-
Using Management Center for Cisco Security Agents 5.0
-
Title
-
Preface
-
Overview
-
Management Center for Cisco Security Agents Administration
-
Configuring Groups and Managing Hosts
-
Building Policies
-
Rule Module Configuration
-
Available Rule Types
-
Using Event Correlation
-
Using Application Classes
-
Configuring Variables
-
Event Logging and Alerts
-
Generating Reports
-
Using Management Center for Cisco Security Agents Utilities
-
Using Cisco Security Agent Analysis
-
Third Party Product Integration
-
Cisco Security Agent Overview
-
System Components
-
Open Source License Acknowledgements and Third Party Copyright Notices
-
Table Of Contents
Management Center for Cisco Security Agents Administration
Management Center for Cisco Security Agents Description
About Management Center for Cisco Security Agents
Accessing Management Center for Cisco Security Agents
Pre-Configured Admin Preferences
Using Management Center for Cisco Security Agents
Creating, Saving, and Deleting Data
Management Center for Cisco Security Agents Administration
Overview
Management Center for Cisco Security Agents supports editing of the database by multiple administrators. Administrators must identify themselves and authenticate to CiscoWorks before they can access any CSA MC configuration data.
CSA MC's web-based user interface provides secure access to the database from anywhere on the network. All changes to the database are logged. The logged information includes a summary description of the modification, the time the changes were made, and the identity of the administrator who made the changes.
This section contains the following topics.
•
Management Center for Cisco Security Agents Description
•
•
•
•
Management Center for Cisco Security Agents Description
The Management Center for Cisco Security Agents (CSA MC) is a web-based user interface which can be accessed from the CiscoWorks user interface on any machine connected to the Internet and running a web browser. Through CSA MC, administrators configure all aspects of Management Center for Cisco Security Agents.
Browser Requirements
The browser you use to access CSA MC through CiscoWorks must meet the following requirements.
Internet Explorer:
•
•
•
Netscape:
•
•
•
Note
About Management Center for Cisco Security Agents
All Cisco Security Agent policies are configured and deployed through the CSA MC web-based user interface. CSA MC also provides a reporting tool, letting you generate reports with varying views of your network enterprise health and status. Providing an HTML web-based user interface enables an administrator to access CSA MC from any machine connected to the Internet and running a web browser.
CSA MC provides a menu bar for easy navigation among the configurable administrator task items. Configurable items are displayed in drop-down menus that appear when you move the mouse over a category in the menu bar. When you select an item, the properties and status for that item are displayed.
Figure 2-1 CSA MC Status View
Accessing Management Center for Cisco Security Agents
You access CSA MC from the CiscoWorks user interface. An initial administrator account was created as part of the CiscoWorks installation process. After that administrator account is entered to log in to CiscoWorks, you do not need to log in to CSA MC again.
•
•
http://<ciscoworks system hostname>:1741For example, enter
http://<ciscoworks system hostname>:1741From the CiscoWorks user interface, the Security Agents 5.0 item is located in the VPN/Security Management Solution drawer. Expand the Management Center or the Administration>Management Center folder. (If you have upgraded from version 4.5.x, you may see both a Security Agent 5.0 and a Security Agents 4.5 item here.)
Note
Role-Based Administration
CSA MC can have multiple administrators, all with secure access to configuration data. Administrators can have different levels of CSA MC database access privileges. The initial administrator created by the CiscoWorks installation automatically has configuration privileges.
CiscoWorks/CSA MC administrator Roles:
•
•
•
Caution
Note
Administrator Preferences
In addition to the role-based administration created through CiscoWorks, you can set CSA MC-specific administrator preferences. As a CSA MC administrator, you can select to view configuration items for all operating systems or to view only those for a particular operating system. If you leave the default of "All" configuration items at the top of item list pages, you must then select an operating system when you configure items such as policies, groups, and agent kits. If you are only configuring or deploying policies to UNIX systems, it is likely that you will only want to see those items. The same holds true if you are deploying policies to only Windows systems.
By selecting Maintenance>Admin Preferences in CSA MC, you can set global administrator preferences (see Figure 2-3). This way, you do not have to choose an operating system, for example, on each configuration page. Using Admin Preferences, you can configure preferences for each administrator registered with CSA MC.
Additional global administrator preferences are:
•
•
Note
•
Once a field is expanded manually on a page, you cannot collapse it again until you refresh the page. To always display all fields on all pages, select the Always show expanded configuration views check box as an Admin Preference.
•
Once you have configured administrator preferences, you must select one or more administrators to which these preferences are assigned in the Apply these preferences to the following selected administrators selection box. To apply different sets of preferences to different administrators, you must configure several Admin Preferences and assign them appropriately.
Operating system designation requirements and their granularity vary for different configuration items. Refer to the following chart and diagram for an overview of how and where operating systems designations are made.
Table 2-1 Operating System Naming Conventions
Figure 2-2 Example: Operating System Specifications
Pre-Configured Admin Preferences
CSA MC ships with several pre-configured administrator preferences that you can choose if the default preferences do not meet your needs. By default, the administrator created automatically by the CiscoWorks installation is also the "Basic Administrator" preference included here. See Figure 2-3. The preferences shipped with CSA MC are as follows:
•
•
•
•
•
Figure 2-3 Administrator Preferences
Using Audit Trail
Accessible from the Reports drop-down list in the menu bar, the Audit Trail page displays a list of changes administrators have made to the CSA MC database. These changes are displayed according to the following information:
•
•
•
•
Click the Change Filter link to edit the audit trail viewing parameters according to the following:
•
•
•
•
•
Using Management Center for Cisco Security Agents
The sections in this chapter describe the various components you should understand in order to configure Cisco Security Agents using CSA MC.
Menu Bar
The menu bar at the top of CSA MC provides links to all configuration pages and list views. Arrows indicate that there are subcategories for which you can choose from those top-level main items (see Figure 2-4). These subcategories appear when you move the mouse over the main item itself.
When you select an item from the menu bar, the list view page for that item appears.
Figure 2-4 Menu Bar
The configuration options available from each menu bar item are as follows.
Events—The Events drop-down list provide tools for viewing and managing system status and log files. You can also set alerts and alert parameters from here. (See Chapter 10, "Event Logging and Alerts".)
Systems—The items available from the Systems drop-down list let you configure the groups which agent host systems are placed into when they register with CSA MC. You can also deploy new agent kits and software updates for agents from this menu option. (See Chapter 3, "Configuring Groups and Managing Hosts".)
Configuration—The items available from the Configuration drop-down list provide you with the pages you will need to configure your policies for agents. This list provides links to the rule pages you use to develop your policies, as well as links to application classes and variables. (See Chapter 4, "Building Policies")
Configuration>Rule modules—System state sets and User state sets are accessible from the cascading Rule Modules menu that appears when you move your mouse over that item in the Configuration drop-down list. (See Chapter 4, "Building Policies")
Configuration>Applications are accessible from the cascading menu that appears when you move your mouse over the Applications item in the Configuration drop-down list. (See Chapter 8, "Using Application Classes")
Configuration>Variables, such as file sets and network addresses, which are the building blocks for policies, are accessible from the cascading menu that appears when you move your mouse over the Variables item in the Configuration drop-down list. (See Chapter 9, "Configuring Variables".)
Analysis—The items in the Analysis menu are for diagnostic and investigative purposes, separate from general CSA MC configuration. Use these menu options to analyze application behavior and to investigate all resources being used across your enterprise with the purpose of securing these applications and resources using CSA MC Policies. (See Chapter 13, "Using Cisco Security Agent Analysis")
Maintenance—The items available from the Maintenance drop-down list let you import and/or export configuration files, backup your database configuration and enter your license key. When you move your mouse over the Export/Import item, you can select further options from the cascading menu that appears. (See Administrator Preferences, available from this menu item, as well.)
Reports—The items available from the Reports drop-down list let you generate reports by various categories such as event severity level, by the group(s) that generated the event and by individual host systems. (See Chapter 11, "Generating Reports".)
Search—Use the selections available from the Search drop-down list to search for a specific configuration item in the CSA MC database. You can limit your search to Hosts, Groups, Policies, Rules, Rule Modules, Variables, Application Classes, or All. Each option has its own criteria by which you can search.
Using Search
Once you select a category to search on from the Search drop-down list, enter all or part of the name of the item for which you are searching in the Find field. (See Figure 2-5.)
To further control your search, select one or more of the following check boxes.
•
•
•
You can limit Results per page by entering a value in the corresponding field. (25 is the default). Click the Find button. Results are displayed as links. Click the item link to go to its configuration view.
Tip
Note
(Use the Delete button to remove found items from the database. Once an item is deleted here, it cannot be recovered.)
•
The Hosts search page lets you search for hosts based on several criteria. For example, you can search for hosts that are not actively polling or that are unprotected. Unprotected hosts are not members of any group or are members of a group that has no policies
You can also search for hosts according to those with "old rule sets", "the latest rule set", "old (outdated) software", "those with pending software updates", "hosts not actively polling" see Not active hosts for details on this item, "hosts that have not polled in for a specified time".
See Host Detail View, page 3-24 for more information on Hosts.
Figure 2-5 Search Feature
Using Help
Help—In addition to this configuration guide, CSA MC provides online help. When you click Help on the far right of the menu bar, you can select Online Help or you can click a link for the Technical Support web site. When you select Online help, a new browser window opens. This window contains help information on the configuration item from which you have accessed the help. To view help on other topics, click the corresponding topic link in the Contents frame of the help window.
Note
Figure 2-6 Main Help System
Shortcuts and Hints
Other <configuration item>—In configuration views, an Other [Policies, Applications, Files Sets, etc] link appears on the right side of the user interface below the menu bar. Click this link to view a drop-down list containing the names of other configurations within the category you are currently working (see Figure 2-7). Click one of these names to view the configuration page for that item.
Note
Figure 2-7 Other Policies Link
Status Summary
Status Summary—When you first login, the Status Summary view appears (see Figure 2-8). This page supplies overall system summary information including recorded events and agent rule versions. You can access this page at any time by selecting it from the Events category in the menu bar. The various summary categories available from this page are as follows.
Network Status
By default, items in the Network Status category do not appear in the list if their number is 0. Simply expand the Network Status view to see all available status items. The status items listed here generally have to do with overall host statistics such as hosts that are not running with up-to-date software versions or the latest rule programs. You can view the number of hosts running in test mode or learn mode, etc. Additionally, the numbers that appear in this status section are clickable and take you to a list of the hosts that comprise that number.
There is one item in this Network Status section that is configurable. Host history collection is a feature that you enable and disable from this page. You optionally, globally enable Host history collection for all hosts if you want to maintain individual host histories of the following types of information: host registration, test mode setting changes, learn mode setting changes, IP address changes, CTA posture changes, CSA version changes, host active/inactive status changes.
When you enable Host history collection, a two week history of the previously listed host status changes is maintained for every host registered with the MC. Once this feature is enabled, to view a host's history, you access the details page for that host from System>Hosts in the menu bar and then click the link for that host. From the host details page, click the Detailed status and diagnostics link. A button that lets you view collected host history information is located on the pop-up diagnostic window that appears.
Note
Most Active
Use the links available in the Most Active section to view the Hosts, Rules, Applications, or Rule/Application pairs that have been the most active or triggered the most (logged the most events to the MC). This information is useful to help you tune your policies for rules that are being tripped too often. This can also alert you to common unwanted occurrences that may be triggering across your enterprise. Additionally, you can purge the events that appear in these lists.
Event Counts Per Day
A colored graph displays the event log according to severity level. Click on a color in the graph to view logged events of that severity level.
Database Maintenance
If there is an alert present in the Database Maintenance category, we recommend that you access the Database Maintenance page from Maintenance in the menu bar and shrink the database. See Database Maintenance (Free Up Disk Space on CSA MC ), page 12-8 for details.
Figure 2-8 Status Summary View
CSA MC Views and Navigation
List View—Each CSA MC configuration category has a top level list view. This list view displays a list of links, each of which represent a configured item for that category. It is from this list view that you create configurations and delete existing configurations. Buttons for New, Clone and Delete actions are present on list view pages. From the list view, you click an item link to access the configuration page for that item.
Configuration View—Access the configuration view for an item by clicking on that item in the list view. Configuration views may contain edit fields, radio buttons, checkboxes, and/or listboxes depending on the configuration requirements. Enter the necessary information and click Save to store data in the CSA MC database. Configuration views contain Save and Delete buttons. See Creating, Saving, and Deleting Data for further details.
Navigation Tools—The heading link (below the menu bar, see Figure 2-9) contains hierarchal links for the item you're configuring. Use these header links to switch between top level list views and subcategory configuration views. For example, in Figure 2-9, the header bar contains links to the top level Policies list view and the MS IIS Server policy. Note that leaving a configuration view without clicking the Save button causes any newly entered data to be lost.
Show reference list—Configuration items that are used in other configurations have a "Show reference list" link on their pages. Clicking this link displays all the configurations where the current item is used. This display also links to the items that are shown.
Note
Configuration Shortcuts—Rule pages allow you to insert pre-configured variables such as file sets and COM components into your rules. If there is no pre-configured variable that you wish to use and you want to create a new one, you can do it without leaving the rule page. When you click the Insert link beside any edit box in the rule page, there is a New item in the list that appears first. Selecting the "New" item pops up a configuration page for that variable type. You can then configure a new variable and use it in the rule without having to leave the rule page to access the variable page. You can double-click on an existing item to view its configuration page.
Application classes also have a shortcut you can use to create a new item. Clicking the New link beside the list of application classes in each rule configuration page lets you create a new application for your rule.
Figure 2-9 Configuration View
Creating, Saving, and Deleting Data
CSA MC Button Frame
All CSA MC action items appear in a frame at the bottom of CSA MC. The buttons in this frame change in accordance with the actions available for the page you're viewing. Available CSA MC buttons and links are as follows.
Generate rules (pending changes)—When you are ready to deploy your configuration (policies, rules, variables, etc.) to Cisco Security Agent systems, you must click this link in the bottom frame to view all pending database changes and then to generate them. (See Chapter 4, "Building Policies".)
New—Use the New button to create a new configuration item within the list view you have selected. Click the New button and a new item appears in the list view. Click the new item link to access the configuration view for that item.
Clone—Use the Clone button in conjunction with the checkboxes beside each list view item. To clone a particular configuration, select its checkbox and click the Clone button. You can clone one item at a time. New links to the cloned configurations appear in the list view.
Note
Note
Delete—Use the Delete button in conjunction with the checkboxes beside each list view item. To delete a configuration, select its checkbox (you can select several at once) and click the Delete button. All checked items are deleted. To quickly select all checkboxes, click the very top checkbox in the list view heading bar. Clicking the Delete button then deletes all items.
Save—When you enter configuration information, whether you are entering new data or editing existing data, you must click the Save button once you are finished to save your configuration in the CSA MC database. If you do not click Save before moving to another page in CSA MC, your data is lost.
Note
Compare—Groups, Policies, Rule Modules, Variables, and Application Classes provide a Compare button in their item list views. When you select the checkbox next to 2 items (you cannot compare more than 2 configurations at a time) and click the Compare button, CSA MC displays the configurations side by side and highlights the differences in red. Once you've examined how the configurations compare, you can select to merge them.
Note
Note
Using the Correct Syntax
CSA MC contains text fields that require you to enter information using a specific syntax. Most of the text fields in these pages are similar and require similar syntax. The text fields are categorized and listed below with the required syntax.
When using configuration variables in rules, application classes, and alerts you must enter the variable name preceded by a dollar sign. The insert links beside each text field automatically insert variables using the correct syntax.
For example, if you have a file set variable named Web Browsers, clicking the Insert File Set link lets you select Web Browsers. It then places $Web Browsers in the corresponding field using the correct syntax. The dollar sign tells CSA MC that this is a variable value.
When entering a Name for any item you configure, use the following syntax:
Names of items must be unique per operating system. Items may only have the same name if they have different operating system designations. (Host names, however, do not have to be unique.) All names are case insensitive, must start with an alphabetic character, can be up to 64 characters long and can include alphanumeric characters, spaces, hyphens - and underscores _ . (Note one exception, agent kits do not accept spaces in names.)
File entry text boxes require:
In a list of items, each item must appear on a single line. Do not specify multiple items on a single line.
Leading and trailing spaces are removed from each line. Other spaces, such as the one located in "Program Files" are recognized. To indicate leading or trailing spaces you must use special characters. The following special characters are recognized. (Note that the need to use the characters listed below should occur very rarely.)
http://stormcenter:1741Leading/Trailing Space
'bTab
'tLine feed
'nCarriage return
Note
Local system files are entered using full path and disk drive.
Windows:
c:\Program Files\Outlook\msimn.exe c:\winnt\regedit.exeYou can also use @fixed to indicate all local system drives without having to indicate the drive letters.
For example,'rUNIX:
/etc/passwd
Local system files are entered using full path and disk drive (Windows) with optional wildcard notations.Windows
c:\Program Files\Outlook\*.exeUNIX
/usr/bin/*
Note
Use the wildcard notation (* or ?) to indicate files within directories and whether directories and subdirectories are recursive
.
For example:
The following entry indicates all files one directory level down in the winnt directory. It does not include files in the winnt directory itself.
c:\winnt\*\*The following entry indicates all files in the winnt directory and all subfolders recursively (digging down as deep as necessary) and files.
c:\winnt\**\*The following entry indicates all files in the winnt directory and all subfolders recursively (digging down as deep as necessary) and files that contain exactly two characters in their name and have any extension.
c:\winnt\**\??.*If you do not specify a drive path in a file text field, CSA MC always prepends the string
c:\Program Files\Outlook\msimn.exe c:\winnt\regedit.exeto the named file. For example, if you enter foo.doc into a text field, it is saved as@fixed:\Program Files\Outlook\msimn.exe.
Note
File and Directory Protection
File access control rules provide three checkboxes which offer you the option of protecting files and/or directories. You should understand that file protection encompasses read/write access. Directory protection encompasses directory deletes, renames, and new directory creation.
Caution/etc/passwd, then no directories can be modified under Program Files. That is an overly broad protection to specify and would likely result in system instability. If you choose to protect directories, be sure to get very specific in your path string and understand the resulting behavior.
When protecting against directory creation, in particular, you should note that directory creation applies to an exact directory path match, but directory write and rename protection applies to all directories explicitly named in a path. If a directory name is completely wildcarded \**\, no protections exist for that particular component of the directory.
The following Windows example displays what protections exist for a literally entered resource in a Deny, File access control rule where the following checkboxes are selected: Read File, Write File, and Create, Delete, Rename Directory.
Example:
c:\Program Files\Outlook\*.exe
/usr/bin/*In the example above, the following protections exist:
•
c:\winnt\*\*cannot be renamed or deleted, but it can be created.•
c:\winnt\**\*cannot be renamed or deleted, but it can be created.•
c:\winnt\**\??.*cannot be renamed, deleted, or created.•
**\•
In the following UNIX example,
**\foo.docis the directory and**\Program Files\**Outlook.exe,, and**\Program Files\**\*SQL*\bin\*.exeare files in the sg directory.The following entry protects files x, y, and z in the sg directory and it protects the directory structure (if all checkboxes are selected in the File access control rule).
/usr/adm/sg/*This example works just like the previous Windows example. Therefore, directory creates are only prevented if the directory attempted to be created
exactly matches the entire path of
**\Program Files. Directory deletes and renames are prevented for each directory named in the path. Note that the only file protection provided here is within the sg directory because the last entry in a path is always assumed to be the file. If you only wanted to provide directory protection and not file protection, you would still have to enter the literal in the same manner. You must provide /* at the end of the path or the last entry would be seen as a file rather than a directory. In this case, you would only select the Write Directory checkbox and even though all files in the sg directory are specified, they are not protected.To protect files in the usr directory, you would have to make that another entry, e.g. /usr/* would have to be entered on another line below the original UNIX example. (Note that Windows works the same way.)
For UNIX directory entries, because there is no drive letter to specify (as in Windows) the wildcarded path (/**/) is not automatically placed in front of a UNIX path that begins with "/". If you begin the path with a forward slash, the directory path is taken literally. If you do not place a slash in front of the path, a wild card path is inserted before the entry when you save the rule.
Caution
Caution
You can use the following "short hand" entries in File Sets, File access control rules, File monitor rules, and Application classes to indicate common system directories. The @symbol must appear at the start of the short hand name. These entries resolve to the Windows directory on each agent system.
Table 2-3 Sample Short Hand File Tokens (Windows only)
@windows
Use
**\Program Files\**\*SQL*to indicate the directory pointed to by the**\Program Files\**\*SQL*\binenvironment variableWhen using @windows, for example, in the File access control rule Files field, it is interpreted as @windows\* to indicate the files within the directory.
@system
Use
**\Program Files\**\*SQL*\binto indicate/usr/adm/sg/@(regpath Registry key/value pair default=default directory)
Use
xto localize the directory structure of an application or other resource. This is useful to indicate software regardless of the directory to which it has been installed. Note that the default= field is optional but recommended, For example:y@dynamic
Use
zin the File set text field to indicate all files that have been quarantined by CSA MC as a result of correlated suspected virus application events, correlated virus scanner log messages, or files that were added manually by the administrator. This list updates automatically (dynamically) as logged quarantined files are received.To view the files that are added to the dynamically quarantined files list and to manually add files to be quarantined, click the Manage dynamically quarantined files link on the Global Event Correlation page. See Manage Dynamically Quarantined Files and IP Addresses, page 7-8 for more information.
You can use the following "short hand" entries in File Sets and in File access control and File monitor rules to indicate removable media. The @ symbol must appear at the start of the name. These entries resolve as follows:
Note
You can also use @fixed to indicate all local system drives without having to indicate the drive letters. For example, @fixed:\Program Files\Outlook\msimn.exe
For correct directory path specifications on internationalized Windows versions, you can use the following universal tokens in File Sets, File access control rules, File monitor rules, and Application classes to indicate common system directories for the localized version of the OS. These entries resolve to the appropriate Windows directory on each localized agent system.
Note
Tip
Network system paths (Windows only) entered using the following syntax:
\\<machine name>\<share>\<path>\<filename>\\Backup_Server\finance\records\database.db
You can also use @network (on Windows and UNIX) to indicate all network shares. For example,@dynamic
Caution
Network address text boxes require addresses entered in any of the following formats:
Enter single fully qualified addresses.
a.b.c.dEnter address ranges.
a.b.c.d-y.zThis address range indicates all addresses from a.b.c.d-a.b.y.z
Enter address ranges using "network address class" notation.
10.0.0.0/24This address range indicates all address from 10.0.0.0 to 10.255.255.255
You can use the following "short hand" entry in Network Address Sets and in Network Access Control rules to indicate all local addresses on the agent system in question. The @ symbol must appear at the start of the short hand name.
Use @local to indicate all local addresses on the agent system.
Use @remote to indicate all addresses that are not on the local agent system.
Use @subnet to indicate the local subnet addresses of the agent system. This is useful for allowing communications on your internal network but not to the outside world. This gives you more granularity for specifying internal communications without having to know all subnet addresses.
Use @recent to track addresses with which agent systems have recently communicated. This is useful for restricting callback connections to addresses with which you've recently initiated communications. You can also use this to restrict server connections to only those hosts that have initiated the control channel.
Use @dynamic in the Network address set text field to indicate all IP addresses that have been quarantined by CSA MC as a result of correlated communications with untrusted hosts events or IP addresses that were added manually by the administrator. This list updates automatically (dynamically) as logged quarantined IP addresses are received.
To view the IP addresses that are added to the dynamically quarantined IP addresses list and to manually add IP addresses to be quarantined, click the Manage dynamically quarantined IP addresses link on the Global Event Correlation page. See Manage Dynamically Quarantined Files and IP Addresses, page 7-8 for more information.
Use @smb-null-session in Network access control rules (as the network service). A null session is an unauthenticated session to one of the NetBIOS or CIFS ports on a system. These ports are typically used for file and print sharing, but they can also be used as an attack vector (e.g. SMB die). Use the @smb-null-session token to control connections to the system via an unauthenticated null-session.
Caution
See Network Access Control, page 6-28 for more information.
Network service text boxes require protocols and port ranges entered in the following formats:
Format all entries as:
protocol/port or port rangeTCP/80UDP/53TCP/1024-65535The protocol here is either "TCP" or "UDP".
Port ranges are designated in the range 0-65535.
Designating ephemeral ports—In some cases, an application may want to offer a temporary service port for callback data connections. An ephemeral port is a temporary system-assigned port for this purpose.
For example, an ephemeral port would be the likely data connection for active FTP. If you do not specify an ephemeral port range for accepting an active FTP connection, you would have to allow clients to listen on a wide range of ports to accept this connection type. This would unnecessarily open a wide range of data channels and possibly create a vulnerability that could be exploited by a Trojan.You can specify an ephemeral port range for a Network service as follows:
TCP/ephemeralUDP/ephemeral
Note
Caution
