1. Create the sync_out.xml file, with the choice of "download actions" to perform.
2. Download data from an Internet-connected PC.
3. Import the downloaded data into the ECAT Server SQL Server database.

1. Trusted Root certificates, and Certificate Revocation Lists (CRLs) for ECAT Server discovered modules.
2. RSA Live feeds for any updates to RSA Security Analytics (SA) Live Feeds been subscribed to (A RSA Live login is required).
3. Kernel Data for any update to the list of ECAT Agent recognizable Windows Operating Systems.
4. File Reputation Service, the hash lookup of unknown discovered ECAT Agent Modules.

Step 1 Create the sync_out.xml file.

1. If only the Trusted Root certificates and CRLs, are required then run the command,
    ConsoleServerSync.exe 1 crl
    
2. If only the RSA Live feeds are required then run the command,
   ConsoleServerSync.exe 1 live;
    
3. If only the Kernel Data is required then run the command,
   ConsoleServerSync.exe 1 kernel
    
4. If only the File Reputation data is required then run the command,
   ConsoleServerSync.exe 1 reputation
    
   Sample Screen Output:
   
   Enter the SQL Security Password?
   *******
   Connecting to database...
   The Reputation Service is currently enabled on the ECAT server. If the server is connected to the Internet, it will automatically check the reputation of every file discovered by ECAT agents in your network and there is no need to use ConsoleServerSync to do so. Do you want to continue? (Yes/No)
   yes
   No modules requiring reputation check found. Skipping reputation.
   Writing file...
   DONE!
   Press any key to continue...
    
   
   
   
   Note the warning message above, if the File Reputation Service is enabled, see the RSA Live configuration of Monitoring and External Components in the ECAT UI.
    
   
   
   
   Note the warning message above, that there will be no reputation check done if there is no module with an unchecked hash value.
   
   
   
   Sample Screen Output when there is a module needing a hash lookup:
   
    
   
   
   ConsoleServerSync.exe 1 reputation
   Enter the SQL Security Password?
   *******
   Connecting to database...
   ConsoleServerSync is about to check the reputation of 4 modules. The time needed for this operation should not be more than 0 minutes. How many modules do you want to include in this batch?
   987
   Getting hashes requiring reputation check...
   Writing file...
   DONE!
   Press any key to continue...
    
   
   
   
   Note in the above that an approximate time to do all the hash lookups is given. There is the requirement to enter the number of hash lookups to do in this run of the ConsoleServerSync.exe program (987 was entered in this example). Where the ECAT Server normally batches only up to 400 hashes for lookup at a time.
   
    
5. To select all actions, run the command,

<?xml version="1.0" encoding="utf-8"?>
<Sync>
    <EcatCertificateSynch />
    <EcatLiveFeedSynch />
    <KernelErrors />
    <Reputation CSID="" URL="" count="0" />
</Sync>

Step 2 Download data from the Internet

1. Trusted Root certificates and CRLs.
    
   The HTTP sites for Trusted Root certificates and CRLs will be shown.
   
   The files trusted_roots.dat and revocation_lists.dat are created in the directory where the ConsoleServerSync.exe program is run.
   
   Note: Some third-party sites may not allow access, or the module may have an incorrect URL, these errors should be ignored.
   
   This action may take up to hours to complete if you have many discovered modules in your ECAT environment from different software vendors.
    
2. RSA Live feeds.
   Enter a valid RSA Live username and password when required.
   
   Under the directory where the ConsoleServerSync.exe program is run a directory feed is created and the subscribed feed zipfiles are downloaded into this directory.
    
3. Kernel Data.
    
   This creates the file kernel_data.csv in the current directory, which as of July 2016 was 1.1MB size containing 977 lines of data, where the first line is a heading line.
    
4.  File Reputation Service Data.
   Enter a valid RSA Live username and password when required.
    

Step 3 Import downloaded files into the ECAT Server SQL Server database

1. Files: trusted_roots.dat and revocation_lists.dat
2. Any zipfile under the feed directory.
3. File: kernel_data.csv
    
   Please note: If you are trying to import the kernel data file from the QueueData folder beware the filename is different (KernelData.csv).
   Rename the filename KernelData.csv to kernel_data.csv before running the "ConsoleServerSync.exe 3".
   This filename discrepancy is resolved in ECAT 4.2.x
    
4. File: reputation.json
   
   Sample Screen Output:
    
   
   Enter the SQL Security Password?
   *******
   Connecting to database...
   Updated 4 hashes out of 4
   DONE!
   Press any key to continue...
   
   

1. Export of source data from the database.
    
   For this phase, this executable must have network access to the database. A file named "sync_out.xml" will be created.
    
2. Collection of trusted roots, download of CRLs, RSA Live feeds and kernel data
    
   For this phase, this executable must have access to the Internet. It is also recommended that the machine is up to date with Windows Updates in order to have the latest trusted certificate roots. The file "sync_out.xml" must be present in the same folder. Files named "revocation_lists.dat", "trusted_roots.dat", "kernel_data.csv", "reputation.json" and folder named "feed" may be created.
    
3. Import of collected data to the database.
    
   For this phase, this executable must have network access to the database. The files "revocation_lists.dat", "trusted_roots.dat", "kernel_data.csv", "reputation.json" and folder named "feed", if generated in Phase 2 must be present in the same folder.
   
   To sync CRLs and trusted root certificates only, run each phase as "ConsoleServerSync.exe [phase]crl".
   To sync RSA Live only, run each phase as "ConsoleServerSync.exe [phase]live".
   To sync kernel data only, run each phase as "ConsoleServerSync.exe [phase] kernel".
   To sync reputation data only, run each phase as "ConsoleServerSync.exe [phase] reputation".
   For example: "ConsoleServerSync.exe 2 reputation".
   
   Enter the number of the phase to execute: