Event Collection Configuration

Detailed device configuration is available for IDS/IPS devices, Firewalls, Routers, Servers, and assorted Operating Systems and applications, along with desktop configuration and The following section identifies the required information, settings, and detailed configuration settings.

• 1. Tier 1 IDS/IPS Device Configurations
  • 1.1. HAWK Snort IDS/IPS CentOS Installation Package
  • 1.2. Snort IDS/IPS Barnyard/Barnyard2 Output Configuration
  • 1.3. HAWK eyeCon/Sourcefire Defense Center eStream API
  • 1.4. HAWK eyeCon/Juniper IDS/IPS Device Configuration
  • 1.5. HAWK eyeCon/TippingPoint IDS/IPS Device Configuration
  • 1.6. HAWK eyeCon/Fortinet FortiGate Analyzer IDS/IPS Device
  • 1.7. HAWK eyeCon/Enterasys Dragon Remote Syslog Configuration
  • 1.8. HAWK eyeCon/Barracuda Networks Spam Firewall Remote Syslog Configuration
• 2. Tier 2 Firewall/Router Device Configuration
  • 2.1. Cisco Network Router Syslog Configuration
    • 2.1.1. Cisco IOS
    • 2.1.2. Cisco Catalyst
  • 2.2. Juniper Network Router Remote Syslog Configuration
  • 2.3. Check Point Network Firewall Device Configuration
    • 2.3.1. Initial Installation
    • 2.3.2. Gateway Configuration (SSL CA Authentication)
    • 2.3.3. Edit FW1-Loggrabber Configuration Files
  • 2.4. Cisco PIX/ASA/FWSM Network Firewall
  • 2.5. SonicWall Network Firewall
  • 2.6. Watchguard Network Firewall Remote Syslog Configuration
    • 2.6.1. Configuration
• 3. Tier 3 Server/Application Configuration
  • 3.1. Microsoft Windows 7, 8, 10 Audit Settings and Recommendations (PCI Compliant)
    • 3.1.1. Accessing Audit Settings
    • 3.1.2. Recommended Audit Policies by Operating System
    • 3.1.3. Audit Policy Tables Legend
    • 3.1.4. Account Logon
    • 3.1.5. Account Management
    • 3.1.6. Detailed Tracking
    • 3.1.7. Logon and Logoff
    • 3.1.8. Object Access
    • 3.1.9. Policy Change
    • 3.1.10. Privilege Use
    • 3.1.11. System
    • 3.1.12. Global Object Access Auditing
    • 3.1.13. References
  • 3.2. Windows Server 2008 to Windows Server 2019 Audit Settings Recommendations (PCI Compliant)
    • 3.2.1. Accessing Audit Settings
    • 3.2.2. Recommended Audit Policies by Operating System
    • 3.2.3. Audit Policy Tables Legend
    • 3.2.4. Account Logon
    • 3.2.5. Account Management
    • 3.2.6. Detailed Tracking
    • 3.2.7. DS Access
    • 3.2.8. Logon and Logoff
    • 3.2.9. Object Access
    • 3.2.10. Policy Change
    • 3.2.11. Privilege Use
    • 3.2.12. System
    • 3.2.13. Global Object Access Auditing
    • 3.2.14. References
  • 3.3. Microsoft Windows 2000, 2003, 2008 Server, Microsoft Windows 7, XP, Vista
    • 3.3.1. Agent-based Installation
      • 3.3.1.1. Reload Configuration
    • 3.3.2. Agent-based Upgrade
    • 3.3.3. Agent-based Uninstall
    • 3.3.4. SNARE Agent
    • 3.3.5. Microsoft Windows Remote Event Collector (WMI/WQL)
      • 3.3.5.1. Configuring Windows server for WMI
  • 3.4. GNU/Linux Remote Syslog Configuration
    • 3.4.1. Syslog-NG Configuration
    • 3.4.2. Syslog Configuration
    • 3.4.3. Agent-based Installation
      • 3.4.3.1. CentOS and RHEL
      • 3.4.3.2. HAWK-OS
      • 3.4.3.3. Download and Install HAWK Agent
    • 3.4.4. Agent-based Uninstall
      • 3.4.4.1. HAWK Agent installed via HAWK Repository
      • 3.4.4.2. HAWK Agent installed via RPM Package
      • 3.4.4.3. HAWK Agent installed via Debian/Ubuntu Package
  • 3.5. Mac OS X Remote Syslog Configuration
  • 3.6. FreeBSD, NetBSD, and OpenBSD Syslog Remote Logging
  • 3.7. Solaris Remote Syslog Configuration
  • 3.8. IBM AIX 5L/6 Remote Syslog Configuration
  • 3.9. McAfee ePolicy Orchestrator v4.0 and Below Configuration using SNMP
  • 3.10. McAfee ePolicy Orchestrator v4.5+ Reporting Configuration using SNMP
  • 3.11. McAfee ePolicy Orchestrator using ODBC
  • 3.12. McAfee NSM Poller Configuration
  • 3.13. Critical Watch
  • 3.14. MicroSoft SQL
  • 3.15. MySQL
  • 3.16. Tenable Nessus Vulnerability Plugin
  • 3.17. Rapid7 Nexpose Vulnerability Plugin
  • 3.18. HAWK Syslog Plugin
  • 3.19. SNMPv1 and SNMPv2c Query Plugin
  • 3.20. SNMPv3 Query Plugin
  • 3.21. Trend Micro Deep Security
• 4. Tier 4 Desktop Computer Configuration
  • 4.1. Microsoft Windows 2000, 2003, 2008 Server, Microsoft Windows 7, XP, Vista
    • 4.1.1. Agent-based Installation
      • 4.1.1.1. Reload Configuration
    • 4.1.2. Agent-based Upgrade
    • 4.1.3. Agent-based Uninstall
    • 4.1.4. SNARE Agent