4.1 Testing the Installation

Sentinel is installed with a demonstration collector that can be used to test many of the basic functions of the system. Using this collector, you can test Active Views, Incident creation, Correlation rules, and Reports. The following procedure describes the steps to test the system and the expected results. You might not see the exact events, but your results should be similar to the results below.

At a basic level, these tests allow you to confirm the following:

Sentinel Services are up and running
Communication over the message bus is functional
Internal audit events are being sent
Events can be sent from a Collector Manager
Events are being inserted into the database and can be retrieved using either Historical Event Query or the Crystal Reports
Incidents can be created and viewed
The Correlation Engine is evaluating rules and triggering correlated events
The Sentinel Data Manager can connect to the database and read partition information

If any of these tests fail, review the installation log and other log files, and contact Novell Technical Support, if necessary.

To test the installation:

Start the Sentinel Control Center:
- Windows: Double-click the Sentinel Control Center icon on the desktop.
- Linux/Solaris: Log in as an admin user (esecadm), change the directory to $ESEC_HOME/bin and run ./control_center.sh from the command prompt. Specify the credentials and press Enter.
Log in to the system as an admin user (esecadm by default).

The Sentinel Control Center opens and you can see the events in the Active Views filtered by public filters: Internal_Events and High_Severity.
Click the Event Source Management menu, and select Live View.
In the Graphical view, right-click 5 eps event source and select Start.
Close the Event Source Management Live View window.
Click the Active Views tab.

The Active window titled PUBLIC: High_Severity, Severity. The collector might take some time to start and send the data to get displayed in the Active View window.
Click the Event Query button in the toolbar.

The Historical Event Query window is displayed.
In the Historical Event Query window, click the Filter drop-down arrow to select the filter. Highlight Public: All filter and click Select.
Select a time period that covers the time that the Collector has been active. Select the date range from the From and To drop-down list.
Select a batch size from the Batch size drop-down list.
Click the Magnifying Glass icon to run the query.
Hold down the Ctrl or Shift key, and select multiple events from the Historical Event Query window.
Right-click and select Create Incident.
Enter a name for the incident TestIncident1 and click Create. A success notification displays.
Click OK.
Click the Incident tab.

The Incident View Manager window is displayed that lists the incident that you created.
Double-click the incident to display.
Click File > Exit or click the X button on the upper right corner of the window to close the Incident window.
Click the Analysis tab.

The Analysis Navigator window with the Events folder is displayed.
Click Historical Event Queries.
Click Analysis > Create Report or click the Create Report icon.

An Event Query window is displayed. Set the following:
- time frame
- filter
- severity level
- batch size (this is the number of events to view – events display from oldest events to newer events)
Click the Begin Searching icon.
To view the next batch of events, click More.
Rearrange the columns by dragging and dropping them, and sort the events as required by clicking the respective column heading.

When the query is complete, it gets added to the list of quick queries in the Navigator.
Click the Correlation tab.

The Correlation Rule Manager window is displayed.
Click Add.

The Correlation Rule wizard is displayed.
Click Simple.

The Simple Rule window is displayed.
Use the drop-down menus to set the criteria to Severity 4. Click Next.

The Update Criteria window is displayed.
Select Do not perform actions every time this rule fires for the next and set the time period to 1 Minute using the drop-down menu. Click Next.

The General Description window displays.
Enter a name and description for the rule, and click Next.
Select No, do not create another rule and click Next.
Create an action to associate the rule that you have created:
1. Perform either of the following:
  - Select Tools > Action Manager > Add.
  - In the Deploy Rule window, click Add Action. For more information, see Step 33 thru Step 34.
  The Configure Action window is displayed.
2. In the Configure Action window, specify the following:
  - Specify the action name. For example, CorrelatedEvent Action.
  - Select Configure Correlated Event from the Action drop-down list.
  - Set the Event Options.
  - Set the Severity to 5.
  - Specify the EventName. For example, CorrelatedEvent.
  - Specify a message if required.
3. Click Save.
Open the Correlation Rule Manager window.
Select a rule and click the Deploy rules link.

The Deploy Rule window is displayed.
In the Deploy rule window, select the Engine to deploy the rule from the drop-down list.
Select the action that you created in Step 32 to associate with the rule and click OK.
Select Correlation Engine Manager.

In the Correlation engine, you can see the rule is deployed/enabled.
Click the Active Views tab and verify that the Correlated Event is generated.
Close the Sentinel Control Center.
Double-click the Sentinel Data Manager (SDM) icon on the desktop.
Log in to SDM using the Database Administrative User specified during installation (esecdba by default).
Click each tab to verify that you can access them.
Close Sentinel Data Manager.

If you were able to proceed through all of these steps without errors, you have completed a basic verification of the Sentinel system installation.