Alert Manager. Product Guide Revision 1.0. version 4.7.1

Transcription

1 Alert Manager Product Guide Revision 1.0 version 4.7.1

2 COPYRIGHT Copyright 2004 Networks Associates Technology, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of Networks Associates Technology, Inc., or its suppliers or affiliate companies. To obtain this permission, write to the attention of the Network Associates legal department at: 5000 Headquarters Drive, Plano, Texas 75024, or call TRADEMARK ATTRIBUTIONS Active Firewall, Active Security, ActiveSecurity (in Katakana), ActiveHelp, ActiveShield, AntiVirus Anyware and design, Bomb Shelter, Certified Network Expert, Clean-Up, CleanUp Wizard, ClickNet, CNX, CNX Certification Certified Network Expert and design, Covert, Design (Stylized E), Design (Stylized N), Disk Minder, Distributed Sniffer System, Distributed Sniffer System (in Katakana), Dr Solomon s, Dr Solomon s label, Entercept, Enterprise SecureCast, Enterprise SecureCast (in Katakana), epolicy Orchestrator, EZ SetUp, First Aid, ForceField, GMT, GroupShield, GroupShield (in Katakana), Guard Dog, HomeGuard, Hunter, IntruShield, Intrusion Prevention Through Innovation, IntruVert Networks, LANGuru, LANGuru (in Katakana), M and Design, McAfee, McAfee (in Katakana), McAfee and design, McAfee.com, McAfee VirusScan, NA Network Associates, Net Tools, Net Tools (in Katakana), NetCrypto, NetOctopus, NetScan, NetShield, NetStalker, Network Associates, Network Associates Coliseum, NetXray, NotesGuard, Nuts & Bolts, Oil Change, PC Medic, PCNotary, PrimeSupport, Recoverkey, Recoverkey - International, Registry Wizard, RingFence, Router PM, SecureCast, SecureSelect, Sniffer, Sniffer (in Hangul), SpamKiller, Stalker, TIS, TMEG, Total Network Security, Total Network Visibility, Total Network Visibility (in Katakana), Total Virus Defense, Trusted Mail, UnInstaller, Virex, Virus Forum, ViruScan, VirusScan, WebScan, WebShield, WebShield (in Katakana), WebSniffer, WebStalker, WebWall, What s The State Of Your IDS?, Who s Watching Your Network, WinGauge, Your E-Business Defender, Zip Manager are registered trademarks or trademarks of Network Associates, Inc. and/or its affiliates in the US and/or other countries. Sniffer brand products are made only by Network Associates, Inc. All other registered and unregistered trademarks herein are the sole property of their respective owners. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO NETWORK ASSOCIATES OR THE PLACE OF PURCHASE FOR A FULL REFUND. Attributions This product includes or may include: Software developed by the OpenSSL Project for use in the OpenSSL Toolkit ( Cryptographic software written by Eric A. Young and software written by Tim J. Hudson. Some software programs that are licensed (or sublicensed) to the user under the GNU General Public License (GPL) or other similar Free Software licenses which, among other rights, permit the user to copy, modify and redistribute certain programs, or portions thereof, and have access to the source code. The GPL requires that for any software covered under the GPL which is distributed to someone in an executable binary format, that the source code also be made available to those users. For any such software covered under the GPL, the source code is made available on this CD. If any Free Software licenses require that Network Associates provide rights to use, copy or modify a software program that are broader than the rights granted in this agreement, then such rights shall take precedence over the rights and restrictions herein. Software originally written by Henry Spencer, Copyright 1992, 1993, 1994, 1997 Henry Spencer. Software originally written by Robert Nordier, Copyright Robert Nordier. Software written by Douglas W. Sauder. Software developed by the Apache Software Foundation ( A copy of the license agreement for this software can be found at txt. International Components for Unicode ( ICU ) Copyright International Business Machines Corporation and others. Software developed by CrystalClear Software, Inc., Copyright 2000 CrystalClear Software, Inc. FEAD Optimizer technology, Copyright Netopsystems AG, Berlin, Germany. Outside In Viewer Technology Stellent Chicago, Inc. and/or Outside In HTML Export, 2001 Stellent Chicago, Inc. Software copyrighted by Thai Open Source Software Center Ltd. and Clark Cooper, 1998, 1999, Software copyrighted by Expat maintainers. Software copyrighted by The Regents of the University of California, Software copyrighted by Gunnar Ritter. Software copyrighted by Sun Microsystems, Inc Software copyrighted by Gisle Aas Software copyrighted by Michael A. Chase, Software copyrighted by Neil Winton, Software copyrighted by RSA Data Security, Inc., Software copyrighted by Sean M. Burke, 1999, Software copyrighted by Martijn Koster, Software copyrighted by Brad Appleton, Software copyrighted by Michael G. Schwern, Software copyrighted by Graham Barr, Software copyrighted by Larry Wall and Clark Cooper, Software copyrighted by Frodo Looijaard, Software copyrighted by the Python Software Foundation, Copyright 2001, 2002, A copy of the license agreement for this software can be found at Software copyrighted by Beman Dawes, , Software written by Andrew Lumsdaine, Lie-Quan Lee, Jeremy G. Siek University of Notre Dame. Software copyrighted by Simone Bordet & Marco Cravero, Software copyrighted by Stephen Purcell, Software developed by the Indiana University Extreme! Lab ( Software copyrighted by International Business Machines Corporation and others, Software developed by the University of California, Berkeley and its contributors. Software developed by Ralf S. Engelschall <rse@engelschall.com> for use in the mod_ssl project ( Software copyrighted by Kevlin Henney, Software copyrighted by Peter Dimov and Multi Media Ltd. 2001, Software copyrighted by David Abrahams, 2001, See bind.html for documentation. Software copyrighted by Steve Cleary, Beman Dawes, Howard Hinnant & John Maddock, Software copyrighted by Boost.org, Software copyrighted by Nicolai M. Josuttis, Software copyrighted by Jeremy Siek, Software copyrighted by Daryle Walker, Software copyrighted by Chuck Allison and Jeremy Siek, 2001, Software copyrighted by Samuel Krempp, See for updates, documentation, and revision history. Software copyrighted by Doug Gregor (gregod@cs.rpi.edu), 2001, Software copyrighted by Cadenza New Zealand Ltd., Software copyrighted by Jens Maurer, 2000, Software copyrighted by Jaakko Järvi (jaakko.jarvi@cs.utu.fi), 1999, Software copyrighted by Ronald Garcia, Software copyrighted by David Abrahams, Jeremy Siek, and Daryle Walker, Software copyrighted by Stephen Cleary (shammah@voyager.net), Software copyrighted by Housemarque Oy < Software copyrighted by Paul Moore, Software copyrighted by Dr. John Maddock, Software copyrighted by Greg Colvin and Beman Dawes, 1998, Software copyrighted by Peter Dimov, 2001, Software copyrighted by Jeremy Siek and John R. Bandela, Software copyrighted by Joerg Walter and Mathias Koch, Issued JULY 2004 / Alert Manager software version DOCUMENT BUILD 004-EN

3 Contents 1 Introducing Alert Manager What s new in this release How Alert Manager works Using this guide Audience Conventions Resources Getting product information Contacting McAfee Security & Network Associates Installing Alert Manager Installing Alert Manager System requirements Using the Setup utility to install the product Removing Alert Manager Using the Setup utility to remove the product Using the Add/Remove Programs utility to remove the product Configuring Alerts Configuring recipients and methods Adding alert methods Sending a test message Setting the alert priority level for recipients Viewing the Summary page Forwarding alert messages to another computer Sending an alert as a network message Sending alert messages to addresses Sending alert messages to a printer Sending alert messages via SNMP Launching a program as an alert Logging alert notifications in an event log Sending a network message to a terminal server Product Guide iii

4 Contents Using centralized alerting Customizing alert messages Enabling and disabling alert messages Editing alert messages Changing alert priority Editing alert message text Using Alert Manager system variables A Troubleshooting Frequently Asked Questions (FAQ) General questions Active Directory questions Troubleshooting common problems General issues Active Directory issues Glossary Index iv Alert Manager software version 4.7.1

5 Introducing Alert Manager 1 Alert Manager provides you with immediate notification that your anti-virus client or server software has detected a virus. Alerting is incorporated into anti-virus software, such as VirusScan Enterprise and other McAfee Security products. Alert Manager receives alerts and notifies you, or others, when viruses are detected on a computer in your network. It also provides a variety of options for what to do with alerts that do occur. These topics are included in this section: What s new in this release How Alert Manager works Using this guide Resources What s new in this release This release of Alert Manager includes the following changes: Any Patches that have been released since the previous release. See the Readme for specific details. New alerts as required to be compatible with VirusScan Enterprise. Product Guide 5

6 Introducing Alert Manager How Alert Manager works Alert Manager allows you to configure two basic aspects of alerting: Where and how alerts are sent. Configure where and how to send alerts generated by anti-virus software. Messages can be sent to workstation users or anti-virus administrators using a variety of alerting methods. Some of these include network messages, messages, printed messages, and SNMP traps. What text is shown in the alert. Configure both the message text and the priority levels of individual alerts. In addition, specific alerts can be completely disabled if desired. Alert Manager handles alerts and events generated by your anti-virus software in real time. In a typical configuration, Alert Manager resides on a central server and listens for alert events sent to it by client or server anti-virus software applications on the network. These anti-virus software applications can be workstation or server applications such as VirusScan Enterprise or mail server applications like GroupShield that are configured to send alerts to Alert Manager. This diagram provides an overview of how Alert Manager works: Figure 1-1. Workstations and servers send events to Alert Manager 6 Alert Manager software version 4.7.1

7 How Alert Manager works Generally, you enable Alert Manager alerting in the client anti-virus application so that the application sends notification to the Alert Manager server. You must specify the server name where Alert Manager is installed, such as \\AlertManagerServer. Figure 1-2. Specify the Alert Manager server Note that you configure your client anti-virus software to point at the server where Alert Manager is installed. You do not configure Alert Manager to point at your client systems. Refer to your client or server anti-virus software documentation for more detailed information on how to configure it to send alerts to Alert Manager. When the anti-virus software generates an alert, for example, when VirusScan Enterprise detects and cleans a virus from an infected message, it sends the alert to Alert Manager. Alert Manager receives the alert, then distributes it as an alert notification message according to pre-configured alert methods. Product Guide 7

8 Introducing Alert Manager This diagram describes how alerts are collected and distributed: Figure 1-3. Alert Manager collects and distributes alerts Alert Manager distributes alert notification messages depending on how you configure Alert Manager to handle alerts of the different priority levels. For example, when critical or major priority alerts are detected, you may want Alert Manager to send an notification to a network administrator s pager for immediate action, and also to network users via a pop-up message. Similarly, you may choose to have lower priority alerts logged to a log file rather than distributed as messages. See Configuring recipients and methods on page 22 for more information on the specific kinds of alert methods available. 8 Alert Manager software version 4.7.1

9 Using this guide Using this guide This guide includes this information: Overview of the product. Detailed instructions for installing the product. Detailed instructions for configuring the product. Troubleshooting information. Glossary of terms. When using this guide, consider the following: Audience Conventions Audience This information is intended for system and network administrators who are responsible for their company s anti-virus and security program. Product Guide 9

10 Introducing Alert Manager Conventions This guide uses the following conventions: Bold All words from the user interface, including options, menus, buttons, and dialog box names. Example Type the User name and Password of the desired account. Courier The path of a folder or program; a web address (URL); text that represents something the user types exactly (for example, a command at the system prompt). Examples The default location for the program is: C:\Program Files\Network Associates\VirusScan Visit the Network Associates web site at: Run this command on the client computer: C:\SETUP.EXE Italic For emphasis or when introducing a new term; for names of product manuals and topics (headings) within the manuals. Example Refer to the VirusScan Enterprise Product Guide for more information. <TERM> Angle brackets enclose a generic term. Example In the console tree under epolicy Orchestrator, right-click <SERVER>. NOTE Supplemental information; for example, an alternate method of executing the same command. WARNING Important advice to protect a user, computer system, enterprise, software installation, or data. 10 Alert Manager software version 4.7.1

11 Resources Resources Refer to these sections for additional resources: Getting product information Contacting McAfee Security & Network Associates Getting product information Installation Guide * Product Guide * System requirements and instructions for installing and starting the software. Product introduction and features, detailed instructions for configuring the software, information on deployment, recurring tasks, and operating procedures. Alert Manager Product Guide McAfee Installation Designer Product Guide epolicy Orchestrator Product Guide Help Configuration Guide * Implementation Guide * Release Notes Contacts High-level and detailed information on configuring and using the software. What s This? field-level help. For use with epolicy Orchestrator. Procedures for configuring, deploying, and managing your McAfee Security product through epolicy Orchestrator management software. Supplemental information for product features, tools, and components. ReadMe. Product information, resolved issues, any known issues, and last-minute additions or changes to the product or its documentation. Contact information for McAfee Security and Network Associates services and resources: technical support, customer service, AVERT (Anti-Virus Emergency Response Team), beta program, and training. This file also includes phone numbers, street addresses, web addresses, and fax numbers for Network Associates offices in the United States and around the world. * An Adobe Acrobat.PDF file on the product CD or the McAfee Security download site. A printed manual that accompanies the product CD. Note: Some language manuals may be available only as a.pdf file. Text files included with the software application and on the product CD. Help accessed from the software application: Help menu and/or Help button for page-level help; right-click option for What s This? help. Product Guide 11

12 Introducing Alert Manager Contacting McAfee Security & Network Associates Technical Support Home Page KnowledgeBase Search PrimeSupport Service Portal * McAfee Security Beta Program Security Headquarters AVERT (Anti-Virus Emergency Response Team) Home Page Virus Information Library Submit a Sample AVERT WebImmune AVERT DAT Notification Service Download Site Home Page DAT File and Engine Updates Product Upgrades * Training McAfee Security University Network Associates Customer Service Web US, Canada, and Latin America toll-free: ftp://ftp.nai.com/pub/antivirus/datfiles/4.x rsity.htm services_corporate_division@nai.com Phone VIRUS NO or Monday Friday, 8 a.m. 8 p.m., Central Time For additional information on contacting Network Associates and McAfee Security including toll-free numbers for other geographic areas see the Contact file that accompanies this product release. * Logon credentials required. 12 Alert Manager software version 4.7.1

13 Installing Alert Manager 2 You can install Alert Manager either as a stand-alone product or as part of a custom installation of another McAfee Security anti-virus product, such as VirusScan Enterprise. These topics are included in this section: Installing Alert Manager Removing Alert Manager Installing Alert Manager The instructions in this section describe installing Alert Manager as a stand-alone product. For detailed information on installing Alert Manager with another McAfee Security product, see the appropriate product documentation. System requirements Using the Setup utility to install the product Product Guide 13

14 Installing Alert Manager System requirements Verify that your computer system meets the following requirements before you start the installation process. The Alert Manager software installs and runs on a server or a workstation equipped with: Processor An Intel processor or compatible architecture. McAfee Security recommends an Intel Pentium or Celeron processor running at a minimum of 166MHz. Operating system Any of these Microsoft Windows platforms: Server Windows NT Server 4.0, with Service Pack 6 or 6a. Windows NT Enterprise Server 4.0, with Service Pack 6 or 6a. Windows NT Terminal Server Edition, with Service Pack 6. Windows 2000 Server, with Service Pack 2, 3, or 4. Windows 2000 Advanced Server, with Service Pack 2, 3, or 4. Windows 2000 DataCenter Server, with Service Pack 2, 3, or 4. Windows Server 2003 Standard Edition, with Service Pack 1. Windows Server 2003 Enterprise Edition, with Service Pack 1. Windows Server 2003 Web Edition, with Service Pack 1. Windows Server 2003 DataCenter Edition Workstation Windows NT Workstation 4.0, with Service Pack 6 or 6a. Windows 2000 Professional, with Service Pack 2, 3, or 4. Windows XP Home and Professional, with Service Pack 1. Windows XP Tablet PC. Free disk space Adequate hard disk space: 1.5MB A complete installation of all the program s features and components occupies approximately 1.5MB of disk space on your computer. 2.6MB The installation process uses an additional 2.6MB of temporary disk space, which is freed when the installation is complete. Other A CD-ROM drive or an Internet connection. 14 Alert Manager software version 4.7.1

15 Installing Alert Manager Using the Setup utility to install the product To install Alert Manager: 1 Extract the contents of the installation.zip file to a temporary folder on your hard drive. 2 Double-click the SETUP.EXE file to start the McAfee Alert Manager Setup utility. Figure 2-4. License Agreement 3 On the License Agreement dialog box, accept the license agreement by clicking the appropriate option, then click Next. You cannot install Alert Manager without accepting the license agreement. 4 On the Service Account Information dialog box, specify the user name and password to be used. a b c Select Use System Account to use the system account for the current user. In the User Name field, type both the domain and account name for this user. In the Password field, type the password for this user. NOTE If you specify a user name and password, make sure that this user account has sufficient rights on the specified system to perform all of the alerting methods you want to configure. Administrator rights are recommended. d Click Next to continue. Product Guide 15

16 Installing Alert Manager Active Directory Configuration Active Directory is a service available on newer versions of the Microsoft Windows operating system, such as Windows 2000, Windows 2003, and Windows XP. Publishing Alert Manager to Active Directory adds a Service Connection Point as a child of the local server object. This Service Connection Point can be used to search in Active Directory for the server on which Alert Manager is running, so that alerts can be forwarded to that server for processing without manual configuration. For additional information, see Active Directory questions on page 58 and Active Directory issues on page 63. If you are installing Alert Manager on a computer that is running a Windows operating system with Active Directory and is already part of the Active Directory domain, the Active Directory Configuration dialog box appears. NOTE If you are publishing Alert Manager in the Active Directory but this dialog box does not appear, your server may not have Active Directory correctly configured. See your operating system documentation for information on how to do this. Figure 2-5. Active Directory Configuration 16 Alert Manager software version 4.7.1

17 Installing Alert Manager 5 To publish Alert Manager to Active Directory: a b c Select Publish Alert Manager in the Active Directory. Type a unique name for the Alert Manager in the text box. If you have multiple instances of Alert Manager published in the Active Directory, each one must have a unique name. If you want this installation of Alert Manager to be the default, select Select to set as the default Alert Manager. NOTE While there can be many instances of Alert Manager in the Active Directory, there can be only one default. If another Alert Manager in the Active Directory domain has also been set to be the default, the new Alert Manager instance does not publish to Active Directory. d Select Next. Product Guide 17

18 Installing Alert Manager Cluster Configuration If you are installing Alert Manager as a clustered resource, the Cluster Configuration dialog box appears. NOTE The Cluster Configuration dialog box appears only if the server on which you are installing Alert Manager is running Microsoft Cluster Server. Figure 2-6. Cluster Configuration 6 To configure Alert Manager to be a clustered resource on your network: a b c d e Select Install Alert Manager as a Clustered Resource. Type the IP Address and Subnet Mask for the computer where you are installing Alert Manager. Type the Virtual Server Name of the computer where you are installing Alert Manager. Select Bring the Alert Manager Server Online to bring this installation of Alert Manager online as a clustered resource. Click Next. 18 Alert Manager software version 4.7.1

19 Removing Alert Manager 7 On the Ready to install dialog box, click Install. 8 When the installation completes, click View Readme to display information about this product release. When finished, close the README file, then click Finish. Figure 2-7. Installation Completed Removing Alert Manager Use one of these methods to remove the Alert Manager program files: Using the Setup utility to remove the product Using the Add/Remove Programs utility to remove the product Product Guide 19

20 Installing Alert Manager Using the Setup utility to remove the product 1 To start the Setup utility, double-click the SETUP.EXE file. Figure 2-8. Uninstall McAfee Alert Manager 2 Click Remove. 3 When the removal process completes, click Finish. Using the Add/Remove Programs utility to remove the product Use the Add/Remove Programs that is included in the Windows Control Panel to remove Alert Manager: 1 Click Start, then select Settings Control Panel Add/Remove Programs. 2 Select the McAfee Alert Manager program from the list of installed programs, then click Remove. 3 Restart your computer after the removal process completes. 20 Alert Manager software version 4.7.1

21 Configuring Alerts 3 Alert Manager controls how to handle alert messages generated by the anti-virus software. Most importantly, Alert Manager can send out alert notifications immediately when viruses are detected on computers in your network. These alerts can be sent using a variety of messaging media, such as , print, and SNMP traps. You can start and configure Alert Manager either through your anti-virus software, for example VirusScan Enterprise, or directly from the Windows desktop. For information on configuring Alert Manager for a specific product, see that product s documentation. These topics are included in this section: Configuring recipients and methods Customizing alert messages Product Guide 21

22 Configuring Alerts Configuring recipients and methods The Alert Manager Configuration component allows you to configure the recipients of alert messages sent out by Alert Manager, and the method by which recipients receive alert messages. Recipients can be addresses or computers on your network. The notification methods can include messages or network messages.to configure the recipients for an alert method: 1 Click Start on the Windows desktop, then select Programs Network Associates Alert Manager Configuration to open the Alert Manager Properties dialog box. Figure 3-1. Alert Manager Properties 2 Select the appropriate tab for a given alert method, such as Logging. 3 Configure the recipients that you want to receive alert notifications using that alert method. 4 Click other tabs to configure recipients for any additional alert methods as required. 5 When finished, click OK to save the configurations and close the Alert Manager Properties dialog box. 22 Alert Manager software version 4.7.1