Support Site

Log Files

Improved Baseline Configuration Management with ConsoleWorks 4.7

by

The recent release of ConsoleWorks Version 4.7 includes a number of new and improved features, including new functionality added to ConsoleWorks Privileged Access Management, Monitoring, and Logging Platform for ensuring auditable security-centered operations of heterogeneous IT environments.

Today I want to talk about the ConsoleWorks Baseline Configuration Management solution. This solution automates the collection of device configurations, allowing administrators to define a master baseline. The current configuration, which can be checked manually or scheduled, is automatically compared to the master – if there are any changes, administrators are automatically alerted. This new feature eliminates the majority of human errors and minimizes the impact of both intentional and unintentional erroneous activity.

The ConsoleWorks Baseline Configuration Management solution addresses key security regulations pertaining to notification of device configuration changes. It can be configured to monitor active ports, services enabled, account & account permissions, installed software & patches, configuration files, and more. Of course, everything that’s monitored is also logged, providing records of changes to the defined baselines that can be used in the event of an audit.

View Datasheets in Resources

Managing Privileged Access with ConsoleWorks

by

ConsoleWorks is an enterprise-level privileged access portal that monitors, manages, logs, remediates, reports, and secures physical (routers, switches, servers, etc.), logical (SANs and applications, for example), and virtual infrastructure at the lowest level, in all machine states, including operating, service, configuration, and maintenance modes.

ConsoleWorks Privileged Interactive Access functionality provides the foundation for security and operations to the automation and integration platform.  Once ConsoleWorks has knowledge of the various devices, it basically has the ability to take the place of a human in performing many of the mundane functions that may be required.

In addition to the fundamental Access features built into the core product, having access enables ConsoleWorks to perform Asset and Configuration Monitoring more comprehensively versus today’s manual processes. Once ConsoleWorks has access, it performs automated Endpoint Password Management on IT or OT assets.  It aggregates any and all log files to provide true Situational Awareness by interlacing those logs, line-by-line and applying a common time stamp.

Finally, with the robust Asset and Configuration Monitoring, ConsoleWorks Patch Gap Analysis has the configuration information retrieved directly from each device – the most accurate source of the information.

Privileged Interactive Access is the power that drives the integrated functionality of the ConsoleWorks platform.

Instead of putting agents on your systems, ConsoleWorks uses a unique blend of connectors, centralized web servers, and out-of-band technologies to implement a robust, high availability, lights-out management solution. ConsoleWorks is designed to minimize operational disruption and mean-time-to-repair, and includes the following features:

  • Agentless Monitoring
  • Log Aggregation
  • Audit & Compliance Reporting
  • Session management
  • Command Control
  • Event Management

For more information on managing privileged access with ConsoleWorks, download: Secure Interactive Access NERC CIP -005

Related Posts:

Persistent Monitoring and Management with ConsoleWorks

 

 

End-to-End Monitoring & Management with ConsoleWorks

by

ConsoleWorks acts in a multi-dimensional fashion by monitoring not only the applications but also the servers, virtual machines, networks, and storage devices that run them. It provides managers and administrators with an end-to-end management solution that controls system access, monitors and manages all log files, and watches for specific events that may occur across the Enterprise.

And it does all of this in real-time and in all machine states – power on, single user, maintenance, production, and failure modes. This persistent connection also locks down the “back door” entrances that are overlooked by similar, agent-based solutions.

The end-to-end view provided by ConsoleWorks helps administrators understand why something went wrong and quickly determine and implement the resolution. During that process, ConsoleWorks captures the exact steps used by an experienced administrator to remediate an issue and stores it in the knowledge base for future reference.

ConsoleWorks achieves end-to-end monitoring and management with the following capabilities:

  • Secure Access Management
  • Event Correlation
  • Log File Aggregation
  • Keystroke Logging & Best Practices
  • Proof of Compliance

ConsoleWorks automates the collection, comparison, alert/notification and auditing of any changes to configuration baselines, eliminating the majority of human errors and minimizing the impact of intentional or unintentional erroneous activity.

ConsoleWorks has the ability to speak multiple protocols (including serial), gaining access to and then collecting the inventory is a fundamental capability of the product.  ConsoleWorks does this without adding an Agent to the endpoint, which is a requirement in the ICS environment since many of these devices are purpose-built and cannot have other vendor software installed on it.

ConsoleWorks can be configured to monitor many items including:

  • Functional settings that determine how the asset operates
  • Versions of software currently installed including BIOS, firmware, operating system, applications, etc.
  • Patches, including security patches that are installed
  • Ports that are active and how they are configured
  • Services that are enabled
  • Accounts
  • Configuration Files

Configuration Monitoring Datasheet

Configuration Monitoring NERC CIP 010

Fault Tolerant Monitoring & Logging

by

A Redundant Automatic Failover configuration consists of two ConsoleWorks invocations, which under normal operating conditions are simultaneously connected to each managed device in the environment, making the solution fully redundant with no single point of failure. If the primary invocation fails, the secondary invocation continues to monitor and manage the enterprise.

Under this scenario, to be completely assured that there is no gap in monitoring and logging, a pair of ConsoleWorks servers duplicate systems monitoring and logging such that at least one server would receive the logging information and send the necessary notifications under all operating conditions and in accordance with designated severity levels.

Either of the servers can be down due to a scheduled maintenance or failure, but logging and alerting remain continuous as required by the standard.

The failover process for ConsoleWorks maximizes availability and eliminates loss of critical security status monitoring, event logging, and compliance reporting for strict compliance requirements.

View Datasheets in Resources

The ConsoleWorks Difference

by

ConsoleWorks is the leading Cybersecurity Operations Platform on the market. The ConsoleWorks Server is the high-performance engine that handles information flow processing, business rule execution, pattern-matching, role-based security, and signed log-file generation. It handles all input and output across the enterprise on the devices and application that it manages, serving this data up as needed.

ConsoleWorks is capable of managing more than 1000 connections per server invocation. The ConsoleWorks Server is a complete solution package for managing the IT foundation of the enterprise.

Some of the key features of ConsoleWorks include role-based access and control, secure remote management and monitoring, in-band and out-of-band management, bi-directional data capture, digitally signed logs and forensic files, and comprehensive automation. ConsoleWorks is also agentless and persistent to facilitate IT operations, enforce security, and maintain comprehensive audit trails.

View Datasheets in Resources

Security and Compliance in Virtual Environments

by

The use of Virtual Machines (VMs) in IT introduces a new layer of complexity in the IT infrastructure, and adds new challenges to IT operations, security, and compliance. ConsoleWorks is unique in that it delivers the same simplification, automation, documentation, and security benefits to virtualized environments as it does to physical ones.

ConsoleWorks maintains console connections in all modes of operation – including during VM migrations. ConsoleWorks uses persistent connections that move with VMs, keeping operations, compliance, and security practices over privileged interfaces consistent and effective.

In addition to maintaining the IT infrastructure security model over privileged interfaces (such as consoles and virtual serial ports), ConsoleWorks is also able to capture all log file data generated by hypervisors (including VM logs). The records produced are accurate, consistent, and comprehensive – and they remain so, even when VMs move from host to host. This comprehensive data collection can support even the most rigorous compliance requirements and provide the transparency needed to meet audits.

View Datasheets in Resources

We can help

Reach out today, and we'll talk through how we might be able to help!

Contact us