Sometimes, you might want to install your own Red Hat Package Manager (RPM) packages, or make other changes to the SIEM Appliance. This article provides information about our policy for installing third-party software and tools on the SIEM Appliance.
IMPORTANT:
- The installation of third-party software can undermine the security of the system and open it up to exploits and instability. If you don't fully understand the consequences of installing and using third-party software products on your SIEM Appliance, we strongly recommend that you contact your system administrator or a Linux or UNIX expert.
- Recommended best practices for the security and stability of the SIEM system are to avoid changing the system and operating the system outside of the GUI. Normal product operation and configuration are performed strictly through the GUI. There's no circumstance where installing third-party software on the appliance is warranted.
- Although we recommend that you use the GUI to operate and configure the Appliances, SSH is enabled by default on the ESM. SSH can also be enabled on other Appliances, but is reserved mainly for troubleshooting. Some standard Linux commands aren't present on an SIEM; others have been changed to provide proprietary behavior for the SIEM appliance. The system detects and can automatically undo certain command-line changes. These changes often appear as Integrity Check errors.
For example, to protect the system, it's not supported to perform the following actions from the command line:
- Add a new Linux user
- Change the root password
- Change user, group, or file permissions
- Format, partition, or mount file systems
- Change any system configuration files (network / SNMP/ logging configurations)
- It's not advisable to use the SIEM product as a repository, FTP server, or NFS share. In addition, we don't advise the use of other functions that require command-line or root-level access to the system. Essentially, if it's not possible to do something from the GUI, it shouldn't be done on the SIEM.
NOTE: As a security appliance, the environment in which the SIEM operates must be secured against exploits and attacks. To help achieve a secure environment, the product operates with a strict firewall. It regularly performs integrity checks to make sure that no third-party software is installed. If invalid RPM packages or software is detected, the system produces an alarm accompanied by a red flag.
If you encounter an integrity check failure, contact Technical Support as soon as possible to ensure a secure and stable system.
- If you are a registered user, type your User ID and Password, and then click Log In.
- If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.
