Main Page

1. Actions box
   • Select All: Selects all the profiles in the table.
   • Multiple Editing: Opens a dialog for multiple editing of selected profiles.
   • Remove: Opens a dialog for profiles removal.
2. Filter box
   • Input field: Filters the entire table based on the entered value, which is compared with all the cells.
   • Pin Icon: Pins the filter after a hypothetical reload.
3. Table Actions box:
   • Plus icon: Opens a dialog to add a new profile
   • .CSV: Downloads the table in CSV format.
   • .XLS: Downloads the table in XLS format.
4. Edit icon: Opens a container for Profile Editing

New Profile

1. Name: it is the name of the profile.
2. Description: It is the description of the profile.
3. Pages Section: This section allows you to choose one or more pages to be associated to the profile. You can use the switch (4) to enable all the pages of the level below.

You can select the pages by clicking on the page rows. If you want to create some spaces, you can click on the module, and their visibility will toggle.

Edit Profile

Multiple Editing

Delete Profile

Main Page

1. Actions box
   • Select All: Select all the dashboards in the table.
   • Multiple Editing: It will open a dialog that allows the multiple editing of selected dashboards.
   • Remove: It will open a dialog that allow the tags removal.
2. Filter box
   • Input field: It is used to filter the entire table. The filter value is compared with all the cells.
   • Pin Icon: The icon is used to pin the filter after an hypotetical reload.
3. Table Actions box:
   • Plus icon: It opens a dialog that allow the “Dashboard Added”
   • .CSV: Downloads the table in CSV format.
   • .XLS: Downloads the table in XLS format.
4. Edit icon: It will open a container that allow the Dashboard Editing

New Dashboard

1. Name: It is the name of the dashboard
2. Description: It is the description of the dashboard
3. Timeout: It is a parameter used to specify the interval at which the dashboard data will be updated.
4. This section is used to associate the dashboard with the selected tags. You can click on the line to select the tags.
5. This section is used to associate the dashboard with one or more users. You can click on the line to select the users.
   • Share: The dashboard will be available for the selected users.
   • Copy: The selected users will have their own dashboard

Edit Dashboard

1. Name: It is the name of the dashboard
2. Description: It is the description of the dashboard
3. Owner: It is the dashboard creator. It is not editable.
4. Timeout: It is a parameter used to specify the interval at which the dashboard data will be updated.
5. This section is used to associate the dashboard with the selected tags. You can click on the line to select the tags.
6. This section is used to associate the dashboard with one or more users. You can click on the line to select the users.
   • Share: The dashboard will be available for the selected users.
   • Copy: The selected users will have their own dashboard
7. Shared icon: This indicates that the dashboard is shared with emphasized users.

Multiple Editing

1. Description: It is the description of the dashboard
2. Timeout: It is a parameter used to specify the interval at which the dashboard data will be updated.
3. Used For: this field reminds how many selected dashboards are associated to the element (in this case, tag)
4. This line displays the Remove icon, so you can delete all the associations with the tag.
5. This line does not display the Remove icon, so you can add the association dashboard-tag
6. This section is used to associate the dashboard with one or more users. You can click on the line to select the users.
   • Share: The dashboard will be available for the selected users.
   • Copy: The selected users will have their own dashboard

Delete Dashboards

A package is a box that contains many preconfigured items for a specific vendor or functionality.

Typically a package may contains:

• pattern
• class
• template
• dashboard
• profiles and vendors association
• playbook

In a multitenant environment, a package must be updated tenant by tenant.

Package Installation

You can check the package list to retreive and install pre-configured objects to integrate in you appliance. To install a package you can reach the page from SCM -> Applications -> Packages

Select the package that you need to install and start the process with “Install” button, a popup will appear. To confirm the installation
you need to select the button “Download and Install”

Once downloaded the package, you must associate it with the hosts, to permit the system to automatically associate these hosts to the correct Class, Template, Vendor, and other related objects to permit to parse the log and convert it into events.

Package content preview and filter objects installation

To view the content of the package before the install to Hosts, you can select the button “Customize” near the “Install Button” to view all
the objects inside it. You can also select only objects that you need.

Installation re-run

If you want to associate other hosts after the first package wizard, you can re-run the wizard with the “play” ▶ button near the related
package.

With this options you can: – Add new Host – Configure a different e-mail for all the Rules and Actions – Review the package content with “Customize”)

Package Update

If a new package version is available, a new icon appear under the “play” icon, with double arrows in circle 🔁.

You can review the package content and then update it.

❗ Update Note: please remind that every items in the package may be overwritten (ID of the object as reference) when confirm the updating. This may include name modification, action reset in the LCE Rule or Event Queries actions and so on.

Package removal

To remove a package you can select the “Trash” 🗑 icon then confirm the deletion in the next popup.

Removal Note: Please remind that the removal do not remove the associated active elements, these must be removed manually.

Custom package

In multitenant or multimanagement environment, you can create a custom package. A custom package must be uploaded manually on every tenant and mantain low IDs on the object.

Creation

To create a package you need to go on SCM -> Actions -> Packages

Next you can select elements to include in the package:

1. An already present package to start from. This is used mainly to produce official package.
2. Multiple elements to include like patterns, class, dashboards, rules, templates, event queries, playbook, profiles and vendors.
3. Actions like
   1. Download package: with this option you can download the newly created package. With this option you must provide a name, short description and optional (but recommended) a logo (square format 1:1, any other aspect ratio will be stretched, no trasparent is recommended to provide theme compatibility). The package will start download in encrypted format
   2. Export to tenants: option present only with impersonificated user in multitenant environment. This allow to share elements directly in other tenants. Once selected in the next popup you can select the tenants where to share objects.

Note: pay attention to the objects dependencies (eg. dashboard with widget come from Template or EQ), these are not shown in the page during creation, due to flexibility in the creations steps.

New Package Export

This section describes how to use the new version of the page that allows you to export a set of objects in a package, or transfer them to other tenants of a Multi tenant environment.
The main innovation of the new version of the package export page is the ability to show all types of objects together. When you first open the page, you see all existing objects, with a maximum of 1000 displayed. Then, you can filter the list by:

• Package(s): to see all the objects contained in one (or more, combined) package already installed on SGBox.
• Name and description: write any text to see all the objects that contain it, in their name or description.
• Types: to see only objects of certain types (e.g. dashboard, patterns).
• Tags: to see only objects associated with the selected tags.

All filters can be combined, so you can see, for example, all Classes and Patterns named like “Watchguard”. You have to click on the FILTER button to apply the filters.

The FILTER button does not apply to the package selection filter, which works immediately and also pre-selects the objects contained in the package(s). This allows you to edit an existing package, by simply adding new objects or deselecting the ones you want to remove from the package.

Objects can be selected if it has the switch enabled, to include it in the package that will be exported. If an object cannot be selected, it’s just for display; it will be automatically included in the package if related to selected objects. When you select an object, the systems highlights with a check icon all the other objects that are related to the selected one. Those related objects will be included in the package too. without need to be manually selected.

As the related objects may not be visible immediately in the list, the button PREVIEW at the bottom right of the page can be used to show, at any time, all the objects that will be included in the package.

The search icon next to any object that can be selected, allows you to see a preview of all the objects related to the one you clicked, to see what would be included in the package if that object was selected.

Upload on tenant

Once downloaded the package in encrypted format, you can upload it in other tenants by enter in the target tenant and upload it via
SCM -> Applications -> Upload App.

Once uploaded a new Section in the application will appear “Custom”

Update custom package

When update a custom package, the package match the object by the name and/or ID of the object already present in the appliance, so pay attention by renaming objects already exported or recreating it.

This article explain how to forward logs/events received from SGBox to another server using syslog protocol.
First off all you need to download the “SGBox syslog forwarder” application or ask support via ticket to unlock it.
Remember that this application reads data from internal repository and forwards log, events or incidents to an external syslog server.

From SCM > Application > Tools click install on SGBox syslog forwarder application.

Launch the application and configure it

Additional information:

• Data is sent by using rfc5424.
• Raw data and events are sent with the same origin and timestamp as the original raw log and event.
• Raw data is sent in plain text
• Events are sent in json format

This article explain how a user can change his settings also if he has read-only privileges on different modules.
After logged in with your user, select USER > Edit

Here you can change: username, password and user email

This articles explain how to configure Oracle App in order to retrieve logs from a specified database table.
Requirements:

• SGBox version 4.2.5

Go to the application lists from SGBox go to SCM > Applications

Select Vendors Integrations and download the application Log from Oracle. Click on INSTALL. Once Installed click on EDIT icon

You need to configure the application as follow:

Host: Database IP
SID: Oracle SID
Port: DB port
Username: Oracle user used to login
Password: Oracle user's password
Star Date: Initial date to retrieve logs
Timestamp field: The Column name that contain the timestamp
Timestamp table: The table that contain the timestamp
Separate field: Character used to separate information once retrieved
Query: query used to extract information

IT’S VERY IMPORTANT TO NOT PUT ANY TIMESTAMP CONDITION OR * IN THE SELECT FIELD

After configured you need to schedule the application to be executed. See this section to know how to schedule an application.

The first time the application has been run some components are added and if everything is ok you can see in LM > Analysis> Historical Search the results

Once executed you’ll see your logs LM > Analysis > Historical Search

If yuo have more databases or more SQL Server you can clone it and configure a new one.