Home
CMC
Administrator Guide
Information and resources about the Administration section of the Central Management Console (CMC), and the tasks that you can do in this part of the software.
Administration
Settings
Security control panel
The Security control panel page shows an overview of the current status of the learning process and lets you configure the features that manage the: learning, security profile, zones, alerts tuning, and alert closing options.
Alert tuning
The Alert tuning page lets you customize the alert behavior. Specifically, you can impose conditions on one, or many, fields to match criteria. This feature can be selectively enabled for specific user groups.

CMC
- Introduction
  An overview of the Central Management Console (CMC).
- Installation Guide
  Information and resources on how to install the Central Management Console (CMC), and the different options and settings available.
- Administrator Guide
  Information and resources about the Administration section of the Central Management Console (CMC), and the tasks that you can do in this part of the software.
  - Administration
    - Administration page
      The administration page lets a user with administrator privileges configure settings and do other tasks.
    - Settings
      - Security control panel
        The Security control panel page shows an overview of the current status of the learning process and lets you configure the features that manage the: learning, security profile, zones, alerts tuning, and alert closing options.
        Alert tuning
        The Alert tuning page lets you customize the alert behavior. Specifically, you can impose conditions on one, or many, fields to match criteria. This feature can be selectively enabled for specific user groups.
        Alert configuration settings
        Alert closing options
        The Alert closing options page lets you customize the closure details of alerts and incidents. When alerts and incidents are closed, the user must choose the reason why the closure happens. There are two default reasons: actual incident and baseline change.
      - Features control panel
        The Features control panel page shows an overview of the current status of system features configuration and lets you fine tune specific values.
      - Users management
        The Users management page shows all the pages that you need to let you manage authentication and authorization policies for users and groups.
      - CLI
        The CLI page lets you change configuration parameters and perform troubleshooting activities.
      - Dashboards
        The Dashboards page lets you create and configure widget-based dashboards that provide information about your network. The dashboards created here will show on the Guardian home page, and give an overview of the monitored environment.
      - Threat Intelligence
        The Threat Intelligence page lets you manage packet rules, YARA rules, Sigma rules, structured threat information expression (STIX) indicators and vulnerabilities to provide detailed threat information.
      - Data model
        The Data model page lets you create a custom field to the Nodes (All-In-One CMC only) and Assets tables. A custom field lets you add information that might be relevant to your organization, and cannot be extracted from network traffic.
      - Data integration
      - Credentials manager
        The Credentials manager is a tool that lets you centralize the management of monitored endpoints to make it easier to create, delete, or update the credentials that are needed to access those endpoints.
      - Zone configurations
        The Zone configurations page shows all the zone configurations in your environment and lets you add new zone configurations and edit them.
      - Synchronization settings
        The Synchronization settings page lets you customize the parameters related to upstream or downstream machines.
      - Alert playbooks
    - System
- User Guide
  Information and resources about the main features of the Central Management Console (CMC), and the tasks that you can do from the user interface (UI).
- Maintenance Guide
  Information about the maintenance tasks of Central Management Console (CMC), to help you administer and maintain the solution in a production environment.
- Print format documentation
  A list of all the print-format documentation that is available for the Central Management Console (CMC).

Alert tuning

The Alert tuning page lets you customize the alert behavior. Specifically, you can impose conditions on one, or many, fields to match criteria. This feature can be selectively enabled for specific user groups.

Alert tuning page — Figure 1. Alert tuning page

Execution policy

As alert rules can be propagated from upstream connections, conflicts between rules are possible. A conflict is detected when multiple rules, performing the same action, match an alert. To deal with these collisions, the execution algorithm takes into consideration the source of the rules. The user can choose three policies:

upstream_only: alert rules are managed in the top Central Management Console (CMC), or with Vantage. Creation and modification are disabled in the lower-level sensors. Only the rules received from upstream are executed
upstream_prevails: in case of conflicts, rules coming from upstream are executed
local_prevails: in case of conflicts, rules created locally are executed

A special case is represented by the mute action. Consider the following example: the execution policy is local_prevails and a mute rule is received by Guardian from an upstream connection. This rule will be ignored if at least one local rule matches the alert. Conversely, with the execution policy set to upstream_prevails, local mute will be ignored if at least one rule coming from upstream matches the alert.

Live / refresh

The Live icon lets you change live view on, or off. When live mode is on, the page will refresh approximately every five seconds.

Export all

Use this to export all the items from the table.

Import

This lets you import alert rules.

Note: The maximum file size is 2 gigabyte (GB). The supported file type is .nozomi_alert_rules.

+ Add

This lets you add and configure an alert.