Browse by Tags - Sentinel Tips

Accepted Solutions - an easy way for community members to locate answers!

Caroline Oest

Attached please find document including the accepted solutions in the discussion board over the past months. If you find that any post resolves your issue, please be sure to mark it as an accepted solution. Your fellow members will appreciate it! …

over 3 years ago
OpenText Sentinel
Sentinel Tips

How to re-parse raw data records in Sentinel

Norbert Klasen

ISSUE: Collectors sometimes fail to parse an incoming raw data record correctly. To check if modifications to a collector fix the problem, Sentinel needs to process the same data again. Another use case is to take data collected on one Sentinel system…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Sending encrypted e-mail notifications from Sentinel

alekz

Recently I had a need for encrypting the e-mail notifications that Sentinel sends from e.g. correlation rules. The e-mails were going to be sent outside the organization to an external e-mail address, and the requirement was that only the recipient should…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Event and Raw Data Migration in Sentinel

Azeezullah

This article explains the procedure to migrate the Sentinel event and raw data with less down time. Problem and limitations: Limitation with the current utilities available in Sentinel server: "backup_util.sh" "backup_util.sh" under bin directory has…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Migrate Sentinel Remote Collector Manager to newer hardware

Azeezullah

This article explains the steps of how to migrate the old Remote Collector Manager (RCM) to new hardware. Here is the use case we used: A user had an RCM pointing to the Sentinel Server. Suddenly there is a failure in the software (RCM). The user recreates…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Sentinel with wildcard certificate using Organizational CA

Azeezullah

Why wildcard certificate? A general description and advantage of the wildcard, is that the same certificate can be used for multiple subdomains of a domain. It will be cheaper and more convenient, rather than buying a certificate for each domain. A single…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Sentinel Using Externally Signed Certificates

Azeezullah

By default Sentinel creates a self-signed certificate which would be valid for 100 years. Due to security reasons we should sign the SSL certificate with Certificate Authority. This document describes the steps involved in creating a custom certificate…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Pulse Secure Collector

Norbert Klasen

Overview There is an existing Sentinel Collector for VPN and Access Control devices which dates back to 2015. This whole product line has been sold to Pulse Secure in the mean time. This collector now supports the current version of these products: Pulse…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Sentinel Syslog 2011.1r6 and Audit 2011.1r4 Connectors are released!

ssankarnarayanan

NetIQ Audit Connector 2011.1r4 Documentation: https://www.netiq.com/support/sentinel/plugins/prod/connectors/NetIQ-Audit_2011.1r4.pdf Download URL: https://www.netiq.com/support/sentinel/plugins/prod/connectors/NetIQ-Audit_2011.1r4.cnz.zip Syslog Connector…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Follow us on Twitter!

ssankarnarayanan

If you'd like to keep up to date on the latest releases, news, and happenings at NetIQ, go ahead and follow us on Twitter! @NetIQ Sentinel

over 3 years ago
OpenText Sentinel
Sentinel Tips

Juniper remote exploit vulnerabilities patched

ssankarnarayanan

Last month Juniper quietly released patches for two newly-discovered remote vulnerabilities: http://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554 The announcement included some curious information including…

over 3 years ago
OpenText Sentinel
Sentinel Tips

How to create and manage Incidents in ServiceNow from Sentinel Alerts with Aegis

MigrationDeletedUser

In previous posts I have shown ( here ) how to integrate Aegis and Sentinel - but why? I often get asked what does Aegis actually do, its not an easy question to answer without example. The short answer is - it can do almost anything - the long answer…

over 3 years ago
OpenText Sentinel
Sentinel Tips

PCI DSS Solution Pack: Sample Reports

ssankarnarayanan

PCI-DSS_2011.1r3-Sample_Reports.zip contains sample reports for the complete set of reports found in the Sentinel PCI DSS Solution Pack (version 2011.1r3). This sample report bundle is a convenient way to show the functionality provided by the solution…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Sentinel Core Solution Pack: Sample Reports

ssankarnarayanan

Sentinel-Core_2011.1r8-Sample_Reports.zip contains sample reports for the complete set of reports found in the Sentinel Core Solution Pack (version 2011.1r8). This sample report bundle is a convenient way to show the functionality provided by the solution…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Cached events are not getting uploaded to the Sentinel Server

hmahantesh

Problem Definition A customer has configured Novell Audit Platform Agent (PA) to Force Caching mode. And along with the Force Caching mode, the “Roll Cache” option is also configured. The PA’s configuration (/etc/logevent.conf) file looks like: LogCacheLimitAction…

over 3 years ago
OpenText Sentinel
Sentinel Tips

How to get the raw data record for a Sentinel event

Norbert Klasen

Getting the raw data record that caused an event in Sentinel is rather cumbersome (Hint: Please vote for enhancement 929916 - add ability to show raw data for an event). To get it, one has to take the RawDataRecordId from the All view of the event in…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Sentinel 7 - Email Notifications for Log Manager Customers

MigrationDeletedUser

By configuring Rules and Actions, Sentinel Log Manager 1.x.x notifies (e.g. via email) security team members about any events of interest. The screenshots below show whenever a SSH authentication failure occurs for 'root' account, a Rule “Auth Failure…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Detecting Data Exfiltration - Who is watching your employees actions?

MigrationDeletedUser

How do you know if your trusted employees are stealing sensitive data? Companies have to allow them access to do their jobs (Utilize USB Drives, Touch File Shares etc), but need to monitor their actions. With Change Guardian and Sentinel we can detect…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Sentinel - Customizing Reports: Workstation Setup

brandonmg47

Sentinel allows you to create your own detailed reports within the web interface. However, more control over the report layout may be desired. NetIQ makes the Sentinel SDK available to not only develop custom plugins, but also create custom reports. There…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Setting Sentinel Main (Reporting) Server Bind Addresses

aburgemeister

There are always configuration options that you find the first time you setup a new system, and then there are some that you find when you are asked for some odd business reason that may not have been as obvious on day one. One of these options for services…

over 3 years ago
OpenText Sentinel
Sentinel Tips

dnsmasq Sentinel Collector

alekz

This is a simple collector for the Linux daemon "dnsmasq", a lightweight DHCP/DNS server. I developed it during a Sentinel course I attended ( Sentinel Software Developer Kit: Building Collectors and Reports which I recommend). This is a development build…

over 3 years ago
OpenText Sentinel
Sentinel Tips

D-Link DIR-655 Sentinel Collector

alekz

This is a simple collector that I wrote for a home router that I had, D-Link DIR-655 that has Syslog support. I developed it during a Sentinel course I attended ( Sentinel Software Developer Kit: Building Collectors and Reports which I recommend). It…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Detecting Windows Kerberos implementation elevation of privilege vulnerability attacks with Sentinel - part 2

Norbert Klasen

CVE-2014-6324 allows remote elevation of privilege in domains running Windows domain controllers. An attacker with the credentials of any domain user can elevate their privileges to that of any other account on the domain (including domain administrator…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Detecting Windows Kerberos implementation elevation of privilege vulnerability attacks with Sentinel

Norbert Klasen

CVE-2014-6324 allows remote elevation of privilege in domains running Windows domain controllers. An attacker with the credentials of any domain user can elevate their privileges to that of any other account on the domain (including domain administrator…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Threat Intelligence Solution Pack: Sample Reports

ssankarnarayanan

Threat Intelligence Solution Pack - Sample reports contains sample reports for the complete set of reports found in the Sentinel Threat Intelligence Solution Pack (version 2011.1r4). This file also contains a report with detailed descriptions of every…

over 3 years ago
OpenText Sentinel
Sentinel Tips

Menu

Sentinel Tips

Accepted Solutions - an easy way for community members to locate answers!

How to re-parse raw data records in Sentinel

Sending encrypted e-mail notifications from Sentinel

Event and Raw Data Migration in Sentinel

Migrate Sentinel Remote Collector Manager to newer hardware

Sentinel with wildcard certificate using Organizational CA

Sentinel Using Externally Signed Certificates

Pulse Secure Collector

Sentinel Syslog 2011.1r6 and Audit 2011.1r4 Connectors are released!

Follow us on Twitter!

Juniper remote exploit vulnerabilities patched

How to create and manage Incidents in ServiceNow from Sentinel Alerts with Aegis

PCI DSS Solution Pack: Sample Reports

Sentinel Core Solution Pack: Sample Reports

Cached events are not getting uploaded to the Sentinel Server

How to get the raw data record for a Sentinel event

Sentinel 7 - Email Notifications for Log Manager Customers

Detecting Data Exfiltration - Who is watching your employees actions?

Sentinel - Customizing Reports: Workstation Setup

Setting Sentinel Main (Reporting) Server Bind Addresses

dnsmasq Sentinel Collector

D-Link DIR-655 Sentinel Collector

Detecting Windows Kerberos implementation elevation of privilege vulnerability attacks with Sentinel - part 2

Detecting Windows Kerberos implementation elevation of privilege vulnerability attacks with Sentinel

Threat Intelligence Solution Pack: Sample Reports

Resources