The RedSeal integration tells you which forwarders and endpoints on your enterprise network are either undefended by RedSeal or unknown to Spectre. By comparing Spectre's comprehensive index of all your network devices against that subset of network devices managed by RedSeal, you can generate a list of network hosts that are not managed by RedSeal. Spectre helps identify the gaps in coverage, so your team can close them.

How Does It Work?

  1. Asset Manager Spectre queries RedSeal and retrieves its inventory of devices under management.
  2. Asset Manager Spectre correlates this inventory against its own authoritative index of IP address space.
  3. Asset Manager Spectre highlights the commonalities and differences into views:
    1. Spectre-only IPs: IP addresses Asset Manager Spectre knows about, but are unmanaged by RedSeal
    2. RedSeal-only IPs: IP addresses RedSeal knows about, but are unknown to Asset Manager (e.g., if Asset Manager does not have access to a network or an off-network device, but RedSeal is still aware of the client agent)
    3. RedSeal- & Spectre-Managed IPs: IP addresses both Asset Manager and RedSeal know about.

This information is available in Asset Manager Spectre via the RedSeal Management dashboard.

Configuring the RedSeal Feed via GUI

Configure the RedSeal feed as follows:

  1. On Spectre's main menu, browse to Settings > Integrations > Other Solutions > RedSeal.
  2. Enable the threat feed by moving Active slider to the right.
    The label changes from No to Yes.
  3. Input a Polling Interval to indicate the time that should elapse between fetching the latest feed data. Input 24 to poll daily, input 12 to poll twice a day, and so on.
  4. Input your customer key.
  5. Input the IP address of your RedSeal server.
  6. Click Submit
    Feed is configured.

Configuring the RedSeal Feed via CLI

To enable the RedSeal feed:

  1. Log in the CLI
  2. Enter the command system feed set redseal enabled true
    The feed is enabled.

To disable the RedSeal feed:

  1. Log in the CLI.
  2. Enter the command system feed set redseal enabled false
    The feed is disabled.

Other RedSeal CLI commands:

  • system feed set redseal pollInterval - Time between checks - system feed set redseal pollInterval 24
  • system feed set redseal server - Set feed server name or IP address - system feed set redseal server
  • system feed set redseal username - Set server username - system feed set redseal username uiadmin
  • system feed set redseal password - Set RedSeal server password - system feed set redseal password 978!78a

See PREVIEW Deploying theRedSeal Plug-in for an advance look at the RedSeal plug-in that is currently in development.