Fidelis XPS Manuel utilisateur

User Guide

Version 6.0

Fidelis XPS™, version 6.0

User Guide, version 6.0

Revised March 2010

Users are granted permission to copy and/or distribute this document in its original electronic form and print

copies for personal use. This document cannot be modified or converted to any other electronic or

machine-readable form in whole or in part without prior written approval of Fidelis Security Systems, Inc.

While we have done our best to ensure that the material found in this document is accurate, Fidelis

Security Systems, Inc. makes no guarantee that the information contained herein is error free.

Fidelis XPS includes GeoLite data created by MaxMind, available from http://www.maxmind.com/.

Fidelis Security Systems

4416 East West Highway, Suite 310

Bethesda, MD 20814

Fidelis XPS User Guide Version 6.0 Table of Contents iii

Table of Contents

Preface............................................................................................................................................. 1

Intended Audience....................................................................................................................... 1

Technical Support........................................................................................................................ 2

Available Guides.......................................................................................................................... 2

Fidelis XPS™ Overview.................................................................................................................. 3

Fidelis XPS Modules.................................................................................................................... 3

CommandPost ........................................................................................................................ 4

Direct....................................................................................................................................... 4

Internal.................................................................................................................................... 4

Proxy....................................................................................................................................... 4

Mail.......................................................................................................................................... 5

Web Walker............................................................................................................................. 5

Connect................................................................................................................................... 5

Fidelis XPS Policies..................................................................................................................... 5

Prebuilt Policies....................................................................................................................... 5

Custom Policies ...................................................................................................................... 6

Chapter 1 Getting Started .............................................................................................................. 7

Access CommandPost................................................................................................................. 7

Change your Account .................................................................................................................. 7

Access the Guides....................................................................................................................... 8

Lock Icon ..................................................................................................................................... 8

CommandPost Navigation........................................................................................................... 8

System Status.............................................................................................................................. 8

Logout.........................................................................................................................................10

Using Non-ASCII Characters in Fidelis XPS...............................................................................10

Chapter 2 The Dashboard.............................................................................................................11

The Radar Page .........................................................................................................................11

What is an event? ..................................................................................................................11

What is an alert? ....................................................................................................................11

What is alert radar?................................................................................................................11

Uses of Alert Radar................................................................................................................12

Current Status Frame.............................................................................................................13

Information Flow Map™ Page ....................................................................................................14

The Information Flow Map......................................................................................................15

Controls in the Left Panel.......................................................................................................17

Fidelis XPS User Guide Version 6.0 Table of Contents iv

Filtering and Sorting Criteria...................................................................................................19

Chapter 3 Understand and Manage Alert Workflows .................................................................22

Access to Alerts and Quarantined E-Mails..................................................................................22

Handle Alerts..............................................................................................................................22

The Alert Workflow Log...............................................................................................................23

Manage a Single Alert.................................................................................................................23

Change Status .......................................................................................................................23

Change Alert Group ...............................................................................................................24

Manage Multiple Alerts ...............................................................................................................24

Chapter 4 Understand and Manage Alerts ..................................................................................25

Alert Report.................................................................................................................................26

Alert Quick Summary .............................................................................................................26

Filter Alerts.............................................................................................................................27

Navigate Alert Pages..................................................................................................................27

Alert Actions................................................................................................................................28

Alert Labels............................................................................................................................28

Export Alerts to Excel.............................................................................................................28

Purge Alerts ...........................................................................................................................29

Alert Report Page Controls.........................................................................................................29

System Reports for Alerts ......................................................................................................30

Search for Alerts ....................................................................................................................30

Duration..................................................................................................................................35

Include or Exclude Incoming Alerts........................................................................................35

Customize Alert Report...............................................................................................................36

Group.....................................................................................................................................36

Group Details.........................................................................................................................38

Create PDF Reports for Alerts....................................................................................................38

Trending......................................................................................................................................39

Alert Details ................................................................................................................................41

Alert Highlighting....................................................................................................................43

Scroll through Alert Details.....................................................................................................44

Download Text File.................................................................................................................44

Find Similar Alerts..................................................................................................................44

Manage Label ........................................................................................................................45

Purge this Alert.......................................................................................................................45

Alert Compression..................................................................................................................45

Decoding Path and Channel Attributes ..................................................................................45

Forensic Data.........................................................................................................................47

Recorded TCP Session..........................................................................................................47

Tune Rules from an Alert............................................................................................................49

Fidelis XPS User Guide Version 6.0 Table of Contents v

Chapter 5 Understand and Manage Quarantined E-Mails..........................................................52

Understand Fidelis XPS Mail Quarantine....................................................................................52

The Quarantine Report...............................................................................................................53

Take Actions on Quarantined E-Mails.........................................................................................54

Deliver or Discard Quarantined E-Mail........................................................................................54

Search Quarantined E-Mails.......................................................................................................54

Search Quarantined E-Mails using Duration...............................................................................56

Advanced Search for Quarantined E-Mails.................................................................................57

Quarantine Details......................................................................................................................58

Chapter 6 Manage Reports ...........................................................................................................59

Create Custom Reports..............................................................................................................60

Search....................................................................................................................................60

Filters .....................................................................................................................................62

Duration..................................................................................................................................63

Columns.................................................................................................................................64

Group By................................................................................................................................66

Custom Report Controls.........................................................................................................66

Run Custom Reports ..................................................................................................................67

Edit Custom Reports...................................................................................................................67

Copy Custom Reports.................................................................................................................67

Save and Schedule Reports.......................................................................................................68

Save.......................................................................................................................................68

Save and Schedule................................................................................................................68

Delete Reports............................................................................................................................69

Chapter 7 Create and Use Quick Reports....................................................................................70

Define Quick Reports..................................................................................................................70

Create Quick Reports .................................................................................................................73

Create PDFs for Quick Reports..................................................................................................74

Schedule Quick Reports.............................................................................................................74

Chapter 8 Network Reports ..........................................................................................................75

TCP Resets ................................................................................................................................77

Application Protocols ..................................................................................................................78

IP Defragmenter .........................................................................................................................79

Inline Module ..............................................................................................................................80

Network Statistics .......................................................................................................................81

TCP Processor ...........................................................................................................................82

Proxy...........................................................................................................................................83

Mail.............................................................................................................................................84

Connect ......................................................................................................................................85

Web Walker................................................................................................................................85

Fidelis XPS User Guide Version 6.0 Table of Contents vi

Chapter 9 Manage Users, Roles, and Groups.............................................................................86

Access Control in CommandPost...............................................................................................87

Small Security Teams.................................................................................................................88

Define User Profiles....................................................................................................................88

Add or Edit a Local User.............................................................................................................89

Delete a User..............................................................................................................................91

Define Alert Management Groups ..............................................................................................92

Add or Edit an Alert Management Group ...............................................................................92

Delete an Alert Management Group.......................................................................................93

Define User Roles.......................................................................................................................93

Access Roles .........................................................................................................................94

Add or Edit a Custom Role.....................................................................................................95

Delete a Custom Role............................................................................................................96

Chapter 10 Configure Fidelis XPS Components.........................................................................97

The Component Page.................................................................................................................97

Component Information ..............................................................................................................97

Status Lights ..........................................................................................................................97

Details....................................................................................................................................97

License Messages..................................................................................................................98

Component Buttons................................................................................................................98

Add a Sensor..............................................................................................................................99

Edit a Sensor..............................................................................................................................99

License...................................................................................................................................99

Expiration.............................................................................................................................100

System Monitor ....................................................................................................................100

Logs .....................................................................................................................................102

Configure CommandPost..........................................................................................................103

User Authentication..............................................................................................................103

Email Configuration..............................................................................................................107

User Notification...................................................................................................................108

LDAP Configuration..............................................................................................................109

LDAP Reports ......................................................................................................................111

Alert Storage ........................................................................................................................112

CommandPost Language Configuration ..............................................................................113

Diagnostics...........................................................................................................................114

Archive.................................................................................................................................115

Configure Sensors....................................................................................................................116

Sensor Run Time Information ..............................................................................................116

Sensor Config Page.............................................................................................................116

Direct and Internal................................................................................................................117

Fidelis XPS User Guide Version 6.0 Table of Contents vii

Proxy....................................................................................................................................122

Mail.......................................................................................................................................123

Web Walker..........................................................................................................................125

Connect................................................................................................................................127

EMail Relayhost ...................................................................................................................129

Sensor Language Configuration...........................................................................................129

Chapter 11 Version Control ........................................................................................................131

Fidelis Release Naming Conventions.......................................................................................131

Update Fidelis XPS...................................................................................................................132

Prepare to Update................................................................................................................132

Run Update..........................................................................................................................132

Update Progress..................................................................................................................133

Schedule Update......................................................................................................................134

Cancel Scheduled Jobs............................................................................................................135

Chapter 12 Configure Exports....................................................................................................136

Export Methods.........................................................................................................................136

Fidelis Archive......................................................................................................................136

EMail and Syslog .................................................................................................................136

SNMP Trap and ArcSight.....................................................................................................138

Verdasys Digital Guardian....................................................................................................138

IBM SiteProtector.................................................................................................................138

Define Exports..........................................................................................................................139

Available Export Buttons......................................................................................................140

Testing Export Communication ............................................................................................140

Delete Exports ..........................................................................................................................140

Chapter 13 Audit..........................................................................................................................141

Access Audit.............................................................................................................................141

Search for Audit Entries............................................................................................................142

Search Terms.......................................................................................................................142

Notes about Search Options................................................................................................143

Time Periods........................................................................................................................143

Chapter 14 Backup and Restore.................................................................................................144

Accessing the Command Line Interface ...................................................................................144

Backup and Restore CommandPost.........................................................................................144

Backup CommandPost.........................................................................................................144

Restore CommandPost........................................................................................................145

Backup and Restore a Sensor..................................................................................................146

Chapter 15 Archive......................................................................................................................147

Export Archive Data .............................................................................................................147

Import Archive Data..............................................................................................................147

Fidelis XPS User Guide Version 6.0 Table of Contents viii

Index.............................................................................................................................................149

List of Tables

Table 1. Critical conditions................................................................................................................ 9

Table 2. High severity conditions...................................................................................................... 9

Table 3. Controls .............................................................................................................................16

Table 4. Filter Lists ..........................................................................................................................20

Table 5. Actions list options.............................................................................................................24

Table 6. System Reports.................................................................................................................30

Table 7. Alert search fields..............................................................................................................32

Table 8. Sections in Alert Details.....................................................................................................42

Table 9. Decoding paths..................................................................................................................46

Table 10. Quarantined E-mail: search fields....................................................................................55

Table 11. Quarantined E-mail: advanced search fields ...................................................................57

Table 12. Search Fields...................................................................................................................60

Table 13. Filters...............................................................................................................................62

Table 14. System report columns....................................................................................................64

Table 15. Quick reports ...................................................................................................................71

Table 16. Determine user access....................................................................................................90

Table 17. User access levels...........................................................................................................94

Table 18. General parameters.......................................................................................................119

Table 19. Advanced parameters....................................................................................................120

Table 20. Proxy parameters ..........................................................................................................122

Table 21. Mail parameters.............................................................................................................124

Table 22. Web Walker parameters................................................................................................125

Table 23. Connect: General parameters........................................................................................127

Table 24. Alert Export keywords....................................................................................................137

Table 25. Audit Log columns .........................................................................................................142

Fidelis XPS User Guide Version 6.0 Preface 1

Preface

This guide describes how to use the Fidelis XPS™CommandPost™ console to monitor and

manage security alerts, to configure sensors, and to create and maintain CommandPost users

This guide contains the following chapters:

The Overview describes Fidelis XPS: the CommandPost Management Console and other

moudules. This section also briefly describes prebuilt and custom policies.

Chapter 1 Getting Started describes how to access and navigate CommandPost, change account

information, and access more information.

Chapter 2 describes the and how to use alert radar and Information Flow Map.

Chapter 3 describes how to manage alert workflows.

Chapter 4 describes the alert report and how to use alert features.

Chapter 5 describes the quarantine management list and how to manage quarantined e-mails.

Chapter 6 describes how to manage Custom Reports.

Chapter 7 describes how to create and use Quick Reports.

Chapter 8 describes how to use network reports.

Chapter 9 describes how to create and modify user information.

Chapter 10 describes how to configure CommandPost and Fidelis XPS sensors.

Chapter 11 descries how to update and manage Fidelis XPS versions.

Chapter 12 describes how to configure exports.

Chapter 13 describes the Audit feature and how to run it from the CommandPost GUI.

Chapter 14 describes how to backup and restore CommandPost and sensors.

Chapter 15 describes how to Archive alert and session data on the CommandPost.

Intended Audience

This information is intended for network system administrators familiar with networking, computer

security, and with the security requirements and practices of their enterprises. This help system

and related guides are intended for users that fit into at least one of the following major categories:

•The alert and quarantine managers are frequent users of the system, likely to visit the

CommandPost GUI several times each day. Both roles are usually filled by system

administrators responsible for reviewing alerts (or quarantined e-mails) and managing any

action required within the enterprise. Alert and quarantine management require high level

data analysis and the ability to delve into the details of any single violation.

•The network IT manager will be the first to touch the CommandPost, but is expected to rarely

use Fidelis XPS after initial installation. The IT manager might need to adjust sensor network

settings and CommandPost to sensor communications, manage CommandPost users and

their credentials, and monitor network statistics to verify connectivity.

Fidelis XPS User Guide Version 6.0 Preface 2

Technical Support

For all technical support related to this product, check with your site administrator to determine

support contract details. Contact your reseller or if you have a direct support contract, contact the

Fidelis Security support team at:

Phone: +1 301.652.7190*

Toll-free in the US: 1.800.652.4020*

*Use the customer support option.

E-mail: support@fidelissecurity.com

Web: https://portal.fidelissecurity.com

Available Guides

The following guides are available:

The Guide to Creating Policies describes how to define policies and the rules and fingerprints that

policies contain.

The Guide to Prebuilt Policies describes policies that ship with Fidelis XPS and the rules and

fingerprints that these policies contain. This guide also indicates which rules and fingerprints might

need to be configured for your enterprise.

The Enterprise Setup and Configuration Guide describes how to set up and configure Fidelis XPS

hardware.

Release Notes are updated with each release to provide information about new features, major

changes, and bugs corrected.

Table des matières

Manuels Système de sécurité populaires d'autres marques

Inner Range

Inner Range Concept 2000 Manuel utilisateur

Climax

Climax Mobile Lite R32 Instructions de montage

CADDX

CADDX NX-6 Manuel utilisateur

FBII

FBII XL-31 Series Manuel utilisateur

Johnson Controls

Johnson Controls PENN Connected PC10 Manuel utilisateur

Aeotec

Aeotec Siren Gen5 Manuel utilisateur

Blaupunkt

Blaupunkt SA 2700 Manuel utilisateur

IDEAL

IDEAL Accenta Manuel du propriétaire

AJAX

AJAX DoubleButton Manuel utilisateur

Swann

Swann SW-P-MC2 Manuel utilisateur

Ecolink

Ecolink Siren+Chime Manuel utilisateur

Digital Monitoring Products

Digital Monitoring Products XR150 Manuel utilisateur

EDM

EDM Solution 6+6 Wireless-AE Manuel utilisateur

Highway Safety Group

Highway Safety Group EA401 Manuel utilisateur

Siren

Siren LED GSM Manuel utilisateur

Detection Systems

Detection Systems 7090i Instructions de montage

Se-Kure Controls

Se-Kure Controls MicroMini SK-4841 Manuel utilisateur

Siemens

Siemens FDM273 Manuel utilisateur