The most effective and simplest way to configure the SnareCore service is to use the Snare web based user interface. There are a number of menu items on the web UI, accessible from http://localhost:6161. The menu displays:bjet
- a list of links that navigate to pages for configuration, viewing events, status, certificates and licensing
- ability to restart the agent service so all changes to settings are made
- a link to the Intersect Alliance Knowledge Base
- a link to the Intersect Alliance user guide and other documentation
- technical information such as the operating system and build identification of the agent, required when submitting an issue to Snare Support.
Primarily, the interface is used to develop and set the audit, network and objectives audit policy configuration, however options are available to manage the SnareCore service. The SnareCore service can be reloaded directly from the menu item Restart Service. This will instruct the SnareCore service to re-read all the configuration settings, clear the buffers and essentially restart the service.
...
Any use of the web UI to modify selected configurations, will result in manual configuration changes being overwritten. Details on the configuration format for the registry can be viewed in Appendix B - Snare Windows Registry Configuration Description.
...