RSA Event Source Configuration Guide. Microsoft Dynamic Host Configuration Protocol Server

Transcription

1 Configuration Guide Microsoft Dynamic Host Configuration Protocol Server Last Modified: Tuesday, March 11, 2014 Event Source (Device) Product Information Vendor Microsoft Event Source (Device) Dynamic Host Configuration Protocol (DHCP) Server Supported Versions Windows 2000,Windows 2003, Windows 2008, Windows 2012 Additional Downloads sftpagent_conf_msdhcpwin2000.txt sftpagent_conf_msdhcpwin2003.txt sftpagent.conf.msdhcpwin2k8 sftpagent.conf.msdhcpwin2k12 RSA Product Information Supported Version RSA envision 4.0 and 4.1 Event Source (Device) Type msdhcp, 114 Collection Method File Reader Event Source (Device) Class.Subclass Host.Application Servers Content 2.0 Table Application Servers This document contains the following information for the Microsoft Dynamic Host Configuration Protocol (DHCP) Server event source: Configuration Instructions Content 2.0 Release Notes Standard Content Release Notes Microsoft DHCP Server Configuration Instructions You must complete these tasks to configure Microsoft DHCP Server to work with envision: I. Configure Microsoft DHCP server. II. Configure RSA envision to retrieve the log files. III. Set up the NIC File Reader Service. Copyright 2012 EMC Corporation. All Rights Reserved.

2 Configure Microsoft DHCP Server Follow the appropriate instructions for your version of Microsoft DHCP Server. To configure Microsoft DHCP Server 2008 or 2012: 1. Open the Microsoft DHCP Service Manager. 2. In the left-hand pane, double-click the server name. 3. To configure IPv4 properties, double-click IPv4, and follow these steps: a. Right-click IPv4, and select Properties. b. On the General tab, make sure that Enable DHCP audit logging is selected. c. Click the Advanced tab, and take note of the audit log file path. Note: You will need to supply this pathname when you set up the NIC SFTP Agent. d. Click OK. 4. To configure IPv6 properties, double-click IPv6, and follow these steps: a. Right-click IPv6, and select Properties. b. On the General tab, make sure that Enable DHCP audit logging is selected. c. Click on Advanced tab, and take note of the audit log file path. Note: You will need to supply this pathname when you set up the NIC SFTP Agent. d. Click OK. To configure Microsoft DHCP Server 2000 or 2003: 1. Open the Microsoft DHCP Server administration console. 2. In the left-hand pane, right-click the server name, and select Properties. 3. On the General tab, make sure that Enable DHCP audit logging is selected. 4. Click the Advanced tab, and take note of the audit log file path. Note: You will need to supply this pathname when you set up the NIC SFTP Agent. 5. Click OK. 2 Configure Microsoft DHCP Server

3 Configure RSA envision to Retrieve the Log Files Set up the NIC File Reader Service for the event source. For complete instructions, see the envision Help topic "Set Up File Reader Service." To set up the NIC File Reader Service: 1. In envision, add the event source to the NIC File Reader Service. 2. Start the NIC File Reader Service. For instructions, see the envision Help. 3. In envision, set up the FTP server (in multiple appliance sites, the FTP server is on an LC or RC). For instructions, see the envision Help. 4. Install and set up the NIC SFTP Agent on the Microsoft DHCP host that send logs to envision. Choose the appropriate configuration file depending upon your version: For Windows 2000, sftpagent_conf_msdhcpwin2000.txt For Windows 2003, sftpagent_conf_msdhcpwin2003.txt For Windows 2008, sftpagent.conf.msdhcpwin2k8 For Windows 2012, sftpagent.conf.msdhcpwin2k12 Note: The SFTP sample file is available on RSA SecurCare Online (SCOL) and on the RSA envision appliance. For details, see RSA envision NIC SFTP Agent Configuration. For instructions on installing the NIC SFTP Agent, see RSA envision NIC SFTP Agent Configuration, which is available on SecurCare Online. 5. From the Windows Services window, start the NIC SFTP Agent Service. Configure RSA envision to Retrieve the Log Files 3

4 Set Up the NIC File Reader Service For complete information on the NIC File Reader Service and adding an event source to the NIC File Reader Service, see the envision help. To set up the NIC File Reader Service: 1. In envision, click Overview > System Configuration > Services > Device Services > Manage File Reader Service.. 2. Click Add. 3. Complete the following fields. Field Value IP Address Enter the IP address of the Microsoft DHCP server. From the drop-down menu, select Microsoft_DHCP_version, File Reader type where version is the version of Microsoft DHCP. 4. Make sure Start File Reader Service on Apply is cleared. 5. Click Apply. Note: Depending on your version of Microsoft DHCP, log data in the raw log file may start on different lines. Log data in Microsoft DHCP 2003 starts on line 30, and log data in Microsoft DHCP 2008 starts on line 32. If you have log data before these lines, you must configure the file reader. To configure the file reader: 1. Log on to RSA envision with your administrative credentials. 2. Click Overview > System Configuration > Services > Universal Device Collection > Manage File Reader Service. 3. Depending on your version of Microsoft DHCP, click Microsoft DHCP 2003 or Microsoft DHCP 2008 or Microsoft DHCP In the Data start line drop-down list, do one of the following: For Microsoft DHCP 2003, change the value to 30. For Microsoft DHCP 2008, change the value to 32. For Microsoft DHCP 2012: For IPv4, change the value to Click Apply. For IPv6, change the value to Set Up the NIC File Reader Service

5 Content 2.0 Release Notes Microsoft DHCP Server Release Notes ( ) New and Updated Event Messages in Microsoft DHCP Server For complete details on new and updated messages, see the Event Source Update Help. Microsoft DHCP Server Release Notes ( ) What's New in This Release RSA has added support for Microsoft DHCP Windows 2012 Server. New and Updated Event Messages in Microsoft DHCP Server For complete details on new and updated messages, see the Event Source Update Help. Microsoft DHCP Server Release Notes ( ) What's New in This Release RSA updated Microsoft DHCP Server to Content 2.0. This event source uses the Application Servers table. Content 2.0 features new tables and improvements to the parsing of event data into variables in those new tables. For rules and reports, note the following: For factory reports, as existing event sources are converted to Content 2.0, their device-specific reports are updated to work with the new content. In some cases, class-specific reports have replaced device-specific reports. Factory correlated rules have been modified to take advantage of the improved tables, variables and parsing. Custom rules, that involve event sources updated to work with Content 2.0, need to be rewritten. Custom reports may not produce the same results as previously. For guidance on updating custom reports, see the accompanying table documentation and the RSA envision Content Inspection Tool guide. Content 2.0 Release Notes 5

6 Standard Content Release Notes Microsoft DHCP Server Release Notes ( ) What's New in This Release RSA has updated the configuration instructions for this release. 6 Standard Content Release Notes