Securing and monitoring the performance of your UNIX and Linux environments can be expensive and time-consuming. The enterprise performance and security managers experience the following challenges:
Deficits in UNIX and Linux security and system expertise
Managing various operating systems including Red Hat, AIX, HP-UX, Solaris, and SUSE Linux
Controlling access to privileged commands and sensitive resources
Lacking intrusion detection and response systems to handle both real and potential security breaches
Security Agent for UNIX (agent) helps you effectively address these challenges by enabling security products, such as Sentinel, to monitor the configuration and risk compliance of your UNIX and Linux environments.
Figure 1-1 Security Agent for UNIX Architecture
You can deploy and manage Security Agent for UNIX using the following:
UNIX Agent Manager (UAM). UAM is a console and data store that you can use to manage the Security Agent for UNIX components in Sentinel. UNIX Agent Manager runs on Windows, UNIX, and Linux operating systems. Most features can be accessed from a command line as well as the console.
The following tables list the functionalities of UAM:
Table 1-1 UAM functionality for Sentinel
Function |
UAM |
---|---|
Agent deployment |
Performed by UAM server |
Audit diagnostics |
Yes |
Enhanced certificate management |
No |
Asset view |
Shows which agent components are enabled on each asset |
Monitoring the agent status |
Yes |
Patch release |
Yes for all patches |
Licensing and availability |
Available with a licensed instance of Sentinel |
Table 1-2 UAM for Sentinel
Function |
UAM |
---|---|
Remote agent installation, upgrades, reconfiguration, and uninstallation |
Yes |
Sentinel rule deployment |
Yes |
Sentinel Oracle endpoint management |
Yes |
When you install an agent, you can choose the security product as Sentinel, which monitors the computer on which the agent resides. A single agent can perform monitoring of the security product Sentinel. Sentinel has its own method for registering the agents and configuring the agent to send the proper data. This security product Sentinel is referred to as the agent component.
For Sentinel, you must deploy rules on the Sentinel Agent by using UAM. The events are filtered and forwarded to the Sentinel server based on the rules deployed. You can monitor the most complex IT environments and obtain the security required to protect your IT environment.