Set Up Devices for Device Audit report

Overview

Before creating the Device Audit report, you need to configure the devices to include in the report.

The Device Audit Report supports both live and offline devices:

• Live devices are devices actively monitored by SecureTrack. When you configure device credentials for a live device, you can also download the configuration for the device.

• Offline devices are devices not monitored by SecureTrack, but can still be checked in the Device Audit report by uploading a device configuration file.

SecureTrack Reporting Essentials (STRE) requires access to your devices directly.

Offline device example

The Aruba CX10000 switch is an offline device monitored through a configuration file. You want to check whether the switch’s configuration file uses the default SNMP community string public, which is a security risk.

After importing the device configuration file, you define a segment so the report searches only within the SNMP configuration section. In the Aruba configuration file, this section begins with the pattern snmp-server and ends with the pattern exit.

You then create a custom check that searches for the line: snmp-server community "public" ro

If this line is found, the report will trigger a violation.

When running the Device Audit report on the Aruba CX10000, you select this custom check for the device to ensure insecure SNMP settings are flagged.

Prerequisites

• Offline devices: Device configuration file

• Live devices: Device credentials. You can use the same credentials for multiple devices.

Procedure

Configuring devices for device audit includes:

• Selecting the devices to audit

• Configuring access to each device either through credentials (live devices) or a device configuration file (offline devices)

• Defining segments for analysis

• Defining custom checks to run on the device

Select Device for Audit

1. Go to Settings > Setup Device Audit.

2. For multi-domain environments, from the list of domains on the top right, select the domain to which to add the device.

3. For offline devices only, add the offline device:

   1. Click +Add Custom Device Type.

      The Add Custom Device Type dialog box appears.

      

   2. Enter the following information:

      • Vendor name

      • Model name

      • Display name (Device Type): The name of the device that will appear in STRE.

   3. Click Add.

   Configure Device Credentials

   Credential requirements differ for live and offline devices.

   For live devices, you can click Download Config in the device credentials section to download the device configuration. This makes it easier to create custom checks with the correct regex string for the live device configuration.

   For live devices

   1. If the device credentials are not populated, define them:

      • Login Username

      • Login Password

      • (Cisco Only) Enable Password (Optional)

      • Port: Leave empty to use the default port: 443 for HTTPS and 22 for SSH.

   2. To test the validity of the credentials, do the following:

      1. Click Test Credentials
         STRE checks to see if it can reach the device with the credentials provided.

         If the communication between STRE and one or more devices failed, a message appears with this icon:

      2. To view failed devices, click the warning icon.

         

      3. To stop the test, click Abort Test.

   3. To save the credentials, click Save .

   For offline devices

   1. In Manage Offline Device files, click Import File.

      

   2. Select the domain and the offline device.

   3. Click Choose file and upload the device configuration file.

   4. Click Add.

   Define Segments

   1. In the Device Configuration Segments section, click Define Segment.

   The Define Segment dialog box appears.

   

   2. Enter the following information:

      • Segment Name

      • Segment Start Pattern: The characters that begin the segment.

      • Segment End Pattern: The characters that end the segment.

   3. Click Add.

   Configure Custom Checks

   1. In the Custom Checks section, click Add Check.

      The Add Custom Configuration Check dialog box appears.

   

   2. In the Scope section, toggle Limit Search, to limit the check to a specific segment.

      If enabled:

      1. Select the segment.

      2. To trigger a violation if the segment is not found when the report is run, select Trigger violation if segment isn't found during report run.

         Trigger violation if segment isn’t found during report run	Scenario	Outcome
         Enabled	Segment start pattern found	The program will look for a match against the search pattern string within the segment.
         	Segment start pattern or end pattern not found	The check will automatically be marked as a violation, and a notification will be included in the report output.
         Disabled	Segment start pattern found	The program will look for a match against the search pattern string within the segment.
         	Segment start pattern or end pattern not found	The check will automatically be classified as No Match. The report will trigger a violation only if the Violate on setting is No Match.

   3. In the Verification section, enter the following information:

      • Name

      • Optional Description

      • Search Pattern: The pattern the report will search for.

   4. In the Compliance section, select:

      • Violate on: Whether the report triggers a violation if a match is found or not found.

      • Severity

   5. Click Add.

   Additional Actions

   To edit or delete an offline device, configuration file, segment, or custom check, select the item, click the More Options icon (), and choose the desired action.