Web Protection Part 3: Deployment, Reports, and Usage

In part one of this series on Web Protection, you had a discussion with a client or potential client about implementing Web Protection. In part two, we covered setting up a demonstration policy and implemented it on a single device to begin collecting data for analysis. Now that you have had a few weeks to let Web Protection analyze the network traffic on your client's endpoint, the time has come to show the results of what type of information has been passing through this device. Bear in mind that while Web Protection has been deployed, it has been collecting and analyzing data. This data is available through the various reports within the MSP Remote Monitoring and Management Cloud Dashboard (MSP RMM Cloud). In the future, note that you can provide feedback on multiple levels. For the sake of this initial demonstration, you will only have tracking information for a single device.

Web Protection Part 2: Setting up a New Policy

In Part 1, we discussed how to have the initial conversation with your client's concerning Web Protection and how their company handles monitoring and managing their user's web activity. We now move into setting up a demonstration for the client to illustrate the benefits of Web Protection. To start out with your new customer, you can offer to run Web Protection on a single, active device for 30 days in order to collect data. This information is what can be viewed per device, and is what drives the generated ports. This demonstration gives you the best opportunity to illustrate the type of data that the client is not currently capturing, and helps them ensure that they are monitoring web access effectively.

System Tray Application Icon - Greatest thing since sliced bread!!

There are many features that can be deployed to your customer's devices by simply getting Advanced Monitoring Agent installed to start with.

There are now options such as antivirus, remote access, unobtrusive (background) management, web filtering and browsing protection, silent patch management, and even individual offsite backup.  All of which are simple to deploy, easy to monitor, and great ways to help you take care of your customers computer & network health.

But in my opinion, the feature that provides you with the most value is the System Tray Application icon. Of course, since it is your business, you may configure it any way you like but here are just a few examples of what you can accomplish with this feature.

Monitoring / managing Lenovo servers with SNMP

MAX SNMP and Lenovo servers

I know it's the old one.

Lenovo is getting more attention for IT support personnel with their new server line of products.  So can these devices be monitored using the MAX RemoteManagement platform?  Must you have a package supporting Intelligent Platform Management Interface (IPMI)? Or are there alternatives?

There is a way to monitor Lenovo via SNMP through MAX RM today.

Mastering User Security While Providing Dashboard Access to Contractors and Clients

Mastering User Security While Providing Dashboard Access to Contractors and Clients

By Andrew Crihfield

Often times you will need to provide restricted Dashboard access to an employee, contractor or client for many different reasons. This article will provide you the necessary information to provide the access you need while still providing a secure dashboard environment.

Take An SNMP Walk - Creating New SNMP Checks using MIB Browsing Tools

How many times have you wanted to use GFI MAX to monitor a piece of hardware like a router or printer but didn't know how?  GFI MAX offers several ways to monitor IP addressable devices.

• Ping check - pings a device using its Hostname, FQDN or IP Address and fails if no response is received
• TCP Service Check - Attempts to connect to the specified port/service.  The check can be configured to pass or fail based on connection status.  In this way it can be used to check for services that should be running or alert you when ports that should be closed become open.
• Web Page Check - Checks a web page and passes the check as long as it responds with the expected text.
• SNMP Check - Used to query SNMP server hardware and SNMP enabled network devices such as routers, switched and printers.

So the first three checks are pretty self-explanatory.  SNMP checks however require a bit of digital mysticism.  Here is basic process for creating a new SNMP check that can then be used over and over again on your dashboard.

I'd like a System State Backup with a side of critical data and databases please!!

                 I'm sure all of you sit down with your clients periodically, if not you should, to go over their current state of affairs in regards to their network and their business technology needs and suggest what you feel is necessary; which should include some type of  backup solution. Translation - Tell them what they need with people skills :) These types of conversations need to be addressed because they don't have a proper working solution in place or if you've decided that you should be in charge of the backups since you will be blamed for it if your customer doesn't have the data they need when they need it. I call it the CYA (Cover Your Agreement) policy.  This scenario would give both you and your client piece of mind. So when it comes time to introduce possible solutions and alternatives, I'm also certain MSPs lead with some type of hardware appliance that does full images so that you can bring them back up rather quickly with either another image,some type of virtualization in the cloud capabilities, or maybe even both.  Then the new customer will probably give you one one of these three responses: 

Master Class: Outage Preparedness in Max MailProtection

MailProtection is generally thought of as a filtering tool, but it can be invaluable to protect continued mailflow when used properly. The Mail Continuity feature of GFI Max MailProtection offers you a layer of insulation in the event of an internet outage, server crash or planned server migration.

Taking a few minutes now to understand how mail continuity works and learning the best steps to take before, during and after a disruption will help ensure the least amount of inconvenience during these situations.

Quick Tip: Getting Spiffy with SPF in RemoteManagement

Yesterday I was explaining how best to incorporate MailProtection's servers for your SPF records - which is very important to do when you are using it as the outbound smarthost for your (or your customer's) outbound mail.

But did you know you need to account for RemoteManagement in your SPF records as well?

Quick Tip: Easy SPF for Max MailProtection

While MailProtection provides quality IP reputation and filtering for your customers' outbound mail, managing the SPF records for those domains can be a bit tricky due to the number and occasional change of IP pools used. Nobody wants to go back and edit every domain's SPF records whenever the MailProtection IP pool changes or risk rejected mail for improperly entering a subnet.

I've done some digging, and you can use the following SPF entry for true "set it and forget it" SPF protection:

Quick Tip UPDATED: The Care and Feeding of your Hacker Check

"Oh, No! The Hacker Check went off! We're under attack!"

Not necessarily.

UPDATED!

Quick Tip: The Phantom Menu Item

Sometimes, on a dark, stormy night when an angry moon hangs low, you may see a menu item that is grayed out so it cannot be pressed - or a menu item you know you've seen before has simply vanished like it was never even there. That is because the interface is haunte...

...One second - Legal is on the phone.

As I was saying, the interface is 100% not haunted (where did you get that idea?), and the phantom menu items are most likely due to one of the following 2 causes:

1. The feature in question requires a newer agent than you currently have installed. Once you update the agent, the item should no longer be grayed out
2. You are somehow logged in as a lower-clearance user than you are accustomed to. Once you log in with your regular account, everything should be as you remember it.

(T3): Just One SNMP example

Did you know that you could monitor that APC with MAX?  Did you know that one of "your own" wrote a way to do it even if you have the Personal Edition of the software?  No?  Really ...

Making sure you know when a server goes offline

Rumor has it that servers are somewhat important, and bad things may occasionally happen when they go down for an extended period of time.

All joking aside, servers are crucial. Maintaining and monitoring them is a big part of why you are in business. So nothing feels worse than having your customer call to tell you their server has been offline for 30 minutes, when you supposedly have a system in place to alert you in the event of downtime.

Let's make sure it doesn't happen to you.

(T3): Patch Management & Dashboard v5.21

Yes, y'all - it's finally upon us!  Dashboard v5.21!  Here's some cool stuff you can do with the new dashboard and the new Release Candidate Agent (v8.10.1).  In essence, now patches from both Microsoft and all of our supported vendors can be approved and installed, including reboots, without user intervention if desired.

If you'd like, you can read the release notes on the forums:
http://forums.gfi.com/Dashboard-v521-and-Agent-v8101-RC-m900804700.aspx

Reducing Alerts for better Signal-to-Noise in RemoteManagement

So, you've deployed your agents. You've configured your reports. You've even got the after-hours alerts routed to a special address. Your system is in place to keep you informed of every little thing that happens. So why are you weeding through alerts you don't care about to get to the information you need? How do you get the alerts adjusted to a level that works for you?

Fine-Tune your Performance Monitoring checks in MAX RM

When you first install MAX RemoteManagement on a server, you may notice a high amount of performance monitoring alerts. This may seem daunting at first, but you can quickly get these alerts under control, as shown in this video:

 

While you should watch the full video for the detailed instructions, the process can be summarized as follows:

1. Temporarily Suppress Alerting while data is collected
2. Analyze the Performance Monitoring Data to determine the proper baselines for the system
3. Edit Performance Monitoring Checks to reflect those new baselines
4. Change General Performance Monitoring Alert Thresholds to report on overall trends instead of spikes