Security officers routinely describe their job as searching for a needle in a haystack. Aristotle^TM alleviates that problem by providing reports of incidents that matter, while backing up the reports with tools to search, locate and analyze the incidents. 

Aristotle^TM not only minimizes the work of management and security officers, it also is designed to be a simple device to run and maintain by the technical staff. No special commands, operating system knowledge or data base expertise is required. It is an application designed to run automatically.

Operating System Requirements
Installation and Network Traffic Load
Server Requirements
How Reports are Distributed
Adding User and Computer Names
Detecting System Problems and Upgrades

Operating System Requirements back to top
Aristotle^TM runs in modern (Mac OS 10.x, Vista, 2003, 2000, XP, XP-SP2) and legacy (95, 98, NT) Windows^® environments. It works with Novell^® networks and executes on thin clients such as Terminal Services^® or Citrix^®.

Installation and Network Traffic Load back to top
Traditionally, agent based security, patch management or virus products were viewed as difficult to deploy. With Aristotle^TM, deployment is very straightforward. A network engineer may use Sergeant Laboratories visual deployment tool to track and install the agent, or he may use Active Directory Scripts, Zen Works Objects^®, Ghosting (our command line ‘whitehat’ tool), or industry available software deployment tools.

Aristotle^TM generates minimum network traffic and is designed to have a small foot print on target machines. Unlike event log aggregators, Aristotle^TM agents employ tokenized real-time report actions to the DataVault^TM server. The use of this technique insures that network traffic is light and foot prints are minimal.

Server Requirements back to top
Aristotle^TM runs on a server we call the DataVault^TM. The DataVault^TM is a 1U rack mount needing a static IP, which the user can configure. The DataVault^TM needs to be housed in a physically secure location, usually near the main switch and always behind the enterprise firewall. All accesses to the DataVault^TM are recorded. Technical staff access the DataVault^TM through an administration password, while security officers and company management may access the reports though another (multiple) password. This insures that technical staff cannot view sensitive information and also provides a chain of evidence regarding who has accessed the DataVault^TM.

How Reports are Distributed back to top
Reports are distributed via email or by departmental login. Computers, Users, or a combination of Computers and Users may be grouped into Department groupings. A manager may get a departmental report via email, or they may login to the DataVault^TM and view only their departmental data. To generate these emails, Aristotle needs access to a valid email account on the customer’s email system.

Adding User and Computer Names back to top
User names, computer names and application names do not have to be preloaded into the system for proper reporting. This data is collected by the system and notifies the security officer when a new name appears. The system administrator can then organize the machines/users into departments via our “user grouping tool,” which is on the administrator side of the DataVault^TM.

Detecting System Problems and Upgrades back to top
The DataVault^TM sends a nightly status email to Sergeant Laboratories. This email is in understandable text and may be reviewed by the security officer before being released to Sergeant Laboratories. The email is used to notify any abnormal conditions on the server to the Sergeant Laboratories Support Team. Information regarding the use or data collected by Aristotle^TM is not released to Sergeant Laboratories. Sergeant Laboratories cannot access the data on Aristotle^TM. 

Updates and Upgrades are performed in one of two ways. 

1. A customer can select to have the system automatically upgrade itself, in which case, no further action is required.

2. A customer can select to receive an email notification of available upgrades. They can then log on to the Aristotle^TM system and manually select an upgrade via the Internet. This functionality is in place for security-conscious customers who wish to control upgrades.

-Bill Bauman, PCS - Outsourced Services Division