Chat now with support
Chat with Support

Security Analytics Engine 1.0 - User Guide

BuiltinPlugin

The BuiltinPlugin is used for determining the browser being used, the time of access and if the incoming IP address is from a whitelisted network.
When viewing the plugin information on the Edit Plugin page, the top two fields provide information on the plugin and cannot be changed:
Instance Name
BuiltinPlugin1
Description
The Builtin plugin provides historical tracking capabilities, including abnormal time, unknown browser and determining whether or not an IP address is within a specific network range.
Plugin Configuration
The following setting is available for the plugin in the Plugin Configuration section:
•
Maximum Days Tracking - This specifies the number of days to keep the tracking data. By default, this is 30 days. The maximum number of days tracking data can be retained is 365 days.
Conditions
The following types of conditions are available for this plugin:
•
Abnormal Browser
•
Abnormal Time
•
Whitelist

GeoLocationPlugin

The GeoLocationPlugin is used for determining the location of the user or browser that is attempting to access the application.
When viewing the plugin information on the Edit Plugin page, the top two fields provide information on the plugin and cannot be changed:
Instance Name
GeolocationPlugin1
Description
The Geolocation plugin provides IP-based geolocation capabilities, including determining country location and if the travel time from the previous location is reasonable.
Plugin Configuration
The following settings are available for the plugin in the Plugin Configuration section:
•
Maximum Days Tracking - This specifies the number of days to track the location data. By default, this is 30 days. The maximum number of days tracking data can be retained is 365 days.
(Optional) VPN Network Definitions
This section allows you to configure a list of IP/subnet network addresses associated with an internal network.
Click Add a new VpnNetworks element to display the following fields:
•
IP Address - This is for configuring an IPv4 or IPv6 address.
•
IP Subnet Mask - This is for configuring the optional IPv4 or IPv6 subnet mask.
•
Enable - Select this check box to enable the configured VPN network definition.
•
Delete - Click this button to remove the VPN network.
Conditions
The following types of conditions are available for this plugin:
•
Abnormal Location
•
Restricted Country
•
Approved Country

MalwareDetectionPlugin

* 
NOTE: The Security Analytics Engine Installer - SonicWALL Processor Service.msi and SonicWALL™ firewall must be installed and configured in order for the Security Analytics Engine to enable the MalwareDetectionPlugin for use in risk policies. For information on how to configure SonicWALL to send malware information to the Security Analytics Engine, see the Security Analytics Engine SonicWALL™ Configuration Guide.
The MalwareDetectionPlugin is used for detecting whether the access attempt comes from an IP address or username associated with malware.
When viewing the plugin information on the Edit Plugin page, the top two fields provide information on the plugin and cannot be changed:
Instance Name
MalwareDetectionPlugin1
Description
The MalwareDetection plugin provides the integration of SonicWALL firewall malware detection, associated with the user name and/or client IP address.
Plugin Configuration
The following settings are available for the plugin in the Plugin Configuration section:
•
Maximum Retention Days - This is the number of days to retain malware records starting with the date detected by the SonicWALL firewall. By default, this is 30 days. The maximum number of days tracking data can be retained is 365 days.
•
Maximum Audit Records - This is the maximum number of malware records to list in the details of an audit record. By default, this is 10 records. The maximum number of records that can be returned is 20.
(Optional) Dynamic IP Network Filters
This section allows you to configure the list of IP/subnet network addresses that are used to ignore malware record IP associations. Adding a dynamic IP network element results in the username association still matching malware records, but it will not match on IP addresses contained in these networks. This allows you to take in to consideration wireless or VPN networks where the IP addresses are dynamically reassigned and reused at a high rate.
Click Add a new DynamicNetworks element to display the following fields:
•
IP Address - This is for configuring an IPv4 or IPv6 address.
•
IP Subnet Mask - This is for configuring the optional IPv4 or IPv6 subnet mask.
•
Enable - Select this check box to enable the dynamic network.
•
Delete - Click this button to remove the dynamic network.
Conditions
The following type of condition is available for this plugin:
•
Associated w/ Malware

Editing plugins

While the plugins provided by the Security Analytics Engine cannot be deleted nor additional plugins created, the settings for each plugin can be edited.
To edit a plugin instance:
1
On the Plugins page, select the plugin to edit.
2
Click the button to open the Edit Plugin page.
3
After editing the plugin settings (see Plugins for information on the specific settings available for each plugin), click Save.
4
Use your browser’s back button or the breadcrumb trail to return to the Plugins page.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating