What you should know about advanced configuration

Advanced configuration

Advanced factory/agent configuration lets you create complex activation sequences using a simple graphic interface.

The purpose of the sequence is to start/stop evidence collection, and/or run an action when an event occurs.

Advanced configuration always includes two basic sequences:

Following is an image that illustrates the two basic sequences recommended for remote data acquisition:

 

NOTE: these two basic sequences are set by default and recommended for minimum agent operations.

Advanced configuration components

Advanced configuration components are:

NOTE: some events, action and module options are only available in advanced configuration.

Reading sequences

Complex sequences can be read as follows:

Possible event, action, sub-action and module combinations are infinite. Following is a detailed explanation of correct design rules.

Events

Events are monitored by the agent and can start, repeat or end an action.

NOTE: a module cannot be directly started by an event.

For example, a Window event (window opened on the device) can trigger an action. The action will then start/stop a module.

Various types of events are available. For the full list see "Event list".

The relation between an event and one or more actions is represented by a connector:

Relation between events and actions Description Connector

Start

Start an action when the event occurs.

Repeat

Repeat an action. The interval and number of repetitions can be specified.

End

Start an action when the event is over.

NOTE: an event can manage up to three distinct actions simultaneously. The Start action is started when an event occurs on the device (i.e.: Standby event triggers Start when the device enters standby mode). The Repeat action is triggered at the set interval for the entire duration of the event. The Stop action is started when the event is over (i.e.: the StandBy event triggers End when the device exits standby mode).

Actions

Actions are triggered when an event occurs. They can:

For example, an action (empty) can disable the Process event (start a system process) that triggered it and enable the Position module (log the GPS position). If necessary, the action can also run an SMS sub-action (send a message to a specified phone number).

Various sub-actions are available and can be combined without restrictions (i.e.: run a command + create an Alert message). For the full list see "Sub-action list"

Relations between actions and modules

An action can influence a module in different ways. The relation between an action and one or more modules is represented by a connector:

Relation between
actions and modules
Description Connector

Start modules

Start a module.

Stop modules

Stop a module.

An action can start/stop several modules simultaneously.

Relations between actions and events

The relation between an action and one or more events is represented by a connector:

Relation between
action and events
Description Connector

Enable events

Enable an event.

Disable events

Disable an event.

NOTE: an action can enable/disable several events simultaneously.

Modules

Each module enables the collection of a specific evidence from the target device. They can be started/stopped by an action and produce evidence.

For example, a Position module (log the GPS position) can be started by an action triggered by a Call event (a call was made/received).

Various modules are available that can be started/stopped (i.e.: start position module + stop screenshot module). For the complete list see "Module list".