Sentinel Installation and Configuration Guide

1 Sentinel Installation and Configuration GuideJuly 2018 Legal NoticeFor information about NetIQ legal notices, disclaimers, warranties, export and other use restrictions, Government restricted rights, patent policy, and FIPS compliance, see 2018 NetIQ Corporation. All Rights information about NetIQ trademarks, see All third-party trademarks are the property of their respective this Book and the Library11 Part I Understanding Sentinel131 What is Sentinel ?15 Challenges of Securing an IT Environment.. 15 The Solution That Sentinel Provides.. 162 How Sentinel Works19 Event Sources.. 21 Sentinel Event.. 21 Mapping Service .. 22 Streaming Maps.. 22 Exploit Detection .. 23 Collector Manager.. 23 Collectors .. 23 Connectors.. 24 ArcSight SmartConnectors .. 24 Agent Manager .. 24 Sentinel Data Routing and Data Storage .. 24 Event Visualizations .. 25 Correlation .. 25 Security Intelligence .. 25 Incident Remediation.

2 25iTrac Workflows.. 26 Actions and Integrators.. 26 Searching .. 26 Reports .. 26 Identity Tracking .. 27 Event Analysis.. 27 Part II Planning Your Sentinel Installation293 Implementation Checklist314 Understanding License Information33 Sentinel Licenses .. 34 Evaluation License.. 34 Free License .. 35 Enterprise Licenses .. 355 Meeting System Requirements37 Connector and Collector System Requirements.. 37 Virtual Environment.. 374 Contents6 Deployment Considerations39 Data Storage Considerations .. 39 Planning for Traditional Storage.. 40 Planning for Scalable Storage .. 43 Sentinel Directory Structure .. 45 Advantages of Distributed Deployments.. 45 Advantages of Additional Collector Managers ..46 Advantages of Additional Correlation Engines..46 All-In-One Deployment .. 46 One-Tier Distributed Deployment .. 47 One-Tier Distributed Deployment with High Availability .. 48 Two-Tier and Three-Tier Distributed Deployment.

3 49 Three-Tier Deployment with Scalable Storage .. 507 Deployment Considerations for FIPS 140-2 Mode53 FIPS Implementation in Sentinel .. 53 RHEL NSS Packages.. 53 SLES NSS Packages .. 54 FIPS-Enabled Components in Sentinel .. 54 Data Connections Affected by FIPS Mode .. 55 Implementation Checklist .. 55 Deployment Scenarios .. 56 Scenario 1: Data Collection in Full FIPS 140-2 Mode .. 56 Scenario 2: Data Collection in Partial FIPS 140-2 Mode .. 578 Ports Used59 Sentinel Server Ports .. 59 Local Ports .. 59 Network Ports.. 59 Sentinel Server Appliance Specific Ports.. 61 Collector Manager Ports .. 61 Network Ports.. 61 Collector Manager Appliance Specific Ports .. 62 Correlation Engine Ports.. 62 Network Ports.. 62 Correlation Engine Appliance Specific Ports .. 63 Scalable Storage Ports .. 639 Installation Options65 Traditional Installation .. 65 Appliance Installation .. 66 Part III Installing Sentinel6710 Installation Overview6911 Installation Checklist7112 Installing and Configuring Elasticsearch73 Prerequisites.

4 73 Contents5 Installing and Configuring Elasticsearch.. 73 Securing Data in Elasticsearch.. 75 Installing the Elasticsearch Security Plug-In .. 76 Providing Secure Access to Additional Elasticsearch Clients.. 77 Updating the Elasticsearch Plug-In Configuration ..78 Performance Tuning for Elasticsearch .. 79 Redeploying Elasticsearch Security Plug-In .. 7913 Installing and Setting Up Scalable Storage81 Installing and Configuring CDH.. 82 Prerequisites .. 82 Installing and Configuring CDH .. 83 Enabling Scalable Storage .. 8314 Traditional Installation85 Performing Interactive Installation .. 85 Sentinel Server Standard Installation .. 85 Sentinel Server Custom Installation .. 86 Collector Manager and Correlation Engine Installation .. 88 Performing a Silent Installation .. 91 Installing Sentinel as a Non-root User .. 9215 Appliance Installation95 Prerequisites.. 95 Installing the Sentinel ISO Appliance .. 95 Installing Sentinel .

5 96 Installing Collector Managers and Correlation Engines .. 97 Installing the Sentinel OVF Appliance.. 97 Installing Sentinel .. 98 Installing Collector Managers and Correlation Engines .. 98 Post- Installation Configuration for the Appliance .. 99 Registering for Updates .. 99 Creating Partitions for Traditional Storage .. 100 Configuring Scalable Storage .. 101 Configuring the Appliance with SMT .. 10116 Installing Additional Collectors and Connectors103 Installing a Collector .. 103 Installing a Connector .. 10317 Verifying the Installation105 Part IV Configuring Sentinel10718 Configuring Time109 Understanding Time in Sentinel .. 109 Configuring Time in Sentinel .. 111 Configuring Delay Time Limit for Events.. 111 Handling Time Zones .. 1116 Contents19 Securing Data in Elasticsearch11320 Enabling Event Visualization115 Prerequisite.. 115 Enabling Event Visualization.. 11521 Modifying the Configuration after Installation11722 Configuring Out-of-the-Box Plug-Ins119 Viewing the Preinstalled Plug-Ins.

6 119 Configuring Data Collection .. 119 Configuring Solution Packs.. 119 Configuring Actions and Integrators .. 12023 Enabling FIPS 140-2 Mode in an Existing Sentinel Installation121 Enabling Sentinel Server to Run in FIPS 140-2 Mode .. 121 Enabling FIPS 140-2 Mode on Remote Collector Managers and Correlation Engines .. 12224 Operating Sentinel in FIPS 140-2 Mode123 Configuring the Advisor Service in FIPS 140-2 Mode.. 123 Configuring Distributed Search in FIPS 140-2 Mode .. 123 Configuring LDAP Authentication in FIPS 140-2 Mode .. 124 Updating Server Certificates in Remote Collector Managers and Correlation Engines .. 125 Configuring Sentinel Plug-Ins to Run in FIPS 140-2 Mode.. 125 Agent Manager Connector.. 126 Database (JDBC) Connector .. 127 Sentinel Link Connector.. 127 Syslog Connector.. 128 Windows Event (WMI) Connector .. 129 Sentinel Link Integrator .. 129 LDAP Integrator .. 130 SMTP Integrator.. 131 Syslog Integrator.

7 131 Using Non-FIPS Enabled Connectors with Sentinel in FIPS 140-2 Mode .. 132 Importing Certificates into FIPS Keystore Database.. 132 Reverting Sentinel to Non-FIPS Mode .. 132 Reverting Sentinel Server to Non-FIPS mode .. 133 Reverting Remote Collector Managers or Remote Correlation Engines to Non-FIPS mode.. 13325 Adding a Consent Banner135 Part V Upgrading Sentinel13726 Implementation Checklist13927 Prerequisites141 Saving the Custom Configuration Information .. 141 Saving the File Settings.. 141 Saving the jetty-ssl File Settings .. 141 Contents7 Extending the Retention Period for Event Associations Data ..141 Pre-Upgrade Configuration for SSDM .. 142 Change Guardian Integration .. 14228 Upgrading Sentinel Traditional Installation143 Upgrading Sentinel .. 143 Upgrading Sentinel as a Non-root User .. 144 Upgrading the Collector Manager or the Correlation Engine ..146 Upgrading the Operating System.

8 14629 Upgrading the Sentinel Appliance149 Upgrading Sentinel .. 149 Upgrading Sentinel through the Appliance Update Channel .. 149 Upgrading Sentinel by Using SMT.. 150 Upgrading the Operating System .. 15230 Post-Upgrade Configurations155 Securing Data in Elasticsearch.. 155 Configuring Event Visualizations.. 155 Configuring IP Flow Data Collection .. 156 Post-Upgrade Configuration for Sentinel Scalable Data Manager .. 156 Install Elasticsearch Security Plug-In.. 157 Updating Spark Applications on YARN.. 157 Enabling Sentinel Features .. 158 Updating Dashboards and Visualizations in Sentinel Scalable Data Manager .. 158 Adding the JDBC DB2 Driver .. 159 Configuring Data Federation Properties in Sentinel Appliance..159 Registering Sentinel Appliance for Updates .. 159 Updating External Databases for Data Synchronization.. 160Re-authenticating Sentinel in Multi-Factor Authentication Mode..16031 Upgrading Sentinel Plug-Ins161 Part VI Migrating Data from Traditional Storage16332 Migrating Data to Scalable Storage165 Data You Can Migrate.

9 166 Migrating Configuration Data .. 167 Backing Up Data on the Source Server ..167 Restoring Data on the Target Server .. 167 Migrating Event Data and Raw Data.. 168 Migrating Alerts and NetFlow Data .. 168 Updating Sentinel Clients .. 168 Importing ESM Configuration .. 1698 Contents33 Migrating Data to Elasticsearch17134 Migrating Data173 Part VII Deploying Sentinel for High Availability17535 Concepts177 External Systems .. 177 Shared Storage.. 177 Service Monitoring .. 178 Fencing .. 17836 System Requirements17937 Installation and Configuration181 Initial Setup .. 182 Shared Storage Setup .. 183 Configuring iSCSI Targets .. 184 Configuring iSCSI Initiators .. 185 Sentinel Installation .. 187 First Node Installation .. 187 Subsequent Node Installation .. 188 Cluster Installation .. 190 Cluster Configuration .. 190 Resource Configuration .. 194 Secondary Storage Configuration .. 19538 Configuring Sentinel HA as SSDM19739 Upgrading Sentinel in High Availability199 Prerequisites.

10 199 Upgrading a Traditional Sentinel HA Installation .. 199 Upgrading Sentinel HA.. 199 Upgrading the Operating System.. 201 Upgrading a Sentinel HA Appliance Installation .. 204 Upgrading Sentinel HA Appliance by Using Zypper.. 20440 Backup and Recovery207 Backup .. 207 Recovery.. 207 Transient Failure .. 207 Node Corruption.. 207 Cluster Data Configuration .. 208 Part VIII Appendices209A Troubleshooting211 Failed Installation Because of an Incorrect Network Configuration ..211 Contents9 The UUID Is Not Created for Imaged Collector Managers or Correlation Engine.. 212 Sentinel Main Interface is Blank in Internet Explorer After Logging in ..212 Sentinel Does Not Launch in Internet Explorer 11 in Windows Server 2012 R2 .. 212 Sentinel Cannot Run Local Reports with Default EPS License .. 213 Synchronization Needs to be Started Manually in Sentinel High Availability After You Convert the Active Node to FIPS 140-2 Mode.