

SOX (DS5.10): Top Firewalls and Permitted Vulnerable Low Port Services By Connections, Bytes: Tracks uncommon services permitted by firewalls – vulnerable services include Microsoft services such as MS-RPC (135), NETBIOS-SSN (139), MICROSOFT-DS (445), MS-SQL (1433,1434), FTP (23), TELNET (21)

SOX (DS5.10): Top Firewall Originated Or Destined Permitted Connections By Count: Ranks the firewall originated or destined connections – these connections would be typically be for administrative and monitoring purposes

SOX (DS5.10): Top Blocked Internal Sources, Services, Destinations: Ranks blocked Internal Sources, Services, Destinations Ranked By Connection Count

SOX (DS5.10): Top Blocked Internal Destinations, Services Ranked By Connection Count: Ranks blocked Internal Destinations, Services Ranked By Connection Count

SOX (DS5.10): Top Network IPS events By Severity, Count: Ranks the network IPS events by count

SOX (DS5.10): Top Network Scanners By Event Count: Ranks the source IP addresses by detected network scan or reconnaissance events

SOX (DS5.10): Top Blocked Network Attacks By Count: Ranks the network attacks attacks blocked by network IPS

SOX (DS5.10): Top Web Users By Uncommon HTTP Method Connections: Ranks web users by uncommon HTTP methods used SOX (DS5.10): Top Web Users By HTTP POST Exchanged Bytes: Ranks web clients by HTTP POST byte count – can catch malware sending confidential information out

SOX (DS5.10): Top Visited Web Sites And Categories By Connections: Ranks (successfully) visited web sites and categories by the number of connections

SOX (DS5.10): Top Denied Web Sites And Categories By Connections: Ranks web sites and categories that were denied by policy, by the number of connections

SOX (DS5.10): Top Web Users, Denied Sites And Categories By Connections: Ranks users, web sites and categories that were denied by policy, by the number of connections

SOX (DS5.10): Top Inbound Blacklisted Mail Gateways By Connections: Ranks denied mail gateways by the number of attempted SMTP connections. The most common reason of denial is often the gateway being included in blacklists.

SOX (DS5.10): Top Inbound Blacklisted Mail Gateways and SMTP Error Types By Connections: Ranks denied mail gateways and the SMTP errors by the number of attempted connections. The most common SMTP error is often the gateway being included in mail blacklists.

SOX (DS5.10): Filtered Inbound Spam Count: Counts total inbound spam denied by spam filtering policy

SOX (DS5.10): Top Outbound Blacklisted Mail Gateways By Connections: Ranks denied mail gateways by the number of attempted SMTP connections. The most common reason of denial is often the gateway being included in blacklists.

SOX (DS5.10): Top Outbound Blacklisted Mail Gateways and SMTP Error Types By Connections: Ranks denied mail gateways and the SMTP errors by the number of attempted connections. The most common SMTP error is often the gateway being included in mail blacklists.

SOX (DS5.10): Filtered Outbound Spam Count: Counts total outbound spam denied by policy

SOX (DS5.10): Total Denied Web Connections By Policy: Counts denied web site connections because of policy violations

SOX (DS5.10): Top Mail Security Gateway Actions By Count: Ranks the actions taken by the mail security gateway – actions include blocking an inbound/outbound mail gateway because of RBL or other SMTP violations, blocking a mail because of spam or other policy violations and delivering a mail

SOX (DS9.x): Firewall Config Changes Detected Via Login: This report captures detected startup or running config changes – the changes are detected by logging into the device and hence is accurate.

SOX (DS9.x): Firewall Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config

SOX (DS9.x): Router/Switch Config Changes Detected Via Login: This report captures detected startup or running config changes the changes are detected by logging into the device and hence is accurate.

SOX (DS9.x): Firewall Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config

HIPAA

HIPAA 164.308(a)(3): Server Password Changes: Tracks password changes

HIPAA 164.308(a)(3),164.312(a)(2): Local Windows User Accounts Created: This report captures user accounts added on a server HIPAA 164.308(a)(3): Local Windows User Accounts Deleted: This report captures user accounts removed from a server HIPAA 164.308(a)(3): Local Windows User Accounts Modified: This report captures local user account modifications.

HIPAA 164.308(a)(3): Users Added To Local Groups: This report captures users added to local groups.

HIPAA 164.308(a)(3): Users Added To Global Groups: This report captures users added to global or univeral groups.

HIPAA 164.308(a)(3): Users Deleted From Local Groups: This report captures users deleted from local groups.

HIPAA 164.308(a)(3): Users Deleted From Global Groups: This report captures users deleted from global or univeral groups.

HIPAA 164.308(a)(3): Local Windows Groups Deleted: This report captures local group deletions

HIPAA 164.308(a)(3): Local Windows Groups Modified: This report captures local group modifications

HIPAA 164.308(a)(3): Local Windows Groups Created: This report captures local group creations

HIPAA 164.308(a)(3): Global Windows Groups Created: This report captures global group creations

HIPAA 164.308(a)(3): Global Windows Groups Deleted: This report captures global group deletions

HIPAA 164.308(a)(3): Global Windows Groups Modified: This report captures global group modifications

HIPAA 164.308(a)(4): Firewall Config Changes Detected Via Login: This report captures detected startup or running config changes the changes are detected by logging into the device and hence is accurate.

HIPAA 164.308(a)(4): Router Config Changes Detected Via Login: This report captures detected startup or running config changes the changes are detected by logging into the device and hence is accurate.

HIPAA 164.308(a)(4): Router Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config

HIPAA 164.308(a)(4): Top Firewalls and Outbound Permitted Services By Connections, Bytes: Ranks firewalls and permitted outbound services by first the total number of connections and then by bytes for that service

HIPAA 164.308(a)(4): Top Firewalls and Inbound Permitted Services By Connections, Bytes: Ranks firewalls and permitted inbound services by first the total number of connections and then by bytes for that service

HIPAA 164.308(a)(4): Top Firewalls and Permitted High Port Services By Connections, Bytes: Tracks the high port services permitted by firewalls – these services may pose security risk

HIPAA 1.x: Top Firewalls and Permitted Uncommon Services By Connections, Bytes: Tracks uncommon services permitted by firewalls – common services include DNS, SMTP, Web

HIPAA 164.308(a)(4): Top Firewalls and Permitted Vulnerable Low Port Services By Connections, Bytes: Tracks uncommon services permitted by firewalls – vulnerable services include Microsoft services such as MS-RPC (135), NETBIOS-SSN (139),

MICROSOFT-DS (445), MS-SQL (1433,1434), FTP (23), TELNET (21)

HIPAA 164.308(a)(4): Top Firewall Originated Or Destined Permitted Connections By Count: Ranks the firewall originated or destined connections – these connections would be typically be for administrative and monitoring purposes

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c),164.312(a)(2): Detailed Successful Login At HIPAA Device: Captures detailed successful logins at any device or application including servers, network devices, domain controllers, VPN gateways, WLAN controllers and applications

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c),164.312(a)(2): Detailed Failed Login At HIPAA System: Captures detailed failed logins at any

device or application – servers, network devices, domain controllers, VPN gateways, WLAN controllers and applications

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Successful Firewall Admin Logon Details: Details about successful firewall logons

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Failed Firewall Admin Logon Details: Details about failed firewall logons

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Successful Router Admin Logon Details: Details about successful router logons

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Failed Router Admin Logon Details: Details about failed router logons

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Successful VPN Admin Logon: Provides event details for all successful VPN admin logons

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Failed VPN Admin Logon: Provides event details for all failed VPN admin logons

HIPAA 10.x: Successful WLAN Admin Logon: Tracks successful admin logons to the WLAN Controller

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Failed WLAN Admin Logon: Tracks failed admin logons to the WLAN Controller HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Privileged Windows Server Logon Attempts using the Administrator Account: This report details prvileged logon attempts to a windows server using the Administrator account

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Remote Desktop Connections to Windows Servers: This report details successful and failed remote desktop connections

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c),164.312(a)(2): Successful Windows Server Logons: This report records successful windows server logons

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c),164.312(a)(2): Failed Windows Server Logons: This report reports failed windows servers logons

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c),164.312(a)(2): Successful Unix Server Logons: This report details successful unix server logons with all parsed fields and raw logs

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c),164.312(a)(2): Failed Unix Server Logons: This report details failed unix server logons with all parsed fields and raw logs

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Unix Server Privileged Logon: This report details UNIX server privileged logon (su) details with all parsed parameters and raw logs

HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Unix Server Privileged Command Execution: This report details privilege command execuations (sudo) at a Unix server

HIPAA 164.308(a)(5)(ii)(c): Windows Server Account Lockouts: This report captures account lockouts on windows servers. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation HIPAA 164.308(a)(5)(ii)(c): Windows Server Account Unlocks: Captures account unlocks on windows servers. Account unlocks happen after lockouts that may happen on repeated login failures

HIPAA 164.308(a)(5): Server Password Changes: Tracks password changes

HIPAA 164.308(a)(6): Virus found but not remediated by Host Antivirus: Captures events that indicate the viruses that Host Antivirus found but failed to remedy

HIPAA 164.308(a)(6): Spyware found but not remediated by Host Antivirus:

HIPAA 164.308(a)(6): Top hosts with Malware found by Host Antivirus:

HIPAA 164.308(a)(6): Top IPs with Malware Found By IPS and Firewalls: Tracks IP addresses with Malware as found by IPS HIPAA 164.308(a)(6): Top IPs with Malware Found By Antivirus and Security Gateways: Tracks IP addresses with Malware as found by Host Anti-virus and Security Gateways

HIPAA 164.308(a)(6): Non-compliant Hosts and Security Software License Expirations: Tracks non-compliant hosts and license expiry events from Security Management Gateways and Firewalls. Non-compliant hosts may not have proper security software running and therefore may pose a security threat. License expiration of security software may expose exploitable security vulnerabilities. HIPAA 164.308(a)(6): Top Network Scanners By Event Count: Ranks the source IP addresses by detected network scan or reconnaissance events

HIPAA 164.308(a)(6): Top Blocked Network Attacks By Count: Ranks the network attacks attacks blocked by network IPS HIPAA 164.308(a)(6): Top Network IPS events (affecting HIPAA devices) Ranked By Severity, Count: Ranks the network IPS events affecting HIPAA devices

HIPAA 164.308(a)(6): Top System detected Security Incidents (affecting HIPAA devices) Ranked By Severity, Count: Ranks the security related incidents by first their severity and then by their count – restricted to HIPAA devices

HIPAA 164.312(a)(2): Successful VPN Logons: Captures successful VPN logons

HIPAA 164.312(a)(2): Failed VPN Logons: Captures failed VPN logons

HIPAA 164.312(a)(2): Successful Wireless Logons: Captures successful wireless logons

HIPAA 164.312(a)(2): Failed Wireless Logons: Captures failed wireless logons

HIPAA 164.312(a)(2): Successful Windows Domain Authentications: Captures successful domain authentications

HIPAA 164.312(a)(2): Failed Windows Domain Authentications: Captures failed domain authentications

HIPAA 164.312(a)(2): Successful Database Server Logons: Captures successful database server logons

HIPAA 164.312(a)(2): Failed Database Server Logons: Captures failed database server logons

HIPAA 164.312(b): Windows Audit Policy Changed: This report captures audit policy changes

HIPAA 164.312(b): All System Admin User Logon Attempts: Details all System Admin User Logon Attempts

HIPAA 164.312(b): System Operational Warnings: Detects System operational errors including license limits, down collector

Performance related

Network Performance Rules

Network Performance Reports

Top Routers Ranked By CPU Utilization: Ranks the routers by average cpu utilization over a window

Top Router Network Intf By Util, Error, Discards: Ranks the firewalls and their network interfaces by first average inbound and then by outbound interface utilization. The utilization is computed by accounting for the link bandwidth.

Top Routers By Memory Utilization: Ranks the firewalls by average memory utilization over a window

Top Firewalls By CPU Utilization: Ranks the firewalls by average cpu utilization over a window

Top Firewalls By Connection Count: Ranks the firewalls by average connection count over a window. The ratio of the connection count to the max connection count since startup is also provided. If the ratio is close 1 and the firewall is up for a long time, the the firewall must be busy from a firewalled connection point of view.

Top Firewall Network Intf By Util, Error, Discards: Ranks the firewalls and their network interfaces by first average inbound and then by outbound interface utilization. The utilization is computed by accounting for the link bandwidth.

Top Firewalls By Memory Utilization: Ranks the firewalls by average memory utilization over a window

Server Performance Rules

Server Performance Reports

Top Windows Servers By CPU Util: Ranks the windows servers by average cpu utilization over a window

Top Windows Servers By Memory Util and swap rate: Ranks the devices by average memory utilization and swap rate

Least Loaded Windows Servers By CPU Util: Ranks the windows servers by average cpu utilization over a window

Top Windows Servers By Disk I/O Activity: Ranks the windows servers by average disk I/O utilization over a window. This requires WMI.

Top Windows Servers By Disk Space Util: Ranks the devices by average system disk utilization over a window

Top Unix Devices By CPU Util: Ranks the devices by average cpu utilization

Top Unix Devices By Memory Util and Swap Rate: Ranks the unix devices by average memory utilization over a window and provides details of memory utilization components such as buffered and cached memory

Top Unix Devices By Disk Space Util: Ranks the devices by average system disk utilization over a window

Top Unix Servers By Disk I/O Activity: Ranks the unix servers by average disk I/O utilization over a window

Virtualization Performance Rules

Virtualization Performance Reports

VM level

Performance: Top VMs By CPU Utilization: This report ranks virtual machines by cpu utilization

Performance: Top VMs By CPU Utilization With Details: This report ranks virtual machines by cpu utilization. Other CPU usage metrics are included.

Performance: Top VMs By CPU Ready Pct: This report ranks virtual machines by cpu ready percent. A high number indicates the VMis starved of CPU

Performance: Least utilized VMs By CPU: This report ranks virtual machines in the descending order of cpu utilization

Performance: Top VMs By Memory Utilization With Details: This report ranks virtual machines by memory utilization. Other memory usage metrics are included.

Performance: Top VMs By Swap Activity: This report ranks virtual machines by swapping activity

Performance: Top VMs By Memory Utilization: This report ranks virtual machines by memory utilization

Performance: Top VMs By Disk I/O Activity With Details: This report ranks virtual machines by disk I/O activity. Other disk I/O usage metrics are included.

Performance: Top VMs By Disk I/O Read Latency: This report ranks virtual machines by disk I/O latency

Performance: Top VMs By Disk I/O Write Latency: This report ranks virtual machines by disk I/O latency

Performance: Top VMs By Disk I/O Read Volume (MBps): This report ranks virtual machines by disk I/O read (MBps)

Performance: Top VMs By Disk I/O Write Volume (MBps): This report ranks virtual machines by disk I/O writes (MBps)

Performance: Top VMs By Datastore I/O Activity With Details: This report ranks virtual machines by datastore I/O activity. Other datastore I/O usage metrics are included.

Performance: Top VMs By Datastore I/O Read Latency: This report ranks virtual machines by datastore I/O latency

Performance: Top VMs By Datastore I/O Write Latency: This report ranks virtual machines by datastore I/O latency

Performance: Top VMs By Datastore I/O Read Volume (MBps): This report ranks virtual machines by datastore I/O read (MBps)

Performance: Top VMs By Datastore I/O Write Volume (MBps): This report ranks virtual machines by datastore I/O writes (MBps)

ESX level

Performance: Top ESX Hosts By CPU Utilization: This report ranks ESX hosts by aggregate cpu utilization. Other CPU usage metrics are included.

Performance: Top ESX Hosts By Memory Utilization With Details: This report ranks ESX hosts by memory utilization. Other memory usage metrics are included.

Performance: Top ESX Hosts By Memory Utilization: This report ranks ESX hosts by memory utilization.

Performance: Top ESX Hosts By Swap Activity: This report ranks ESX hosts by swap activity

Performance: ESX Hosts With Balooning Memory: This report identifies ESX hosts with low enough memory where memory balooning technique is used for memory management

Performance: ESX Hosts With Swapping Memory: This report identifies ESX hosts with low memory where swapping memory technique is used for memory management

Performance: Top ESX Hosts By Disk I/O Activity With Details: This report ranks ESX hosts by disk I/O operations. Other disk I/O usage metrics are included.

Performance: Top ESX Hosts By Disk I/O Read Volume (MBps): This report ranks ESX hosts by read disk I/O (MBps)

Performance: Top ESX Hosts By Disk I/O Write Volume (MBps): This report ranks ESX hosts by write disk I/O (MBps)

Performance: Top ESX Hosts By Disk I/O Latency With Details: This report ranks ESX hosts by disk I/O latency. Other disk I/O usage metrics are included.

Performance: Top ESX Hosts By Kernel Disk I/O Read Latency: This report ranks ESX hosts by kernel disk I/O read latency.

Performance: Top ESX Hosts By Kernel Disk I/O Write Latency: This report ranks ESX hosts by kernel disk I/O write latency. Performance: Top ESX Hosts By Device Disk I/O Read Latency: This report ranks ESX hosts by device disk I/O read latency Performance: Top ESX Hosts By Device Disk I/O Write Latency: This report ranks ESX hosts by device disk I/O write latency.

Performance: Top ESX Hosts By Network Activity With Details: This report ranks ESX hosts by network activity.

Performance: Top ESX Hosts By Inbound Network Utilization: This report ranks ESX hosts by inbound network utilization

Performance: Top ESX Hosts By Outbbound Network Utilization: This report ranks ESX hosts by outbound network utilization

Performance: Datastores with Highest Utilization: This report ranks ESX hosts by datastore utlization

Performance: Datastores with Lowest Free Space: This report ranks ESX datastore with lowest free space

Performance: Top ESX Hosts By Datastore I/O Activity With Details: This report ranks ESX hosts by datsatore I/O operations. Other datastore I/O usage metrics are included.

Performance: Top ESX Hosts By Datastore I/O Read Volume (MBps: This report ranks ESX hosts by read datastore I/O (MBps)

Performance: Top ESX Hosts By Datastore I/O Write Volume (MBps): This report ranks ESX hosts by write datastore I/O (MBps) Performance: Top ESX Hosts By Datastore I/O Latency With Details: This report ranks ESX hosts by datastore I/O latency. Other datastore I/O usage metrics are included.

Performance: Top ESX Hosts By Kernel Datastore I/O Read Latency: This report ranks ESX hosts by kernel datastore I/O read latency.

Performance: Top ESX Hosts By Kernel Datastore I/O Write Latency: This report ranks ESX hosts by kernel datastore I/O write latency.

Performance: Top ESX Hosts By Device Datastore I/O Read Latency: This report ranks ESX hosts by device datastore I/O read latency

Performance: Top ESX Hosts By Device Datastore I/O Write Latency: This report ranks ESX hosts by device datastore I/O write latency.

Cluster level

Performance: Top VMWare Clusters By CPU Utilization: This report ranks VMWare clusters by CPU utilization

Performance: Top VMWare Clusters By Memory Utilization: This report ranks VMWare clusters by memory utilization

Performance: Top VMWare Clusters By Device Datastore Read Latency: This report ranks VMWare clusters by datastore read latency

Performance: Top VMWare Clusters By Device Datastore Write Latency: This report ranks VMWare clusters by datastore write latency

Performance: Top VMWare Clusters By Datastore I/O Activity With Details: This report ranks VMWare Clusters by datsatore I/O operations. Other datastore I/O usage metrics are included.

Performance: Top VMWare Clusters By Datastore I/O Read Volume (MBps): This report ranks ESX hosts by read datastore I/O (MBps)

Performance: Top VMWare Clusters By Datastore I/O Write Volume (MBps): This report ranks ESX hosts by write datastore I/O (MBps)

Performance: Top VMWare Clusters By Datastore I/O Latency With Details: This report ranks ESX hosts by datastore I/O latency.

Other datastore I/O usage metrics are included.

Performance: Top VMWare Clusters By Kernel Datastore I/O Read Latency: This report ranks ESX hosts by kernel datastore I/O read latency.

Performance: Top VMWare Clusters By Kernel Datastore I/O Write Latency: This report ranks ESX hosts by kernel datastore I/O write latency.

Performance: Least Utilized VMWare Clusters By CPU: This report ranks least utilized VMWare clusters by CPU utilization

Performance: Least Utilized VMWare Clusters By Memory: This report ranks least utilized VMWare clusters by memory utilization Performance: Least Utilized VMWare Clusters By Device Datastore Read Latency: This report ranks least utilized VMWare clusters by datastore read latency

Performance: Least Utilized VMWare Clusters By Device Datastore Write Latency: This report ranks least utilized VMWare clusters by datastore write latency

Performance: Least Utilized VMWare Clusters By Disk I/O Read Volume (MBps): This report ranks least utlized VMware clusters by disk I/O read (MBps)

Performance: Least Utilized VMware Clusters By Disk I/O Write Volume (MBps): This report ranks least utilized VMWare clusters by disk I/O write volume (MBps)

Resource pool level

 Performance: Top VMWare Resource Pools By CPU Utilization: This report ranks VMWare resource pools by CPU utilization Performance: Top VMWare Resource Pools By Memory Utilization: This report ranks least utilized VMWare resource pools by memory utilization

Application Performance Reports

Performance: Top Oracle Database servers by buffer cache hit ratio: Ranks the Oracle database servers by buffer cache hit ratio and presents other metrics

Performance: Top Oracle Database servers by table space usage: Ranks the Oracle databases by table space usage

Performance: Top MS SQL Database servers by buffer cache hit ratio: Ranks the MS SQL Servers by buffer cache hit ratio and presents other metrics

Performance: Top MS SQL Database servers by space usage: Ranks the MS SQL Servers by space usage

Security Related Rules and Reports

Security Rules

Access Control Violations

Network Scanning Activity

Malware

Explicit Security Exploits

Policy Violations

Security Reports

Access Control Reports

Malware Reports

Other Security Issues

Network Traffic Analysis

Access Control Violations

Network Device Access

Multiple Admin Login Failures: Net Device: Detects excessive logon failures at a network device – 5 consecutive failures in a 10 minute period.

Repeated Admin Multiple Login Failures: Net Device: Detects repeating occurrences of multiple logon failures at a network device

Account Locked: Network Device: Detects account lockout caused by excessive logon failures

Server Access

Multiple Logon Failures: Server: Detects excessive logon failures at a server – 5 consecutive failures in a 10 minute period

Repeated Multiple Logon Failures: Server: Detects repeating occurrences of multiple logon failures at a server from the same user. Multiple Privileged Logon Failures: Server: Detects excessive privileged logon failures at a server – 3 consecutive failures in a 10 minute period

Account Locked: Server: Detects account lockout caused by excessive logon failures

Network Access

Multiple Logon Failures: Domain: Detects multiple domain logon failures – 5 consecutive failures in a 10 minute period

Repeated Multiple Logon Failures: Domain: Detects repeating occurrences of multiple domain logon failures

Multiple Logon Failures: VPN: Detects multiple VPN logon failures – 5 consecutive failures in a 10 minute period

Repeated Multiple Logon Failures: VPN: Detects repeating occurrences of excessive VPN logon failures

Multiple Logon Failures: WLAN Detects multiple Wireless logon failures – 5 consecutive failures in a 10 minute period

Repeated Multiple Logon Failures: WLAN: Detects repeating occurrences of excessive wireless LAN logon failures

Account Locked: Domain: Detects account lockout caused by excessive logon failures

Application Access

Multiple Logon Failures: Web Server: Detects excessive application logon failures – 5 consecutive failures in a 10 minute period. Application logsons include the one that may require authentication for accessing the authentication, such as HTTP, SNMP, FTP, POP3, IMAP etc.

Repeated Multiple Logon Failures: Web Server: Detects repeating occurrences of multiple application logon failures

Multiple Logon Failures: Database: Detects excessive database logon failures – 5 consecutive failures in a 10 minute period.

Repeated Multiple Logon Failures: Database: Detects repeating occurrences of multiple application logon failures

Multiple Logon Failures: Misc App: Detects excessive application logon failures – 5 consecutive failures in a 10 minute period. Application logsons include the one that may require authentication for accessing the authentication, such as HTTP, SNMP, FTP, POP3, IMAP etc.

Repeated Multiple Logon Failures: Misc App: Detects repeating occurrences of multiple application logon failures

Special situations

Privileged Command Execution Failure: Detects excessive privileged command execution (e.g. sudo exec) failure at a server

Disabled Account Logon Attempt: Detects logon attempts to disabled accounts

Logon Time Restriction Violation: Detects logon attempts at times which are not permitted by policy

Multiple Logon Failures: Same Src, Multiple Hosts: Detects the same source having excessive logon failures at distinct hosts Multiple Logon Failures: Same Src and Dest, Multiple Accounts: Detects same source having excessive logon failures at the same destination host but multiple distinct accounts are used during the logon failure

Suspicious Logon Failure: no following successful login: Detects an unusual condition where a source has authentication failures at

a host but that is not followed by a successful authentication at the same host within the same day

Failed VPN Logon From Outside My Country: Detects VPN logon from outside my country. My Country is set to “United States” and may need to be changed for outside United States

Concurrent Failed Authentications To Same Account  From Multiple Countries: Detects simultaneous failed server/network device/domain authentications to the same system and the same account from different countries. This may indicate stolen credentials unless it is an administrative account and is supposed to be accessed by administrators from multiple countries.

Concurrent Failed Authentications To Same Account From Multiple Cities: Detects simultaneous failed server/network

device/domain authentications to the same system and the same account from different cities. This may indicate stolen credentials unless it is an administrative account and is supposed to be accessed by administrators from multiple cities.

Concurrent Successful Authentications To Same Account From Multiple Countries: Detects simultaneous successful server/network device/domain authentications to the same system and the same account from different countries. This may indicate stolen credentials unless it is an administrative account and is supposed to be accessed by administrators from multiple countries. Concurrent Successful Authentications To Same Account From Multiple Cities: Detects simultaneous successful server/network device/domain authentications to the same system and the same account from different cities. This may indicate stolen credentials unless it is an administrative account and is supposed to be accessed by administrators from multiple cities.

Concurrent VPN Authentications To Same Account From Different Cities: Detects simultaneous VPN authentications to the same account within a short period of time from different cities. This may indicate a stolen credential.

Suspicious logon attempt detected: Detects suspicious logon attempts that indicate policy violations, e.g. root logon to database servers, default passwords, attempts to bypass authentication, root logon over unencrypted protocols such as Telnet, ftp, anonymous logons etc.

Transient Account Usage: Detects that an account was created, used and then deleted within a short period of time

Multiple Accounts Disabled by Administrator: Detects that multiple (more than 3) accounts were disabled by administrator in a short period of time

Network Scanning Activity

 Heavy TCP Host Scan: Detects excessive half-open TCP sessions from the same source to many distinct destinations in a short period of time. The threshold is 200 flows within 3 minutes. Scanning may be a precursor to exploits. However, network management and mapping tools often scan the network for discovery purposes and authorized scanners need to be blacklisted. P2P clients also exhibit this behavior when they attempt to establish connections to (non-existent) peers.

 Heavy TCP Host Scan On Fixed Port: Detects excessive half-open TCP sessions from the same source to many distinct destinations and on the same destination port in a short period of time. The threshold is 200 flows within 3 minutes. A fixed destination port may indicate that the scanning host is attempting to find hosts on a well known port (with a vulnerability). Scanning may be a precursor to exploits. However, network management and mapping tools often scan the network for discovery purposes and authorized scanners need to be blacklisted. P2P clients also exhibit this behavior when they attempt to establish connections to (non-existent) peers. Heavy TCP Port Scan: Single Host: Detects a host performing a port scan – this involves excessive half open TCP connections from the same source to many distinct ports on a host in a short period of time. The thresholds are at least 20 distinct ports in a 2 minute window

Heavy TCP Port Scan: Multiple Hosts: Detects that a source is doing port scans on multiple hosts. The thresholds are port scans on at least 5 hosts in 15 minute window

Heavy UDP Host Scan: Detects excessive number of UDP connections from the same source to many distinct destinations in a short period of time. The threshold is 200 flows within 3 minutes. Scanning may be a precursor to exploits. However, network management and mapping tools often scan the network for discovery purposes and authorized scanners need to be blacklisted. P2P clients also exhibit this behavior when they attempt to establish connections to (non-existent) peers.

 Heavy UDP Host Scan On Fixed Port: Detects excessive number of UDP connections from the same source to many distinct destinations and on the same destination port in a short period of time. The threshold is 200 flows within 3 minutes. A fixed destination port may indicate that the scanning host is attempting to find hosts on a well known port (with a vulnerability). Scanning may be a precursor to exploits. However, network management and mapping tools often scan the network for discovery purposes and authorized scanners need to be blacklisted. P2P clients also exhibit this behavior when they attempt to establish connections to (non-existent) peers. Heavy UDP Port Scan: Single Host: Detects excessive UDP connections from the same source to many distinct ports on the same destination in a short period of time

Heavy UDP Port Scan: Multiple Hosts: Detects that a source is doing UDP port scans on multiple hosts. The thresholds are port scans on at least 5 hosts in 15 minute window

Heavy ICMP Ping sweep: Detects excessive number of ICMP echo request packets from the same source to many distinct destinations in a short period of time. Nachhi worm exploited pings to spread. The threshold is 50 pings within 3 minutes. Scanning may be a precursor to exploits. However, network management and mapping tools often scan the network for discovery purposes and authorized scanners need to be blacklisted.

Excessive ICMP Unreachables: Detects an usually high frequency of ICMP destination unreachable packets between the same source and destination – this indicates routing error

TCP DDOS Attack: Detects excessive number of half-open TCP connections from many distinct sources to the same destination host and on the same port in a short period of time. This may indicate that the destination server is under some sort of attack.

Excessive Denied Connections From Same Src: Detects excessive denies from the same source to many distinct destinations on the same port in a short period of time. The intent could be malicious or some sort of misconfiguration.

Excessive Denied Connections To Same Destination: Detects excessive denies from many distinct sources to the same destination on the same destination port

Multiple IPS Scans From Same Src: Detects multiple IPS scans from the same source IP in a short period of time.

Invalid TCP/UDP Port Traffic: Detects invalid TCP/UDP traffic with 0 port

Invalid TCP Flags – Medium Intensity: Detects moderate (e.g. 100 or more flows in 5 minutes) amount of traffic with invalid TCP flag combinations (NULL,FIN, SYN-FIN, SYN-FIN-PUSH, SYN-FIN-RESET, SYN-FIN-RESET-PUSH,SYN-FIN-RESET-PUSH-ACK-URG) may indcate scanning and probing activity from the sender

Invalid TCP Flags – High Intensity: Detects excessive (e.g. 500 or more flows in 5 minutes) amount of traffic with invalid TCP flag combinations (FIN, SYN-FIN, SYN-FIN-PUSH, SYN-FIN-RESET, SYN-FIN-RESET-PUSH,SYN-FIN-RESET-PUSH-ACK-URG) – may indicate scanning and probing activity from the sender

Excessive ICMP Traffic From Same Source: Detects excessive (e.g. more than 5000 in 5 minutes) ICMP traffic from the same source

Malware

Source: Antivirus, Security gateway, Host IPS, Network IPS, Firewall Log

Virus outbreak: Detects potential virus outbreak – same virus found on three distinct computers/IP addresses

Virus found but not remediated: Detects that host anti-virus or content inspection devices found a virus but could not remediate it Spyware found but not remediated: Detects that host anti-virus or content inspection devices found a spyware but could not remediate it

Spam/Malicious Mail Attachment found but not remediated:

Scanner found severe vulnerability:

Rootkit found:

Phishing attack found but not remediated:

Malware found but not remediated:

Denied Blacklisted Source:

Denied Blacklisted Destination:

Multiple Distinct IPS Events From Same Src:

Permitted Blacklisted Source:

Permitted Blacklisted Destination:

Source: External threat intelligence

Traffic to Zeus Blocked IP List:

Traffic to Emerging Threat Spamhaus List:

Traffic to Emerging Threat Shadow server List:

Traffic to Emerging Threat RBN List:

Traffic to Emerging Threat Dshield List:

Permitted traffic from Emerging Threat Spamhaus List:

Permitted Traffic from Zeus Blocked IP List:

Permitted Traffic from Emerging Threat Shadow server List:

Permitted Traffic from Emerging Threat RBN List:

Permitted Traffic from Emerging Threat Dshield List:

DNS Traffic to Malware Domains:

Adware process found:

Traffic to bogon networks:

Source: Network Traffic Analysis

Excessive End User Mail: Detects a scenario where a host, that is itself not an authorized mail gateway, is sending excessive emails (more than 20 emails in 2 minutes). This behavior may indicate malware running on an end host that is trying to send spam or privileged information to its own set of mail servers (which may be compromised).

Excessive Denied End User Mail To Unauthorized Mail Gateways: Detects a scenario where a host, that is itself not an authorized mail gateway, is unsuccessfully trying to send excessive emails to unauthorized mail gateways. Authorized mail gateways are represented by the “Mail Gateway” group. Such requests would be typically denied because, either the firewall would block SMTP from end hosts and/or mail gateways only receive mail from other authorized mail gateways. This behavior may indicate malware running on an end host that is trying to send spam or privileged information to its own set of mail servers (which may be compromised).  End User DNS Queries to Unauthorized DNS Servers: Detects a scenario where a host, that is itself not a DNS server, is trying to send DNS requests to unauthorized DNS servers. Authorized DNS servers are represented by the “DNS Server” group. In a typical scenario, end hosts always send DNS requests to authorized DNS servers which in turn communicate to other DNS servers – so this behavior may indicate malware running on the end host.

Excessive End User DNS Queries: Detects a scenario where a host, that is itself not an DNS server, is sending excessive DNS requests. Authorized DNS servers are represented by the “DNS Server” group. In a typical scenario, the frequency of end host DNS requests is not high unless, there is a script running – this might indicate the presence of malware on the end host.

Excessive Denied DNS Queries: Detects a scenario where a host, has a very high frequency of denied DNS traffic.

Excessive Uncommon DNS Queries: Detects the same host that is not a DNS server, doing an excessive amount of uncommon domain name queries – this indicates the host is likely infected with malware. An end host typically needs to perform only A and PTR queries; any other query inidicates the likely presence of malware.

Excessive Repeated DNS Queries To Same Domain: Detects an usually high frequency of DNS name resolution queries from the same host to the same domain name in a short period of time. This is not expected behavior since, in a typical scenario, the domain name resolution is cached at the end point. Repeated queries indicates that a special DNS client is likely running at the end host that is trying to make use of fast flux techniques to get back many infected hosts behind a crafted domain name.

Excessive Malware Domain Name Queries: Detects bad domain name queries which indicate malware infected end hosts.

Suspicious Botnet like End host DNS Behavior: Detects an end host meeting at least 3 requirements for suspicious use of DNS requests – this indicates that a bot is likely running on the end host

Unusually Large ICMP Echo Packets: Detects large (> 200 bytes/pkt) ICMP echo request and response packets – this is unusual since ICMP packets carry minimal information and are small in size. THis may indicate that some other traffic is being carried over ICMP protocol.

Unusual ICMP Traffic:

Explicit Security Issues

SQL Injection Attack detected by NIPS:

High Severity Non-Cisco IPS Exploit:

High Severity Inbound Permitted IPS Exploit:

High Severity Inbound Denied Security Exploit:

High Risk Rating Cisco IPS Exploit:

Excessive WLAN Exploits: Same Source:

Excessive WLAN Exploits:

DoS Attack detected by NIPS:

Distributed DoS Attack detected by NIPS:

Layer 2 Switch Port Security Violation:

Policy violations

Firewall Perimeter Policy

Outbound cleartext password usage detected:

Inbound cleartext password usage detected:

VNC from Internet:

Remote Desktop from Internet:

Large Outbound Transfer:

Large Outbound Transfer To Outside My Country:

Large Inbound Transfer From Outside My Country:

External website access policy

Inappropriate Website access: Multiple categories:

Inappropriate Website access: High volume:

Inappropriate Website access:

Internal website access policy

Executable file posting from external source:

Excessive HTTP Client Side Errors:

Excessive FTP Client Side Errors:

Change control policy

 Windows Audit Log Cleared:

Windows Audit Disabled:

WLAN policy

Rogue or Unsecure AP Detected:

Excessive Rogue or Unsecure APs Detected:

Wireless Host Blacklisted:

VPN policy

 Long lasting VPN session:

High throughput  VPN session:

Suspicious Traffic

 Tunneled traffic detected: IRC traffic detected:

P2P traffic consuming high network bandwidth:

Access Control Reports

Network Device Access

Failed Router Admin Logons: Details about failed router administrative logons

Successful Router Admin Logons: Details about successful router administrative logons

Failed Firewall Admin Logons: Details about failed firewall administrative logons

Successful Firewall Admin Logons: Details about successful firewall administrative logons

Failed VPN Admin Logon: Provides event details for all failed VPN admin logons

Successful VPN Admin Logon: Provides event details for all successful VPN admin logons

Successful WLAN Admin Logon: Tracks successful admin logons to the WLAN Controller

Failed WLAN Admin Logon: Tracks failed admin logons to the WLAN Controller

Network Access

Top Users Ranked By Successful VPN Logon: Ranks the VPN Gateways and their users by the number of successful VPN logons.

Top VPN Gateways Ranked By Distinct Users: Ranks the VPN Gateways by the total number of distinct user logons

Top VPN Users Ranked By Failed VPN Logons: Ranks the VPN Gateways and their users by the number of failed VPN logons.

Wireless Logon Failure Details: Provides details of wireless logon authentication failures

Top Wireless Controllers, Users By Failed Logon Count: Ranks wireless controllers by the total number of failed logons

Top Windows Domain Controllers, Users By Successful Domain Authentication Count: Ranks the Windows Domain Controllers and their users by the number of successful domain authentications

Top Windows Domain Controllers, Users By Failed Domain Authentication Count: Ranks the Windows Domain Controllers and the users by the number of failed authentications

Windows Domain Account Lockouts: Details windows domain account lockouts

Remote Desktop Connections to Domain Controller: Details successful remote desktop connections

Privileged Domain Controller Logon Attempts using the Administrator Account: Ranks the windows servers and their users by the number of failed logons using the administrator account

Failed Authentication Server Logons: Captures failed AAA Server Logons

Successful Authentication Server Logons: Captures successful AAA Server Logons

Server Access

Top Unix Servers, Users By Successful Logon Count: This report ranks the UNIX servers and their users by successful logon count

Top Unix Servers, Users By Failed Logon Count: This report ranks the UNIX servers and their users by failed logon count

Top Unix Servers, Users By Successful Privilege Escalation Count: This report ranks the UNIX servers and their users by successful privilege escalations (su) count

Top Unix Servers, Users By Failed Privilege Escalation Count: This report ranks the UNIX servers and their users by failed privilege escalations (su) count

Top Windows Servers, Users By Successful Logon Count: Ranks the Windows Servers and their users by the number of successful logons

Top Windows Servers, Users By Failed Logon Count: Ranks the Windows Servers and the users by the number of failed authentications

Windows Server Account Lockouts: Details windows server lockouts

Windows Server Account Unlocks: Captures account unlocks on windows servers. Account unlocks happen after lockouts that may happen on repeated login failures

Remote Desktop Connections to Windows Servers: Details successful remote desktop connections

Privileged Server Logon Attempts using the Administrator Account: Ranks the windows servers and their users by the number of failed logons using the administrator account

Application Access

Top FTP Clients By Unauthorized Access Error Count: Ranks FTP servers and their clients by the total number of unauthorized access error count

Top Web Visitors By Unauthorized Access Error Count: Ranks web servers and visitors by the total number of unauthorized access error count

Top Users By Successful Database Server Logons: Ranks database users by the number of successful logons

Top Users By Failed Database Server Logons: Ranks database users by the number of failed logons

Malware Reports

Virus found and remediated Captures events that indicate the viruses found and remediated – the events could be from Host Anti-virus or Network Security Gateways

Virus found but not remediated Captures events that indicate viruses found but failed to remedy – the events could be from Host Anti-virus or Network Security Gateways

Spyware found and remediated Captures events that indicate spyware was found and remediated on a host – the events could be from Host Anti-virus or Network Security Gateways

Spyware found but not remediated Captures events that indicate spyware was found but the detecting software failed to remediated the vulnerability – the events could be from Host Anti-virus or Network Security Gateways

Spam/Malicious Mail Attachment found and remediated Captures events that indicate spam or mailicious mail attachments were found and remediated on a host – the events could be from Host Anti-virus or Network Security Gateways

Spam/Malicious Mail Attachment found but not remediated Captures events that indicate spyware was found but the detecting software did not remediated the vulnerability

Phishing attempt found and remediated Captures events that indicate phishing attempt

Top IPs with Malware Found By Antivirus and Security Gateways: Tracks IP addresses with Malware as found by Host Anti-virus and Security Gateways

Top Computers with Malware Found By Antivirus and Security Gateways: Tracks computers with Malware as found by Host Anti-virus and Security Gateways

Top IPs with Malware Found By IPS and Firewalls: Tracks IP addresses with Malware as found by IPS – these are somewhat less reliable than Host Anti-virus and Security Gateways

Top IPs with Malware Found By Security Gateways: Tracks IP addresses with Malware as found by Security Gateways

Non-compliant Hosts and Security Software License Expirations: Tracks non-compliant hosts and license expiry events from Security Management Gateways and Firewalls. Non-compliant hosts may not have proper security software running and therefore may pose a security threat. License expiration of security software may expose exploitable security vulnerabilities. Host Vulnerabilities discovered: Tracks vulnerabilities discovered on a host

Other Security Issues

Top Network IPS events By Severity, Count: Ranks the network IPS events by count

Top Network Scanners By Event Count: Ranks the source IP addresses by detected network scan or reconnaissance events

Top Blocked Network Attacks By Count: Ranks the network attacks attacks blocked by network IPS

Rogue APs detected: Lists the rogue APs

Rogue AP Detection Details: Provides details of rogue AP events

Top WLAN IDS Alerts: Ranks WLAN IDS alerts

Multiple Distinct IPS Events From Same Src: Detects multiple IPS events from the same source IP in a short period of time – the source IP may have been infected

Multiple IPS Scans From Same Src: Detects multiple IPS scans from the same source IP in a short period of time.

High Risk Rating Cisco IPS Exploit: Detects a high risk rating IPS exploit event. This is applicable for Cisco IPS.

High Severity IPS Exploit: Detects a high severity IPS exploit detected by non-Cisco IPS

High Severity Security Exploit: Detects a high severity security exploit detected by non IPS devices

Network Traffic Analysis

Top Conversations By Bytes: Ranks the top conversations by total bytes. A conversation includes Source IP, Destination IP, Protocol and Destination Port.

Top Conversations By Bytes: Detailed View Ranks the top conversations by total bytes but also provides, sent Bytes and received Bytes as additional information. A conversation includes Source IP, Destination IP, Protocol and Destination Port.

Top Source IPs By Bytes Ranks the top source IPs by bytes

Top Source IPs By Bytes: Detailed View Ranks the top source IPs and destination ports by bytes

Top Destination IPs By Bytes Ranks the top destination IPs by bytes

Top Destination IPs By Bytes: Detailed View Ranks the top destination IPs and ports by bytes

Top Protocols By Bytes: Ranks the top protocols and destination ports by bytes

Top Protocols By Bytes: Detailed View: Ranks the top protocol and destination ports by bytes Top Router Link Usage By Bytes Ranks the top router link usage by bytes

Availability Related Rules and Reports

AccelOps Availability Rules

System component issues

System Collector Down: Detects that collector is down

System Collector Event Delayed: Detects that collector has not sent an event to AccelOps cloud for more than 10 minutes System Worker Down: Detects that system worker is down License Issues

System License Warning: High Event Rate: Detects that the system is receiving events at a rate that is higher than the license limit.

Events beyond the license limit would be dropped unless the license is upgraded

System License Warning: High Config Items: Detects that the number of CMDB configuration items is close to the license limit additonal configuration items would not be stored unless the license is upgraded.

Notification issues

Scheduled Report Send Error: Detects that system has failed to deliver a scheduled report

Incident Notification Error: Detects that system has failed to take notification action on an incident

Large Supervisor JMS Request Queue: Detects that Supervisor JMS Request queue is very large

Large Supervisor JMS System Queue: Detects that Supervisor JMS System queue is very large

Data collection errors

WMI Service Unavailable: Detects that WMI service is unavailable

SNMP Service Unavailable: Detects that SNMP service is unavailable

Performance Monitoring Error: Detects that the system failed to monitor a performance monitoring metric

No Events Reported In Last Hour: Detects that a reporting device that reported events (logs etc) in the last hour did not report any events this hour. This does not include monitoring events (like CPU, Memory etc). This indicates that there is a problem in the network or at the reporting device.

Large Worker Input Event Queue: Detects that Worker input event queue is very large (greater than 100MB). This indicates that the workers are falling behind in handling events and cannot keep pace with the rate at which workers are sending events. Consider ading more workers or adding resources to workers.

Large Worker Input SVN Queue: Detects that Worker input SVN queue is very large (greater than 100MB). This indicates that the workers are falling behind in handling SVN files from collectors or from the parser modules. Check the SVN installation. Event Storage/Archiving/Purging issues

Change Log

Introduction

This document provides the following information for FortiOS 5.4.5 build 1138:

l Special Notices l Upgrade Information l Product Integration and Support l Resolved Issues l Known Issues l Limitations

See the Fortinet Document Library for FortiOS documentation.

Supported models

FortiOS 5.4.5 supports the following models.

Introduction                                                                                                                              Supported models

Special branch supported models

The following models are released on a special branch of FortiOS 5.4.5. To confirm that you are running the correct build, run the CLI command get system status and check that the Branch point field shows 1138.

What’s new in FortiOS 5.4.5                                                                                                                Introduction

What’s new in FortiOS 5.4.5

For a detailed list of new features and enhancements that have been made in FortiOS 5.4.5, see the What’s New forFortiOS 5.4.5 document available in the Fortinet Document Library.

Special Notices

Built-In Certificate

FortiGate and FortiWiFi D-series and above have a built in Fortinet_Factory certificate that uses a 2048-bit certificate with the 14 DH group.

Default log setting change

For FG-5000 blades, log disk is disabled by default. It can only be enabled via CLI. For all 2U & 3U models (FG-3600/FG-3700/FG-3800), log disk is also disabled by default. For all 1U models and desktop models that supports SATA disk, log disk is enabled by default.

FortiAnalyzer Support

In version 5.4, encrypting logs between FortiGate and FortiAnalyzer is handled via SSL encryption. The IPsec option is no longer available and users should reconfigure in GUI or CLI to select the SSL encryption option as needed.

Removed SSL/HTTPS/SMTPS/IMAPS/POP3S

SSL/HTTPS/SMTPS/IMAPS/POP3S options were removed from server-load-balance on low end models below FG-100D except FG-80C and FG-80CM.

FortiGate and FortiWiFi-92D Hardware Limitation

FortiOS 5.4.0 reported an issue with the FG-92D model in the Special Notices > FG-92D High Availability in Interface Mode section of the release notes. Those issues, which were related to the use of port 1 through 14, include:

• PPPoE failing, HA failing to form l IPv6 packets being dropped l FortiSwitch devices failing to be discovered
• Spanning tree loops may result depending on the network topology

FG-92D and FWF-92D do not support STP. These issues have been improved in FortiOS 5.4.1, but with some side effects with the introduction of a new command, which is enabled by default:

config system global set hw-switch-ether-filter <enable | disable>

FG-900D and FG-1000D                                                                                                               Special Notices

When the command is enabled:

• ARP (0x0806), IPv4 (0x0800), and VLAN (0x8100) packets are allowed l BPDUs are dropped and therefore no STP loop results l PPPoE packets are dropped l IPv6 packets are dropped l FortiSwitch devices are not discovered l HA may fail to form depending the network topology

When the command is disabled:

• All packet types are allowed, but depending on the network topology, an STP loop may result

FG-900D and FG-1000D

CAPWAP traffic will not offload if the ingress and egress traffic ports are on different NP6 chips. It will only offload if both ingress and egress ports belong to the same NP6 chip.

FG-3700DX

CAPWAP Tunnel over the GRE tunnel (CAPWAP + TP2 card) is not supported.

FortiGate units managed by FortiManager 5.0 or 5.2

Any FortiGate unit managed by FortiManager 5.0.0 or 5.2.0 may report installation failures on newly created VDOMs, or after a factory reset of the FortiGate unit even after a retrieve and re-import policy.

FortiClient Support

Only FortiClient 5.4.1 and later is supported with FortiOS 5.4.1 and later. Upgrade managed FortiClients to 5.4.1 or later before upgrading FortiGate to 5.4.1 or later.

Consider the FortiClient license before upgrading. Full featured FortiClient 5.2 and 5.4 licenses will carry over into FortiOS 5.4.1 and later. Depending on your organization’s needs, you might need to purchase a FortiClient EMS license for endpoint provisioning. Contact your sales representative for guidance on the appropriate licensing for your organization.

The perpetual FortiClient 5.0 license (including the 5.2 limited feature upgrade) will not carry over into FortiOS 5.4.1 and later. You need to purchase a new license for either FortiClient EMS or FortiGate. A license is compatible with 5.4.1 and later if the SKU begins with FC-10-C010.

Special Notices                                                                                FortiClient (Mac OS X) SSL VPN Requirements

FortiClient (Mac OS X) SSL VPN Requirements

When using SSL VPN on Mac OS X 10.8, you must enable SSLv3 in FortiOS.

FortiGate-VM 5.4 for VMware ESXi

Upon upgrading to FortiOS 5.4.5, FortiGate-VM v5.4 for VMware ESXi (all models), no longer supports the VMXNET2 vNIC driver.

FortiClient Profile Changes

With introduction of the Cooperative Security Fabric in FortiOS, FortiClient profiles will be updated on FortiGate. FortiClient profiles and FortiGate are now primarily used for Endpoint Compliance, and FortiClient Enterprise Management Server (EMS) is now used for FortiClient deployment and provisioning.

In the FortiClient profile on FortiGate, when you set the Non-Compliance Action setting to Auto-Update, the

FortiClient profile supports limited provisioning for FortiClient features related to compliance, such as AntiVirus,

Web Filter, Vulnerability Scan, and Application Firewall. When you set the Non-Compliance Action setting to Block or Warn, you can also use FortiClient EMS to provision endpoints, if they require additional other features, such as VPN tunnels or other advanced options. For more information, see the FortiOS Handbook – Security

Profiles.

When you upgrade to FortiOS 5.4.1 and later, the FortiClient provisioning capability will no longer be available in FortiClient profiles on FortiGate. FortiGate will be used for endpoint compliance and Cooperative Security Fabric integration, and FortiClient Enterprise Management Server (EMS) should be used for creating custom FortiClient installers as well as deploying and provisioning FortiClient on endpoints. For more information on licensing of EMS, contact your sales representative.

FortiPresence

FortiPresence users must change the FortiGate web administration TLS version in order to allow the connections on all versions of TLS. Use the following CLI command.

config system global set admin-https-ssl-versions tlsv1-0 tlsv1-1 tlsv1-2

end

Log Disk Usage

Users are able to toggle disk usage between Logging and WAN Optimization for single disk FortiGates.

To view a list of supported FortiGate models, refer to the FortiOS 5.4.0 Feature Platform Matrix.

SSL VPN setting page                                                                                                                   Special Notices

SSL VPN setting page

The default server certificate has been changed to the Fortinet_Factory option. This excludes FortiGateVMs which remain at the self-signed option. For details on importing a CA signed certificate, please see the How to purchase and import a signed SSL certificate document.

FG-30E-3G4G and FWF-30E-3G4G MODEM Firmware Upgrade

The 3G4G MODEM firmware on the FG-30E-3G4G and FWF-30E-3G4G models may require updating. Upgrade instructions and the MODEM firmware have been uploaded to the Fortinet CustomerService & Support site.

Log in and go to Download > Firmware. In the Select Product list, select FortiGate, and click the Download tab. The upgrade instructions are in the following directory:

…/FortiGate/v5.00/5.4/Sierra-Wireless-3G4G-MODEM-Upgrade/

Use of dedicated management interfaces (mgmt1 and mgmt2)

For optimum stability, use management ports (mgmt1 and mgmt2) for management traffic only. Do not use management ports for general user traffic.

Upgrade Information

Upgrading to FortiOS 5.4.5

FortiOS version 5.4.5 officially supports upgrading from version 5.4.3 and later and 5.2.9 and later.

When upgrading from a firmware version beyond those mentioned in the Release Notes, a recommended guide for navigating the upgrade path can be found on the Fortinet documentation site.

There is a separate version of the guide describing the safest upgrade path to the latest patch of each of the supported versions of the firmware. To upgrade to this build, go to FortiOS 5.4 Supported Upgrade Paths.

Upgrading to FortiOS 5.6.0

Cooperative Security Fabric Upgrade

FortiOS 5.4.1 and later greatly increases the interoperability between other Fortinet products. This includes:

• FortiClient 5.4.1 and later l FortiClient EMS 1.0.1 and later l FortiAP 5.4.1 and later l FortiSwitch 3.4.2 and later

The upgrade of the firmware for each product must be completed in a precise order so the network connectivity is maintained without the need of manual steps. Customers must read the following two documents prior to upgrading any product in their network:

• Cooperative Security Fabric – Upgrade Guide
• FortiOS 5.4.x Upgrade Guide for Managed FortiSwitch Devices

This document is available in the Customer Support Firmware Images download directory for FortiSwitch 3.4.2.

FortiGate-VM 5.4 for VMware ESXi                                                                                          Upgrade Information

FortiGate-VM 5.4 for VMware ESXi

Upon upgrading to FortiOS 5.4.5, FortiGate-VM v5.4 for VMware ESXi (all models), no longer supports the VMXNET2 vNIC driver.

Downgrading to previous firmware versions

Downgrading to previous firmware versions results in configuration loss on all models. Only the following settings are retained:

l operation mode l interface IP/management IP l static route table l DNS settings l VDOM parameters/settings l admin user account l session helpers l system access profiles

When downgrading from 5.4 to 5.2, users will need to reformat the log disk.

Amazon AWS Enhanced Networking Compatibility Issue

Due to this new enhancement, there is a compatibility issue with older AWS VM versions. After downgrading a 5.4.1 or later image to an older version, network connectivity is lost. Since AWS does not provide console access, you cannot recover the downgraded image.

Downgrading to older versions from 5.4.1 or later running the enhanced nic driver is not allowed. The following AWS instances are affected:

• C3 l C4 l R3 l I2
• M4 l D2

Upgrade Information                                                                                                            FortiGate VM firmware

FortiGate VM firmware

Fortinet provides FortiGate VM firmware images for the following virtual environments:

Citrix XenServer and Open Source XenServer

• .out: Download the 64-bit firmware image to upgrade your existing FortiGate VM installation.
• .out.OpenXen.zip: Download the 64-bit package for a new FortiGate VM installation. This package contains the QCOW2 file for Open Source XenServer.
• .out.CitrixXen.zip: Download the 64-bit package for a new FortiGate VM installation. This package contains the Citrix XenServer Virtual Appliance (XVA), Virtual Hard Disk (VHD), and OVF files.

Linux KVM

• .out: Download the 64-bit firmware image to upgrade your existing FortiGate VM installation.
• .out.kvm.zip: Download the 64-bit package for a new FortiGate VM installation. This package contains QCOW2 that can be used by qemu.

Microsoft Hyper-V

• .out: Download the 64-bit firmware image to upgrade your existing FortiGate VM installation.
• .out.hyperv.zip: Download the 64-bit package for a new FortiGate VM installation. This package contains three folders that can be imported by Hyper-V Manager on Hyper-V 2012. It also contains the file vhd in the Virtual Hard Disks folder that can be manually added to the Hyper-V Manager.

VMware ESX and ESXi

• .out: Download either the 64-bit firmware image to upgrade your existing FortiGate VM installation.
• .ovf.zip: Download either the 64-bit package for a new FortiGate VM installation. This package contains Open Virtualization Format (OVF) files for VMware and two Virtual Machine Disk Format (VMDK) files used by the OVF file during deployment.

Firmware image checksums

The MD5 checksums for all Fortinet software and firmware releases are available at the Customer Service & Support portal, https://support.fortinet.com. After logging in select Download > Firmware Image Checksums, enter the image file name including the extension, and select Get Checksum Code.

Product Integration and Support

FortiOS 5.4.5 support

The following table lists 5.4.5 product integration and support information:

FortiOS 5.4.5

FortiOS 5.4.5 support                                                                                             Product Integration and Support

Language

Language support

The following table lists language support information.

Language support

SSL VPN support

SSL VPN standalone client

The following table lists SSL VPN tunnel client standalone installer for the following operating systems.

Operating system and installers

Other operating systems may function correctly, but are not supported by Fortinet.

SSL VPN support                                                                                                  Product Integration and Support

SSL VPN web mode

The following table lists the operating systems and web browsers supported by SSL VPN web mode.

Supported operating systems and web browsers

Other operating systems and web browsers may function correctly, but are not supported by Fortinet.

SSL VPN host compatibility list

The following table lists the antivirus and firewall client software packages that are supported.

Supported Microsoft Windows XP antivirus and firewall software

SSL VPN

Supported Microsoft Windows 7 32-bit antivirus and firewall software

Resolved Issues

The following issues have been fixed in version 5.4.5. For inquires about a particular bug, please contact CustomerService & Support.

AntiVirus

DLP

Firewall

GUI

HA

IPsec VPN

Logging & Report

Router

SSL VPN

System

Web Filter

WebProxy

WiFi

Common Vulnerabilities and Exposures

FortiOS 5.4.5 is no longer vulnerable to the following CVE references. For more information, see https://fortiguard.com/psirt.

Known Issues

The following issues have been identified in version 5.4.5. For inquires about a particular bug or to report a bug, please contact CustomerService & Support.

AntiVirus

Endpoint Control

Firewall

FortiGate-3815D

FortiRugged-60D

FortiSwitch-Controller/FortiLink

FortiView

GUI

Known Issues

HA

IPsec

Router

SSL VPN

Known Issues

System

Upgrade

Visibility

VM

WiFi

Limitations

Citrix XenServer limitations

The following limitations apply to Citrix XenServer installations:

• XenTools installation is not supported.
• FortiGate-VM can be imported or deployed in only the following three formats:
• XVA (recommended) l VHD l OVF
• The XVA format comes pre-configured with default configurations for VM name, virtual CPU, memory, and virtual NIC. Other formats will require manual configuration before the first power on process.

Open Source XenServer limitations

When using Linux Ubuntu version 11.10, XenServer version 4.1.0, and libvir version 0.9.2, importing issues may arise when using the QCOW2 format and existing HDA issues.

Integration API

AccelOps provides an API that you can use to query and make changes to the CMDB, query events, and send notifications. These topics contain information on API parameters, sample XML input and output files, and python scripts that you can use to interact with the API.

Python Support

Versions 2.5, 2.6

Version 2.4 is only supported when import ssl is changed to from socket import ssl

Version 3.0 cannot be supported unless all print statements are rewritten

You will need to install httplib2 and ssl manually, if they are not already installed

Topics

Add or Update an Organization

Create or Update Credentials

Discover Devices

Get CMDB Device Info

Get the List of Monitored Devices and Attributes

Get the List of Monitored Organizations

Update Device Monitoring

Add, Update or Delete Device Maintenance Schedule

Events and Report Integration

Incident Notification

Formats for Incident Notifications over Email, HTTPS, SNMP Trap, and API Using the Notification API

External Help desk / CMDB Integration External Threat Intelligence Integration License Registration

CMDB APIs

These APIs are available for interacting with the AccelOps CMDB.

Add or Update an Organization

Create or Update Credentials

Discover Devices

Get CMDB Device Info

Get the List of Monitored Devices and Attributes

Get the List of Monitored Organizations

Update Device Monitoring

Add, Update or Delete Device Maintenance Schedule

Add or Update an Organization

Applies To

API Parameters

Sample Code for Adding an Organization

Sample XML Input File

Sample Python Script

Sample Code for Updating an Organization’s Attributes

Sample XML Input File

Sample Python Script

Applies To

Multi-tenant deployments

API Parameters

Sample Code for Adding an Organization

The sample shows how to add the organization organization341 and specify its attributes.

Sample XML Input File

Sample Python Script

Sample Code for Updating an Organization’s Attributes

Th sample increases the max events per sec (eps) value of organization341 to 1000. The Key is the name. Sample XML Input File

Sample Python Script

Create or Update Credentials

Applies To

API Parameters

Multi-Tenant Deployments

Enterprise Deployments

Sample Code for Adding and Updating Credentials

Sample XML Input File

Sample Python Script

Applies To

Enterprise and multi-tenant deployments

API Parameters

The key is the credential name in the input XML. If a credential with the same name exists, then the credential in the database will be updated with the new content.

Multi-Tenant Deployments

Enterprise Deployments

Sample Code for Adding and Updating Credentials

This sample takes the credentials and, optionally, the organization name as arguments and writes out the parsed XML output file in a comma separated value (CSV) format on the screen. The output can be redirected to a file if needed. Sample XML Input File

Sample Python Script

Discover Devices

Applies To

API Parameters

Multitenant Deployments

Enterprise Deployments

Sample Code for Discovery Request

Sample Input XML File

Sample Python Script

Sample Output XML for Discovery Results

Sample Output Text for Discovery Results

Applies To

Enterprise and multitenant deployments

API Parameters

Multitenant Deployments

Enterprise Deployments

Sample Code for Discovery Request

This sample takes the credentials and, optionally, organization name as arguments and writes out the parsed XML output file in a comma separated value (CSV) format on the screen. The output can be redirected to a file if needed.

Sample Input XML File

Sample Python Script

Sample Output XML for Discovery Results

Sample Output Text for Discovery Results