GCenter documentation version 2.5.3.101

Release Notes

• 1. Upgrade Path
• 2. Release Notes

Setup

• 1. Presentation of the equipment
  • 1.1. GCenter
  • 1.2. GCAP
• 2. Flow Matrix
• 3. Example of architectures
• 4. Configuration
  • 4.1. Initial configuration
  • 4.2. Global configuration

GCap

• 1. Presentation
• 2. Pairing
  • 2.1. Add a GCAP
  • 2.2. Re-pairing a GCAP
  • 2.3. Delete a GCAP
• 3. Configuration
  • 3.1. Details of a GCAP
  • 3.2. Set a default profile

GUM

• 1. Upgrade
  • 1.1. Hotfix
  • 1.2. Upgrade
• 2. Updating signatures (Update)
  • 2.1. Update mode
  • 2.2. Configuration
  • 2.3. Manual update of the engines
  • 2.4. Checking for updates

Malcore

• 1. Presentation
• 2. Configuration
  • 2.1. Global settings
  • 2.2. Profiles
  • 2.3. Exception list
• 3. Detection
  • 3.1. Inspectra
  • 3.2. Dashboards
• 4. Generated events
  • 4.1. Example of a log
  • 4.2. Summary table of the fields
• 5. Detection by gscan

Codebreaker

• 1. Presentation
• 2. Detection
• 3. Generated events
  • 3.1. Codebreaker Shellcode
  • 3.2. Codebreaker Powershell
• 4. GScan
  • 4.1. Shellcode Scanning
  • 4.2. Powershell Scanning
  • 4.3. History

Sigflow

• 1. Presentation
• 2. GCAP Profiles
  • 2.1. Detection Rulesets
  • 2.2. Base variables
  • 2.3. Net variables
  • 2.4. Flow timeouts
  • 2.5. Files rules management
  • 2.6. Packet filtering
• 3. Rules management
  • 3.1. Sources
  • 3.2. Rulesets
  • 3.3. Changing signatures
  • 3.4. Generating rulesets
  • 3.5. Secret Local Rule
• 4. Detection
  • 4.1. SmartMap
  • 4.2. Kibana Dashboard
• 5. Generated events
  • 5.1. Document type "alert"
  • 5.2. Document type "fileinfo"
  • 5.3. Metadata document

Machine Learning

• 1. Introduction to the DGA Algorithm
• 2. Activation
• 3. Exception list
• 4. Generated events

External integration

• 1. MISP (Malware Information Sharing Platform)
• 2. Hurukai (by HarfangLab)
• 3. Intelligence
  • 3.1. External
  • 3.2. GBox
• 4. Syslog
  • 4.1. Configuration Syslog
  • 4.2. Logstash
  • 4.3. Splunk
• 5. Using the GCENTER API
  • 5.1. Use via swagger
  • 5.2. Use via CURL
  • 5.3. Use via python package

Supervision

• 1. Home Page
• 2. Embedded Dashboards
• 3. Nagios
• 4. Netdata
  • 4.1. Netdata export
• 5. Using a NETDATA server
  • 5.1. Installation via docker
  • 5.2. Configuration
  • 5.3. Creating alerts for Netdata

User management

• 1. Local users
• 2. LDAP Integration / ActiveDirectory
• 3. Audit trail
  • 3.1. Authentications history

Backup / Restore

• 1. Configuration
  • 1.1. Operations

Maintenance

• 1. Data Management
  • 1.1. Data deletion
• 2. Diagnostics
  • 2.1. Log files
• 3. Solution logs
• 4. Emergency mode
• 5. GApps management

MPL: Details

• 1. MPL: reminders
• 2. MPL applied to GCENTER
  • 2.1. Automatic action
  • 2.2. Manual action

Download link for this documentation : PDF Documentation GCenter