Sensor settings

Use the sensor Settings page to update the sensor location, make annotations and enable or disable Packet Capture. You can also access the sensor settings from the Actions menu on the Sensors page.

Requirements:

• You must have Admin privileges to edit the sensor settings.

To edit the sensor settings:

1. Click the gear icon at the top-right of page select Sensors. The Sensor page opens.

   

2. Click the Sensor ID. The sensor Status page opens.
3. Click the Settings tab. The General page displays the sensor Location, Labels and PCAP status.
4. Click Edit General Settings to edit the sensor Location and Labels.

   Location	Update the sensor location.
   Labels	Enter keywords about the sensors. To add annotation, type the phrase or keyword and press Tab or Enter. Annotations with an orange background are internal an cannot be edited. Annotations with a blue background can be added or deleted.

5. Click Edit Features Settings to enable/disable Packet Capture.

   PCAP Enabled

   Enable packet capture. For more information, see Packet capture.

To edit the settings from the Sensors page:

1. On the Sensors page, click the actions menu at the right side of the page and click Edit.

   

2. Update the Sensor details and click Update.

   Location	Update the sensor location.
   Annotations	Enter keywords about the sensors. To add annotation, type the phrase or keyword and press Tab or Enter. Annotations with an orange background are internal an cannot be edited. Annotations with a blue background can be added or deleted.
   PCAP Enabled	Enable packet capture. For more information, see Packet capture.
   Packet Inspection Engine	Suricata: A Suricata event is created when Suricata (an intrusion detection tool) alerts or metadata are integrated into Zeek logs, highlighting threat detection signatures and behaviors. See, Suricata fields. Fortinet DPI: A DPI (Deep Packet Inspection) event is created by the Fortinet IPS (Intrusion Prevention System) engine running on the sensor which logs informative and pattern matching based events. The IPS engine logs AppID (Applications seen by the engine for software and protocols), IDS (signatures for vulnerabilities), OT Protocols/Threats (Operational Technology based protocol parsing and signatures), Botnet (Botnet based traffic patterns), and Info (informational events about protocols). See,DPI fields.

   Packet Inspection Engine Guidelines

   VM Sensors	To run Suricata and Fortinet DPI engines concurrently, the following minimum recommended system resources are required: CPU: 24 cores RAM: 48 GB
   Physical Sensors	Enabling DPI on physical sensors depends on available system resources. Customers should contact the support team for confirmation and guidance.