Introduction to server configuration sets

Introduction

To access configuration set functionality

To view configuration sets

To add and specify a configuration set

To edit the parameters of a configuration set

To delete a configuration set

To sync a configuration set

To check the sync status of a configuration set

To view the sync history of a configuration set

To manage the functionality of a configuration set from the Configuration Set tab

RESTful API

Introduction:

The server configuration set functionality in Entuity enables you to create server configurations from a central server and then push them to remote polling servers, as appropriate. It also enables you to keep existing and new remote polling servers up to date with current configurations from the central server.

You can create configuration sets to which you can add servers. A server cannot belong to more than one configuration set.

To access configuration set functionality:

Configuration set functionality is accessible from the Configuration Set tab of the Multi-Server Configuration page. To access this functionality:

1.  From the Main Menu, click Administration.
   The Entuity Administration page is displayed.
2. In the General Settings section of the page, click Multi-Server Configuration.
   
   
    
3. On the Multi-Server Configuration page that is displayed, click the Configuration Set tab.
   
   
   
   Note, to see all the buttons on this tab, you might need to zoom out on your web browser.

To view configuration sets:

The configuration sets that you have added are listed in the table on the Configuration Set tab of the Multi-Server Configuration page.

The table displays the following details:

To add and specify a configuration set:

Adding a configuration set has two stages:

1. Create the configuration set with the Add button.
2. Specify the parameters of the configuration set with the following buttons:
   • Assign Servers
   • Manage Users
   • Manage Views
   • Manage OS Services (from Entuity v21.0 P03 upwards)
   • Manage CPE Mapping Rules (from Entuity v22.0 upwards)
   • Manage Thresholds (from Entuity v22.0 upwards)
   • Manage Webhooks (from Entuity v23.0 P03 upwards)

To add a configuration set:

1. Navigate to the Configuration Set tab of the Multi-Server Configuration page.

2. Click Add at the top of the page (or from the Overflow Menu).
   
   

   The Add Configuration Set form is displayed.
    

   
    

3. Specify a Name and Description for the configuration set.
4. Sync Views - specify whether the servers in this configuration set will be required to have the same Views. If enabled, existing Views on this server will be replaced by the Views specified in the Manage Views option (see below). By default, this is not enabled.
5. Sync Users - specify whether the servers in this configuration set will be required to have the same users. If enabled, existing users on this server will be replaced by the users specified in the Manage Users option (see below). By default, this is not enabled. 
   Note, it is not possible to create a config set that contains a user who does not have a specified password.
6. Sync User Groups - specify whether the servers in this configuration set will be required to have the same user groups. If enabled, existing users group on this server will be replaced by the user groups specified in the Manage Users option (see below). By default, this is not enabled.
7. Sync OS Services - (from Entuity v21.0 P03 upwards) specify whether to sync OS Services details, for example, service name and service rules. To enable this setting, you must also enable Sync Views above.
8. Sync CPE Mapping Rules - (from Entuity v22.0 upwards) specify whether to sync CPE Mapping Rules across the servers in this configuration set. CPE Mapping Rules and Groups are used to automatically discover potential//candidate CPEs (so long as vulnerability monitoring is enabled).
9. Sync User Defined Thresholds - (from Entuity v22.0 upwards) specify whether to sync user defined thresholds across the servers in this configuration set. 
   Note, if a user defined threshold utilizes a custom event, then that custom event will need to be created on all servers in a configuration set in order for the user defined threshold to successfully sync across those servers.
10. Sync Custom Webhooks - (from Entuity v23.0 P03 upwards) specify whether to share and sync the custom webhook configuration on the central/controlling server in the configuration set across the servers in this configuration set. By default, this is not enabled.
    Note, a custom webhook configuration comprises the custom webhook group definitions, including all the rules, conditions, and events for each custom webhook group.  
    Note, for events to be raised on any server in a configuration set, Entuity recommends that the only custom webhook configuration on the server must be the custom webhook configuration of the configuration set to which the server belongs. If other custom webhook configurations exist, then synchronization of the configuration set takes priority in the database. 

To assign servers to a configuration set:

Note: assigning a server to a configuration set will replace all users, user groups, and Views in that server with those specified for that configuration set (depending on the configuration set's sync preferences). As soon as you assign a server to a configuration set (even if the configuration set is empty and has no users, user groups, or Views specified to it), that configuration set will then be queued for synchronization and therefore the existing configuration on that server will be lost. If you want to prevent this immediate loss of existing server configuration, ensure that you do not assign servers to the configuration, or pause the synchronization (with the Status column icon), until you are happy that the configuration set contains everything you need.

Note regarding remote servers configured for external authentication: servers that are configured for external authentication (for example, LDAP) are permitted to be part of a configuration set, but their users will not be synced in accordance with the configuration set's parameters, even if the Sync Users option is enabled.

1. From the Configuration Set tab of the Multi-Server Configuration page, select the configuration set that you want to edit.

2. Click Assign Servers at the top of the page (or from the Overflow Menu or right-click Context Menu).
   
   

   The Assign Servers form is displayed.
   
   
    

3. Select the check boxes next to the servers that you want to include in the configuration set. 
   If any of the servers already belong to another configuration set, a warning message is displayed below the name of the server. If you attempt to add a server that already belongs to another configuration set, a warning message is displayed when you save your changes.
   
   
    
4. Click Done to save your changes. Otherwise, click Cancel. 
    
5. At the confirmation window that is displayed, click Yes to confirm the deletion. Otherwise, click No. 
   
   

To assign users and user groups to a configuration set:

1. From the Configuration Set tab of the Multi-Server Configuration page, select the configuration set that you want to edit.
2. Click Manage Users at the top of the page (or from the Overflow Menu or right-click Context Menu).
   
   
    
   The Account Management page is displayed from which you can add, edit, or remove users and user groups to and from a specified configuration set.
3. Select either the Users or Groups tab in the top-right of the page, and then select the configuration set from the Server/Configuration Set dropdown field in the top-left of the page. 
4. Add, edit, or remove users, as needed.
   
   For users:
   
   
   
   For user groups:
   
   
   
   Note, it is possible to add a user group from a central server to a remote server that is on an earlier version of Entuity.
   
   See the user accounts and user groups articles for more information on managing users and user groups in Entuity.

To manage the Views in a configuration set:

1. From the Configuration Set tab of the Multi-Server Configuration page, select the configuration set that you want to edit.
2. Click Manage Views at the top of the page (or from the Overflow Menu or right-click Context Menu).
   
   
   
    The View Management page is displayed, from which you can add, edit, and delete Views, and can specify content and incident/event filters for Views.
    
3. Select the configuration set from the Server/Configuration Set dropdown field in the top-left of the page, and then specify and manage the Views that you want to include in, or remove from, this configuration set.
   
   
   
   See this article for more information on View Management in Entuity.

To manage the OS service rules in a configuration set:

1. From the Configuration Set tab of the Multi-Server Configuration page, select the configuration set that you want to edit.
2. Click Manage OS Services at the top of the page (or from the Overflow Menu or right-click Context Menu).
   
   
   
   The OS Service Management page is displayed, from which you can add, edit, and delete OS Service rules for the specified configuration set.
    
3. Select the configuration set from the Server/Configuration Set dropdown field in the top-left of the page, and then specify and manage the OS Service rules that you want to include in, or remove from, this configuration set.
   
   
   
   See this article for more information on OS Service monitoring in Entuity.

To manage the CPE Mapping rules in a configuration set:

1. From the Configuration Set tab of the Multi-Server Configuration page, select the configuration set that you want to edit.
2. Click Manage CPE Mapping Rules at the top of the page (or from the Overflow Menu or right-click Context Menu).
   
   
   
   The Vulnerability Monitoring page is displayed, from which you can add, edit, and delete CPE Mapping rules for the specified configuration set.
    
3. Select the configuration set from the Server/Configuration Set dropdown field in the top-left of the page, and then specify and manage the CPE Mapping rules that you want to include in, or remove from, this configuration set.
   
   
   
   See this article for more information on Vulnerability Monitoring in Entuity.

To manage the user defined thresholds in a configuration set:

1. From the Configuration Set tab of the Multi-Server Configuration page, select the configuration set that you want to edit.
2. Click Manage Thresholds at the top of the page (or from the Overflow Menu or right-click Context Menu).
   
   
   
   The User Defined Threshold Summary page is displayed, from which you can add, edit, and delete user defined thresholds for the specified configuration set.
    
3. Select the configuration set from the Server/Configuration Set dropdown field in the top-left of the page, and then specify and manage the CPE Mapping rules that you want to include in, or remove from, this configuration set.
   
   
   
   See this article for more information on Vulnerability Monitoring in Entuity.

To manage the custom webhook configuration in a configuration set (from Entuity v23.0 P03 upwards):

1. From the Configuration Set tab of the Multi-Server Configuration page, select a configuration set that is enabled for custom webhooks.
2. Click Manage Webhooks at the top of the tab (or from the Overflow Menu or right-click Context Menu).
   Note, to view the Manage Webhooks button on this tab, you might need to zoom out in your web browser window.
   
   
   
   This takes you to a page from which you can add, edit, and delete the custom webhook group and rule definitions for the configuration set. A custom webhook configuration comprises the custom webhook group definitions, including all the rules, conditions, and events for each custom webhook group.  
    
3. From the Server/Configuration Set dropdown field at the top-left of the page, select the configuration set, and then specify and manage the custom webhook groups and the webhook rules associated with each webhook group. 
   When the server configuration set synchronization occurs, any updates and changes that you make are shared and updated with the servers in the configuration set. For more information on centrally managing custom webhooks, see this article.
   
   
   
   See this article for more information on custom webhooks in Entuity. 

To import the config of a server to a configuration set:

The Import Current Config functionality enables you to extract all users, user groups, and Views from a selected server and then import them to the currently selected configuration set. As a result of this, all existing content of the configuration set will be replaced with the imported data.

1. From the Configuration Set tab of the Multi-Server Configuration page, select the configuration set to which you want to import users, user groups, and Views.
2. Click Import Current Config from the Overflow Menu or right-click Context Menu.
   
   
   
   The Import Configuration form is displayed.
3. Select whether to Include Hidden servers in the Entuity Servers field, and then select a server from which you want to import users, user groups, and Views.
   
   
    
4. Click Done to save your changes. Otherwise, click Cancel.

To release a server from a configuration set:

You can release a server from a configuration set in one of two ways:

From the Configuration Set tab:

1. Select the configuration set that you want to edit.
2. Click Assign Servers at the top of the page (or from the Overflow Menu or right-click Context Menu).
3. On the Assign Servers form that opens, clear the check boxes next to the server(s) that you want to release from the configuration set.
4. Click Done to save your changes. Otherwise, click Cancel. 
   The selected server(s) are immediately released from the configuration set.

From the Remote Servers tab:

1. Select the server that you want to release.
2. Click Release from Configuration Set from the Overflow Menu or right-click Context Menu. 
   The selected server is immediately released from the configuration set.
   
   
   
   
    

To edit the parameters of a configuration set:

1. From the Configuration Set tab of the the Multi-Server Configuration page, select the configuration set that you want to edit.

2. Click Edit at the top of the page (or from the Overflow Menu or right-click Context Menu).
   
   
    

   The Edit Configuration Set form is displayed, which has the same fields as the Add Configuration Set form (see above).
   
   
   
    

To delete a configuration set:

1. From the Configuration Set tab of the the Multi-Server Configuration page, select the configuration set that you want to delete.
2. Click Delete at the top of the page (or from the Overflow Menu or right-click Context Menu).
   
   
    
3. At the confirmation window that is displayed, click Yes to confirm the deletion. Otherwise, click No. 
    

To sync a configuration set:

When you make a change to a configuration set's parameters (for example, changing the sync requirements of User Groups), or make a change to what's included in the configuration set (for example, adding a View to the configuration set), then these changes are immediately pushed as a job to each server that is a member of the set.

A popout window containing a Configuration Set Sync Progress bar is displayed once you have made your change (for example, if you are adding users, the popout window is displayed whilst you are still on the Account Management page), displaying the progress of the automatic sync and any messages associated with it. You can dismiss this window at any time.

Important note regarding existing server configurations: syncing a server wipes its previous configuration. Before syncing, take a backup of the existing configuration. If you subsequently remove a server from a configuration set, that server's old configuration will not be restored.

Note regarding remote servers configured for external authentication: servers that are configured for external authentication (for example, LDAP) are permitted to be part of a configuration set, but their users will not be synced in accordance with the configuration set's parameters, even if the Sync Users option is enabled.

To manually sync a configuration set:

You can also manually sync a configuration set at any time:

1. From the Configuration Set tab of the Multi-Server Configuration page, select the configuration set that you want to sync.
2. From the Overflow Menu, click Sync Now. 
   A popout window opens (that you can manually dismiss), displaying the progress of the sync.

Note, you can only manually sync one configuration set at a time.

You can check the status of this sync in the Status column of the Configuration Set table (Multi-Server Configuration > Configuration Set tab > table > Status column) (see To check the sync status of a configuration set below).

You can check the sync history of a configuration set in the table under the Sync History tab of the Multi-Server Configuration page (see To view the sync history of a configuration set below).

To pause a sync: 

Select the configuration set that you want to pause and click Pause Sync from the Overflow Menu or right-click Context Menu. You can also pause the sync from the sync status details form (see below). Once paused, the sync status icon changes to paused.

To check the sync status of a configuration set:

Once you have made a change to a configuration set, you can see its sync status in the Status column of the Configuration Set table. 
Note, this column is only available when on the central/consolidation server. It is not available from a remote server.

There is a status icon, and the % bar details the progress of all servers' synchronization. Click the progress bar to open the Status Details form, providing details of the current sync (you can also access this form by clicking Status Details from the Overflow Menu or right-click Context Menu):

This form is read-only and details the following:

• Configuration Change ID - ID of the current configuration change, referred to in the Sync History table (see below).
• Synchronization - use the toggle to specify whether syncing is Active or Paused.
• Member Sync Status - details the sync status of each individual server that belongs to this configuration set.

To view the sync history of a configuration set:

Sync history is retained for 30 days, but this can be configured in entuity.cfg.

There are two ways to access the sync history of a configuration set:

• navigate to the Sync History tab of the Multi-Server Configuration page. In the Server/Configuration Set dropdown field, select the configuration set for which you want to view the sync history.
  
  
  
   
• select the configuration set on the Configuration Set tab of the Multi-Server Configuration page, and click Sync History from the Overflow Menu or right-click Context Menu. This opens the Sync History tab for the selected configuration set.
  
  
   

From the Sync History tab, you can also view the sync history of individual servers, which is accessible from the Server/Configuration Set dropdown field in the top-left of the page:

The Sync History tab shows a table detailing the following:

To view details of an individual sync record, click Details at the top of the page (or from the Overflow Menu or right-click Context Menu).

This opens the Synchronization Details form, which summarizes all the information for that particular synchronization (the information being the same as that in the table above). This form allows you to read the Error Message more easily, if applicable.

If a sync has failed on a server(s): 

To retry synchronization, you can trigger synchronization of an individual server from the Remote Servers tab of the Multi-Server Configuration page by clicking Sync Now (from the Overflow Menu or right-click Context Menu):

To manage the functionality of a configuration set from the Configuration Set tab:

You can navigate to the functionality specified in a configuration set by selecting the config set and then accessing the Overflow Menu (or the right-click Context Menu). From there, you can click the relevant functionality, and you will be taken to the appropriate page.

For example, clicking Manage CPE Mapping Rules takes you to the Vulnerability Monitoring page.

RESTful API:

See the following articles for more information on managing server configuration sets using Entuity RESTful API:

• List config sets, and create new config sets
• List summary info about config sets
• Update or delete a config set, and pause the synchronization of a config set
• List and populate the configuration of a config set
• List active config from a server, determined by the optional parameter(s)
• Populate the configuration of a config set from a local server
• List servers currently assigned to a specified config set, and add and remove servers from a config set
• Force control of a server (that already belongs to a diferent config set) when adding it to a new config set
• Trigger synchronization for a specifed config set
• List sync (change) history for all config sets, or filter by individual config set and/or member servers
• List all users in a config set, and add users to a config set
• Change a user's password, or delete a user from a config set
• User group membership:
  • Modify user membership of a specified user group on a specified config set
  • Add users to a specified user group on a specified config set
  • Delete a user from a specified user group on a specified config set
• List the Views in a config set, and add Views to a config set
• Update, rename or delete Views in a config set
• List the content filters in a config set, and add or update config filters
• List the incident filters in a config set, and add or update incident filters
• List the event filters in a config set, and add or update event filters
• List the profiles in a specified server configuration set, and add a new profile to a config set
• List details of, modify, or delete a profile within a config set
• List details of, modify, or delete an OS Service in a specified config set