Chat now with support
Chat with Support

Security Analytics Engine 1.1 - User Guide

Security Analytics Engine Overview Plugins Conditions Shared Policies Applications Auditing Issued Alerts Policy Overrides Fallback Password Security Settings Glossary

SonicWALLPlugin

* 
NOTE: This was previously called the MalwareDetectionPlugin.
* 
NOTE: The Security Analytics Engine Installer - SonicWALL Processor Service.msi and SonicWALL™ firewall must be installed and configured in order for the Security Analytics Engine to enable the SonicWALLPlugin for use in risk policies. For information on how to configure SonicWALL to send malware information to the Security Analytics Engine, see the Security Analytics Engine SonicWALL™ Configuration Guide.
The SonicWALLPlugin is used for detecting whether the access attempt comes from an IP address or username associated with walware, blacklists, a specific threat level, etc.
When viewing the plugin information on the Edit Plugin page, the top two fields provide information on the plugin and cannot be changed:
Instance Name
SonicWALLPlugin1
Description
The SonicWALL™ plugin provides the integration of SonicWALL firewall user activity, associated with the user name and/or client IP address.
Plugin Configuration
The following settings are available for the plugin in the SonicWALL Configuration section:
•
Maximum Retention Days - This is the number of days to retain malware records starting with the date detected by the SonicWALL firewall. By default, this is 30 days. The maximum number of days tracking data can be retained is 365 days.
•
Maximum Audit Records - This is the maximum number of malware records to list in the details of an audit record. By default, this is 10 records. The maximum number of records that can be returned is 20.
•
Ignore Malware Signatures - (Optional) This field is for listing any malware signature IDs to ignore and is used for instances where certain signatures have also been disabled in the SonicWALL firewall configuration by a firewall administrator, when specific signatures are considered false positives, or when any signatures should be ignored for any other reason. The signature ID values need to be separated by a comma and fall between 0-4294967295. By default, signature IDs for ICMP Destination Unreachable (Port Unreachable) (310) and ICMP Echo Reply (316) are configured to be ignored.
•
Ignore Application Signatures - (Optional) This field is for listing any application signature IDs to ignore and is used for instances where certain signatures have also been disabled in the SonicWALL firewall configuration by a firewall administrator, when specific signatures are considered false positives, or when any signatures should be ignored for any other reason. The signature ID values need to be separated by a comma and fall between 0-4294967295. By default, signature IDs for Microsoft® App Store (10313, 10314,10366), Akamai (6570, 6572, 6573, and 6574), cURL (1618), BITS (6583), and WGET (1613) are configured to be ignored.
(Optional) Dynamic IP Network Filters
This section allows you to configure the list of IP/subnet network addresses that are used to ignore firewall activity IP associations. Adding a dynamic IP network element results in the username association still matching firewall activity records, but it will not match on IP addresses contained in these networks. This allows you to take into consideration wireless or VPN networks where the IP addresses are dynamically reassigned and reused at a high rate.
Click Add to display the following fields:
•
IP Address - This is for configuring an IPv4 or IPv6 address.
•
IP Subnet Mask - This is for configuring the optional IPv4 or IPv6 subnet mask.
•
Enable - Select this check box to enable the dynamic network.
•
Delete - Click this button to remove the dynamic network.
After making changes to the plugin, click the Validate button in the lower right corner to check that the configuration is valid.
Conditions
The following types of conditions are available for this plugin:
•
Associated w/ Application Category
•
Associated w/ Application Threat Level
•
Associated w/ Blacklist
•
Associated w/ Country
•
Associated w/ Malware

Editing plugins

While the plugins provided by the Security Analytics Engine cannot be deleted nor additional plugins created, the settings for each plugin can be edited.
To edit a plugin instance
1
On the Plugins page, select the plugin to edit.
2
Click the button to open the Edit Plugin page.
3
After editing the plugin settings (see Plugins for information on the specific settings available for each plugin), click Validate to test the configuration.
4
Click Save to save the changes.
5
Use your browser’s back button or the breadcrumb trail to return to the Plugins page.

Conditions

•
Introduction
•
Conditions page
•
Condition categories
•
Adding and managing conditions

Introduction

While a plugin retrieves and stores the data for the Security Analytics Engine, conditions are what allow you to tailor how that data is used to fit the needs of each application. Each condition contains parameters that dictate what to look for specifically during an access attempt: a certain IP address, a browser that has never been used by the user, a regularly occurring time of access, etc.
When working with conditions, keep in mind that within a risk policy all conditions can be used to modify other conditions, in which case it becomes a modifier. However, all modifiers cannot be used as conditions. Conditions with a risk type value of Can increase risk, Can both increase or decrease risk, and those without a risk type value are able to be used as both conditions and modifiers since they have the ability to increase a risk score. Conditions assigned the risk type value of Can decrease risk are only usable as modifiers since they are designed to decrease condition scores not decrease an entire risk score. All conditions and modifiers, regardless of risk type value, are managed using the Conditions page.
From the Home page of the Security Analytics Engine Administration web site, click on the Conditions link to create and manage condition parameters for the plugins.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating