Page Comparison

[Certificate]

This subkey stores SSL/TLS certificates configuration values.

DestinationCertPreference

This value is of type REG_SZ, and defines the required level of SSL/TLS certificate verification when connecting to a remote destination server. 

Note: SSL/TLS certificate verification is not relevant if UDP or TCP protocols are used to connect to the destination.

Accepted values are:
ANY - (Default) Require an SSL/TLS certificate to be presented, but accept the certificate even if the chain of trust cannot be authenticated, or the hostname does not match the presented certificate. This is useful for self-signed certificates.
STRICT - Require an SSL/TLS certificate to be presented, and have both a valid chain of trust and also a hostname matching the certificate. A hostname must be provided in the associated Destination#Host setting, as an IP address will not work.

DestinationCertPreferenceSAM

This value is of type REG_SZ, and defines the required level of SSL/TLS certificate verification when connecting to a Snare Agent Manager server. 

Accepted values are:
ANY - (Default) Require an SSL/TLS certificate to be presented, but accept the certificate even if the chain of trust cannot be authenticated, or the hostname does not match the presented certificate. This is useful for self-signed certificates.
STRICT - Require an SSL/TLS certificate to be presented, and have both a valid chain of trust and also a hostname matching the certificate. A hostname must be provided in the SAM1IP setting, as an IP address will not work.

WebCertID

The thumbprint of the certificate to be used for HTTPS web user interface interactions. 

By default, Snare Agent generates a self-signed certificate. Customer is welcome to replace it with a CA-signed certificate for improved security. 

AgentLog

CachePath

This is the disk cache path where the agent will temporarily save all unsent events if the agent needs to restart. Agent will read and send the events on next start.

Checksum

This value is of type REG_DWORD, and determines whether Epilog includes an MD5 Checksum of the contents of each audit record, with the record in question. Set this value to 0 for no, or 1 for Yes. Will default to FALSE (0) if not set. Note that the checking application will need to strip the final delimiter, plus the MD5 Checksum, from the record before evaluating the record against the checksum.

Clientname

This is the Hostname of the client and is of type REG_SZ. If no value has been set, "hostname" command output will be displayed. Must be no more than 100 chars, otherwise will truncate.

EventSourceId

This is of type REG_SZ and stores the Windows Registry path from where to read the Event Source Id text/value. If the value in EventSourceIdType is 2 (Registry Path), then the text/value in the registry, specified by the path, is included in each event.

EventSourceIdText

This is of type REG_SZ and directly stores the Event Source Id text/value. If the value in EventSourceIdType is 1 (Free Text), then this text/value is included in each event.

EventSourceIdType

This is of type REG_DWORD and stores the option related to specifying Event Source Id: 0(NONE), 1(Free Text), 2(Registry Path).

FileSize

HeartBeat

This values is the frequency with which a heartbeat is sent, set in minutes.

HeartBeatFileExport

This value determines whether heartbeats are logged to a file. Set this value to 0 for no, or 1 for Yes.

HeartBeatOutputPath

This is the path where the heartbeat messages are exported to, if selected.

HostGUID

This value is of type REG_DWORDSZ. When disabled (0), Snare Agent supports TLS 1.2 and TLS 1.3 for web connections. When enabled (1), TLS 1.2 is explicitly disabled; browsers connecting to the agent website must Set to the GUID of the specific network card.

HostIP

IISLogFlush

TLS13Minimum

This value is of type REG_DWORD. When disabled (0), Snare Agent supports TLS 1.2 and TLS 1.3 for web connections. When enabled (1), TLS 1.2 is explicitly disabled; browsers connecting to the agent website must support at least TLS 1.3 for ssl connections.

Separator

Legacy agent setting required to upgrade agents (if it was set to be the identifier to separate events). Defunct for v5 as now set in Destination Configuration.

UpgradePath

This value is of type REG_SZ.  The automatically generated path in which temporary upgrade files are stored.

UseHostIP

IfThis setvalue it resolves the machinesis of type REG_DWORD and determines whether Snare should use IP address from(as theset firstin wiredHostIP) adapter.instead Itof willthe nothostname resolvein wirelessthe IP's at presentevents' header when sending events. Set this value to 0 for noNo, or 1 for Yes.

UseUTC

 Will default to FALSE (0) if not set.

UseUTC

This value is of type REG_DWORD and determines whether Snare should use UTC timestamps instead of the local system time when sending events. Set this value to 0 for no, or 1 for Yes. Will default to FALSE (0) if not set.

Filter# 

(where # is a 
serial number)

This section describes the format of the log filtersFilters applied to Log file monitors. Filters are of type REG_SZ , of no greater than 1060 chars.Example(string), and the stored value looks similar to this: 
Filter1:     
criticality=1,6,6,6,3,3,0,0,0,0match="*"regex=0state=1uuid=e6a813b4ec27404d-3a9b1843-41b44d58-b8739617-e7df57fbb2b1
Criticality- Format for this string is d25c09f3040c

criticality - ten comma-separated integer values ([0-4],[0-7],[0-7],[0-7],[0-10],[1-10],0,0,0,0. ) representing event criticality for different event formats. First integer is between 0 and 4 that indicates indicating the severity of the event . Critical = 4, Priority = 3, Warning = 2, Information = 1, Clear = 0. in Snare format: 0 - Clear , 1 - Information, 2 - Warning, 3 - Priority, 4 - Critical. Next 3 values are Syslog for each RFC3164, RFC3164 Alt and RFC5424 formats. Syslog values RFC3164 Alt and RFC5424 are copied from Syslog and not used separately. Values 0-7 denote denote Emergency, Alert, Critical, Error, Warning, Notice, Info and Debug, Debugrespectively. CEF is  0 is  0 - 10, 0 is least severe and 10 is most severe. LEEF is  1 is  1 - 10, 1 is least severe and 10 is most severe. Last 4 values 0,0,0,0 are reserved and not in use.

eg. criticality=2,5,5,5,7,9,0,0,0,0

match (General Match)  - The General match term is the filter expression, and is defined to be any value which includes DOS wildcard characters. Max length is 512. It can also include regular expressions if 'regex' box is checked. Use = to include matching events, != to exclude matching events. 

eg match="*"

Regex: =0 (Include general string term to match); =1  (Include regex string term to match)

eg. regex=0

CacheSize

match= - a string (if regex = 0) or a regular expression (if regex = 1) to match and INCLUDE. Events matching this filter will be collected. DOS wildcard characters ("*" and "?") can be used when regex = 0, for example: match="*"
or
match!= - a string (if regex = 0) or a regular expression (if regex = 1) to match and EXCLUDE. Events matching this filter will not be collected.
regex - integer indicating whether the match string is a regular expression: 0 - no; 1 - yes
state - an integer representing the state of Filter configuration: 0 - Disabled; 1 - Enabled; 2 - Requiring Service Restart
uuid - a unique 16-byte identifier of this Filter.

See Log Filter Configuration page in this User Guide for more details.

CacheSize

CacheSizeM

This value is of type REG_DWORD, and determines the size of the in memory cache. The value must be between 1 and 1024.If this is set then CacheSize cannot be altered.

CheckTime

Destination1Delimiter

This sub key is of type REG_SZ and is a comma separated list of destinations, which should be a maximum of 100 characters each. It details the IP address or hostname which the event records will be sent (NB: multiple hosts only available in supported agent). See Appendix - Delimiters.The delimiter to be used in the events written to this network destination, including, tab, comma, vertical bar, space and any custom character.  By default the delimiter is a tab character.

Destination1Format

Destination1Host

Destination1mTLSCertID

Destination1Port

This value is of type REG_DWORD, and determines the Destination Port number. This value must be in 1-65535 range. Will default to 514 if a SYSLOG header has been specified.

Destination1SocketType

Destination1TLSAuthKey

FileOutput1Delimiter

FileOutput1FileName

FileOutput1Format

The format to write to the log file. Available formats are:

Snare (0), SYSLOG RFC3164 (1), SYSLOG Alt (2), CEF (3), LEEF (4), SYSLOG RFC5424 (5), SNARE V2 (6), SYSLOG JSON (7), DEVO (8), DEVO JSON (9).

NotifyMsgLimit

NotifyMsgLimitFrequency

RateLimit

SyslogFacility

[Remote]

This subkey stores all the remote control parameters.

AccessKeyAuth

This is of type REG_SZ, and stores the actual password to be used, in encrypted format.

Allow

"Allow" is of type REG_DWORD, and set to either 0 or 1 to allow remote control If not set or out of bounds, will default to 0/NO (ie; not able to be remote controlled).

LockTime

MaxFailAttempt

Restrict

This value is of type REG_DWORD, and set to either 0 or 1 to signal whether the remote users should be restricted via IP address or not. 0 = no restrictions.

RestrictIP

This is of type REG_SZ and is the IP address set from above.

WebPort

This value is the web server port, if it has been set to something other than port 6162. It is of type REG_DWORD. If not set or out of bounds, it will default to port 6162.

[SAM]

Stores the Snare Agent Manager settings

SAM1AuthKey

Key used by the agent to communicate with the Snare Agent Manager.

SAM1IP

The IP/hostname of where SAM is installed, that will communicate with the agent.

SAM1Port

The port number the agent uses to communicate with SAM, port 6262.

[State]

SAMCToken

Token provided by SAM to the agent.

AgentLocked

AgentLockEndTime

LoginAttempts

Log# 

(where # is
a serial number)

RateLimit

SyslogFacility

SyslogTAGTerminator

This value is of type REG_DWORD, having value of 0 or 1, and determines whether to use TAB as SYSLOG (RFC3164) TAG Terminator. SYSLOG (RFC3164) IEFT standard allows all alphanumeric characters considered the part of TAG. It is strongly recommended to keep it as 1, else Destination#Delimiter will be used as TAG terminator.

AccessKeyAuth

This is of type REG_SZ, and stores the actual password to be used, in encrypted format.

Allow

"Allow" is of type REG_DWORD, and set to either 0 or 1 to allow remote control If not set or out of bounds, will default to 0/NO (i.e. not able to be remote controlled).

LockTime

MaxFailAttempt

Restrict

This value is of type REG_DWORD, and set to either 0 or 1 to signal whether the remote users should be restricted via IP address or not. 0 = no restrictions.

RestrictIP

This is of type REG_SZ and is the IP address set from above.

WebPort

This value is the web server port, if it has been set to something other than port 6162. It is of type REG_DWORD. If not set or out of bounds, it will default to port 6162.

SAM1AuthKey

Key used by the agent to communicate with the Snare Agent Manager.

SAM1IP

The IP/hostname of where SAM is installed, that will communicate with the agent.

SAM1Port

The port number the agent uses to communicate with SAM, port 6262.

SAMCToken

Token provided by SAM to the agent.

AgentLocked

AgentLockEndTime

LoginAttempts

Log# 

(where # is
a serial number)

This section describes the format of the log file monitors. Log monitors are of type REG_SZ (string), and the stored value looks similar to this: 

logtype=0logval=""linetype=0lineval="1"watchtype=0watchval="1"dirfilter="C:\temp\LogFilterTest\*"filefilter="*.txt"features=16state=1uuid=3a53e96d-bf10-4d2d-b5da-455ca8d34ec5

logtype - an integer representing the type of logs being collected: 0 - Generic log format(default); 1 - Apache web logs;  2 - Exchange message tracking logs pre 2007; 3 - Exchange message tracking logs 2007; 4 - Exchange message tracking logs 2010/2013; 5 - Microsoft IIS web server logs; 6 - Microsoft ISA firewall logs; 7 - Microsoft ISA web logs; 8 - Microsoft proxy server logs; 9 - Microsoft SMTP logs; 10 - Squid proxy logs; 11 - VMS Security Logs; 12 - Custom Event log; 13 - Microsoft DNS server logs; 14 - NCR ATM Journal Logs; 15 - DHCP Logs

logval - user-defined string that will be used as a log type in the event header if the logtype = 12 - Custom Event Log.

linetype - an integer defining what comprises a single event: 0 - Single Line (every line in the monitored file is converted to a separate event); 1 - Fixed Number of Lines; 2 - Line separating events (a line specified in lineval acts as event separator)

lineval - if linetype = 1, a string representing the number of lines to be read as one event; if linetype = 2, this is the line that separates events, for example, "<end>". 

watchtype - an integer indicating which files should be monitored in the given directory: 0 - All matching files; 1 - Last matching file (alphabetically); 2 - First matching file (alphabetically); 3 - Fixed number of first matching files; 4 - Fixed number of last matching files

watchval - if watchtype = 3 or 4, a string representing the number of first/last matching files, otherwise "1"

dirfilter - a string representing fully qualified path to the desired log file or the directory containing the target log files

filefilter - a string representing the file name or file name pattern to monitor for new logs

features - an integer representing a bitmap of extra features, such as comments inclusion, date-based or regex-based file matching, etc. This value is set programmatically based on other selections.

state - an integer representing the state of Log file monitor configuration. Disabled = 0, Enabled = 1, Requiring Service Restart = 2.

uuid - a unique 16-byte identifier of this Log file monitor.

See Log Configuration page in this User Guide for more details.