SPECTRUM Security Manager 3.3

Transcription

1 Titlepage SPECTRUM Security Manager 3.3 Installation Guide for Windows Document 5102 Security Management

2 Copyright Notice Document Copyright present by Aprisma Management Technologies, Inc. All rights reserved worldwide. Use, duplication, or disclosure by the United States government is subject to the restrictions set forth in DFARS (c)(1)(ii) and FAR Liability Disclaimer Aprisma Management Technologies, Inc. ( Aprisma ) reserves the right to make changes in specifications and other information contained in this document without prior notice. In all cases, the reader should contact Aprisma to inquire if any changes have been made. The hardware, firmware, or software described in this manual is subject to change without notice. IN NO EVENT SHALL APRISMA, ITS EMPLOYEES, OFFICERS, DIRECTORS, AGENTS, OR AFFILIATES BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF OR RELATED TO THIS MANUAL OR THE INFORMATION CONTAINED IN IT, EVEN IF APRISMA HAS BEEN ADVISED OF, HAS KNOWN, OR SHOULD HAVE KNOWN, THE POSSIBILITY OF SUCH DAMAGES. Trademark, Service Mark, and Logo Information SPECTRUM, IMT, and the SPECTRUM IMT/VNM logo are registered trademarks of Aprisma Management Technologies, Inc., or its affiliates. APRISMA, APRISMA MANAGEMENT TECHNOLOGIES, the APRISMA MANAGEMENT TECHNOLOGIES logo, MANAGE WHAT MATTERS, DCM, VNM, SpectroGRAPH, SpectroSERVER, Inductive Modeling Technology, Device Communications Manager, SPECTRUM Security Manager, and Virtual Network Machine are unregistered trademarks of Aprisma Management Technologies, Inc., or its affiliates. For a complete list of Aprisma trademarks, service marks, and trade names, go to All referenced trademarks, service marks, and trade names identified in this document, whether registered or unregistered, are the intellectual property of their respective owners. No rights are granted by Aprisma Management Technologies, Inc., to use such marks, whether by implication, estoppel, or otherwise. If you have comments or concerns about trademark or copyright references, please send an to spectrum-docs@aprisma.com; we will do our best to help. Installation Guide for Windows Page 1

3 Restricted Rights Notice (Applicable to licenses to the United States government only.) This software and/or user documentation is/are provided with RESTRICTED AND LIMITED RIGHTS. Use, duplication, or disclosure by the government is subject to restrictions as set forth in FAR (June 1987) Alternate III(g)(3) (June 1987), FAR (June 1987), or DFARS (c)(1)(ii) (June 1988), and/or in similar or successor clauses in the FAR or DFARS, or in the DOD or NASA FAR Supplement, as applicable. Contractor/manufacturer is Aprisma Management Technologies, Inc. In the event the government seeks to obtain the software pursuant to standard commercial practice, this software agreement, instead of the noted regulatory clauses, shall control the terms of the government's license. Virus Disclaimer Aprisma makes no representations or warranties to the effect that the licensed software is virusfree. Aprisma has tested its software with current virus-checking technologies. However, because no antivirus system is 100 percent effective, we strongly recommend that you write-protect the licensed software and verify (with an antivirus system in which you have confidence) that the licensed software, prior to installation, is virus-free. Contact Information Aprisma Management Technologies, Inc. 273 Corporate Drive Portsmouth, NH Phone: U.S. toll-free: Web site: Installation Guide for Windows Page 2

4 Contents About the documentation Document Feedback Online Documents Conventions Used in This Guide Text conventions Icons CHAPTER 1: PREPARATION About Preparing to Install SSM SPECTRUM Integration Security Environment Supported Devices Extraction and Activation Keys Generating Activation Keys To generate activation keys Key Usage Notes Pre-Installation Checklist CHAPTER 2: INSTALLATION OVERVIEW About Installing SSM... 23

5 4 SSM Installation Guide For Windows Installing SSM Components The Central Server Event Consolidators Normalizers The Reporting System The SSM Database The JDBC Configuration Wizard Remote Consoles Agents Installing SSM CHAPTER 3: CREATING A DATABASE About the SSM Database About MS SQL Server Database Integration Creating an SQL Server database Creating a User with DBO Rights To create a new user with DBO rights To set the owner rights for an existing generic user Validating Troubleshooting About Oracle Database Integration Creating an Oracle Database Validating Troubleshooting CHAPTER 4: INSTALLING CENTRAL SERVERS About Installing Central Servers Prerequisites Installation Notes Running SSM on Windows 2000 Server To configure IIS to not start automatically... 36

6 Table of Contents 5 Java 2 Virtual Machine 1.3 Requirement Installing Central Servers To install Central Servers Validating To launch SSM To inject an event Troubleshooting CHAPTER 5: CONNECTING THE CENTRAL SERVER TO THE SSM DATABASE About Connecting the Central Server Installing the JDBC Configuration Wizard Creating the JDBC Database Connection To create the JDBC database connection: Validating To launch SSM To inject an event To query the database CHAPTER 6: INSTALLING THE NORMALIZER PACK About Installing Normalizers Prerequisites Installation Notes Normalizer Operators OID Operators Installing Normalizers To install the Normalizer Pack Validating Central Server Event Consolidators, and Remote Consoles Troubleshooting... 50

7 6 SSM Installation Guide For Windows CHAPTER 7: INSTALLING AGENTS About Agents Installation Notes About BlackIce Defender Agent About the Supported Product Prerequisites Installation Notes Installing BlackIce Defender To install BlackIce Defender To configure the BlackIce Defender Agent To run the Agent Validating Troubleshooting About the Cisco IDS Agent About the Supported Product Installing the Cisco IDS Agent To install the Cisco IDS Agent To use FTP to transfer the Cisco IDS files To configure the itactics_ciscoids.conf file To activate the Cisco IDS Agent: Configuring the Cisco IDS Agent to start automatically: Validating Troubleshooting About Intruder Alert Agent About the Supported Product Prerequisites Installation Notes Installing Intruder Alert Agent To install the Intruder Alert Device Agent To configure the agent Running the Agent Validating Troubleshooting... 64

8 Table of Contents 7 About the McAfee Agent About the Supported Product Installing McAfee Prerequisites To install the McAfee agent Validating Troubleshooting About NetCache Agent About the Supported Product Prerequisites Installation Notes Installing NetCache Agent To install the NetCache Agent To configure the agent Running the Agent Validating Troubleshooting About the Oracle Agent About the Supported Product Installing Oracle Agent Prerequisites To install the Oracle Agent Validating Troubleshooting About the Syntegra Agent About the Supported Product Prerequisites Installation Notes To Configure Syntegra Agent To install the Syntegra Agent Run the Script on System Startup Validating Troubleshooting... 81

9 8 SSM Installation Guide For Windows CHAPTER 8: INSTALLING EVENT2MESSAGE About Event2Message Prerequisites Installation Options Installation Notes Remote Host Monitoring Setting Up Event2Message Installing Event2Message Service Configuring SSM s Event2Message Service Adding a Filter to Event2Message To install filters Configuring the Windows Event Viewer Windows NT Windows Configuring SSM s Event2Message Service to Start Automatically Configuring Windows auditing Windows NT Windows Adding a Remote Host To add a remote host Removing a Remote Host Validating Troubleshooting CHAPTER 9: INSTALLING THE REPORTING SYSTEM About the Reporting System Installation Notes Installing the Reporting System Connecting to a Database To use a native driver to connect to the database To use an SQL ODBC driver to connect to the database To configure the ODBC driver to recognize your password... 96

10 Table of Contents 9 Securing Connections Using SSL Using SSL certificates Setting up SSL Launching the Reporting System Starting and stopping Jakarta-Tomcat Using a Web browser to access the Reporting System Using SSM to access the Reporting System To configure SSM To configure the CS Reports button in SSM Validating Troubleshooting CHAPTER 10: INSTALLING EVENT CONSOLIDATORS About Installing Event Consolidators Prerequisites Installation Notes Installation directory Running SSM on Windows 2000 Server To configure IIS to not start automatically Java 2 Virtual Machine 1.3 Requirement Installing Event Consolidators To install Event Consolidators Validating To launch SSM To Set up the debugger on an Event Consolidator To inject an event Troubleshooting CHAPTER 11: INSTALLING REMOTE CONSOLES About Remote Consoles Prerequisites

11 10 SSM Installation Guide For Windows Installation Notes Installation directory Running SSM on Windows 2000 Server To configure IIS to not start automatically Java 2 Virtual Machine 1.3 Requirement Installing Remote Consoles Configuring SSM to send data to a Remote Console Validating Troubleshooting CHAPTER 12: VALIDATING DATA FLOW About Validating Data Flow Prerequisites Installing Event Replicator To install Event Replicator Adding a Connection Sending an Event Adding a Message Editing a Message Sending an Event at a Specified Rate Performing SQL Queries To add additional drivers CHAPTER 13: SPECIAL SITUATIONS About Configuring SSM for Trusted Sources Configuring SSM for Trusted Sources About Traversing a Firewall Traversing a Firewall To configure your Event Consolidator To configure the Central Server

12 Table of Contents 11 CHAPTER 14: REMOVING SSM About Removing SSM Removing SSM and the Normalizer Pack To remove SSM Removing Agents To remove the Reporting System APPENDIX A: SYSTEM REQUIREMENTS About SSM System Requirements Reporting System Requirements APPENDIX B: SUPPORTED DEVICES About SSM Supported Devices

13 12 SSM Installation Guide For Windows

14 Preface About the documentation This guide is part of the SPECTRUM Security Manager (SSM) documentation set. The full documentation set includes: SPECTRUM Security Manager Basics Guide SPECTRUM Security Manager Installation Guide for Windows SPECTRUM Security Manager Installation Guide for Solaris SPECTRUM Security Manager Reporting System Installation and Configuration Guide Installing and Using SPECTRUM Security Manager with SPECTRUM Normalizer Pack online help SSM online help release notes for SSM, the Reporting System, and the Normalizer Pack Document Feedback Please send feedback regarding SPECTRUM documents to the following address: Thank you for helping us improve our documentation.

15 14 SSM Installation Guide For Windows Online Documents SPECTRUM documents are available online at: Check this site for the latest updates and additions. Conventions Used in This Guide Text conventions This guide uses various typefaces to differentiate between coded and regular text, as well as to help you identify important concepts: Text that you type and text that appears on screen is presented in Lucinda Console type. Placeholders for variables and expressions appear in [square brackets]. User interface labels, such as dialog box titles and button names, appear in bold. Italics are used for references to other guides in the documentation set, and to introduce new terms. Icons This guide also uses Note, Tip, and Caution icons to call attention to important information. The Note icon indicates essential information related to the surrounding overview or procedure. The Tip icon indicates a recommendation. Many tips introduce best practice concepts.

16 15 The Caution icon indicates a warning. Cautions advise you about potential problems, and offer advice for avoiding these problems.

17 16 SSM Installation Guide For Windows

18 Preparation 1 About Preparing to Install SSM This chapter contains information to help you prepare to install NSM on your system. Aprisma recommends that you read this chapter, follow the procedures, and gather any essential information before beginning your SSM installation. This chapter includes information about: SSM system requirements. SPECTRUM Integration What you need to know about your security environment. The security devices that SSM supports. How to obtain and use Extraction and activation keys. SPECTRUM Integration If you will be using SSM with SPECTRUM, you must install the SPECTRUM Integration component of SSM before installing the SSM application. For installation instructions and further information, refer to the Using and Installing SPECTRUM Security Manager 3.3 with SPECTRUM guide.

19 18 SSM Installation Guide For Windows Security Environment Before installing SSM, you need to know: Which security devices are installed on your network (for example Firewalls, IDSs, and so forth); The type, model, version number, and operating system version (if applicable) of each security device. This information is vital because Aprisma develops decoders for data emitted from specific devices, and in some case, for specific versions of devices; The configuration of each security device; Who configured each security device; The type of data emitted from each security device (for example SNMP, SMTP, Syslog); Who the DBA is for the SSM database and their availability (optional). The Operating System hardening level. You may also want to have a log sample for each security device. Supported Devices SSM supports third-party security devices through agents and normalizers, which can be installed from an SSM Normalizer Pack. Normalizer Packs may be bundled with SSM or released separately and contain the latest normalizers and agents. For a list of the security devices supported by SSM, see "Supported Devices" on page 133 of this guide. If you use a device (or a version of a device) that does not appear on the supported devices list, SSM can parse and normalizer information from the device as long as it emits one of the following: SMTP traps SNMP traps Syslogs Aprisma continually expands the list of supported devices. For the latest normalizers and agent schedule, contact the Aprisma Customer Support Department.

20 Chapter 1: Preparation 19 Extraction and Activation Keys SSM requires two types of keys: extraction keys and activation keys. Extraction keys can be found in the letter supplied with your SSM CD and allow you to install SSM as a Central Server, Event Consolidator, or Remote Console. You cannot generate extraction keys yourself. A single extraction key can have one or more activation keys associated with it. You can generate activation keys from the Aprisma Web site. You can generate an activation key for each Central Server, Event Consolidator, and Remote Console that you are evaluating or purchasing. Activation keys expire for evaluation users. When the key expires, SSM shuts down and displays a message. Generating Activation Keys You create activation keys on the Aprisma key generation Web site using the Login Name and Login Password provided in the letter you received with your SSM CD. If you did not receive a Login Name or Password or if you experience difficulties logging in to the key generation Web site, contact the Aprisma Management Technologies support center, 24 hours a day at Option 6 or Alternatively, you can support at customer-relations@aprisma.com. Activation keys are unique to a specific Company Name and IP address. This means that each activation works only with the computer that corresponds to the IP address that you enter during the key generation process. Aprisma recommends that you install SSM components on computers that have static IP addresses. To generate activation keys 1. Open a Web browser and navigate to 2. Click on the Generate a SPECTRUM Security Manager Activate Key link. 3. Type your Login and Password. 4. Click Login. A list of your extraction keys appear.

21 20 SSM Installation Guide For Windows 5. Click the key referred to in the letter provided with your SSM CD. 6. Type the correct IP addresses for each Central Server, Event Consolidator, and Remote Console that you plan to install. You do not have to generate all your activation keys at once. 7. When finished, click Get_Keys. Your activation keys appear in the right column. 8. Click Logout to exit. Ensure that you enter the correct IP addresses. SSM will not run if you enter an incorrect IP address. If you enter an incorrect IP address, contact the Aprisma Management Technologies support center, 24 hours a day at Option 6 or Alternatively, you can support at customerrelations@aprisma.com. Key Usage Notes The products that use extraction and activation keys are case-sensitive. The keys, however, will always use uppercase letters. The Organization or Company Name must be exact, is case-sensitive and may be a combination of uppercase and lowercase letters and punctuation marks. Ensure that you do not confuse 1's and I's and 0's and O's when entering keys.

22 Chapter 1: Preparation 21 Pre-Installation Checklist For a detailed list of the SSM system requirements, see "System Requirements" on page 129 of this guide. Use the following checklist to ensure that you have the following information and hardware before installing SSM: Central Servers Verify Server meets the minimum system requirements CD ROM drive on the Central Server computer, or a LAN connection Monitor on the Central Server computer, or a LAN connection Keyboard on the Central Server computer, or a LAN connection Know IP Address of the Central Server Activation and Extraction Keys and your Organization name Event Consolidators Verify Server meets the minimum system requirements CD ROM drive on the Event Consolidator computer, or a LAN connection Monitor on the Event Consolidator computer, or a LAN connection Keyboard on the Event Consolidator computer, or a LAN connection Know IP Address of each Event Consolidator IP Address of the Central Server Port number of the Central Server (the default is 9317) Activation and Extraction Keys and your Organization name

23 22 SSM Installation Guide For Windows Remote Console Verify Server meets the minimum system requirements CD ROM drive on the Remote Console computer, or a LAN connection Monitor on the Remote Console, or a LAN connection Keyboard on the Remote Console, or a LAN connection Know IP Address of each Remote Console IP Address of the Central Server Port number of the Central Server (the default is 9317) Activation and Extraction Keys and your Organization name Database Know IP address and credentials of the database server Database user name and password

24 Installation Overview 2 About Installing SSM The following example illustrates a typical SSM installation. Your installation may differ depending on your network environment and security architecture.

25 24 SSM Installation Guide For Windows Installing SSM Components A typical SSM installation consists of the following components: A Central Server An SSM Database One or more Event Consolidators Normalizers An SSM installation may also have the following optional components: SPECTRUM Integration component The Reporting System The Reporting System/SPECTRUM Web Operator Suite Integration One or more Remote Consoles Agents For detailed information on installing the SPECTRUM integration component or the Reporting System as an integrated component of SPECTRUM s Web Operator Suite, see the Using and Installing SPECTRUM Security Manager 3.3 with SPECTRUM guide. The Central Server The Central Server is considered the core of SSM. You use it to create rules and direct other SSM components to detect, filter, prioritize, and transmit information from Event Consolidators and security devices. The Central Server has a user interface to build and edit rules. Once rules are created, they are pushed out to the Event Consolidators, Device Consolidators, and Remote Consoles. These components use rules to send events to SSM. Aprisma recommends that you install the Central Server on its own computer. The Central Server connects to the SSM database via a Java Database Connectivity (JDBC) connection. Use the JDBC Configuration Wizard ( Start>Programs> Spectrum Security Manager>Administrative Tools>Driver Configuration) to create this connection.

26 Chapter 2: Installation Overview 25 Event Consolidators Event Consolidators are collectors that receive information from your network devices, filter this information, and then send it to a Central Server. They are deployed throughout an organization to collect, analyze, and correlate event information. Event Consolidators do not have graphical user interfaces. Rules are be built on the Central Server and pushed out the Event Consolidators. Normalizers Normalizers are specialized applications that take messages from third-party security devices and reformat them into the standard SSM Message format. Install normalizers on any SSM devices (Central Servers, Event Consolidators, or Remote Consoles) that will receive events directly from third-party security devices. You can install normalizers from the SSM Normalizer Pack. Before you can use normalizers, you must: configure your security devices to send events to SSM edit the corresponding SSM rules For more information about normalizers, see the Normalizer Online Help. The Reporting System The Reporting System is a Web-based application that lets you create text- and graphic-based reports from information stored in your SSM database. It can be installed as a standalone application or as an integrated component of SPECTRUM s Web Operator Suite. You can generate a report from a pre-defined report or create your own custom reports. The Reporting System connects to the SSM database via a Web connection, which you can secure using Secure Socket Layering (SSL). Once installed and configured, you can launch the Reporting System from either a Web browser or the SSM Central Console. You can install the Reporting System on the same computer as the Central Server or on a separate computer.

27 26 SSM Installation Guide For Windows For more information, see the Reporting System Installation and Configuration Guide. The SSM Database The SSM database component is either an Oracle or MS SQL Server database. You must create the database on your server using scripts included on the SSM Installation CD before you can store SSM messages to it or run reports. You must edit the Central Server rules to store SSM events to this database. You can also create a database for each Event Consolidator. The JDBC Configuration Wizard SSM provides default JDBC drivers for the Oracle 8i and MS SQL Server databases. The JDBC Configuration Wizard allows you to create a connection to the SSM database using these drivers, and saves this information as the default settings. If you want to use a database other then Oracle 8i or MS SQL, you must download the driver and specify the settings. The JDBC Configuration Wizard is installed automatically with SSM Central Server. Remote Consoles Remote Consoles are dynamic graph viewers that you can install on computers other than the SSM Central Server. This product allows you to remotely monitor events in real-time. You can also use a Remote Console to create, edit, and test rules for your Central Server and Event Consolidators. Once your rules are ready to be deployed, you can copy them to other components. You must define rules on your Central Server, to make it send copies of events to your Remote Consoles. You build and edit these rules on the Central Server and send them to the Remote Consoles through rule-syncing. Remote Consoles can not send events to the Central Server. Agents Agents are small programs or scripts that extract information from devices and send this information to an Event Consolidator or Central Server. Each type of agent

28 Chapter 2: Installation Overview 27 extracts logs from a specific network device. For example the Intruder Alert Agent extracts logs form Intruder Alert version 3.5. This means that you need only install the agents that correspond to your network security devices. You can install agents on computers that are running or have access to third-party security devices. You can install agents from the SSM Normalizer Pack. For more information about agents, see the Normalizer Pack Online Help. Installing SSM To install SSM on your system, you must: 1. Generate activation keys from the Aprisma website. For more information, see "Extraction and Activation Keys" on page 19 of this guide. 2. If you will be using SSM with SPECTRUM, you must install the SPECTRUM Integration Components from the SSM Installation CD. For more information, see the Using and Installing SPECTRUM Security Manager 3.3 with SPECTRUM guide. 3. Create an SSM database (the default is called Generic) using scripts on the SSM Installation CD. For more information, see "Creating A Database" on page 29 of this guide. 4. Install the Central Server from the SSM Installation CD. For more information, see "Installing Central Servers" on page 35 of this guide. 5. Configure the Central Server to send information to the SSM database. For more information, see "Connecting the Central Server to the SSM Database" on page 41 of this guide. 6. Install normalizers from the SSM CD. For more information, see "Installing the Normalizer Pack" on page 45 of this guide. 7. Install Event Consolidators.

29 28 SSM Installation Guide For Windows For more information, see "Installing Event Consolidators" on page 103 of this guide. 8. Install the Reporting System standalone application or the Reporting System/SPECTRUM Web Operator Suite Integration. (optional) For more information on installing the Reporting System, see "Installing the Reporting System" on page 93 of this guide. For more information on installing the Reporting System as an integrated component of SPECTRUM s Web Operator Suite Integration, see the Using and Installing SPECTRUM Security Manager 3.3 with SPECTRUM guide. 9. Configure the Reporting System to access the SSM database. (optional) For more information, see "Connecting to a Database" on page 94 of this guide. 10. Install agents from the SSM CD. (optional) For more information, see "Installing Agents" on page 53 of this guide. 11. Install Remote Consoles. (optional) For more information, see "Installing Remote Consoles" on page 109 of this guide.

30 Creating A Database 3 About the SSM Database You must create the SSM database on your database server before you can store SSM messages in it. You only need to create the database once, since any additional SSM components can use this same database. The Central Server should have its own database. If you desire, you can add additional databases for your Event Consolidators. For Central Servers and Event Consolidators, you must define which events are stored in the database using SSM rules. SSM supports MS SQL Server and Oracle databases.

31 30 SSM Installation Guide For Windows About MS SQL Server Database Integration To use MS SQL Server with SSM, you must: 1. Create an MS SQL Server database. 2. Create a user with database ownership (DBO) rights. The following procedures assume that you have installed and configured MS SQL Server. Creating an SQL Server database 1. Go to Start > Programs > Microsoft SQL Server > Query Analyzer. The SQL Server Query Analyzer opens. 2. Log on to the appropriate server as the system administrator. 3. Go to File > Open. Browse to the SSM Installation CD. Open the DB_Scripts directory. 4. Double-click the sql_create.sql file to open it. This script replaces any existing database (named Generic) with a new, empty version. If a database named Generic already exists on your system and you wish to save the data, you must back up the database before running the script. If you need to use a different database name, you must: Edit the database script. Change the default database name in the JDBC Configuration Wizard. 5. Press F5 to run the script. The script creates the Generic database and tables. 6. Close SQL Server Query Analyzer. Creating a User with DBO Rights Once you create your SSM database, you need to create a user with DBO rights for the database.

32 Chapter 3: Creating A Database 31 If you wish to use an existing user for the SSM database, follow the steps outlined in the "To set the owner rights for an existing generic user" section to ensure that the existing user has been assigned the db_owner role. Without this role, the existing user cannot access the Generic database. If you wish to create a new user, follow the steps outlines in the "To create a new user with DBO rights" section. Remember your username and password; you will need them later in the installation procedure. To create a new user with DBO rights 1. Go to Start > Programs > Microsoft SQL Server >Enterprise Manager. 2. Connect to the SQL server that contains the SSM Generic database. 3. To create a new user, go to Console Root > Microsoft SQL Servers > SQL Server Group > [name of your server] > Security. 4. Right-click Logins and select New Login from the shortcut menu. 5. Type the Name for the new user. 6. Select the SQL Server Authentication option. 7. Type a Password. 8. From the Default Database field, select Generic. 9. On the Database Access tab, select the Generic checkbox. 10. The Database Rules for Generic will appear below. Select db_owner checkbox. Click OK. 11. Click OK in the Confirm the new password popup. 12. Exit SQL Server Enterprise Manager. To set the owner rights for an existing generic user 1. Go to Start > Programs > Microsoft SQL Server >Enterprise Manager. 2. Connect to the SQL server that contains the SSM Generic database. 3. Go to Console Root > Microsoft SQL Servers > SQL Server Groups >[name of your server] > Databases > [name of your SSM database].

33 32 SSM Installation Guide For Windows 4. Double-click Users. 5. Double-click the user you want to give DBO rights to.. 6. In the Database Role Membership box, select the db_owner. 7. Exit SQL Server Enterprise Manager. Validating To validate that the database and event table exists and that you can query it. Log in to the database using either SQL Server Query Manager or SQL Plus and submit a query (select * from event) against the Generic database. If the query returns an empty result, this means that the database exists and is working. If the query returns an error, this means that the database is not working properly or you are not using the correct database. Troubleshooting If the database is not working, check that: The database name is correct (the default is Generic). The SSM database tables are created by the sql_create.sql script.

34 Chapter 3: Creating A Database 33 About Oracle Database Integration To use Oracle with SSM, you must create an Oracle database. The following procedures assume that you have installed and configured Oracle. Creating an Oracle Database 1. Log on to SQL Plus Worksheet as the user assigned the DBO role. 2. Open the following file from the SSM CD: DB_Scripts\create_Oracle.sql. This script replaces any existing database named Generic with a new, empty version. If a database named Generic already exists on your system, and you wish to save the data, you must back up the database before running the script. 3. Once the script is finished, select Execute from the Worksheet menu. 4. Exit SQL Plus Worksheet. To use a different database name, you must: Edit the database script. Change the default database name in the JDBC Configuration Wizard. Validating To validate that the database and event table exists that you can query it, log in to the database and submit a query (select * from event). If the query returns an empty result, this means that the database exists and is working. If the query returns an error, this means that the database is not working properly.

35 34 SSM Installation Guide For Windows Troubleshooting If the database is not working, check that: The database name is correct (the default is Generic). The SSM database tables are created.

36 Installing Central Servers 4 About Installing Central Servers The Central Server is used to create rules and direct other SSM components to detect, filter, prioritize, and transmit information from Event Consolidators. Prerequisites Before installing the Central Server, ensure that the server meets the system requirements and you have all of the necessary information specified in the "Preparation" chapter of this guide. Installation Notes Running SSM on Windows 2000 Server SSM uses some of the same ports as the Windows 2000 Internet Information Server (IIS). The IIS is installed and started automatically with some versions of Windows. The port conflict can prevent SSM from receiving Syslogs and SMTP traps. Make certain that the IIS is not running before you start SSM. You can configure the IIS service so that it does not start automatically when Windows restarts.

37 36 SSM Installation Guide For Windows If you have configured Windows to run the SMTP server, SSM will not receive any events from port 25. To configure IIS to not start automatically 1. Click Start > Settings > Control Panel. 2. Double-click Administrative Tools, then Services. The Services dialog box appears. 3. Right-click IIS Admin and select Properties from the shortcut menu. The IIS Admin Services Properties dialog box appears. 4. From the Startup type drop-down, select Manual. 5. Click Stop to immediately stop IIS. 6. Click OK to save your changes. Java 2 Virtual Machine 1.3 Requirement SSM requires the Java 2 Virtual Machine (JVM), version 1.3. The SSM InstallShield automatically installs the Java 2 Virtual Machine (JVM), version 1.3, even if there already is a JVM installed. Installing Central Servers Shut down any open applications before installing any SSM software. To install Central Servers 1. Insert the SSM CD into your CD-ROM drive. If Autorun is enabled on your computer, the SSM InstallShield begins.click on the SPECTRUM Security Manager installation option. If Autorun is disabled run /SSM/SSMsetup.exe. The InstallShield begins. 2. At the Welcome screen click Next.

38 Chapter 4: Installing Central Servers Ensure that you type the correct information at this screen: Type any Name that describes this installation. Type the Company Name provided in the letter included with your SSM purchase in the Organization field. Type the Central Server Extraction key provided in the letter included with your SSM purchase. 4. Click I accept the terms of the license agreement. 5. Do not enter a memory allocation value that is higher than the maximum memory of the server. This causes a black DOS prompt to appear and then disappear when starting SSM. For example, if the total RAM is 512 MB, then the total allocation should be 384 ( ) to ensure that all system resources are not allocated to SSM, leaving nothing for the operating system. 6. It is strongly recommended that you use C:\SSM as the installation directory name because of limitations of the JRE 1.3. You can change this name; however, keep the length of the file name under five characters. The SSM installation folder must use a short directory name for SSM to register properly, and there must not be any spaces in the path. Installing SSM to a path such as C:\Program Files\SSM will result in unpredictable and unstable behavior. 7. This screen shows you the Setup Type you are installing, based on the extraction key. In this case it will say Central Server. 8. When the installation is complete, the JDBC Configuration Wizard appears. If the JDBC Configuration Wizard does not appear, launch it manually by selecting Start > Programs > Spectrum Security Manager > Administration Tools >Driver Configuration. Configure this information to match the database user or click Finished to accept the following default values: JDBC URL: jdbc:inetdae7: :1433?database=generic Username: sa Password: [blank] You must restart the computer for the database changes to take effect.

39 38 SSM Installation Guide For Windows Validating Ensure that the Central Server is installed properly by: 1. Launching SSM. 2. Sending an event. To launch SSM 1. Click Start > Programs > Spectrum Security Manager > SPECTRUM Security Manager You will be prompted to enter the activation key the first time you launch SSM. 3. The SSM Central Console appears, click the SSM button in the lower left hand corner. Closing this window will shutdown SSM. To inject an event 1. Click Go to Localsystem Graph and draw an edge from msg_listener to the debugger. To draw an edge; place your mouse pointer over the msg_listener node, click and drag a line to the debugger node and release. You will see an line with an arrow drawn between the nodes, this is called an edge. 2. Open a command line and telnet to port 9317 on the Central Server. Type: event t_ip [any IP Address] endevent You should see the event pass through the debugger window. The debugger window is the black window that opens behind the SSM Central Console. The title bar of the debugger window reads C:\SSM\_smjvm\bin\java.exe. When you are satisfied that the Central Server is working properly, delete the edge from msg_listener to the debugger because sending events to the debugger adds overhead. Troubleshooting If the Central Server does not launch:

40 Chapter 4: Installing Central Servers Restart the computer and re-launch the Central Server. If the computer is low on memory, the Central Server may not launch. 2. Next, check that you entered the same Company Name when you launched the Event Consolidator as you entered in the Organization field in the InstallShield. If you entered the wrong information in the InstallShield, remove the SSM folder from your hard drive and reinstall SSM. If the activation key dialog box disappears and you receive an error message prompting you to contact Aprisma s Customer Support department, your activation key is wrong. Ensure that you: Typed the correct activation key (ensure that you didn't confuse I's and 1's and O's and 0's). Entered correct IP Address when you generated the activation key. If Java exception errors appear in the DOS window, install JRE 1.3 from the SSM CD. This situation may result from an incompatible JRE version. You can test whether your browser s JRE is working by navigating to a website that contains Java applets.

41 40 SSM Installation Guide For Windows

42 Connecting the Central Server to the SSM Database 5 About Connecting the Central Server SSM uses a JDBC Configuration Wizard to create and maintain the database connection to SSM. You can change the default database to Oracle or add another database by adding a new driver to the C:\SSM\lib\db directory and entering this information into the JDBC Configuration Wizard. You can use any type of suitable driver. You cannot duplicate database connections using one database driver. The JDBC Configuration Wizard writes information to the /scripts/db.nsm directory. You can also edit this file directly. You can find information needed for the JDBC Configuration Wizard in the corresponding driver s documentation. Installing the JDBC Configuration Wizard The JDBC Configuration Wizard is installed with the SSM Central Servers and Event Consolidators.

43 42 SSM Installation Guide For Windows Creating the JDBC Database Connection Connecting the JDBC driver to the database is an integral part of installing SSM. If this connection is not working or fails for any reason, SSM cannot store messages in the database. To create the JDBC database connection: 1. Click Start > Programs > Spectrum Security Manager > Administration Tools and select Driver Configuration. 2. Modify the following fields, as required. Field Connect to Database Connection Name JDBC URL Name of Driver Location of JAR file Username Password Do Choose either Default SQL or Default Oracle from the drop-down list. Type a name for the database connection. Type the location of the database driver. This must consist of the following: jdbc, the name of the driver, the IP address of the database server, and the database name. For example, the default SQL entry is jdbc:inetdae7: :1433?database=generic. For the default Oracle or SQL settings, only the IP address and the name of the database must be edited. Type the name of the driver used for the database. For the default Oracle or SQL settings, this should not be changed. Type the location of the database driver on your local drive. This default should not be changed for the Oracle or SQL databases. If adding a new driver for another database, it should be saved in the C:\SSM\lib\db directory. Type the username used to connect to the database. Type the password used to connect to the database. 3. Click Finished. You must restart SSM for any changes made to the database to take effect.

44 Chapter 5: Connecting the Central Server to the SSM Database 43 Validating Validate that the Central Server is sending events to the database by: 1. Launching SSM. 2. Sending an event. 3. Querying the database. To launch SSM 1. Click Start > Programs > Spectrum Security Manager > SPECTRUM Security Manager You will be prompted to enter the activation key the first time you launch SSM. 3. The SSM Central Console appears. To inject an event 1. Open a command line and telnet to port 9317 on the Central Server. Type: event t_ip [any IP Address] endevent To query the database Log in to the database and submit a query (select * from event). If the query returns a result with the value of t_ip the same as the event you entered in the above step, SSM is connected to the database properly.

45 44 SSM Installation Guide For Windows

46 Installing the Normalizer Pack 6 About Installing Normalizers Normalizers are specialized software applications that take messages from thirdparty security devices and reformat them into the SSM Message format. Install normalizers on the SSM devices (Central Servers, Event Consolidators, Device Consolidators, or Remote Consoles) that will be receiving events from third-party security devices. Prerequisites You must install SSM before installing the Normalizer Pack.

47 46 SSM Installation Guide For Windows Installation Notes SSM 3.3a ships with Normalizer Pack 1.4. When you install this Normalizer Pack, any existing normalizer operators are renamed. This normalizer pack: Installs several new normalizers and their associated operators Renames all existing normalizer operators Normalizer Operators Once you install Normalizer Pack 1.4, the following normalizer operators will appear in the operator drop-down list in the SSM Visualization Window: normalizer_snmp: BlackIce V2.6 normalizer_snmp: CheckPoint V4.1 normalizer_snmp: CiscoPix V5.3 normalizer_snmp: CiscoPix V6.0 normalizer_snmp: Dragon V4.2 normalizer_snmp: ISS RealSecure V5.0 normalizer_snmp: ISS RealSecure V6.0 normalizer_snmp: IceCap V2.6 normalizer_snmp: McAfee AntiVirus V4.5 normalizer_snmp: NFR V5.x normalizer_snmp:netprowler V3.5 normalizer_snmp: NetScreen V5XP normalizer_nsmp: Oracle V8i normalizer_snmp: Raptor V6.x normalizer_snmp: SessionWall V normalizer_snmp: SunScreen V3.1 normalizer_snmp: Cisco IOS V12.x normalizer_snmp: CiscoIDS V2.2 normalizer_snmp: CiscoPix V5.0

48 Chapter 6: Installing the Normalizer Pack 47 normalizer_syslog: CiscoPix V6.0 normalizer_syslog: CyberGuard V4.3 normalizer_syslog: NetScreen V10.0 normalizer_syslog: Snort V1.8 normalizer_syslog: Solaris V8.0 normalizer_syslog: WatchGuard V4.61 Each operator name indicates: The product it supports (for example, as BlackIce). The version of the product it supports (for example, as V2.6). The type of data it normalizes, and the SSM rulespaces it works in (for example, snmp or syslog) The Normalizer Pack also reconfigures the default SSM rules to include these operators. All operators with "snmp" in their names will appear in both your Central Server and Event Consolidator SNMP rules. All operators with "syslog" in their names will appear in both your Central Server and Event Consolidator Syslog rules. You must configure the operators in these rules in order for the rules to work properly.

49 48 SSM Installation Guide For Windows OID Operators Normalizer Pack 1.4 adds the following object identifier (OID) operators to SSM: Object Identifier: Black Ice Object Identifier: Checkpoint Object Identifier: Dragon Object Identifier: ISS Realoid: Dragon Object Identifier: IceCap Object Identifier: McAfee AntiVirus Object Identifier: NFR Object Identifier: NetProwler Object Identifier: NetScreen OS2.4 Object Identifier: NetScreen OS2.6 Object Identifier: Oracle Object Identifier: Pix Object Identifier: Raptor Object Identifier: SessionWall Object Identifier: SunScreen Object Identifier: oid These operators will appear in your default SSM rules, but you do not need to configure them. Installing Normalizers When you install the Normalizer Pack, all normalizers are installed by default. SNMP normalizers are added to your Central Server and Event Consolidator SNMP rules. Syslog normalizers are added to the Syslog rules.

50 Chapter 6: Installing the Normalizer Pack 49 SSM will not work properly until: You configure any normalizers that you intend to use. To install the Normalizer Pack 1. Insert the SSM CD into the CD ROM. The InstallShield begins. Choose the Normalizer Pack installation option. 2. Follow the procedures outlined in the InstallShield. Ensure that: The install directory is the same as the directory where you installed SSM. If you left the default for your SSM installation the directory is C:\SSM. Validating Central Server On the Central Server, check that the Normalizer Pack is installed properly by: Opening the SSM Visualization Window and ensure that normalizer operators now appear in the operator drop-down list. Checking the corresponding.properties files are located in the /etc directory. Navigating to the SNMP rule space and ensuring that your graph looks similar to

51 50 SSM Installation Guide For Windows the following: Event Consolidators, and Remote Consoles On Event Consolidators, and Remote Consoles, check that the Normalizer Pack is installed properly by: Checking the corresponding.properties files are located in the /etc directory. Troubleshooting If the normalizer operators do not appear in the operator drop-down list: Check that you have installed into the correct directory. To remedy this situation, remove and then reinstall the Normalizer Pack. If SSM is not receiving events from a security device: For security devices that generate SNMP events, use a third party application

52 Chapter 6: Installing the Normalizer Pack 51 such as Trapreceiver to check the OID of the security device. Enter this in the oid attribute of the corresponding normalizer. For security devices that generate syslog events, use a third party device such as Snoop or Netcat to check the facility number of the security device. Enter this in the facility_number attribute of the corresponding normalizer.

53 52 SSM Installation Guide For Windows

54 Installing Agents 7 About Agents Agents are small programs or scripts that extract information from network devices and send this information to SSM. Agents are needed for devices that do not have the capability to send information to SSM on their own using SNMP, SMTP or Syslog. Agents are installed from the SSM CD. There are eight agents that ship with Normalizer Pack 1.4: BlackIce Defender Cisco IDS Event2Message Intruder Alert McAfee NetCache Oracle Syntegra The Event2Message agent has extended functionality and the installation instructions for this agent are documented in "Installing Event2Message" on page 83 of this guide.

55 54 SSM Installation Guide For Windows Installation Notes Agents must have access to the logs of the products that they work with. For example, the McAfee agent needs access to McAfee AntiVirus logs. You can install an agent on the computer running the associated product, or you can install it on a different computer as long as the agent still has access to the product logs. Some third-party products allow remote logging, or network access to logs. About BlackIce Defender Agent The BlackIce Defender agent extracts and normalizes data from BlackIce Defender 2.9, and sends it to SSM. The following table describes the BlackIce Defender Agent: Works with BlackICE Defender Version number 2.9 Works on Windows 95/98/98SE/Me Windows NT 4.0 Windows 2000 Means of communication with SSM SNMP traps About the Supported Product The following table describes the product that this agent supports: Name BlackICE Defender for Server Manufacturer Internet Security Systems (ISS) Type Software firewall and IDS Version number 2.9