Appendix

Reconfiguring Agents

In some situations, for example, if the hostname or IP address of the CipherTrust Manager appliance changes, Agents' connection with DDC must be reconfigured with the new hostname or IP address.

Reconfiguring DDC Agents on Windows

To reconfigure a DDC Agent:

1. Log on to the host machine as administrator.

2. Open Enterprise Recon Configuration Tool (er2_config_cmd.exe).

   By default, the tool is available at C:\Program Files (x86)\Ground Labs\Enterprise Recon 2\.

3. In the Master server IP address or host name field, specify the new hostname or IP address of the CipherTrust Manager.

4. Click Test Connection. A message stating "Connectivity test is successful" confirms successful reconfiguration.

5. Click Finish.

Reconfiguring DDC Agents on Debian

To reconfigure a DDC Agent:

1. Log on to the host machine as a user with root privileges.

2. Reconfigure connection with DDC on the CipherTrust Manager appliance.

   sudo er2-config -i <hostname|ip_address>
   

   Here, <hostname|ip_address> represents the new IP address or hostname of the CipherTrust Manager appliance.

3. Restart the Agent service. Configuration settings will be effective after the Agent restarts.

   sudo /etc/init.d/er2-agent -restart
   

Reconfiguring DDC Agents on RHEL

To reconfigure a DDC Agent:

1. Log on to the host machine as a user with root privileges.

2. Reconfigure connection with DDC on the CipherTrust Manager appliance.

   er2-config -i <hostname|ip_address>
   

   Here, <hostname|ip_address> represents the new IP address or hostname of the CipherTrust Manager appliance.

3. Restart the Agent service. Configuration settings will be effective after the Agent restarts.

   sudo /etc/init.d/er2-agent restart
   

Restarting DDC Agents

Restarting Agents on Windows

To restart a DDC Agent, run the following commands:

net stop "Enterprise Recon 2 Agent (<ARCH>)"
net start "Enterprise Recon 2 Agent (<ARCH>)"

Here, <ARCH> represents the Windows architecture - x32 or x64.

Restarting Agents on Debian

To restart a DDC Agent, run:

sudo /etc/init.d/er2-agent restart

Alternatively, restart the Agent service by stopping it and again starting it manually. Run the following commands:

sudo /etc/init.d/er2-agent stop
sudo /etc/init.d/er2-agent start

Restarting Agents on RHEL

To restart a DDC Agent, run:

sudo /etc/init.d/er2-agent restart

Alternatively, restart the Agent service by stopping it and again starting it manually. Run the following commands:

sudo /etc/init.d/er2-agent stop
sudo /etc/init.d/er2-agent start

Mounting an NFS Share

To mount an NFS share on a Proxy agent, run this command as root:

sudo mount <nfs-server-hostname|nfs-server-ipaddress>:</target/directory/share-name>

Information Types

Supported Formats

Files

Office files

WORD

• Legacy: Legacy filename extensions denote binary Microsoft Word formatting that became outdated with the release of Microsoft Office 2007. Although the latest version of Microsoft Word can still open them, they are no longer developed. Legacy filename extensions include:

  • .doc – Legacy Word document; Microsoft Office refers to them as "Microsoft Word 97 – 2003 Document"
  • .dot – Legacy Word templates; officially designated "Microsoft Word 97 – 2003 Template"
  • .wbk – Legacy Word document backup; referred as "Microsoft Word Backup Document"

• OOXML: Office Open XML (OOXML) format was introduced with Microsoft Office 2007 and became the default format of Microsoft Word ever since. Pertaining file extensions include:

  • .docx – Word document
  • .docm – Word macro-enabled document; same as docx, but may contain macros and scripts
  • .dotx – Word template
  • .dotm – Word macro-enabled template; same as dotx, but may contain macros and scripts
  • .docb – Word binary document introduced in Microsoft Office 2007

EXCEL

• Legacy: Legacy filename extensions denote binary Microsoft Excel formats that became outdated with the release of Microsoft Office 2007. Although the latest version of Microsoft Excel can still open them, they are no longer developed. Legacy filename extensions include:

  • .xls – Legacy Excel worksheets; officially designated "Microsoft Excel 97-2003 Worksheet"
  • .xlt – Legacy Excel templates; officially designated "Microsoft Excel 97-2003 Template"
  • .xlm – Legacy Excel macro

• OOXML: Office Open XML (OOXML) format was introduced with Microsoft Office 2007 and became the default format of Microsoft Excel ever since. Excel-related file extensions of this format include:

  • .xlsx – Excel workbook
  • .xlsm – Excel macro-enabled workbook; same as xlsx but may contain macros and scripts
  • .xltx – Excel template
  • .xltm – Excel macro-enabled template; same as xltx but may contain macros and scripts

POWERPOINT

• Legacy:

  • .ppt – Legacy PowerPoint presentation
  • .pot – Legacy PowerPoint template
  • .pps – Legacy PowerPoint slideshow

• OOXML:

  • .pptx – PowerPoint presentation
  • .pptm – PowerPoint macro-enabled presentation
  • .potx – PowerPoint template
  • .potm – PowerPoint macro-enabled template
  • .ppam – PowerPoint add-in
  • .ppsx – PowerPoint slideshow
  • .ppsm – PowerPoint macro-enabled slideshow
  • .sldx – PowerPoint slide
  • .sldm – PowerPoint macro-enabled slide

ACCESS

• Legacy:

  • .ade – Protected Access Data Project (not supported in 2013)
  • .adp - Access Data Project (not supported in 2013)
  • .mdb - Access Database (2003 and earlier)
  • .cdb - Access Database (Pocket Access for Windows CE)
  • .mda - Access Database, used for addins (Access 2, 95, 97), previously used for workgroups (Access 2)
  • .mdt - Access Add-in Data (2003 and earlier)
  • .mdf - Access (SQL Server) detached database (2000)
  • .mde - Protected Access Database, with compiled VBA and macros (2003 and earlier)
  • .ldb - Access lock files (associated with .mdb)

• Available formats since Access 2007:

  • .accdb – The file extension for the new Office Access 2007 file format. This takes the place of the MDB file extension
  • .accde – The file extension for Office Access 2007 files that are in "execute only" mode. ACCDE files have all Visual Basic for Applications (VBA) source code hidden. A user of an ACCDE file can only execute VBA code, but not view or modify it. ACCDE takes the place of the MDE file extension
  • .accdt – The file extension for Access Database Templates
  • .accdr – is a new file extension that enables you to open a database in runtime mode. By simply changing a database's file extension from .accdb to .accdr, you can create a "locked-down" version of your Office Access database. You can change the file extension back to .accdb to restore full functionality

OUTLOOK

• .pst - Outlook
• .ost - Outlook
• .msg - Outlook
• .dbx - Outlook

OTHER

• .pub – a Microsoft Publisher publication
• .xps – a XML-based document format used for printing (on Windows Vista and later) and preserving documents

Databases

• Microsoft SQL
• Oracle
• DB2
• PostgresQL

Big Data

• Hadoop

Security Audit Log Event Messages

The following table contains a complete list of security audit log event messages that DDC prints in the log file.

Configuration Backup

You can back up and restore the DDC configuration by using the Backup/Restore functionality available in CipherTrust Manager. Such a backup will include the following elements:

• Data Stores

• Branch Locations

• Classification Profiles

• Infotypes

• Report definitions

This backup will not include the information about the scan executions.

Creating/Restoring the Configuration Backup

To create or restore a backup of your DDC configuration:

1. Log in to CipherTrust Manager.

2. Click the Admin Settings link on the dashboard.

3. Select Backups from the sidebar on the left. This will display the Backups screen.

4. To create a backup of your DDC configuration, click the Create Backup button.

5. To restore your DDC configuration from a backup, click the Upload Backup button.

For more details refer to these sections of the CipherTrust Manager documentation:

• CipherTrust Manager Backup

• CipherTrust Manager Scheduling Backups

• CipherTrust Manager Scheduler

Configuration Backup Limitations

• The configuration backup references the DDC Active Node. Restoring the backup to a different CipherTrust Manager cluster leaves DDC referencing an invalid node, and therefore without any valid active node.

• The configuration backup contains the definition of the DDC resources (such as the Scan or Data Store definitions). Restoring from a backup that does not contain a certain resource (for example, a Custom Classification Profile) or a resource version after a scan had been completed causes a TDP scan execution data to point to an invalid resource identifier.

  If you generate a report that points to the missing resource you may display incomplete data (such as not being able to display the resource name) and/or fail.

Creating/Restoring Backup of Scan Executions

To back up or restore the your Data Discovery and Classification scan executions data you need to access the DDC data stored in Hadoop. For details, refer to the Thales Data Platform Hadoop Backup section in the Thales Data Platform Administrator Guide.