Index

Symboles

```Admin- GUM - Config``` screen ```Admin-Backup/Restore - Configuration``` screen ```Admin-Backup/Restore - Operations``` screen ```Admin-GCaps pairing and status``` screen ```Admin-GCenter Trackwatch logs``` screen ```Admin-GCenter- Accounts``` screen ```Admin-GCenter- CTI Configuration``` screen ```Admin-GCenter- Data exports``` screen ```Admin-GCenter- Data Management``` screen ```Admin-GCenter- Diagnostics``` screen ```Admin-GCenter- Malcore Management``` screen ```Admin-GCenter- ML Management``` screen ```Admin-GCenter- Monitor``` screen ```Admin-GUM- Software update``` screen ```Admin-GUM- Threat DB update``` screen

```Admin-NDR configuration``` screen ```Alerts``` screen ```Assets``` screen ```Config - Assets/Users Association rules``` screen ```Config - Gcaps profiles``` screen ```Config - sigflow/MISP``` screen ```Config - sigflow/rulesets``` screen ```Config - sigflow/sources``` screen ```GScan``` screen ```Health checks``` screen ```Home``` screen ```Hunting``` screen ```Overview``` screen ```Relations``` screen ```Top risk``` screen ```Users``` screen

A

Administrator NDR; Configuring the NDR Setting up a Netdata server Administrator, account management Adding an API access token Changing some of a local user's information Configuring the connection between the GCenter and the LDAP server Configuring the users and groups defined on LDAP / ActiveDirectory Creating local users Deleting a local user Displaying of the connection status between the GCenter and the LDAP server Enable the connection between the GCenter and the LDAP server Managing the password policy Resetting a local user's password Viewing the authentication history Viewing the history function for all changes in user rights Viewing the history of user creations or deletions Administrator, Backup restore function Backup Backup configuration Restoration Administrator, detection motors Enabling and configuring the Machine Learning engine Managing the white and black lists of the Machine Learning engine Managing the white and black lists of the Malcore engine Setting up GBox and the Malcore and Retroact engines and activate the GBox Administrator, GCap administration Change the default profile or customise the existing profile Delete a GCap connected to the GCenter Pairing a GCap with the GCenter Re-pairing a GCap Administrator, GCenter administration Configuring the connection to the GBox Configuring the connection to the Intelligence site Configuring the connection to the MISP Deleting data (log files) Export data to a ETL Logstash via the syslog protocol Export data to a SIEM via the syslog protocol Export data to a SPLUNK SIEM via the syslog protocol Generating and loading files for diagnosis Quick creation of a POC Logstash Using an endpoint API

Administrator, GCenter software Configuring automatic update via GUM Installing a hotfix Installing of an upgrade Manual installation of an update of signatures and/or anti-viral engines (update) Administrator, global configuration Configuring Session Age Settings Configuring the Netdata export interface Configuring the Netdata polling interface Connection to the GCenter web interface via a web browser GCenter global configuration Licence amendment Logging out of the GCenter web interface Proxy settings configuration SSL settings configuration Using a Netdata server Alerting ANSSI API Endpoints list Introduction Overview of the API interface Presentation of the tittle bar Use via CURL Use via the swagger GUI Using an endpoint API Audit trail Viewing the authentication history Viewing the history function for all changes in user rights Viewing the history of user creations or deletions

C

Characteristics Electrical characteristics Functional characteristics Mechanical characteristics CLI Codebreaker Codebreaker Configuration Codebreaker Engine Codebreaker update Configure Codebreaker then apply the Sigflow rulesets to the GCaps Introduction Powershell Codebreaker Counter Summary Table Viewing the status of Codebreaker Codebreaker, Events generated Codebreaker Powershell Codebreaker Powershell log example Codebreaker Shellcode Codebreaker Shellcode log data structure Data structure and values of Codebreaker Powershell counters Example of a Codebreaker Shellcode log, [1] Example of a Powershell alert in the WebUI Presentation Configuration menu ```About``` Command ```Arp Manager``` command ```DateTime``` command ```Diagnose``` command ```Exit``` command ```Gcenter Services Management``` command ```Keyboard``` command ```LPM Mode``` command ```Network``` command ```Password``` command ```Reset``` command ```Restart``` command ```Shutdown``` command ```Tech Support``` command ```Upgrade type``` command ```VPN MTU``` command Presentation

Critical risk CTI Configuring CTI engine, RetroHunt engine and ActiveHunt engine CTI Update Presentation Presentation of ActiveHunt engine Presentation of RetroHunt engine Presentation of the CTI module Viewing the CTI Status CTI, Events generated by the RetroHunt engine Example of alert in the webui Presentation CTI, RetroHunt engine generated events RetroHunt event example RetroHunt log data structure

D

Data Data related to detection results, [1], [2] Data use Deleting data Detection data

E

Emergency mode Engine hash External integration Access for a monitoring server Intelligence site and GBox Introduction MISP Server Netdata server

G

GApps management GBox Configuring the connection to the GBox Presentation of the GBox Sending files to the GBox Setting up GBox and the Malcore and Retroact engines and activate the GBox GCap Presentation of the GCap GCap configuration Configure Codebreaker then apply the Sigflow rulesets to the GCaps Configure File Reconstruction Rules (File rules management) Configure filters on targeted parts of the analyzed traffic (Packet filters) Configure GCap Sigflow module specific parameters (Base variables) Configure network variables used by rules (Net variables) GCenter Configuring Session Age Settings GCenter Global Configuration Licence amendment Presentation of the GCenter Proxy settings configuration SSL settings configuration

Gscan Detection procedure by Gscan Introduction of the GScan detection Gstats Presentation of the tittle bar GUM Configuring automatic update via GUM Installing a hotfix Installing of an upgrade Manual installation of an update of signatures and/or anti-viral engines (update) Presentation of GUM

H

High risk

Hotfix Presentation of GUM

I

Intelligence site Introduction Intelligence website Configuring the connection to the Intelligence site

Interconnection Interconnection between devices

K

Kibana GUI Data exploitation Kibana GUI overview Native dashboards overview

L

LDAP LDAP user Configuring the connection between the GCenter and the LDAP server Configuring the users and groups defined on LDAP / ActiveDirectory Displaying of the connection status between the GCenter and the LDAP server Enable the connection between the GCenter and the LDAP server Legacy web UI ```Admin- GUM - Config``` screen ```Admin-Backup/Restore - Configuration``` screen ```Admin-Backup/Restore - Operations``` screen ```Admin-GCaps pairing and status``` screen ```Admin-GCenter Trackwatch logs``` screen ```Admin-GCenter- Accounts``` screen ```Admin-GCenter- CTI Configuration``` screen ```Admin-GCenter- Data exports``` screen ```Admin-GCenter- Data Management``` screen ```Admin-GCenter- Diagnostics``` screen ```Admin-GCenter- Malcore Management``` screen ```Admin-GCenter- ML Management``` screen ```Admin-GCenter- Monitor``` screen ```Admin-GCenter- Third-party modules``` screen, [1] ```Admin-GCenter-Configuration``` screen ```Admin-GUM- Software update``` screen ```Admin-GUM- Threat DB update``` screen ```Config - sigflow/MISP``` screen ```Config - sigflow/rulesets``` screen ```Config - sigflow/sources``` screen Central screen Central screen of the legacy WEB UI Description of the legacy WEB UI Overview of the traditional WEB UI Traditional interface navigation bar

List of accounts Local user Changing some of a local user's information Creating local users Deleting a local user Resetting a local user's password Logging Logstash Export data to a ETL Logstash via the syslog protocol Quick creation of a POC Logstash Low risk

M

Machine Learning Activation Displaying DGA alerts Enabling and configuring the Machine Learning engine Exception lists White List / Black List Introduction to the DGA Algorithm Machine learning log data structure Machine Learning Setup Machine Learning Update Managing the white and black lists of the Machine Learning engine Viewing the state of machine learning Machine Learning, Events generated Example of alert in webui Example of Machine Learning log Presentation Malcore Events generated Malcore Configuration Malcore engine Malcore update Managing the white and black lists of the Malcore engine Presentation of the Malcore engine Setting up GBox and the Malcore and Retroact engines and activate the GBox View Malcore Status

Malcore, Events generated Malcore log data structure Medium risk Menu de configuration Commande ```Elasticsearch storage mode``` Metadata rate limiter ```Config - Metadata rate limiter``` screen MISP Configuring the connection to the MISP Mitre MTU

N

Netdata Configuring the Netdata export interface Configuring the Netdata polling interface Overview of the Netdata User Interface Setting up a Netdata server Using a Netdata server

O

OIV Operator Configuring Metadata Rate Limiters Session management;Connection to the GCenter web interface via a web browser Session management;Logging out of the GCenter web interface Operator, account management Changing some of the current user's information Changing the current account password Operator, GCap configuration Configure Codebreaker then apply the Sigflow rulesets to the GCaps Configure File Reconstruction Rules (File rules management) Configure filters on targeted parts of the analyzed traffic (Packet filters) Configure GCap Sigflow module specific parameters (Base variables) Configure network variables used by rules (Net variables)

Operator, Gscan Detection procedure by Gscan Operator, Kibana dashboards Use of Kibana dashboards Operator, NDR dashboards Use of NDR dashboards Operator, Report Analysis Report Analysis Procedure Send file for external analysis to GCenter Operator, SIGFLOW management Creating a SIGFLOW engine ruleset Generating a SIGFLOW engine ruleset Modifying SIGFLOW engine rules SIGFLOW engine rule sources OTP

R

RAID1 RAID5 Report Results and analysis report Retroact Configuration Counters associated with the Rétroact engine Presentation of retroact engine Retroact analysis engine Setting up GBox and the Malcore and Retroact engines and activate the GBox Update Viewing the status of Retroact

S

setup ```About``` Command ```Arp Manager``` command ```DateTime``` command ```Diagnose``` command ```Exit``` command ```Gcenter Services Management``` command ```Keyboard``` command ```LPM Mode``` command ```Network``` command ```Password``` command ```Reset``` command ```Restart``` command ```Shutdown``` command ```Tech Support``` command ```Upgrade type``` command ```VPN MTU``` command Account of the configuration menu; Related principles Account setup from the configuration menu Commande ```Elasticsearch storage mode``` Direct connection to the GCenter configuration menu in HTTP via iDRAC (DELL server) Direct connection to the GCenter configuration menu SSH via the iDRAC interface in serial port forwarding mode Direct connection to the GCenter configuration menu with keyboard and monitor Functions allowed in the setup account setup account Direct connection to the GCenter configuration menu via SSH SIEM Export data to a SIEM via the syslog protocol SIEM SPLUNK Export data to a SPLUNK SIEM via the syslog protocol Sigflow GCAP Profiles; GCAP Profiles Organizing the rules Presentation Sigflow engine Sigflow engine signature sources Sigflow Setup Sigflow update Structure of sigflow logs View the status of Sigflow Sigflow Rulesets Changing signatures Definition of signatures Generating rulesets Optimization of rulesets Rulesets Secret Local Rule Sigflow, Events generated Counters of the source part of Sigflow logs of alert type Events of type "alert" Events of type "fileinfo" Events of type "meta-data" Example and log structure (Events) Sigflow Example of "alert" Sigflow events in the webui Log data of type "alert" Presentation

Sigflow, GCap configuration Configure File Reconstruction Rules (File rules management) Configure filters on targeted parts of the analyzed traffic (Packet filters) Configure GCap Sigflow module specific parameters (Base variables) Configure network variables used by rules (Net variables) Sigflow, Gcap configuration Configure Codebreaker then apply the Sigflow rulesets to the GCaps Sigflow, GCAP Profiles Alerting et logging Base variables Community ID Detection Rulesets File rule management Flow timeouts HTTP Proxy Multi-tenant by interface Multi-tenant by vlan Net variables Packet filtering Payload Single-tenant Stream analysis and file extraction Sigflow, SIGFLOW management Creating a SIGFLOW engine ruleset Generating a SIGFLOW engine ruleset Modifying SIGFLOW engine rules SIGFLOW engine rule sources Software installation Applying a patch (Hotfix) GUM Setup Overview of the backup and restoration Presentation of GUM Release note Update signatures and/or engines (update) Upgrade Syslog servers Introduction Logstash SIEM SIEM Splunk

T

TAP Overview of the TAP

Token Adding an API access token Managing the password policy

U

Update Presentation of GUM Upgrade Presentation of GUM Use case, member of Administrator group NDR; Configuring the NDR Use case, member of Administrator group, account management Adding an API access token Changing some of a local user's information Configuring the connection between the GCenter and the LDAP server Configuring the users and groups defined on LDAP / ActiveDirectory Creating local users Deleting a local user Displaying of the connection status between the GCenter and the LDAP server Enable the connection between the GCenter and the LDAP server Managing the password policy Resetting a local user's password Viewing the authentication history Viewing the history function for all changes in user rights Viewing the history of user creations or deletions Use case, member of Administrator group, administration GCap Change the default profile or customise the existing profile Delete a GCap connected to the GCenter Pairing a GCap with the GCenter Re-pairing a GCap Use case, member of Administrator group, Backup restore function Backup Backup configuration Restoration Use case, member of Administrator group, detection motors Enabling and configuring the Machine Learning engine Managing the white and black lists of the Machine Learning engine Managing the white and black lists of the Malcore engine Setting up GBox and the Malcore and Retroact engines and activate the GBox Use case, member of Administrator group, GCenter administration Configuring the connection to the GBox Configuring the connection to the Intelligence site Configuring the connection to the MISP Deleting data (log files) Export data to a ETL Logstash via the syslog protocol Export data to a SIEM via the syslog protocol Export data to a SPLUNK SIEM via the syslog protocol Generating and loading files for diagnosis Quick creation of a POC Logstash Using an endpoint API Use case, member of Administrator group, GCenter software Configuring automatic update via GUM Installing a hotfix Installing of an upgrade Manual installation of an update of signatures and/or anti-viral engines (update)

Use case, member of Administrator group, global configuration Configuring Session Age Settings Configuring the Netdata export interface Configuring the Netdata polling interface GCenter global configuration Licence amendment Proxy settings configuration Setting up a Netdata server SSL settings configuration Using a Netdata server Use case, member of Administrator group, Session management Connection to the GCenter web interface via a web browser Logging out of the GCenter web interface Use case, member of Operator group Configuring Metadata Rate Limiters Use case, member of Operator group, account management Changing some of the current user's information Changing the current account password Use case, member of Operator group, GCap configuration Configure Codebreaker then apply the Sigflow rulesets to the GCaps Configure File Reconstruction Rules (File rules management) Configure filters on targeted parts of the analyzed traffic (Packet filters) Configure GCap Sigflow module specific parameters (Base variables) Configure network variables used by rules (Net variables) Use case, member of Operator group, Gscan Detection procedure by Gscan Use case, member of Operator group, Kibana dashboards Use of Kibana dashboards Use case, member of Operator group, NDR dashboards Use of NDR dashboards Use case, member of Operator group, Report Analysis Report Analysis Procedure Use case, member of Operator group, Send file for external analysis to GCenter Use case, member of Operator group, Session management Connection to the GCenter web interface via a web browser Logging out of the GCenter web interface Use case, member of Operator group, SIGFLOW management Creating a SIGFLOW engine ruleset Generating a SIGFLOW engine ruleset Modifying SIGFLOW engine rules SIGFLOW engine rule sources Use case, Setup account Direct connection to the GCenter configuration menu via SSH Use case, setup account Direct connection to the GCenter configuration menu in HTTP via iDRAC (DELL server) Direct connection to the GCenter configuration menu SSH via the iDRAC interface in serial port forwarding mode Direct connection to the GCenter configuration menu with keyboard and monitor

W

Web interface accounts and their management Web Interface Accounts Web UI Interface ```Admin-NDR configuration``` screen ```Alerts``` screen ```Assets``` screen ```Config - Assets/Users Association rules``` screen ```Config - Gcaps profiles``` screen ```Config - Metadata rate limiter``` screen ```GScan``` screen ```Health checks``` screen ```Home``` screen ```Hunting``` screen ```Overview``` screen ```Relations``` screen ```Top Relations``` screen, [1] ```Top risk``` screen ```Users``` screen Central screen Navigation bar Overview of the WEB UI Presentation of the Admin menu Presentation of the Config menu Presentation of the tittle bar

Web UI, account management Changing some of the current user's information Changing the current account password Web UI, member of Administrator group, Session management Connection to the GCenter web interface via a web browser Logging out of the GCenter web interface Web UI, Session management Connection to the GCenter web interface via a web browser Logging out of the GCenter web interface