Tecnologia

Incident Copy Only Setup.

________________________________________

Problem

Setup NDLP Manager to view DLPe incidents without controlling DLPe polices through the NDLP GUI.

Solution/Workaround

Please follow the steps to allow incident copy only. Make sure that both DLPe and NDLP versions are matching before installing.

1. Install NDLP Manager

2. Install DLPe components (consult DLPe documentation)

3. On the NDLP manager configure epouser

a.Click on SYSTEM | User Administrator | DB User

b.Create password for epouser

c.Under EPO IP Address add the IP and click [Add]

d. Click [Apply]

4. In ePO go to Menu | Software | Extensions.

a. Click Install Extensions

b. Click [Browse]

c. Locate the netdlp.zip extension and click [Open].

d. Click [OK]

e. You now have Data Loss Prevention 9.x.x.xxx extension installed. This will allow you to register a NDLP Manager in ePO.

5. Register NDLP Manger as a Registered Server.

a. In ePO go to Menu | Configuration |Registered Servers

b. Click on [New Server]

c. Fill out the following on Registered Server Builder

1. Server type: "DLP Manager"

2. Name: <DLPMgrHostname>

d. Click [Next] and fill out infomation

1. DLP Manager <IPAddress>

2. Database port (Default 3306)

3. Database User Name: epouser (DB user that was setup in NDLP Manager)

4. Database Password: <epouserpassword>

5. Check mark Copy Incidents/Device Data

6. GUI User Name: <admin>

7. GUI Password: <password>

8. Refresh Period (seconds): (default 60)

d. Click [Test Connection]

e. Click [Save]

6. Create a Server task to push incidents to the NDLP Manger.

a. In ePO go to Menu | Automation | Server Tasks

b. Click [New Tasks]

c. Fill out info for Server Task Builder

1. Name: (ie Push DLPe incidents to NDLP Manger)

d. Click Next and configure server task

1. Actions: (DLP select endpoint events to show in the DLP Manager)

2. Criteria: (Criteria has to be selected to save query ie Domain name)

e. Click [Next]

f. Set schedule

g. Click [Next]

h. On overview click [Save]

7. Add new evidence server into NDLP Manger.

a. Login into DLP Manger go to System tab

b. Click on Actions | New Evidence Server and fill out the following.

1. Hostname: <ePOservername>

2. IP Address: <ePOIPAddress>

3. Username: <ePO DB SA Account>

4. Password: <ePO DB SA Password>

c. Click [Add]

8. Add new device into NDLP Manager

a. Login

...