- Docker logs tail: Troubleshoot Docker containers with real-time logging - Wed, Sep 13 2023
- dsregcmd: Troubleshoot and manage Azure Active Directory (Microsoft Entra ID) joined devices - Thu, Aug 31 2023
- Ten sed command examples - Wed, Aug 23 2023
Many businesses struggle to maintain visibility and audit files accessed across their environments. This lack of visibility and control opens the door to ransomware and other cybersecurity concerns. PA File Sight is a solution aimed at helping businesses take control of their Windows file auditing and govern which applications and executables can run in the environment. Its primary offerings include ransomware protection, data loss prevention, file access auditing, and trusted application safelisting.
PA File Sight architecture
The installation includes a SQL Lite DB. However, you can point it to SQL Server as well. PA File Sight is an agent service you push out from the Central Monitoring Server. Once your servers are onboarded, you can configure PA File Sight to protect and audit your resources.
PA File Sight logs and alerts based on events in the environment. These are all configurable, and you can trigger many actions based on file audit events.
Below is a high-level overview of the PA File Sight architecture.
PA File Sight architecture
PA File Sight includes the following features:
- Ransomware protection
- Data loss prevention (DLP)
- Audit file access
- Trusted applications
Ransomware protection
Ransomware attacks have grown in frequency and sophistication, causing significant disruptions across various sectors. They involve malicious software that encrypts files, rendering them inaccessible until a ransom is paid. PA File Sight's ransomware protection feature is designed to detect and stop these attacks in their tracks.
It uses advanced heuristics and supports the use of honeypots—decoy systems used to lure and analyze attackers. Furthermore, it only allows executables that meet your rules to run, adding another layer of defense against ransomware.
Data loss prevention (DLP)
Unintentional data exposure can lead to dire consequences for any organization, including financial penalties, loss of customer trust, and regulatory violations. This is where PA File Sight's data loss prevention (DLP) feature comes into play. DLP detects and optionally blocks file copying actions based on real-time rules. It also enables blocking access to cloud folders and external drives, providing additional control over data access, and preventing potential information leaks.
Audit file access
PA File Sight's file access auditing provides comprehensive insight into file operations in an organization. It audits who is deleting, moving, or reading files and stores this data to generate rich reports. This feature is handy for meeting compliance requirements, allowing organizations to maintain a detailed record of file operations. For instance, it could help meet compliance mandates, such as PCI DSS, SOX, GLBA, HIPAA, FISMA, and ISO 27001/27002 requirements.
Trusted applications
As cyber threats evolve, relying solely on traditional antivirus solutions is no longer sufficient. Application safelisting has become an effective method for preventing malware attacks by allowing only trusted applications to run. PA File Sight's trusted applications feature provides this capability, granting or denying file I/O in real time based on your rules.
Enterprise robustness and centralized management
PA File Sight helps with compliance and security by ensuring that your data stays on your servers and is not sent to the cloud. You can also configure automatic failover with a hot standby PA File Sight server, contributing to high availability.
The centralized management feature in the Ultra edition is worth noting, as it allows for administering the system from anywhere. This convenience, coupled with the ability to monitor remote servers as easily as local ones, results in many management benefits for a large-scale deployment.
The importance of real-time alerts
Real-time alerts are a critical feature of any Windows file auditing and protection solution. Minutes and even seconds count during a ransomware attack. PA File Sight provides immediate notification of potential issues, allowing for a quick support response and preventative action.
With PA File Sight, IT staff can get real-time alerts to investigate potential issues immediately. It can be instrumental in identifying unusual file operations, such as unexpected file deletions or suspicious file copying activities.
Installation and initial configuration
If you want to try out PA File Sight, you can download the application for a free 30-day trial. The trial edition was used in testing. Installing PA File Sight is a straightforward process, especially if you choose to use the integrated DB. You simply run the downloaded .EXE file and follow the installation prompts.
Beginning the PA File Sight installation
Once the PA File Sight installation is completed successfully, it will launch a wizard to perform the initial configuration of the solution, including the following:
- Configuring a service account
- Email configuration
- Log file action
- Creating your first monitor
Initial PA File Sight configuration wizard
After running through the initial configuration, you will be taken to your PA File Sight dashboard.
PA File Sight dashboard
Onboarding endpoints and configuring monitors
The Easy Deploy feature allows you to easily deploy Satellite monitoring services (the PA File Sight agent) to a list of servers in your environment. To launch the Easy Deploy option, navigate to Configuration > Easy Deploy. Enter the hosts you want to onboard.
Running the Easy Deploy process
Once you have onboarded the hosts to the PA File Sight solution, you can then right-click the host and choose Add New Monitor.
Host onboarded and beginning the process of adding a monitor
You will then choose what type of monitor you want to add to the monitored host. Here, we are choosing the File Sight Monitor option.
Choosing the monitor to add to a host in PA File Sight
Under Monitor Purpose (for configuration help), you can choose what type of configuration you are attempting to set up. Here, you can configure various monitoring thresholds, such as:
- File types
- File activities
- Directory activities
- Copy detection
- User activities
- Streams and behaviors
Monitor purpose configuration help
You can choose what types of actions you want to trigger when monitoring thresholds meet the configured criteria. It defaults to a few actions on the list. However, you can add many more.
Default actions for the PA File Sight monitor
If you click the New option, you can add from a long list of actions in the Add New Action dialog box.
Adding new actions for a monitor trigger
Controlling which applications and executables are allowed to run on an endpoint or server is a great way to prevent ransomware infections. Application safelisting only allows specified applications to run and ensures that all exes and apps have been vetted from a security standpoint.
Choosing the Trusted Application monitor allows you to configure a new monitor to watch all file read access and only allow activity based on configured application rules.
Controlling which applications can run
When you add a monitored host, one of the nice features of the interface is the real-time system information and status dashboard, where you can monitor file activity and see which files and executables are being accessed and how often.
PA File Sight monitoring all file activity on the satellite host
On the CONFIGURED ACTIONS BY TYPE menu, you can see which actions are configured and add new custom actions.
Configured actions by type
For compliance purposes, informing key stakeholders, and maintaining visibility into changes and activity in the environment, you can schedule reports that capture many different types of activities and have these sent at scheduled intervals.
PA File Sight scheduled reports
Wrapping up
When it comes to cybersecurity, Windows file auditing and real-time protection are necessities. With its comprehensive features, including ransomware protection, data loss prevention, and file access auditing, PA File Sight helps businesses maintain visibility and control over file and application access.
Subscribe to 4sysops newsletter!
The solution includes many features and offers the ability to customize those features to meet specific organizational needs. We have only scratched the surface of what PA File Sight can do in this overview. It offers many features and provides an intuitive solution to help organizations with today's cybersecurity challenges.
