8.6.7. Configuring the connection to the GBox

8.6.7.1. Introduction

This procedure describes the connection configuration with the GBox.

Note

For more information, see Interconnection with external systems.
The graphical interface is described in `Admin-GCenter- Third-party modules` screen of the legacy web UI.

8.6.7.2. Prerequisites

  • User : member of Administrator group

8.6.7.3. Preliminary operations

8.6.7.4. Procedure to acces to the `Interconnection settings` setting

  • In the navigation bar, click successively on:

  • The `Admin` button

  • The `Gcenter` sub menu

  • The `Third-party modules command
    The `Third-party modules` window is displayed.
  • Click the `Intelligence` button.
    The following screen is displayed:
    ../../_images/INTELLIGENCE-01.PNG

The Interconnection settings page consists of the tabs:

  • `Configuration` Settings Management tab

  • `Security` Settings Management tab

8.6.7.5. Procedure to test the current setting

  • Press button (6) `Test the interconnection with the current saved configuration`.
    The message `Successfully established connection to GBox https://x.x.x.x` is displayed to indicate a correct connection with the GBox.

  • View status message (7):

  • If the message is `GCenter connexion to intelligence enabled` then the connection is correctly configured

  • Otherwise, use the following procedure to configure this connection

8.6.7.6. Procedure to configure the connection

  • Click on the `CONFIGURATION` button (1) .
    The following screen is displayed:
../../_images/INTELLIGENCE-01.PNG

  • Activate selector (11) `Is the target server a GBOX`.

  • Activate selector (10) `Enable interconnection`.

  • Enter the GBox URL (for example `https://adresse IP`) in field (9) `Url`.

  • Do not enter anything in field (3) `Intelligence usermail`.

  • Select `Offline` in field (8) `Analysis mode.

  • Select the network interface (4) to be used for this interconnection.

  • Press the `Save` button.
  • Click on the button (2) `SECURITY`.
    The following screen is displayed:
    ../../_images/INTELLIGENCE-02.PNG

  • Activate selector (8) `Disable SSL verification`.

  • Disable the selector (7) `Private remote analysis`.

  • Access the GBox WEBUI interface.

  • Create a token in the GBox webui interface (see the tokens API screen accessible from the `Admin/GBox/Accounts` menu).

  • Copy this token.

  • Paste this token in field (6) `Token`.

  • Press the `Save` button.
    When the backup is done, the following message is displayed: `The new configuration was successfully saved and applied.`
    The status message (7) is `GCenter connexion to intelligence enabled`: the connection is correctly configured.

8.6.7.7. Procedure to setup the Malcore Engine

  • In the navigation bar, click successively on:

  • The `Admin` button

  • The `Gcenter` sub menu

  • The `Malcore Management` command

../../_images/MALCORE_SETTING-01.PNG
  • Enable selector (6) `Enable automatic GBox analysis:` C.A' to enable automatic GBox analysis to transfer files classified by Malcore as 'Suspect' or 'Infected'.
    Following this connection, the administrator may be able to send files to the Intelligence platform for further analysis and download the report.