Three LCE clients have been added in the Tenable Appliance: the LCE tail client, Tenable Network Monitor, and Tenable Netflow Monitor.
Enabling the clients is completed by entering the IP address or Hostname of the LCE server and the correct port to send the data to. The LCE default listening port of 31300 is entered initially and may be changed as needed. Once enabled, the only configuration option for the local client is to change the IP address or Hostname and port of the LCE listening server.
As shown in the LCE Client example above, once a client is enabled other options are displayed. These options are the same except for the names for each of the available LCE clients. A “Disable LCE Client” button is available to disable the client from sending further data until the client is re-enabled. The client status is displayed along with the version of the client installed. The client may be started, restarted, or stopped using the appropriate button.
The policy file to configure the LCE Client on the appliance contains a white list of directories that may be monitored. The policy may be edited to monitor only a subset of the allowed directories or eliminate specific files or directories from being monitored. However, adding additional files and directories not listed will not be honored by the policy.