Trend Micro Deep Discovery Advisor 2.95 Administrator's Guide
Total Page：16
File Type：pdf, Size：1020Kb
Trend Micro Incorporated reserves the right to make changes to this document and to the products described herein without notice. Before installing and using the software, please review the readme files, release notes, and the latest version of the applicable user documentation, which are available from the Trend Micro website at: http://docs.trendmicro.com/en-us/enterprise/deep-discovery-advisor.aspx Trend Micro, the Trend Micro t-ball logo, InterScan, and ScanMail are trademarks or registered trademarks of Trend Micro, Incorporated. All other product or company names may be trademarks or registered trademarks of their owners. Copyright © 2013 Trend Micro Incorporated. All rights reserved. Document Part No.: APEM25797/121119 Release Date: January 2013 Patents pending The user documentation for Trend Micro Deep Discovery Advisor introduces the main features of the software and installation instructions for your production environment. Read through it before installing or using the software. Detailed information about how to use specific features within the software are available in the online help file and the online Knowledge Base at Trend Micro’s website. Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro document, please contact us at [email protected]. Please evaluate this documentation on the following site: http://www.trendmicro.com/download/documentation/rating.asp Table of Contents Preface Preface ............................................................................................................... vii Deep Discovery Advisor Documentation .................................................. viii Audience ........................................................................................................... viii Document Conventions ................................................................................. viii Terminology ....................................................................................................... ix Chapter 1: Deploying Deep Discovery Advisor Deployment Overview ................................................................................... 1-2 Required Network Environment ......................................................... 1-2 Product Virtual Machines ..................................................................... 1-2 Network Settings .................................................................................... 1-5 Deployment Checklist ........................................................................... 1-7 Task 1: Mounting the Device ..................................................................... 1-10 Task 2: Connecting the Device to Power Supplies ................................. 1-10 Task 3: Accessing the VMware ESXi Server Console ............................ 1-10 Task 4: Connecting the Device Ports to the Network Ports ................. 1-13 Task 5: Changing the VMware ESXi Server Password and Assigning an IP Address ........................................................................................................... 1-16 Task 6: Using vSphere Client to Log On to the VMware ESXi Server 1-20 Task 7: Assigning the VMware ESXi Server a License Key .................. 1-22 Task 8: Preparing a Custom Sandbox ....................................................... 1-25 Creating a New Virtual Machine on the VMware ESXi Server .... 1-25 Converting an Existing Host and Deploying it to the VMware ESXi Server ...................................................................................................... 1-42 Creating and Deploying an OVA or OVF File ............................... 1-55 Task 9: Installing the Required Components and Software on the Custom Sandbox .......................................................................................................... 1-61 i Deep Discovery Advisor 2.95 Administrator’s Guide Task 10: Modifying the Custom Sandbox Environment ....................... 1-67 Modifying the Custom Sandbox Environment (Windows XP) .... 1-68 Modifying the Custom Sandbox Environment (Windows 7) ....... 1-71 Task 11: Installing Deep Discovery Advisor ........................................... 1-74 Task 12: Managing the Sandbox Controllers of Slave Devices ............. 1-84 Chapter 2: Getting Started About Deep Discovery Advisor ................................................................... 2-2 New in this Release ........................................................................................ 2-2 Deep Discovery Advisor Logon Credentials ............................................. 2-4 Integration with Trend Micro Products and Services ............................... 2-5 The Management Console ............................................................................ 2-7 Management Console Navigation .............................................................. 2-10 Chapter 3: Dashboard Dashboard Overview ..................................................................................... 3-2 Tabs .................................................................................................................. 3-3 Predefined Tabs ...................................................................................... 3-3 Tab Tasks ................................................................................................. 3-3 New Tab Window .................................................................................. 3-4 Widgets ............................................................................................................. 3-6 Widget Types ........................................................................................... 3-6 Widget Tasks ........................................................................................... 3-7 Out-of-the-Box Widgets ..................................................................... 3-11 Investigation-driven Widgets .............................................................. 3-23 Chapter 4: Virtual Analyzer Virtual Analyzer .............................................................................................. 4-2 Virtual Analyzer Submissions ....................................................................... 4-2 Virtual Analyzer Suspicious Objects ......................................................... 4-11 Suspicious Objects Tab ....................................................................... 4-12 Exceptions Tab ..................................................................................... 4-14 ii Table of Contents Chapter 5: Investigation Investigation Prerequisites ............................................................................ 5-2 Investigation Overview .................................................................................. 5-2 The Search Bar ................................................................................................ 5-4 Valid Query Strings ................................................................................ 5-6 Smart Events ................................................................................................. 5-14 Smart Event Preferences Window ..................................................... 5-18 Visualization Tools ....................................................................................... 5-20 Charts ..................................................................................................... 5-21 GeoMap ................................................................................................. 5-40 LinkGraph ............................................................................................. 5-48 TreeMap ................................................................................................. 5-55 Pivot Table ............................................................................................ 5-62 Parallel Coordinates ............................................................................. 5-67 Log View ........................................................................................................ 5-73 Filtering Preferences Window ............................................................ 5-76 Investigation Baskets ................................................................................... 5-77 Utilities ........................................................................................................... 5-83 Chapter 6: Alerts and Reports Alerts ................................................................................................................. 6-2 Adding Alert Rules ................................................................................. 6-2 Alert Rules ............................................................................................... 6-5 Triggered Alerts ...................................................................................... 6-7 Alert Settings ......................................................................................... 6-17 Reports ........................................................................................................... 6-18 Standard Reports .................................................................................. 6-18 Investigation-driven Reports .............................................................. 6-21 Report Templates ................................................................................. 6-32 Report Schedules .................................................................................