Sentinel Log Manager Handling POCs

Automated Compliance and Security Management

Things to Point Out during POC

The Log Manager does not run as ROOT Agentless solution The different ways customers use Collector Managers

DMZ Remote location Compress and encrypting of data Central logging Control when and/or the bandwidth of forward events

Sentinel Link allows

Novell Inc. All rights reserved

Things to Point Out during POC

There is no requirement for a report server Query and report will search archived data, no need to import data from archives Retention policy of data can also be set for internal audit event for the Log Manager The Log Manager was built on the Sentinel framework The Log Manger can be an account other then novell

Novell Inc. All rights reserved

Do(s) Before going onsite

Get requirements from customer Establish success criteria Identify Red Flags Know the business problem Know what/how many data sources Download the latest connector and collector from the support page that are needed Identify who owns the different data sources Be prepared to sent collectors and connects PDFs

Novell Inc. All rights reserved

Do(s) Before going onsite

Find out if the customer is ok with default for installation Check that customer has current version Hardware or VM installation Does the customer have SuSe 11

Novell Inc. All rights reserved

Do(s) While onsite

Keep it simple Before starting installation check the file space Try to setup most/all data sources before doing queries/reports Create an account for the customer and use that account when showing them the solution Show creating a report from a query and add to favorites tab

Novell Inc. All rights reserved

Do Not(s)

Do not get in the number games Do not agree to a data source that there is not a collector for or could be processed by generic collector

http://developer.novell.com/wiki/index.php/Develop_ to_Sentinel

Novell Inc. All rights reserved

Thing to Remeber

POC is one way for the customer to get an idea what their EPS may be iReport does not come with Log Manager or the SDK Demo/showing/training on iReport is usually out of scope

Novell Inc. All rights reserved