Snare Central employs an interactive application interface, employing drag and drop, popup dialogs, and dynamically updating data. The Snare Central interface is generally divided into four 'panels', as shown in false-colour, in the image below.
| Info |
|---|
Top Panel
The 'green' panel provides buttons for performing common functions and switching between the different navigation menus. Some of these buttons are greyed out when they are not available for use for the current objective. These buttons are, in order left to right:
| The Snare Logo, which takes you back to the dashboard. |
Modify the configuration of the currently open objective. | |
Change who can access, or modify the configuration of the currently open objective. | |
Configure the objective to regenerate on schedule, and modify the email distribution list. | |
Add the currently displayed objective to the regeneration queue. | |
Displays the currently queued and regenerating objectives. | |
Provides the option to download attachments generated by the currently open objective. | |
Logs you out of your current session on the Server Server. | |
| Switch to the Agent Management Console. |
Switch to the Reports navigation menu mode. | |
Switch to the Status navigation menu mode. | |
| Switch to the System navigation menu mode. |
Objective Navigation Panel
...
A range of default objectives will be installed in the 'Reports' area for you by the Snare Central Installation process.
| Info |
|---|
|
| Tip | ||||
|---|---|---|---|---|
| ||||
Dynamic Search may be used to quickly sift through information across multiple log sources, at the expense of completeness. The following filters are available for this tool:
Note that data that arrives into the Snare Server may take up to fifteen minutes before it is processed. This means, for Snare Server 7.5 and prior, the data isn't available for queries within this time, as data summation occurs at top of the hour, 15 minutes, 30 minutes, 45 minutes, and top of the hour again. |
| Tip |
|---|
The Objective Navigation Panel can be partially hidden from view, by clicking the left-pointing arrow at the top-right of the navigation panel. The panel will be 'folded' into the side of the window. A small, right-pointing arrow will remain in place, to restore the panel to normal size. The panel can also be expanded and contracted by smaller increments, using the left/right pointing arrows. |
...
Over to the right-hand side of the area, the amount of time that the server has been running without reboot will also be displayed, and if the Snare Central Health Checker needs to inform you of an issue that requires your attention, an animated notification icon may also be displayed. This icon may be clicked on for further information.
Objective Panel
The 'yellow' panel is where objectives are actually displayed. When you select an objective from the 'blue' panel, this panel updates to show you the objective.
Many objectives display portions of the objective results in 'tabs' at the top of the page. These can be individually clicked to scan through the results. The type and function of these components is objective dependent, but will often include:
- A 'pattern map', which shows volumes of events, divided up into 15 minute segments for the reporting period.
- Tabular details, which displays a configurable proportion of the results.
- Various line graphs, bar graphs, port-maps, geolocation maps, or pie graphs.
| Info |
|---|
...
| Info |
|---|
Many objectives will also have interactive components that can be clicked to:
...