ESET REMOTE ADMINISTRATOR Event Management Extension Technical Setup and User Guide. Click here to download the latest version of this document

Size: px

Start display at page:

Download "ESET REMOTE ADMINISTRATOR Event Management Extension Technical Setup and User Guide. Click here to download the latest version of this document"

Jacob Farmer
5 years ago
Views:

1 ESET REMOTE ADMINISTRATOR Event Management Extension Technical Setup and User Guide Click here to download the latest version of this document

2 ESET REMOTE ADMINISTRATOR - Event Management Extension Copyright 2017 by ESET, spol. s r.o. ESET REMOTE ADMINISTRATOR - Event Ma na gement Extens i on wa s devel oped by ESET, s pol. s r.o. For more i nforma ti on vi s i t et.com. Al l ri ghts res erved. No pa rt of thi s documenta ti on ma y be reproduced, s tored i n a retri eva l s ys tem or tra ns mi tted i n a ny form or by a ny mea ns, el ectroni c, mecha ni ca l, photocopyi ng, recordi ng, s ca nni ng, or otherwi s e wi thout permi s s i on i n wri ti ng from the a uthor. ESET, s pol. s r.o. res erves the ri ght to cha nge a ny of the des cri bed a ppl i ca ti on s oftwa re wi thout pri or noti ce. Cus tomer Ca re Worl dwi de: et.com/s upport

3 1. Introduction System Requirements Installing...6 Event Management Extension 3.1 Before installation Installation Configuring...9 Event Management Extension General Configuration...9 Log...11 report Configuration ESET Event...14 Management Extension Changelog

4 1. Introduction Thank you for using ESET Event Management Extension. ESET Event Management Extension is designed to work in conjunction with ESET Remote Administrator Server. Event Management Extension monitors ERA Server for new threats, scans and quarantined items and sends configurable syslog messages when new entries are found. 4

5 2. System Requirements ESET Event Management Extension can be deployed on any server that has a network path to your ESET Remote Administrator Server and the Syslog server. The following requirements must be met: ESET Remote Administrator Server 5.3 / 6.3 or later Microsoft Visual C x86 Redistributable 5

6 3. Installing Event Management Extension ESET Event Management Extension must be installed manually and cannot be installed remotely using the ESET Remote Administrator push feature. There are no options for a silent installation when installing ESET Event Management Extension. This section contains the following topics: Before installation Installation 3.1 Before installation Before installing Event Management Extension, make sure you have the following information available: The IP address, port and protocol of your syslog server The IP address, username and password of your ERA Server The desired frequency for Event Management Extension to check the database for changes. The default setting is every 60 seconds and ranges from 30 second to 86,400 second intervals. The desired Syslog Facility and Syslog Level to assign to sent Event Management Extension messages. 3.2 Installation Follow the steps below to install ESET Event Management Extension: 1. Double-click the installer file eset_eventmgmtext.msi to start the Setup Wizard. 2. Click Next. Figure 1-1 6

7 3. Read the End-User License Agreement, select the check box next to I Accept the terms in the License Agreement and then click Next. Figure Select the installation path and click Next. Figure Click Install to begin installation. 7

8 Figure Click Finish to exit the Event Management Extension Setup Wizard. Figure 1-5 Proceed to the Configuring Event Management Extension section to learn how to configure ESET Event Management Extension. 8

9 3.3 Configuring Event Management Extension This section contains the following topics: General Configuration Log report Configuration General Configuration Event Management Extension must be configured before the Event Management service will run. 1. After installing Event Management Extension, open ESET Event Management Extension Configuration Manager from your Start menu. Enter the following configuration options in the General tab of the ESET Event Management Extension Configuration Manager window. The fields must be filled in before Event Management Extension will function. 2. In the Syslog Server section, enter the information in the following fields: Hostname / IP Address of your Syslog Server(s) Port of your Syslog Server (default is 514) Protocol that your Syslog Server receives message on (default is UDP) 3. In the ESET Remote Administrator section, enter the information in the following fields: Hostname / IP Address of your ESET Remote Administrator Server (ERAS) Port of your ERA Server ERA Version ERA Username and Password 4. In the Options section, enter the information in the following fields: ERA poll Interval (Seconds) How often you would like Event Management Extension to check for new records (default is every 60 seconds) Syslog Facility (Local0 Local7) Syslog Level (Emergency Debug) 9

Figure 1-1 5. Once you have finished entering your settings, click Test ERA Connection to verify that Event Management Extension is able to connect to your ERA Server. 6.

10 Figure Once you have finished entering your settings, click Test ERA Connection to verify that Event Management Extension is able to connect to your ERA Server. 6. DO NOT exit the configuration manager at this time; you must first configure the log report options for each log type that you wish to report on. Proceed to the Log report Configuration section. 10

3.3.2 Log report Configuration ESET Event Management Extension can enable reporting from the Threat Log, Scan Log and Quarantine (v6 only) sections of ESET Remote Administrator Server.

11 3.3.2 Log report Configuration ESET Event Management Extension can enable reporting from the Threat Log, Scan Log and Quarantine (v6 only) sections of ESET Remote Administrator Server. Future versions of this tool will have expanded functionality to monitor other aspects of your environment. 1. To enable each type of reporting, click the appropriate tab, select the check box to enable reporting and then type the customized message to your Syslog Server using the specified variables. A sample configuration for Event Management Extension to report new Threat Log entries to your Syslog Server is shown below: Figure 1-1 The configuration shown above will send the following message to your Syslog Server when a new threat is reported to ERA Server: New Threat Detected: <computer name> encountered the following threat: <threat name> Action taken: <action taken> You can customize the message to your Syslog Server with any text or use any of the specified variables. 2. Once you have finished configuring each of the tabs in ESET Event Management Extension Configuration Manager, click File > Save to save your configuration. 11

12 Figure After you have successfully saved your settings, click Service > Start Service to start the Event Management service and begin monitoring your ERA Server. 12

13 Figure

14 4. ESET Event Management Extension Changelog Version : Added: Ability to send Syslog messages to multiple Syslog Servers Added: Ability to monitor the quarantine logs for ERA v6 Servers Version : Initial public release 14

ESET SECURE AUTHENTICATION. VMware Horizon View Integration Guide

ESET SECURE AUTHENTICATION. VMware Horizon View Integration Guide ESET SECURE AUTHENTICATION VMware Horizon View Integration Guide ESET SECURE AUTHENTICATION Copyright 2016 by ESET, spol. s r.o. ESET Secure Authenti ca ti on wa s devel oped by ESET, s pol. s r.o. For