The raw data files for each event source are compressed and archived every hour and the file hash is computed for archived files. The file hash is used to check the integrity of the archived files.
Log in to Sentinel Log Manager as an administrator.
Click thelink in the upper left corner of the page.
In thesection, select the desired Collector and Connector combination from the Event Source hierarchy drop-down list.
Thefield displays the list of associated event sources (hostnames or IP addresses). Select the event source from the drop-down list.
The table displays the list of local and archived raw data files for the selected event source.
Clickto select all the files in the table.
To select a raw data file, select the check box next to the raw data file.
Theand options are only enabled when you select a file from the table.
Clickto verify the integrity of the selected archived files by comparing the hash values for the selected archived files.
If integrity verification is successful, a green icon is displayed next to the filename in thecolumn. If it fails, a red icon is displayed.
The hash is computed and updated in database only for archived files, but not for the local raw data files. Because the raw data files are updated until they are archived, the hash value cannot be computed or updated for these files. It is not possible to check the integrity of the local raw data files.
Select the raw data file, then clickto download the selected archived and local raw data files.
The selected files are downloaded in the form of a zip file that contains a .csv (comma separated values) file. If the archived files are selected, the zip file also contains a hash file corresponding to each of the archive files downloaded.
The SHA-256 algorithm is used to generate the file hash and the generated hash is Base64 encoded.