Submit a ticketCall us

whitepaperYour VM Perplexities Called, and They Need You to Read This.

Virtualization can give you enormous flexibility with future workloads and can be a key enabler for other areas, like cloud computing and disaster recovery. So, how can you get a handle on the performance challenges in your virtual environment and manage deployments without erasing the potential upside? Learn the four key areas you need to be focusing on to help deliver a healthy and well-performing data center.

Get your free white paper.

Home > Success Center > Log & Event Manager (LEM) > Log & Event Manager (LEM) Documentation > LEM Administrator Guide > Configure the Disable Networking active response in LEM

Configure the Disable Networking active response in LEM

Updated: September 15, 2017

Use the Disable Networking Active Response to disable networking on a LEM Agent at the Windows Device Manager level. Use this active response for isolating network infections and attacks. You can automate the active response in a LEM rule or manually execute the response from the Respond menu in the LEM console.

Use caution with this active response, because it responds to the LEM Agent at the Device Manager level. To avoid disabling networking unintentionally, consider placing new rules with this action in Test mode until you are sure your correlations are configured appropriately.

Configure the Windows Active Response connector on each LEM Agent where you need a Disable Networking active response.

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

  2. Click Manage > Nodes.

  3. Locate the LEM Agent that requires a new connector.

  4. Click button-gear.png next to the Agent and select Connectors.

  5. Enter Windows Active Response in the Refine Results search box.

  6. Click button-gear.png next to the connector and select New.

  7. Enter a custom alias name for the new connector, or accept the default.

  8. Click Save.

  9. Click button-gear.png next to the new connector and select Start.

  10. Click Close to exit the Connector Configuration window.

Re-enable networking on a computer affected by the active response

  1. Log in to the computer locally with administrative privileges.

  2. Open Device Manager in Control Panel > Administrative Tools > Computer Management.

  3. Expand the Network adapters group.

  4. Select the network adapter and click Action > Enable.

Last modified

Tags

Classifications

Public