Managed Service Provider guide for a single server
16.1 About the SetData script
The SetData script,
MSPSetData.vbs
, may be run from Windows or called from the command line or a batch file. MSPSetData:
■
■ reads parameters from Sophos Endpoint Security and Control, writes the SESC parameters to the endpoint Windows registry,
■
■ must be run with LOCAL_SYSTEM administrator privileges, must be run in a 32-bit environment. For 64-bit versions of Windows, the 32-bit version of the command prompt is available at
%WINDIR%\SysWOW64\cmd.exe
.
To run the SetData script in command line mode, use the following format:
MSPSetData <base_key> [logFileName]
Where
<base_key>
is the base key within HKEY_LOCAL_MACHINE to write the endpoint parameters and
[logFileName]
is an optional path to a log file.
Note: If you call SetData with the logFileName parameter, it appends log data to any existing log file. If you call SetData frequently, this can result in a very large log file.
Example:
MSPSetData "SOFTWARE\Sophos\ESCStatus" "c:\MSPSetDataLog.txt"
This will write all parameters within
HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\ESCStatus and log to
C:\MSPSetDataLog.txt
.
16.2 About the endpoint parameters
The SetData script reads parameters from Endpoint Security and Control and Sophos Client
Firewall, and writes them to the endpoint Windows registry as detailed below, under a configurable hive path root within
HKEY_LOCAL_MACHINE
.
If Endpoint Security and Control or Sophos Client Firewall are not present or not running, their
REG_DWORD parameters are set to -1 and REG_SZ parameters to null.
If Endpoint Security and Control or Sophos Client Firewall are updating, all their REG_DWORD parameters except UpdateInProgress are set to -1 and all their REG_SZ parameters to null.
Parameters list
Registry hive path Parameter/Key
\SAVService\Status\Infected ControlledAppDetected
Description
0: No controlled application detected
1: Controlled application detected (& quarantined)
Type REG_
DWORD
29
Sophos Endpoint Security and Control
Registry hive path Parameter/Key
MalwareDetected
Description Type REG_
0: No malware detected
1: Malware detected & quarantined
PUADetected
0: No PUA detected
1: PUA detected
SuspiciousBehaviorDetected
0: No suspicious behavior detected
1: Endpoint exhibiting suspicious behavior
SuspiciousFileDetected
0: No suspicious files detected
1: Suspicious file detected
\SAVService\Status\LastScan SystemScan
NormalScan
EnterpriseScan
\SAVService\Status\Policy AppControlComplies
SAVComplies
DataControlComplies
DevControlComplies
\SAVService\Application Managed
Time/date of last scan(s) (epoch value) e.g. 1268337010
0: Non-compliant with SEC policy
1: Compliant with SEC policy
\SAVService\Version Data
Major
Minor
0: Independent
1: Managed by SEC
SAV Virus data version e.g.
4.50G
SAV major version # e.g. 9
SAV minor version # e.g. 5
SZ
DWORD
30
Registry hive path Parameter/Key
Extra
\SAVService\Status\Policy OnAccessEnabled
\SAVService\Update UpdateInProgress
\Sophos Client
Firewall\Config
IDECount
LastUpdated
ActiveLocation
DetectedLocation
Disabled
Mode
\Sophos Client
Firewall\Update
\Sophos Client
Firewall\Version
UpdateInProgress
FirewallVersion
Managed Service Provider guide for a single server
Description Type REG_
SAV version supplementary information e.g. beta
SZ
0: On-access scanning disabled
DWORD
1: On-access scanning enabled
0: Not updating
1: Updating
Number of Sophos virus identity files present
Time/date of last update dd.mm.yyyy hh:mm:ss e.g.
02.03.2010 18:56:30
SZ
DWORD
1: Primary location
2: Secondary location
0: Operational
1: Passing all traffic
0: Interactive
1: Block unknown
2: Pass unknown
0: Not updating
1: Updating
Firewall version # e.g. 2.0
SZ
31
