지금 지원 담당자와 채팅
지원 담당자와 채팅

Security Analytics Engine 1.0 - SonicWALL Configuration Guide

Overview

By using the Security Analytics Engine’s SonicWALL™ malware detection plugin, an application is able to incorporate explicit malware detection data into a risk calculation thus minimizing the risk of a malicious user or browser gaining access to the application.
Support for SonicWALL malware detection in the Security Analytics Engine requires some minimum configuration settings in the SonicWALL firewall AppFlow configuration, as well as the deployment and configuration of the SonicWALL Processor service. Additional configuration options that affect malware detection record details are also outlined in this guide.
SonicWALL requirements
One of the following SonicOS versions is required:
•
SonicOS 5.8
•
SonicOS 5.9
•
SonicOS 6.0
•
SonicOS 6.1

SonicWALL Processor Service Installation and Configuration

•
Introduction
•
SonicWALL Processor service installation
•
SonicWALL Processor service configuration

Introduction

The Security Analytics Engine utilizes the SonicWALL Processor service, which processes and forwards data received from the SonicWALL device pertaining to malware. Prior to making the required SonicWALL firewall configuration changes, we recommend that the SonicWALL Processor service be installed and configured as follows.
* 
NOTE: If Windows® Firewall is enabled and running on the installation destination server, the SonicWALL Processor service will automatically configure firewall rules to allow SonicWALL AppFlow data communications from the firewall to the service. However, if a third-party firewall is installed, it may be necessary to configure the firewall to allow UDP traffic on the configured AppFlow port.

SonicWALL Processor service installation

The following procedure covers installing the SonicWALL Processor service.
* 
NOTE: In order to install the SonicWALL Processor service, you must have Administrator privileges.
To install the SonicWALL Processor service:
1
Copy the Security Analytics Engine Installer - SonicWALL Processor Service.msi file to the installation destination server.
2
From the installation destination server, install the Security Analytics Engine Installer - SonicWALL Processor Service.msi file with the default parameter values.
OR
From the installation destination server, install the Security Analytics Engine Installer - SonicWALL Processor Service.msi file and provide command line parameter options to specify the following configuration values:
•
REPORTERURL - This command overrides the default Security Analytics Engine URL (http://localhost/SecurityAnalyticsEngine).
•
REPORTERKEY - This command overrides the default key value used to send malware records to the Security Analytics Engine.
* 
IMPORTANT: Copying encrypted key values from configuration files on different computers is NOT supported.
* 
NOTE: For simple, single-server installations of both the Security Analytics Engine and the SonicWALL Processor service, the installers will auto-generate an encrypted shared key which will be stored in the appropriate configuration files. Therefore, these types of installations do not require use of the REPORTERKEY.
For complex installations where the same shared key must be configured on multiple servers, the REPORTERKEY is required and must be set to the same text as the MALWAREPROVIDERKEY used during the installation of the Security Analytics Engine. See the procedure below for information on resetting the key.
In both cases upgrades are handled automatically, where the same key will be retained, and providing the installer key parameters during upgrades will reset the shared key to the new value.
NOTE: If you are unable to provide the key used in the installation of the Security Analytics Engine during the installation of the SonicWALL Processor, you can reset the key post-install without needing to uninstall the Security Analytics Engine.
To reset the key for the SonicWALL Processor and the Security Analytics Engine:
1
Run the Dell.SecurityAnalyticsEngine.SonicWALL.Processor.Utility.exe (Dell | SecurityAnalyticsEngine | SonicWALLProcessor).
2
In the Key Generator section, use one of the following methods to reset the key:
•
In the Provider Key field, enter your preferred key.
•
Click the Generate button to generate a random key.
3
An encrypted key will be automatically generated. Click the Update button to update the configuration file with the new key.
IMPORTANT: Resetting a key when the SonicWALL Processor and the Security Analytics Engine are installed in different systems requires that the utility be run in both systems individually. In that case, you must enter the same key into the Provider Key field.
•
APPFLOWPORT - This command overrides the default SonicWALL AppFlow port number (2055).
3
After installing the SonicWALL Processor service, verify that the service is running and that no errors or warnings are logged to the service log file.
* 
NOTE: By default, the installation path for the SonicWALL Processor service is:
C:\Program Files\Dell\SecurityAnalyticsEngine\SonicWALLProcessor
셀프 서비스 도구
지식 기반
공지 및 알림
제품 지원
소프트웨어 다운로드
기술 설명서
사용자 포럼
비디오 자습서
RSS 피드
문의처
라이센싱 지원가져오기
기술 지원
모두 보기
관련 문서

The document was helpful.

평가 결과 선택

I easily found the information I needed.

평가 결과 선택