Need some Assistance with SEM

Hey Everyone,

So I am digging into a SolarWinds SEM appliance for the first time as I didn't configure it. I wonder if there is a good place to start trying to understand this solution? I have a few questions that I will list below as I have noticed but don't quite understand.

1. When it comes to logging are Rules or connector profiles "KING". I see connector profiles set on certain devices and I have rules set. For example, if I install the agent on a server and I use the connector profile and enable it will I start receiving that specific set of logs like? Or do I also need a rule to configure as well? Sorry seems like a dumb question as I type it.

2. Is there documentation explaining what each rule means? I've seen where I am supposed to hover over the icon, but that only shows the name of the specific object of the rule i'm trying to create, with no explanation of what it does or what I need to do to make sure it works correctly.

3. Is there anyway to retreat to a previous version of SEM. If so do you do that within the GUI or from the box cmc console? Can you go from version 2024.2 to 2020.2 for example (not those exact versions, but same concept).

Thanks in advance

Find more posts tagged with

sem

Accepted answers

All comments

DisVet13

I forgot to type my last question:

4. Does anybody run vulnerability scans against the SEM appliance? If so are you running it against the CMC console, providing those credentials to the scanner? Or is it recommended that you do not scan against it?

npatterson

First thing I would do is review that are agent based and want are agentless base Nodes. The reason for this is you know what is being forward to your sem (Push) compared to what is being take from a node (Pulled)

Look under managed Connectors for list of connectors for push data you can later filter by the tool alias to get ilst of assets configured for that connector

For agent based connectors check to see if there are in connect profile or in the individual node this will determine how you control the configurations.

recommend connection profiles for better control of what connectors are installed on wide scale.

For understanding about connectors I reference Tags for high level and review the connector pages for what is supported. This is a good starting point but I typically look at the regex file this install in on endpoint for the connection to check was data is parsed because I like to know was is drops for good measure. This is slight more advanced that most.

3. I use virtual instance and take snapshot or at least backup the first drive that contain the os version for a roll back if needed.

4. I am paranoid and run most of my Sem through a Reverse Proxy and use as large enough password for CMC you can scan on your want I scan my network weekly for vulnerabilities with no issues. I do not typically give the credentials as SSH is modified so not sure what issues might happen with given credentials.

Number 5 you did not ask but I will tell you. Test mode for rules is your friend run the rules in test mode for at least a week before releasing to the wild. Then with email alerts in place limited the send to 1 every 15 minutes are you will flood your email pretty quick.

DisVet13

@npatterson

Thanks for the quick response. I will dig into everything you have said. On the scanning for vulnerabilities. SEM provides the CMC and password, is that what you use as credentials for a vulnerability scan? Or are you creating a different account within the SEM box for scanning credentials (I'm not even sure you can do that)?

As for upgrading or downgrading the SEM. Our is a virtual instance as well. Do you run the upgrade through the CMC console? Or do you do a different route? Its good to know I can downgrade, but this question is mainly for upgrading.

kellytice

To answer the last question above, typically the access you have to the CMC console is fairly limited; that is by design. SEM runs on a linux backend, but unless you are talking to tech support you will not have an account with root access. While auditors love that aspect of SEM, I can see how it could make it difficult if you need a user account to accomplish your vulnerability scanning goals.

I have heard (anecdotally) that some people will run external scanners to look for open ports, etc... and I haven't heard of any issues with doing so.
I have not heard of anyone doing scanning that requires credentials for SEM, but if that's something you want to do you might ask Tech Support about it to see if it is something that could be accomplished or not.

To briefly touch back on your initial questions:

1. Connectors and Rules are two different things.

Connectors - Although there are a couple of exceptions (like for email SMTP server setup), the vast majority of connectors are log parsers. That concept is true for Windows machines, linux boxes, and network devices.

By default, when you put the SEM agent on a Windows machine, it will have a few connectors already assigned to that agent that pull in the Windows Application, Windows System, and Windows Security logs. There are other connectors that you could assign to that node that could pull in other logs like those from DNS, DHCP, IIS, different variants of anti-virus, and different variants of SQL (among others). Those can be configured by going to Configure --> Nodes, selecting a specific agent-based Node, then clicking "Manage Node Connectors". Optionally, you can define a Connector Profile that contains specific connectors and then apply that profile to one or more nodes (so that you don't have to manually go and apply the same connectors to each Node).

When it comes to network devices, there isn't really an agent configured for those, so after you have configured the network device to send syslog to SEM, you'll just enable a connector for that type of node under Configure -> Manager Connectors.

So, that takes care of getting the data IN to SEM; the next bit will be more about how you can do something when certain events happen:
Rules - As the log events flow in and are parsed by the connectors, Rules will be evaluated and they can take actions based on some criteria being matched in that incoming log data. Some examples would be sending an email, or killing a process, or logging off a user, or sending a popup.

So, to sum that up: the Connectors (or Connector Profile) that's assigned to a Node will determine WHAT gets parsed, while the Rules will determine what ACTIONS occur because certain events came in.

2. I don't believe there is a list of what each out-of-the-box Rule does. You can look at the definition for a given Rule and get a pretty good idea of what it is trying to do. For some of them you can hover over the little " i " icon to get a bit of a description, but I do realize that is often limited:

3. No there isn't a roll-back option. As @npatterson mentioned, per this page "SolarWinds recommends exporting (Hyper-V) or taking a snapshot of (vSphere) your SEM virtual appliance before you perform the upgrade"

DisVet13

Thanks a bunch for this. Especially on the connectors and rules. That makes so much more sense! This surely makes more sense why some of the Rules that are configured are not "producing" anything. I filtered within the active logs based on exactly the defines statement of some rules and received no results. I assume that either those rules are not configured correctly, we are not ingesting via profiles the correct logs, or I guess there maybe no events.

As for the rules, for whatever reason I don't have the little information bubbles. Or at least I cannot find them. I'll circle back and see if I just over looked it. The logic for creating the rules just isn't clicking for me. I've seen rules in other platforms but struggle with the SolarWinds logic.