General
- Andrew Madge
- Svetlana Sheptiy
The following options may be configured:
- Web Management Port - The port the Snare Reflector web UI operates on.
- Web UI HTTPS Certificate - This certificate will be used for HTTPS Snare Reflector Web UI interactions.
- TLS Listener Certificate - This certificate will be used for TLS client interactions.
- Generate a new self-signed certificate - Newly generated self signed certificates will be appended to the list of available certificates.
- Network Destination certificate verification - Choose the desired level of certificate verification. This can be one of Accept Any or Strict Checking. Accept Any is ideal for self-signed certificates. Strict Checking verifies the entire certificate chain.
- Event Cache Memory Size - This is the total memory size in MB used by the RAM-based event cache. Once the cache is full, the Snare Reflector will store incoming events on disk. Once the disk cache is full, Snare Reflector may start dropping incoming events.
- Disk Cache Folder - This is the folder location of the disk cache. Disk cache files are written to this folder location. This location can be changed entering a new folder location. If the folder location does not exist, then Snare Reflector will revert to the last known good folder location.For performance and security reasons it is recommended that the disk cache be used only on NTFS formatted drives, rather than FAT32.
- Disk Cache File Size - This is the maximum size in MB of the file used by the disk cache to store events.
- Disk Cache Email Alert Threshold - Set this to send an email alert if the disk cache fills to this volume as a percentage of total capacity. A value of 0 indicates no alerts will be sent.
- UTC Charts - Turn this on to display UTC (Coordinated Universal Time) times on destination charts instead of local machine times. By default the times are displayed in local time.
- TLS Authentication Key - Define the authentication key for TLS_AUTH listener. The same key should be used by the agents that wants to send logs using TLS_AUTH
- Setup Wizard - The setup wizard helps you walk through initial steps to get Snare Reflector up and running. Selecting Restart Wizard will cause the Wizard to restart.
To save and set the changes to the above settings, and to ensure the Reflector service has received the new configuration, perform the following:
Click on Update to save any changes to the registry.
Click on the Restart Snare Reflector button at the top of the screen.
Note
Any changes to the Disk Cache Folder, Disk Cache File Size or Event Cache Size will result in the loss of any events currently stored on the disk cache. Please ensure that the reflector is quiet if these settings need to be changed while in operation. Additionally any disk I/O errors during normal operation or on loading after a restart may also result in loss of any events currently stored on the disk cache if the reflector can not process the cache file.