McAfee Enterprise Security Manager 11.1.x Installation Guide

Transcription

1 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

2 COPYRIGHT Copyright 2018 MAfee, LLC TRADEMARK ATTRIBUTIONS MAfee nd the MAfee logo, MAfee Ative Protetion, epoliy Orhestrtor, MAfee epo, MAfee EMM, Foundstone, MAfee LiveSfe, MAfee QuikClen, Sfe Eyes, MAfee SECURE, SeureOS, MAfee Shredder, SiteAdvisor, MAfee Stinger, True Key, TrustedSoure, VirusSn re trdemrks or registered trdemrks of MAfee, LLC or its susidiries in the US nd other ountries. Other mrks nd rnds my e limed s the property of others. LICENSE INFORMATION Liense Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

3 Contents 1 Instlltion overview 5 Whih type of instlltion do you need? First-time instlltion workflow Upgrde workflow Plnning your instlltion 9 Aville system omponents Configurtion senrios Clustering System requirements 15 System requirements Deploy new ESM 17 Supported VM pltforms Deploy VMwre ESXi virtul mhine Deploy MAfee ESM on Linux KVM Deploy MAfee ESM on n AWS VM Crete n AWS VM Downlod the VM imge Instll nd onfigure MAfee ESM on AWS Crete n AWS imge Configure AWS onnetions Deploy MAfee ESM on n AWS HVM Log on to MAfee ESM Add nd onfigure devies 27 Add devies to the devie tree Add devies in FIPS mode Enle ommunition with multiple devies in FIPS mode Chnge devie nmes, links, nd desriptions Configuring reeivers Set up reeiver dt rhiving Set up high vilility reeivers Set up high vilility reeivers with IPv Add reeiver ssets Configure reeivers to rete dt soures utomtilly Configure Enterprise Log Serh (ELS) Configure ELM Set up ELM redundny Set ELM ompression Configure ACE Selet the dt type for orreltion Configure Dt Streming Bus Configure Diret Atthed Storge (DAS) MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 3

4 Contents Configure distriuted ESMs Post-deployment tsks 39 Set up dt storge Set up dt storge Set up VM dt storge Inrese umultor indexes Define dt llotion limits MAfee Enterprise Log Mnger (ELM) Set up MAfee ESM logging Move storge pools Redue storge llotion size Mirroring ELM dt storge Add mirrored ELM dt storge Reuild mirrored storge pools ELM redundny Restore ELM dt Define n lternte storge lotion Migrting the ELM dtse Configure ELM Storge Disle HomeGroup file shring Set up externl dt storge Add iscsi devies Link storge devies to storge pools Formt SAN storge devies Configure Diret Atthed Storge (DAS) Set up virtul lol drive to store dt Configure third prty dt onsumers Work in FIPS mode Chek FIPS integrity Trouleshoot FIPS mode Upgrde to new version of ESM 53 Downlod the upgrde file Bk up the dtse Chek for unusul upgrde senrios nd ddress them Upgrde MAfee ESM on single ESM devie Upgrde MAfee ESM on multiple ESM devies Upgrde MAfee ESM on distriuted ESMs Updte devies Updte peripherl devies Updte peripherl SIEM devies (FIPS mode) Updte HA reeivers Trouleshooting instlltion issues 65 Grnt MAfee ess to your system MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

5 1 1 Instlltion overview Contents Whih type of instlltion do you need? First-time instlltion workflow Upgrde workflow Whih type of instlltion do you need? Determine whih instrutions pply to your instlltion. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 5

6 1 Instlltion overview First-time instlltion workflow First-time instlltion workflow Instll MAfee ESM on virtul mhine. See lso Configurtion senrios on pge 11 Aville system omponents on pge 9 Upgrde workflow Instll new version of MAfee ESM. 6 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

7 Instlltion overview Upgrde workflow 1 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 7

8 1 Instlltion overview Upgrde workflow 8 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

9 2 Plnning 2 your instlltion Contents Aville system omponents Configurtion senrios Aville system omponents MAfee ESM nd its omponents re instlled on your network nd onfigured to identify vulnerilities nd threts. The MAfee ESM devie, reeiver, nd MAfee Enterprise Log Mnger re required. Other devies re optionl ording to usiness needs. MAfee ESM omponents inlude: MAfee Enterprise Seurity Mnger (MAfee ESM) devie Aville s hrdwre omponent or virtul mhine (VM) softwre instlltion, the MAfee ESM devie provides log nlysis, SIEM, nd network nlysis funtions. MAfee Event Reeiver (ERC) Aville s hrdwre omponent or VM softwre instlltion, it ollets 3rd prty logs, events, nd flow dt for orreltion nd nlysis y n ESM devie. MAfee Enterprise Log Mnger (ELM) Aville s hrdwre omponent or VM instlltion, it provides omplint log mngement funtions. Requires MAfee ESM devie nd ERC. ELM n e thought of s "ool" storge. It hshes for forensi integrity nd ompresses for storge effiieny (in smll 2U pkge). It n e serhed, ut only in rre instnes. And it should e the storge of reord whih llows for full log retention. Dt Streming Bus - ingest dt through the dt streming us, sving time nd simplifying dt integrtions with MAfee Behviorl Anlytis nd third-prty produts. Delivered s VM devie. Required for Distriuted ESM nd Dt Shring fetures. MAfee Enterprise Log Serh (ELS) A hrdwre omponent tht ollets, indexes, nd stores ll events to provide proven udit tril of tivity. The ELS serhes events fster thn the MAfee Enterprise Log Mnger euse it uses indexes. ELS n e thought of s fst rw log serh. It llows users to serh for events in ny prt of the log (espeilly those tht re not prsed). It llows the MAfee ESM to filter "less importnt" dt quikly. This inreses MAfee ESM effiieny, performne, nd storge time. ELS typilly stores less thn full retention requirements (3-6 months depending on EPS) sine this dt isn't ompressed, so high EPS environments will quikly reh the high Teryte rnge. MAfee Reeiver/ELM (ELMERC) Aville s hrdwre omponent or VM softwre instlltion tht inludes oth ELM nd ERC. MAfee Advned Correltion Engine (MAfee ACE) Aville s hrdwre omponent or VM softwre instlltion tht provides MAfee RSC nd Enterprise orreltion - identify nd sore thret events in rel time or historil mode, using oth rule- nd risk-sed logi. MAfee Applition Dt Monitor A hrdwre or VM omponent tht monitors more thn 500 known pplitions through the entire lyer stk nd ptures full session detil of ll violtions. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 9

10 2 Plnning your instlltion Aville system omponents MAfee Dtse Event Monitor (DEM) A hrdwre omponent tht utomtes the olletion, mngement, nlysis, visuliztion, nd reporting of dtse ess for most dtse pltforms. MAfee Diret Atthed Storge (DAS) A hrdwre omponent onneted to the ESM, ELM, or ELS to expnd storge spe. In redundnt solutions, one DAS devie is required in eh system. For exmple, two redundnt ELMs require two DAS devies. System digrm (no Dt Streming Bus) System digrm with Dt Streming Bus 10 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

11 Plnning your instlltion Configurtion senrios 2 See lso Configurtion senrios on pge 11 First-time instlltion workflow on pge 6 Configurtion senrios You n onfigure MAfee ESM with one omintion ESM devie, or you n dd omponents to identify threts in lrge enterprise network. Adding omponents to your network environment llows you to inrese performne, dd funtionlity, nd inrese event storge pility. For exmple, dding the following omponents or more dvned models of n existing omponent n sle your network protetion. ESM omintion devies instlled on virtul mhines hve limits to the numer of omponents tht you n dd. Smll-sle ESM solution This figure shows tht one ESM devie gives you visiility to network events. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 11

12 2 Plnning your instlltion Configurtion senrios Lrge-sle ESM solution Multiple ESM devies give you visiility into events on lrge enterprise network. Add ESM devies s the network grows nd the numer of events inreses. 12 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

13 Plnning your instlltion Configurtion senrios 2 See lso First-time instlltion workflow on pge 6 Aville system omponents on pge 9 Clustering Clusters of MAfee ESM devies n e set up to mximize throughput (shrding), to mximize how mny opies of event dt re mintined in the devies (replition), or to tke dvntge of oth of these pilities in hyrid instlltion (oth shrding nd replition). In lustered environment, one node ts s the tive node nd others t s stndy nodes. The tive node performs mngement funtions for the luster. Sling Clustering llows you to sle your system through dt shrding, whih is the ility of eh MAfee ESM devie in luster to query event dt ross ll MAfee ESM devies in tht luster. Shrding enhnes system throughput rtes y using the power of multiple devies to proess event dt. Replition When you use replition, eh devie ts s n individul node of the dtse, llowing you to replite your dt. In lustered environment, you speify whih one you wnt s the tive devie. This devie is the primry point of intertion with the MAfee ESM softwre. The other devies t s stndy devies, whih help lne queries nd ollet dt ut do not perform mngement tsks. You n mnully onfigure ny ESM devie in the luster to e the tive devie. Eh devie stores onfigurtion nd other settings. New event dt is lod lned to eh devie depending on the onfigured replition ftor. The replition ftor determines how mny opies of your dt exist in the luster. Replition mitigtes the onsequenes of devie filure. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 13

14 2 Plnning your instlltion Configurtion senrios Sling nd replition together By using oth sling nd replition, you n uild roust system tht provides fst proessing of events, ensures dt retention, nd provides fult tolerne. 14 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

15 3 System 3 requirements System requirements Mke sure the required network ports re exposed nd hve firewll rules. VM system requirements Proessor 8-ore 64-it, Dul Core2/Nehlem or higher, or AMD Dul Athlon64/Dul Opteron64 or higher RAM 24 GB or more Disk spe Depends on the model (250 GB or more). See the speifitions for your VM produt. All utilized ports 22 - TCP - ll devies Kfk - MAfee Event Reeiver, MAfee ACE, MAfee Applition Dt Monitor, DBM, Dt Streming Bus Snowflex(server) gossip Snowflex - ESMs Snowmn - ESMs EDB Seure - ll devies Snowlient/jd gossip - ESMs Snowlient/jd response - ESMs Ports required for non-lustered environment ehind firewll For non-lustered ESM environments, whether the environment onsists of omintion pplines or disrete pplines, only these need to e open: 22 - TCP - ll devies Kfk - MAfee Event Reeiver, MAfee ACE, MAfee Applition Dt Monitor, DBM, Dt Streming Bus EDB Seure - ll devies MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 15

16 3 System requirements System requirements Ports required for lustered environment ehind firewll For environments where ESMs re lustered nd my ross firewll, these dditionl ports must e open: Snowflex(server) gossip Snowlient/jd gossip - ESMs Snowflex - ESMs Snowlient/jd response - ESMs Snowmn - ESMs Third prty onsumers The Dt Shring nd Messge Forwrding fetures require n open port on the Militrized network mpped to port This enles third prty onsumers to ess Dt Streming Bus puli topis. 16 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

17 4 4 Deploy new ESM Contents Supported VM pltforms Deploy VMwre ESXi virtul mhine Deploy MAfee ESM on Linux KVM Deploy MAfee ESM on n AWS VM Deploy MAfee ESM on n AWS HVM Log on to MAfee ESM Supported VM pltforms MAfee ESM n e deployed on severl VM pltforms. Azure AWS Xen ESXi HVM Deploy VMwre ESXi virtul mhine One you mount nd key VMwre ESXi VM, it mimis physil ESM devie. 1 Aess the root of the CD drive (for CD instlltion) or downlod the ESXi.ov files from the MAfee downlod site. 2 In vsphere Client, lik the server IP ddress in the devie tree. 3 Clik File nd selet Deploy OVF Templte. 4 Designte the nme, the folder to mount the VM, the disk provisioning setting, nd the VM Networking option. 5 Deploy the files to the ESXi server, selet the VM, nd set the Edit Virtul Mhine setting. 6 Selet the orret networking settings for your VMwre ESXi network swithes/dpters, then lik Ply to strt the VM. 7 Using the VM menu, set MGT1 IP ddress, netmsk, gtewy, nd DNS ddresses, then press Es to tivte the menu. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 17

18 4 Deploy new ESM Deploy MAfee ESM on Linux KVM Deploy MAfee ESM on Linux KVM To run MAfee ESM in Linux KVM environment, you must import the hrd drive imge from the trll (.tgz) file. The trll file ontins smple onfig files. 1 Otin the urrent trll (.tgz) file from the MAfee downlod pge. 2 Move the trll file to the diretory where you wnt the virtul hrd drive to reside. 3 Extrt the trll y running this ommnd: tr xf MAfee_ETM_VM4_250.tgz To deploy multiple VMs of the sme type in the sme lotion, hnge the nme of the virtul hrd drive. ERC-VM4-disk-1.rw, ERC-VM4-disk-2.rw to, for exmple, my_first_er.rw, my_seond_er.rw. 4 Crete VM on your KVM hypervisor using: (livirt, qemu-kvm, proxmox, virt-mnger, ovirt) 5 Point the VM imge to the existing virtul hrd drive (Virtio disk.rw file) where you extrted the trll. Deploy MAfee ESM on n AWS VM Contents Crete n AWS VM Downlod the VM imge Instll nd onfigure MAfee ESM on AWS Crete n AWS imge Configure AWS onnetions Crete n AWS VM Contents Crete n AWS server Configure the VM network interfe Key the VM devie Crete n AWS server Crete the AWS server with the proper settings nd rete onnetion to your enterprise network. Before you egin You must hve n Amzon We Servies ount. This proedure, nd the seleted vlues, desrie reting simple VM. The vlues you selet might e different. 18 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

19 Deploy new ESM Deploy MAfee ESM on n AWS VM 4 1 Log on to the AWS onsole to disply the AWS Console pge. 2 Set the AWS dt enter region to the lotion losest to most of your networks. 3 Under Compute, doule-lik EC2 (Amzon Elsti Compute Cloud) to open Step 1: Choose n Amzon Mhine Imge (AMI), nd selet the server instne Amzon Linux AMI. This type hs the AWS/EC2 tools preinstlled. If you hoose other Linux types, you hve to instll the AWS/EC2 tools. 4 Open Step 2: Choose n Instne Type, selet m3.2xlrge or lrger, then lik Next: Configure Instne Detils. When hoosing the Instne Type, selet the orret CPU ount nd the orret instne type. If you're unsure, ontt Support. 5 Selet the network to use while running your instne. Mke sure you re le to onnet to your instne using: Puli ddress Privte ddress You n rete your own Virtul Privte Cloud in AWS. For more informtion, see VPC in Servies from the drop-down list. 6 Clik Next: Add Storge to open Step 4: Add Storge pge. Leve the defults seleted for the Amzon "uild" instne. The defult for MAfee devies is 250 GB. You n dd more volumes if you need them. 7 Clik Next: Tg Instne to open Step 5: Tg Instne pge. Type nme so you n find the instne under the Vlue olumn. 8 Clik Next: Configure Seurity Group to open Step 6: Configure Seurity Group pge, then selet one: Crete new seurity group A new seurity group limits who n log on to the instne. Add your externl-fing IP ddress rnge. Selet existing seurity group. 9 Clik Review nd Lunh to open Step 7: Review Lunh Instne, then lik Lunh. Disregrd this wrning tht ppers: Your instne onfigurtion is not eligile for the free usge tier. 10 Selet n existing key pir or rete new key pir, whih you need to log on to your new instne. 11 Clik Lunh Instne nd View Instnes to onfirm the sttus of the AWS server. It might tke minutes efore your instne is redy to ess. When the Sttus Cheks olumn next to your new instne displys 2/2 heks, you re redy to strt the instlltion proess. 12 Mke note of the puli IP ddress. Shown in this exmple s:.dd.ee.ff. This IP ddress is needed to trnsfer the instller to the instne nd to log on. You hve reted your AWS server. Continue with the AWS imge retion nd instlltion proess. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 19

20 4 Deploy new ESM Deploy MAfee ESM on n AWS VM See lso Instll nd onfigure MAfee ESM on AWS on pge 21 Configure AWS onnetions on pge 24 Crete n AWS imge on pge 22 Configure the VM network interfe Set up ommunition etween the VM nd MAfee ESM. 1 Connet monitor nd keyord to the devie nd power it on. The oot proess tkes out two minutes, nd virtul LCD disply ppers. 2 Press Es twie, then sroll down to MGT IP Conf nd press Enter. 3 Set the ESM VM IP ddress. Sroll to Mgt1 nd press Enter. Sroll to IP Address nd press Enter. Use the rrows to hnge the vlue of the urrent digit nd to swith etween digits, then when done, press Enter. 4 Set the IP netmsk ddress. Sroll to Netmsk nd press Enter. Use the rrows to hnge the vlue of the urrent digit nd to swith etween digits, then when done, press Enter. 5 Set the network gtewy IP ddress. Sroll to Gtewy IP nd press Enter. Use the rrows to hnge the vlue of the urrent digit nd to swith etween digits, then when done, press Enter. 6 Set the DNS IP ddress. Sroll to DNS1 IP nd press Enter. Use the rrows to hnge the vlue of the urrent digit nd to swith etween digits, then when done, press Enter. 7 Configure DHCP. Sroll to DHCP nd press Enter. Toggle the setting etween Y(es) nd N(o), then press Enter to selet the orret setting. 20 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

21 Deploy new ESM Deploy MAfee ESM on n AWS VM 4 8 Quit nd sve your hnges. Sroll to Done nd press Enter to return to MGT IP Conf. Sroll to Sve Chnges nd press Enter. 9 (Optionl) If you re using FIPS mode, hnge the ommunition port. Press the down rrow twie, then press Enter. Sroll to Comm Port nd press Enter. Chnge the port numer, then press Enter. Mke note of the new port numer; you will need it when you key the devie. Key the VM devie You must key the devie to estlish link etween the VM nd the ESM. Before you egin The devie must e physilly onneted to your network. 1 On the system nvigtion tree, lik the system or group, then lik the Add Devie ion pne. in the tions 2 Enter the informtion requested on eh pge of the Add Devie Wizrd. Downlod the VM imge Get the VM imge file from the MAfee downlod site. Before you egin You must hve your MAfee Grnt Numer to downlod the ESM VM imge. 1 Use your rowser to ess the MAfee downlod site. 2 Clik Downlods, type your MAfee Grnt Numer nd the CAPTCHA ode, then lik Sumit. 3 On the My Produts pge, sroll down the list nd selet MAfee Enterprise Seurity Mnger VM** downlod file. The numer in the downlod file nme indites the numer of ores the ESM imge llotes to the VM. For exmple, file "VM32" llotes 32 ores to the VM. 4 Selet the Current Version t nd selet the MAfee Enterprise Seurity Mnger VM imge. 5 Selet n imge file nd sve it to your lol system. Mke note of the file nme nd lotion; you will need tht informtion to mount the imge. Instll nd onfigure MAfee ESM on AWS An Amzon We Servies (AWS) virtul server provides the sme fetures nd performne s lolly onfigured MAfee ESM VM. The si steps to rete n AWS server in your network with MAfee ESM inlude: MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 21

22 4 Deploy new ESM Deploy MAfee ESM on n AWS VM 1 Get n AWS ount from 2 Log on to the AWS Mngement Console nd onfigure your AWS instne. 3 Instll the devies. 4 Configure the devies. See lso Configure AWS onnetions on pge 24 Crete n AWS imge on pge 22 Crete n AWS server on pge 18 Crete n AWS imge Instll ESM on n AWS server. Before you egin You must hve n AWS server onneted to the server. You must know the IP ddress of the AWS server. 1 Use sp or psp (PuTTY Seure Copy Client) to onvert the.pem file to.ppk. For exmple, using Seure Copy Client, use this ommnd to onvert the key file nd trnsfer it to the new AWS instne: sp -i mykeypir.pem siem_instll.sh e2-user@.dd.ee.ff: Using PuTTY Seure Copy Client, use this ommnd to onvert the file: psp -i mykeypir.pem siem_instll.sh e2-user@.dd.ee.ff>: These re the vriles in the previous exmples: siem_instll.sh Conversion file nme e2-user User nme.dd.ee.ff IP ddress For Windows, use WinSCP to opy the file to your instne y onverting the.pem file to.ppk for PuTTY or WinSCP. 2 Log on to the new AWS instne using SSH or PuTTY with this ommnd: ssh -i mykeypir.pem e2-user@.dd.ee.ff These re the vriles in the exmple: mykeypir.pem Convert SSH file nme e2-user User nme.dd.ee.ff IP ddress 3 Type this ommnd to hnge to root, then press Enter: sudo su 22 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

23 Deploy new ESM Deploy MAfee ESM on n AWS VM 4 4 Run ws onfigure s root nd provide the Aess Key ID nd Seret Aess Key tht you were given, using these ommnds: [root@<ip ddress> <e2-user nme>]# ws onfigure AWS Aess Key ID [None]: <Aess Key ID> AWS Seret Aess Key [None]: <Seret Aess Key> Defult region nme [None]: (Leve lnk, nd press Enter) Defult output formt [None] (Leve lnk, nd press Enter) 5 Confirm tht the instlltion sript is exeutle. If needed, use hmod. For exmple: hmod u+x siem_instll.sh 6 Crete n AMI imge nd n instne with this ommnd:./siem_instll.sh If you see n error tht sys the keys were not defined, you n dd the keys on the ommnd line. For exmple: [root@ip e2-user]#./instll_mafee_etm_vm8.sh The AWS ess key or the AWS Seret key were not defined [root@ip e2-user]#./instll_mafee_eru_vm8.sh -O <Aess Key ID> -W <Seret Aess Key> To ess Help for the output options: [root@ip e2-user]#./instll_mafee_etm_vm8.sh -h instll_mafee_etm_vm8.sh - instll SIEM to Amzon EC2 instll_mafee_etm_vm8.sh [options] options: -h, --help show rief help -O AWS key -W AWS Seret Key Creting the AMI imge tkes out 20 minutes nd is non-intertive. This is n exmple of the output: [root@ip e2-user]#./instll_mafee_etm_vm8.sh Deompressing files Running instller Creting volume Atthing volume formtting volume 1+0 reords in 1+0 reords out ytes (4.2 MB) opied, s, 89.8 MB/s mke2fs (28-De-2013) mke2fs (28-De-2013) mounting min prtition opying min files mounting oot prtition opying oot files Updting fst Updting gru unmounting oot prtition unmounting min prtition dething volume Creting snpshot (this will tke while) Creting AMI Creted AMI "mi-8f81". To run, lunh n instne of this AMI Deleting (temporry) volume Client.InvlidVolume.NotFound: The volume 'vol-9e2e81' does not exist. Done 7 One the imge is reted, exit from the root shell, exit the instne, go to the EC2 Dshord, nd terminte the running instne. Terminting the instne destroys the instne. Now you n log on to the ESM. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 23

24 4 Deploy new ESM Deploy MAfee ESM on n AWS HVM See lso Instll nd onfigure MAfee ESM on AWS on pge 21 Crete n AWS server on pge 18 Configure AWS onnetions on pge 24 Configure AWS onnetions Connet nd dd devies to n AWS ESM devie. Before you egin You must hve n AWS VM with MAfee ESM instlled. You must verify the hsh with MAfee. 1 Use your IP ddress to log on to the ESM. 2 Connet oth physil nd virtul devies to the ESM devie. 3 Confirm tht ll devies pper in MAfee ESM efore onfiguring the devies. 4 Key the devies to omplete the devie onfigurtion. See lso Instll nd onfigure MAfee ESM on AWS on pge 21 Crete n AWS server on pge 18 Crete n AWS imge on pge 22 Deploy MAfee ESM on n AWS HVM MAfee ESM is instlled on AWS HVM using sripts. The SIEM Amzon EC2 instller sripts rete Amzon Mhine Imges (AMIs) from whih you n lunh VM instnes of devies. Before you egin Mke sure you hve n instller sript for eh devie type (MAfee ESM, MAfee Event Reeiver, MAfee ACE, nd so on) you wnt to instll. 1 On the Amzon EC2 dshord, selet Instnes in the left menu r nd lik Lunh Instne. 2 Selet Amzon Linux AMI. 3 On the Choose Instne Type sreen, hoose m3.medium or m4.lrge nd lik Next. 4 On the Configure Instne Detils sreen, lik Next. 5 On the Add Storge sreen, lik Next. 6 On the Add Tgs sreen, lik Next. 7 On the Configure Seurity Group sreen, selet Crete or selet seurity group tht llows you to hve SSH ess to the instne. 8 Clik Review And Lunh. 24 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

25 Deploy new ESM Log on to MAfee ESM 4 9 Clik Lunh. 10 Selet key pir tht you hve ess to nd lik Lunh Instnes. 11 Copy the instller sript to the VM: sp -i ~/my_key.pem instll_hvm_etm_16.sh e2-user@instne_ip_ddress: 12 Type these ommnds to log on, eome root, nd onfigure AWS:. ssh -i ~/my_key.pem e2-user@instne_ip_ddress sudo su ws onfigure 13 Enter the AWS Aess Key nd AWS Seret Key.. 14 At the ommnd prompt, type #./instll_hvm_e_16.sh. When the instller sript finishes (15 20 minutes), new AMI is registered in your AWS ount. You n use this AMI to lunh VM. The Amzon Linux instne tht ws used to run the instller is no longer needed nd n e terminted. Log on to MAfee ESM Log on the onsole to egin onfiguring the ESM devie settings. Before you egin Verify whether you re required to operte the system in FIPS mode. Verify whether you re required to operte the system in FIPS mode. Cler your rowser he to prevent login issues. 1 Open we rowser nd go to the IP ddress you set when you onfigured the network interfe. 2 Clik Continue to site, if self-signed ertifite error ppers for your rowser. 3 Clik Login, selet the lnguge for the onsole, then type the defult user nme nd pssword. Defult user nme: NGCP Defult pssword: seurity.4u 4 Clik Login, red the End User Liense Agreement, then lik Aept. 5 When prompted, hnge your user nme nd pssword, then lik OK. 6 Selet whether to enle FIPS mode nd if you lik Yes, lik the dditionl onfirmtion. If you must work in FIPS mode, enle it the first time you log on so tht ll future ommunition with MAfee devies is in FIPS mode. Do not enle FIPS mode if you re not required to. 7 For Rules Updte Aess, lik OK nd follow the instrutions tht pper to otin your user nme nd pssword, whih re needed for ess to rule updtes. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 25

26 4 Deploy new ESM Log on to MAfee ESM 26 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

27 5 5 Add nd onfigure devies Contents Add devies to the devie tree Add devies in FIPS mode Chnge devie nmes, links, nd desriptions Configuring reeivers Configure Enterprise Log Serh (ELS) Configure ELM Configure ACE Configure Dt Streming Bus Configure Diret Atthed Storge (DAS) Configure distriuted ESMs Add devies to the devie tree After you set up nd instll the physil nd virtul devies, dd them to the MAfee ESM onsole. Before you egin Mke sure the devies re instlled ording to the hrdwre guide (for hrdwre) or instlltion guide (for virtul devies). Complete the following steps only for omplex MAfee ESM instlltion with multiple devies. Do not omplete this tsk for simple MAfee ESM instlltion using omintion of devies. 1 On the system nvigtion tree, lik Lol ESM or group. 2 Clik. 3 Selet the type of devie you re dding, then lik Next. 4 In the Devie Nme field, enter unique nme in this group. These # $ % ^ & * ) ( ] [ } { : ; " ' > < >, /? ` ~ + = \ nd re invlid in devie nmes. 5 Clik Next. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 27

28 5 Add nd onfigure devies Add devies in FIPS mode 6 Provide the informtion requested: For MAfee epo devies Selet reeiver, type the redentils required to log on to the we interfe, then lik Next. To use for ommuniting with the dtse, type the settings. Selet Require user uthentition to limit ess to those users who hve the user nme nd pssword for the devie. For ll other devies Type the trget IP ddress or URL for the devie. 7 Selet whether to use Network Time Protool (NTP) settings on the devie, then lik Next. 8 Enter pssword for this devie, then lik Next. MAfee ESM tests devie ommunition nd reports on the sttus of the onnetion. Add devies in FIPS mode Two methods in FIPS mode enle you to dd devie tht hs lredy een keyed to n ESM devie. The terms nd file extensions listed here might e useful s you follow these proesses. Terminology Devie key Defines the mngement rights tht MAfee ESM hs for devie, nd is not used for rypto. Puli key The ESM puli SSH ommunition key, whih is stored in the uthorized keys tle of devie. Privte key The ESM privte SSH ommunition key, whih is used y the SSH exeutle on n ESM to estlish the SSH onnetion with devie. Primry ESM The ESM devie tht ws originlly used to register the devie. Seondry ESM The dditionl ESM devie tht ommunites with the devie. File extensions for the different export files.exk Contins the devie key..puk Contins the puli key..prk Contins the privte key nd the devie key. Enle ommunition with multiple devies in FIPS mode You n llow multiple ESM devies to ommunite with the sme SIEM devie y exporting nd importing.puk files. The primry ESM devie is used to import the seondry ESM devie exported.puk file nd send the seondry ESM puli key to the peripherl devie, thus llowing oth ESM devies to ommunite with the devie. 1 Export the.puk file from the seondry ESM. On the System Properties pge of the seondry ESM, selet ESM Mngement. Clik Export SSH, then selet the lotion to sve the.puk file. Clik Sve, then log off. 28 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

29 Add nd onfigure devies Chnge devie nmes, links, nd desriptions 5 2 Import the.puk file to the primry ESM. In the system nvigtion tree of the primry ESM, selet the devie you wnt to onfigure. d e Clik the Properties ion, then selet Key Mngement. Clik Mnge SSH Keys. Clik Import, selet the.puk file, then lik Uplod. Clik OK, then log off of the primry ESM. Chnge devie nmes, links, nd desriptions When you dd devie to the System Tree, give it nme tht displys on the tree. You n hnge the devie nme, system nme, URL, nd desription. 1 From the MAfee ESM dshord, lik nd selet Configurtion. 2 On the system nvigtion tree, selet the devie, then lik the Properties ion. 3 Clik Nme nd Desription to hnge the nme, system nme, URL, nd desription, or view the Devie ID numer. Configuring reeivers The MAfee Event Reeiver enles the olletion of seurity events nd network flow dt from multi-vendor soures inluding firewlls, virtul privte networks (VPNs), routers, NetFlow, sflow, nd others. Reeivers ollet nd normlize event nd flow dt into single mngele solution, providing single view ross multiple vendors. High vilility reeivers (Reeiver-HA) n e used in primry nd seondry mode, ting s kups for eh other. The seondry reeiver (B) monitors the primry reeiver (A) ontinuously nd new onfigurtion or poliy informtion is sent to oth devies. When reeiver B determines tht reeiver A hs filed, it disonnets reeiver A's dt soure NIC from the network nd tkes over s the primry. It remins primry until you mnully restore reeiver A s primry. Set up reeiver dt rhiving Configure the reeiver to forwrd kup of the rw dt to your storge devie for long-term storge. Before you egin Port 445 must e opened on the system with the CIFS shre to enle CIFS shre onnetion. Port 135 must e opened on the system with the SMB shre to enle n SMB onnetion. MAfee ESM supports the following types of storge: Server Messge Blok/Common Internet File System (SMB/ CIFS), Network File System (NFS), nd Syslog Forwrding. SMB/CIFS nd NFS store, in the form of dt files, kup of ll rw dt sent to the reeiver y dt soures tht use the emil, estrem, http, SNMP, SQL, syslog, nd remote gent protools. The system sends these dt files to the rhive every 5 minutes. Syslog Forwrding sends rw dt for syslog protools s ontinuous MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 29

30 5 Add nd onfigure devies Configuring reeivers strem of omined syslogs to the devie. Syslog forwrding supports only UDP pkets. The reeiver n forwrd to only one type of storge t time; you n onfigure ll three types, ut only one type n e enled to rhive dt. This feture doesn't support NetFlow, sflow, nd IPFIX dt soure types. 1 From the MAfee ESM dshord, lik nd selet Configurtion. 2 On the system nvigtion tree, selet the devie, then lik the Properties ion. 3 Clik Reeiver Configurtion Dt Arhivl. 4 Selet shre type nd enter the onnetion onfigurtion informtion. SMB/CIFS Shre type - sets the shre type to SMB or CIFS. IP ddress - the IP ddress of the shre. Shre Nme - The lel pplied to the shre. Pth - The sudiretory on the shre where the rhived dt must e stored (for exmple, TMP/ Storge). If storge is in the root diretory of the shre, no pth is required. User Nme nd Pssword - The redentils required to onnet to the shre. Do not use omms in the pssword when onneting to n SMB/CIFS shre. NFS IP ddress - the IP ddress of the shre. Mount Point - Nme of the mount point on the shre. Pth - The sudiretory on the shre where the rhived dt must e stored (for exmple, TMP/ Storge). If storge is in the root diretory of the shre, no pth is required. Syslog Forwrding IP ddress - the IP ddress of the shre. Port - the port used to rhive dt. Set up high vilility reeivers Define the settings for high vilility reeivers. Add the reeiver tht serves s the primry devie, whih must hve three or more NICS. If you re required to omply with FIPS regultions, do not use this feture. High vilility Reeivers re not FIPS-omplint. 1 On the system nvigtion tree, selet the reeiver tht is the primry high vilility devie, then lik the Properties ion. 2 Clik Reeiver Configurtion, then lik Interfe. 3 Clik the HA Reeiver t, then selet Setup High Avilility. 4 Fill in the informtion requested, then lik OK. 30 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

31 Add nd onfigure devies Configuring reeivers 5 The proess tht keys the seond reeiver updtes the dtse, pplies glols.onf, nd syns the two reeivers. Set up high vilility reeivers with IPv6 Set up high vilility with IPV6 euse you n't set the IPv6 ddress mnully using the LCD. Before you egin Ensure tht MAfee ESM uses IPv6, mnully or utomtilly (System Properties Network settings). Mke sure you hve the shred IP ddress, whih the network dministrtor retes. 1 On the two reeivers in the high vilility pir: Turn on the reeiver, then enle IPv6 using the LCD. Nvigte to Mgt IP Configr Mgt1 IPv6, nd write down the mngement IP ddress. This might tke some time due to network lteny. 2 Add one of these reeivers to MAfee ESM. Nme Nme of the high vilility pir. Trget IP Address or URL Mngement IPv6 ddress for this high vilility reeiver, whih you wrote down. 3 Selet the newly dded devie on the system nvigtion tree, then lik Reeiver Properties Reeiver Configurtion Interfe. 4 In the IPv6 Mode field, selet Mnul (the only supported mode for high vilility). 5 Clik Setup next to the numer 1 interfe, type the shred IP ddress in the IPv6 field, then lik OK. This ddress is ssigned to the shred interfe during high vilility setup. If this isn't done, high vilility doesn't fil over properly. 6 On Reeiver Properties, lik Connetion, enter the shred IPv6 ddress in Trget IP Address/Nme, then lik OK. 7 Continue with the HA setup proess. Add reeiver ssets An sset is ny devie on the network with n IP ddress. The Asset Mnger llows you to rete ssets, hnge their tgs, rete sset groups, dd sset soures, nd ssign ssets to groups. An ESM devie n hve only one sset soure. Reeivers n hve multiple sset soures. If two sset disovery soures find the sme sset, the disovery method with the highest priority dds the sset it disovered to the tle. If two disovery soures hve the sme priority, the lst one tht disovers the sset tkes priority over the first. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 31

32 5 Add nd onfigure devies Configuring reeivers 1 On the system nvigtion tree, selet Reeiver Properties, then lik Asset Soures. 2 Clik Add, then onfigure the sset. Selet Enled to enle the utomti retrievl funtionlity. If the hekox is not seleted, you n still retrieve dt from the sset soure mnully y liking Retrieve. If it is seleted, the system retrieves the dt t the intervl speified in the Retrieve Dt field. Selet the Type of sset soure. The remining fields vry sed on the type you selet. d e f g h i j k l Type Nme for this sset soure. (Optionl) Selet zone for this sset soure. Selet the priority tht you wnt this sset soure to hve if it disovers n sset t the sme time s vulnerility ssessment or network disovery. The options re 1 5, 1 eing the highest. Type the IP ddress nd port for your sset soure. Selet if you wnt to use the TLS enryption protool (for Ative Diretory) or SSL (for Altiris). Type the User Nme nd Pssword required to ess the sset. Type the proper nme for the domin ontroller (for exmple, d=mafee,d=om). (Altiris only) If you wnt to enle the proxy server, selet Enle, nd enter the proxy IP ddress, port, nd redentils. If you wnt to retrieve dt utomtilly, selet how often to retrieve. To test the onnetion, lik Connet. 3 Clik OK, then lik Write on Asset Soures. Configure reeivers to rete dt soures utomtilly Set up reeivers to rete dt soures utomtilly, using the stndrd rules tht ome with the reeiver or rules tht you rete. 1 Clik the Get Events nd Flows ion on the tions toolr to pull events or flows. 2 From the MAfee ESM dshord, lik nd selet Configurtion. 3 On the system nvigtion tree, selet the reeiver, then lik the Properties ion. 4 On the Reeiver Properties pge, lik Dt Soures Auto Lern. 5 On the Auto Lern pge, lik Configure. 6 On the Auto Add Rule Editor pge, ensure tht Enle uto retion of dt soures. 7 Clik Add, then selet the uto dd rules you wnt the reeiver to use to rete dt soures utomtilly. 8 To pply seleted rules to the existing uto lerned dt, lik Run Now. 32 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

33 Add nd onfigure devies Configuring reeivers 5 s Set up dt soure uto-lerning on pge 33 Set up MAfee ESM Reeivers to lern dt soure IP ddresses utomtilly. Set up dt soure uto-lerning Set up MAfee ESM Reeivers to lern dt soure IP ddresses utomtilly. Before you egin Define ports for Syslog, MEF, nd flows. Reeiver ports must mth the soures tht re sending dt or uto lerning does not hppen. The firewll on the Reeiver opens for the time you designte, so the system n lern set of unknown IP ddresses. You n then dd to the system s dt soures. Updting MAfee ESM deletes uto-lerning results. Run uto-lerning fter updting to ollet uto-lerning results gin. 1 From the MAfee ESM dshord, lik nd selet Configurtion. 2 On the system nvigtion tree, selet the Reeiver, then lik the Properties ion. 3 On the Reeiver Properties pge, lik Dt Soures Auto Lern. 4 Configure the uto-lerning settings. Selet the length of time you wnt uto-lerning to our in the pproprite hours field, then lik Enle. When using uto-lerning for MEF, you n't dd dt soures tht re uto-lerned using host ID. When the time expires, the system disles uto-lerning nd popultes the tle with found IP ddresses. Clik Disle to stop uto lerning. 5 Add uto-lerned IP ddresses s dt soures. Selet IP ddresses of the sme type s those you wnt to dd, then lik Add. On the Auto-Lerned Soures pge, selet one of the options. If the seleted IP ddresses do not hve n ssoited nme, the system sks whether to dd prefix to the seleted ddresses. If you lik No, the IP ddresses re used s the nmes for these dt soures. If you lik Yes, enter prefix nme nd lik OK. The nmes of these dt soures inlude oth the nme you dded nd the IP ddress. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 33

34 5 Add nd onfigure devies Configure Enterprise Log Serh (ELS) If the seleted IP ddresses hve nmes, the system dds dt soures to the list. Client mth on type - If n existing dt soure mthes the seleted IP ddress, the system dds items to the dt soure s mth-y-type lient dt soures. If dt soure mthing the seleted IP ddress doesn't exist, one is reted. The remining items re dded to it s mth-y-type lient dt soures. Client mth on IP - Allows you to selet the dt soure to whih you wnt to dd this IP ddress s lient. Mthing dt soures re listed. If there ren't ny, the only option ville is None - rete new dt soure. Selet the dt soure you wnt to dd this IP ddress to s lient, then lik OK. 6 To hnge the nme of dt soure, lik Edit Nme. Use mximum of 50 hrters nd mke sure the nme hs not lredy een ssigned to dt soure on the list. 7 To hnge the type of the seleted IP ddress, lik Chnge Type. Chnge the type if the type suggested y the system is wrong. Viewing the pket n help you determine the orret type. Configure Enterprise Log Serh (ELS) To serh ELS dt, dd ELS devies to the onsole, set up ELS storge nd retention poliies, nd ssoite dt soures with speifi retention poliies. Before you egin Set up nd instll virtul or physil devies. 1 From the dshord, lik, then lik Configurtion. 2 Add ELS devies to the onsole. On the tions toolr, lik, then selet MAfee Enterprise Log Serh. Clik Next. d Enter unique Devie Nme, then lik Next. Enter the trget IP ddress or URL, trget SSH port numer, nd Network Time Protool (NTP) settings for the devie. Clik Next. Enter pssword for this devie, then lik Next. 3 Set up storge. Retining unompressed dt speeds the ELS serh pilities. But, it requires dditionl storge spe, suh s hrd drives or network storge. Selet ELS, lik, then lik Dt Storge. d If using iscsi, DAS, SAN, or virtul lol drives, fill in the informtion in the top grid. If using SAN, virtul lol, NFS, iscsi, or CIFS, lik Add in the lower grid. Enter the orret prmeters nd lik OK. 34 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

35 Add nd onfigure devies Configure ELM 5 4 Add retention poliies (limited to no more thn six). To serh ELS log dt, you must hve t lest one retention poliy. The system sets the first retention poliy reted s the defult. If only one poliy exists, you n hnge it ut you nnot delete it. The ELS nnot ept dt older thn six months efore when you rete the first retention poliy. Selet ELS, lik Clik Add., then lik Retention Poliies. Speify the nme nd durtion of the retention poliy nd lik OK. The system stores durtion in dys. You n set up durtion in yers (365 dys), qurters (90 dys), or months (30 dys). 5 Assoite dt soures with retention poliies. Selet the dt soure devie (suh s MAfee Event Reeiver) nd lik. d Clik Dt Soures. In the Logging olumn, hoose the relevnt hekox to disply the Log Dt Options sreen. Selet the retention poliy you wnt to ssoite with this dt soure nd lik OK. Configure ELM Contents Set up ELM redundny Set ELM ompression Set up ELM redundny If you hve stndlone ELM devie on your system, you n provide redundny for logging y dding stndy ELM. Before you egin Instll stndlone ELM nd dd it to MAfee ESM. You must hve stndy ELM instlled ut not dded to the onsole. Ensure tht there is no dt on the stndy ELM. Contt Support if you need to perform ftory reset. 1 On the system nvigtion tree, lik the ELM, then lik the Properties ion. 2 On the ELM Properties pge, lik ELM Redundny, then lik Enle. 3 Type the IP ddress nd pssword for the stndy ELM, then lik OK. 4 On the ELM Properties pge, lik Storge Pools, nd verify tht the Ative t is seleted. 5 Add storge devies to the tive ELM. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 35

36 5 Add nd onfigure devies Configure ELM 6 Clik the Stndy t, then dd storge devies tht hve enough omined spe to mth the storge on the tive ELM. 7 Add one or more storge pools to eh ELM. The onfigurtion on oth ELMs is now synhronized nd the stndy ELM mintins the synhroniztion of dt etween oth devies. Option Definition Aville only when ELM redundny is not enled. Enle Clik, then dd stndy ELM dt to tivte ELM redundny. Aville only when ELM redundny is enled. Remove Swith ELMs Suspend Sttus Return to servie Clik to disle redundny on the ELM. Clik to swith the ELMs so the stndy ELM eomes the primry ELM. The system ssoites ll logging devies to it. Logging nd onfigurtion tions re loked during the swith-over proess. Clik to suspend ommunition with the stndy ELM if it is experiening prolems. All ommunition stops nd error notifitions for redundny re msked. When you ring the stndy ELM k up, lik Return to Servie. Clik to view detils out the stte of dt synhroniztion etween the tive nd stndy ELM. Clik to return repired or repled stndy ELM to servie. If the system rings the ELM k up nd detets no hnges to the onfigurtion files, redundny ontinues s efore. If the system does detet differenes, the redundny proess ontinues for the storge pools without prolems, nd you re informed tht one or more pools re out of onfigurtion. Fix these pools mnully. If you reple or reonfigure the stndy ELM, the system detets it nd prompts you to rekey it. The tive ELM then syns ll onfigurtion files to the stndy ELM nd the redundny proess ontinues s efore. Set ELM ompression Selet the ompression level for the dt oming into the ELM to sve disk spe or proess more logs. Setting the ompression rtio higher thn the defult (14:1) my result in dt loss. 1 On the system nvigtion tree, selet ELM Properties, then lik ELM Configurtion Compression. 2 Selet the ELM ompression level, then lik OK. 36 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

37 Add nd onfigure devies Configure ACE 5 Configure ACE Selet the dt type for orreltion MAfee ESM ollets oth event nd flow dt. Selet whih dt to send to the MAfee Advned Correltion Engine (ACE). Defult is event dt only. 1 On the system nvigtion tree, selet ACE Properties, then lik ACE Configurtion. 2 Clik Dt, then selet Event Dt, Flow Dt, or oth. 3 Clik OK. Configure Dt Streming Bus Set up virtul devie to filitte ommunition etween devies, to shre rw dt with third-prty pplitions, nd to shre prsed dt etween ESMs in distriuted/hierrhil onfigurtions. Before you egin Set up the MAfee ESM devie nd note the IP ddress nd pssword. 1 From the MAfee ESM dshord, lik nd selet Dt Streming Bus. 2 Clik +Add. You n dd only one Dt Streming Bus devie. 3 Right-lik on the devie nd selet Settings to dd or hnge the devie informtion (suh s desription, key mngement, network interfe, onnetion, nd mngement). 4 Connet the Dt Streming Bus to other MAfee ESM devies. Selet the Dt Streming Bus. Clik Connet Devie to see ville MAfee ESM devies. Selet devie nd lik Sve. Filter the devie list y typing serh terms in the serh ox. See lso Upgrde MAfee ESM on distriuted ESMs on pge 58 Configure Diret Atthed Storge (DAS) Before you egin Set up DAS devies to store dt from n ESM devie. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 37

38 5 Add nd onfigure devies Configure distriuted ESMs 1 On the system nvigtion tree, selet the MAfee ESM devie then lik Properties. 2 Clik Dtse nd lik Dt Storge. 3 On the tle, lik one of the devies tht hs not een ssigned to store MAfee ESM dt. 4 Clik Assign nd lik Yes. One you ssign devie, you n't hnge it. Configure distriuted ESMs Configure hild ESM to shre filtered suset of its dt with prent ESM. Before you egin Your environment must inlude two ESMs eh with Dt Streming Bus. Configure the MAfee Event Reeiver on the hild ESM to send dt to the Dt Streming Bus. 1 On the prent ESM, dd the hild. Clik Add Devie. d e f Selet Distriuted ESM. Type nme for the hild ESM. Enter the IP ddress of the hild ESM. In the Dt Reeiving Devie field, selet the Dt Streming Bus on the prent ESM. Type the user nme nd pssword for the hild ESM nd lik Next. The prent estlishes ommunition with the hild nd syns devies nd dt soures. 2 On the prent ESM, selet the hild ESM from the devie tree. 3 Crete filter (ESM Properties Filters). To forwrd ll events, you n rete simple filter suh s Severity=>1. 4 Log out of the hild ESM nd log k in. A pop-up sks you to pprove the distriuted reltionship. 5 Clik Approve. 6 In Hierrhil ESMs, selet Approve for the prent ESM. The hild ESM egins forwrding dt to the prent ESM. It my tke few minutes for dt from the hild to pper in the prent dshord. 38 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

39 6 Post-deployment tsks Contents Set up dt storge MAfee Enterprise Log Mnger (ELM) Configure ELM Storge Configure third prty dt onsumers Work in FIPS mode Set up dt storge Contents Set up dt storge Set up VM dt storge Inrese umultor indexes Define dt llotion limits Set up dt storge If you hve n Internet Smll Computer System Interfe (iscsi), Storge Are Network (SAN), Common Internet File System (CIFS), or Network File System (NFS) devie onneted to MAfee ESM, you n set them up for dt storge. 1 On the system nvigtion tree, selet System Properties, then lik Dtse Arhivl. 2 Clik the dt storge devie ts, selet n tion, then fill in the devie IP ddress, nme, nd port. The ville ts depend on the storge types onneted to MAfee ESM. 3 Clik Cnel to lose the pge. Set up VM dt storge If your MAfee ESM VM hs more thn 4 CPUs, you n use dditionl storge for the VM's system storge, dt storge, nd high-performne storge. Before you egin Clulte your storge needs sed on EPS nd retention poliy. Use high-speed storge suh s SSD. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 39

40 6 Post-deployment tsks MAfee Enterprise Log Mnger (ELM) 1 On the system nvigtion tree, selet System Properties, then lik Dtse VM Dt. 2 In eh field, selet the drive you wnt the dt stored on. You n selet eh drive only one. 3 Clik OK. Inrese umultor indexes Due to the numer of enled stndrd indexes on MAfee ESM, you n dd only 5 indexes to n umultor field. If you need more thn 5, you n disle up to 42 unused stndrd indexes (suh s session ID, sr/dst M, sr/dst port, sr/dst zone, sr/dst geolotion). MAfee ESM indexes ll ports nd MAC ddresses y defult nd uses stndrd indexes to generte queries, reports, lrms, nd views. If you disle n index, MAfee ESM notifies you when it n't generte query, report, lrm, or view due to disled index, ut it does not identify whih index is disled. Due to this limittion, do not disle stndrd indexes unless needed. 1 From the MAfee ESM dshord, lik nd selet Configurtion. 2 Clik Dtse. 3 Clik Settings, then lik the Aumultor Indexing t. 4 From the Aville list, lik Stndrd Indexes, then selet Show stndrd indexes. 5 Clik the stndrd indexes to e disled, then lik the rrow to move them to the Aville re. The numer in the remining sttement in the top right orner of the pge inreses with eh stndrd index tht you disle. You n now enle more thn 5 umultor indexes for the umultor field tht you selet. Define dt llotion limits The mximum numer of event nd flow reords the system mintins is fixed vlue. Dt llotion llows you to set how muh spe to llote for eh, nd how mny reords re serhed to optimize querying. 1 On the system nvigtion tree, selet System Properties, then lik Dtse Dt Allotion. 2 Clik the mrkers on the numer lines nd drg them to the wnted numers, or lik the rrows in the Events nd Flows fields. 3 Clik OK. MAfee Enterprise Log Mnger (ELM) MAfee Enterprise Log Mnger (ELM) supports storing, mnging, essing, nd reporting on log dt. Dt reeived y ELM is orgnized into storge pools, eh omposed of storge devies. A retention time is ssoited with eh storge pool nd the dt is retined in the pool for the period speified. Government, industry, nd orporte regultions require tht logs e stored for different time periods. 40 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

41 Post-deployment tsks MAfee Enterprise Log Mnger (ELM) 6 You n set up serh nd integrity-hek jos on the ELM. Eh jo esses stored logs nd retrieves or heks dt defined in the jo. You n then view the results nd export the informtion. To onfigure n ELM, you must know: Soures tht re storing logs on the ELM Required storge pools nd their dt retention times Storge devies tht re required to store the dt Generlly, you know the soures tht store logs on the ELM nd the storge pools tht re required. Wht is unknown is the needed storge devies tht store the dt. The est pproh to ddressing this unertinty is: 1 Mke onservtive estimte of the storge requirements. ELM storge pools require 10 perent of the lloted spe for mirroring overhed. When lulting required spe, tke the 10 perent into ount. 2 Configure ELM storge devies to meet the estimted requirements. 3 Review logs on the ELM for short period. 4 Use ELM storge sttistis informtion to hnge the storge devie onfigurtions to ommodte the tul dt storge requirements. Set up MAfee ESM logging If you hve n Enterprise Log Mnger (ELM) devie on your system, onfigure the defult logging pool to send internl event dt MAfee ESM genertes to the ELM devie. Before you egin Add n ELM devie to your system. 1 On the system nvigtion tree, selet System Properties, then lik ESM Mngement. 2 On the Configurtion t, lik Logging. 3 Selet the defult logging options nd storge pool to store internl event dt, then lik OK. If you hve more thn one ELM devie on the system, selet the ELM you wnt to store the dt on. This MAfee ESM devie lwys logs on to the ELM you selet. Selet the IP ddress tht you wnt MAfee ESM to ommunite with the ELM. They system notifies you when the seleted ELM is suessfully ssoited with the devie. If storge pools hve not een onfigured on the ELM, the system notifies you to dd storge pools to the ELM efore you n enle logging. Move storge pools You n move storge pools from one devie to nother. Before you egin Set up the storge devies you wnt to move the storge pool to s mirror of the devie urrently holding the pool. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 41

42 6 Post-deployment tsks MAfee Enterprise Log Mnger (ELM) 1 On the system nvigtion tree, selet the ELM devie holding the storge pool, then lik the Properties ion. 2 Clik Storge Pools. 3 Clik the mirrored devies listed under the pool to e moved. 4 Clik Edit, nd from the Dt Storge Devies drop-down list, selet the devie tht mirrors the storge pool to e moved. It is now the min dt storge devie. 5 To mirror the new dt storge devie, selet devie from the Mirrored Dt Storge Devie drop-down list, then lik OK. Redue storge llotion size If storge devie is full due to spe lloted for storge pools, you n redue the mount of spe defined for eh llotion, whih llotes spe on this devie for more storge pools. If the llotion size redution ffets dt, the system moves dt to other llotions in the pool (if spe is ville). If spe is unville, the system deletes the oldest dt. 1 From the MAfee ESM dshord, lik nd selet Configurtion. 2 On the system nvigtion tree, selet the ELM, then lik the Properties ion. 3 Clik Storge Pools. 4 On the ottom tle, selet the pool to redue, then lik Redue Size. 5 Enter the mount tht you wnt to redue the storge, then lik OK. Mirroring ELM dt storge Set up seond ELM storge devie to mirror the dt olleted on the min devie. If the min devie goes down, the kup devie ontinues storing the dt s it omes in. When the min devie omes k on line, it utomtilly syns with the kup, then resumes storing the dt s it rrives. If the min devie goes down permnently, you n ressign the kup to eome the min on MAfee ESM, then designte different devie to mirror it. When either devie goes down, helth sttus flg nvigtion tree. ppers next to the ELM devie on the system A mirrored storge pool might lose onnetion with its storge devie. The loss n e due to: The file server or the network etween the ELM nd the file server hs filed. The file server or network is shut down for mintenne. An llotion file is identlly deleted. When there is prolem with the mirror, the storge devies show wrning ion Use the Reuild funtion to repir it. in the Storge Pools tle. 42 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

43 Post-deployment tsks MAfee Enterprise Log Mnger (ELM) 6 Add mirrored ELM dt storge You n use ny storge devie to mirror dt sved on n Enterprise Log Mnger (ELM) storge devie. Before you egin Add the two devies you wnt to use to mirror eh other to MAfee ESM. 1 On the system nvigtion tree, selet ELM Properties, then lik Storge Pools. 2 Clik Add. 3 Enter the informtion requested, then lik Add to selet the storge devie nd mirroring devie. You n ssign devie to more thn one pool t time. 4 Clik OK twie. Reuild mirrored storge pools If mirrored storge pool loses onnetion with its storge devies, use the Reuild funtion to repir it. 1 On the system nvigtion tree, selet ELM Properties, then lik Storge Pool. 2 Hover over the mirrored devies with wrning ion. A tooltip informs you tht the ELM llotion is reuilding or tht the mirrored devie needs to e reuilt. 3 Clik the devies, then lik Reuild. ELM redundny You n provide redundny for your logging y dding stndy ELM to the urrent stndlone ELM on your system. To enle redundny, define the IP ddresses nd other network informtion on two ELMs. The stndy ELM must hve storge devies with enough omined spe to mth the storge on the tive ELM. One they re set up, the onfigurtion on oth ELMs is synhronized, nd the stndy ELM mintins the synhroniztion of dt etween oth devies. There re severl tions you perform when working with ELM redundny: swith over, return to servie, suspend, remove, nd view sttus. All tions re ville on ELM Properties ELM Redundny. Swith over If the primry ELM goes down or needs to e repled, selet Swith ELM. The stndy ELM eomes tive nd the system ssoites ll logging devies to it. Logging nd onfigurtion tions re loked during the swith-over proess. Return to servie If the stndy ELM goes down, you must return it to servie when it is rought k up. If no hnges to onfigurtion files re deteted, redundny ontinues s efore. If differenes re deteted in the files, redundny ontinues for the storge pools tht do not hve prolems, ut n error sttus is returned, tht one or more pools re out of onfigurtion. You must fix these pools mnully. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 43

44 6 Post-deployment tsks MAfee Enterprise Log Mnger (ELM) If the stndy ELM hs een repled or reonfigured, the system detets it nd prompts you to rekey the stndy ELM. The tive ELM then syns ll onfigurtion files to the stndy, nd redundny ontinues s efore. Suspend You n suspend ommunition with the stndy ELM if it is down or is going to e down for ny reson. All ommunition stops nd error notifitions for redundny re msked. When the stndy ELM is rought k up, follow the return to servie proess. Disle redundny on the ELM You n disle ELM redundny y seleting Remove. The tive ELM sves opy of the redundny onfigurtion files. If this kup file is found when enling ELM redundny, you re sked if you wnt to restore the sved onfigurtion files. View sttus You n view detils out the stte of dt synhroniztion etween the tive nd stndy ELM y seleting Sttus. Restore ELM dt To reple n Enterprise Log Mnger (ELM), restore the mngement dtse nd log dt to the new ELM. Before you egin The ELM dtse nd log dt must e mirrored. To restore the dt from n old ELM to new ELM, don't rete n ELM using the Add Devie wizrd. 1 On the system nvigtion tree, selet ELM Properties for the ELM tht must e repled. A wrning pge lets you know tht the system n't lote the ELM. 2 Close the wrning pge, then lik Connetion. 3 Enter the IP ddress for the new ELM, then lik Key Mngement Key Devie. 4 Enter the pssword to ssoite with this devie, then lik Next. 5 Clik ELM Informtion Bkup & Restore Restore ELM. 6 Resyn eh devie logging to the ELM y liking Syn ELM on Properties Configurtion for eh devie. Restoring the ELM mngement dtse nd dt storge to new ELM n tke severl hours. 44 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

45 Post-deployment tsks Configure ELM Storge 6 Define n lternte storge lotion To store Enterprise Log Mnger (ELM) mngement dtse reords in lotion not on the ELM, define the lternte storge lotion. You n lso selet seond devie to mirror wht is stored. 1 On the system nvigtion tree, selet ELM Properties, then lik ELM Configurtion Migrte DB. 2 Selet the lotion to store the mngement dtse nd seond storge lotion to mirror the dt storge devie. The first time you selet to mirror ny of the existing devies, the proess n tke n extended mount of time. 3 Clik OK. Migrting the ELM dtse The Enterprise Log Mnger (ELM) mngement dtse stores the reords tht trk logs sent to the ELM. The mount of disk spe ville on your ELM devie to store the mngement dtse depends on the model. When you dd the devie, the system verifies tht it hs enough disk spe to store the reords. The system might prompt you to define n lternte lotion for mngement dtse storge. If the devie does hve enough disk spe ut you prefer to sve the dtse in n lterntive lotion, you n use Migrte DB on the ELM Properties pge to set up tht lotion. Migrte DB n e used t ny time. But, if you migrte the mngement dtse one it ontins reords, the ELM session is on hold for severl hours until the migrtion is omplete, sed on the numer of reords it ontins. We reommend tht you define this lterntive lotion when you first set up the ELM devie. Configure ELM Storge Contents Disle HomeGroup file shring Set up externl dt storge Add iscsi devies Link storge devies to storge pools Formt SAN storge devies Configure Diret Atthed Storge (DAS) Set up virtul lol drive to store dt Disle HomeGroup file shring Windows 7 requires you to use HomeGroup file shring, whih works with other Windows 7 omputers ut not with Sm. To use Windows 7 omputer s CIFS shre, you must disle HomeGroup file shring. 1 Open the Windows 7 Control Pnel, then selet Network nd Shring Center. 2 Clik Chnge dvned shring settings. 3 Clik Home or Work profile nd mke sure it is leled s your urrent profile. 4 Turn on network disovery, file nd printer shring, nd puli folder. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 45

46 6 Post-deployment tsks Configure ELM Storge 5 Go to the folder you wnt to shre using CIFS (try the puli folder first) nd right-lik it. 6 Selet Properties, then lik the Shring t. 7 Clik Advned shring, then selet Shre this folder. 8 (Optionl) Chnge the shre nme nd lik Permissions. Mke sure you hve permissions set s you wnt ( hekmrk in Chnge = writele). If you enle pssword-proteted shres, updte settings to ensure tht your Uuntu user is inluded for permission. Set up externl dt storge You n set up externl storge (iscsi, SAN, DAS, nd virtul lol) to store ELM dt. When you onnet the externl storge types to the Enterprise Log Mnger (ELM), set them up to store dt from the ELM. 1 On the system nvigtion tree, selet ELM Properties, then lik Dt Storge. The system returns ll ville storge devies on the pproprite ts. 2 Clik the iscsi, SAN, DAS, or Virtul Lol t, then follow the required steps. 3 Clik Apply or OK. Add iscsi devies To dd n iscsi devie for ELM storge, you must onfigure onnetions to the devie. 1 On the system nvigtion tree, selet the ELM, then lik the Properties ion. 2 Clik Dt Storge. 3 On the iscsi t, lik Add. 4 Enter the informtion requested, then lik OK. If the onnetion is suessful, the system dds the devie nd its IQNs to the iscsi Configurtion list nd Devie Type list on Add Storge Devie. One n IQN egins storing ELM logs, you nnot delete the iscsi trget. Due to this limittion, set up your iscsi trget with suffiient spe for ELM storge. 5 Before using n IQN for ELM storge, selet it on the list, then lik Formt. 6 To hek its sttus s it is formtting, lik Chek Sttus. 7 To disover or redisover the IQNs, lik the iscsi devie, then lik Disover. Attempts to ssign more thn one devie to n IQN n result in dt loss. 46 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

47 Post-deployment tsks Configure ELM Storge 6 Link storge devies to storge pools Add storge devies, whih you n then link to storge pools. Before you egin Set up storge devies. When editing storge devies, you n inrese the size, ut you n't redue it. You nnot delete devie if it's storing dt. 1 On the system nvigtion tree, selet ELM Properties, then lik Storge Pools. 2 Clik Add. 3 On Add Storge Devie, fill in the requested informtion then lik OK. Option Devie Type Nme Mx size IP Address, Remote Mount Point, Remote Pth IP Address, Remote Shre Nme, Pth, Usernme, Pssword iscsi Devie iscsi IQN SAN Virtul Lol Volume Definition Selet the type of storge devie. Migrting the ELM dtse requires minimum of 506 GB of free disk spe. Type nme for the storge devie. Selet the mximum mount of storge spe tht you wnt to llote on this devie. When dding remote storge devie to the ELM, Mx size defults to 4 GB. One perent of the storge spe is reserved for mngement of the remote storge. When dding virtul lol storge devie, Mx size defults to the totl storge pity of the devie. Six GB of the storge spe is reserved for mngement of the virtul storge. You n't djust this field. Type this informtion for the NFS devie. Type this informtion for the CIFS devie. Selet the devie tht you dded. Selet the IQN. Selet the SAN volume tht you dded. Selet the virtul lol storge devie. This option is only ville when the devie type is Virtul Lol. 4 Define onnetion prmeters of storge devie, whih is used in storge pool for dt retention. Option Dt Storge Devies Definition Selet the devie you wnt to dd. YOu n ssign devie to more thn one pool t time. Storge spe Selet the mximum mount of spe on this devie for storing dt. The system uses 10 perent of the storge spe for overhed. For exmple, if you selet 4GB in the storge spe field, 3.6GB is ville to store dt. Mirrored Dt Storge Devie To mirror dt on this storge devie with nother devie, selet the seond storge devie. MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 47

48 6 Post-deployment tsks Configure ELM Storge Formt SAN storge devies If you hve SAN rd in your system, you n use it to store ELM dt. Before you egin Verify tht SAN rd exists in your system. 1 On the system nvigtion tree, selet ELM Properties, then lik Dt Storge. 2 Clik the SAN t, then hek the sttus of the SAN volumes tht were deteted. Formt required volume must e formtted nd doesn't pper on the list of ville volumes on the Add Storge Devie pge. Formtting volume is in the proess of eing formtted nd doesn't pper on the list of ville volumes. Redy volume is formtted nd hs reognizle file system. These volumes n e used to store ELM dt. 3 If volume is not formtted nd you wnt it to store dt, lik it, then lik Formt. Formtting volume deletes ll stored dt. 4 To hek if formtting is omplete, lik Refresh. When formtting ompletes, the system hnges the sttus to Redy. 5 To view the detils of volume t the ottom of the pge, lik the volume. Configure Diret Atthed Storge (DAS) Before you egin Set up DAS devies to store dt from n ESM devie. 1 On the system nvigtion tree, selet the MAfee ESM devie then lik Properties. 2 Clik Dtse nd lik Dt Storge. 3 On the tle, lik one of the devies tht hs not een ssigned to store MAfee ESM dt. 4 Clik Assign nd lik Yes. One you ssign devie, you n't hnge it. Set up virtul lol drive to store dt Detet nd formt virtul storge devies on the virtul MAfee Enterprise Log Mnger. It n then e used for dtse migrtion nd storge pools. Before you egin Add virtul lol storge devies to the virtul MAfee Enterprise Log Mnger from its virtul environment. To dd the storge, see the doumenttion for the virtul mhine environment. 48 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide

49 Post-deployment tsks Configure third prty dt onsumers 6 Supported drive formts SCSI SATA IDE is not supported. 1 On the system nvigtion tree, selet the virtul MAfee Enterprise Log Mnger, lik the Properties ion, then lik Dt Storge. Root nd oot prtitions re unville s vile storge options. 2 Clik the Virtul Lol t, then selet devie from the list of ville virtul devies. The Virtul Lol t is only ville if the system detets virtul storge. 3 If the Sttus olumn sys Formt required, lik Formt to formt the devie with ext4 file formt. The sttus hnges to Redy. Configure third prty dt onsumers Use rw ESM dt in third prty pplitions. Before you egin Configure n event forwrding rule on ESM with n externl ertifite nd trget topi. Downlod the root ertifite nd the ertifite onfigured for the forwrding rule. 1 On the omputer tht hosts the dt onsumer, dd n entry to the host file: <DSB_IP> <DSB_GUID>. Where DSP_IP is the IP ddress of the VM tht hosts the Dt Streming Bus nd DSB_GUID is the vlue from /et/nitrogurd/devsettings.onf on the sme VM. 2 Configure the third prty pplition. Set the topi to the trget topi reted when you onfigured the event forwrding rule. Speify the port on the Dt Streming Bus VM tht llows externl ess (defult is 9092). d Enter the IP ddress of the VM tht hosts the Dt Streming Bus. Speify the root ertifite nd the ertifite onfigured for the forwrding rule. Work in FIPS mode Contents Chek FIPS integrity Trouleshoot FIPS mode MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide 49

50 6 Post-deployment tsks Work in FIPS mode Chek FIPS integrity If operting in FIPS mode, FIPS requires softwre integrity testing regulrly. You must test the system nd eh devie. 1 On the system nvigtion tree, selet System Properties, nd mke sure tht System Informtion is seleted. 2 Do ny of the following. In this field... FIPS Sttus Test or FIPS Self-Test Do this... View the results of the most reent FIPS self-test performed on the MAfee ESM. Run the FIPS self-tests, whih test the integrity of the lgorithms used in the rypto-exeutle. The results n e viewed on the Messge Log. If the FIPS self-test fils, FIPS is ompromised or devie filure is ourring. Contt MAfee Support. View or FIPS Identity Open the FIPS Identity Token pge to perform power-up softwre integrity testing. Compre this vlue to the puli key tht ppers on this pge: If this vlue nd the puli key don't mth, FIPS is ompromised. Contt MAfee Support. Trouleshoot FIPS mode Issues might rise when operting MAfee ESM in FIPS mode. Cn't tlk to the MAfee ESM Chek the LCD on the front of the devie. If it sys FIPS Filure, ontt MAfee Support. Chek for n error ondition through the HTTP interfe y viewing the MAfee ESM FIPS Self-test wepge in rowser. If single digit 0 is displyed, inditing tht the devie hs filed FIPS self-test, reoot the MAfee ESM devie nd ttempt to orret the prolem. If the filure ondition persists, ontt Support for further instrutions. If single digit 1 is displyed, the ommunition prolem is not due to FIPS filure. Contt Support for further trouleshooting steps. 50 MAfee Enterprise Seurity Mnger 11.1.x Instlltion Guide