BT COUNTERPANE

VERSION 2.0

SNARE 2.4.X CONFIGURATION

BT Counterpane Supported Snare 2.4.x Configuration Guide

Using Snare2.4.x for Windows

2004, BT Counterpane

5/10/2007

Page 1 of 9

BT COUNTERPANE

VERSION 2.0

SNARE 2.4.X CONFIGURATION

Overview
This document is provided for BT Counterpane customers using Snare 2.4.x for Windows. After researching the abilities of the Snare 2.4.x we have put together a standard configuration that will allow BT Counterpane to provide consistent coverage for messages being transferred by this forwarder. The Snare 2.4.x for Windows has several configuration options, which, if used, can cause a failure in filter matching. In an effort to provide consistent coverage to all customers using the Snare 2.4.x for Windows, BT Counterpane has come up with a standard configuration that will be supported. Below are instructions on how to set up the Snare 2.4.x to comply with BT Counterpane standards. Leave all configuration options set at their default value unless changed below. Setup Procedure There is two-step process that will need to be accomplished during this configuration. The first is the BT Counterpane suggested configuration of the Local Security Settings within Windows. The second is the installation and configuration of the EventReporter program. To set up the Local Security Settings 1. 2. 3. 4. Goto Control Panel and open Administrative Tools Open Local Security Settings Select Local Polices and then Audit Policy Change the Security Setting to match the following: a. Audit account logon events: Success, Failure b. Audit account management: Success, Failure c. Audit directory service access: No auditing d. Audit logon events: Success, Failure e. Audit object access: No auditing f. Audit policy change: Failure g. Audit privilege use: Failure h. Audit process tracking: No auditing i. Audit system events: Failure To change the Security Setting on a Policy you will need to right mouse click on the policy you would like to change and select Properties. Then chose the required setting and press Ok. Once you have made all of the required changes, press File and select Exit You are now done with step one, please move to step two.

2004, BT Counterpane

5/10/2007

Page 2 of 9

BT COUNTERPANE

VERSION 2.0

SNARE 2.4.X CONFIGURATION

The first step is to install Snare 2.4.x: 1. Start the installation of the Snare 2.4.x client, click next to continue

2. Please select the appropriate installation directory. Once selected, click next to continue

2004, BT Counterpane

5/10/2007

Page 3 of 9

BT COUNTERPANE

VERSION 2.0

SNARE 2.4.X CONFIGURATION

3. Select the name that will appear in the start menu. Click next to continue

4. Click install to start the installation of Snare.

2004, BT Counterpane 5/10/2007 Page 4 of 9

BT COUNTERPANE

VERSION 2.0

SNARE 2.4.X CONFIGURATION

5. Answer Yes to the following question

2004, BT Counterpane

5/10/2007

Page 5 of 9

BT COUNTERPANE

VERSION 2.0

SNARE 2.4.X CONFIGURATION

6. Next select setup and audit configuration, this will allow you to customize Snare to work with the BT Counterpane monitoring service.

7. You will need to match your configuration to the one outlined below. For the Enter the remote ip or dns address parameter please enter the ip address of the sentry. Click ok to save the configuration and to continue the installation.

2004, BT Counterpane

5/10/2007

Page 6 of 9

BT COUNTERPANE

VERSION 2.0

SNARE 2.4.X CONFIGURATION

8. Apply and restart the Snare service.

2004, BT Counterpane

5/10/2007

Page 7 of 9

BT COUNTERPANE

VERSION 2.0

SNARE 2.4.X CONFIGURATION

9. Click next to continue

10. Click finish to finish the installation.

2004, BT Counterpane

5/10/2007

Page 8 of 9

BT COUNTERPANE

VERSION 2.0

SNARE 2.4.X CONFIGURATION

Once the Snare 2.4.x has been configured as described above, the BT Counterpane filterset should correctly address the messages coming into the Sentry.

BT Counterpane Technical Support If you have any questions or are experiencing difficulties integrating this sensor, please call BT Counterpane Customer Service at 1-888-710-8171.

Additional Information For additional information about this paper and BT Counterpanes services, please see BT Counterpanes Web site at www.counterpane.com, or use the contact information on this page.

BT Counterpane 1090 La Avenida Avenue Mountain View CA 94043 Main phone: 650-404-2400 www.counterpane.com

Toll Free: 888-710-8175 info@counterpane.com

2004, BT Counterpane

5/10/2007

Page 9 of 9