Audience
Prerequisites
Course Overview
◦ Day 1
Section 1: Functionality and Purpose
◦ Day 2
Section 2: Policies and Alerts
Section 3: Live Lab
Lab Setup – Course DVD Exercises & Demos
◦ Hands on experience throughout the course
◦ VMWare Player
Windows 2003 Server
Self-contained, server and agent are on the same
functional VMWare image
Demonstration preceding each exercise
Tripwire training books are available for checkout at the library
Functionality and Purpose 5
IIS Server Private Data System
Tripwire Clients
Tripwire Server Push agent out to
system you’re protecting
Or, install agent manually on system you’re protecting Agents accept
settings from server, perform tasks, and send results to server
Minimum hardware requirements
Network port and hostname requirements Agent Installation – Services Password!! Demo: Installing Tripwire Enterprise Server
software on Windows 2003 Server
Functionality and Purpose 8
Port Requirements
Port Protocol Application Use
443 TCP HTTPS Secure HTTP connection to the Tripwire Enterprise from a web browser
8080 TCP HTTP Alternate HTTP port for application integration and agent updates
9898 TCP Services Communication to/from Agent Service
Any and all of these ports are configurable to a different port number
Functionality and Purpose 10
Licensing
◦Contact the CU Licensing Office for License Authorization Code (LAC)
◦Pre-generated LACs include 30 file system nodes and 30 network nodes
Accessing the Tripwire Enterprise Console
◦ Accepting the SSL Certificate
Console Layout
◦ Sidebar
◦ Tabs
◦ Button Bar
◦ Interface Toolbar
◦ Tree Pane
◦ Status Bar
◦ Main Pane
User Accounts, Roles, and Groups
◦Pre-defined Roles
Administrator Power User
Regular User
Monitor User
User Administrator
◦User Groups
Access Controls
◦An access control is used to limit the
permissions of the specific users and user groups to nodes and node groups.
User Settings
◦User Preferences
User preferences affect only the display for a
user
◦Difference (Viewer) Preferences
System Settings
◦Global configuration options which apply to all users
◦Severity Ranges
A numeric value which is used in a rule to indicate changes to monitored objects and the relative importance of these changes.
◦ Global Variables
Used in place of specific text strings or passwords.
Exercise 1: Accessing the Console Exercise 2: Licenses
Exercise 3: Getting Help
Exercise 4: User Accounts and Roles Exercise 5: User Groups
Exercise 6: Permissions
Exercise 7: User Preferences Exercise 8: Severity Ranges Exercise 9: Global Variables
How would one obtain a license to run a Tripwire
Enterprise Server?
What are the configurable user settings? What is a severity range?
What is a global variable?
Tripwire Enterprise Objects
◦
Nodes
◦
Rules
◦
Actions
◦
Tasks
Tripwire Enterprise Objects
◦
Elements
◦
Versions
Policies and Alerts 23 IIS Server Index.html Search.php Jan 3 Edit July 30 Edit April 7 Edit
Understanding Groups
◦Node Groups
◦Rule Groups
◦Tasks and Nested Groups
Moving, Deleting, Linking, and Unlinking Objects
◦ Move
◦ Delete
◦ Copies of Node Objects
◦ Linking
Discovered objects
◦ Unlinking
The Unlinked Folder
◦Importing and exporting objects
Demo
: Working with Objects
Exercise 1 – Groups
Exercise 2 – Moving, Linking, Unlinking, Deleting
Objects
What is the difference between a node, rule,
action, and task?
How is a version related to an element? Can actions be grouped?
Place Nodes in Groups
◦
The Node Tree
Geographical Location
Type of Node
Other Node Options
◦
Security Tab
◦
Variables Tab (node specific)
Exercise 1 – Node Specific Variables Exercise 2 – Agent Logs
Grouping Rules
◦
The Rule Tree
Integrity Check
Links to Rules Library based on time to run
Rules Library
Type of Node Platform
Handout: File System Rule Configuration Reference Handout: Windows Registry Key and Value Attributes
Create Criteria Sets
◦Choosing file attributes
Static attributes
Dynamic attributes
Content attribute
Permissions attributes Package data attributes
Exercise 1 – Criteria Sets
Exercise 2 – File System Rules Exercise 3 – Registry Rules
Exercise 4 – Command Output Capture Rules
Actions are an event that is executed given the
outcome of an element change
Predefined Actions for file systems
Handout: Actions and Conditional Actions
What is the best practice for organizing nodes? Give an example of a rule that you would create.
Would you associate that rule with an action?
Creating Baselines
◦3 steps before running a baseline
Check Severity Ranges Check Monitored Objects
Schedule
Change Notification
◦ E-mail Action – Summary vs. Contextual
◦ Execution Action
Finding Changed Objects
Using the Difference Viewer
◦ Modification
◦ Addition
◦ Removal
Exercise: Examining changes
Exercise 1 – Tasks and Baselines for File System
Objects
Promoting expected changes
◦ Manual
◦ Promote by reference
Managing unexpected changes Gathering audit information
Irrelevant Changes – rule tuning
What is a baseline?
What objects are necessary to schedule a
baseline?
What is an indication of a change in the Tripwire
console?
What are the different responses to changes?
Archiving Log Messages
Compacting Element Versions
What is the purpose of Tripwire? What does Tripwire monitor?
What are the objects that make up a task? How does Tripwire detect changes?
Creating Policies to Manage Change
◦ General Principles
◦ Step 1: Define a Policy
◦ Step 2: Outline the Policy
◦ Step 3: Create the Policy Objects
Categorize Objects Remediate Changes
Minimize the amount of effort required by IT and
management staff
Internet Facing Systems Principles Private Data Systems Principles Live Lab Principles
Policies and Alerts 59
Change Occurs
Scheduled Task Performed
Appropriate Administrator Alerted
Policies and Alerts 60 Change Occurred Evaluate Change Unexpected Promote Unexpected Change
Policies and Alerts 61 Unexpected? Revert Declare Security Incident Revert? Change Detected Authorized Unauthorized Yes No Promote Run the task or
check the rules
Policies and Alerts 62 Change Occurred Evaluate Change Unexpected Promote Unexpected Change
Policies and Alerts 63
Fix the rule and task as necessary
Run the task or check the rules
Eliminate elements no longer checked Change
Detected
Unexpected Change
Policies and Alerts 64 Change Occurred Evaluate Change Unexpected Promote Unexpected Change
Policies and Alerts 65
Change Detected
Unexpected
Change Tuning
Promote changes as necessary
Import the rules.xml file
We’ll follow step by step the reason behind the
pre-defined rules that are outlined in the rules.xml file
