Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated Configs With Field Best Practices #5

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Updated Configs With Field Best Practices #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
09b313b
Updated Configs With Field Best Practices
Nov 20, 2024
562f1aa
Update Linux Configuration
gpcarval Nov 21, 2024
cccc13a
Update MacOS Configuration
gpcarval Nov 21, 2024
d2225ad
Update Unix Configuration
gpcarval Nov 21, 2024
97e4dd1
Update Windows Configuration
gpcarval Nov 21, 2024
5386309
Fixed indentation
Dec 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
131 changes: 69 additions & 62 deletions linux/snowagent.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,95 +27,102 @@
<!-- Configuration for File System scan-->
<Software>
<Include>
<Path recursive="true" unconditionally="false">/*</Path>
<!-- Only include necessary folders for the file scan-->
<Path recursive="true" unconditionally="false">/etc/*</Path>
<Path recursive="true" unconditionally="false">/var/*</Path>
<Path recursive="true" unconditionally="false">/bin/*</Path>
<Path recursive="true" unconditionally="false">/home/*</Path>
<Path recursive="true" unconditionally="false">/usr/*</Path>
<Path recursive="true" unconditionally="false">/opt/*</Path>
<Path recursive="true" unconditionally="false">/oracle/*</Path>
<Path recursive="true" unconditionally="false">/u01/*</Path>
</Include>
<IncludeCriteria enabled="true">
<FileType>ELF*executable*</FileType>
</IncludeCriteria>
<Exclude>
<!-- Normal temporary directories on Unix systems. -->
<Path>/tmp*</Path>
<Path>/var/tmp*</Path>
<!-- Oracle audit files can be numerous. -->
<Path>*/oracle/*/audit*</Path>
<!-- Common non-relevant file extensions -->
<Path>*.au</Path>
<Path>*.bmp</Path>
<Path>*.bmu</Path>
<Path>*.cfg</Path>
<Path>*.class</Path>
<Path>*.conf</Path>
<Path>*.csm</Path>
<Path>*.css</Path>
<Path>*.dic</Path>
<Path>*.enc</Path>
<Path>*.gif</Path>
<Path>*.h</Path>
<Path>*.htm</Path>
<Path>*.html</Path>
<Path>*.jpg</Path>
<Path>*.js</Path>
<Path>*.log</Path>
<Path>*.mo</Path>
<Path>*.mof</Path>
<Path>*.packlist</Path>
<Path>*.pcf</Path>
<Path>*.pc</Path>
<Path>*.pf</Path>
<Path>*.pl</Path>
<Path>*.png</Path>
<Path>*.po</Path>
<Path>*.properties</Path>
<Path>*.rdf</Path>
<Path>*.sdl</Path>
<Path>*.so</Path>
<Path>*.sql</Path>
<Path>*.ttf</Path>
<Path>*.txe</Path>
<Path>*.txt</Path>
<Path>*.utf8</Path>
<Path>*.xml</Path>
<Path>*.xpt</Path>
<Path>*.zip</Path>
<!-- Exclude common temporary directories -->
<Path>/tmp*</Path>
<Path>/var/tmp*</Path>
<Path>/var/log*</Path>
<!-- Exclude Oracle audit files -->
<Path>*/oracle/*/audit*</Path>
<!-- Exclude common file extensions -->
<Path>*.au</Path>
<Path>*.bmp</Path>
<Path>*.bmu</Path>
<Path>*.cfg</Path>
<Path>*.class</Path>
<Path>*.conf</Path>
<Path>*.csm</Path>
<Path>*.css</Path>
<Path>*.dic</Path>
<Path>*.enc</Path>
<Path>*.gif</Path>
<Path>*.h</Path>
<Path>*.htm</Path>
<Path>*.html</Path>
<Path>*.jpg</Path>
<Path>*.js</Path>
<Path>*.log</Path>
<Path>*.mo</Path>
<Path>*.mof</Path>
<Path>*.packlist</Path>
<Path>*.pcf</Path>
<Path>*.pc</Path>
<Path>*.pf</Path>
<Path>*.pl</Path>
<Path>*.png</Path>
<Path>*.po</Path>
<Path>*.rdf</Path>
<Path>*.sdl</Path>
<Path>*.so</Path>
<Path>*.sql</Path>
<Path>*.ttf</Path>
<Path>*.txe</Path>
<Path>*.utf8</Path>
<Path>*.xpt</Path>
<Path>*.zip</Path>
<!-- *.xml *.txt and *.properties files would normally be excluded but are required for SIOMS -->
<!--<Path>*.xml</Path>
<Path>*.txt</Path>
<Path>*.properties</Path>-->
</Exclude>
</Software>
<!-- Scanning for Oracle databases, requires SIOS -->
<!-- <Oracle enabled="true">
<DefaultInstanceCredentials>
<UserName></UserName>
<Password></Password>
</DefaultInstanceCredentials>
<Oracle enabled="false">
<!-- Password needs to be encrypted-->
<!--<DefaultInstanceCredentials>
<UserName></UserName>
<Password></Password>
</DefaultInstanceCredentials>-->
<Include>
<AllInstances>true</AllInstances>
</Include>
</Oracle> -->
</Oracle>
<Logging>
<MaxSize>10240</MaxSize>
<MaxSize>1024</MaxSize>
<!-- error, warning, info, trace, verbose -->
<Level>verbose</Level>
<Level>error</Level>
</Logging>
<SystemSettings>
<!-- Running processes -->
<Setting key="software.scan.running_processes" value="true"/>
<!-- Scan jar files metadata -->
<Setting key="software.scan.jar" value="true"/>
<!-- Scan package manager for software inventoring on Debian, SUSE, Ubuntu -->
<Setting key="software.scan.dpkg" value="true"/>
<!-- Scan package manager for software inventoring on RedHat and CentOS-->
<Setting key="software.scan.rpm" value="true"/>
<!-- Attempt to find bind mounts and add these to the list of directories to be ignored -->
<!-- Detect bind mounts and add these to the list of directories to be ignored -->
<Setting key="software.scan.ignore_bind_mounts" value="true"/>
<!-- Attempt to find detect autofs mounts and add these to the list of directories to be ignored -->
<!-- Detect autofs mounts and add these to the list of directories to be ignored -->
<Setting key="software.scan.ignore_autofs_mounts" value="true"/>
<!-- Check for server certificate -->
<!-- <Setting key="http.ssl_verify" value="true"/> -->
<Setting key="http.ssl_verify" value="true"/>
<Setting key="log.append" value="false"/>
<!-- Storage folder for snowpacks -->
<Setting key="env.data_dir" value="data/"/>
<!-- Logging folder for snowagent.log -->
<Setting key="env.log_dir" value="data/"/>
<!-- Java executable to run SIOS.jar -->
<!-- <Setting key="env.java_home" value="java/bin/java"/> -->
<!-- <Setting key="env.java_home" value="/java/bin/java"/> -->
<!-- <Setting key="disable_all_updates" value="false" /> -->
</SystemSettings>
</Configuration>
</Configuration>
6 changes: 3 additions & 3 deletions macos/snowagent.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@
</Exclude>
</Software>
<Logging>
<MaxSize>10240</MaxSize>
<MaxSize>1024</MaxSize>
<!-- error, warning, info, trace, verbose -->
<Level>verbose</Level>
<Level>error</Level>
</Logging>
<SystemSettings>
<!-- Running processes -->
Expand All @@ -57,4 +57,4 @@
<Setting key="env.log_dir" value="data/"/>
<!-- <Setting key="disable_all_updates" value="false" /> -->
</SystemSettings>
</Configuration>
</Configuration>
36 changes: 27 additions & 9 deletions unix/snowagent.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,15 @@
<Software>
<!-- Only if Include is specified a disk scan will be initiated. -->
<Include>
<Path recursive="true" unconditionally="false">/*</Path>
<!-- Only include necessary folders for the file scan-->
<Path recursive="true" unconditionally="false">/etc/*</Path>
<Path recursive="true" unconditionally="false">/var/*</Path>
<Path recursive="true" unconditionally="false">/bin/*</Path>
<Path recursive="true" unconditionally="false">/home/*</Path>
<Path recursive="true" unconditionally="false">/usr/*</Path>
<Path recursive="true" unconditionally="false">/opt/*</Path>
<Path recursive="true" unconditionally="false">/oracle/*</Path>
<Path recursive="true" unconditionally="false">/u01/*</Path>
</Include>
<IncludeCriteria>
<!-- Standard file system on HP-UX -->
Expand All @@ -54,6 +62,7 @@
<!-- Normal temporary directories on Unix systems. -->
<Path>/tmp*</Path>
<Path>/var/tmp*</Path>
<Path>/var/log*</Path>
<!-- Oracle audit files can be numerous. -->
<Path>*/oracle/*/audit*</Path>
<!-- Common non-relevant file extensions -->
Expand Down Expand Up @@ -83,22 +92,23 @@
<Path>*.pl</Path>
<Path>*.png</Path>
<Path>*.po</Path>
<Path>*.properties</Path>
<Path>*.rdf</Path>
<Path>*.sdl</Path>
<Path>*.so</Path>
<Path>*.sql</Path>
<Path>*.ttf</Path>
<Path>*.txe</Path>
<Path>*.txt</Path>
<Path>*.utf8</Path>
<Path>*.xml</Path>
<Path>*.xpt</Path>
<Path>*.zip</Path>
<!-- *.xml *.txt and *.properties files would normally be excluded but are required for SIOMS -->
<!--<Path>*.xml</Path>
<Path>*.txt</Path>
<Path>*.properties</Path>-->
</Exclude>
</Software>
<!-- Scanning for Oracle databases, requires SIOS -->
<Oracle enabled="true">
<Oracle enabled="false">
<!-- If no user credential for specific Instance is given this is used on all other Intances. -->
<!-- <DefaultInstanceCredentials>
<UserName></UserName>
Expand All @@ -110,13 +120,21 @@
</Include>
</Oracle>
<Logging>
<MaxSize>10240</MaxSize>
<MaxSize>1024</MaxSize>
<!-- error, warning, info, trace, verbose -->
<Level>verbose</Level>
<Level>error</Level>
</Logging>
<SystemSettings>
<Setting key="log.append" value="true" />
<!-- Scan running processes -->
<!--Setting key="software.scan.running_processes" value="false" /-->
<!-- Standard file system on AIX -->
<Setting key="software.scan.lpp" value="true"/>
<!-- Standard file system on Solaris 11 -->
<Setting key="software.scan.ips" value="true"/>
<!-- Standard file system on Solaris 10 and pervious versions -->
<Setting key="software.scan.svr4" value="true"/>
<!-- Standard file system on HP-UX -->
<Setting key="software.scan.sd" value="true"/>
<!-- Detect autofs mounts and add these to the list of directories to be ignored -->
<Setting key="software.scan.ignore_autofs_mounts" value="true"/>
</SystemSettings>
</Configuration>
21 changes: 12 additions & 9 deletions windows/snowagent.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,31 +80,32 @@
<Daily>true</Daily>
</Occurance>
<Action>scan</Action>
<!-- Time is in 24 hour format-->
<TimeOfDay>09:00:00</TimeOfDay>
<Randomize>60</Randomize>
<Randomize>90</Randomize>
</Task>
</Schedule>
<!-- Scanning for Oracle databases, requires SIOS -->
<!-- <Oracle enabled="true">
<DefaultInstanceCredentials>
<Oracle enabled="false">
<!--<DefaultInstanceCredentials>
<UserName></UserName>
<Password></Password>
</DefaultInstanceCredentials>
</DefaultInstanceCredentials>-->
<Include>
<AllInstances>true</AllInstances>
</Include>
</Oracle> -->
</Oracle>
<Logging>
<MaxSize>10240</MaxSize>
<MaxSize>1024</MaxSize>
<!-- error, warning, info, trace, verbose -->
<Level>verbose</Level>
<Level>error</Level>
</Logging>
<SystemSettings>
<!-- Check for updates every 6 hours -->
<Setting key="http.poll_interval" value="21600"/>
<Setting key="http.poll_variance" value="300"/>
<!-- Verify the Server Certificate - ONLY USE IF HTTPS -->
<!-- <Setting key="http.ssl_verify" value="true" /> -->
<Setting key="http.ssl_verify" value="true" />
<!-- Time to live for all powershell scripts in milliseconds -->
<Setting key="env.powershell_timeout" value="300000"/>
<Setting key="powershell.enabled" value="true"/>
Expand All @@ -120,5 +121,7 @@
<!-- <Setting key="env.java_home" value="java\bin\java.exe" /> -->
<!-- <Setting key="env.is_virtual_desktop_infrastructure" value="false" /> -->
<!-- <Setting key="disable_all_updates" value="false" /> -->
<!-- Control process affinity to limit CPU usage during scan-->
<!-- <Setting key="process_affinity" value="" /> -->
</SystemSettings>
</Configuration>
</Configuration>