Help Menu

PA File Sight Documentation Table of Contents

Welcome & Install

Product Overview: Getting Started with PA File Sight

Concepts & Terms: PA File Sight is composed of a console that you interact with, and a system service that is started when the computer boots up and is always running in the background.

Main Installation: Installing the Central Monitoring System (Typical Install)

Starting the Console: How to start the Console and connect to a monitoring service

Getting Started

Console: If a problem persists for longer and longer, different sets of actions can be run to progressively deal with the issue (for example try auto resolving, and if that doesn't work contact the tech staff).

Startup Wizard: The Startup Wizard walks you through a few standard dialogs to help configure your system for basic monitoring.

Global Settings: Group servers together in visual groups to help keep track of them. Group-based status reports are also available.

Database Settings: Easily point PA File Sight at the embedded SQLite database or use an external Microsoft SQL Server.

Report Settings: Configure how often the server status reports are generated via the Report Settings dialog.

HTTP Settings: Control the HTTP port that PA File Sight uses, and optionally enable HTTPS (SSL)

Easy Deploy: Paste a list of servers or IP address into a list and let PA File Sight deploy Satellite Monitoring Services to those servers for monitoring.

Adding Monitors: Paste a list of servers or IP address into a list and let PA File Sight inspect and self-configure for each server/device. Or easily copy the configuration from one configured server to one or more other servers.

Adding Actions: Perform changes of settings in actions, monitors, reports and scheduling for several servers at one time, or copy configuration settings to other servers.

Bulk Config: Perform changes of settings in actions, monitors, reports and scheduling for several servers at one time, or copy configuration settings to other servers.

Adv. Configuration

Acknowledging Alerts: Acknowledge alerts to indicate they have been seen, are owned, and being worked on.

Adv. Monitor Options: Many advanced options that exist on every monitor can help PA File Sight work the way you want it to.

Alert Reminders: Configure reminders to get sent for previous alerts that might not have been handled yet

Automatic Fail Over: Setup a second instance of PA File Sight to monitor the primary monitoring service, and take over if it fails

Blocked Users List: Blocks access to all drives monitored by PA File Sight to any account added to the Blocked List.

Command Line: Different options that can be used to help automate PA File Sight.

Config Email Ack: Acknowledge alerts by replying to an email.

Config Security: Password protect the Console, and alert on changes that could affect monitoring.

Credentials: Windows: Edit Windows credentials to control the credentials used when monitoring a server via Windows RPC.

Custom Icons: Servers/devices and groups can have custom icons manually or automatically assigned based on what the Inventory Collector monitor finds.

Custom Properties: Set cascading iCustomer Properties on Groups, Computers/Devices and Monitors which can be used in monitor, scripts and message templates.

Customize Menus: Customize the Operations right-click pop-up menu in the Console to add your own commands, or change or remove existing commands

Endpoints: Detect file copying using the File Sight Endpoint agent.

Endpoint Alerts: Configure alerts for cases where the Endpoint goes offline

Endpoint Operations: Apply configuration options to many Endpoints at once

Endpoint USB Blocking: Configure the File Sight Endpoint to block unauthorized external/USB drives and CD/DVDs.

Error Auditing: Keep track of which errors have been reviewed and acknowledged. Also a great way for administrators to have an overview of any errors within their area of responsibility.

Event Deduplication: Detects errors which are very similar or identical to existing outstanding alerts and suppresses them.

Expansion Variables: Variables with details about alerts can be used to change the output of custom messages.

External API: Send basic configuration requests to the product via an HTTPS URL.

File Locations: Locations of files used in the product

Import & Export: Paste a list of servers or IP address into a list and let PA File Sight inspect and self-configure for each server/device. Or easily copy the configuration from one configured server to one or more other servers.

Locking Configuration: Lock monitors or actions to prevent their configuration from being changed.

Maintenance Mode: While a computer is in maintenance mode, PA File Sight won't run monitors. It will turn itself back on automatically after the maintenance window expires if you manually entered maintenance mode, or it can automatically enter and leave maintenance mode on a schedule.

Monitor Templates: Create monitors at a group level that are automatically deployed to all servers/devices within the group.

Secure Settings: Controls various security related functions in the application

Adv. Configuration

Concepts: Trusted Applications concepts

Trusted Lists: Trusted Applications - Trusted Lists

Statements: Trusted Applications - Statements

Rules: Trusted Applications - Rules

Getting Started: Trusted Applications - Getting Started

Day to Day Ops: Trusted Applications - Day to Day Operations

Monitors

Action Scheduler: Automate common IT tasks with the Action Scheduler. It will run your defined Actions when you specify.

All-Systems-GO: Reports to the All-Systems-GO service which can notify you if the monitoring installation is affected in any way that would prevent its from alerting.

Drive Sight: Protects servers and workstations by preventing CD/DVDs and/or external drives, including USB drives, from being attached. Any specified devices that are attached are immediately detached by the operating system so they cannot be accessed.

Dynamic Server List: Dynamic Server Lists are groups of serves that meet your criteria. Once the list is known, you can define Dynamic Groups based on the list, and use that group everywhere else groups are used.

File Sight: The File Sight monitor watches real time file access by users and programs. You can configure which files it watches, and how you are notified when a particular operation (file read, write, delete, etc) occurs.

The Ultra version also lets you:
* Record the file access operations to a database for reporting (by user, by file, by operation, etc)
* Alert on user usage patterns (i.e. user reads X amount of data in Y time, useful for ransomware protection and detecting file copying)

NOTE: This monitor can ONLY monitor drives on the local computer. Watching files on remote computers requires that the PA File Sight service (or a Satellite) be installed on the remote computers.

Inventory Collector: Collects inventory information (hardware information, pending Windows Update, anti-virus status, etc) from a variety of sources including WMI, SNMP and an optional System Details application.

Trusted Applications: Checks all file access on a server against a set of rules (application whitelisting) to determine if the application should start and whether file access is allowed.

Actions

Action List: Groups of actions for common notifications, group notifications, etc.

Add to Blocked List: Adds all users reported on by a File Sight monitor to the Global Blocked Users List.

Call URL: This action will call a URL you specify, optionally posting information about the current alert. This makes it easy to connect to a helpdesk/ticketing system.

Desktop Notifier: Delivers alerts to Windows desktops via a pop-up message box or a slider in the lower right corner of the screen.

Dial-Up Connection: Connects or disconnects a Windows Dial-up Connection. Typically this is for servers that are not on the Internet, but need to connect to send alerts.

E-mail Alert: Sends SMTP email messages to mail boxes, cell phones, mobile devices, etc. The E-mail action has Alert Digests which are a powerful/friendly feature that combines multiple alerts that happen within a short time into a single email notification. This can be very helpful when something goes really wrong. You can easily specify when messages should be sent or suppressed.

Execute Script: Similar to the Execute Script monitor, this Action lets you extend the list of available actions via your own script written in VBScript. Many variables from the source monitor are also available for creating rich, situation-specific responses.

Message Box: A simple message box that displays monitor findings. These message boxes are smart: if there are many pending alerts you can easily dismiss them all at once.

Directed-Email: The monitor which detects a problem specifies the email address to use for each alert. This is very useful when sending reminders and alerts to end users such as with the User Quota Monitor and the Directory Quota Monitor.

Network Message: Sends a message box containing the critical monitor details to every place that you are logged in.

Pager Alert via SNPP: Send monitor results to pagers via standard Simple Network Paging Protocol (SNPP). You can easily specify when messages should be sent or suppressed, and the content of the message.

PagerDuty Integration: Send alerts directly to your PagerDuty account and track them using the full power of the PagerDuty platform.

Phone Dialer: Dials a modem/phone and optionally sends DTMF commands or other commands (to send SMS messages for example). This is typically used by a disconnected server to send an alert over a normal phone line (where the CallerID identifies the server)

Play Sound: Audible alert when monitors detect a problem with the server.

Reboot Server: Reboots the server if a monitor has detected a critical system failure.

Run Report: When this action is triggered, it will run the specified Scheduled Report including sending any emails or saving PDF or CSV files that report requires.

SMS Text Message: Send SMS text messages to your mobile device via your service providers SMS Internet gateway (SMPP server). You can control which information gets sent, as well as when messages are allowed.

Server Maintenance: Set or remove the Immediate Maintenance period for a server or servers

SNMP Trap: Sends an SNMP Trap with details from the monitor firing the action

Start Application: Starts a specified application when the monitor triggers actions

Start Service: Sends control messages to the Windows Service Control Manager to start, stop or restart a specified service.

Syslog: Sends monitor alerts to a Syslog server on the network

Write to Event Log: Writes monitor details to the Windows Event Log.

Write to Log File: Log the findings of any triggered monitor to a file. Separate files can be created for each day, week, month, etc.

Reports

Ad Hoc Reports: Generate reports on the fly to quickly see graphical trends

Branding Reports: Easily brand reports with your company logo at the top

Group Settings: Group summary reports can be specified and controlled in a per-group way. In addition, group reports can be automatically emailed to anyone that needs to keep track of the servers.

Password Protection: Password protect web reports in PA File Sight

Satellite Status: Quickly see the current status of an individual Satellite Monitoring Service.

Satellite Summaries: Two reports that let you see the status of all of the Satellites at once.

Scheduled Reports: You can create scheduled reports which will get created when you want them, and optionally email the report to a list of recipients. Scheduled report URLs are stable so you can add them to your Favorites list to quickly and easily see the latest results.

Server Status: Easily see at a glance the state of your server along with system statistics

System Activity Log: Quickly see which monitors are running, how long they are taking, which actions are being fired and more.

Standard Report Tabs: View the tabs and information that is common among most report types.

FS: All Changes: Get a quick report to see everything PA File Sight has recorded in a specified time frame.

FS: Custom Data Set: Create a report that filters on many different File Sight criteria.

FS: File Changes: Quickly see all changes that happened to specific file or set of files.

FS: Type of Change: See all file operations of a specific type. For example, all files that were deleted in the past two days could be quickly shown.

FS: User Activity: Find all users who have done more than a specified number of specific operations. For example, anyone that has deleted more than 50 files in the past week.

FS: User Block List: Quick way to see which users are on the File Sight User Block List, and which are on the white list.

FS: User Changes: Select a specific user and a time frame to see all recorded file activities they have performed.

FS: User R/W Amt: Find all users who have read and/or written a specified amount of data in a given time frame.

Grp: All Errors Report: The All Errors report show all recent errors on all monitors on all servers/devices within a group. This is a good place to quickly get a detailed view of any problems happening on the network.

Grp: All Servers Report: This report shows all of your servers in a group in a single page. Each server is a small box that is color coded according to the status of the monitors on that server.

Grp: Custom Group: Create custom reports at a group level to show custom HTML, charts, and other status values for the contained servers.

Grp: Group Summary: See a one line status indicator per server to see at a glance how the servers in your data center are doing. Per-group status reports are also supported.

Grp: Status Map: See a graphical map that contains status indicators that show you at a glance how servers in different geographic regions are doing.

Sys: Config Audit: This report shows you what your current configuration is with your Groups, Servers, Monitors, and Actions.

Sys: Conn. Sessions: See all sessions (Console, Satellite, mobile apps) currently connected to the Central Service.

Sys: Error Audit: Powerful report to look at current and past alert conditions that have been detected by the system.

Sys: Monitor Scope: Displays a summary of what is being monitored on a per-group basis. This would be appropriate to show stake holders to indicate the level of monitoring work being done.

Sys: Monitor Status: A quick table-based overview of current monitor statuses. You can specify a specific monitor type, only monitors in error, etc.

Sys: Statistics: View system statistics such as HTTPS connections and data transferred, numbers of monitors and connected Satellites, etc.

Sys: System Audit: Find out about activities within the monitoring system, such as alert emails sent, user logins, Satellite disconnects, etc.

Sys: User Permissions: This report will display all users defined in the system, what they have access to, and their permissions.

Remote Sites

Remote Monitoring: Monitoring remote servers and devices with PA File Sight

Install Prerequisites: Pre-requisites for installing a remote Console or Agent

Install Satellites: Installing a monitoring agent at a remote location

Configure Satellites: Configuring a monitoring agent at a remote location

Satellite Operations: Operations on a Satellite Monitoring Service

Remote Support

SNAP Tunnels: Safely send data to remote networks using SNAP Tunnels

Remote Desktop: Securely connect to Remote Desktop even through firewalls with PA File Sight

Remote Users

Install Consoles: Installing a Console GUI

Remote Access Users: Managing remote user access

Filter User Access: Control which users can see which groups and servers

HOWTO

Ack and Silence Alerts: How to acknowledge alerts such that they stop coming for known problems.

Add Licenses: How to add licenses.

Add Monitor Notes: How to add monitor notes.

Alternate Sat Upgrade: Discover how to make Satellite upgrades download the installer file from an alternate location

Deploy Satellites: Information on deploying Satellites remotely.

Embed Child Reports: Steps to embed child Custom Reports within parent Custom Reports

Extract Data: Extract data from the databases for use in your own systems

Group Devices: How to dynamically group servers and devices based on arbitrary device selection

Integration: How to integrate with other enterprise systems and usage scenarios

NIST 800-53: How to fulfill NIST 800-53 requirements to protect and audit data access

NIST 800-171: How to fulfill NIST 800-171 requirements to audit data access

Office365 and OAuth: Authenticating to Office365 with OAuth 2.0

Prepare for Imaging: How to prepare a Satellite installation for disk imaging and duplication

Shrink Databases: How to shrink the embedded database files in the Databases folder

Slack Integration: How to integrate with Slack by sending alerts to Slack channels.

Teams Integration: How to integrate with Microsoft Teams by sending alerts with the Call URL action.

Use Other SSL Cert: Explains how to use your own SSL certificate in place of the default.

	PA File Sight Help Map