SOCaaP

• Introduction
  • Logging-in To The SOCaaP Console
• Dashboard Overview
  • Summary
  • Alerts,Incidents And Website Vulnerabilities
  • Customer Health
• SOCaaP Alerts/Escalations
  • Log-in To The Admin Console
  • The Home Screen
  • Service Summary
  • Incidents Overview
    • Incidents
    • Threat Summary
  • Log Collection Summary
  • Threat Communication Graph
  • Tickets
  • Reports
  • Notification Settings
  • Integrate Your Office 365 Account With SOCaaP
• SOCaaP SIEM
  • Log-in To The Admin Console
  • The Main Interface
  • The Dashboard
  • Customer Asset Management
    • Add Customers
    • Add Assets For Monitoring
      • Hard Assets
      • Soft Assets
    • Configure Nxlog And Rsyslog To Send Logs To SOCaaP Server
    • Edit Customers
  • Query Management
    • Configure Event Queries
    • Long Term Analysis
    • Configure Custom Dashboards
    • Event Field Selection Settings
  • Manage Rules
    • Manage Correlation Rules
    • Manage Tagged Rules
    • Manage Aggregation Rules
  • Incidents
    • Manage Incidents
    • Incident Category Management
    • Category Action Management
  • Lists
    • Manage Live Lists
    • Manage Live List Content
    • Manage Range List Content
    • Manage IP Range List Content
    • Manage Multiple Column List Content
  • Manage Reports
  • Administration
    • Event Collection
    • Phantom Settings
    • Manage Users
  • Appendix 1 – Field Groups And Event Items Description
  • Appendix 2 –SOCaaP Supported Logs
• SOCaaP Web Protection
  • Add Websites
  • The Main Interface
  • The Dashboard
  • Website Data And Settings
    • Website Overview
    • Security Scans
      • Website Scans
      • Website Files Security Scans
        • Malware Scan Settings
          • Automatic Configuration
          • Manual Configuration
        • Run A Scan And View Results
        • Notifications, Malware Removal And Scheduled Scans
      • Vulnerability Scans
        • CMS Vulnerability Scans
        • OWASP Top 10 Vulnerability Scans
    • Content Delivery Network
      • Activate CDN For A Website
      • CDN Settings
      • View CDN Metrics
    • Firewall
      • WAF Statistics
      • WAF Events
      • Configure WAF Policies
      • Manage Custom Firewall Rules
    • SSL Configuration
    • DNS Configuration
    • Add Trust Seal To Your Websites
    • Back Up Your Website
      • Backup Settings
      • On-Demand Backup
      • View Backup Records And File Statistics
      • Restore And Download Website Files
      • Delete Backups
  • Manage Your Profile
• Sensor Installation
  • Requirements
  • (Option 1) Create Installation Media
  • (Option 2) Deploy Virtual Machine Environment
    • Create A New Virtual Machine
    • Configure Memory Size
    • Configure Hard Disk
    • Configure Hard Disk File Type
    • Configure Storage On Physical Hard Disk
    • Configure Size Of Virtual Hard Disk
    • Configure Network Settings
    • Select VM Startup Disk
  • Sensor Installation Steps
  • Sensor Configuration Steps
    • Login To The Web Portal
    • User Settings
    • Configure Network
    • Configure Timezone
    • Key Activation
    • (Optional) Valkyrie Key Verdict
    • (Optional) Forward Log
• Frequently Asked Questions
• About Xcitium Security Solutions

DNS Configuration

 

• Select a website from the drop-down at top-left then choose 'DNS'

• You need to change your site's authoritative DNS server to Xcitium DNS to enable SOCaaP Web Protection , the content delivery network, and the Web Application Firewall (WAF).

• The DNS page shows the authoritative name servers (NS) for your site. You can use these to configure DNS settings.

• After switching to Xcitium DNS, you should use this page for DNS management instead of your web host's DNS management page. For example, you can add new 'CNAME' and 'A' records, change MX records, and more. 

The following sections explain how to:

• Configure DNS settings for your site 

• Manage DNS Records for your site 

Configure DNS settings for your site

• Open the SOCaaP Web Protection dashboard

• Select the target website from the menu at top-left

• Click the 'DNS' tab  

SOCaaP Web Protection first queries your DNS servers to collect your existing records:

• Click 'Next' to allow SOCaaP Web Protection to fetch your DNS records

 The DNS configuration page for the site will then load, complete with the site's name server (NS) details:

• Go to your site's DNS management page and enter the new name servers.

• See https://support.google.com/domains/answer/3290309?hl=en if you need more help on name server changes.

You can view whether the change was successful in the SOCaaP Web Protection interface:

• Select the target website from the menu at top-left

• Click the 'DNS' tab
  

• Look in the 'Status' column:

 

• It may take up to 24 hours to process the DNS changes

• FYI - there is no site downtime when you switch name servers. It is a seamless transition.

Note: You have to use the SOCaaP Web Protection interface to manage your DNS records once you have pointed your name servers to Comodo DNS. For example, changes to your MX records must be done in SOCaaP Web Protection and can no longer be done in your web host's DNS management page. See 'Manage DNS Records' below for more information.

Manage DNS Records for your site

Note - you can only manage DNS records in SOCaaP Web Protection if your nameservers are pointed to Xcitium.

• This applies if you entered the NS values from the 'DNS' page as explained above, or chosen Option A - Change your domain's authoritative DNS servers to Xcitium' in 'CDN' > 'Settings' > 'Activation'.

• If you selected 'Option B - Enter DNS records explicitly' when activating CDN, then you must use your web-host's tools to manage your DNS records. Any updates to DNS records that you make in this page will have no effect.

 

Manage DNS records

• Open the SOCaaP Web Protection dashboard

• Select the target website from the menu at top-left

• Click the 'DNS' tab

• Scroll down to 'DNS Records' pane 

The DNS records associated with the website are shown:

 

DNS Records - Table of Parameters
Column Header	Description
Type	The kind of the DNS record.
Name	The label of the record.
Value	The content of the record.
TTL (Time To Live)	How long the record value can be served from the name server / local cache without refreshing the value from the site.
Status	Whether the record is protected or not. - The record is protected. Click the icon to remove the site from SOCaaP Web Protection - The record is not protected. Click the icon to add the record to SOCaaP Web Protection for protection See Configure SOCaaP Web Protection for a site for guidance on this Note - protection is available for CNAME and A records if not already enrolled to SOCaaP Web Protection.
Controls	Remove a record from the website.

 

Add a DNS record

• Open the SOCaaP Web Protection dashboard

• Select the target website from the menu at top-left

• Click the 'DNS' tab
  

• Scroll down to the 'DNS Records' pane

• Configure the following items:

• Type - Select the kind of the DNS record from the drop-down

• Name - Enter an appropriate label for the record

• Value - Enter an appropriate content for the record. For example if CNAME is selected, then enter the alias domain name

• TTL - Time-To-Live value for the record. Select the TTL period from the drop-down.

• Click 'Add Record' to save your changes

You can enable protection for a site after adding the DNS record. See below more on this.

• See https://support.google.com/domains/answer/3290309?hl=en if you need more help to change nameservers

Enable SOCaaP Web Protection on a site

• Click the  icon beside the DNS record

• If the website is licensed then the protection starts after you click the icon.

• If not licensed then you need to register the record to SOCaaP Web Protection.

• Click 'Add Site' to start the 'Add Websites' wizard.

The website name is pre-populated.

• Click 'Continue Setup' to move to the next step.

• The drop-down menu lists any unused licenses you have on your account. You can apply one of these licenses if available.

• Click 'Buy a license' if you don't have any existing licenses. Click here if you need help with the order form.

• Click 'Finish' to apply the license. The site will be registered.

• SOCaaP Web Protection will validate your request then show the following confirmation message:

 

• Click 'Get Started' to activate SOCaaP Web Protection.
  

• If you do not have any licenses available then you will be asked to purchase a license:

• Click 'Buy a License'

• You will be taken to the license purchase page:

• Select the license period and type. 

• Click 'Continue'

• Complete the payment details section

• Read the 'End User License/Subscriber Agreement' and tick the checkbox to agree

• Enter your billing address

• Complete the captcha verification and click 'Process Payment'

• The new license is added to your account and can be applied to the site inSOCaaP Web Protection. 

• Restart the process to add protection to the DNS record.
  

Remove protection from a site

• Click the shield icon beside the record:

You will see the following confirmation message:

Remove a DNS record

• You can remove a record that is not SOCaaP Web protected

• Click the trash can icon beside a record