Oracle WebLogic Configuration

What is Discovered and Monitored

Protocol	Information discovered	Metrics collected	Used for
JMX		Generic information: Application version, Application port, SSL listen port, Listen port enabled flag, SSL listen port enabled Availability metrics: Uptime, Application Server State Memory metrics: Total memory, Free memory, Used memory, Memory utilization, Heap utilization, Heap used memory, Heap max memory,  Heap commit memory, Total nursery memory Servlet metrics: Application name, App server instance, Web application name, Web context name, Servlet name, Invocation count, Servlet execution time Database pool metrics: Application name, App server instance, Data source, Active connection count, Connection limit, Leaked connections, Reserve requests, Requests wait for connections Thread pool metrics: App server instance, Completed requests, Execute threads, Pending requests, Standby threads, Total threads EJB metrics: EJB component name, EJB state, EJB idle beans, EJB used beans, EJB pooled beans, EJB Waiter threads, EJB committed Transactions, EJB timedout transactions, EJB rolledback transactions, EJB activations, EJB Passivations, EJB cache hits, EJB cache misses, EJB cache accesses, EJB cache hit ratio Application level metrics: Application name, App server instance, Web application name, Web context root, Peak active sessions, Current active sessions, Total active sessions, Servlet count, Single threaded servlet pool count,	Performance Monitoring

 

Event Types

In CMDB > Event Types, search for “WebLogic in the Description column to see the event types associated with this device.

Rules

There are no predefined rules for this device.

Reports

In Analytics > Reports, search for “WebLogic” in the Name column to see the reports associated with this application or device.

Configuration

JMX

Enable and Configure Internet Inter-ORB Protocol (IIOP)

1. Log into the administration console of your WebLogic application server.
2. In the Change Center of the administration console, click Lock & Edit.
3. In the left-hand navigation, expand Environment and select Servers.
4. Click the Protocols tab, then select IIOP.
5. Select Enable IIOP.
6. Expand the Advanced
7. For Default IIOP Username and Default IIOP Password, enter the username and password that you will use as the access credentials when configuring AccelOps to communicate with your application server.

Enable IIOP Configuration Changes

1. Go to the Change Center of the administration console.
2. Click Activate Changes.

You can now configure AccelOps to communicate with your IBM Websphere device by following the instructions in Setting Access Credentials for Device Discovery, and then initiate discovery of the device as described in the topics in Discovering Infrastructure.

Sample Event for WebLogic Metrics

<134>Jan 22 02:12:20 10.1.2.16 java:

[PH_DEV_MON_WEBLOGIC_GEN]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.1 6,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=7001,[a ppVersion]=WebLogic Server 10.3  Fri Jul 25 16:30:05 EDT 2008 1137967 ,[appServerInstance]=examplesServer,[appServerState]=RUNNING,[sysUpTime]

=1358476145,[appPort]=7001,[sslListenPort]=7002,[listenPortEnabled]=true

,[sslListenPortEnabled]=true

<134>Jan 22 02:12:20 10.1.2.16 java:

[PH_DEV_MON_WEBLOGIC_MEMORY]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.

2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=7001

,[appVersion]=WebLogic Server 10.3  Fri Jul 25 16:30:05 EDT 2008 1137967

,[appServerInstance]=examplesServer,[appServerState]=RUNNING,[heapUsedKB ]=153128,[heapCommitKB]=262144,[heapFreeKB]=109015,[heapUtil]=59,[heapMa xKB]=524288,[usedMemKB]=4086224,[freeMemKB]=107624,[memTotalMB]=4095,[me mUtil]=97,[nurserySizeKB]=88324  <134>Jan 22 02:12:22 10.1.2.16 java:

[PH_DEV_MON_WEBLOGIC_SERVLET]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1

.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=700

1,[appVersion]=WebLogic Server 10.3  Fri Jul 25 16:30:05 EDT 2008

1137967 ,[appServerInstance]=examplesServer,[appName]=consoleapp,[webAppName]=ex amplesServer_/console,[servletName]=/framework/skeletons/wlsconsole/plac eholder.jsp,[webContextRoot]=/console,[invocationCount]=1094,[servletExe cutionTimeMs]=63

<134>Jan 22 02:15:24 10.1.2.16 java:

[PH_DEV_MON_WEBLOGIC_DB_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1

.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=700

1,[appVersion]=WebLogic Server 10.3  Fri Jul 25 16:30:05 EDT 2008

1137967 ,[appServerInstance]=examplesServer,[appName]=examples-demoXA-2,[dataSou rce]=examples-demoXA-2,[activeConns]=0,[connLimit]=1,[leakedConns]=0,[re serveRequests]=0,[waitForConnReqs]=0  <134>Jan 22 02:12:20 10.1.2.16 java:

[PH_DEV_MON_WEBLOGIC_THREAD_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]=

10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]

=7001,[appVersion]=WebLogic Server 10.3  Fri Jul 25 16:30:05 EDT 2008

1137967 ,[appServerInstance]=examplesServer,[completedRequests]=14066312,[execut eThreads]=7,[pendingRequests]=0,[standbyThreads]=5,[totalThreads]=43  <134>Jan 22 02:12:20 10.1.2.16 java:

[PH_DEV_MON_WEBLOGIC_EJB]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.1 6,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=7001,[a ppVersion]=WebLogic Server 10.3  Fri Jul 25 16:30:05 EDT 2008 1137967 ,[appServerInstance]=examplesServer,[ejbComponentName]=ejb30,[ejbIdleBea ns]=0,[ejbUsedBeans]=0,[ejbPooledBeans]=0,[ejbWaiter]=0,[ejbCommitTransa ctions]=0,[ejbTimedOutTransactions]=0,[ejbRolledBackTransactions]=0,[ejb Activations]=0,[ejbPassivations]=0,[ejbCacheHits]=0,[ejbCacheMisses]=0,[ ejbCacheAccesses]=0,[ejbCacheHitRatio]=0

<134>Jan 22 02:12:23 10.1.2.16 java:

[PH_DEV_MON_WEBLOGIC_APP]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.1 6,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=7001,[a ppVersion]=WebLogic Server 10.3  Fri Jul 25 16:30:05 EDT 2008 1137967

,[appServerInstance]=examplesServer,[appName]=webservicesJwsSimpleEar,[w ebAppName]=examplesServer_/jws_basic_simple,[webContextRoot]=/jws_basic_ simple,[activeSessions]=0,[activeSessionsPeak]=0,[activeSessionTotal]=0,

[numServlet]=4,[singleThreadedServletPool]=5

Microsoft ASP.NET Configuration

Creating a Generic User Who Does Not Belong to the Local Administrator Group

Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group

Enable DCOM Permissions for the Monitoring Account

Creating a User Who Belongs to the Domain Administrator Group

Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group

Enable the Monitoring Account to Access the Monitored Device

Enable DCOM Permissions for the Monitoring Account

Enable Account Privileges in WMI

Allow WMI to Connect Through the Windows Firewall (Windows 2003)

Allow WMI through Windows Firewall (Windows Server 2008, 2012)

Sample Event for ASP.NET Metrics

What is Discovered and Monitored

Protocol	Information discovered	Metrics collected	Used for
WMI		Request Execution Time, Request Wait Time, Current Requests, Disconnected Requests, Queued requests, Disconnected Requests	Performance Monitoring

Event Types

In CMDB > Event Types, search for “asp.net” in the Description column to see the event types associated with this device.

Rules

There are no predefined rules for this device.

Reports

In Analytics > Reports, search for “asp.net” in the Name column to see the reports associated with this application or device.

Configuration

Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:

Creating a Generic User Who Does Not Belong to the Local Administrator Group

Creating a User Who Belongs to the Domain Administrator Group

Creating a Generic User Who Does Not Belong to the Local Administrator Group

Log in to the machine you want to monitor with an administrator account.

Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group

1. Go to Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups.
2. Right-click Users and select Add User.
3. Create a user.
4. Go to Groups, right-click Distributed COM Users, and then click Add to group.
5. In the Distributed COM Users Properties dialog, click Add.
6. Find the user you created, and then click OK.

This is the account you will need to use in setting up the Performance Monitor Users group permissions.

7. Click OK in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
8. Repeat steps 4 through 7 for the Performance Monitor Users group.

Enable DCOM Permissions for the Monitoring Account

1. Go to Start > Control Panel > Administrative Tools > Component Services.
2. Right-click My Computer, and then Properties.
3. Select the COM Security tab, and then under Access Permissions, click Edit Limits.
4. Make sure that the Distributed COM Users group and the Performance Monitor Users group have Local Access and Remote Access set to
5. Click OK.
6. Under Access Permissions, click EditDefault.
7. Make sure that the Distributed COM Users group and the Performance Monitor Users group have Local Access and Remote Access set to
8. Click
9. Under Launch and Activation Permissions, click Edit Limits.
10. Make sure that the Distributed COM Users group and the Performance Monitor Users group have the permissions Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.
11. Click OK.
12. Under Launch and Activation Permissions, click Edit Defaults.
13. Make sure that the Distributed COM Users group and the Performance Monitor Users group have the permissions Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.

See the sections on Enabling WMI Privileges and Allowing WMI Access through the Windows Firewall in the Domain Admin User set up instructions for the remaining steps to configure WMI.

Creating a User Who Belongs to the Domain Administrator Group

Log in to the Domain Controller with an administrator account.

Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group

1. Go to Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users.
2. Right-click Users and select Add User.
3. Create a user for the @accelops.com domain.

For example, YJTEST@accelops.com.

4. Go to Groups, right-click Administrators, and then click Add to Group.
5. In the Domain Admins Properties dialog, select the Members tab, and then click Add.
6. For Enter the object names to select, enter the user you created in step 3.
7. Click OK to close the Domain Admins Properties dialog.
8. Click OK.

Enable the Monitoring Account to Access the Monitored Device

Log in to the machine you want to monitor with an administrator account. Enable DCOM Permissions for the Monitoring Account

1. Go to Start > Control Panel > Administrative Tools > Component Services.
2. Right-click My Computer, and then select Properties.
3. Select the Com Security tab, and then under Access Permissions, click Edit Limits.
4. Find the user you created for the monitoring account, and make sure that user has the permission Allow for both Local Access and Re mote Access.
5. Click OK.
6. In the Com Security tab, under Access Permissions, click Edit Defaults.
7. Find the user you created for the monitoring account, and make sure that user has the permission Allow for both Local Access and Re mote Access.
8. Click OK.
9. In the Com Security tab, under Launch and Activation Permissions, click Edit Limits.
10. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.
11. In the Com Security tab, under Launch and Activation Permissions, click Edit Defaults.
12. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.

Enable Account Privileges in WMI

The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.

1. Go to Start > Control Panel > Administrative Tools > Computer Management > Services and Applications.
2. Select WMI Control, and then right-click and select Properties.
3. Select the Security
4. Expand the Root directory and select CIMV2.
5. Click Security.
6. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Enable Account and Remot e Enable.
7. Click Advanced.
8. Select the user you created for the monitoring account, and then click Edit.
9. In the Apply onto menu, select This namespace and subnamespaces.
10. Click OK to close the Permission Entry for CIMV2 dialog.
11. Click OK to close the Advanced Security Settings for CIMV2 dialog.
12. In the left-hand navigation, under Services and Applications, select Services.
13. Select Windows Management Instrumentation, and then click Restart. Allow WMI to Connect Through the Windows Firewall (Windows 2003)
14. In the Start menu, select Run.
15. Run msc.
16. Go to Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections > Windows Firewall.
17. Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
18. Select Windows Firewall: Allow remote administration exception.
19. Run exe and enter these commands:
20. Restart the server.

Allow WMI through Windows Firewall (Windows Server 2008, 2012)

1. Go to Control Panel > Windows Firewall.
2. In the left-hand navigation, click Allow a program or feature through Windows Firewall.
3. Select Windows Management Instrumentation, and the click OK.

You can now configure AccelOps to communicate with your device by following the instructions in Setting Access Credentials for Device Discovery, and then initiate discovery of the device as described in the topics in Discovering Infrastructure.

Sample Event for ASP.NET Metrics

Oracle GlassFish Server Configuration

JMX

What is Discovered and Monitored

Protocol	Information discovered	Metrics collected	Used for
JMX		Generic information: Application version, Application port Availability metrics: Uptime, Application Server State CPU metrics: CPU utilization Memory metrics: Total memory, Free memory, Memory utilization, Virtual committed memory, Total Swap Memory, Free Swap Memory, Swap memory utilization, Heap Utilization, Heap Used Memory, Heap max memory,  Heap commit memory, Non-heap Utilization, Non-heap used memory, Non-heap max memory, Non-heap commit memory Servlet metrics: Web application name, Servlet Name, Count allocated, Total requests, Request errors, Avg Request Processing time Session metrics: Web context path, Peak active sessions, Current active sessions, Duplicate sessions, Expired sessions, Rejected sessions, Average session lifetime, Peak session lifetime, Session processing time, Session create rate, Session expire rate, Process expire frequency, Max session limited, Max inactive Interval Database metrics: Data source Thread pool metrics: Current live threads, Max live threads Request processor metrics: Request processor name, Received Bytes, Sent Bytes, Total requests, Average Request Process time, Max Request Processing time, Request Rate, Request Errors, Max open connections, Current open connections, Last Request URI, Last Request method, Last Request completion time Application level metrics: Cache TTL, Max cache size, Average request processing time, App server start time, Cookies allowed flag, Caching allowed flag, Linking allowed flag, Cross Context Allowed flag EJB metrics: EJB component name, EJB state, EJB start time Connection metrics: Request processor name, HTTP status code, HTTP total accesses	Performance Monitoring

Event Types

In CMDB > Event Types, search for “glassfish” in the Description column to see the event types associated with this device.

Rules

There are no predefined rules for this device.

Reports

In Analytics > Reports, search for “glassfish” in the Name column to see the reports associated with this application or device. Configuration

JMX

1. The default JMX port used by Oracle GlassFish is 8686. If you want to change it, modify the node jmx-connector of the file ${GlassF ish_Home}\domains\${Domain_Name}\config\domain.xml.
2. The username and password for JMX are the same as the web console.

You can now configure AccelOps to communicate with your Oracle GlassFish device by following the instructions in Setting Access Credentials for Device Discovery, and then initiate discovery of the device as described in the topics in Discovering Infrastructure. Settings for Access Credentials

<134>Jan 22 02:00:29 10.1.2.201 java:

[PH_DEV_MON_GLASSFISH_APP]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.

201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]=868

6,[appVersion]=Sun Java System Application Server 9.1_02,[webContextRoot]=,[webAppState]=RUNNING,[cacheMaxSize]=10240,[cac heTTL]=5000,[reqProcessTimeAvg]=0,[startTime]=1358755971,[cookiesAllowed ]=true,[cachingAllowed]=false,[linkingAllowed]=false,[crossContextAllowe d]=true  <134>Jan 22 02:00:29 10.1.2.201 java:

[PH_DEV_MON_GLASSFISH_CPU]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.

201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]=868

6,[appVersion]=Sun Java System Application Server

9.1_02,[sysUpTime]=35266,[cpuUtil]=60

<134>Jan 22 02:00:29 10.1.2.201 java:

[PH_DEV_MON_GLASSFISH_MEMORY]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1

.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]=

8686,[appVersion]=Sun Java System Application Server 9.1_02,[freeMemKB]=479928,[freeSwapMemKB]=6289280,[memTotalMB]=16051,[me mUtil]=98,[swapMemUtil]=1,[swapMemTotalMB]=6142,[virtMemCommitKB]=402586 4,[heapUsedKB]=1182575,[heapMaxKB]=3106432,[heapCommitKB]=3106432,[heapU til]=38,[nonHeapUsedKB]=193676,[nonHeapMaxKB]=311296,[nonHeapCommitKB]=2 77120,[nonHeapUtil]=69

<134>Jan 22 02:00:29 10.1.2.201 java:

[PH_DEV_MON_GLASSFISH_SESSION]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.

1.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]

=8686,[appVersion]=Sun Java System Application Server 9.1_02,[webContextPath]=/__JWSappclients,[activeSessionsPeak]=0,[duplica teSession]=0,[activeSessions]=0,[expiredSession]=0,[rejectedSession]=0,[ sessionProcessTimeMs]=85,[sessionLifetimeAvg]=0,[sessionLifetimePeak]=0, [maxSessionLimited]=-1,[maxInactiveInterval]=1800

<134>Jan 22 02:00:29 10.1.2.201 java:

[PH_DEV_MON_GLASSFISH_SERVLET]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.

1.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]

=8686,[appVersion]=Sun Java System Application Server

9.1_02,[webAppName]=phoenix,[webAppState]=RUNNING,[servletName]=DtExport

Servlet,[totalRequests]=0,[reqErrors]=0,[reqProcessTimeAvg]=0

<134>Jan 22 02:00:29 10.1.2.201 java:

[PH_DEV_MON_GLASSFISH_CONN_STAT]:[eventSeverity]=PHL_INFO,[destIpAddr]=1 0.1.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPor t]=8686,[appVersion]=Sun Java System Application Server 9.1_02,[reqProcessorName]=http8181,[httpStatusCode]=304,[httpTotalAccess es]=0

<134>Jan 22 02:00:29 10.1.2.201 java:

[PH_DEV_MON_GLASSFISH_EJB]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.

201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]=868

6,[appVersion]=Sun Java System Application Server 9.1_02,[ejbComponentName]=phoenix-domain-1.0.jar,[ejbState]=RUNNING,[sta rtTime]=1358755963,  <134>Jan 22 02:00:29 10.1.2.201 java:

[PH_DEV_MON_GLASSFISH_JMS]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.

201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]=868

6,[appVersion]=Sun Java System Application Server

9.1_02,[jmsSource]=jms/RequestQueue

<134>Jan 22 02:00:29 10.1.2.201 java: [PH_DEV_MON_GLASSFISH_REQUEST_PROCESSOR]:[eventSeverity]=PHL_INFO,[destI pAddr]=10.1.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[de stDevPort]=8686,[appVersion]=Sun Java System Application Server 9.1_02,[reqProcessorName]=http4848,[recvBytes]=0,[sentBytes]=0,[totalReq uests]=0,[reqRate]=0,[reqProcessTimeAvg]=0,[reqProcessTimeMax]=0,[maxOpe nConnections]=0,[lastRequestURI]=null,[lastRequestMethod]=null,[lastRequ estCompletionTime]=0,[openConnectionsCount]=0,[reqErrors]=0

<134>Jan 22 02:00:29 10.1.2.201 java:

[PH_DEV_MON_GLASSFISH_THREAD_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr] =10.1.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevP ort]=8686,[appVersion]=Sun Java System Application Server 9.1_02,[liveThreads]=106,[liveThreadsMax]=138

<134>Jan 22 02:06:29 10.1.2.201 java:

[PH_DEV_MON_GLASSFISH_DB_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.

Configuring Applications

This section describes how to configure applications for discovery and for providing information to AccelOps.

What is Discovered and Monitored

Protocol	Information discovered	Metrics collected	Used for
JMX		Generic information: Application version, Application port Availability metrics: Uptime, Application Server State CPU metrics: CPU utilization Memory metrics: Total memory, Free memory, Memory utilization, Virtual committed memory, Total Swap Memory, Free Swap Memory, Swap memory utilization, Heap Utilization, Heap Used Memory, Heap max memory,  Heap commit memory, Non-heap Utilization, Non-heap used memory, Non-heap max memory, Non-heap commit memory Servlet metrics: Web application name, Servlet Name, Count allocated, Total requests, Request errors, Load time, Avg Request Processing time Session metrics: Web context path, Peak active sessions, Current active sessions, Duplicate sessions, Expired sessions, Rejected sessions, Average session lifetime, Peak session lifetime, Session processing time, Session create rate, Session expire rate, Process expire frequency, Max session limited, Max inactive Interval Database metrics: Web context path, Data source, Database driver, Peak active sessions, Current active sessions, Peak idle sessions, Current idle sessions Thread pool metrics: Thread pool name, Application port, Total threads, Busy threads, Keep alive threads, Max threads, Thread priority, Thread pool daemon flag Request processor metrics: Request processor name, Received Bytes, Sent Bytes, Average Request Process time, Max Request Processing time, Request Rate, Request Errors	Performance Monitoring

 

Event Types

In CMDB > Event Types, search for “tomcat” in the Device Type and Description column to see the event types associated with this device.

Rules

There are no predefined rules for this device.

Reports

In Analytics > Reports, search for “tomcat” in the Name column to see the reports associated with this application or device. Configuration

JMX

1. Add the necessary parameters to the Tomcat startup script.

Windows

Modify the file ${CATALINA_BASE}\bin\catalina.bat by adding these arguments for JVM before the comment rem

—-Execute The Requested Command ——

Linux

Modify the file ${CATALINA_BASE}/bin/catalina.sh by adding these arguments for JVM before the comment # —-Execute

3. Edit the password file password.

The first column is user name and the second column is password). AccelOps only needs monitor access.

4. In Linux, set permissions for the access and jmxremote.password files so that they are read-only and accessible only by the Tomcat operating system user.

You can now configure AccelOps to communicate with your device by following the instructions in Setting Access Credentials for Device Discovery, and then initiate discovery of the device as described in the topics in Discovering Infrastructure.

Sample Event for Tomcat Metrics

<134>Jan 22 01:57:32 10.1.2.16 java:

[PH_DEV_MON_TOMCAT_CPU]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,

[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=9218,[app

Version]=Apache

Tomcat/7.0.27,[appServerState]=STARTED,[sysUpTime]=2458304,[cpuUtil]=0

<134>Jan 22 01:57:32 10.1.2.16 java:

[PH_DEV_MON_TOMCAT_MEMORY]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2. 16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=9218,[ appVersion]=Apache Tomcat/7.0.27,[appServerState]=STARTED,[freeMemKB]=116504,[freeSwapMemKB

]=2974020,[memTotalMB]=4095,[swapMemTotalMB]=8189,[virtMemCommitKB]=1699 00,[memUtil]=98,[swapMemUtil]=65,[heapUsedKB]=18099,[heapMaxKB]=932096,[ heapCommitKB]=48896,[heapUtil]=37,[nonHeapUsedKB]=22320,[nonHeapMaxKB]=1 33120,[nonHeapCommitKB]=24512,[nonHeapUtil]=91

<134>Jan 22 01:57:33 10.1.2.16 java:

[PH_DEV_MON_TOMCAT_SERVLET]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2

.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=9218,

[appVersion]=Apache

Tomcat/7.0.27,[webAppName]=//localhost/host-manager,[servletName]=HTMLHo stManager,[countAllocated]=0,[totalRequests]=0,[reqErrors]=0,[loadTime]= 0,[reqProcessTimeAvg]=0,[maxInstances]=20,[servletState]=STARTED

<134>Jan 22 01:57:33 10.1.2.16 java:

[PH_DEV_MON_TOMCAT_SESSION]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2

.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=9218,

[appVersion]=Apache Tomcat/7.0.27,[webContextPath]=/host-manager,[activeSessionsPeak]=0,[act iveSessions]=0,[duplicateSession]=0,[expiredSession]=0,[rejectedSession] =0,[sessionLifetimeAvg]=0,[sessionLifetimePeak]=0,[sessionProcessTimeMs] =0,[sessionCreateRate]=0,[sessionExpireRate]=0,[webAppState]=STARTED,[pr ocessExpiresFrequency]=6,[maxSessionLimited]=-1,[maxInactiveInterval]=18 00

<134>Jan 22 01:57:33 10.1.2.16 java: [PH_DEV_MON_TOMCAT_DB]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,[ hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=9218,[appV ersion]=Apache Tomcat/7.0.27,[webContextPath]=/host-manager,[dataSource]=”jdbc/postgres 1″,[dbDriver]=org.postgresql.Driver,[activeSessionsPeak]=20,[activeSessi ons]=0,[idleSessionsPeak]=10,[idleSessions]=0

<134>Jan 22 01:57:33 10.1.2.16 java:

[PH_DEV_MON_TOMCAT_THREAD_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]=10

.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=9

218,[appVersion]=Apache Tomcat/7.0.27,[threadPoolName]=ajp-apr-18009,[appPort]=18009,[totalThrea ds]=0,[busyThreads]=0,[keepAliveThreads]=0[maxThreads]=200,[threadPriori ty]=5,[threadPoolIsDaemon]=true

<134>Jan 22 01:57:33 10.1.2.16 java: [PH_DEV_MON_TOMCAT_REQUEST_PROCESSOR]:[eventSeverity]=PHL_INFO,[destIpAd dr]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevP ort]=9218,[appVersion]=Apache

IBM WebSphere Configuration

What is Discovered and Monitored

Install the perfServletApp Application

Configure Security for the Application

Start the Application

Settings for Access Credentials

Protocol	Information discovered	Metrics collected	Used for
HTTP / HTTP(S)		Generic information: Application version, Application port Availability metrics: Uptime, Application Server State CPU metrics: Application server instance, CPU utilization Memory metrics: Heap utilization, Heap used memory, Heap free memory, Heap max memory,  Heap commit memory Servlet metrics: Application name, Web application name, Servlet Name, Invocation count Database pool metrics: Application server instance, JDBC provider, Data source, Pool size, Closed connections, Active Connections, Requests wait for connections, Connection use time, Connection factory type, Peak connections Thread pool metrics: Application server instance, Thread pool name, Execute threads, Peak execute threads Transaction metrics: Application server instance, Active Transaction, Committed Transaction, Rolled back Transaction Authentication metrics: Application name, Application server instance, Authentication Method, Count	Performance Monitoring
JMX		Generic information: Application version, Application port Availability metrics: Uptime, Application Server State CPU metrics: Application server instance, CPU utilization Memory metrics: Heap utilization, Heap used memory, Heap free memory, Heap max memory,  Heap commit memory, Max System dumps on disk, Max heap dumps on disk Servlet metrics: Application name, Web application name, Servlet Name, Invocation count, Request errors Database pool metrics: Application server instance, JDBC provider, Data source, Pool size, Closed connections, Active Connections, Requests wait for connections, Connection use time, Connection factory type, Peak connections Thread pool metrics: Application server instance, Thread pool name, Execute threads, Peak execute threads Application level metrics: Application name, Web application name, Application server instance, Web application context root, Active sessions, Peak active sessions EJB metrics: Application name, Application server instance, EJB component name	Performance Monitoring
Syslog			Log analysis

Event Types

In CMDB > Event Types, search for “websphere” in the Description column to see the event types associated with this device.

PH_DEV_MON_WEBSPHERE_CPU (from HTTPS)

 

Rules

There are no predefined rules for this device.

Reports

In Analytics > Reports, search for “websphere” in the Name column to see the reports associated with this device.

Configuration

HTTP(S)

Install the perfServletApp Application

• Log in to your Websphere administration console.

2. Go to Applications > Application Types > WebSphere enterprise application.
3. Click Install.
4. Select Remote file system and browse to {WebSphere_Home}/AppServer/installableApps/PerfServletApp.ear.
5. Click Next.

The Context Root for the application will be set to /wasPerfTool, but you can edit this during installation.  Configure Security for the Application

1. Go to Security > Global Security.
2. Select Enable application security.
3. Go to Applications > Application Types > Websphere Enterprise Applications.
4. Select perfServletApp.
5. Click Security role to user/group mapping.
6. Click Map Users/Groups.

 

7. Use the Search feature to find and select the AccelOps user you want to provide with access to the application,
8. Click Map Special Subjects.
9. Select All Authenticated in Application’s Realm.
10. Click OK.

Start the Application

1. Go to Applications > Application Types > WebSphere enterprise application.
2. Select perfServletApp.
3. Click Start.
4. In a web browser, launch the application by going to http://<ip>:<port>/wasPerfTool/servlet/perfservlet.

JMX

Configuring the Default JMX Port

By default, your Websphere application server uses port 8880 for JMX. You can change this by logging in to your application server console and going to Application servers > {Server Name} > Ports > SOAP_CONNECTOR_ADDRESS. The username and password for JMX are the same as the credentials logging into the console.

To configure JMX communications between your Websphere application server and AccelOps, you need to copy several files from your application server to the Websphere configuration directory for each AccelOps virtual appliance that will be used for discovery and performance monitoring jobs. AccelOps does not include these files because of licensing restrictions.

1. Copy these files to the directory /opt/phoenix/config/websphere/ for each Supervisor, Worker, and Collector in your AccelOps deployment.

File Type	Location
Client Jars	a.  ${WebSphere_Home}/AppServer/runtimes/com.ibm.ws.admin.client.jar b.  ${WebSphere_Home}/AppServer/plugins/com.ibm.ws.security.crypto.jar
SSL files	a.  ${WebSphere_Home}/AppServer/profiles/${Profile_Name}/etc/DummyClientKeyFile.jks b.  ${WebSphere_Home}/AppServer/profiles/${Profile_Name}/etc/DummyClientTrustFile.jks

2. Install IBM JDK 1.6 or higher in the location /opt/phoenix/config/websphere/java for each Supervisor, Worker, and Collector in your AccelOps deployment.

You can now configure AccelOps to communicate with your IBM Websphere device by following the instructions in Setting Access Credentials for Device Discovery, and then initiate discovery of the device as described in the topics in Discovering Infrastructure.

You can now configure AccelOps to communicate with your IBM Websphere device by following the instructions in Setting Access Credentials for Device Discovery, and then initiate discovery of the device as described in the topics in Discovering Infrastructure.

Configuring FortiSIEM Windows Agents

This section describes how to setup FortiSIEM Windows Agent and Agent Manager as part of FortiSIEM infrastructure.

Configure FortiSIEM Supervisor

Register Windows Agent Manager to FortiSIEM Supervisor

Configure Windows Agent Manager

License and Template Assignments in Agent Manager via Export/Import Verify Events in FortiSIEM

Sample logs generated by FortiSIEM Windows Agents

Windows System logs

Windows Application logs

Windows Security logs

Windows DNS logs

Windows DHCP logs

Windows IIS logs

Windows DFS logs

Windows file content monitoring logs

Windows File integrity monitoring logs

Windows Installed Software logs

Windows Registry change logs

Windows WMI logs

Windows Powershell logs

Procedure

Configure FortiSIEM Supervisor

1. Go to Admin > License Management and make sure that there are entries for Basic and Advanced Windows Agents.
2. Go to Admin > Setup Wizard and add Agent Managers
   1. Click on Windows Agents tab
   2. Click Add and enter information for an Windows Agent Manager. This information will be used by the Agent Manager to register to FortiSIEM
      1. Enter Agent Manager Name
      2. Enter the number of Basic Agents and Advanced Agents assigned to this Agent Manager

• Enter the Start Time and End Time for license validity

1. Choose Event Upload Destination – this is where the Agent Manager will upload events to.
   1. Select the Organization (Super for Enterprise version and Specific Organization for the Service Provider version)
   2. Select one or more Collectors belonging to the selected organization v. Click OK to Save

Register Windows Agent Manager to FortiSIEM Supervisor

1. Log on to Windows Agent Manager
2. Launch FortiSIEM Windows Agent Manager application
3. Log on to the FortiSIEM Windows Agent Manager application using User ID and Password created during setup
4. Register the Windows Agent Manager to FortiSIEM
   1. Enter Supervisor IP/Host
   2. Enter Agent Manager Name – this is defined in Step 2.b.i in Configure FortiSIEM Supervisor step
   3. Enter Organization Name – this is defined in Step 2.b.iv in Configure FortiSIEM Supervisor step
   4. Enter Organization User and Organization Password as the Organizations credentials defined when the Organization was created in Admin > Setup wizard.
5. Click Register. If registration is successful, then Windows Agent Manager Dashboard page is displayed. All the installed agents show up in this page with Current Status as Running.

Configure Windows Agent Manager

Collectors. Agents send events to any collector they choose. If a particular collector is not responsive, Agent will send to other available collectors. Before Release 2.1, Agents sent events to Collector(s) via Windows Agent Manager.

1. Go to Dashboard and make sure that it displays all Windows Servers with FortiSIEM agents installed.
2. Create a Monitoring Template
   1. Go to Template Settings. Click on + to expand the options.
   2. Click Create Template.
      1. Enter a template name and description. Click Settings. ii. Specify options for each monitoring category

Category	Description	Settings
File/Folder Changes	Monitor access and change to files and folders	Click New. Enter the full path of File/Folder to be modified Select Include Subfolder(s) if the folders under the main directory needs to be monitored. Narrow down the scope by either specify Include or Exclude files The chosen files/directories will be displayed (Note: To get User information, you have do some special configuration in Windows Agents as defined in Step 2 of Pre-requisites in Installing FortiSIEM Windows Agent)
Registry Changes	Monitor changes to the root keys of Windows Registry hive	Select the root keys (available keys are HK_CLASSES_ROOT, HKEY_CUR RENT_USER, HKEY_LOCAL_MACHINE, HKEY_USERS, and HKEY_CURRE NT_CONFIG) Set the time interval for how often the Agent will check for change. More CPU will be used for shorter time intervals
Installed Software	Monitor software install / uninstall on a Windows server	Select Product Name, Version and Vendor to be included in an event when a change is detected.
Logs	Collect System/Security/Application logs and specific application logs	Check System if you want to collect Windows System logs. Specify include/exclude event ids. Check Security if you want to collect Windows Security logs. Specify include/exclude event ids. Check DNS if you want to collect Windows DNS logs. Specify include/exclude event ids. Check DFS if you want to collect Windows DFS logs. Specify include/exclude event ids. Check Application if you want to collect Windows Application logs. Specify include/exclude event ids. Check IIS if you want to collect Windows IIS logs. Specify include/exclude event ids. Check DHCP if you want to collect Windows DHCP logs. Specify include/exclude event ids. Check User Logs and specify the file(s) you want to monitored. Any time, the file changes, a log will be generated,
WMI Classes	Run a WMI command and collect its output	Select Category and then select the class Select WMI Class Attributes Specify how often the command needs to run Note: you may need to write a parser in FortiSIEM to get accurate attribute based reporting
Powershell Script	Run Powershell command and send its output	Enter a Powershell script Specify how often the Powershell script needs to run Note: you may need to write a parser in FortiSIEM to get accurate attribute based reporting

iii.  Click Apply to save the template iv.  Click Save

3. Associate Windows Computers with proper license and one or more Templates (Starting with release 2.0) and one or more collectors (starting with release 2.1)
   1. Click Associate License / Templates.
   2. Click Search to find the list of computers to apply the license/templates to
      1. Choose Simple or Advanced
      2. For Simple mode
         1. Select the field to Search in. Possible choices are Computer, OS, License Type, Template Name.
         2. Type in the string to search for in the adjacent edit box.
         3. Click Find.
         4. The list of matched computers will be displayed in the area below the Search box.
         5. Select the Computers to which license/templates would be assigned
            1. Select the header checkbox to select/unselect all
            2. Individually select/unselect the computers if needed

• For Advanced mode
  1. For searching by computer names, type the search text next to Computer.
  2. For searching by OS names, type the search text next to OS.
  3. For searching by License Types, select the desired license type from the drop down 4. For searching by Template Names, do one of the following.
     1. For exact template name matches, set Templates to ‘Specified from‘ and select one or more templates from the next drop down and select the operator: AND or OR
     2. For searching template names, set Templates to ‘Specified in‘ and type the search string
  4. Click Find.
  5. The list of matched computers will be displayed in the area below the Search boxSelect a Template for a Computer.
  6. Select the Computers to which license/templates would be assigned
  7. Select the header checkbox to select/unselect all
  8. Individually select/unselect the computers if needed
  9. Make sure the list of computers in view are correct for the license/template assignment and are checked. d. Click Assign

1. License Assignment

Select License Type: Basic or Advanced or None

Click Assign

1. Template Assignment

Select Template(s) from drop down list

Click Validate

Click Assign. The display would reflect the assignment.

Click Unassign to remove the template from the computer. The display would reflect the modification.

• Collector Assignment

Select Collector and then choose a set of Collectors from the drop down

Click Associate to assign the collectors to the Computers. The display would reflect the assignment.

Click Dissociate to remove the template from the computer. The display would reflect the modification. Click Associate remaining to assign the remaining collectors to the Computers e.  Click Close

License and Template Assignments in Agent Manager via Export/Import

1. Logon to Agent Manager
2. Go to Dashboard and make sure that the Agents are showing up
3. Click Export – a list of Agents Computer name, Assigned license and Assigned template will be exported to a CSV formatted file named ‘ExportedAgentAssociation.csv’ in the directory ProgramData|AccelOps|
4. Edit the CSV file to associate the right license type and monitoring template to each computer. Do not add any new computer or edit computer. Every computer known to the Agent Manager will be present in the csv file.
5. Click Import and put the CSV file in the Open file Dialog
6. Once Import finishes, a dialog will tell you the number of records processed and successfully updated.
7. Click Assign Licenses to Computers to see the License assignments
8. Click Associate Computers with Templates to see Template assignments
9. Any warnings during import operations will be recorded in <CSVFilename>-<Date>-<Time>.log file in the directory ProgramData |AccelOps|

Verify Events in FortiSIEM

1. Log on to FortiSIEM
2. Go to Analytics > Historical Search.
3. Select Filter Criteria: Structured
4. Create the following condition: Raw Event Log CONTAIN AccelOps-WUA. Click Note that all event types for all Windows Server generated logs are prefixed by AccelOps-WUA.
5. Select the following Group By
   1. Reporting Device Name
   2. Reporting IP
6. Select the following Display Fields:
   1. Reporting Device Name ii. Reporting IP

iii.  COUNT(Matched Events)

1. Run the query for last 15 minutes
2. The Query will return all hosts that reported events in the last 15 minutes.
3. To drill down further, add Event Type to both Group By and Display Fields. Then rerun the query.

Sample logs generated by FortiSIEM Windows Agents

FortiSIEM Windows Agent Manager generates Windows logs in an easy to analyze “attribute=value” style without losing any information.

Windows System logs

#Win-System-Service-Control-Manager-7036

Thu May 07 02:13:42 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-WinLo

[monitorStatus]=”Success” [eventName]=”System”

[eventSource]=”Service Control Manager” [eventId]=”7036″

[eventType]=”Information” [domain]=”” [computer]=”WIN-2008-LAW-agent”

[user]=”” [userSID]=”” [userSIDAcctType]=”” [eventTime]=”May 07 2015

10:13:41″ [deviceTime]=”May 07 2015 10:13:41″

[msg]=”The Skype Updater service entered the running state.”

 

Thu May 07 02:13:48 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-WinLo

[monitorStatus]=”Success” [eventName]=”System”

[eventSource]=”Service Control Manager” [eventId]=”7036″

[eventType]=”Information” [domain]=”” [computer]=”WIN-2008-LAW-agent”

[user]=”” [userSID]=”” [userSIDAcctType]=”” [eventTime]=”May 07 2015

10:13:47″ [deviceTime]=”May 07 2015 10:13:47″

[msg]=”The Skype Updater service entered the stopped state.”

Windows Application logs

#Win-App-MSExchangeServiceHost-2001

Thu May 07 03:05:42 2015 WIN-2008-249.ersijiu.com 10.1.2.249

AccelOps-WUA-WinLog [monitorStatus]=”Success” [eventName]=”Application”

[eventSource]=”MSExchangeServiceHost” [eventId]=”2001″

[eventType]=”Information” [domain]=”” [computer]=”WIN-2008-249.ersijiu.co

[user]=”” [userSID]=”” [userSIDAcctType]=”” [eventTime]=”May 07 2015

11:05:42″ [deviceTime]=”May 07 2015 11:05:42″

[msg]=”Loading servicelet module

Microsoft.Exchange.OABMaintenanceServicelet.dll”

 

#MSSQL

#Win-App-MSSQLSERVER-17137

Thu May 07 03:10:16 2015 WIN-2008-249.ersijiu.com 10.1.2.249

AccelOps-WUA-WinLog [monitorStatus]=”Success” [eventName]=”Application”

[eventSource]=”MSSQLSERVER” [eventId]=”17137″ [eventType]=”Information”

[domain]=”” [computer]=”WIN-2008-249.ersijiu.com” [user]=””

[userSID]=”” [userSIDAcctType]=”” [eventTime]=”May 07 2015 11:10:16″

[deviceTime]=”May 07 2015 11:10:16″

[msg]=”Starting up database ‘model’.”

Windows Security logs

#Win-Security-4624(Windows logon success)

Thu May 07 02:23:58 2015 WIN-2008-249.ersijiu.com 10.1.2.249

AccelOps-WUA-WinLog [monitorStatus]=”Success” [eventName]=”Security”

[eventSource]=”Microsoft-Windows-Security-Auditing” [eventId]=”4624″

[eventType]=”Audit Success” [domain]=””

[computer]=”WIN-2008-249.ersijiu.com” [user]=”” [userSID]=””

[userSIDAcctType]=”” [eventTime]=”May 07 2015 10:23:56″ [deviceTime]=”May 07 2015 10:23:56″ [msg]=”An account was successfully logged on.” [[Subject]][Security ID]=”S-1-0-0″ [Account Name]=”” [Account Domain]=”” [Logon ID]=”0x0″ [Logon Type]=”3″ [[New

Logon]][Security ID]=”S-1-5-21-3459063063-1203930890-2363081030-500″

[Account Name]=”Administrator” [Account Domain]=”ERSIJIU” [Logon

ID]=”0xb9bd3″ [Logon GUID]=”{00000000-0000-0000-0000-000000000000}” [[Process Information]][Process ID]=”0x0″ [Process Name]=”” [[Network

Information]][Workstation Name]=”SP171″ [Source Network

Address]=”10.1.2.171″

[Source Port]=”52409″ [[Detailed Authentication Information]][Logon Process]=”NtLmSsp” [Authentication Package]=”NTLM” [Transited

Services]=””

[Package Name (NTLM only)]=”NTLM V2″ [Key Length]=”128″ [details]=””

Windows DNS logs

#DNS Debug Logs

#AO-WUA-DNS-Started

Thu May 07 02:35:43 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DNS

[monitorStatus]=”Success”

[msg]=”5/7/2015 10:34:05 AM 20BC EVENT   The DNS server has started.”

 

#AO-WUA-DNS-ZoneDownloadComplete

Thu May 07 02:35:43 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DNS

[monitorStatus]=”Success” [msg]=”5/7/2015 10:34:05 AM 20BC EVENT The DNS server has finished the background loading of zones. All zones ar now available for DNS updates and zone transfers, as allowed by their individual zone configuration.”

#AO-WUA-DNS-A-Query-Success

Thu May 07 02:48:25 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DNS

[monitorStatus]=”Success” [msg]=”5/7/2015

10:47:13 AM 5D58 PACKET  0000000002B74600 UDP Rcv 10.1.20.232  0002   Q

[0001   D   NOERROR] A      (8)testyjyj(4)yjyj(3)com(0)”

Thu May 07 02:48:25 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DNS

[monitorStatus]=”Success” [msg]=”5/7/2015

10:47:13 AM 5D58 PACKET  0000000002B74600 UDP Snd 10.1.20.232     0002 R

[8085 A DR  NOERROR] A      (8)testyjyj(4)yjyj(3)com(0)”

 

#AO-WUA-DNS-PTR-Query-Success

Thu May 07 02:48:25 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DNS

[monitorStatus]=”Success” [msg]=”5/7/2015

10:47:22 AM 5D58 PACKET  00000000028AB4B0 UDP Rcv 10.1.20.232 0002   Q [0

D   NOERROR] PTR

(3)223(3)102(3)102(3)102(7)in-addr(4)arpa(0)”

Thu May 07 02:48:25 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DNS

[monitorStatus]=”Success” [msg]=”5/7/2015

10:47:22 AM 5D58 PACKET  00000000028AB4B0 UDP Snd 10.1.20.232     0002 R

[8085 A DR  NOERROR] PTR

(3)223(3)102(3)102(3)102(7)in-addr(4)arpa(0)”

 

#DNS System Logs

#Win-App-DNS-2(DNS Server started)

Thu May 07 02:39:17 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-WinLo

[monitorStatus]=”Success”

[eventName]=”DNS Server” [eventSource]=”DNS” [eventId]=”2″

[eventType]=”Information” [domain]=”” [computer]=”WIN-2008-LAW-agent”

[user]=”” [userSID]=”” [userSIDAcctType]=”” [eventTime]=”May 07 2015

10:39:17″ [deviceTime]=”May 07 2015 10:39:17″

[msg]=”The DNS server has started.”

#Win-App-DNS-3(DNS Server shutdown)

Thu May 07 02:39:16 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-WinLo

Windows DHCP logs

AO-WUA-DHCP-Generic

Thu May 07 05:44:44 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DHCP

[monitorStatus]=”Success” [ID]=”00″ [Date]=”05/07/15″

[Time]=”13:44:08″ [Description]=”Started” [IP Address]=”” [Host Name]=””

[MAC Address]=”” [User Name]=”” [ TransactionID]=”0″

[ QResult]=”6″ [Probationtime]=”” [ CorrelationID]=”” [Dhcid.]=””

 

#AO-WUA-DHCP-IP-ASSIGN

Thu May 07 05:56:41 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DHCP

[monitorStatus]=”Success” [ID]=”10″ [Date]=”05/07/15″

[Time]=”13:56:37″ [Description]=”Assign” [IP Address]=”10.1.2.124″ [Host

Name]=”Agent-247.yj” [MAC Address]=”000C2922118E”

[User Name]=”” [ TransactionID]=”2987030242″ [ QResult]=”0″

[Probationtime]=”” [ CorrelationID]=”” [Dhcid.]=””

 

#AO-WUA-DHCP-Generic(Release)

Thu May 07 05:56:41 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DHCP

[monitorStatus]=”Success” [ID]=”12″ [Date]=”05/07/15″

[Time]=”13:56:33″ [Description]=”Release” [IP Address]=”10.1.2.124″

[Host Name]=”Agent-247.yj” [MAC Address]=”000C2922118E”

[User Name]=”” [ TransactionID]=”2179405838″ [ QResult]=”0″

[Probationtime]=”” [ CorrelationID]=”” [Dhcid.]=””

 

#AO-WUA-DHCP-IP-LEASE-RENEW

Wed Feb 25 02:53:28 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DHCP

[monitorStatus]=”Success” [ID]=”11″ [Date]=”02/25/15″

[Time]=”10:53:19″ [Description]=”Renew” [IP Address]=”10.1.2.123″ [Host

Name]=”WIN-2008-249.yj” [MAC Address]=”0050568F1B5D”

[User Name]=”” [ TransactionID]=”1136957584″ [ QResult]=”0″

[Probationtime]=”” [ CorrelationID]=”” [Dhcid.]=””

Windows IIS logs

 

#AO-WUA-IIS-Web-Request-Success

Thu May 07 03:49:23 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-IIS

[monitorStatus]=”Success” [date]=”2015-05-07″

[time]=”03:44:28″ [s-sitename]=”W3SVC1″

[s-computername]=”WIN-2008-LAW-AG” [s-ip]=”10.1.2.242″ [cs-method]=”GET”

[cs-uri-stem]=”/welcome.png” [cs-uri-query]=”-” [s-port]=”80″

[cs-username]=”-” [c-ip]=”10.1.20.232″ [cs-version]=”HTTP/1.1″

[cs(User-Agent)]=”Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.36

+(KHTML,+like+Gecko)+Chrome/42.0.2311.135+Safari/537.36″

[cs(Cookie)]=”-” [cs(Referer)]=”http://10.1.2.242/”

[cs-host]=”10.1.2.242″ [sc-status]=”200″ [sc-substatus]=”0″

[sc-win32-status]=”0″

[sc-bytes]=”185173″ [cs-bytes]=”324″ [time-taken]=”78″ [site]=”Default

Web Site” [format]=”W3C”

 

#AO-WUA-IIS-Web-Client-Error

Thu May 07 03:49:23 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-IIS

[monitorStatus]=”Success” [date]=”2015-05-07″ [time]=”03:44:37″

[s-sitename]=”W3SVC1″ [s-computername]=”WIN-2008-LAW-AG”

[s-ip]=”10.1.2.242″ [cs-method]=”GET” [cs-uri-stem]=”/wrongpage”

[cs-uri-query]=”-”

[s-port]=”80″ [cs-username]=”-” [c-ip]=”10.1.20.232″

[cs-version]=”HTTP/1.1″

[cs(User-Agent)]=”Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.36

+(KHTML,+like+Gecko)+Chrome/42.0.2311.135+Safari/537.36″

[cs(Cookie)]=”-” [cs(Referer)]=”-” [cs-host]=”10.1.2.242″

[sc-status]=”404″

[sc-substatus]=”0″ [sc-win32-status]=”2″ [sc-bytes]=”1382″

[cs-bytes]=”347″ [time-taken]=”0″ [site]=”Default Web Site”

[format]=”W3C”

 

#AO-WUA-IIS-Web-Forbidden-Access-Denied

Thu May 07 03:30:39 2015 WIN-2008-249.ersijiu.com 10.1.2.249

AccelOps-WUA-IIS [monitorStatus]=”Success” [date]=”2015-05-07″

[time]=”03:30:15″

[s-ip]=”10.1.2.249″ [cs-method]=”POST”

[cs-uri-stem]=”/AOCACWS/AOCACWS.svc” [cs-uri-query]=”-” [s-port]=”80″

[cs-username]=”-”

[c-ip]=”10.1.2.42″ [cs(User-Agent)]=”-” [sc-status]=”403″ [sc-substatus]=”4″ [sc-win32-status]=”5″ [time-taken]=”1″

[site]=”Default Web Site”

[format]=”W3C”

Windows DFS logs

#Win-App-DFSR-1002

Thu May 07 03:01:12 2015 WIN-2008-LAW-agent 10.1.2.242

AccelOps-WUA-WinLog [monitorStatus]=”Success” [eventName]=”DFS

Replication”

[eventSource]=”DFSR” [eventId]=”1002″ [eventType]=”Information”

[domain]=”” [computer]=”WIN-2008-LAW-agent” [user]=”” [userSID]=””

[userSIDAcctType]=”” [eventTime]=”May 07 2015 11:01:12″ [deviceTime]=”May 07 2015 11:01:12″ [msg]=”The DFS Replication service is starting.”

#Win-App-DFSR-1004

Thu May 07 03:01:12 2015 WIN-2008-LAW-agent 10.1.2.242

AccelOps-WUA-WinLog [monitorStatus]=”Success” [eventName]=”DFS

Replication”

[eventSource]=”DFSR” [eventId]=”1004″ [eventType]=”Information”

[domain]=”” [computer]=”WIN-2008-LAW-agent” [user]=”” [userSID]=””

[userSIDAcctType]=”” [eventTime]=”May 07 2015 11:01:12″ [deviceTime]=”May 07 2015 11:01:12″ [msg]=”The DFS Replication service has started.”

#Win-App-DFSR-1006

Thu May 07 03:01:10 2015 WIN-2008-LAW-agent 10.1.2.242

AccelOps-WUA-WinLog [monitorStatus]=”Success” [eventName]=”DFS

Replication”

[eventSource]=”DFSR” [eventId]=”1006″ [eventType]=”Information”

[domain]=”” [computer]=”WIN-2008-LAW-agent” [user]=”” [userSID]=””

[userSIDAcctType]=”” [eventTime]=”May 07 2015 11:01:10″ [deviceTime]=”May 07 2015 11:01:10″ [msg]=”The DFS Replication service is stopping.”

#Win-App-DFSR-1008

Thu May 07 03:01:11 2015 WIN-2008-LAW-agent 10.1.2.242

AccelOps-WUA-WinLog [monitorStatus]=”Success” [eventName]=”DFS

Replication”

[eventSource]=”DFSR” [eventId]=”1008″ [eventType]=”Information”

[domain]=”” [computer]=”WIN-2008-LAW-agent” [user]=”” [userSID]=””

[userSIDAcctType]=”” [eventTime]=”May 07 2015 11:01:11″ [deviceTime]=”May 07 2015 11:01:11″ [msg]=”The DFS Replication service has stopped.”

Windows file content monitoring logs

Windows File integrity monitoring logs

#AO-WUA-FileMon-Added

Thu May 07 05:30:59 2015 WIN-2008-LAW-agent 10.1.2.242

AccelOps-WUA-FileMon [monitorStatus]=”Success” [userId]=”Administrator”

[eventTime]=”May 07 2015 05:30:58″ [fileName]=”C:\\test\\New Text

Document.txt” [osObjAction]=”Added”

[hashCode]=”d41d8cd98f00b204e9800998ecf8427e”

[msg]=””

 

#AO-WUA-FileMon-Renamed-New-Name

Thu May 07 05:31:02 2015 WIN-2008-LAW-agent 10.1.2.242

AccelOps-WUA-FileMon [monitorStatus]=”Success” [userId]=”Administrator”

[eventTime]=”May 07 2015 05:30:58″ [fileName]=”C:\\test\\test.txt”

[osObjAction]=”Renamed [New Name]”

[hashCode]=”d41d8cd98f00b204e9800998ecf8427e”

[msg]=””

 

#AO-WUA-FileMon-Renamed-Old-Name

Thu May 07 05:31:02 2015 WIN-2008-LAW-agent 10.1.2.242

AccelOps-WUA-FileMon [monitorStatus]=”Success” [userId]=”Administrator”

[eventTime]=”May 07 2015 05:31:01″ [fileName]=”C:\\test\\New Text

Document.txt” [osObjAction]=”Renamed [Old Name]” [hashCode]=””

[msg]=””

 

#AO-WUA-FileMon-Modified

Thu May 07 05:31:14 2015 WIN-2008-LAW-agent 10.1.2.242

AccelOps-WUA-FileMon [monitorStatus]=”Success” [userId]=”Administrator”

[eventTime]=”May 07 2015 05:31:13″ [fileName]=”C:\\test\\test.txt”

[osObjAction]=”Modified” [hashCode]=”23acb5410a432f14b141656c2e70d104″

[msg]=””

 

#AO-WUA-FileMon-Removed

Thu May 07 05:31:29 2015 WIN-2008-LAW-agent 10.1.2.242

AccelOps-WUA-FileMon [monitorStatus]=”Success” [userId]=”Administrator”

[eventTime]=”May 07 2015 05:31:27″ [fileName]=”C:\\test\\test.txt”

[osObjAction]=”Removed” [hashCode]=”” [msg]=””

 

Windows Installed Software logs

Windows Registry change logs

#AO-WUA-Registry-Modified

Thu May 07 04:01:58 2015 WIN-2008-249.ersijiu.com 10.1.2.249

AccelOps-WUA-Registry [monitorStatus]=”Success”

[regKeyPath]=”HKLM\\SOFTWARE\\Microsoft\\ExchangeServer\\v14\\ContentInde

CatalogHealth\\{0d2a342a-0b15-4995-93db-d18c3df5860d}”

[regValueName]=”TimeStamp” [regValueType]=”1″

[osObjAction]=”Modified”

[oldRegValue]=”MgAwADEANQAtADAANQAtADAANwAgADAAMwA6ADQAOQA6ADQANwBaAAAA” [newRegValue]=”MgAwADEANQAtADAANQAtADAANwAgADAANAA6ADAAMQA6ADQAOABaAAAA”

 

#AO-WUA-Registry-Removed

Thu May 07 05:25:09 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-Regis

[monitorStatus]=”Success”

[regKeyPath]=”HKLM\\SOFTWARE\\RegisteredApplications” [regValueName]=”Sky

[regValueType]=”1″ [osObjAction]=”Removed”

[oldRegValue]=”UwBPAEYAVABXAEEAUgBFAFwAQwBsAGkAZQBuAHQAcwBcAEkAbgB0AGUAcg

GUAdAAgAEMAYQBsAGwAXABTAGsAeQBwAGUAXABDAGEAcABhAGIAaQBsAGkAdABpAGUAcwBkAG

ABoAGQAaABkAGgAZABoAGQAAAA=” [newRegValue]=””

Windows WMI logs

#AO-WUA-WMI-Win32_Processor

Thu May 07 03:53:33 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-WMI

[monitorStatus]=”Success”  [__CLASS]=”Win32_Processor”

[AddressWidth]=”64″ [Architecture]=”9″ [Availability]=”3″ [Caption]=”Inte

Family 6 Model 26 Stepping 5″ [ConfigManagerErrorCode]=””

[ConfigManagerUserConfig]=”” [CpuStatus]=”1″

[CreationClassName]=”Win32_Processor” [CurrentClockSpeed]=”2266″

[CurrentVoltage]=”33″

[DataWidth]=”64″ [Description]=”Intel64 Family 6 Model 26 Stepping 5″

[DeviceID]=”CPU0″ [ErrorCleared]=”” [ErrorDescription]=””

[ExtClock]=”” [Family]=”12″ [InstallDate]=”” [L2CacheSize]=”0″

[L2CacheSpeed]=”” [L3CacheSize]=”0″ [L3CacheSpeed]=”0″

[LastErrorCode]=”” [Level]=”6″ [LoadPercentage]=”8″

[Manufacturer]=”GenuineIntel” [MaxClockSpeed]=”2266″

[Name]=”Intel(R) Xeon(R) CPU           E5520  @ 2.27GHz” [NumberOfCores]=

[NumberOfLogicalProcessors]=”1″

[OtherFamilyDescription]=”” [PNPDeviceID]=””

[PowerManagementCapabilities]=”” [PowerManagementSupported]=”0″

[ProcessorId]=”0FEBFBFF000106A5″ [ProcessorType]=”3″ [Revision]=”6661″

[Role]=”CPU” [SocketDesignation]=”CPU socket #0″

[Status]=”OK” [StatusInfo]=”3″ [Stepping]=””

[SystemCreationClassName]=”Win32_ComputerSystem”

[SystemName]=”WIN-2008-LAW-AG”

UniqueId]=”” [UpgradeMethod]=”4″ [Version]=”” [VoltageCaps]=”2″

Windows Powershell logs

Configuring External Systems for Discovery, Monitoring and Log Collection

Ports Used by FortiSIEM for Discovery and Monitoring

These ports are used by FortiSIEM to discover devices, pull metrics and process event logs.

Ports	Services	Super	Worker	Collector
UDP/514	UDP syslog	x	x	x
TCP/1470	TCP syslog	x	x	x
UDP/6514	UDP syslog over TLS	x	x	x
TCP/6514	TCP syslog over TLS	x	x	x
UDP/2055	netflow	x	x	x
TCP/22	ssh	x	x	x
TCP/5480	HTTP Registration			x
ICMP		x	x	x
TCP/21	FTP (Receiving Bluecoat logs via ftp)	x	x	x
TCP/5432	postgresql	x
UDP/111, TCP/111	NFS portmapper	x	x
TCP/7900	phMonitor	x	x
TCP/7914	phParser	x	x
TCP/7916	phQueryWorker	x	x
TCP/7918	phQueryMaster	x	x
TCP/7920	phDataManager	x	x
TCP/7922	phRuleMaster	x	x
TCP/7924	phRuleWorker	x	x
TCP/7926	phAgentManager	x	x
TCP/7928	phDiscover	x	x
TCP/7930	phCheckpoint	x	x
TCP/7932	phReportWorker	x	x
TCP/7934	phReportMaster	x	x
TCP/7936	phEventPackager	x	x
TCP/7938	phIpIdentityMaster	x	x
TCP/7940	phIpIdentityWorker	x	x
TCP/110	POP3	x
TCP/135	WMI	x	x	x
TCP/143	IMAP	x
UDP/161	SNMP	x	x	x
UDP/162	SNMP TRAP	x	x	x
TCP/389	LDAP	x	x	x
TCP/443	HTTPS	x	x	x
TCP/993	IMAP/SSL	x
TCP/995	POP/SSL	x
TCP/1433	JDBC	x	x	x
UDP/8686	JMX	x	x	x
TCP/18184	Checkpoint LEA	x	x	x
TCP/18190	Checkpoint CPMI Port	x	x	x

 

Supported Devices and Applications by Vendor

Vendor	Model	Discovery Overview	Performance Monitoring Overview	Log Analysis Overview	Configuration Change monitoring	Details
AirTight Networks	SpectraGuard	Discovered via LOG only	Not natively supported – Custom monitoring needed	CEF format: Over 125 event types parsed covering various Wireless suspicious activities	Currently not natively supported	AirTight Networks SpectraGuard
Alcatel	TiMOS Routers and Switches	SNMP: OS, Hardware	SNMP: CPU, memory, interface utilization, hardware status	Not natively supported – Custom parsing needed	Currently not natively supported	Alcatel TiMOS and AOS Switch Configuration
Alcatel	AOS Routers and Switches	SNMP: OS, Hardware	SNMP: CPU, memory, interface utilization, hardware status	Not natively supported – Custom parsing needed	Currently not natively supported	Alcatel TiMOS and AOS Switch Configuration
Alertlogic	IPS	Discovered via LOG only	Currently not natively supported	AlertLogic API – Snort event types	Currently not natively supported
Amazon	AWS Servers	AWS API: Server Name, Access IP, Instance ID, Image Type, Availability Zone	CloudWatch API: System Metrics: CPU, Disk I/O, Network	CloudTrail API: Over 325 event types parsed covering various AWS activities	CloudTrail API: various administrative changes on AWS systems and users	AWS CloudWatch AWS CloudTrail
Amazon	AWS Elastic Block Storage (EBS)	CloudWatch API: Volume ID, Status, Attach Time	CloudWatch API: Read/Write Bytes, Ops, Disk Queue	Covered via CloudTrail API	Covered via CloudTrail API	AWS EBS and RDS
Amazon	AWS Relational Database Storage (RDS)		CloudWatch API: CPU, Connections, Memory, Swap, Read/Write Latency and Ops	Currently not natively supported	Covered via CloudTrail API	AWS EBS and RDS
Amazon	Elastic Load Balancer (ELB)		Currently not natively supported	HTTP(S) Access logs – Management logs – Covered via CloudTrail API	Covered via CloudTrail API
Apache	Tomcat Application Server	JMX:  Version	JMX: CPU, memory, servlet, session, database, threadpool, request processor metrics	Currently not natively supported – Custom parsing needed	Currently not natively supported	Apache Tomcat
Apache	Apache Web server	SNMP: Process name	SNMP: process level cpu, memory HTTPS via the mod-status module: Apache level metrics	Syslog: W3C formatted access logs – per HTTP(S) connection: Sent Bytes, Received Bytes, Connection Duration	Currently not natively supported	Apache Web Server
APC	NetBotz Environmental Monitor	SNMP: Host name, Hardware model, Network interfaces	SNMP: Temperature, Relative Humidity, Airflow, Dew point, Current, Door switch sensor etc.	SNMP Trap: Over 125 SNMP Trap event types parsed covering various environmental exception conditions	Currently not natively supported	APC Netbotz
APC	UPS	SNMP: Host name, Hardware model, Network interfaces	SNMP: UPS metrics	SNMP Trap: Over 49 SNMP Trap event types parsed covering various environmental exception conditions	Currently not natively supported	APC UPS
Arista Networks	Routers and Switches	SNMP: OS, Hardware SSH: configuration, running processes	SNMP: CPU, Memory, Interface utilization, Hardware Status	Syslog and NetFlow	SSH: Running config, Startup config	Arista Router and Switch
Aruba Networks	Aruba Wireless LAN	SNMP: Controller OS, hardware, Access Points	SNMP: Controller CPU, Memory, Interface utilization, Hardware Status SNMP: Access Point Wireless Channel utilization, noise metrics, user count	SNMP Trap: Over 165 event types covering Authentication, Association, Rogue detection, Wireless IPS events	Currently not natively supported	Aruba WLAN
Aruba Networks	ClearPass Policy Manager	Discovery via LOG	Currently not natively supported	Syslog: Successful and failed AAA authentication, warnings and errors	Currently not natively supported
Aruba Networks	Switches	SNMP: OS, Hardware	SNMP: Uptime, Interface utilization	Currently not natively supported – Custom parsing needed	Currently not natively supported
Avaya	Call Manager	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization, Hardware Status	CDR: Call Records	Currently not natively supported	Avaya Call Manager

 

Avaya	Session Manager	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization, Hardware Status	Currently not natively supported – Custom parsing needed	Currently not natively supported
Barracuda Networks	Spam Firewall	Discovery via LOG	Currently not natively supported	Syslog: Over 20 event types covering mail scanning and filtering activity	Currently not natively supported	Barracuda Spam
Bit9	Security platform	Discovery via LOG	Currently not natively supported	Syslog: Over 259 event types covering various file monitoring activities	Currently not natively supported	Bit9 Security Platform
Bit9	Carbon Black	Currently not natively supported	Currently not natively supported	Syslog: File monitoring watch list hit	Currently not natively supported
Blue Coat	Security Gateway Versions v4.x and later	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization, Proxy performance metrics	Syslog: Admin access to Security Gateway SFTP: Proxy traffic analysis	Currently not natively supported	Blue Coat Web Proxy
Box.com	Cloud Storage	Currently not natively supported	Currently not natively supported	Box.com API: File creation, deletion, modify, file sharing	Currently not natively supported	Box.com
Brocade	SAN Switch	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization	Currently not natively supported	Currently not natively supported	Brocade SAN Switch
Brocade	ServerIron ADX switch	SNMP: Host name, serial number, hardware	SNMP: Uptime, CPU, Memory, Interface Utilization, Hardware status, Real Server Statistics	Currently not natively supported	Currently not natively supported	Brocade ADX
Brocade	NetIron CER Switches	SNMP: Host name, serial number, hardware	SNMP: Uptime, CPU, Memory, Interface Utilization, Hardware status, Real Server Statistics	Currently not natively supported	Currently not natively supported	Brocade NetIron CER Routers
CentOS / Other Linux distributions	Linux	SNMP: OS, Hardware, Software, Processes, Open Ports SSH: Hardware details, Linux distribution	SNMP: CPU, Memory, Disk, Interface utilization, Process monitoring, Process stop/start, Port up/down SSH: Disk I/O, Paging	Syslog: Situations covering Authentication Success/Failure, Privileged logons, User/Group Modification SSH: File integrity monitoring, Command output monitoring, Target file monitoring AccelOps LinuxFileMon Agent: File integrity monitoring	SSH: File integrity monitoring, Target file monitoring Agent: File integrity monitoring	Linux Server
CentOS / Other Linux distributions	DHCP Server	Currently not natively supported	Currently not natively supported	Syslog: DHCP activity (Discover, Offer, Request, Release etc) – Used in Identity and Location	Not Applicable	Linux DHCP
Checkpoint	FireWall-1 versions NG, FP1, FP2, FP3, AI R54, AI R55, R65, R70, R77, NGX, and R75	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization	LEA from SmartCenter or Log Server: Firewall Log, Audit trail, over 940 IPS Signatures	LEA: Firewall Audit trail	Check Point Provider-1 Firewall
Checkpoint	Provider-1 versions NG, FP1, FP2, FP3, AI R54, AI R55, R65, R70, R77, NGX, and R75	Currently not natively supported	Currently not natively supported	LEA: Firewall Log, Audit trail	LEA: Firewall Audit trail	Check Point Provider-1
Checkpoint	VSX	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization	LEA from SmartCenter or Log Server: Firewall Log, Audit trail	LEA: Firewall Audit trail	Check Point Provider-1
Citrix	NetScaler Application Delivery Controller	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization, Hardware Status, Application Firewall metrics	Syslog: Over 465 event types covering admin activity, application firewall events, health events	Currently not natively supported	Citrix Netscaler
Citrix	ICA	SNMP: Process Utilization	SNMP: Process Utilization WMI: ICA Session metrics	Currently not natively supported	Currently not natively supported	Citrix ICA
Cisco	ASA Firewall (single and multi-context) version 7.x and later	SNMP: OS, Hardware SSH: interface security level needed for parsing traffic logs, Configuration	SNMP: CPU, Memory, Interface utilization, Firewall Connections, Hardware Status	Syslog: Over 1600 event types parsed for situations covering admin access, configuration change, traffic log, IPS activity NetFlow V9: Traffic log	SSH: Running config, Startup config	Cisco ASA

 

Cisco	PIX Firewall	SNMP: OS, Hardware SSH: interface security level needed for parsing traffic logs, Configuration	SNMP: CPU, Memory, Interface utilization, Connections, Hardware Status	Syslog: Over 1600 event types parsed for situations covering admin access, configuration change, traffic log, IPS activity	SSH: Running config, Startup config	Cisco ASA
Cisco	FWSM	SNMP: OS, Hardware SSH: interface security level needed for parsing traffic logs, Configuration	SNMP: CPU, Memory, Interface utilization, Connections, Hardware Status	Syslog: Over 1600 event types parsed for situations covering admin access, configuration change, traffic log, IPS activity	SSH: Running config, Startup config	Cisco ASA
Cisco	IOS based Routers and Switches	SNMP: OS, Hardware SSH: configuration, running process, Layer 2 connectivity	SNMP: CPU, Memory, Interface utilization, Hardware Status SNMP: IP SLA metrics SNMP: BGP metrics, OSPF metrics SNMP: Class based QoS metrics SNMP: NBAR metrics	Syslog: Over 200 event types parsed for situations covering admin access, configuration change, interface up/down, BGP interface up/down, traffic log, IPS activity NetFlow V5, V9: Traffic logs	SSH: Running config, Startup config	Cisco IOS
Cisco	CatOS based Switches	SNMP: OS, Hardware (Serial Number, Image file, Interfaces, Components) SSH: configuration running process	SNMP: CPU, Memory, Interface utilization, Hardware Status	Syslog: Over 700 event types parsed for situations covering admin access, configuration change, interface up/down, BGP interface up/down, traffic log, IPS activity NetFlow V5, V9: Traffic logs	SSH: Running config, Startup config	Cisco IOS
Cisco	Nexus OS based Routers and Switches	SNMP: OS, Hardware SSH: configuration running process, Layer 2 connectivity	SNMP: CPU, Memory, Interface utilization, Hardware Status SNMP: IP SLA metrics, BGP metrics, OSPF metrics, NBAR metrics SNMP: Class based QoS metrics	Syslog: Over 3500 event types parsed for situations covering admin access, configuration change, interface up/down, BGP interface up/down, traffic log, hardware status, software and hardware errors NetFlow V5, V9: Traffic logs	SSH: Running config, Startup config	Cisco NX-OS
Cisco	300 Series Switches (SF 300, SG300/350 etc)	SNMP: OS, Hardware	SNMP: Interface utilization,	Currently not natively supported	Currently not natively supported	Cisco 300 Series Routers
Cisco	ONS	SNMP: OS, Hardware		SNMP Trap: Availability and Performance Alerts		Cisco NX-OS
Cisco	ACE Application Firewall	SNMP: OS, Hardware
Cisco	UCS Server	UCS API: Hardware components processors, chassis, blades, board, cpu, memory, storage, power supply unit, fan unit	UCS API: Chassis Status, Memory Status, Processor Status, Power Supply status, Fan status	Syslog: Over 500 event types parsed for situations covering hardware errors, internal software errors etc	Currently not natively supported	Cisco UCS
Cisco	WLAN Controller and Access Points	SNMP: OS, Hardware, Access Points	SNMP: Controller CPU, Memory, Interface utilization, Hardware Status SNMP: Access Point Wireless Channel utilization, noise metrics, user count	SNMP Trap: Over 88 event types parsed for situations covering Authentication, Association, Rogue detection, Wireless IPS events	Currently not natively supported	Cisco Wireless LAN
Cisco	Call Manager	SNMP: OS, Hardware, VoIP Phones	SNMP: Call manager CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage SNMP: VoIP phone count, Gateway count, Media Device count, Voice mail server count  and SIP Trunks count SNMP: SIP Trunk Info, Gateway Status Info, H323 Device Info, Voice Mail Device Info, Media Device Info, Computer Telephony Integration (CTI) Device Info	Syslog: Over 950 messages from Cisco Call Manager as well as Cisco Unified Real Time Monitoring Tool (RTMT) CDR Records, CMR Records: Call Source and Destination, Time, Call Quality metrics (MOS Score, Jitter, latency)	Currently not natively supported	Cisco Call Manager

 

Cisco	Contact Center	SNMP: OS, Hardware	SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change	Currently not natively supported – Custom parsing needed	Currently not natively supported	Cisco Contact Center
Cisco	Presence Server	SNMP: OS, Hardware	SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change	Currently not natively supported – Custom parsing needed	Currently not natively supported	Cisco Presence Server
Cisco	Tandeberg Tele-presence Video Communication Server (VCS)	SNMP: OS, Hardware	SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change	Currently not natively supported – Custom parsing needed	Currently not natively supported	Cisco Tandeberg Telepresence VCS
Cisco	Tandeberg Tele-presence Multiple Control Unit (MCU)	SNMP: OS, Hardware	SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change	Currently not natively supported – Custom parsing needed	Currently not natively supported	Cisco Telepresence MCU
Cisco	Unity Connection	SNMP: OS, Hardware	SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change	Currently not natively supported – Custom parsing needed	Currently not natively supported	Cisco Unity
Cisco	IronPort Mail Gateway	SNMP: OS, Hardware	SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change	Syslog: Over 45 event types covering mail scanning and forwarding status	Currently not natively supported	Cisco IronPort Mail
Cisco	IronPort Web Gateway	SNMP: OS, Hardware	SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change	W3C Access log (Syslog): Over 9 event types covering web request handling status	Currently not natively supported	Cisco IronPort Web
Cisco	Cisco Network IPS Appliances	SNMP: OS, Hardware	SNMP: CPU, Memory, Disk Interface utilization, Hardware Status	SDEE: Over 8000 IPS signatures	Currently not natively supported	Cisco NIPS
Cisco	Sourcefire 3D and Defense Center	SNMP: OS, Hardware				Sourcefire 3D and Defense Center
Cisco	FireSIGHT Console			eStreamer SDK: Intrusion events, Malware events, File events, Discovery events, User activity events, Impact flag events		Cisco FireSIGHT
Cisco	Cisco Security Agent	SNMP or WMI: OS, Hardware	SNMP or WMI: Process CPU and memory utilization	SNMP Trap: Over 25 event types covering Host IPS behavioral signatures.	Currently not natively supported	Cisco CSA
Cisco	Cisco Access Control Server (ACS)	SNMP or WMI: OS, Hardware	SNMP or WMI: Process CPU and memory utilization	Syslog: Passed and Failed authentications, Admin accesses	Currently not natively supported	Cisco ACS
Cisco	VPN 3000	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization	Syslog: Successful and Failed Admin Authentication, VPN Authentication, IPSec Phase 1 and Phase 2 association, VPN statistics	Currently not natively supported	Cisco VPN 3000
Cisco	Meraki Cloud Controllers	SNMP: OS, Hardware, Meraki devices reporting to the Cloud Controller	SNMP: Uptime, Network Interface Utilization SNMP Trap: Various availability scenarios	Currently not natively supported – Custom parsing needed	Currently not natively supported	Cisco Meraki Cloud Controller and Network Devices
Cisco	Meraki Firewalls	SNMP: OS, Hardware	SNMP: Uptime, Network Interface Utilization	Syslog: Firewall log analysis	Currently not natively supported	Cisco Meraki Cloud Controller and Network Devices
Cisco	Meraki Routers/Switches	SNMP: OS, Hardware	SNMP: Uptime, Network Interface Utilization		Currently not natively supported	Cisco Meraki Cloud Controller and Network Devices
Cisco	Meraki WLAN Access Points	SNMP: OS, Hardware	SNMP: Uptime, Network Interface Utilization		Currently not natively supported	Cisco Meraki Cloud Controller and Network Devices
Cisco	MDS Storage Switch	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization, Hardware Status	Currently not natively supported – Custom parsing needed	Currently not natively supported
Cisco	Network Control Manager (NCM)			Syslog: Network device software update, configuration analysis for compliance, admin login		Cisco Network Compliance Manager

 

Cisco	Wide Area Application Services (WAAS)	SNMP: Host name, Version, Hardware model, Network interfaces	SNMP: CPU, Memory, Interface utilization, Disk utilization, Process cpu/memory utilization			Cisco WAAS
Cisco	Application Centric Infrastructure (ACI)	Not Applicable	Not Applicable	Cisco APIC API: Faults, Events, Configuration Changes, Node/Tenant/Cluster/Application/EPG/Overall health		Cisco Application Centric Infrastructure (ACI) Configuration
Clavister	Clavister IP
Cylance	Cylance Protect Endpoint Protection			Syslog: Endpoint protection alerts		Cylance Protect
Cyphort	Cyphort Cortex Endpoint Protection			Syslog: Endpoint protection alerts		Cyphort Cortex
Dell	SonicWall Firewall	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization, Firewall session count	Syslog: Firewall log analysis (over 1000 event types)	Currently not natively supported	Dell SonicWALL
Dell	Force10 Router and Switch	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization, Interface Status, Hardware Status		SSH: Running config, Startup config	Dell Force10
Dell	NSeries Router and Switch	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization, Hardware Status		SSH: Startup config	Dell NSeries
Dell	PowerConnect Router and Switch	SNMP: OS, Hardware	SNMP: CPU, Memory, Interface utilization, Hardware Status		SSH: Startup config	Dell PowerConnect
Dell	Dell Hardware on Intel-based Servers	SNMP: Hardware	SNMP: Hardware Status: Battery, Disk, Memory, Power supply, Temperature, Fan, Amperage, Voltage		Currently not natively supported.
Dell	Compellent Storage	SNMP: OS, Hardware	SNMP: Network Interface utilization, Volume utilization, Hardware Status (Power, Temperature, Fan)		Currently not natively supported.	Dell Compellant
Dell	EqualLogic Storage	SNMP: OS, Hardware (Network interfaces, Physical Disks, Components)	SNMP: Uptime, Network Interface utilization SNMP: Hardware status: Disk, Power supply, Temperature, Fan, RAID health SNMP: Overall Disk health metrics: Tot al disk count, Active disk count, Failed disk count, Spare disk count SNMP: Connection metrics: IOPS, Throughput SNMP: Disk performance metrics: IOPS,  Throughput SNMP: Group level performance metrics: Storage, Snapshot		Currently not natively supported.	Dell EqualLogic
EMC	Clariion Storage	Naviseccli: Host name, Operating system version, Hardware model, Serial number, Network interfaces, Installed Software, Storage Controller Ports Naviseccli: Hardware components, RAID Groups and assigned disks, LUNs and LUN -> RAID Group mappings, Storage Groups and memberships	Naviseccli: Storage Processor utilization, Storage Port I/O, RAID Group I/O, LUN I/O, Host HBA Connectivity, Host HBA Unregistered Host, Hardware component health, Overall Disk health, Storage Pool Utilization		Currently not natively supported.	EMC Clarion

 

EMC	VNX Storage	Naviseccli: Host name, Operating system version, Hardware model, Serial number, Network interfaces, Installed Software, Storage Controller Ports Naviseccli: Hardware components, RAID Groups and assigned disks, LUNs and LUN -> RAID Group mappings, Storage Groups and memberships	Naviseccli: Storage Processor utilization, Storage Port I/O, RAID Group I/O, LUN I/O, Host HBA Connectivity, Host HBA Unregistered Host, Hardware component health, Overall Disk health, Storage Pool Utilization			EMC VNX
EMC	Isilon Storage	SNMP: Host name, Operating system, Hardware (Model, Serial number, Network interfaces, Physical Disks, Components	SNMP: Uptime, Network Interface metrics SNMP: Hardware component health: Disk, Power supply, Temperature, Fan, Voltage SNMP: Cluster membership change, Node health and performance (CPU, I/O), Cluster health and performance, Cluster Snapshot, Storage Quota metrics, Disk performance, Protocol performance			EMC Isilon
EMC	Data Domain	SNMP: Host name, Operating system, Hardware (Model, Serial number, Network interfaces, Physical Disks	SNMP: Interface utilization, Hardware Status SNMP: Overall Storage metrics: replication metrics, disk I/O, NFS metrics, CIFS metrics SNMP: Individual disk metrics: disk I/O, disk utilization, disk status	Currently not natively supported – Custom parsing needed	Currently not natively supported
ESET	Nod32 Anti-virus	Application type discovery via LOG		Syslog (CEF format): Virus found/cleaned type of events		ESET NOD32
FireEye	Malware Protection System (MPS)	Application type discovery via LOG		Syslog (CEF format): Malware found/cleaned type of events		FireEye MPS
FireEye	HX Appliances for Endpoint protection	Application type discovery via LOG		Syslog (CEF format): Malware Acquisition, Containment type of events
F5 Networks	Application Security Manager	Discovery via LOG		Syslog (CEF Format); Various application level attack scenarios – invalid directory access, SQL injections, cross site exploits		F5 Application Security Manager
F5 Networks	Local Traffic Manager	SNMP: Host name, Operating system, Hardware (Model, Serial number, Network interfaces, Physical Disks), Installed Software, Running Software	SNMP: CPU, Memory, Disk, Interface utilization, Process monitoring, Process stop/start	SNMP Trap: Exception situations including hardware failures, certain security attacks, Policy violations etc Syslog: Permitted and Denied Traffic		F5 Networks Local Traffic Manager
F5 Networks	Web Accelerator	Discovery via LOG		Syslog: Permitted Traffic		F5 Networks Web Accelerator
Fortinet	FortiGate firewalls	SNMP: OS, Host name, Hardware (Serial Number, Interfaces, Components)	SNMP: Uptime, CPU and Memory utilization, Network Interface metrics	Syslog: Over 3700 Traffic and system logs	SSH: Running config, Startup config	Fortinet FortiGate
Fortinet	FortiManager	SNMP: Host name, Hardware model, Network interfaces, Operating system version	SNMP: Uptime, CPU and Memory utilization, Network Interface metrics			FortiManager

 

Fortinet	FortiMail Mail Gateway	Discovery via LOG	Currently not supported	Syslog: Over 120 event types covering admin logons, configuration changes, restarts, operational errors, malware and virus, spam	Currently not natively supported	Fortinet FortiWeb
Fortinet	FortiWeb Web Gateway	SNMP: OS, Host name, Hardware (Serial Number, Interfaces)	SNMP: Uptime, CPU and Memory utilization, Network Interface metrics	Syslog: Over 450 event types covering admin logons, configuration changes, restarts, operational errors, Web attacks, HTTP Protocol anomaly	Currently not natively supported	Fortinet FortiWeb
Fortinet	FortiSandbox	SNMP: OS, Host name, Hardware (Serial Number, Interfaces)	SNMP: Uptime, CPU and Memory utilization, Network Interface metrics, Disk	Syslog: Event types covering malware, network attacks and system events	Currently not natively supported	Fortinet FortiSandbox Configuration
Fortinet	FortiDDoS	Discovery via LOG	Currently not supported	Syslog: Over 160 event types covering admin logons, configuration changes, restarts, operational errors, traffic anomaly, DDoS attacks	Currently not natively supported	FortiDDoS
Foundry Networks	IronWare Router and Switch	SNMP: OS, Hardware SSH: configuration, running process	SNMP: Uptime, CPU, Memory, Interface utilization, Hardware Status	Syslog: Over 6000 event types parsed for situations covering admin access, configuration change, interface up/down	SSH: Running config, Startup config	Foundry Networks IronWare
Google	Google Apps	Not Applicable	Not Applicable	Google Apps Admin SDK: Over 200 event types parsed for situations covering login, file access, user/group creation/modification, file creation/modifications	Not Applicable	Google Apps Audit Configuration
Huawei	VRP Router and Switch	SNMP: OS, Hardware SSH: configuration, running process, Layer 2 connectivity	SNMP: Uptime, CPU, Memory, Interface utilization, Hardware Status	Syslog: Over 30 event types parsed for situations covering admin access, configuration change, interface up/down	SSH: Running config, Startup config
HP	BladeSystem	SNMP: Host name, Access IP, Hardware components	SNMP: hardware status			HP BladeSystem
HP	HP-UX servers	SNMP: OS, Hardware	SNMP: Uptime, CPU, Memory, Network Interface, Disk space utilization, Network Interface Errors, Running Process Count, Running process CPU/memory utilization, Running process start/stop SNMP: Installed Software change SSH : Memory paging rate, Disk I/O utilization			HP UX Server
HP	HP Hardware on Intel-based Servers	SNMP: hardware model, hardware serial, hardware components (fan, power supply, battery, raid, disk, memory)	SNMP: hardware status	SNMP Trap: Over 100 traps covering hardware issues
HP	TippingPoint UnityOne IPS	SNMP: OS, Hardware	SNMP: Uptime, CPU, Memory, Network Interface,  Network Interface Errors	Syslog: Over 4900 IPS alerts directly or via NMS		TippingPoint IPS
HP	ProCurve Switches and Routers	SNMP: OS, hardware model, hardware serial, hardware components SSH: configuration	SNMP: Uptime, CPU, Memory, Network Interface,  Network Interface Errors SNMP: hardware status		SSH: Running config, Startup config	HP ProCurve
HP	Value Series (19xx) Switches and Routers	SNMP: OS, hardware model, hardware serial, hardware components SSH: configuration	SNMP: Uptime, CPU, Memory, Network Interface,  Network Interface Errors		SSH: Startup config	HP Value Series (19xx) and HP 3Com (29xx) Switch

 

HP	3Com (29xx) Switches and Routers	SNMP: OS, hardware model, hardware serial, hardware components SSH: configuration	SNMP: Uptime, CPU, Memory, Network Interface,  Network Interface Errors		SSH: Startup config	HP Value Series (19xx) and HP 3Com (29xx) Switch
HP	HP/3Com Comware Switches and Routers	SNMP: OS, hardware model, hardware serial, hardware components SSH: configuration	SNMP: Uptime, CPU, Memory, Network Interface,  Network Interface Errors SNMP: hardware status	Syslog: Over 6000 vent types parsed for situations covering admin access, configuration change, interface up/down and other hardware issues and internal errors	SSH: Startup config	HP/3Com ComWare
IBM	Websphere Application Server	SNMP or WMI: Running processes	HTTP(S): Generic Information, Availability metrics, CPU / Memory metrics, Servlet metrics, Database pool metrics, Thread pool metrics, Application level metrics, EJB metrics			IBM WebSphere
IBM	DB2 Database Server	SNMP or WMI: Running processes	JDBC: Database Audit trail: Log on, Database level and Table level CREATE/DELETE/MODIFY operations			IBM DB2
IBM	ISS Proventia IPS Appliances			SNMP Trap: IPS Alerts: Over 3500 event types		IBM ISS Proventia
IBM	AIX Servers	SNMP: OS, Hardware, Installed Software, Running Processes, Open Ports SSH: Hardware details	SNMP: CPU, Memory, Disk, Interface utilization, Process monitoring, Process stop/start, Port up/down SSH: Disk I/O, Paging	Syslog: General logs including Authentication Success/Failure, Privileged logons, User/Group Modification		IBM AIX
IBM	OS 400 (including iSeries)			Syslog via PowerTech Agent: Over 560 event types Syslog via Townsend Agent		IBM OS400
IBM	Guardium Database Firewall
Intel/McAfee	McAfee Sidewinder Firewall	SNMP: OS, Hardware, Installed Software, Running Processes	SNMP: CPU, Memory, Disk, Interface utilization, Process monitoring, Process stop/start	Syslog: Firewall logs		McAfee Firewall Enterprise (Sidewinder)
Intel/McAfee	McAfee ePO	SNMP: Related process name and parameters	SNMP: Process resource utilization	SNMP Trap: Over 170 event types		McAfee ePolicy Orchestrator (ePO)
Intel/McAfee	Intrushield IPS	SNMP: OS, Hardware	SNMP: Hardware status	Syslog: IPS Alerts		McAfee IntruShield
Intel/McAfee	Stonesoft IPS (now called Forcepoint)			Syslog: IPS Alerts		McAfee Stonesoft
Intel/McAfee	Web Gateway			Syslog: Web server log		McAfee Web Gateway
Intel/McAfee	Foundstone Vulnerability Scanner			JDBC: Vulnerability data		McAfee Foundstone Vulnerability Scanner
Infoblox	DNS/DHCP Appliance	SNMP: OS, Hardware, Installed Software, Running Processes	SNMP: Zone transfer metrics, DNS Cluster Replication metrics, DNS Performance metrics, DHCP Performance metrics, DDNS Update metrics, DHCP subnet usage metrics SNMP: Hardware Status SNMP Trap: Hardware/Software Errors	Syslog: DNS logs – name resolution activity success and failures		Infoblox DNS/DHCP
ISC	Bind DNS			Syslog: DNS logs – name resolution activity success and failures		ISC BIND DNS

 

Juniper	JunOS Router/Switch	SNMP: OS, Hardware SSH: Configuration	SNMP: CPU, Memory, Disk, Interface utilization, Hardware Status	Syslog: Over 1420 event types parsed for situations covering admin access, configuration change, interface up/down and other hardware issues and internal errors	SSH: Startup configuration	Juniper Networks JunOS
Juniper	SRX Firewalls	SNMP: OS, Hardware SSH: Configuration	SNMP: CPU, Memory, Disk, Interface utilization, Hardware Status	Syslog: Over 700 event types parsed for situations covering traffic log, admin access, configuration change, interface up/down and other hardware issues and internal errors	SSH: Startup configuration	Juniper Networks JunOS
Juniper	SSG Firewall	SNMP: OS, Hardware SSH: Configuration	SNMP: CPU, Memory, Disk, Interface utilization, Hardware Status	Syslog: Over 40 event types parsed for situations covering traffic log, admin access, configuration change, interface up/down and other hardware issues and internal errors	SSH: Startup configuration	Juniper Networks SSG Firewall
Juniper	ISG Firewall	SNMP: OS, Hardware SSH: Configuration	SNMP: CPU, Memory, Disk, Interface utilization, Hardware Status	Syslog: Over 40 event types parsed for situations covering traffic log, admin access, configuration change, interface up/down and other hardware issues and internal errors	SSH: Startup configuration	Juniper Networks SSG Firewall
Juniper	Steelbelted RADIUS	Discovered via LOG		Syslog – 4 event types covering admin access and AAA authentication		Juniper Networks Steel-Belted RADIUS
Juniper	Secure Access Gateway	SNMP: OS, Hardware	SNMP: CPU, Memory, Disk, Interface utilization	Syslog – Over 30 event types parsed for situations covering VPN login, Admin access, Configuration Change		Juniper Networks SSL VPN Gateway
Juniper	Netscreen IDP			Syslog – directly from Firewall or via NSM – Over 5500 IPS Alert types parsed		Juniper Networks IDP Series
Juniper	DDoS Secure			Syslog – DDoS Alerts		Juniper DDoS
Lantronix	SLC Console Manager			Syslog – Admin access, Updates, Commands run		Lantronix SLC Console Manager
Liebert	HVAC	SNMP: Host Name, Hardware model	SNMP: HVAC metrics: Temperature: current value, upper threshold, lower threshold, Relative Humidity: current value, upper threshold, lower threshold, System state etc			Liebert HVAC
Liebert	FPC	SNMP: Host Name, Hardware model	SNMP: Output voltage (X-N, Y-N, Z-N), Output current (X, Y. Z), Neutral Current, Ground current, Output power, Power Factor etc			Liebert FPC
Liebert	UPS	SNMP: Host Name, Hardware model	SNMP: UPS metrics: Remaining battery charge, Battery status, Time on battery, Estimated Seconds Remaining, Output voltage etc			Liebert UPS
Malwarebytes	Endpoint Protection			Syslog (CEF format): Malware detected, quarantine success and failures
Microsoft	Windows 2000, Windows 2003, Windows 2008, Windows 2008 R2, Windows 2012, Windows 2012 R2, Windows 2014, Windows 2016	SNMP: OS, Hardware (for Dell and HP), Installed Software, Running Processes WMI: OS, Hardware (for Dell and HP), BIOS, Installed Software, Running Processes, Services, Installed Patches	SNMP: CPU, Memory, Disk, Interface utilization, Process utilization WMI: SNMP: CPU, Memory, Disk, Interface utilization, Detailed CPU/Memory usage, Detailed Process utilization	WMI pulling: Security, System and Application logs AccelOps Windows Agent (HTTPS): Security, System and Application logs, File Content change Snare Agent (syslog): Security, System and Application logs Correlog Agent (syslog): Security, System and Application logs	SNMP: Installed Software Change AccelOps Windows Agent: Installed Software Change, Registry Change AccelOps Windows Agent: File Integrity Monitoring	Microsoft Windows Servers
Microsoft	DHCP Server – 2003, 2008	SNMP: Running Processes	WMI: DHCP metrics:  request rate, release rate, decline rate, Duplicate Drop rate etc	AccelOps Windows Agent (HTTPS): DHCP logs – release, renew etc Snare Agent (syslog): DHCP logs – release, renew etc Correlog Agent (syslog): DHCP logs release, renew etc		Microsoft DHCP (2003, 2008)

 

Microsoft	DNS Server – 2003, 2008	SNMP: Running Processes	WMI: DNS metrics: Requests received, Responses sent, WINS requests received, WINS responses sent, Recursive DNS queries received etc	AccelOps Windows Agent (HTTPS): DNS logs – name resolution activity Snare Agent (syslog): DNS logs – name resolution activity Correlog Agent (syslog): DNS logs – name resolution activity		Microsoft DNS (2003, 2008)
Microsoft	Domain Controller / Active Directory 2003, 2008, 2012, 2014, 2016	SNMP: Running Processes LDAP: Users	WMI: Active Directory metrics: Directory Search Rate, Read Rate, Write Rate, Browse Rate, LDAP search rate, LDAP Bind Rate etc WMI: “dcdiag -e” command output detect successful and failed domain controller diagnostic tests WMI: “repadmin /replsummary” command output – Replication statistics LDAP: Users with stale passwords, insecure password settings			Microsoft Active Directory
Microsoft	SQL Server – 2005, 2008, 2008R2, 2012, 2014	SNMP: Running Processes	SNMP or WMI: Process resource usage JDBC: General database info, Configuration Info, Backup Info, JDBC: Per-instance like Buffer cache hit ratio, Log cache hit ratio etc JDBC: per-instance, per-database Performance metrics Data file size, Log file used, Log growths etc JDBC: Locking info, Blocking info	JDBC: database error log JDBC: Database audit trail		Microsoft SQL Server
Microsoft	IIS versions	SNMP: Running Processes	SNMP or WMI: Process level resource usage WMI: IIS metrics: Current Connections, Max Connections, Sent Files, Received Files etc	AccelOps Windows Agent (HTTPS): W3C Access logs – Per instance Per Connection Sent Bytes, Received Bytes, Duration Snare Agent (syslog): W3C Access logs Correlog Agent (syslog): W3C Access logs		Microsoft IIS for Windows 2000 and 2003 Microsoft IIS for Windows 2008
Microsoft	ASP.NET	SNMP: Running Processes	SNMP or WMI: Process level resource usage WMI: Request Execution Time, Request Wait Time, Current Requests, Disconnected Requests etc			Microsoft ASP.NET
Microsoft	Internet Authentication Server (IAS)	SNMP: Running Processes	SNMP or WMI: Process level resource usage	AccelOps Windows Agent (HTTPS): AAA logs – successful and failed authentication Snare Agent (syslog): AAA logs – successful and failed authentication Correlog Agent (syslog): AAA logs successful and failed authentication		Microsoft Internet Authentication Server (IAS)
Microsoft	HyperV Hypervisor		Powershell over winexe: Guest/Host CPU usage, Memory usage, Page fault, Disk Latency, Network usage			HyperV
Microsoft	Sharepoint Server	SNMP: Running Processes	SNMP or WMI: Process level resource usage	LOGBinder Agent: SharePoint logs – Audit trail integrity, Access control changes, Document updates, List updates, Container object updates, Object changes, Object Import/Exports, Document views, Information Management Policy changes etc		Microsoft SharePoint
Microsoft	Exchange Server	SNMP: Running Processes	SNMP or WMI: Process level resource usage WMI: Exchange performance metrics, Exchange error metrics, Exchange mailbox metrics, Exchange SMTP metrics, Exchange ESE Database, Exchange Database Instances, Exchange Mail Submission Metrics, Exchange Store Interface Metrics etc			Microsoft Exchange

 

Microsoft	ISA Server	SNMP: Running Processes	SNMP or WMI: Process level resource usage	AccelOps Windows Agent (HTTPS): W3C Access logs – Per Connection – Sent Bytes, Received Bytes, Duration Snare Agent (syslog): W3C Access logs Correlog Agent (syslog): W3C Access logs		Microsoft ISA Server
Microsoft	PPTP VPN Gateway			AccelOps Windows Agent (HTTPS): VPN Access – successful and failed Snare Agent (syslog): VPN Access successful and failed Correlog Agent (syslog): VPN Access successful and failed		Microsoft PPTP
Microsoft	Office 365	Not Applicable	Not Applicable	Office365 Management Activity API: Close to 500 event types for situations covering login, file access, user/group creation/modification, file creation/modifications		Microsoft Office365 Audit Configuration
Motorola	AirDefense Wireless IDS			Syslog: Wireless IDS logs		Motorola AirDefense
Motorola	WiNG WLAN Access Point			Syslog: All system logs: User authentication, Admin authentication, WLAN attacks, Wireless link health		Motorola WLAN
Mikrotek	Mikrotech Switches and Routers	Host name, OS, Hardware model, Serial number, Components	SNMP: Uptime CPU utilization, Network Interface metrics			Mikrotek Router
NetApp	DataONTAP based Filers	SNMP: Host name, OS, Hardware model, Serial number, Network interfaces, Logical volumes, Physical Disks	SNMP: CPU utilization, Network Interface metrics, Logical Disk Volume utilization SNMP: Hardware component health, Disk health ONTAP API: Detailed NFS V3/V4, ISCSI, FCP storage IO metrics, Detailed LUN metrics, Aggregate metrics, Volume metrics, Disk performance metrics	SNMP Trap: Over 150 alerts – hardware and software alerts		NetApp Filer
Nimble	NimbleOS Storage	Host name, Operating system version, Hardware model, Serial number, Network interfaces, Physical Disks, Components	SNMP: Uptime, Network Interface metrics, Storage Disk Utilization SNMP: Storage Performance metrics: Read rate (IOPS), Sequential Read Rate (IOPS), Write rate (IOPS), Sequential Write Rate (IOPS), Read latency etc			Nimble Storage
Nessus	Vulnerability Scanner			Nessus API: Vulnerability Scan results – Scan name, Host, Host OS, Vulnerability category, Vulnerability name, Vulnerability severity, Vulnerability CVE Id and Bugtraq Id, Vulnerability CVSS Score, Vulnerability Consequence etc		Nessus Vulnerability Scanner
Nginx	Web Server	SNMP: Application name	SNMP: Application Resource Usage	Syslog: W3C access logs: per HTTP(S) connection: Sent Bytes, Received Bytes, Connection Duration		Nginx Web Server
Nortel	ERS Switches and Routers	SNMP: Host name, OS, Hardware model, Serial number, Components	SNMP: Uptime CPU/memory utilization, Network Interface metrics/errors, Hardware Status			Nortel ERS and Passport Switch
Nortel	Passport Switches and Routers	SNMP: Host name, OS, Hardware model, Serial number, Components	SNMP: Uptime CPU/memory utilization, Network Interface metrics/errors, Hardware Status			Nortel ERS and Passport Switch
Nutanix	Controller VM	SNMP: Host name, OS, Hardware model, Serial number, Network interfaces, Physical Disks, Components	SNMP: Uptime CPU/memory utilization, Network Interface metrics/errors, Disk Status, Cluster Status, Service Status, Storage Pool Info, Container Info			Nutanix
Okta.com	SSO	Okta API: Users		Okta API: Over 90 event types covering user activity in Okta website		Okta Configuration
OpenLDAP	OpenLDAP	LDAP: Users

 

Oracle	Enterprise Database Server – 10g, 11g, 12c	SNMP or WMI: Process resource usage	JDBC: Database performance metrics: Buffer cache hit ratio, Row cache hit ratio, Library cache hit ratio, Shared pool free ratio, Wait time ratio, Memory Sorts ratio etc JDBC: Database Table space information: able space name, table space type, table space  usage, table space free space, table space next extent etc JDBC: Database audit trail: Database logon, Database operations including CREATE/ALTER/DROP/TRUNCATE operations on tables, table spaces, databases, clusters, users, roles, views, table indices, triggers etc.	Syslog: Listener log, Alert log, Audit Log		Oracle Database
Oracle	MySQL Server	SNMP or WMI: Process resource usage	JDBC: User Connections, Table Updates, table Selects, Table Inserts, Table Deletes, Temp Table Creates, Slow Queries etc JDBC: Table space performance metrics: Table space name, table space type, Character set and Collation, table space  usage, table space free space etc JDBC: Database audit trail: Database log on, Database/Table CREATE/DELETE/MODIFY operations			MySQL Server
Oracle	WebLogic Application Server	SNMP or WMI: Process resource usage	JMX: Availability metrics, Memory metrics, Servlet metrics, Database metrics, Thread pool metrics, EJB metrics, Application level metrics			Oracle WebLogic
Oracle	Glassfish Application Server	SNMP or WMI: Process resource usage	JMX: Availability metrics, Memory metrics, Servlet metrics, Session metrics, Database metrics, Request processor metrics, Thread pool metrics, EJB metrics, Application level metrics, Connection metrics			Oracle GlassFish Server
Oracle	Sun SunOS and Solaris	SNMP: OS, Hardware, Software, Processes, Open Ports SSH: Hardware details	SNMP: CPU, Memory, Disk, Interface utilization, Process monitoring, Process stop/start, Port up/down SSH: Disk I/O, Paging	Syslog: Situations covering Authentication Success/Failure, Privileged logons, User/Group Modification		Sun Solaris Server
Palo Alto Networks	PAN-OS based Firewall	SNMP: Host name, OS, Hardware, Network interfaces SSH: Configuration	SNMP: Uptime, CPU utilization, Network Interface metrics, Firewall connection count	Syslog: Traffic log, Threat log (URL, Virus, Spyware, Vulnerability, File, Scan, Flood and data subtypes), config and system logs	SSH: Configuration Change	Palo Alto Firewall
PulseSecure	PulseSecure VPN			Syslog: VPN events, Traffic events, Admin events		PulseSecure
Qualys	Vulnerability Scanner			Qualys API: Vulnerability Scan results – Scan name, Host, Host OS, Vulnerability category, Vulnerability name, Vulnerability severity, Vulnerability CVE Id and Bugtraq Id, Vulnerability CVSS Score, Vulnerability Consequence etc		Qualys Vulnerability Scanner
Qualys	Web Application Firewall			syslog (JSON formatted): web log analysis		Qualys Web Application Firewall
Rapid7	NeXpose Vulnerability Scanner			Rapid7 NeXpose API: Vulnerability Scan results – Scan name, Host, Host OS, Vulnerability category, Vulnerability name, Vulnerability severity, Vulnerability CVE Id and Bugtraq Id, Vulnerability CVSS Score, Vulnerability Consequence etc		Rapid7 NeXpose Vulnerability Scanner

 

Riverbed	Steelhead WAN Accelerators	SNMP: Host name, Software version, Hardware model, Network interfaces	SNMP: Uptime, CPU / Memory / Network Interface / Disk space metrics,  Process cpu/memory utilization SNMP: Hardware Status SNMP: Bandwidth metrics: (Inbound/Outbound  Optimized Bytes – LAN side, WAN side, Connection metrics: Optimized/Pass through / Half-open optimized connections etc) SNMP: Top Usage metrics: Top source, Top destination, Top Application, Top Talker SNMP: Peer status: For every peer: State, Connection failures, Request timeouts, Max latency	SNMP Trap: About 115 event types covering software errors, hardware errors, admin login, performance issues – cpu, memory, peer latency issues Netflow: Connection statistics		Riverbed SteelHead WAN Accelerator
Redhat	Linux	SNMP: OS, Hardware, Software, Processes, Open Ports SSH: Hardware details, Linux distribution	SNMP: CPU, Memory, Disk, Interface utilization, Process monitoring, Process stop/start, Port up/down SSH: Disk I/O, Paging	Syslog: Situations covering Authentication Success/Failure, Privileged logons, User/Group Modification SSH: File integrity monitoring, Command output monitoring, Target file monitoring Agent: File integrity monitoring	SSH: File integrity monitoring, Target file monitoring Agent: File integrity monitoring	Linux Server
Redhat	JBOSS Application Server	SNMP: Process level CPU/Memory usage	JMX: CPU metrics, Memory metrics, Servlet metrics, Database pool metrics, Thread pool metrics, Application level metrics, EJB metrics			Redhat JBOSS
Redhat	DHCP Server	SNMP: Process level CPU/Memory usage		Syslog: DHCP address release/renew events		Linux DHCP
Ruckus	Wireless LAN	SNMP: Controller host name, Controller hardware model, Controller network interfaces, Associated WLAN Access Points	SNMP: Controller Uptime, Controller Network Interface metrics, Controller WLAN Statistics, Access Point Statistics, SSID performance Stats			Ruckus WLAN
Snort	IPS	SNMP: Process level CPU/Memory usage		Syslog: Over 40K IPS Alerts JDBC: Over 40K IPS Alerts – additional details including TCP/UDP/ICMP header and payload in the attack packet		Snort IPS
Sophos	Sophos Endpoint Security and Control			SNMP Trap: Endpoint events including Malware found/deleted, DLP events		Sophos Endpoint Security and Control
Squid	Web Proxy	SNMP: Process level CPU/Memory usage		Syslog: W3C formatted access logs – per HTTP(S) connection: Sent Bytes, Received Bytes, Connection Duration		Squid Web Proxy
Symantec	Symantec Endpoint Protection			Syslog: Over 5000 event types covering end point protection events – malware/spyware/adware, malicious events		Symantec Endpoint Protection
Symantec	DLP
TrendMicro	Office scan			SNMP Trap: Over 30 event types covering end point protection events – malware/spyware/adware, malicious events		Trend Micro OfficeScan
TrendMicro	Intrusion Defense Firewall (IDF)			Syslog: Over 10 event types covering end point firewall events		Trend Micro IDF
TrendMicro	Deep Security Manager			Syslog: Over 10 event types covering end point protection events
Tufin	SecureTrack			Syslog: Over 10 event types covering firewall policy management events
Vasco	DigiPass			Syslog – Successful and Failed Authentications, Successful and Failed administrative logons		Vasco DigiPass

 

 

VMware	VMware ESX and VCenter	VMWare SDK: Entire VMware hierarchy and dependencies Data Center, Resource Pool, Cluster, ESX and VMs	VMWare SDK: VM level: CPU, Memory, Disk, Network, VMware tool status VMWare SDK: ESX level: CPU, Memory, Disk, Network, Data store VMWare SDK: ESX level: Hardware Status VMWare SDK: Cluster level: CPU, Memory, Data store, Cluster Status VMWare SDK: Resource pool level: CPU, Memory	VMWare SDK: Over 800 VCenter events covering account creation, VM creation, DRS events, hardware/software errors		VMware Monitoring Events
VMware	vShield			Syslog: Over 10 events covering permitted and denied connections, detected attacks
VMware	VCloud Network and Security (vCNS) Manager			Syslog: Over 10 events covering various activities
WatchGuard	Firebox Firewall			Syslog: Over 20 firewall event types		WatchGuard Firebox Firewall
Websense	Web Filter			Syslog: Over 50 web filtering events and web traffic logs		Websense Web Filter

 

 

Adding Super/Global Users to Organizations with Collectors

In multi-tenant deployments, you may need to create Super/Global users who have roles within multiple organizations. If your deployments include organizations with collectors, you must add add the users individually.

1. Log in to your Supervisor node as a Super/Global users.
2. Create the individual user as described in Adding a Single User, choosing the appropriate Default Role.
3. Select the Permitted Organizations the user is allowed to access, overriding any default role settings as necessary.
4. Click Save.

Adding Super/Global Users to Organizations without Collectors

For the organizations-without-collector case, if the Active Directory Server belongs to super-local, then the discovered users would be visible from the super-global view and any of these users can be made an FortiSIEM user. In this case the steps are

Logon as super-global

Create the user as described here – both manual and discovery-based approaches can be used

Choose the Default role

Choose the permitted organizations. And if needed, override the default role for specific organizations. In the example below, user1 is the Network Admin for every organization but System Admin for O-eng.

Adding Users to Multi-Tenant Deployments

Two kinds of admin users can be added

users belonging to a specific organization or super-local users belonging to super-global

Adding specific organization users

This can be done from the specific organization admin account or from the super global account.

Logon as an appropriate administrator – two possibilities logon as admin user for that organization or

logon as super-global and then switch user to that organization

Follow the steps for AO-VA case described here. Note that for Active Directory based discovery, the Active Directory server has to belong to that specific organization. If the Active Directory server belongs to super-local, then the users also belong to super and would not be visible for that organization.

FortiSIEM provides a short-cut to add admin users for multiple organizations in one shot

Logon as super-global

Manually create the user as described in the manual user creation mode here.

Choose the Default role

Choose the permitted organizations and also override the default role for a specific organization if needed. In the example below, user1 is the Network Admin for every organization but System Admin for O-eng.

Adding super-global users

Super-global users are often need for managing multiple organizations, and can be created from the super-global account. There are two cases depending on whether organizations have collectors or not.

For the organizations-with-collector-only case, users must be created manually.

Logon as super-global

Manually create the user as described in the manual user creation mode here

Choose the Default role

Choose the permitted organizations. Override the default role for each specific organization, if needed. In the example below, user1 is the Network Admin for every organization but System Admin for O-eng.

For the organizations-without-collector case, if the Active Directory Server belongs to super-local, then the discovered users would be visible from the super-global view and any of these users can be made an FortiSIEM user. In this case the steps are

Logon as super-global

Create the user as described here – both manual and discovery-based approaches can be used

Choose the Default role

Choose the permitted organizations. And if needed, override the default role for specific organizations. In the example below, user1 is the Network Admin for every organization but System Admin for O-eng.

Adding Users to Organizations

Adding users to organizations for multi-tenant deployments follows the same processes described in Adding Users for Enterprise Deployments, though if you want to discover users in an Active Directory server over LDAP, the Active Directory server has to belong the organization where you want to add the user.

1. Log in to your Supervisor node either as the Admin user for the organization where you want to add the user, or log in as a Super/Global user to add the user to more than one organization.
2. Create the user as described in Adding a Single User, or follow the instructions in Adding Users from Active Directory via LDAP.
3. If you have logged in as the Super/Global user, select the organizations where you want to add the user, overriding any Default Roles for the organization as necessary.

 

How Devices are Added to Organizations

When you initiate device discovery for organizations, the way in which those devices are added to organizations depends on whether you are using Collectors in your deployment.

For organizations with Collectors, discovery is carried out by the Collector, and the Collector assigns devices to the organization with which it is associated. If organizations have an overlapping IP range, deploying Collectors and assigning them to a specific IP range and organization will ensure that the device is added to the correct organization.

For organizations without Collectors, discovery is carried out by the Supervisor. In this case, the Include/Exclude IP Range you defined when you set up the organization is used to add the device to the organization.

If a device matches only one defined organization IP Range, then it is assigned to that organization

If a device matches multiple defined IP Ranges, then it is assigned to the Super organization

You can change a device’s assigned organization manually, and FortiSIEM will automatically update the Include/Exclude IP Range for that organization. This updated IP range definition will then be used in the next discovery process. However, this may create confusing IP range definitions for the organization, so you may want to re-define the organization’s IP range and rediscover devices.