HP Enterprise printers - HP Connection Inspector (white paper)

ManualsBrandsHP ManualsDesktopsHP LaserJet Enterprise M506x

Public 
 
Technical Whitepaper 
HP Connection Inspector  
 
 
Table of contents 
Introduction  2 
Theory of Operation  2 
HP Connection Inspector settings  2 
Feature Enable / Disable  2 
Threshold and Duration Settings  2 
Self-Healing (Remediation) Settings  3 
White List Settings  4 
Restore Default Settings  4 
Protected Mode  4 
Entering Protected Mode  4 
DNS Behavior in Protected Mode  4 
Self-Healing Mode  5 
Error and Status Messages  5 
Event log Messages  5 
Control Panel Messages  5 
Jetdirect configuration page status  6 
Syslog Messages  6 
 
 
 

Summary of content (8 pages)

PAGE 1
Technical Whitepaper HP Connection Inspector Table of contents Introduction 2 Theory of Operation 2 HP Connection Inspector settings Feature Enable / Disable Threshold and Duration Settings Self-Healing (Remediation) Settings White List Settings Restore Default Settings 2 2 2 3 4 4 Protected Mode Entering Protected Mode DNS Behavior in Protected Mode 4 4 4 Self-Healing Mode 5 Error and Status Messages Event log Messages Control Panel Messages Jetdirect configuration page status Syslog Messages 5
PAGE 2
Introduction HP Connection Inspector is a new intelligent embedded security feature created by HP Labs. The technology inspects outbound network connections typically abused by malware, determines what is normal and stop suspicious activity. If the printer is compromised, it will automatically trigger a system restart to initiate HP Sure Start self-healing procedures.
PAGE 3
Monitoring Window: Default: 80 mins (30 mins – 14400 mins) The length of the window in minutes in which DNS resolution activity is counted. • A longer window will detect slower executing connection request activity but will increase potential false positives. Protected Mode Duration: Default: 60 mins (40 mins – 120 mins) The minimum time in minutes the DNS Protected Mode is active once triggered. • A higher value will mitigate stealthier malware behavior.
PAGE 4
White List Settings The White List option allows adding DNS addresses that will never be blocked and are not counted towards detection statistics. If HP Connection Inspector generates false positives the DNS names or domains that cause the false positives can be added to the white list.
PAGE 5
Self-Healing Mode The device initiates a system restart when one of the following conditions is met: • The number of DNS Protected Mode events exceeds the “Number of DNS Protected Mode Events” setting • The total DNS Protected Mode duration exceeds the “Cumulative DNS Protected Mode Duration” setting • When a system restart remediation event is initiated, the device will automatically reboot unless the Auto-recover feature is disabled, or a possible network anomaly occurs twice within 30 minutes, the devi
PAGE 6
Jetdirect configuration page status The Jetdirect Configuration page shows the Protected Mode status for HP Connection Inspector • Yes – Device in protected mode • No – Device not in protected mode • N/A – HP Connection Inspector disabled Syslog Messages Syslog messages are sent from the device for the following settings changes and events.
PAGE 7
Message: : HP Connection Inspector Protected Mode settings modified; time="" item=monitoring_window value= old_value= user="" source_IP="" outcome=success interface= Interface(s): EWS Syslog severity: Informational Explanation: The monitoring window setting for the HP Connection Inspector feature was modified.
PAGE 8
Message: : HP Connection Inspector settings modified; time="" action=factory_defaults_restored user="" source_IP=" Interface(s): EWS Syslog severity: Informational Explanation: HP Connection Inspector feature settings were restored to factory defaults.