Technical Resources for MSPs

Implementation Flow

The following steps describe how to configure and deploy FileSure on client endpoints:

Step 1: Create a JSON Configuration File

1. • Define your rules and alerts with shortcodes.  Then add necessary overrides in a structured JSON file for alerts.

   • Example JSON:

     Simple example:

     {
       "Rules": [
         "AUDITCOPIES",
         "AUDITFOLDERMOVES",
         "AUDITOFFICENOACCESS",
         "AUDITUSB"
       ],
       "Alerts": [
         {
          "Id": "BULKCOPY",
         },
         {
           "id": "FOLDERMOVES"
         },
         {
           "id": "USBWRITES"
         },
         {
           "id": "WEBACCESSED"
         },
       ]
     }
     

     An example with alert overrides:

     {
       "Rules": [
         "AUDITCOPIES",
         "AUDITFOLDERMOVES",
         "AUDITOFFICENOACCESS",
         "AUDITUSB"
       ],
       "Alerts": [
         {
           "Id": "BULKCOPY",
           "Body": "<%username%> has copied <%count%> files within <%AgeInMinutes%> minutes",
           "AgeInMinutes":500
         },
         {
           "id": "FOLDERMOVES"
         },
         {
           "id": "USBWRITES"
         },
         {
           "id": "WEBACCESSED",
           "SQL": "Select 1, * from AuditRecords where eventTime > OldestRecordAge and ((lower(exeName) = 'edge.exe' or lower(exeName) = 'firefox.exe' or lower(exeName) = 'chrome.exe') and deniedOp = 0)",
           "Body": "<%username%> accessed <%filename%> with <%exeName%>"
         }
       ]
     }
     

     When defining the 'Body', you can use 'Merge Fields' that are enclosed with '<%' and '%>' like: <%fileName%>. The variables you can use are the fields returned by the 'SQL' statement and a few default ones.
     
     Here are the default ones:
     • AGEINMINUTES - from the alert definition.
     • THRESHOLD - from the alert definition.
     • KEYNAME - from the alert definition.
     • QUERYNAME - from the alert definition.
     • QUERYSQL - from the alert definition.
     • COUNT - the first column from the SQL select.