Best Of

Re: IBM Qradar SIEM

Hi Vincent

You can set Policy Manager to forward alerts to a third-party syslog server.

Currently, both TCP and UDP transport protocols are supported.

To configure alert forwarding:

Select Tools > Server configuration from the menu.
Click Syslog.
Select Forward alerts to syslog and enter the server address.
- By default, alerts are forwarded to syslog using UDP port number 514. If you want to use a different port, enter the port number after the server address, for example, example.com:8080.
Select the message format.
- Both Syslog (RFC 3614) and Common Event Format messages are supported.
Click OK.

Note - Customization is not possible on system logs configuration

JamesC

1

Re: Client Security 14 firewall popup dialogs

Hi Ashok

It's expected behavior and that's how Windows Firewall works.

It allows all connections which we allow in Firewall settings and blocks ones which are blocked in firewall profile. But for unknown inbound ones it may ask for user to decide - that's why users see these dialogs.

To tell which rules exactly are needed, admin can check event log for Windows Firewall or C:\ProgramData\F-Secure\Log\Firewall\Blocks.log - this file logs all blocked connections by windows firewall.

You need to trigger these apps to be blocked and can read which connection was blocked in blocks.log - then can add rule which would allow it.

Note that Windows Firewall configuration will be altered even when the prompt is dismissed by selecting “Cancel”. Two inbound rules for the related application will be created with Block action for both TCP and UDP protocols.

JamesC

1

Re: After upgrading to client security 14.10, client shows error "Virus and spyware protection malfuncti

Hi FabioRocha

How many machines are affected ?

Follow the instructions below one at a time and check whether it solves the issue. Move on to the next step if issue is not resolved.

Check and ensure that the following services are up and running. Start the services if they are not running. Or perform reset by stopping and restarting the services manually:
- F-Secure Automatic Update Agent
- F-Secure Management Agent
- F-Secure Network Request Broker
- F-Secure ORSP Client
- F-Secure WebUI Daemon
- FSGKHS
Download and run the FSAUA reset tool to reset the potentially corrupted definition updates. You can download the tool here: https://download.f-secure.com/support/tools/FSAUA-Reset/fsaua-reset.exe
Download and run the fsdbupdate utility to install the definition updates manually. You can find the utility here: https://download.f-secure.com/latest/fsdbupdate9.exe
Uninstall the product and then reinstall it using the F-Secure uninstaller tool. You can find the tool here: https://www.f-secure.com/en/business/support/support-tools
Check on the IP configuration that your computer uses the correct subnet. For example, if it uses subnet /24 instead of /22, IP 10.X.240.X is not able to join Policy Manager in the 10.X.241.X destination.
Reset GUTS2 folder by;
- Perform step 1 (stop services)
- Delete guts2 folder at C:\ProgramData\F-secure
- Start back services
- Check for updates

JamesC

1

Re: Email and Server security strips XLS files (not Autorun macro) with exclusion

Hi all

We have the fix ready, for ESS 12.X on Exchange Server 2013 (and later), where it strips XLS files (not Autorun macro) even with exclusion.

Please let me know if you want the fix

JamesC

1

Re: uninstall F-Secure Client Security 14.10 on multiple laptops

Hi krisvdv

How many clients do you need to uninstall ?

If you need to do a mass-uninstall, you can use the UNINSTALL operation available in the INSTALLATION tab in F-Secure Policy Manager, however make sure the context is correct. Meaning you have the correct sub-domain (with eg. only server hosts) or a particular host selected (when performing the operation) on the left pane.

Once done, distribute the policies. The client will be uninstalled when it receives the policy. A reboot is not performed after uninstallation, however installing a different end-point protection client likely will require a reboot of the host

JamesC

1

Re: Device Control USB not getting blocked

Hi ITSM

You may need to block it using Hardware ID class. Some USB devices have different classes.

You can limit or block access permissions for removable drives using Device control. Refer to the following link for instructions:

Note: Device control can only be configured from the Policy Manger or PSB Portal (Profile editor). There is no local configuration user interface.

JamesC

1

Re: Quarantine Management

Hi ITSM

We have determined the root cause. This will be fixed with next release, and should be available within a week or two.

JamesC

1

Re: How do I block a smartphone on PSB

Hi Carlos2285

To block/disable mobile phone via Device Control from PSB web portal, you need to block the following device classes.

Please add a device access rule as below, and let me know if it works:

Display name: Mobile Phone storage
HardwareID: USB\Class_FF
Access level: Blocked

Repeat this rule with the below mentioned device classes to block all smart phones:

HardwareID: USB\Class_00
HardwareID: USB\Class_08
HardwareID: USB\Class_02
HardwareID: USB\Class_EF

JamesC

2

Re: Linux Security 64 more documentation?

Hi Donovan,

I hope the below finds you well, but please do let me know if you have further concerns or questions.

Which service is responsible for what?

Currently, we have the following services for the Linux Security 64 but it could change at any moment through a routine channel update without a notice or advance warning.

* f-secure-baseguard-accd.service is responsible for receiving access permission requests from the kernel through the fanotify API. It can grant access autonomously, but for malware analysis, it uses f-secure-baseguard-icap.service.
* f-secure-baseguard-as.service is a BaseGuard facility for email spam scanning. In LS64, the service is inactive.
* f-secure-baseguard-cleanup.service makes sure channel updates don't accumulate on the disk without limit.
* f-secure-baseguard-icap.service is the malware analysis service used for realtime, scheduled and manual scanning.
* f-secure-baseguard-orspgw.service is a local proxy for F-Secure's Online Reputation Service. It is used by f-secure-baseguard-icap.service.
* f-secure-baseguard-update.service monitors F-Secure's GUTS2 service for channel updates and sends notifications to fsbg-updated.service.
* f-secure-linuxsecurity-fsicd.service maintains the file integrity checker baseline.
* f-secure-linuxsecurity-lspmd.service locally distributes policy settings to LS64 services.
* f-secure-linuxsecurity-scand.service manages manual and scheduled scans.
* f-secure-linuxsecurity-statusd.service collects status and statistics information from LS64 services and relays them to the policy agent (fsma2)
* fsbg-statusd.service collects status and statistics information from BaseGuard services and relays them to the policy agent (fsma2)
* fsbg-updated.service schedules the installation of online channel updates.
* fsbg.service locally distributes policy settings to BaseGuard services.

How to invoke manual configuration update?
- All configurations related to Linux Security 64 needs to be done via Policy Manager. Currently, it is not possible to do a manual update etc
How to check proper functioning of the antivirus?
- The only way to check that the antivirus is functioning properly is by scanning an eicar file. Alternatively, you could also check the status of LS64 services and make sure that they are up and running.
Eicar test file is not working with full real time scanning on / enable, /opt/f-secure/linuxsecurity/bin/fsanalyze , but EICAR_Test_File_Not_A_Virus is working ok.
- By default, “Files and folders to scan” setting for real time scanning is empty in Policy Manager that customer has to specify which file/directory to be scanned by the real time scanning after the product installation. If they want all files to be scanned, they can consider to add root directory (/) to that setting as below.
Do we need only to configure "Linux security 64" or is the "Real-time scanning" also involved ?
- You only need to configure “Linux security 64” for this LS64 product as shown on the screenshot above

JamesC

7

Re: Email and Server security strips XLS files (not Autorun macro) with exclusion

Please check your inbox. I have just messaged you the links for the hotfix

JamesC

2