ESET REMOTE ADMINISTRATOR PLUG-IN FOR KASEYA Technical Setup and User Guide Click here t dwnlad the latest versin f this dcument
ESET REMOTE ADMINISTRATOR PLUG-INFOR KASEYA Cpyright 2016 by ESET, spl. s r.. ESET REMOTE ADMINISTRATOR Plug-in FOR KASEYA was develped by ESET, spl. s r.. Fr mre infrmatin visit www.eset.cm. All rights reserved. N part f this dcumentatin may be reprduced, stred in a retrieval system r transmitted in any frm r by any means, electrnic, mechanical, phtcpying, recrding, scanning, r therwise withut permissin in writing frm the authr. ESET, spl. s r.. reserves the right t change any f the described applicatin sftware withut prir ntice. Custmer Care Wrldwide: www.eset.cm/supprt REV. 7/12/2016
1. Intrductin...4 2. Plug-in Installatin...7 Prerequisites 3. Plug-in Installatin...8 4. Setup Wizard...11 5. Manage...14 ESET endpint prducts 6. Plicies...15 6.1 Create a plicy...15 fr versin 5.x ESET endpint prducts 6.2 Create a plicy...16 fr versin 6.x ESET endpint prducts 6.3 Plicy assignment...17 7. Deply...19 ESET prducts 7.1 Create versin...19 5.x ESET prduct packages 7.2 Create versin...20 6.x ESET prduct packages 7.3 Deply packages...21 8. Generate...22 a Reprt 9. Permissins...23 10. Clumn...24 Set Management 11. Threats...25 12. Dashbards...26 13. Ntificatins...27 14. Technical...28 Cnfig. and Trubleshting 15. Appendix...29 A: Sample Dashbard Charts 16. Appendix...32 B: Sample Ntificatins
1. Intrductin Thank yu fr using the ESET Remte Administratr (ERA) Plug-in fr Kaseya. The ERA Plug-in fr Kaseya is designed t allw an administratr t manage ESET endpint prducts frm within the Kaseya Virtual System Administratr. The ERA Plug-in fr Kaseya ffers the fllwing functinalities: Deply the latest versins f ESET endpint prducts and ESET File Security fr Micrsft Windws Server t Kaseya clients. Mnitr clients, threats, scans, and tasks using a dashbard similar t ESET Remte Administratr. Run scans r updates and distribute cnfiguratin plicy changes t ESET-prtected endpints. Create alarms, ntificatin emails, Kaseya Agent prcedures, and cnfigurable triggers fr ESET endpint prducts. Generate detailed reprts abut the health f yur envirnment using Kaseya Inf Center. View glbal events using the audit lg. Enhancements and bug fixes in versin 2.4.0.0: Plug-in nw supprts ESET Remte Administratr 5.3 and ESET Remte Administratr 6.3-6.4. ESET Remte Administratr 6.2 and earlier are n lnger supprted Enhancement: Kaseya grup may be assigned plicies Enhancement: Plicy view nw reflects the usability changes implemented in ERA 6.4 Enhancement: Plug-in nw supprts uninstall f passwrd prtected ESET agent Enhancement: Plug-in nw supprts language selectin when creating deplyment packages Enhancements and bug fixes in versin 2.3.1.0: Plug-in nw supprts ESET Remte Administratr 5.3 and ESET Remte Administratr 6.3. ESET Remte Administratr 6.2 is n lnger supprted Enhancement: Plug-in nw supprts Kaseya clud (multitenancy) Enhancement: Added WSC reprted AV clumn t "Clients" view Enhancement: Added ability t create activatin task via "Clients" view Enhancement: Added ability t remve Plug-in assigned plicies frm "Clients" view Enhancement: "Task Executin Lg" has been updated t reflect the change t new task wrkflw in ESET Remte Administratr 6.3 Enhancement: Added supprt fr Custm Deplyment. EMU MSPs can deply ESET slutins t clients withut specifying a Username and Passwrd Enhancement: Added supprt fr MAC OS X deplyment Enhancement: Updated ntificatins UI Enhancement: Updated Plicy Assignment UI with imprved filtering Nte: Plug-in users wh were previusly assigning plicies r ntificatins t Kaseya grups rather than specific clients shuld use the new assignment interface t re-assign plicies and ntificatins. The plug-in n lnger assigns these items 4
t grups due t multi-tenancy changes intrduced in this versin. Enhancement: Licenses are nw srted by License Owner and prduct name Bug Fix: Fixed an issue that caused errneus activatin tasks t be created fllwing deplyment f versin 6 slutins Bug Fix: Fixed an issue that caused reapply schema errrs n new (nn-upgrade) installatins Bug Fix: Fixed an issue intrduced in versin 2.2.2.1 that prevented versin 5 deplyments frm being edited Bug Fix: Fixed an issue that caused the plug-in nt t register that an ESET Remte Administratr Server update had cmpleted Bug Fix: Fixed an issue that caused deplyment t Windws Server 2012 t install the wrng client slutin Bug Fix: Fixed an issue that caused V6 deplyment packages nt t aut-select their crrect agent certificate during edit Bug Fix: Fixed an issue that caused multiple actins nt t fire when a ntificatin included a cldwn task Enhancements and bug fixes in versin 2.2.1.0: Enhancement: Remved frced rebt after running ESET Install/Uninstall deplyment scripts Bug fix: Fixed an issue that caused certain IIS cnfiguratins t nt crrectly serve javascript assciated with plug-in pages Bug fix: Fixed an issue where use f specific Kaseya rle permissin settings caused UI buttns nt t display Bug fix: Fixed an issue where a single client with multiple netwrk adapters culd be displayed as a duplicate Bug fix: Fixed an issue where Install/Uninstall wuld nt run with specific SQL Server cnfiguratins Bug fix: Fixed an issue where Install pp-up windws were nt clsed after clicking 'install' Enhancements and bug fixes in versin 2.2.0.0: Enhancement: Added supprt fr ESET Remte Administratr 5.3 Enhancement: 'Last Cnnected' field shws "Less than a minute ag" rather than the exact number f secnds Enhancement: Deplyment descriptin is nw mre accurate. "Autselect...EEA/EES fr Wrkstatins" has been changed t "Autselect EEA/EES fr Wrkstatins EFSW fr Servers" Enhancement: Added the ability t install and uninstall ESET slutins directly frm the plug-in Enhancement: Added the ability t assign plicies t multiple machines r entire Kaseya machine grups Enhancement: Added the ability t create and mdify ESET Remte Administratr 6 plicies Enhancement: email and alert ntificatins can nw be mdified withut the need t re-create the ntificatin Enhancement: Plug-in permissins are nw far mre granular Bug fix: Client matching nw displays the internal IP address instead f the cnnecting IP address Bug fix: Fixed an issue that culd cause the plug-in t be unrespnsive when refreshing data Bug fix: Fixed an issue that wuld cause errrs if n clients were cntained in the ESET Remte Administratr Server 5
6 Remved: Remved supprt fr ESET Remte Administratr 5.2
2. Plug-in Installatin Prerequisites The ESET Remte Administratr Plug-in fr Kaseya must be installed using the System Administratr accunt n yur Kaseya Server (Kaseya VSA 7.0 and later are supprted). The fllwing versins f ESET Remte Administratr Server are supprted: ESET Remte Administratr Server 6.4 Dwnlad ERA 6.4 ESET Remte Administratr Server 5.3 Dwnlad ERA 5.3 Nte: While the Plug-in must be installed directly n yur Kaseya VSA server, ESET Remte Administratr may be installed n a separate server. T review Kaseya Server system requirements, please visit the Kaseya hme page. 7
3. Plug-in Installatin Nte: During the installatin prcess yu will be prmpted t reapply yur Kaseya VSA schema, which will temprarily take yur Kaseya server ffline. This step is necessary and must be perfrmed fr the Plug-in t functin crrectly. 1. Lg in t the server n which Kaseya is installed using the System Administratr accunt. 2. Click the fllwing link t dwnlad the ESET Remte Administratr Plug-in fr Kaseya installer file:http:// dwnlad.eset.cm/dwnlad/plugins/kaseya/eset_era_kaseya_plugin.exe 3. Duble click the ESET Remte Administratr Plug-in fr Kaseya setup file (.exe) t start the installatin wizard. Figure 1-1 4. Read the End-User License Agreement and click I Accept if yu agree t the terms. Figure 1-2 5. Click Next after the installer finishes checking fr prerequisites. 8
Figure 1-3 6. The directry where the ESET Remte Administratr Plug-in fr Kaseya will be installed will be displayed. Make any desired changes t the install directry and then click Install. Figure 1-4 7. When installatin is cmplete, click Finish. The installer will autmatically reapply the database schema fr yur database. 9
Figure 1-5 10
4. Setup Wizard After installatin is cmplete, pen Kaseya and click Getting Started > Setup Wizard. The Setup Wizard will help yu cnfigure the Plug-in t cmmunicate with the ESET Remte Administratr Server. Nte: Befre running the Setup Wizard, yu can cnfigure Kaseya t cnvert lgging times t the time zne used by yur web brwser, rather than UTC. T d s, pen Kaseya and navigate t System > User Settings > Preferences and select Use time zne f the brwser lgging int the system. Click Apply when yu are finished. Figure 1-6 1. Expand ESET Endpint Slutins > Settings and click ERA Servers. Figure 1-7 2. Click New t create a new server entry. 3. Type a name fr yur new server int the Name field and click Next. 11
Figure 1-8 4. Enter the fllwing infrmatin using the crrespnding fields in the Setup Wizard (see figure 1-9). a. A name fr yur ERA Server b. The versin f ERA yu will be cnnecting t c. The hstname r IP address f yur ERA Server d. The prt used t cnnect t ERA Server (prt 2226 is the default value) e. Yur ESET Remte Administratr (ERA) username (Administratr is the default value). Windws Dmain is supprted in the frmat (Dmain\[admin user]) f. Yur ERA passwrd (blank by default). This is the passwrd that yu have defined fr the Administratr in ESET Remte Administratr. 5. Click Test Cnnectin when yu are finished making changes t verify that yur settings are crrect and then click Next. 12
Figure 1-9 6. If the cnnectin is successful, yu will be prmpted t set the plling refresh rate. The default value is 5 minutes. Make yur desired changes and then click Finish. 7. Yur new server will be displayed in the ERA Server list. We recmmend that yu click Refresh Data t have yur server cnnect t Kaseya immediately rather than at the next plling interval. Figure 1-10 13
5. Manage ESET endpint prducts Infrmatin abut all Kaseya endpints is displayed under View and Manage > Clients. Each client will display infrmatin abut the ESET prduct installed n that client and the last time that it checked int the ESET Remte Administratr Server. Select a client (r hld CTRL t select multiple clients) t view mre detailed infrmatin abut that client. A. Initiate a client task Click Scan r Update Virus DB t apply these tasks n yur selected clients. Yu can als assign plicies and create activatin tasks fr V6 clients. B. Srt and edit clumns By default, clients that need attentin r have a changed value in the Prtectin Status Test clumn, are displayed in range. This usually relates t a functinality issue, such as an utdated perating system r virus signature database. Click Clumn Sets t edit the infrmatin categries displayed in this windw. See Clumn Set Management fr mre details n this feature. Figure 1-11 14
6. Plicies Yu can create and edit plicies fr Kaseya clients with ESET slutins installed. Navigate t Plicies and Ntificatins > Plicies t view plicies that currently exist n yur ESET Remte Administratr servers. Plicy manager displays plicies fr versin 5 ESET prducts in the plicy tree. Plicies fr versin 6 ESET prducts are srted by pririty (descending) and name (ascending). Plicies fr versin 5 ESET prducts are created and mdified using an XML file. Dwnlad and run ESET Cnfiguratin Editr n yur lcal system t edit these plicies. Plicies fr versin 6 ESET prducts are created and mdified frm ESET Remte Administratr Web Cnsle, which can be accessed using yur web brwser. Select a plicy t see Kaseya machines r machine grups t which that plicy is assigned. Plicy actins: New Create a new plicy fr the specified ERA server. Fr ERA versin 5 servers, the new plicy will be created as a child f the currently selected plicy r ERA server. Plicies created fr ERA versin 6 servers all reside at the same tree level, since child plicies are nt used in this versin. Edit Opens the editr fr the currently selected plicy. Delete ERA versin 6 plicies nly. This buttn will delete the currently selected plicy. Assign Machines Opens the plicy assignment dialg fr the currently selected plicy. This feature allws yu t assign plicies t individual machines. Assign Grups Opens the plicy assignment dialg fr the currently selected plicy. This feature allws yu t assign plicies t kaseya grups. Allw Assignment / Disallw Assignment Click this t allw the selected plicy t be assigned directly t a machine via the Clients view. By default, plicies must be explicitly Allwed befre they will appear in the Assign Plicy drp-dwn menu f the Clients view. Exprt Cnfiguratin This buttn allws yu t exprt settings fr the currently selected plicy. (.xml fr ERA 5.x and.dat fr ERA 6.x). 6.1 Create a plicy fr versin 5.x ESET endpint prducts 1. Navigate t Plicies and Ntificatins > Plicies, lcate yur ERA versin 5 server and then select the nde that yu want t act as a parent f the plicy yu are creating. 2. Click New. Figure 1-12 3. Type a name fr the plicy. If yu have already created an XML file cntaining yur plicy settings, skip t step 7. 15
4. If yu d nt have this XML file, click the dwnlad link t dwnlad ESET Cnfiguratin Editr. When yur dwnlad finishes, duble-click the.exe file t pen ESET Cnfiguratin Editr. 5. Use ESET Cnfiguratin Editr t create yur desired plicy. Click Save when yu are finished and save the file. Figure 1-13 6. Click Brwse, navigate t yur saved.xml cnfiguratin and then click Open. 7. Click Save t create the plicy. 6.2 Create a plicy fr versin 6.x ESET endpint prducts 16 1. Under Plicies and Ntificatins > Plicies, lcate yur ERA 6.x server and select the parent nde representing the server yu wuld like t create the plicy fr. 2. Click New. 3. Type a name fr the plicy. 4. Select the plicy pririty. This is imprtant in the event that yu have mre than ne cnflicting plicy assigned t the same machine. Plicies are applied t the machine in the rder f their pririty values. 5. Select the ESET prduct that yu want the plicy t apply t frm the drp-dwn menu. 6. Make changes that yu want t apply t client cmputers using the plicy settings tree.
Figure 1-14 7. Click Finish when yu are finished making changes. 6.3 Plicy assignment Fr ERA 5.x clients, each machine is nly able t adpt a single plicy. Plicies inherit settings frm their parent ndes.the plicy applied t 5.x clients is dictated by the fllwing: If the machine has any plicies applied directly, it will adpt the mst recent plicy it was assigned t. Fr ERA 6.x clients, multiple plicies can be applied t a single client. The plicies applied t each v6 client is dictated by the fllwing: Plicies that are applied t a machine grup in rder f pririty T assign a plicy t a machine grup r specific machine 1. Navigate t Plicies and Ntificatins > Plicies. 2. Select the plicy yu want t assign and click Assign Machines r Assign Grups. 3. Select the check bx next t the name f a machine r grup t assign the current plicy. Yu can als filter the client list using the filtering bar. Select the check bx next t the name f a client t assign the plicy t that specific client. All grups and clients assigned t a plicy will be displayed at the bttm f the Plicy Assignment windw. 4. Click Save when yu are satisfied with yur assignments. 17
Figure 1-15 18
7. Deply ESET prducts Navigate t Deplyment > Packages t create install packages that will be run as agent prcedures n the machine. This feature is currently nly available fr Windws ESET prducts. During the executin f the deplyment package, it will dwnlad the latest versin f the selected ESET sftware and cnfigure it t cnnect t the specified ESET Remte Administratr server t allw management using the plug-in. 7.1 Create versin 5.x ESET prduct packages 1. Navigate t Deplyment > Packages. Figure 1-16 2. Click New. 3. Type a name fr yur new deplyment package and select yur ERA 5.x server frm the drp-dwn menu. 4. Select the prduct that yu wuld like t install: a. Aut select and dwnlad latest at time f deplyment (EEA fr Wrkstatins) will deply ESET Endpint Antivirus t wrkstatins and ESET File Security fr Windws Server t servers. b. Aut select and dwnlad latest at time f deplyment (EES fr Wrkstatins) will deply ESET Endpint Security t wrkstatins and ESET File Security fr Windws Server t servers. 5. Enter yur ESET-issued Username and Passwrd ( fr example, EAV-123456789). 6. Click Save. Figure 1-17 19
7.2 Create versin 6.x ESET prduct packages 1. Navigate t Deplyment > Packages. Figure 1-18 2. Click New. 3. Type a name fr yur new deplyment package and select yur ERA 6.x server frm the drp-dwn menu. 4. Select the prduct that yu wuld like t install: a. Aut select and dwnlad latest at time f deplyment (EEA fr Wrkstatins) will deply ESET Endpint Antivirus t wrkstatins and ESET File Security fr Windws Servers t servers. b. Aut select and dwnlad latest at time f deplyment (EES fr Wrkstatins) will deply ESET Endpint Security t wrkstatins and ESET File Security fr Windws Server t servers. 5. Chse yur desired license frm the drp-dwn menu. 6. Chse yur desired agent certificate frm the drp-dwn menu. 7. If applicable, enter yur certificate passphrase. 8. Click Save. Figure 1-19 20
7.3 Deply packages ESET packages are deplyed t machines under View and Manage > Clients. 1. Navigate t View and Manage > Clients. 2. Select the client r clients yu want t deply t and click Deplyment. 3. Click Install ESET. 4. Chse the desired deplyment package frm the drp-dwn menu. 5. Click Install ESET. The next time the Kaseya agent cnnects, the deplyment package will be sent t the machine t run. Upn executin, the installer will dwnlad the latest ESET prduct versin frm the website and install it. Once installatin cmpletes, the user will be prmpted t rebt. Figure 1-20 Uninstalling ESET frm the Plug-in 1. Navigate t View and Manage > Clients. 2. Select the client r clients yu want t deply t and click Deplyment. 3. Click Uninstall ESET. 4. If yur ESET installatin is passwrd-prtected, enter the settings passwrd. 5. Click Uninstall ESET. Clients with ESET prducts installed will be prmpted t rebt t cmplete the uninstall. In ERA 6.x, clients that yu deply an uninstall cmmand t will autmatically be remved. In ERA 5.x, yu will need t remve these clients manually (select them and press Delete n yur keybard). 21
8. Generate a Reprt Yu can exprt a reprt frm the ESET Remte Administratr Plug-in fr Kaseya t view varius data abut client systems. T d s, yu must define a reprt template, which yu can then use t preview and create a reprt nce it is ready. Create a new reprt template 1. Expand Inf Center > Cnfigure and Design and click Reprt Templates. 2. Select a flder where yu want t stre yur new reprt template r click Add Flder t create a new flder. 3. Select yur new flder and click Add t create a new reprt template. 4. Specify a reprt title and name fr the template and then click Next. 5. Yu can add different reprt parts t yur new reprt template in the Layut tab. T d s, expand the ESET flder and then click and drag any f the available reprt parts int the layut windw n the right. Preview and save a reprt 1. Once yu have defined a new reprt template, expand Inf Center > Cnfigure and Design > Reprt Templates, pen the flder where yu saved yur reprt template and click Preview t view the reprt. Click OK if a warning message is displayed. 2. Specify the data filters yu want t use when previewing the reprt and click Next. 3. A windw will pen t display the new reprt. Click Save t exprt a cpy f the reprt. 22
9. Permissins Yu can define permissins within the ESET Remte Administratr Plug-in fr Kaseya fr different Virtual System Administratr (VSA) Admin rles. We recmmend that yu nly allw access t Plug-in settings t trusted Kaseya VSA Admins. Navigate t System > User Security > User Rles. Figure 1-21 23
10. Clumn Set Management Using the clumn set manager, yu can define the infrmatin displayed in different windws within the Plug-in. Yu can define multiple clumn sets, each with unique data sets arranged in the rder that the administratr wuld like them t appear. Figure 1-22 1. Click Clumn Sets in any Plug-in windw and then click Clumn Set Manager t specify clumn sets fr that windw. 2. Click Save when yu are finished making changes. Figure 1-23 24
11. Threats T view threat histry fr yur envirnment, select View and Manage > Threat Lg. The threat menu ptin lists detailed infrmatin abut threats. Fr each client wrkstatin the fllwing infrmatin is available: Detected threats Time f detectin Name f the threat Any actins taken. Yu can use Clumn Sets and Filter t custmize yur view. Figure 1-24 25
12. Dashbards A Dashbard is a set f reprts that are autmatically updated with new data t give a cmprehensive verview f yur endpints. Yu can have up t fur cnfigurable charts per dashbard page. Click New t add a new dashbard. Figure 1-25 Add a new chart t yur Dashbard 1. Click New Chart t add an individual chart t a dashbard. 2. Give yur new chart a title and select yur preferences fr the chart parameters. 3. Click Save when yu are finished making changes. See Appendix A fr a list f cmmnly used dashbard charts with cnfiguratin settings. Figure 1-26 26
13. Ntificatins Using Alerts, a systems administratr can cnfigure email ntificatins that are autmatically sent ut when an endpint has failed t update in a given perid f time, is nt cmmunicating with the server, r there are ther issues. Create a new Ntificatin 1. Click Ntificatins > Ntificatins > New and type a name fr yur new ntificatin in the Name field. Figure 1-27 2. Yu can cnfigure alert triggers and the cl dwn perid required between alerts. After yu create an alert and define its trigger, yu can assign actins that crrespnd t that alert in the Alert actins tab. Click Create alarm, email recipients, r run agent prcedure t autmatically execute these actins when an alert is triggered. Infrmatin abut alerts will be recrded autmatically in the Mnitr tab under Status > Alarm Summary. Fr a list f sample ntificatins and settings t cnfigure them, see Appendix B. Nte: When creating a new ntificatin yu can specify multiple AND cnditins, all f which will be evaluated when the ntificatin is triggered T create a wildcard, leave blank the Value field that fllws the Like r Nt Like peratr 27
14. Technical Cnfig. and Trubleshting Knwn issues are listed in bld. Recmmended steps t reslve an issue are included belw the issue descriptin. Plug-in des nt display in the Kaseya VSA navigatin panel r viewing sectins f the Plug-in results in a database errr. This can ccur if the Database Schema was applied incrrectly during Plug-in installatin. Open the ESET Remte administratr Plug-in fr Kaseya, navigate t System > Server Management > Cnfigure and click Reapply Schema. Nte that reapplicatin f the schema will temprarily take yur Kaseya VSA server ffline. Dates and times d nt display crrectly in the Plug-in. The ERA Plug-in fr Kaseya uses time zne settings that are specific t each VSA administratr. If times are nt displayed at all, r are displaying incrrectly, pen the ESET Remte administratr Plug-in fr Kaseya and navigate t System > User Settings > Preferences. Select Use time zne f the brwser lgging int the system and click Apply. Figure 1-28 Dashbards d nt display graphs Install Adbe Flash Player if it is nt already installed. If the issue persists, cntact Kaseya supprt t review requirements fr ckies, JavaScript and pp-ups. 28
15. Appendix A: Sample Dashbard Charts See belw fr sample cnfiguratin settings yu can use t add several infrmative dashbard charts. See Dashbards fr instructins t add a new chart. Clients by Kaseya grup Figure A-1 Clients last cnnected Figure A-2 29
Clients with prtectin status issues Figure A-3 Client virus signature database versin Figure A-4 30
Number f threats by date Figure A-5 Tp threats Figure A-6 31
16. Appendix B: Sample Ntificatins See belw fr sample ntificatin settings yu can use t add several infrmative ntificatins. See Ntificatins fr instructins t create a new ntificatin. Nte: When creating a new ntificatin yu can specify multiple AND cnditins, all f which will be evaluated when the ntificatin is triggered. T create a wildcard, leave the Value field fllwing the Like r Nt Like peratr blank. Client has missed its check-in interval This will fire if the Kaseya Agent is nline, but the ESET endpint has nt checked in t the ERA Server in ver 7 days. We recmmend that yu specify a ne day cl dwn perid fr this trigger. Figure B-1 Virus signature database is ut f date This set f triggers will fire if the Kaseya Agent is nline and the ESET virus signature database is ver three days ld. Figure B-2 Virus scan detected infected files This will fire if ne r mre infected files are fund during a scan. Figure B-3 Threats detected This will fire any time that threats are detected and reprted t the ERA Server. Figure B-4 Threats detected Unable t clean This will fire any time that a detected threat cannt be remved by ESET. Figure B-5 32