* .WikiGuest * .SheriffCyberSecurity: AddingAssetsByScanningForNewAssets CustomizeAndDevelopNewPlugins PolicyConsequences

UpPrevious Next Sheriff CSM™ Search and Close Tickets Sheriff CSM lets you search for a particular ticket and use various search criteria to help you refine your...

UpPrevious Next Sheriff CSM™ Clear All Events from the SIEM Database Sheriff CSM backs up events every day and purges them after a threshold (Event Backup Config...

UpPrevious Next Sheriff CSM™ Alarms Tray – Fields Alarms tray field descriptions Sheriff CSM Field NameDescription Intent Strategy Describes the attack pa...

UpPrevious Next Sheriff CSM™ Purge Old System Logs You should delete Sheriff CSM system logs and/or old event logs on a regular basis, otherwise the appliance ma...

UpPrevious Next Sheriff CSM™ Remote Support The Remote Support feature in Sheriff CSM opens a secure, encrypted connection to the Sheriff Support Server through t...

UpPrevious Next Sheriff CSM™ Update Your Sheriff License Key Occasionally, you may need to replace the Sheriff license key in your Sheriff CSM instance. For exam...

UpPrevious Next Sheriff CSM™ Back Up and Restore MongoDB MongoDB is a cross platform and open source document oriented database, a kind of NoSQL database. As a No...

UpPrevious Next Sheriff CSM™ Configure Database Plugins Database plugins extract data from an external database and turn them into Events. Sheriff CSM supports M...

UpPrevious Next Sheriff CSM™ High Availability Prerequisites and Restrictions Before you start, review the prerequisites and restrictions in setting up a high av...

UpPrevious Next Sheriff CSM™ Configure Sheriff CSM to Recognize Your Local Keyboard Follow this procedure if your keyboard does not use a United States key layou...

UpPrevious Next Sheriff CSM™ Configure Synchronization with an NTP Server Use of an NTP server in your network helps ensure that all system components are correc...

UpPrevious Next Sheriff CSM™ Configure Sheriff CSM to Use a DNS Use of a Domain Name Service (DNS) helps Sheriff CSM to resolve host names against IP addresses. ...

UpPrevious Next Sheriff CSM™ Change the Default Time Zone The default time zone for Sheriff CSM is Pacific Time (UTC 7h). If you are not operating in that time z...

UpPrevious Next Sheriff CSM™ Configure a Hostname for Sheriff CSM You should always configure a hostname for Sheriff CSM. This helps you identify each one unique...

UpPrevious Next Sheriff CSM™ Configure the Search Domain For DNS (Domain Name System) lookup and reverse DNS resolution to work correctly, Sheriff CSM requires th...

UpPrevious Next Sheriff CSM™ Configure the Sheriff CSM Enterprise Server and Enterprise Database The Sheriff CSM Enterprise Server component is hardware only, and...

UpPrevious Next Sheriff CSM™ Addendum Notice Regarding Scanning Leased or Public Address Space Sheriff CSM and Sheriff Vigilante® contain a number of built in too...

UpPrevious Next Sheriff CSM™ How to Submit a Security Issue to Sheriff We are always working to improve the security of our products. You, the Sheriff Cyber Secur...

UpPrevious Next Sheriff CSM™ Plugin Management %TWISTY{ showlink="Table of Contents" hidelink="Table of Contents" start="show" showimgleft="" hideimgleft=""...

UpPrevious Next Sheriff CSM™ High Availability Configuration %TWISTY{ showlink="Table of Contents" hidelink="Table of Contents" start="show" showimgleft="" h...

UpPrevious Next Sheriff CSM™ Set Up the Management Interface The first time you power on the Sheriff CSM hardware or launch the virtual machine console after the ...

UpPrevious Next Sheriff CSM™ Asset Management %TWISTY{ showlink="Table of Contents" hidelink="Table of Contents" start="show" showimgleft="" hideimgleft="" ...

UpPrevious Next Sheriff CSM™ About Sheriff CSM Network Security Capabilities Sheriff CSM is designed primarily to help mid size organizations effectively defend t...

UpPrevious Next Sheriff CSM™ Introduction to Sheriff CSM This guide provides information for users of the Sheriff CSM system, that are responsible for monitoring...

To search the Threat Database for available plugins 1 Go to Environment Vulnerabilities Threat Database. Sheriff CSM displays the threat families with the ...

Asset Details View Tab Description TabInformation Shown Vulnerabilities Vulnerabilities related to this asset. Alarms Alarms related to this asset. Event...

Advanced Options for Asset Scans Advanced OptionsSuboptionDescription Scan Type Ping Sends a ping to each asset. Fast Scan (Default) Scans the most commo...

Field Descriptions for Asset Scan Results Column/Field NameDescription Check box to select hosts. Host The IP address that identifies the host. Hostname...

Sheriff HIDS A Sheriff CSM feature and data source for intrusion detection that enables host based log collection, file integrity monitoring, and, on Windows host...

UpPrevious Next Sheriff CSM™ NXLog Plugins Microsoft Windows includes different categories of logs (Security, System, or Application event logs) to record importa...

Network Field Descriptions Network field descriptions Column/Field NameRequired or OptionalDescription Name Required Name of the network. CIDR Required CID...

UpPrevious Next Sheriff CSM™ Sheriff CSM Security Monitoring and Analysis This section provides an overview of Sheriff CSM web UI main menu and submenu options an...

UpPrevious Next Sheriff CSM™ Getting Started with Sheriff CSM This section details typical security operations performed after the system installation, initial de...

Sheriff CSM Documentation

OSXPulse OSX pulses provide information on the reliability of threat data, who reported a threat, and other details of threat investigation.

UpPrevious Next Sheriff CSM™ Network Administration This section covers the following subtopics: * Network List View * Creating a Network * Viewing Netwo...

UpPrevious Next Sheriff CSM™ Asset Group Administration This section covers the following subtopics: * Asset Group List View * Creating an Asset Group *...

UpPrevious Next Sheriff CSM™ Asset Administration Managing assets occurs in Sheriff CSM in the Asset List View. This section covers the following subtopics: *...

User Guides Sheriff CSM : Deployment Guide : User Guide

UpPrevious Next Changing the Boot Sequence on HPE Hardware If the rear view of your Sheriff CSM hardware looks similar to the below, it is built on an HPE ProLia...

UpPrevious Next Changing the Boot Sequence on Supermicro Hardware If the rear view of your Sheriff CSM hardware looks similar to the below, it is built on a Supe...

UpPrevious Next Sheriff CSM™ Default Functions Used in the Sheriff CSM Plugins The Sheriff CSM Server must receive normalized events in a predefined format. Sher...

UpPrevious Next Sheriff CSM™ Deployment Guide This topic discusses the following subtopics: System Overview Sheriff CSM Deployments Set Up the Management Interfac...

UpPrevious Next Sheriff CSM™ User Guide This topic discusses the following subtopics: Introduction to Sheriff CSM Getting Started with Sheriff CSM Sheriff CSM Se...

UpPrevious Next Time Range Time Range sets a period of time in which to match events. When configured, only events that occur during the specified time range are...

UpPrevious Next Event Priority Using Event Priority as a policy condition, you can filter events that are from a server according to how reliable the events are....

UpPrevious Next Reputation Using Open Threat Exchange Reputation data as a policy condition, you can filter events from either the source or destination IP addre...

UpPrevious Next Task 5: Reload Directives To apply all the changes made 1 Click Reload Directives. The text displays in red, suggesting an action. 1 Clic...

UpPrevious Next Task 4: Add a Level 3 Rule to Detect the Same Event with 1000 Occurrences This task is a repeat of Task 3. You can repeat this task as many times...