Configuration Profiles
      Back to home
      1. Vali Cyber Knowledge Base
      2. ZeroLock™
      3. Configuration Profiles

      Configuration Profiles Homepage on the ZeroLock™ Management Console

      Overview of the Configuration Profiles homepage that permits control of ZeroLock™ Agent behavior on protected Endpoints.

        Overview

        A Configuration Profile greatly simplifies ensuring that the desired protections are enabled/disabled, the Lockdown rule policies, the logging and cache options, and the secure shell configuration are as you intended for that specific endpoint.

        Additionally, using Configuration Profiles enables ZMC administrators to fine-tune settings for Ransomware, Cryptojacking, and Tampering protection, as well as settings for ensuring usage of SSH-MFA two-factor authentication.  These profiles can also be configured to manage HASH rules as far as setting alert levels, response type, whether to send email alerts, and auto-quarantine settings.

        The following instructions will walk you through the layout of the Configuration Profiles homepage followed by instructions on creating a Configuration Profile.

        Configuration Profile Screen

        Config Profile Main Screen 2.0.1
        1. Export Data - Allows downloading of all the information on your screen in CSV format. Clicking either will download all the information on your screen in CSV format.
          1. If you wish to see only select files, hover the cursor to the left of the file number and select the box that appears.
          2. Repeat this process until you have selected the files you want then use either download option.
        2. Add New Profile - Select this button when you want to create a new configuration profile.
        3. Column Headings - The column headings are mostly self-explanatory.   IDs are system generated. “# of Endpoints” refers to the number of Endpoints that profile is being used by.
        4. Configuration Profiles - The names and descriptions of the configuration profiles that currently exist in the environment.
        5. View - Provides a drop down listing of the screen configurations, i.e., layouts or views, that are available. Initially, the only option in the VIEW drop-down list is All, which represents the default and, initially, the only one available layout or view.   Once other layouts are created, they will appear on the list as well.
        6. Edit - Selecting the cog or gear symbolbrings up the Edit View pop-up screen. This screen enables changing of the layout (view) of the columns such as moving columns or even hiding columns altogether. The different views you create may be saved under their own name for easy access from the VIEW tab.

          When the Edit View screen first appears, the only option is Save A Copy.   Once you select any column, Modified, Reset, and Save As will replace it.Edit View 3 Options 2.0.1-2
          1. Modified – is static and only shows that the ‘original’ layout (view) has been changed.   The label goes away when it’s saved. 
          2. Reset – erases your changes, returning the profile back to its original configuration.
          3. Save As – allows you to name and save the view you created.


         

        For the new view, the ID column was moved after the Description column.  To save this new Configuration Profile layout or view, click Save As, which brings up the Save View As screen. Enter a name for the new view then select Save As which will return you to the previous screen.

        Save As View 2.0.1-1            Edit View Done 2.0.1-1

        Clicking the Done button completes the process and opens to the new Configuration Profile View or layout.  New CP Layout with Magnified View 2.0.1

        Creating a New Configuration Profile

        Navigate to the System Configuration | Config Profile page then select Add New Profile. 

        CP Main Screen 2.0.1

         

        Once on the New Configuration Profile pop-up screen you are presented with eleven (11) editable sections followed by Cancel and Create buttons.

        New Config Profile Full-2
        1. Name/Description – consists of the name and description of the new configuration profile.
        2. Ransomware Protection – Has six (6) fields:
          1. Enabled - If this protection active the block is green, if inactive the block is red.
          2. Sensitivity - Low, Medium, and High. The higher the sensitivity the fewer files it takes for ZeroLock to react.
          3. Alert Level - Low, Medium, and High.
          4. Send Email Alerts - If emails are to be generated to others with alert information.  If active, checkbox will be white.
          5. Response Type – refers to how ZeroLock will respond.  Options are Do Nothing, Suspend, Kill, and Remediate.
          6. Auto Quarantine – if checkbox is white the endpoint will be auto quarantined in the event of an alert. 
        3. Cryptojacking Protection – Has the same six (6) fields as Ransomware Protection.
        4. Tampering Protection – Has the same fields as Ransomware Protection except for Sensitivity has been removed.
        5. Hash Rules – Has four (4) fields: Alert Level, Send Email Alerts, Response Type, and Auto Quarantine.
        6. SSH Multifactor Auth – Has three (3) fields:  Enabled, Alert level, and Send Email Alerts.
        7. Default Control Policy – Using the Policy drop down menu, select the desired policy.
        8. Endpoint Logging – Used for setting the size of the Baldur and Tyr logs for the ZeroLock Agent on the endpoint.
        9. Remote Shell – A remote shell is a tool for executing commands on a device through a command-line shell.  Fields are Enabled and Default User.   A green checkbox means that this feature is enabled and commands can be remotely run from the ZeroLock Management Console (ZMC) on the endpoints.  The Default User is ‘nobody’ and is a place holder with no permissions.

          Note:  The ONLY system that can access this feature on the endpoint is the configured collector system defined in the Agents configuration.
        10. Precision Mode Settings* –  By default, an agent does not monitor any processes.  Process monitoring settings are set here, in the Configuration Profile, or in the server query functionality.  Regardless of where it is set, it may take up to 60 seconds for an agent to start monitoring SSH and other processes when it is initially applied.                                    This section contains five (5) fields:
          1. Enable – If selected, Precision Mode is on
          2. Monitor cron – ZeroLock to monitor cron jobs. Cron, Anacron, and/or Crond must be present in the Process Scan Regex for this setting to work.
          3. Monitor systemd –ZeroLock to monitor systemd and any services restarted or started by a periodic job.
          4. Monitor containerd - ZeroLock to monitor containers. Containerd must be present in the Process Scan Regex for this setting to work. 
          5. Process scan regex – is a regex that must be matched for processes ZeroLock will monitor when it does sweeps of the system.

        Note:  When disabling monitor options, the agent must be disabled then reenabled to stop monitoring already running processes.  For example, if you are monitoring cron jobs and then disable it on the server, you have to deactivate and reactivate the agent so that it stops monitoring this type of process.

                  *Available in ZeroLock Management Console v2.0.7 and later.

        11.     Cache Settings – Contains four (4) fields:

                    a.   Location - path to where cache is located.

                    b.   Max Size - of cache in mega-bytes (MB).

                    c.   Max Cache File Age - in seconds.

                    d.   Max Cache File Size - in bytes (B).           

         

        Edit an Existing Configuration Profile

        If you need to make changes to a saved profile, the simplest way is to click a single time on the profile name which will open a partial view of the Profiles screen as seen below.  For the 'default' layout only Duplicate and Edit are available.  For any other layouts or views the Delete option will be included.

        Selecting Edit will open the screen fully as previously seen in step 2.  

        CP with Edit Selected 2.0.1

         

        When done editing, click Update to return to the screen you started on.

        ConfigProfile Full

        Applying a Configuration Profile to an Endpoint

        1. Once a Configuration Profile has been created, it must be applied to an endpoint for the settings to take effect. Navigate to the Endpoints page.
          Endpoints Home page 2.0.1

        2. On the Endpoints page, select the endpoint or multiple endpoints that you want to apply the new configuration profile to. Then, click the Actions drop-down menu and select Set Endpoint Config.
          Set Endpoint Config 2.0.1-1

        3. On the Set Endpoint Configs pop-up menu, select the created configuration profile from the drop-down menu. Then select the Set Configs button.
          Set Configs Box 2.0.1

        4. On clicking Set Configs you are returned to the Endpoints homepage where you can see the profile has been applied.New Endpoint Config Set 2.0.1

        You have successfully configured an endpoint with a new Configuration Profile!