OpenText Sentinel Community

add jq utility to appliance

Norbert Klasen

jq is a lightweight and flexible command-line JSON processor. It is essential when working with the Sentinel REST API on the command line. jq is maintained as a package in the SUSE utilities project: https://build.opensuse.org/package/show/utilities…
- over 3 years ago
- OpenText Sentinel
- Sentinel Ideas
Need Collector Plugin for Splunk

syahiralias

Hi, I have an issues when Splunk SIEM forwards the logs towards Sentinel Collector. I received the logs coming from 1 node which have multiple logs per devices(Palo Alto FW, FortiGate UTM, imsva, Microsoft Active Directory and Windows, Unix/Linux and…
- over 4 years ago
- OpenText Sentinel
- Sentinel Ideas
MSG Field size to 16kB

MigrationDeletedUser

The message field size should be bigger. Some of custom log event sources require bigger msg size.
- over 5 years ago
- OpenText Sentinel
- Sentinel Ideas
Integrate the 9443 console certificate mechanism of the Sentinel 8.2.0 appliance into the 8443 console

gathagan

Appliances created with SUSE studio have a security certificate mechanism integrated into the port 9443 administration console. This mechanism greatly simplifies the process of adding a 3rd party security cert to the appliance. In the Filr appliance,…
- over 5 years ago
- OpenText Sentinel
- Sentinel Ideas
Sentinel 8.2.2.0 database upgrade failure due to older orphaned jar files

MigrationDeletedUser

During an upgrade from Sentinel 8.2.0.0 the database upgrade failed, after the main Sentinel upgrade failed. After investigation, it was determined that there were some orphaned jar files from 8.1.0.1 that were causing the database upgrade to fail. Putting…
- over 5 years ago
- OpenText Sentinel
- Sentinel Ideas
Fix your post 8.2.2.0 installer to require 4 CPUs

MigrationDeletedUser

Sentinel 8.2.2.0 will not successfully install on Linux without 4 cores assigned to the box. I recently spent around a week trying to get a clean 8.2.2.0 install to work and when all was said and done, it came down to it not having 4 cores assigned, even…
- over 5 years ago
- OpenText Sentinel
- Sentinel Ideas
Fix your post 8.2.2.0 installer to require 4 CPUs

MigrationDeletedUser

Sentinel 8.2.2.0 will not successfully install on Linux without 4 cores assigned to the box. I recently spent around a week trying to get a clean 8.2.2.0 install to work and when all was said and done, it came down to it not having 4 cores assigned, even…
- over 5 years ago
- OpenText Sentinel
- Sentinel Ideas
EVT/EVTX file via Agent Manager Agent

MigrationDeletedUser

In agent manager you can read a Single Line Log. It would be a great enhancement to read also evt/evtx files, because there are several software products that write their own event logs that are shown in the event viewer. e.g. Symantec Endpoint Protection…
- over 5 years ago
- OpenText Sentinel
- Sentinel Ideas
Appliance based Elastic Nodes for event visualisation

damon_kalajzich

The requirement to build your own elastic nodes to provide event visualisation, means this is not a full product, this then requires additional Server OS licencing. All other advanced SIEMs provide a full solution. with the requirement to deploy and configure…
- over 5 years ago
- OpenText Sentinel
- Sentinel Ideas
Palo Alto NGFW

MigrationDeletedUser

Today, the operation system version of the Palo Alto NGFW is PAN-OS 8.1. However, the version we support is 6.0 in https://www.netiq.com/support/sentinel/plugins/ Do we have plan to update the plug-in to support latest Palo Alto NGFW? We would like to…
- over 5 years ago
- OpenText Sentinel
- Sentinel Ideas
Certify the use of BigIP together with Sentinel, SAM and UAM

MigrationDeletedUser

Because a SAM Central Computer only can connect to one Collector Manager. It would be nice if it was supported adding a BigIP between SAMservers and Collector Managers. And for UAM the same as above. Although you can specify a secondary Collector Manager…
- over 6 years ago
- OpenText Sentinel
- Sentinel Ideas
Change Guardian Agent install

MigrationDeletedUser

In CG version 5.1 there is no more build in option to do a agent install via software distribution software. There is a cool solution: https://www.netiq.com/communities/cool-solutions/automating-manual-process-installing-change-guardian-windows-agent…
- over 6 years ago
- OpenText Sentinel
- Sentinel Ideas
Certify Sentinel for High availability on Red Hat Linux

mjruane

High availability/Clustering for Sentinel is only supported and certified on SLES or SLES appliances. There is no supported high availability option available for Sentinel on Red Hat Linux. This option needs to be tested and certified by Micro Focus for…
- over 6 years ago
- OpenText Sentinel
- Sentinel Ideas
"Status Details" statistics do not persist on Sentinel service restart

jgassner

Within the Sentinel Control Center (SCC) --> Event Source Management --> Live View... --> Table tab --> expand any Collector Manager. The statistics do not persist upon Sentinel service restart, as viewed from right-clicking on any Connector, Collector…
- over 6 years ago
- OpenText Sentinel
- Sentinel Ideas
Bulk plugin download

jgassner

Updating and downloading plugins is a time consuming and manual process. It is especially difficult as you need to download each one individually. It is also challenging for closed environments and change management processes as each file needs to be…
- over 6 years ago
- OpenText Sentinel
- Sentinel Ideas
Enable Postgresql DB storage to use an different filesystem/partition from event store

brandon-langley

When the DB is on the same store as the event store, either the DB or the event store overrunning available storage can create problems for the other store. Also, sometimes the I/O on the event store can cause challenges on the DB. By separating the file…
- over 6 years ago
- OpenText Sentinel
- Sentinel Ideas
Sentinel appliances - expose patch status and instructions on main webUI (not WebYast)

brandon-langley

In the current appliances the use of WebYast for patch updates is discouraged due to a number of challenges with WebYast itself. Instead, people are being asked to use 'zypper patch'. This creates a couple of challenges for users that don't have comfort…
- over 7 years ago
- OpenText Sentinel
- Sentinel Ideas
webhelper to interact with REST api from collectors and actions

Norbert Klasen

If one wants to interact with Sentinel's REST api a https connection need to be established and authenticated. This can be cumbersome from an action or collector and requires credentials to be stored somewhere. The action and collector frameworks should…
- over 7 years ago
- OpenText Sentinel
- Sentinel Ideas
WTMP Agent RPM

MigrationDeletedUser

Worlking at Worldline in a Sentinel project. Worldline has already a Linuy based "Siem" for Linux events, that the buils on Linux scripting. Now they build a Sentinel solution that gets all the events from Linux (Syslog) and Windows. Worldline has already…
- over 7 years ago
- OpenText Sentinel
- Sentinel Ideas
Make Sentinel 8 CentOS 7 "compatible"

MigrationDeletedUser

Hi, Sometimes I want to install Sentinel to CentOS (e.g no hassle with licensing in labs). Sentinel 7.4 series run fine in Centos 6.x. Would developers make Sentinel 8 CentOS 7 compatible with following little tweak: Could developers compile novell-Sentineldb…
- over 7 years ago
- OpenText Sentinel
- Sentinel Ideas
Use Delta RPMs for Appliance

MigrationDeletedUser

The size of the current RPMs is very significant, both to download/bandwidth and the temporary disk requirements. This is extremely slow and often unreliable when pulling updates from disparate geo locations. Utilising Delta RPMs (.drpm) will allow quicker…
- over 7 years ago
- OpenText Sentinel
- Sentinel Ideas
A way to migrate event and rawdata from Sentinel installation to another

MigrationDeletedUser

Currently there is no way to migrate event and rawdata between separate Sentinel Installations. The current "Find data" operability in Data Restoration supports only importing event data not rawdata. This makes migration with rawdata to newer Sentinel…
- over 8 years ago
- OpenText Sentinel
- Sentinel Ideas
Schedule download for scp or/and sshfs for file connector

MigrationDeletedUser

SCP option in the file connector should have schedule/recurring download option. sshfs together with CIFS and NFS, would be very useful option too.
- over 8 years ago
- OpenText Sentinel
- Sentinel Ideas
Ability to import production collectors into the SDK to customize and debug

MigrationDeletedUser

Provide SDK versions of released collectors - all the data is already contained in the released collector. This step just removes the task of creating a new collector in the SDK, and then importing all the files manually to re-create a production collector…
- over 8 years ago
- OpenText Sentinel
- Sentinel Ideas

Menu

OpenText Sentinel

add jq utility to appliance

Need Collector Plugin for Splunk

MSG Field size to 16kB

Integrate the 9443 console certificate mechanism of the Sentinel 8.2.0 appliance into the 8443 console

Sentinel 8.2.2.0 database upgrade failure due to older orphaned jar files

Fix your post 8.2.2.0 installer to require 4 CPUs

Fix your post 8.2.2.0 installer to require 4 CPUs

EVT/EVTX file via Agent Manager Agent

Appliance based Elastic Nodes for event visualisation

Palo Alto NGFW

Certify the use of BigIP together with Sentinel, SAM and UAM

Change Guardian Agent install

Certify Sentinel for High availability on Red Hat Linux

"Status Details" statistics do not persist on Sentinel service restart

Bulk plugin download

Enable Postgresql DB storage to use an different filesystem/partition from event store

Sentinel appliances - expose patch status and instructions on main webUI (not WebYast)

webhelper to interact with REST api from collectors and actions

WTMP Agent RPM

Make Sentinel 8 CentOS 7 "compatible"

Use Delta RPMs for Appliance

A way to migrate event and rawdata from Sentinel installation to another

Schedule download for scp or/and sshfs for file connector

Ability to import production collectors into the SDK to customize and debug

Resources

Menu

Popular Tags

Resources