Using the Set up Wizard

The Set Up Wizard is used to perform the initial configuration of KFSensor.
Each step of the wizard is described below.

After the Set Up Wizard is run, KFSensor will be ready to detect attacks on the system.

Set Up Wizard - Port Classes

To make it easy to set up common ports KFSensor has a set of pre-defined listen definitions.
The definitions are grouped into the classes in the wizard enabling you to add different types of ports.

1. Windows Workstation
   These include the basic ports opened in Windows workstations and servers.
2. Windows Server
   These include ports opened in Windows servers.
3. Windows Internet Services
   These are Internet facing servers, such as POP3 and FTP.
4. Windows Applications
   Windows applications with well known security risks.
5. Linux (services not usually in Windows)
   These include services such as SOCKS, mySQL and Telnet.
6. Trojans and worms
   Malware such as SubSeven and Blaster open ports to allow remote control.

It is possible to remove all ports of a class by unselecting the class.

To pick up the maximum about of attacks select all the port classes.

You can also run the Set Up Wizard again later to add additional components.

Set Up Wizard - Domain

• Domain Name
  

  This is the domain name used to identify the server to a visitor.
  It is used in several Sim Servers.

  This could be the real domain name of the machine or a fictitious one. If you pick a fictitious one, try not to use a real domain belonging somebody else.

  If you are using KFSensor inside a corporate environment then create a sub-domain of your corporate domain name.
  e.g. testserver.yourcompany.com

Set Up Wizard - EMail Alerts

KFSensor can send alerts by email.
The settings in the wizard are the minimum needed to enable this feature.

For more details on the options available see the EMail Alerts dialog box.

Set Up Wizard - Systems Service

A systems service is a special type of application that Windows runs in the background and is similar in concept to a UNIX daemon.

The KFSensor Server becomes independent of the logged on user, so the user can log off and another person can log on without affecting the server.

The KFSensor Server can be configured to start automatically when the system starts, before a user logs on.

The user must be logged in as the Administrator in order to install a systems service.

For more information see the Running the KFSensor Server section of the manual.

Next: Basic testing

KF Sensor On-Line Manual Contents