Backup and Restore Procedures

This section covers the backup and restore procedure for recovering eyeInspect data in case of permanent or temporary system failure. When using this procedure, all of the data and most of the settings of eyeInspect can be safeguarded.

Note: If eyeInspect is deployed as a Virtual Appliance, Forescout recommends using solutions offered by the hypervisor (e.g. snapshots) for backup and restore. Snapshots can only be used for disaster recovery if the snapshot files are kept in a physically separate hard drive array. Otherwise, a hard drive array failure can result in a loss of all data. It is recommended to periodically store the snapshot backups in a separate facility from the data center hosting the Virtual Appliance.
The following data and settings are subject to this backup procedure:

  • Alert, Visual Analytics and Flow information (e.g. Alerts, Asset Map, Aggregates, Analytics)
  • Passive Sensor configuration (including modules and profiles, their configuration, etc.)
  • Users and roles
  • User specific views (Map Tabs, Analytics Tabs, etc.)
  • Integration settings (LDAP, user activity log forwarding, health status forwarding, DNP3 notification service and notification log forwarding)
  • Captured traffic per Passive Sensor
  • Passive Sensor license information
  • Enterprise Command Center Settings
  • Certificates

The following settings are not part of the backup procedure and would require additional action if these are to be added to a backup:

  • Syslog and e-mail forwarding settings
  • Customization rules and Alert storing exceptions
  • Command Center and Passive Sensor configurations set on OS level (e.g. config files, IP settings, routing)

If the Enterprise Command Center is not deployed, there is no need to back it up.

Go to the following pages to learn more: