McAfee Network Threat Response (NTR) 4.0

Transcription

1 McAfee Network Threat Response (NTR) 4.0 Configuring Automated Reporting and Alerting Automated reporting is supported with introduction of NTR 4.0 and designed to send automated reports via existing SMTP mail servers. Optionally, XML reports can be generated and saved locally for processing within other systems. The following tasks describe how to configure flexible reporting templates that instruct NTR on how to generate reports and where to send them. If you do not wish to enable ing of reports, then skip to Configure and Enable Reporting Templates. Note: Completion of the following steps assumes basic familiarity with Linux Operating Systems and the ability to execute basic Unix command line operations. Configure Server Tasks: 1 Logon to the NTR Management Web Console with an administrative account. 2 To perform follow-on steps, click on the Admin Settings icon located at the top of the console. 3 Click Mail Settings from the Admin Settings tab. 4 Change your configuration according to your environment as follows: Server Address: IP or hostname of the outbound SMTP server Port: Port to be used when connecting to the SMTP server

2 Domain: Your local fully qualified domain name BounceBack Address: Return address where delivery problems may be reported From Address: address that should be shown in the from field of mail 5 Click Save. Configure and Enable Reporting Templates YAML ( reporting templates are included as part of the core NTR installation, but additional customer-driven templates are available for download from and each template can be modified based on customer data requirements. Automated reports can be generated in XML and HTML formats and sent to various recipients or ingested by other reporting and analysis systems. Once the configuration templates are in place, activation of the reports and configuration of the SMTP server can be done within the NTR Manager. It is recommended that the recipient address consist of an Distribution List (DL) that can be more easily maintained. Perform the following steps to enable automated report generation. Note: For proper parsing of report templates, it is critical that proper syntax and existing data structures are adhered to. A link to an online YAML syntax tool is provided below. Access to the Internet is assumed for successful completion of those steps. Tasks: 1. Logon to the NTR Manager system (CentOS) with root privileges and browse to the following directory where reporting templates are saved (this is also where new report templates should be saved). /opt/endeavor/amp/amp_ruby/report_templates/ 2. Each report template file that you want to activate must be modified to include proper recipient addresses and output format (XML or HTML). Optionally, the title and description can be updated as well as the trigger that kicks off report generation. The report templates can be updated to reflect specific customer requirements as follows: a. Summary: The report Title and description can be modified by editing the Title: and Description: fields as displayed below:

3 b. Event Triggers: Report creation can be triggered based on a pre-determined schedule or in response to detection of a new Event or Incident. In the example below the - Event: field is set to send reports based upon a schedule outlined in crontab format. Modify the existing - Schedule: field (example below is daily at midnight) with the schedule of your choice. For those unfamiliar w/ crontab, the following online calculator can be used to assist with creating the correct format for your scheduling needs: Note: existing hyphens (-) preceding Event Trigger fields are required. To configure the reporting engine to create reports in response to an Incident, set the - Event: field to New Incident as displayed in the following example: To configure the reporting engine to create reports in response to a new Event, set the - Event: field to Notification and set the - NotificationType field to the type of event you want to trigger on. NotificationType can be any of the following event types: DAT (AntiVirus) ART (File Reputation) MIP (IP Reputation) MHP (Host/URL Reputation) SC (Shellcode) XOR (Encoded File) FM (File Mismatch) CC (Command & Control) The following example is configured to trigger on all event types.

4 While this example will trigger only in response to GTI File reputation events: c. Output: To specify report format, specify HTML or XML for the Format: field. If you ve configured an SMTP server in prior steps and you want to send the report via , delete the # preceding the Destination: field and ensure a valid address or DL is configured for your environment. Alternatively, if you choose to have reports saved locally or to network drive instead of ing, the Output: section can contain fields for specifying the destination folder (Directory:). By default, the filename will match the name of the yml report template file, but the FileNameOptions: field can be used to create unique file names with the following switches: :date insert current date into the file name. :time insert current time into the file name. :id_event_type Depending on the report trigger, insert the name of the id type ( notification_id or incident_id ) into the file name. :event_id Depending on the report trigger, insert the unique ID of the Event or Incident into the file name. In the following example, a file will be created in the local /tmp directory with a name consisting of the yml file name, current date and time, type and corresponding id for all new Incidents:

5 A report template named ESM-Group-local-filesave would result in a report output file name of: ESM-Group-local-filesave_ T11:05: _incident_id_1239.xml d. Sections: Basic report formatting and data querying are handled with the Header, Title and Query fields. A single reporting template can include multiple SQL queries, each of which will be displayed as a simple table of records (HTML) or in XML representation. The Header field supports a configurable header for the entire data section, just below the overall report Title and Description. The Title and Query fields are specific to each data query, allowing for execution of an underlying database (MySQL) query, as well as a configurable data label displayed above each table. The following configuration would result in execution of two database queries with the associated labeling created within the output report. This would result in HTML report formatting similar to this: It is beyond the scope of this document to cover MySQL database queries or the underlying NTR database schema. It is expected that reporting template creators have experience with writing MySQL queries and can interpret the NTR database schema.

6 3. Validate your syntax and Save any changes. The following online YAML syntax tool can be used to validate and optimize proper formatting of the report template: 4. Logon to the NTR Management Web Console with an administrative account and click on the Admin Settings icon located at the top to enable the Administration tab. 5. Select the Reports section and click Restart Reporting to load the new configuration templates (Note: perform this step whenever underlying reporting templates or mailer configuration files are modified). If parsing errors were encountered during processing of the report templates, an error message will be displayed within the Description field of the Reports table as depicted below (Additional logging information can be found within /var/log/delayed_worker.log) on the NTR Manager system. 6. For testing purposes, you can immediately trigger any scheduled report by first clicking the checkbox within the REPORT column and then clicking Trigger Reports. This will also initiate of the report if configured within the reporting template to do so. Reports triggered by Events or new Incidents cannot be generated on-demand, and no checkbox will appear within the REPORT column.