The most effective and simplest way to configure the Snare service is to use the web based user interface.

There are a number of menu items on the web UI, accessible from https://localhost:6161.

The menu displays:

a list of links that navigate to pages for configuration, viewing events, status, certificates and licensing
ability to restart the agent service so all changes to settings are applied
a link to the Intersect Alliance Knowledge Base
a link to the Intersect Alliance user guide and other documentation
technical information such as the operating system and build identification of the agent, required when submitting an issue to Snare Support.

Primarily, the interface is used to develop and set the audit, network and audit policies configuration, however options are available to manage the Snare service. The Snare service can be reloaded directly from the menu item Restart Service. This will instruct the Snare service to re-load all the configuration settings, clear the buffers and essentially restart the service.

If settings changes have been made on individual pages, the following message will be displayed:

This will remind users that updates were made throughout the agent, however they have not been applied. The menu item also changes from Restart Service to Apply Configuration & Restart Service.

When Apply Configuration & Restart Service is selected, the Snare configuration settings are applied. The following message will be displayed in the agent to confirm that the settings were applied.

Authentication is required:

when navigating to the browser for the agent
in each instance when Restart Service / Apply Configuration & Restart Service is selected
after the browser is idle for 5 minutes

Any use of the web UI to modify selected configurations, will result in manual configuration changes being overwritten. Details on the configuration file format can be viewed in /wiki/spaces/MACV5/pages/2155315345.

Browser not supported