Proof of Concept Checklist for Reputation Security Monitor v1.6 Plus

Summary:

The document provides a step-by-step guide for installing and configuring Reputation Security Monitor Plus v1.60, tailored for users with or without internet access during a Proof of Concept (PoC). Here are the key points: For Users with Internet Access: 1. Install Model Import Connector on both Linux and Windows 64-bit systems. 2. Configure Active List capacity by adding `activelist.max_capacity=1500000` to `\config\server.properties`. 3. Set Manager Heap Size to at least 4 GB and restart the Manager if necessary. 4. Install Reputation Security Monitor Plus v1.60 using `Reputation_Security_Monitor_Plus_1.6.arb`. 5. Configure Model Import Connector in the Console with "Model Import User" set to admin, adjusting heap size minimum to at least 2 GB or more if possible. 6. Start the Model Import Connector and send a start command from the Console. Verify by checking Malicious Domains and IP Addresses Active Lists for entries. For Users without Internet Access: 1. Download necessary files. 2. Follow steps 3-6 with internet access but use downloaded Active Lists. 3. Import lists into the system as per ArcSight procedures for solutions or models. 4. Verify import success by checking specific Active Lists related to RSM. 5. In the Rules section, deploy Real-time Rule(s) from "Reputation Security Monitor 1.5" group and wait for rules to appear under this group.

Details:

The provided document outlines a checklist for installing and configuring Reputation Security Monitor Plus v1.60, along with specific instructions tailored for users with or without internet access during a Proof of Concept (PoC). For users with internet access: 1. Install the Model Import Connector which is available in versions compatible with both Linux and Windows operating systems on a 64-bit system. 2. Configure the Active List capacity by adding `activelist.max_capacity=1500000` to the `\config\server.properties` file, then restart the Manager for the new setting to take effect. 3. Ensure that the "Manager Heap Size (MB)" is set to at least 4 GB and restart the Manager if necessary. 4. Install Reputation Security Monitor Plus v1.60 by running `Reputation_Security_Monitor_Plus_1.6.arb`. 5. After installation, configure the Model Import Connector in the Console with the "Model Import User" set to admin, adjusting the heap size minimum to at least 2 GB if possible or more if available memory permits. 6. Start the Model Import Connector and send a start command from the Console once it's configured. Verify its operation by checking the Active Lists resource for entries in specified lists such as Malicious Domains and Malicious IP Addresses, which may take some time to populate. For users without internet access: 1. Download the necessary files mentioned above. 2. Follow steps 3-6 from the section with internet access but use the downloaded Active Lists instead of fetching them online. 3. Import these lists into your system as per standard ArcSight procedures for importing solutions or models. To summarize, you need to verify that an import was successful by checking if entries have been populated in specific Active Lists related to a Reputation Security Monitor (RSM) appliance. You should then go to the Rules section within the ArcSight Solutions and find the "Reputation Security Monitor 1.5" group. Right-click on this group, select "Deploy Real-time Rule(s)", and wait for a few seconds while the rules appear under the "Real-time Rules/Reputation Security Monitor 1.5". These rules are linked to the ones in the original ArcSight Solutions/Reputation Security Monitor 1.5 group.

Disclaimer:

The content in this post is for informational and educational purposes only. It may reference technologies, configurations, or products that are outdated or no longer supported. If there are any comments or feedback, kindly leave a message and will be responded.