Chatta subito con l'assistenza
Chat con il supporto

Foglight APM for Real User Experience 5.9.9 - Administration and Configuration Guide

Getting started Configuring traffic capture
Managing Sniffers Managing Archivers Managing capture groups Managing sessionizing policies Managing monitored ports Managing monitored IP addresses Managing monitored subnets Managing identifiers for virtual addressing schemes Managing private keys Managing web services and SOAP operations
Configuring traffic analysis Configuring analyzers Capturing traffic outside the network Configuring advanced options Integrating Foglight APM with other products Maintaining and troubleshooting Appendix: Building regular expressions in Foglight Appendix: Traffic analysis processing
Understanding the traffic analysis workflow Stage 1: Run hit analysis Stage 2: Run sequence analysis Stage 3: Finalize stopped sequences Stage 4: Finalize the session Example of interdependent analyzers Online-Only Topics
Removing items from a table Defining extraction expressions Adding, copying, and editing archivers Testing archivers Configuring archiver database shard settings Adding, copying, and editing sniffers Testing sniffers Adding and editing capture groups Testing capture groups Adding and copying sessionizing policies Editing sessionizing policies Selecting session identifiers from a discovery list Adding and editing session identifier variables Organizing session identifiers Selecting user name variables from a discovery list Adding and editing username rules Selecting URL prefixes from a discovery list Adding or adding URL prefixes Selecting ports from a discovery list Adding or editing monitored ports Selecting IP addresses from a discovery list Adding or editing monitored IP addresses Looking up host names for all monitored IP addresses Associating private keys with IP addresses Selecting subnets from a discovery list Adding and editing monitored subnets Adding identifiers Editing identifiers Finding IP addresses in HTTP headers Configuring a custom HTTP header using Microsoft IIS Manager Adding and editing local private keys Adding and editing HSM private keys Exporting keys using Microsoft Management Console Adding or editing web services Importing WSDL files to define web services Managing custom fields and metrics Adding, copying, and editing custom fields Removing custom fields Editing custom metrics Removing custom metrics Managing sensitive data Adding, copying, and editing sensitive hit detail policies Adding, copying, and editing sensitive content expression policies Modifying members of pivot categories Selecting aliases from a discovery list Adding, copying, and editing domain rules Adding, copying, and editing large hit details Adding, copying, and editing URL classifiers Reviewing rules for browser category, browser, and operating system hit details Adding user-defined user agent rules Adding and editing additional parsed response types Adding and editing captured request body types Adding, copying, and editing scripts Removing scripts Referencing configuration objects in a script Testing regular expressions Syntax for test data Adding simple hit analyzers using the Setup Wizard Adding simple sequence analyzers using the Setup Wizard Adding analyzers Copying analyzers Editing analyzers Adding and editing conditions Creating a simple Boolean expression Creating a complex Boolean expression Disabling standard metrics generated by a hit analyzer Adding custom metrics Editing custom metrics Selecting pivot categories Breaking out metrics into dynamically-named topology objects Publishing metric timeslices for the Geographical Perspectives dashboard Changing SLA thresholds Adding custom field updates Editing custom field updates Adding scripts to an analyzer Editing scripts Creating new scripts on the fly Adding hit storage restrictions Editing hit storage restrictions Adding sequence events Editing sequence events Adding static page elements Editing static page elements Viewing resource files defined by static page elements Adding and editing subnet filters Exporting configurations Exporting encrypted configurations Restoring a previous configuration Importing saved configurations Importing hit analysis configurations from Foglight Experience Viewer Using the Import Configuration Wizard

Capturing host names

Host identifiers are HTTP response headers that contain the host names of web servers that provide content for your monitored applications. Archivers insert the host name into all URLs. In some monitored environments, you may need to configure host identifiers for the session replay feature to work properly.
To create host identifiers, you need to complete the following tasks:
•
Configure each web server to insert a response header that contains the server’s host name (for example, quest.com). For information about how to insert a response header tag into outgoing traffic, see your web server documentation.
•
Configure a host identifier with the same response header. For instructions, see Defining identifiers.

Managing private keys

Private keys enable the system to monitor encrypted web traffic. To decrypt HTTPS traffic, Sniffers need access to the same private keys used to encrypt the data. Private keys can be stored locally or in a Hardware Security Module (HSM) appliance.
To load and manage private keys, navigate to APM > Configure > Traffic Capture > Private Keys.
Figure 37. Private Keys dashboard
In the Private Keys dashboard, you can perform the following tasks:
•
Managing local private keys
•
Managing HSM private keys

Managing local private keys

For each secure IP address that you want to monitor, you need to export the keys as encrypted private key files. When adding a private key in Foglight, you need both the encrypted key file plus the passphrase used when encrypting the key file.
Supported encryption technologies
Before you begin adding private keys, you need to ensure that Foglight APM supports the same encryption technologies in use within your network environment. Private keys need to be encrypted using a supported encoding format. In addition, the Sniffers and your secure servers need to use the same protocols and algorithms for secure communication. They need to establish a session using the same cryptographic protocol (such as TLS) and the same key exchange algorithm (such as RSA). They also need to use the same bulk encryption algorithm (such as RC4) for transmitting secure data.
The following table summarizes the supported technologies.
 
Table 23. Supported encryption technologies
Encryption
Supported Technologies
Private Key Encoding
•
PEM (Privacy Enhanced Mail)
•
DER (Distinguished Encoding Rules)
•
PKCS12
Cryptographic Protocols
•
SSLv2
•
SSLv3.0
•
TLSv1.0
•
TLSv1.1
•
TLSv1.2
Key Exchange Algorithm1
RSA
Bulk Encryption Algorithm
•
Camellia
•
RC4
•
RC2
•
IDEA
•
DES
•
3DES
•
AES
•
AES-GCM
•
FRT (Fortezza)
1
Diffie-Hellman is not supported because this key exchange algorithm cannot be decrypted by third-party monitoring tools. If you want to monitor the SSL traffic protected by Diffie-Hellman, disable all versions of Diffie-Hellman on the web server (or SSL endpoint) using the following syntax: !DH:!ADH:!DHE

Understanding how local private keys are stored
When you add private keys, Foglight APM Appliances encrypt the key files and save them in hidden files on the appliance. The appliance then implements extensive hardening and security measures, ensuring that your private keys cannot be compromised. Passphrases are not saved.
Exporting local private keys
When exporting the private key from your web server, make sure to select the Yes, Export the private key option. Depending on the web server, the private key is not always included in an export by default. You will need to specify a passphrase for use with the encrypted key file. For more information, see Exporting keys using Microsoft Management Console.
Example
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,F85757828BFF54C8
QlHfWyCnqpe5ag4LgNiRQaqrcTC5bBV3yT35tRbB0WKB3VsaDcHuhjlyz3ohQmgpHoZtWcCxCRm8DOROlBPEBhmRgUSYxByyt/Y8OvL9Ei2YFdRjBapsJjEjpTEl6AXNGHKjHbmyCHs5O1LvnwEv13b51Q0RHRpRZX1yNVL34cz/efMCfVlhgqlYCHFb0qRzLcNFVW6vRXWfKkM5jbw67WmKjqeDa+VMMXskPRDxFVYud/HoB+gnMP0ecnSX7k4xZrLkIwk4QcVaJST2BPiDq0DhBdUfXRurJd9AQuAECAw6SgumqIRY/CrH31w5dxqXzs2UY0lqODpU3tVqZW8+OxX34ojsBPeH0zmeOxnmQ8IebRyex8MTHhEVnpIU4DDNdKlbE0/seoyNGJRXFh2lDcrXlkTMgrOVg1VL216vGIgbpfyZgOBDiexkEj24tW4dO0iRhyqiOZVZVlR2kcm9L64NruhwgzLAGPDlaGfLkExATQvp1NNETxoR0iMe4vBgA1xLZDZ/atH4U/oE63Hedj4B9C3MG8Wapnx5lJaA7DVKSkPwKZRP5Qxcbun3R084j+Q7KwmkiOk0yT8RlQapLm7SaYahOklJPy0eHpfo4sZPELhkU39V4smBa1LlAKCbxTzFYq22CLCKBtEkCKrc9yfOQ8KpQ9SsD2/VCJRfLGhMRrVzSheOXeGDA/oKq/ZZLO27r68odZaXQw1e9dR7oKStqNOG8M3WAsY3LEH++DAubqXDJ6g00aHC2eiVr9ZFfRUpKWRqybHns+ukAcg436UJoK2RMyhWyBHV8P2cDqF1ow9QQzO8Qg==
-----END RSA PRIVATE KEY-----
Defining local private keys
When adding or editing a local private key, you can set the following options.
 
Table 24. Defining local private keys
Option
Setting the Option
Key Name
Specify a unique name for the private key.
Choose File
Navigate to and select the encrypted private key file.
Passphrase
Type the passphrase used to encrypt the private key during the export process.
Example
Figure 38. Add Private Key dialog box
Troubleshooting local private keys
When adding a private key, you may see the following message:
The key file you supplied is invalid. Possible reasons are: 1) incorrect password, 2) the file does not contain a private key, 3) the file was exported with strong encryption, or 4) the file is in an unrecognized format.
Due to the nature of SSL, it is impossible to determine precisely why your key may be invalid, but you can try exporting the key again, making sure to select the following options:
•
Select a supported encoding format: PKCS, PEM, or DER.
•
Select the Export Private Key (or similar) option. Depending on the web server, the private key is not always included in an export by default.

Managing HSM private keys

An HSM is an appliance that stores and manages private keys. When integrated with an HSM appliance, Foglight can use the keys within the HSM server to decrypt HTTPS traffic, without having to store the keys locally. Before you can define HSM private keys, you need to complete the steps in Integrating with SafeNet Hardware Security Modules.
Supported HSMs
Foglight currently supports SafeNet Luna SA HSM appliances.
Defining HSM private keys
When adding or editing an HSM private key, you can set the following options.
 
Table 25. Defining HSM private keys
Option
Setting the Option
Partition
Select the HSM partition that contains the key you want to add.
Enter Password
Click Enter Password and type the password for the partition.
Key Name
Select the key.
Example
Figure 39. Add Hsm Key dialog box
Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione