Table of Contents. Chapter 1: Preface. Chapter 2: Introduction. Chapter 3: Installation Considerations

Transcription

1

2

3 Table of Contents Chapter 1: Preface Documentation Audience Document Conventions Terminology Chapter 2: Introduction About Smart Sensor The Smart Sensor Server The Smart Sensor Agents Features and Capabilities Threat Intelligence OpenIOC Files Sample Contents of an OpenIOC File YARA Rules Sample YARA Rules Product Versions Chapter 3: Installation Considerations Unsupported IPv Dedicated Windows 2008 Server Server Performance Database Other Security Software Server Installation Checklist Agent Installation Checklist i

4 Installation Guide Local Agent Installation Remote Agent Installation Enabling Administrative Shares Chapter 4: Installing Smart Sensor Server Requirements Agent Requirements Installing the Server Setup Flow Configuring the Database Server Configuring the Web Server Specifying Smart Sensor Server Identification Specifying Listening Ports for Agent Communication Specifying the Listening Port for Server Communication Installing the Agent Locally Installing the Agent Remotely Uninstalling the Agent Locally Uninstalling the Agent Remotely Chapter 5: Technical Support Troubleshooting Resources Trend Community Using the Support Portal Security Intelligence Community Threat Encyclopedia Contacting Trend Micro Speeding Up the Support Call Sending Suspicious Content to Trend Micro File Reputation Services Reputation Services Web Reputation Services Other Resources TrendEdge ii

5 Table of Contents Download Center TrendLabs iii

6

7 Legal Trend Micro Incorporated reserves the right to make changes to this document and to the product described herein without notice. Before installing and using the product, review the readme files, release notes, and/or the latest version of the applicable documentation, which are available from the Trend Micro website at: Trend Micro, the Trend Micro t-ball logo, and Smart Sensor are trademarks or registered trademarks of Trend Micro Incorporated. All other product or company names may be trademarks or registered trademarks of their owners. Copyright Trend Micro Incorporated. All rights reserved. Document Part No.: APEM16387/ Release Date: April 2014 Protected by U.S. Patent No.: Patents pending. This documentation introduces the main features of the product and/or provides installation instructions for a production environment. Read through the documentation before installing or using the product. Detailed information about how to use specific features within the product may be available at the Trend Micro Online Help Center and/or the Trend Micro Knowledge Base. Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro document, please contact us at docs@trendmicro.com. v

8

9 Chapter 1 Preface Welcome to the Trend Micro Smart Sensor Installation Guide. This document provides details related to the server and agent installation. Documentation on page 1-2 Audience on page 1-2 Document Conventions on page 1-3 Terminology on page

10 Installation Guide Documentation The Smart Sensor documentation includes the following: TABLE 1-1. Smart Sensor Documentation DOCUMENTATION Online Help Installation Guide Readme file Knowledge Base DESCRIPTION HTML files that provide "how to's", usage advice, and field-specific information. The Help is accessible from the Smart Sensor server console. A *.pdf file that discusses requirements and procedures for installing the Smart Sensorserver and agent. A *.txt file that contains a list of known issues and basic installation steps. It may also contain late-breaking product information not found in the Help or printed documentation An online database of problem-solving and troubleshooting information. It provides the latest information about known product issues. To access the Knowledge Base, go to the following website: Check the latest version of the documentation at: Audience Smart Sensor documentation is intended for the following users: Smart Sensor Administrators: Responsible for Smart Sensor management, including the Smart Sensor agent installation and management. These users are expected to have advanced networking and server management knowledge. Incident responders: Users who investigate computer related crimes within an organization. The skill level of these individuals ranges from advanced to expert. 1-2

11 Preface Document Conventions To help you locate and interpret information easily, the Smart Sensor documentation uses the following conventions: TABLE 1-2. Document Conventions CONVENTION ALL CAPITALS Bold Italics <Text> Note DESCRIPTION Acronyms, abbreviations, and names of certain commands and keys on the keyboard Menus and menu commands, command buttons, tabs, options, and tasks References to other documentation or new technology components Indicates that the text inside the angle brackets should be replaced by actual data. For example, C:\Program Files \<file_name> can be C:\Program Files\sample.jpg. Provides configuration notes or recommendations Tip Provides best practice information and Trend Micro recommendations WARNING! Provides warnings about activities that may harm computers on your network Terminology The following table provides the official terminology used throughout the Smart Sensor documentation: 1-3

12 Installation Guide TABLE 1-3. Smart Sensor Terminology TERMINOLOGY DESCRIPTION Server Server computer Administrator (or Smart Sensor administrator) Console Targeted attacks / advanced persistent threats (APTs) / advanced threats License activation Agent installation folder The Smart Sensor server program The host where the Smart Sensor server is installed The person managing the Smart Sensor server The user interface for configuring and managing Smart Sensor server settings The console for the Smart Sensor server program is called "web console". A category of threats that pertain to computer intrusions by threat actors that aggressively pursue and compromise chosen targets. APTs are often conducted in campaigns a series of failed and successful attempts over time to get deeper and deeper into a target s network and are thus not isolated incidents. In addition, while malware are typically used as attack tools, the real threat is the involvement of human operators who will adapt, adjust, and improve their methods based on the victim s defenses. Includes the type of Smart Sensor server installation and the allowed period of usage that you can use the application The folder on the host that contains the Smart Sensor agent files. If you accept the default settings during installation, you will find the installation folder at any of the following locations: C:\Program Files\Trend Micro\ESE Server installation folder The folder on the host that contains the Smart Sensor server files. If you accept the default settings during installation, you will find the installation folder at any of the following locations: C:\Program Files\Trend Micro\Smart Sensor 1-4

13 Chapter 2 Introduction This section provides an overview of Smart Sensor and the features available in this release. Topics include: About Smart Sensor on page 2-2 Features and Capabilities on page 2-3 Threat Intelligence on page 2-3 OpenIOC Files on page 2-5 YARA Rules on page 2-9 Product Versions on page

14 Installation Guide About Smart Sensor Smart Sensor is designed to complete and complement the Trend Micro Custom Defense solution. Smart Sensor empowers administrators and information security experts with a timeshift concept threat lifecycle visibility to triage incident investigation and response. The Smart Sensor Server The server provides the following important functions: Real-time investigation of security events within the corporate network InfoSec engineers can launch an investigation to search for the arrival and execution of suspicious objects, including the Windows registry and memory. Visualization and diagnosis of security events and their history through the Smart Sensor web console Smart Sensor provides a history of what happened on every endpoint, which results to actionable intelligence. This enables you provide timely response and remediation. Support for advanced threat indicators and signature-less detection Traditional malware patterns cannot protect/detect incidents related to advanced persistent threats. Smart Sensor supports OpenIOC and YARA rules, which help detect targeted attacks. The Smart Sensor server and agent communication is based on HTTPS. The Smart Sensor Agents The Smart Sensor agents are managed endpoints that are running the Smart Sensor agent program. Installing the agent program on supported endpoints allows you to determine the files, executions, and important system resources on every agent machine. Smart Sensor continuously monitors the arrival and execution of suspicious objects. 2-2

15 Introduction Note NOTE: Please refer to the Installation Guide for details about agent requirements and deployment. The agent program is enabled by default to provide you with real-time recording of the arrival of vectors commonly associated with targeted attacks file executions, memory violations, registry changes, and more. Agents send query results to the server in real time. On the other hand, the Smart Sensor server queries agent recordings only during an investigation. The server retains only the results from the most recent investigation. Log on to the web console and go to the Agents screen to view all agents in your network and adjust applicable settings. Features and Capabilities FEATURE Real-time endpoint investigation Discovery and verification Threat analysis DESCRIPTION Perform multi-level "signature-less" investigations using rich IOC (indicators of compromise) Monitor and investigate endpoints regardless of their location on premise, remote, or cloud-based Analyze the enterprise-wide chain of events involved in a targeted attack Threat Intelligence Threat intelligence refers to indicators and suspicious objects (a.k.a. digital artifacts) that can be used to identify the tools, tactics, and procedures threat actors engaging in targeted attacks use. Both external and local threat intelligence is crucial for developing the ability to detect attacks early. Threat intelligence are conditions that Smart Sensor uses to search target endpoints. 2-3

16 Installation Guide To carry out a successful investigation or to yield better conclusive results, incident responders need usable threat intelligence, refer to the Smart Sensor Online Help. Smart Sensor supports the following intelligence types: Suspicious objects: These are digital artifacts resulting from analysis from any Trend Micro Deep Discovery products or other sources. Note If there are multiple entries per object type, separate each entry with a line. For details, refer to the Valid Query Strings topic in the Online Help. SUSPICIOUS OBJECT IP addresses and ports DESCRIPTION Type the IPv4 ddress of endpoints Delimit per line Valid format: :8080 or DNS records Type the domain name connected from endpoints. Valid format: cncserver.com or malicioussite.com Delimit each entry per line. User accounts Type the name of the Active Directory account or local user. Delimit each entry per line. Valid formats: Active Directory user: <domain>\<user name> or jp \jane_doe Local user: <user name> or jane_doe File SHA-1 hashes Type or copy the hash value of a suspicious file. Delimit each entry per line. Valid format: a2da9cda33ce378a21f54e9f03f6c0c9efba61fa Keywords on file path Type the directory or full path. Delimit each entry per line. Valid format (partial path): tmp 2-4

17 Introduction SUSPICIOUS OBJECT Keywords on file name DESCRIPTION Type the full or extension name. Delimit each entry per line. Valid format (partial name): decoy_document Registry items: These are registry keys, names, or data resulting from any hostbased anti-malware solutions. Important Please take note of the supported matching mechanism when investigating for registry items: Key: search for the exact match Name: searches for partial matches of the name value provided Data: searches for partial matches of rdata that contain or do not contain the value provided Indicators of Compromise (IOCs) on page 2-5 YARA rules on page 2-9 OpenIOC Files An OpenIOC file (*.ioc) groups Indicators of Compromise (IOCs), and communicates these forensic artifacts in a machine readable format. Smart Sensor supports the following indicators and converts them as conditions used in an investigation: TABLE 2-1. Supported OpenIOC Schemas in Smart Sensor 1.0 SUPPORTED CATEGORY CONTEXT SEARCH CONTENT TYPE DESCRIPTION UserItem UserItem/fullname String Domain and user account name 2-5

18 Installation Guide SUPPORTED CATEGORY CONTEXT SEARCH CONTENT TYPE DESCRIPTION UserItem UserItem/Username String User account name UserItem UserItem/grouplist/ groupname String Group name UserItem UserItem/disabled String Disable user UserItem UserItem/LastLogin String Most recent/last known access PortItem PortItem/CreationTime String Timestamp when the connection is established PortItem PortItem/process String Bind on a specific process PortItem PortItem/remoteIP String Connected remote IP address PortItem PortItem/remotePort String Connected remote port PortItem PortItem/localIP String Binding local port ProcessIte m ProcessItem/name String Connection is created by a specific process name ProcessIte m ProcessItem/PortList/ PortItem/CreationTime String Timestamp when a process is created ProcessIte m ProcessItem/PortList/ PortItem/localIP String Connected local IP address ProcessIte m ProcessItem/PortList/ PortItem/remoteIP String Connected remote IP address ProcessIte m ProcessItem/Username String Account of the process owner ProcessIte m ProcessItem/SectionList/ MemorySection/ DigitalSignature/ CertificateIssuer String Process signer FileItem FileItem/FileExtension String File extension 2-6

19 Introduction SUPPORTED CATEGORY CONTEXT SEARCH CONTENT TYPE DESCRIPTION FileItem FileItem/Username String Created by a specific account FileItem FileItem/FullPath String Suspicious or target landing folder FileItem FileItem/FileName String Suspicious file name FileItem FileItem/Created String Timestamp when a file is created FileItem FileItem/Modified String Timestamp when a file is modified FileItem FileItem/Sha1sum String Suspicious file SHA1-hash DnsEntryIt em DnsEntryItem/Host String specific DNS host DnsEntryIt em DnsEntryItem/RecordData/ Host String Host name DnsEntryIt em DnsEntryItem/RecordData/ IPv4Address String IPv4 address Network Network/DNS String DNS record obtained from a network appliance Sample Contents of an OpenIOC File <?xml version="1.0" encoding="us-ascii"?> <ioc xmlns:xsi=" xmlns:xsd=" id="6c3704f1-5e5d-41a6-bd57-bb1b " last-modified=" t12:01:02" xmlns=" <short_description>targeted Attack on Unknown in EMEA with backdoor</short_description> <description>related to SR </description> <authored_by>smart Sensor Team</authored_by> <authored_date> t11:57:01</authored_date> 2-7

20 Installation Guide <links /> <definition> <Indicator operator="or" id="eca4489b-70c b68bd0c800d39e08"> <IndicatorItem id="87f3c2b4-e61e-4b11-9c76-c8d414c00579" condition="is"> <Context document="fileitem" search="fileitem/sha1sum" type="mir" /> <Content type="string">05571e6835d5281ce20069a ec b</content> </IndicatorItem> <IndicatorItem id="8ebd1bb9-8c e11-f0e3a2eab1b7" condition="is"> <Context document="fileitem" search="fileitem/sha1sum" type="mir" /> <Content type="string">2e85371ff1a7830f8a6a363de351 c4fa1e094d50</content> </IndicatorItem> <IndicatorItem id="ff08f5fb-d3cc-4417-bafa-3d4e53cf3144" condition="is"> <Context document="fileitem" search="fileitem/sha1sum" type="mir" /> <Content type="string">ccf9468b1c3ebf884b4ac8f286 ef65d704c5cb83</content> </IndicatorItem> <IndicatorItem id="9dc82b62-522d-4a e60dc7d" condition="is"> <Context document="fileitem" search="fileitem/sha1sum" type="mir" /> <Content type="string">d2f5272a34b129433e73e0e77934 bd7fe8f8bc7b</content> </IndicatorItem> <IndicatorItem id="974c5e8d-a4e2-47e3-9e2f-aff54b7bca6e" condition="is"> <Context document="fileitem" search="fileitem/sha1sum" type="mir" /> <Content type="string">dfd43a14ff1a97d0ef95ff03b01 f </content> </IndicatorItem> </Indicator> 2-8

21 Introduction </definition> </ioc> YARA Rules A YARA file (*.yara) contains rules that describe malware in textual or binary patterns. Smart Sensor uses YARA rules to monitor and investigate running processes on managed endpoints. Sample YARA Rules rule APT_NGO_wuaclt { strings: $a = "%%APPDATA%%\\Microsoft\\wuauclt\\wuauclt.dat" $b = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)" $c = "/news/show.asp?id%d=%d" $d = "%%APPDATA%%\\Microsoft\\wuauclt\\" $e = "0l23kj@nboxu" $f = "%%s.asp?id=%%d&sid=%%d" $g = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SP Q%%d)" $h = "Cookies: UseID=KGIOODAOOK%%s" condition: ($a and $b and $c) or ($d and $e) or ($f and $g and $h) } Product Versions Install either a full or trial version of Smart Sensor. Both versions require a different type of Activation Code. To obtain an Activation Code, register the product with Trend Micro. 2-9

22 Installation Guide TABLE 2-2. Version Comparison Full Version Trial Version VERSION DESCRIPTION The full version includes all the product features and technical support, and provides a grace period (usually 30 days) after the license expires. After the grace period expires, technical support and investigation are not available. Renew the license before or after it expires by purchasing a maintenance renewal. The trial version includes all the product features. Upgrade a trial version to the full version at any time. If not upgraded at the end of the trial period, Smart Sensor disables investigation. 2-10

23 Chapter 3 Installation Considerations This section provides an overview of the Smart Sensor server and agent installation, including key considerations. Topics include: Unsupported IPv6 on page 3-2 Dedicated Windows 2008 Server on page 3-2 Server Performance on page 3-2 Database on page 3-3 Other Security Software on page 3-3 Server Installation Checklist on page 3-4 Agent Installation Checklist on page 3-4 Local Agent Installation on page 3-5 Remote Agent Installation on page

24 Installation Guide Unsupported IPv6 Smart Sensor 1.0 does not support IPv6. The communication between server and agents is through IPv4. A Smart Sensor server only communicates with agents through their IPv4 addresses. If the server will manage IPv4 and IPv6 agents, such agents must have both IPv4 and IPv6 addresses and must be identified by its host name. A Smart Sensor server is identified by its IPv4 address. Therefore, IPv6 agents cannot connect to the server. Dedicated Windows 2008 Server The Smart Sensor server only supports Windows Server When selecting the machine that will host the Smart Sensor server, consider the following: The CPU load the server can handle Other functions that the server performs If the target machine has other functions, choose another that does not run critical or resource-intensive applications. Server Performance Enterprise networks require servers with higher specifications than those required for small and medium-sized businesses. Tip Trend Micro recommends at least 2GHz dual processors and over 4GB of RAM for the Smart Sensor server. The number of networked agents that a single Smart Sensor server can manage depends on several factors, such as available server resources and network topology. Contact 3-2

25 Installation Considerations your Trend Micro representative for help in determining the number of agents the server can manage. Database Smart Sensor data must be stored in a SQL database. When you install Smart Sensor on a server that does not have its own database, Setup provides the option to install the Microsoft SQL Express. However, due to the limitations of SQL Express, large networks require a SQL server. Tip Trend Micro highly recommends using Microsoft SQL Server Standard or Enterprise Edition. SQL Express is suitable for testing purposes but not for production environments. The default ID is sa. Smart Sensor encrypts the password set during installation on page 4-4. Other Security Software These applications may prevent successful Smart Sensor server installation or affect its performance: Important The setup program does not check for these incompatibilities. The Smart Sensor component will still be installed. However, issues will occur (for example, the Smart Sensor services are unable to start). TABLE 3-1. Software Incompatibilities SMART SENSOR COMPONENT INCOMPATIBLE WITH: Server Trend Micro Safe Lock 3-3

26 Installation Guide SMART SENSOR COMPONENT INCOMPATIBLE WITH: Agent Trend Micro Deep Security and Trend Micro Titanium Server Installation Checklist Obtain the following from Trend Micro: Smart Sensor server installer package Activation Code Ensure that IIS 7 and all the necessary role services are installed. Check the required hardware and software specifications on page 4-2 prior to installing the server. Agent Installation Checklist The Smart Sensor agent installer is available in the Smart Sensor server installation folder (default is c:\program Files\Trend Micro\Smart Sensor \Download\Agent\). Check the required hardware and software specifications on page 4-3 prior to installing the agent. Depending on how you will install the Smart Sensor agent, refer to the following guidelines to help ensure a successful installation: Remote Agent Installation on page 3-5 Local Agent Installation on page

27 Installation Considerations Local Agent Installation To ensure that local installation can proceed: The agent installer, <Smart Sensor server installation path> \Download\Agent\TMSmartSensor.exe, must be shared or copied to the target endpoint The port that agents will use to listen for server communication must be allowed by the firewall The default port is Otherwise, use the value you have specified during installation on page Related information Installing the Agent Locally Remote Agent Installation Remote installation allows launching the installation on one computer and installing Trend Micro agent on another endpoint. When performing a remote installation, Setup checks if the target host meets the requirements for agent installation. To ensure that remote installation can proceed: On each target endpoint, start the Remote Registry service using an administrator account and not a Local System account. Remote Registry service is managed from Microsoft Management Console (Click Start > Run, and type services.msc). Record the endpoint's host name and logon credentials (user name and password with administrator access). Enable the administrative shares on page 3-6 on target endpoints \\<endpoint>\admin$ should be accessible. Refer to Enabling Administrative Shares on page 3-6for instructions. Target endpoints should have IPv4 or IPv4 address on an IPv6 network. Installing the Smart Sensor agent on a pure IPv6 endpoint is not supported. 3-5

28 Installation Guide The port that agents will use to listen for server communication must be allowed by the firewall. The default port is Otherwise, use the value you have specified during installation on page The port that the server will use to listen for agent communication must be available. The default ports are 8002 (fast port) and 8003 (slow port). Otherwise, use the value you have specified during installation on page Verify that target endpoints meet the Smart Sensor agent system requirements on page 4-3. Enabling Administrative Shares Procedure Windows XP Change the local security policy from Network access: Sharing and security model for local accounts to Classic - local users authenticate as themselves. Windows 7: a. Enable File and Printer Sharing through the Control Panel > Network and Internet > Network and Sharing Center. b. Open the Registry Editor and navigate to HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies \System. c. Add a new DWORD (32-bit) Value with the following settings: Name: LocalAccountTokenFilterPolicy Value data: 1 d. Reboot the computer. 3-6

29 Chapter 4 Installing Smart Sensor This section provides details about the Smart Sensor server and agent installation procedure. Topics include: Server Requirements on page 4-2 Agent Requirements on page 4-3 Installing the Server on page 4-4 Installing the Agent Locally on page 4-13 Installing the Agent Remotely on page 4-14 Uninstalling the Agent Locally on page 4-16 Uninstalling the Agent Remotely on page

30 Installation Guide Server Requirements TABLE 4-1. Required Hardware and Software Components for Server Installation REQUIRED HARDWARE/ SOFTWARE COMPONENT SPECIFICATIONS RAM 2GB minimum 4GB recommended Available disk space 10GB minimum 20GB recommended Operating system Microsoft Windows 2008 (64-bit) Microsoft Windows 2008 R2 (64-bit) Web server Microsoft Internet Information Services (IIS) 7 with the following role services: Static Content Default Document Directory Browsing HTTP Errors HTTP Redirection ASP.NET ASP CGI ISAPI Extensions ISAPI Filters Request Filtering IIS Management Console 4-2

31 Installing Smart Sensor REQUIRED HARDWARE/ SOFTWARE COMPONENT Web browser (for Smart Sensor web console access) SPECIFICATIONS Microsoft Internet Explorer 9 or later The latest version of Google Chrome The latest version of Mozilla Firefox Related information Setup Flow Installing the Server Agent Requirements TABLE 4-2. Required Hardware and Software Components for Agent Installation REQUIRED HARDWARE/ SOFTWARE COMPONENT SPECIFICATION RAM 512MB minimum for Windows XP 1GB minimum for others Available disk space 350MB minimum for Windows XP or Windows 7 1GB minimum for Windows 2003 or 2008 Operating system Windows Vista SP1 (32-/64-bit) Windows XP Service Pack 3 (SP3) (32-bit) Windows 7 (32-/64-bit) Windows Server 2003 (32-/64-bit) Windows Server 2008 (32-/64-bit) 4-3

32 Installation Guide Installing the Server Before you begin Refer to the Server Installation Checklist on page 3-4 for details. Procedure 1. On the target server, launch the Smart Sensor server installer (SmartSensorSetup.exe). The installation program checks for existing components, and then displays the License Agreement on page 4-5 screen. 2. Specify the location where the Smart Sensor server program will be installed. The default server installation path is C:\Program Files\Trend Micro \Smart Sensor. Identify the installation path or use the default path. If the path does not exist, Setup creates it automatically. 3. Type the full or trial Activation Code on page 2-9 for Smart Sensor. 4. Specify the Smart Sensor server settings. a. Configure database server on page 4-7. b. Configure the web server on page 4-9. c. Specify server identification on page d. Specify the server's listening ports for incoming agent communication on page e. Specify the agent's listening port for incoming server communication on page Set the admin account password that you will use to log on to the web console. 6. Click Install. 7. Click Finish. 4-4

33 Installing Smart Sensor Setup launches your default web browser, which allows you to access the Smart Sensor console. In addition, Setup displays the Smart Sensor readme file. What to do next Install agents. Read the Local Agent Installation on page 3-5 checklist for details. Related information Setup Flow Setup Flow Setup prompts for the following information when installing the Smart Sensor server. TABLE 4-3. Setup Flow and Needed Information SEQUENCE NEEDED INFORMATION 1. None 2. None 3. The server's installation path. 4-5

34 Installation Guide SEQUENCE NEEDED INFORMATION 4. The full or trial Activation Code on page 2-9 for Smart Sensor. 5. The database server settings on page 4-7, which Smart Sensor uses to record investigations and agent information. 6. The web server settings on page 4-9 for the Smart Sensor console. 7. The FQDN, host name, or IP address on page 4-10, which allows agents to identify the Smart Sensor server. 8. The port numbers on page 4-11, which the Smart Sensor server uses to communicate with agents. 9. The port number on page 4-12, which agents use to communicate with the Smart Sensor server. 4-6

35 Installing Smart Sensor SEQUENCE NEEDED INFORMATION 10. Set the password for the default admin account. The admin account is the account that you will use to log on to the Smart Sensor web console. 11. None 12. None Configuring the Database Server The settings on this screen defines how Smart Sensor stores data included in investigations and agent settings. The Smart Sensor server installation establishes this connection as well as the user name and password for accessing the database. Select the type of database you have for your Smart Sensor environment. 4-7

36 Installation Guide Procedure Microsoft SQL Express: If you do not have anything set up, Setup can install Microsoft SQL Express. Tip Microsoft SQL Server Express is suitable only for a small number of connections. Trend Micro recommends using an SQL server for large Smart Sensor networks. SQL Server: Type the SQL Server (\Instance) that you want to use. To specify an alternative SQL server, identify the server using its FQDN, IPv4 address, or NetBIOS name. 4-8

37 Installing Smart Sensor SQL server account/database authentication User name and Password: By default, the user name is sa. Set the password for the default sa, which Smart Sensor will use to access the database. Configuring the Web Server Before you begin Install the required IIS server and role services on page 4-2. The settings on this screen define how the network identifies your Smart Sensor server connection. Accept the default settings or specify new ones. 4-9

38 Installation Guide Procedure SSL port: Default is Enable HTTP: Select to access the console using HTTP. By default, the Smart Sensor web console can be accessed using HTTPS. If HTTP access is required, select this option. HTTP port: Default is If changed, access the web console using that port. Specifying Smart Sensor Server Identification The setting on this screen identify how agents communicate with the Smart Sensor server. 4-10

39 Installing Smart Sensor Select a host address for agents to communicate with the server. Important The setting on this screen is irreversible. If there is a need to change the server ID at a later time, both the Smart Sensor server and all registered agents must be reinstalled. Procedure Fully qualified domain name (FQDN) or host name: Type the FQDN or host name of the Smart Sensor server. IP address: Select from the list of available IPv4 addresses. Specifying Listening Ports for Agent Communication The settings on this screen identify the ports, which the Smart Sensor server uses to listen for incoming agent communication. 4-11

40 Installation Guide Accept the default values or specify new ones. Procedure HTTPS port (fast): Default is HTTPS port (slow): Default is Specifying the Listening Port for Server Communication The settings on this screen identify the port, which Smart Sensor agents use to listen for incoming server communication. In addition, this screen also displays the default agent installation path. 4-12

41 Installing Smart Sensor Procedure $ProgramFiles\TrendMicro\ESE: Default agent installation path. Client listening port: Accept the default value (8081), or type a new one. Installing the Agent Locally Before you begin Refer to local agent installation guidelines on page 3-5 for details. 4-13

42 Installation Guide Procedure 1. On the target endpoint (for example, TMLS08R2-A), run cmd.exe as an administrator. 2. Issue the following command: $ TMSmartSensor.exe The installer will perform a silent install of the agent. What to do next Log on to Smart Sensor web console, and verify whether the agent has registered through the Agents screen. The following example illustrates that TMLS08R2-A has successfully registered to the Smart Sensor server: Installing the Agent Remotely Before you begin Refer to remote agent installation guidelines on page 3-5 for details. Procedure 1. On the Smart Sensor server, navigate to <Smart Sensor installation path>\cmdtool\remote Helper, and then open the following files: PCList.csv 4-14

43 Installing Smart Sensor TargetedPCs.csv 2. Add the following information: Target endpoint's IP address or host name User name/password that has administrative rights to the target endpoint Important Do NOT modify the first lines of PCList.csv and TargetedPCs.csv. 3. Run cmd.exe using an administrator account, and then issue the following commands: $ cd <Smart Sensor installation path>\cmdtool\remote Helper RemoteHelper.exe TargetedPCs.csv..\..\download\agent\install.zip Results similar to the following appear: 4-15

44 Installation Guide Check Deploy.log and Targetpc.csv to determine whether the installation is completed successfully. Based on the sample results above, an agent with the IP address of is now added in the Agents screen. Uninstalling the Agent Locally Before you begin Refer to local agent installation guidelines on page 3-5 for details. Procedure 1. On the target agent, run cmd.exe as an administrator. 2. Issue the following command: $ TMSmartSensor_Uninstall.exe The installer will perform a silent uninstall of the agent. The Agents screen should no longer list the host name and other information related to the uninstalled agent. Uninstalling the Agent Remotely Before you begin Refer to remote agent installation guidelines on page 3-5 for details. Procedure 1. On the Smart Sensor server, navigate to <Smart Sensor installation path>\cmdtool\remote Helper, and then open the following files: PCList.csv TargetedPCs.csv 4-16

45 Installing Smart Sensor 2. Add the following information: IP address or host name of the agent that you want to uninstall User name/password that has administrative rights to the target agent Important Do NOT modify the first lines of PCList.csv and TargetedPCs.csv. 3. Run cmd.exe using an administrator account, and then issue the following commands: $ cd <Smart Sensor installation path>\cmdtool\remote Helper RemoteHelper.exe TargetedPCs.csv..\..\download\agent\ uninstall.zip The Agents screen should no longer list the host name and other information related to the uninstalled agent. 4-17

46

47 Chapter 5 Technical Support This chapter describes how to find solutions online, use the Support Portal, and contact Trend Micro. Topics include: Troubleshooting Resources on page 5-2 Contacting Trend Micro on page 5-4 Sending Suspicious Content to Trend Micro on page 5-5 Other Resources on page

48 Installation Guide Troubleshooting Resources Before contacting technical support, consider visiting the following Trend Micro online resources. Related information Trend Community Using the Support Portal Security Intelligence Community Threat Encyclopedia Trend Community To get help, share experiences, ask questions, and discuss security concerns with other users, enthusiasts, and security experts, go to: Using the Support Portal The Trend Micro Support Portal is a 24x7 online resource that contains the most up-todate information about both common and unusual problems. Procedure 1. Go to 2. Select a product or service from the appropriate drop-down list and specify any other related information. The Technical Support product page appears. 3. Use the Search Support box to search for available solutions. 4. If no solution is found, click Submit a Support Case from the left navigation and add any relevant details, or submit a support case here: 5-2

49 Technical Support A Trend Micro support engineer investigates the case and responds in 24 hours or less. Security Intelligence Community Trend Micro cyber security experts are an elite security intelligence team specializing in threat detection and analysis, cloud and virtualization security, and data encryption. Go to to learn about: Trend Micro blogs, Twitter, Facebook, YouTube, and other social media Threat reports, research papers, and spotlight articles Solutions, podcasts, and newsletters from global security insiders Free tools, apps, and widgets. Threat Encyclopedia Most malware today consists of "blended threats" - two or more technologies combined to bypass computer security protocols. Trend Micro combats this complex malware with products that create a custom defense strategy. The Threat Encyclopedia provides a comprehensive list of names and symptoms for various blended threats, including known malware, spam, malicious URLs, and known vulnerabilities. Go to to learn more about: Malware and malicious mobile code currently active or "in the wild" Correlated threat information pages to form a complete web attack story Internet threat advisories about targeted attacks and security threats Web attack and online trend information Weekly malware reports. 5-3

50 Installation Guide Contacting Trend Micro In the United States, Trend Micro representatives are available by phone, fax, or Address Trend Micro, Inc North De Anza Blvd., Cupertino, CA Phone Toll free: +1 (800) (sales) Voice: +1 (408) (main) Fax +1 (408) Website address Worldwide support offices: Trend Micro product documentation: Related information Speeding Up the Support Call Speeding Up the Support Call To improve problem resolution, have the following information available: Steps to reproduce the problem Appliance or network information Computer brand, model, and any additional hardware connected to the endpoint Amount of memory and free hard disk space Operating system and service pack version Endpoint client version 5-4

51 Technical Support Serial number or activation code Detailed description of install environment Exact text of any error message received. Sending Suspicious Content to Trend Micro Several options are available for sending suspicious content to Trend Micro for further analysis. Related information File Reputation Services Reputation Services Web Reputation Services File Reputation Services Gather system information and submit suspicious file content to Trend Micro: Record the case number for tracking purposes. Reputation Services Query the reputation of a specific IP address and nominate a message transfer agent for inclusion in the global approved list: Refer to the following Knowledge Base entry to send message samples to Trend Micro: 5-5

52 Installation Guide Web Reputation Services Query the safety rating and content type of a URL suspected of being a phishing site, or other so-called "disease vector" (the intentional source of Internet threats such as spyware and malware): If the assigned rating is incorrect, send a re-classification request to Trend Micro. Other Resources In addition to solutions and support, there are many other helpful resources available online to stay up to date, learn about innovations, and be aware of the latest security trends. Related information TrendEdge Download Center TrendLabs TrendEdge Find information about unsupported, innovative techniques, tools, and best practices for Trend Micro products and services. The TrendEdge database contains numerous documents covering a wide range of topics for Trend Micro partners, employees, and other interested parties. See the latest information added to TrendEdge at: 5-6

53 Technical Support Download Center From time to time, Trend Micro may release a patch for a reported known issue or an upgrade that applies to a specific product or service. To find out whether any patches are available, go to: If a patch has not been applied (patches are dated), open the Readme file to determine whether it is relevant to your environment. The Readme file also contains installation instructions. TrendLabs TrendLabs is a global network of research, development, and action centers committed to 24x7 threat surveillance, attack prevention, and timely and seamless solutions delivery. Serving as the backbone of the Trend Micro service infrastructure, TrendLabs is staffed by a team of several hundred engineers and certified support personnel that provide a wide range of product and technical support services. TrendLabs monitors the worldwide threat landscape to deliver effective security measures designed to detect, preempt, and eliminate attacks. The daily culmination of these efforts is shared with customers through frequent virus pattern file updates and scan engine refinements. Learn more about TrendLabs at: index.html#trendlabs 5-7

54

55