Novell Sentinel Rapid Deployment 6.1, Installation Manual

Page: 59 / 84

Advisor Configuration
6
59
no
vd
ocx
(e
n)
17
Sep
te
m
be
r 20
09
6
Advisor Configuration
This section discusses loading Advisor data and configuring regular updates to the Advisor data.

Section 6.1, “Advisor Overview,” on page 59

Section 6.2, “Installing Advisor,” on page 59

Section 6.3, “Maintaining Advisor,” on page 60
6.1 Advisor Overview
Advisor is a subscription service that provides device-level correlation between real-time events
from intrusion detection and prevention systems and enterprise vulnerability scan results. By
providing normalized attack information, Advisor acts as an early warning service to detect attacks
against vulnerable systems (exploit detection). It also provides associated remediation information.
Advisor is a necessary component if you want to use the Sentinel Exploit Detection. Advisor is a
subscription-based data service and requires an additional license from Novell. For evaluation
purpose, a snapshot of the Advisor data by default is installed with the Sentinel 6.1 Rapid
Deployment database if you have an Advisor licence. You need to procure this licence to receive the
benefit of ongoing Advisor data updates and exploit-vulnerability mappings. For more information
on this, see “
Understanding Advisor ” in the Sentinel 6.1 Rapid Deployment User Guide .
6.2 Installing Advisor
A snapshot of the Advisor data is installed as part of the sentinel 61 rd installation. However, to
download and install the ongoing Advisor data updates from the Advisor server, you need a current
subscription and valid credentials. During the installation, you can specify the credentials to access
the Advisor server. After sentinel installation, Advisor new feed files from the Internet are routinely
downloaded, if available. This action is triggered by the automatic cron job installed on the Sentinel
6.1 Rapid Deployment server. When the cron job executes the
advisor.sh
script, it starts
processing the initial Advisor data. By default, downloading the Advisor data updates is scheduled
to run every 6 hours.
For more information on installing Advisor data, see Step 18 thru Step 21 on page 34 in the
Section 4.5.1, “Single Script Installation with Root Privileges,” on page 31 .
6.2.1 Updating Advisor Data in a Secured Environment
When the Sentinel 6.1 Rapid Deployment server is installed on a machine in a secured environment,
it requires a manual update to the Advisor data. Installations in a secure environment frequently do
not have internet connections; therefore, you must manually download and copy the Advisor data to
the machine.
The Advisor data can be manually downloaded from the following location by using the Novell
eLogin and password for the user who is entitled to the Advisor subscription:
Advisor Data (https://secure-www.novell.com/sentinel/advisor/advisordata)