Warning: You are viewing an older version of this documentation. Most recent is here: 40.0.1

Capture Settings

For all settings related to capture, you need to apply changes on the probe once you are happy with your change set.

To do so click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

Change interface settings for a probe

This will effectively allow you to enable/disable interfaces on the probe. Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. Click on sub menu Edit under Action form the left hand side panel. Click on subsection Interfaces. Select the desired sniffing interfaces for the remote probe and then click on Submit.

You should be able to verify the change as displayed in the NSM settings sub menu on the right hand side panel view. Click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

NOTE: In case there is a no interface displayed, you can use (Re)discover system parameters under Special actions sub menu from the left hand side panel. This will try a discovery of the different parameters of the probes.

Add Berkeley packet filter to adjust probes inspection

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. On the right hand side under Interface settings click on the interface you would like to add the BPF (Berkeley packet filter) add the filter expression in the Berkeley Packet Filter section - > click on the Submit button.

Click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

For example, to be able to negate traffic from a given host or port, you could do the following:

not (host 10.28.1.30 or host 10.28.1.24)

or

not (port 80 or 8080)

Add threads to an interface inspection on a probe

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. On the right hand side under Interface settings click on the interface you would like to edit -> adjust the number of threads in the Threads section - > click on the Submit button.

Click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

Network card load balancing

In case your system has a network card with available load balancing features for sniffing you can activate the Network card load balancing that will trigger the usage of this feature as well as a series of optimizations. If this option is unset, then the load balancing between threads will be done by the kernel.

Activating this option is not recommended for virtual probes.

NSM settings

For all settings related to Network Security Monitoring, you need to apply changes on the probe once you are happy with your change set.

To do so click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

Change NSM settings for a probe

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. Click on sub menu Edit under Action form the left hand side panel. On the right hand side under NSM settings you can choose/click a particular output for further Basic (enable/disable) or Advanced editing.

Change NSM settings proto/alert

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. Click on sub menu Edit under Action form the left hand side panel. On the right hand side under NSM settings you can choose/click a particular output for further Basic (enable/disable) or Advanced editing.

Enable or disable protocols for a probe

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. Click on sub menu Edit under Action form the left hand side panel. Click on subsection Protocols. Select (or deselect) the desired protocols for the remote probe and then click on Submit.You should be able to verify the change as displayed in the NSM settings sub menu on the right hand side panel view.

Click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

Add custom or extended HTTP information

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. On the right hand side under NSM settings click on the HTTP icon. Click on the Advanced subsection and select the desired option. If you would like to add custom fields make sure Custom logging is selected and add the desired fields in the List of fields section.

Custom fields can be any of these below:

  • accept

  • accept-charset

  • accept-datetime

  • accept-encoding

  • accept-language

  • accept-range

  • age

  • allow

  • authorization

  • cache-control

  • connection

  • content-encoding

  • content-language

  • content-length

  • content-location

  • content-md5

  • content-range

  • content-type

  • cookie

  • date

  • dnt

  • etags

  • from

  • last-modified

  • link

  • location

  • max-forwards

  • origin

  • pragma

  • proxy-authenticate

  • proxy-authorization

  • range

  • referrer

  • refresh

  • retry-after

  • server

  • set-cookie

  • te

  • trailer

  • transfer-encoding

  • upgrade

  • vary

  • via

  • warning

  • www-authenticate

  • x-forwarded-proto

  • x-requested-with

Click on the Submit button.

Click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

Add custom or extended SMTP information

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. On the right hand side under NSM settings click on the SMTP icon. Click on the Advanced subsection and select the desired option. If you would like to add custom fields make sure Custom logging is selected and add the desired fields in the List of fields section.

Custom fields can be any of these below:

  • bcc

  • content_md5

  • date

  • importance

  • in_reply_to

  • message_id

  • organization

  • priority

  • received

  • references

  • reply_to

  • sensitivity

  • subject

  • user_agent

  • x_mailer

  • x_originating_ip

Click on the Submit button.

Click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

Add custom DNS information

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. On the right hand side under NSM settings click on the DNS icon. Click on the Advanced subsection and select the desired option. If you would like to add custom fields make sure Custom logging is selected and add the desired fields in the List of fields section. Custom fields can be any of these below:

  • A

  • AAAA

  • CNAME

  • MX

  • NS

  • PTR

  • TXT

Click on the Submit button.

Click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

Add packet data or payload to the alerts information

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. On the right hand side under NSM settings click on the ALERT icon. Click on the Advanced subsection and select the desired option. Click on the Submit button.

To apply immediately, click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

File handling capabilities

For all settings related to file handling, you need to apply changes on the probe once you are happy with your change set.

To do so click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

Enable or disable file extraction for a probe

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. Click on sub menu Edit under Action form the left hand side panel. Click on subsection Settings. Select (or deselect) the Activate file extraction for the remote probe and enter maximum file size (just a number indicates MB). Click on Submit.

To apply immediately, click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

Change file extraction max size for a probe

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. Click on sub menu Edit under Action form the left hand side panel. Click on subsection Settings. Make sure the Activate file extraction is selected for the remote probe and enter maximum file size (just a number indicates MB). Click on Submit.

To apply immediately, click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

Add MD5 or file magic information

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list. On the right hand side under NSM settings click on the FILES icon. Click on the Advanced subsection and select the desired option. Click on the Submit button.

To apply immediately, click on Apply change(s) under the sub menu Pending modification(s) from the left hand side panel. Choose if you would like to schedule the change or apply immediately. Click on the Apply button. In the task list presented - you will be informed of the details of the task execution - status, duration, started, retries, etc.

Rule Activity for a probe

Review rules activity for a probe

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list.You are presented with an overview of the rules activity for that particular probe over a period of time.You can click on the settings icon to the right to select or change the timespan shown.

Under the Rule Activity section you will have a summary aggregation of the different rules subdivided by - Sid, Msg, Category Hits and the alerts each rules has generated for that particular probe.

If you would like to see the rule itself yo can click on the Msg for that particular rule. To see one particular rule activity’s:

  • rule definition

  • activity (including) on other probes

  • Status in the ruleset

you can click on the sid number for that rule under Sid row under Rule Activity sub section. You can subsequently enable, disable that rule or delete the generated alerts by that rule.

Delete generated alerts by a rule of a particular probe

Click on Appliances major menu -> Select the desired probe - as available under name form the Stamus Probes list.You are presented with an overview of the rules activity for that particular probe over a period of time.You can click on the settings icon to the right to select or change the timespan shown.

Under the Rule Activity section you will have a summary aggregation of the different rules subdivided by - Sid, Msg, Category, Hits and the alerts each rules has generated for that particular probe. You can click on the sid number for the rule in question under Sid row. Click on Delete generated alerts under sub menu Action from the left hand side panel. Confirm by clicking on the Delete alerts button.