dotdefender Central Management v4.25 User Guide Applicure Web Application Firewall
Table of Contents Chapter 1 1. Introduction...3 1.1 Prerequisites... 3 1.2 System Requirements...3 Chapter 2 2. Installation Procedure...4 2.1 Central Management Installation...4 2.2 Central Management Web-Service Configuration...11 2.3 Central Management Setup...14 Chapter 3 3. Dashboard...20 Chapter 4 4. Server Management...22 4.1 Adding server groups to CM...22 4.2 Adding web servers to CM...24 4.3 Server Connection Settings (Monitoring Tasks)...26 Chapter 5 5. License Management...30 5.1 Installing CM license... 30 5.2 Installing dotdefender licenses...31 5.3 Viewing dotdefender license reports...33 Chapter 6 6. User Management...34 6.1 Overview...34 6.2 Adding User Groups...35 6.3 Adding Users... 37 6.4 Deleting Users...38 Chapter 7 7. Log Viewer...39 7.1 Log Viewer Navigation Bar...39 7.2 Filtering Events...40 42 Chapter 8 8. Report Production... 8.1 Overview...42 8.2 Creating accounts...43 8.3 Defining recipients...45 8.4 Report Look & Feel Settings...46 Chapter 9 9. Web Service API...47
1 1.Introduction The Applicure dotdefender Central Management interface enables a centrally located network administrator to access multiple servers installed with dotdefender. The CM interface provides access to all connected dotdefender servers for monitoring of attacks, display of licenses and statuses, and a variety of information and tasks. 1.1 Prerequisites The following are required to be installed before the installation of the dotdefender Central Management interface, in order to enable its functioning: Microsoft SQL Server 2005/2005 Express, 2008/2008 Express, 2012 Microsoft IIS 6.0 or above Microsoft.NET Framework v3.5 and above PDF Viewer (Optional) Web Browser Microsoft Internet Explorer 8.0 and above, Mozilla Firefox, Google Chrome and Apple Safari. 1.2 System Requirements These requirements are the minimum necessary for the operation of the CM Interface Hardware: RAM: 2 GB CPU: 1 GHZ single processor Disk Space: 100 MB (Not including database) Software: Windows 2003/2008 Server, 32-bit or 64-bit
2 2.Installation Procedure 1. Save the installation file in a local folder of your choosing. 2. Double-click the file to open the Installation Wizard. 3. Follow the instructions detailed in the Wizard (as described below). 2.1 Central Management Installation Open the "IIS Manager" -> "Web Service Extension" In the right pane, click the "ASP.NET" extension and make sure it is in status "Allowed" (Note: Figure above presents Web Service Extensions in IIS6!)
After double-clicking the installation file, the CM Installation Wizard opens with the following window: Click Next to display the Pre Installation Check List window.
Click Next to display the License Agreement window.
Read and accept the terms of the license agreement. Click Next to proceed
Click Browse to install to the required location Click Next to display the Start Installation window.
Click Install to start the installation procedure. After a few minutes, the installation will be completed, and the final Wizard window appears:
Click Finish to complete the installation, launch the CM Configuration Manager and complete the setup.
2.2Central Management Web-Service Configuration Launch CM Configuration Manager from your Start All Programs menu. Alternatively, "CM Configuration Manager" can also be run from: "$:\Program Files\Applicure\dotDefender CM\bin\dotDcmConfigurationManager.exe" The "Network Configuration" tab appears in the "Configuration Manager" HTTP IP: Fill in the IP address on which CM Web-Service will be listening Http Port: Fill in the port, at which CM Web-Service will be listening TCP IP: Fill in the IP address on which an internal inter-process socket will be opened (For Web-Service -> CM communication) Tcp Port: Fill in the port at which the local inter-process socket will be opened (For Web-Service -> CM communication)
Switch to the "Database" tab to configure CM -> SQL connectivity: Host/IP: Fill in the database server IP address Authentication: Choose between using Windows Authentication and SQL Authentication User Name: Database user (needs DB + table creation privilege) Password: Database connectivity password Switch to the "Default CM User" tab to configure the initial user to be used to setup Central Management over Web:
After defining a default administrative user and password for CM, press the "Save Changes" button.
2.3 Central Management Setup After completing the installation procedure successfully, you may log in to Central Management either by browsing to: http://yourserver/dotdefendercm_ui, or by launching it from your Start All Programs menu.
On the left-hand side of the dashboard, right-click "dotdefender-cm" and choose "Settings Wizard" in order to setup initial connections to dotdefender-protected web servers. When the following window appears press "Next": Step 1 - Fill in sender and recipient email addresses for CM system error notifications Step 2 - Fill in email sender, recipient, subject and email priority for any dotdefender status change notifications. Press "Next"
Step 3 Fill in the outgoing mail server name / IP, port, username and password. Check "Use SSL" in case your mail server uses encrypted SSL connections. Press "Test e-mail settings" in order to send a test email to the recipient filled in the "To:" field.
Step 4 Enter SQL connection details: Server Name: SQL server\instance (Using hostname / IP address) Authentication: Choose whether you want to use SQL or Windows user authentication Login: Database username (for instance sa / administrator) Password: Database password
After filling in the MS-SQL related parameters, you can verify the validity of the parameters by clicking the Test Connection button. This button activates a connection to the MS-SQL server you specified (in this example, 192.168.1.41) and informs you of success/failure. In case the connection succeeds, press "Next".
Before clicking the Finish button, it is recommended that you click the Check button to initiate a check of the connections you configured during the setup procedure. After this step, the CM dashboard appears.
3 3.Dashboard After completing the setup procedure described in the preceding chapter, the main CM Interface appears. This chapter provides an overview of the CM dashboard interface: The dashboard shows statistics for chosen group / server / website. This can be picked from the left-hand side tree. The dashboard provides six panes (left to right, top to bottom):
Leftmost pane shows a hierarchy of logical server groups, sorted by account, under which the associated website profiles appear "All Attacks" shows a pie chart of the attack distribution per chosen server / group "Attacks By Time/Amount" shows a line graph indicating overall attacks over time "Attacks By IPs" - A bar graph indicating attacks per source IP "Attacks By Category" A bar graph indicating distribution of attack types Bottom pane a dynamically updating security alerts list
4 4.Server Management 4.1 Adding server groups to CM Server groups are purposed to logically bind different web servers belonging to the same owner. Dashboard, log views and reports may be filtered by server groups and underlying websites. Before registering new web servers containing dotdefender, one needs to create logical groups. In order to create a new server group, perform the following steps: 1. Under the grouping tree pane on the left-hand side of the dashboard, right-click the dotdefender-cm shield icon and choose "Add Servers Group" in order to create a new server group. 2. In the "Add Group" window, fill in the group name and press "OK"
4.2 Adding web servers to CM In order to add web servers with dotdefender to CM, perform the following steps: 1. Under the grouping tree, right-click the server group you would like to contain this web server and choose "Add Server" The Add Server window appears:
2. Fill in the following fields: Name Server identifier in CM Server Type - choose IIS / Apache according to the web server dotdefender is installed on Hostname/IP - web server's hostname / IP address Description a description of the server that will appear on the dashboard Group Related used after server is registered to associate the server to a logical group Alias Relative URL pointing to CM's registered extension on web server Authentication authentication scheme used to log into the server over HTTP Username a valid user belonging to dotdefender's administrators group on the target server Password password configured on the web server Use SSL check this option to use an encrypted HTTPS connection to the server 3. After configuring all parameters, press "Test Connection" to test whether an HTTP connection may be established with the web server, the user credentials are valid and dotdefender is able to communicate with CM.
4.3 Server Connection Settings (Monitoring Tasks) In order to configure connection settings per server, under the "Add Server" window click the Monitoring Tasks button at the bottom of the window. Alternatively, after a server has been registered under CM, you may right-click a web server under the grouping tree and choose "Edit Server": Then press "Monitoring Tasks". The following window appears:
Under the "Attacks" tab, event polling is configured using the following parameters: The "Scheduling" pane contains the following options: "Enable" Check this option to enable scheduled event polling "Every" Fill in the polling frequency in minutes The "Miscellaneous" pane contains the following option: "Max Size" The maximum size of event information allowed to be transferred. The "Configuration" tab contains dotdefender status check settings, monitoring dotdefender's configuration changes.
The "Scheduling" pane contains the following option: "Enable" Check this option to enable scheduled dotdefender configuration checks "Every" Fill in dotdefender configuration check frequency in minutes The "Notification" pane contains the following options: "Enable" Check this option to enable email alerts on dotdefender configuration changes "Use default settings" Check this option to send the email alerts using the settings entered in the CM settings wizard "Import default settings" Fills in the email fields with the settings chosen in the CM settings wizard "To:" Notification email recipient "From:" - Notification email sender name "Subject:" Subject as will appear in the notification email "Priority:" Email priority as will appear in the notification email The "status" tab contains CM diagnostic check settings, monitoring CM system health.
The "Scheduling" pane contains the following option: "Enable" Check this option to enable scheduled CM health checks "Every" Fill in CM health check frequency in minutes The "Notification" pane contains the following options: "Enable" Check this option to enable email alerts on CM system status changes "Use default settings" Check this option to send the email alerts using the settings entered in the CM settings wizard "Import default settings" Fills in the email fields with the settings chosen in the CM settings wizard "To:" Notification email recipient "From:" - Notification email sender name "Subject:" Subject as will appear in the notification email "Priority:" Email priority as will appear in the notification email
5 5.License Management 5.1 Installing CM license In order to register a new CM license, under the dashboard grouping tree right-click "dotdefender CM" at top of the tree and choose "Set CM License" "Set CM License" window appears
Press the "Browse" button to browse filesystem for CM license file. After choosing the correct file received from Applicure, press "Save". CM is now registered and active. In case you have not received a license yet, you may register and receive one at: http://www.applicure.com 5.2 Installing dotdefender licenses In order to register a new license on a dotdefender machine, under the grouping tree right-click a web server and choose "Set dotdefender License"
The "Set License" window appears. Fill in your email address and password as received from Applicure. In case you have not received a license yet, you may register and receive one at: http://www.applicure.com
5.3 Viewing dotdefender license reports Clicking on the "Reports" tab from the main menu, switches to a general license usage status screen: The upper pane labeled "License Summary" indicates the overall usage of dotdefender licenses, grouped by license types and dotdefender's current operation mode. The lower pane labeled "Servers Summary" contains detailed status of every dotdefender license being used, including server details as well.
6 6.User Management 6.1 Overview The "User Management" tab contains user and group management functionality. This includes user/group creation, server and website association with groups, access control and privilege assignment. This menu contains four panes as seen in the screenshot: "All Groups" - (left-hand side) contains a list of existing groups "Group Details" - (top pane) showing privileges and allowed IP addresses per group "Account Servers/Sites" (bottom left-hand side) managed servers/websites "Group Users" (bottom right-hand side) users belonging to the group chosen under "Group Details"
6.2 Adding User Groups In order to create a new user group, perform the following actions: 1. right-click "All Groups" in the left-hand side pane and choose "Add New Group" 2. Under "Group Details", Fill in the following parameters: "Group Name" The name that you choose to represent this user group in CM "User Type" Choose whether the users in this group will be able to manage CM ("Admin") or view data only ("ReadOnly") "Display Mode" level of data visibility available to this user group: SitesOnly: May view individual websites associated with this user group ServersAndSitesOnly: May view server level and lower DisplayAll: May view all server groups associated with this user group "White-List IP's" IP addresses allowed access to CM for users under this group. Press "enter" after filling in each IP address 3. Under the "Account Servers/Sites" pane, press the "Edit" button. The "Edit servers and sites for users group" window appears:
4. Check the servers and websites you would like to associate with this user group and press the "OK" button. Then under the "Group Details" pane, press the "Save" button.
6.3 Adding Users After establishing the required user groups, you may add new users and associate them with the groups you have created. Follow these steps: 1. In the left-hand grouping tree, left-click the required group to include the new user and choose "Add new user" Alternatively, after clicking the group name, under the bottom left-hand pane labeled "Group Users" you may click the + icon
2. The "User Properties" window appears. 3. Fill in the following fields: Username - user name for CM login / API Password - user password Group choose the container group of this user 4. Press the "Save" button 6.4 Deleting Users In order to delete users perform the following actions: 1. Left-click the group containing the user in the left-hand grouping tree 2. In the "Group Users" pane, left-click the user name and click the button Alternatively, you may right-click a user name and choose "Delete" (as in the figure on the right)
7 7. Log Viewer The Log Viewer tab contains a centralized view of all events polled from dotdefender machines. This information can be filtered to present a more pinpointed view, based on the required criteria 7.1 Log Viewer Navigation Bar The top bar allows quick navigation through the Log Viewer pages. The buttons are hereby explained from left to right: Navigate back to the previous page view Navigate forward to the next page view Navigate to the main home page Refresh the current page view Search events based on chosen criteria Print the current page Create a PDF report of viewed events
7.2 Filtering Events In order to view the specific events of interest, click on the search button in the navigation bar (magnifying glass icon). The Search Options window appears: Event view filtering is based on the following criteria, hereby described by appearance in the menu: Search By Time/Reference (top pane) Start Date/End Date fields - Allow configuration of time window, in which the required events have been recorded Reference Id Allows searching for an event based on a unique reference ID optionally reported in dotdefender s block page Web Server(s)/Site(s) (left pane)
This hierarchical tree allows choosing the specific website profiles to be included in the event view Attack Filters (right pane) Filter By Category Choose between showing any attack category and a specific group of attacks. Only recorded attack categories are possible to choose from Filter Attacks By Sources Choose the source IP s of the attacks to be viewed Severity Filter Check Enabled to filter out any events with severity levels lower than the threshold defined in the Minimum Severity field When finished defining the desired view filters, press the Search button to apply these filters on the currently viewed events.
8 8.Report Production 8.1 Overview The reports module was specifically designed to serve as an automatic report dispatch system allowing maximum flexibility to design custom report templates on the one hand, and to provide fully automatic scheduling tailored around each account served. Accounts are logical groups of email recipients belonging to the same owners of website groups. Security events are correlated, analyzed, visualized and packed into different formats before being automatically sent to pre-defined recipients, informing them about security breach attempts relevant to their associated websites.
The Reports tab contains the following panes: Accounts pane (left-hand pane) Shows a list of website owners, registered in CM to receive occasional reports by email Add/Delete/Save Toolbar (Topmost) Green/yellow/blue icons at top of page represent account addition, deletion or configuration saving, in the respectful order Account Details (middle center pane) - Contains account name, content length and occurrence frequency Account Servers/Sites (bottom left) View/Change websites associated with the currently viewed account Account Recipients (bottom right) Add/modify email recipients under current account. Manage report template and format 8.2 Creating accounts In order to create a new account, perform the following actions: 1. Press the + green button at top left of the toolbar 2. Fill in a name for the new account in the Account Name field 3. Click the Edit button under Account Servers/Sites in order to choose which websites will be associated with this account 4. The Edit Servers and sites for account window appears. Now choose whatever website profiles will be included in the report
5. Pick a Start Date and a Start Time in the respectful fields to define when the first report will be sent 6. Choose report dispatch frequency at the Reoccurs Every field 7. Choose the length of time that the report will retroactively include at the Report Content. For example, 1 day means that all events for 1 day back will be included in the next report. 8. Press the diskette icon in the top toolbar (rightmost) in order to save this account under the existing grouping tree
8.3Defining recipients In order to configure email recipients under an account, perform the following: 1. Press the Add Recipient button 2. Under the Account Recipients pane, click an empty row under the Email Address column 3. Fill in the desired email address 4. Under Account Servers/Sites click the Edit button and choose the websites associated with this account 5. Click the Settings button under the Report Parts column, and enable all parts you would like to see inside reports sent to this email recipient 6. Press the Add Recipient button in case you would like to define more users in this group
8.4Report Look & Feel Settings After defining report dispatching, you may press the green (+) button under the Properties column in order to customize the report s content, feel & look. A window appears: This menu contains the following sections: Report Templates Save / load reusable report templates Choose Headers Colors Choose the color theme of the report Events Filters Choose the number of events to be included in the report Choose Logo Pick your own company logo to appear in the report heading Severity Filter Choose the minimum severity threshold for alert inclusion in report Press the Save button in order to save this report template.
9 9.Web Service API Applicure Technologies is now offering a Web-Service API to allow rapid integration of all dotdefender and dotdefender Central Management products with 3 rd party software. In order to ease the integration, a WSDL file exists on the server to reflect the available SOAP methods. The following table summarizes the list of functions exposed via CM WebService API; Name DeleteTemplate GetUserAccounts GetUserTemplates GetTemplate GetRecipientLogo EditAccount GetServersGroup GetSites GetCMLicenseInformation SetCMLicense GetServiceAndDBStatus SetSettingsWizard GetSettingsWizard SetOperationMode CreateExecutiveReport CreateDetailedReport SetDDLicense SetDSP lggetattackerssourceiplist lggetattackcategorieslist GetAttackEventDetails GetClientIpAttacksSummaryList GetCategoryAttacksSummaryList GetSitesAttackSummaryList GetAttackEventsList GetServersAttackSummaryList GetServersGroupAttackSummaryList CreatePDFReport GetLicensesTables GetUserAccount AddAccount Output Erase a report template from database Return a list of all (customer) accounts, filtered by current user permission Returns a list of all report templates according to user permissions Returns a specific template Returns the recipient logo Updates an account in the database Returns all server groups according to user permissions Returns all server websites according to user permissions Returns CM license details Applies a license to Central Management Returns information regarding CM service and database Saves all system settings for the settings wizard Returns all system settings for the settings wizard structure Changes dotdefender operation mode Creates a basic Excel report of dotdefender licenses Creates a detailed Excel report of dotdefender licenses Applies a license to dotdefender Defines a Default Security Profiles for a dotdefender server Returns a list of attacker source IPs, filtered by search criteria Returns a list of attack categories, filtered by search criteria Returns a list of the 100 recent attacks, filtered by permissions and location in tree Returns a list of attacks per IP, filtered by search criteria Returns a list of attacks per category, filtered by search criteria Returns a list of attacks per website, filtered by search criteria Returns a list of the 100 recent attacks, filtered by search criteria Returns a list of attacks per server, filtered by search criteria Returns a list of attacks per server group, filtered by search criteria Returns a PDF report, according to search settings Returns 2 license tables (server information+license), (number of licenses per license type) Returns a specific account Adds an account to database
UpdateAccount DeleteAccount AddTemplate UpdateTemplate IsUsersGroupEmpty GetUsers GetUsersGroup IsUserNameAvailable IsUserValid IsUserAdmin GetUser GetUsersGroups AddUsersGroups AddUser EditUser EditUsersGroup DeleteUser DeleteUsersGroup AddServer AddServersGroup GetServer Updates an account in database Deletes an account from database Adds a report template to database Updates a report template in database Checks if user group is empty Returns all users belonging to a specific group Returns a specific user group Checks whether user name already exists in database Checks whether user is allowed access to Central Management Checks whether user is administrative Returns a specific user name Returns all user groups Adds new user group to database Adds new user to database Updates a user in database Updates a user group in database Deletes a user from database Deletes a user group from database Adds a server to database Adds a server group to database Returns a specific server Returns a list of all servers belonging to a specific server group, GetServers according to permissions EditServer Updates a server in database EditServersGroup Updates a server group in database TestServerConnection Checks whether it is possible to login to server GetCMVersion Returns CM version DeleteServer Deletes server from database DeleteServersGroup Deletes a specific server group from database Returns the 100 recent attacks of last week. Filtered by location in tree and GetLatestAttacks permissions GetLatestAttacksAmount Returns number of attacks in the given time range Returns a list of categories and number of attacks, filtered by location in tree GetGeneralAttacksSummary and permissions Returns a list of websites/servers/server groups/number of attacks, filtered by GetAttacksStats location in tree and permissions GetClientIpAttacksSummary Returns a list of attacks per IP address, filtered by location in tree and permissions For further information on communicating over SOAP with CM and code examples, please refer to: http://applicuresupport.helpserve.com/