Appendix

This section provides supplemental information.

Supported FMS Configurations

Teamcenter supports various FMS configurations based on the volume of files to be stored, how often files are accessed by clients, and client geographical location (remote). 

For illustration purposes, the supported configurations are listed below: 

1. Single FSC  

   1. With single volume – Typically for simple deployment. Teamcenter provides a single FSC that mounts a single volume. In this case, enter the URL in the "FMS Target URL".

   2. With multiple volumes – A standard small or medium deployment with a large volume of file storage. In this case, each volume will have an entry under this FSC. Here, enter the URL in the "FMS Target URL" field.

   3. A sample of the FMS master file is shown below for illustration purposes:
      <fscgroup id="mygroup">
<loadbalancer id="ReverseProxy" address="http://SAMPLE.local:8080/tc/fms" />
<fsc id="FSC_SAMPLE_Teamcenter_3" address="http://SAMPLE.local:4544" ismaster="true">
<volume id="9c1cfc281ec644eabec6" enterpriseid="-1234567890" root="C:\Program Files\Siemens\volume" priority="0" />
<transientvolume id="v6ca776c74e437d98ef662ecb5751tt" enterpriseid="-1234567890" root="C:\\Temp\\transientVolume_Teamcenter" />
</fsc>

2. Multiple FSCs with Multiple Volumes – Numerous files are accessed simultaneously by the clients from more than one FSC or a single file from any one of the configured FSC. For instance, in the below case, a client is configured to connect with more than one FSC. Therefore, you must specify the details in the Other Target URL field.

   

   Other Target URL Setup

   A sample of the FMS master file is shown below for illustration purposes:

   CODE

   <fscgroup id="mygroup">
   <loadbalancer id="ReverseProxy" address="http://PUN-FMS:8080/tc/fms"/>
   <fsc id="PUN-FMS_usprd01" address="http://PUN-FMS:4544" ismaster="true">
   <volume id="123d0000000f8c9bd0d7" enterpriseid="-1234567890" root="E:\Siemens\usprd01_vols\dba_vol1" priority="0" />
   <volume id="456a000001388c9bd0d7" enterpriseid="-1234567890" root="E:\Siemens\usprd01_vols\lyn_vol1" priority="0" />
   <volume id="7898001339268c9bd0d7" enterpriseid="-1234567890" root="F:\Siemens\usprd01_vols\dba_vol2" priority="0" />
   <volume id="0123001339268c9bd0d7" enterpriseid="-1234567890" root="F:\Siemens\usprd01_vols\lyn_vol2" priority="0" />
   <transientvolume id="7f16bd0578697f1eb1bbb4b5020aadef" enterpriseid="-1234567890" root="D:\\Temp\\transientVolume_usprd01" priority="0" />
   </fsc>
   <fsc id="PUN-FMS_YUN_WEB20P_usprd01" address="http://PUN-FMS-WEB:4544" ismaster="false">
   <transientvolume id="8c425ee7352a4657ac777dc198712cb3" enterpriseid="-1234567890" root="D:\\Temp\\transientVolume_usprd01" priority="0" />
   </fsc>
   <fsc id="PUN-FMS_YUT_usprd01" address="http://PUN-FMS-YUT:4544" ismaster="true">
   <volume id="c07e4bfa95a44a0894b0" enterpriseid="-1234567890" root="D:\Siemens\usprd01_vols\YUT_vol1" priority="0" />
   </fsc>
   <fsc id="PUN-FMS_YRT_usprd01" address="http://PUN-FMS-YRT:4544" ismaster="true">
   <volume id="9c1cfc281ec644eabec6" enterpriseid="-1234567890" root="D:\Siemens\usprd01_vols\YRT_vol1" priority="0" />
   </fsc>
   <clientmap subnet="127.0.0.1" mask="0.0.0.0">
   <assignedfsc fscid="PUN-FMS_YUN_WEB20P_usprd01" priority="0" />
   </clientmap>
   </fscgroup>

Failover Mechanism for HaloENGINE in HaloCAD for PLM

Server failover between two systems supports uninterrupted operation and service reliability in case of a breakdown. The server failover configuration is "active-standby," meaning that the primary server is "active", and the secondary server is "standby." 

HaloCAD for PLM supports connection failover between two HaloENGINEs. Here's a summary of its purpose: 

1. High Availability: If the primary HaloENGINE fails, the secondary HaloENGINE will take over, reducing downtime and maintaining continuous operation.
   Example: Let us assume that your business process requires no downtime.
   As per the business security policy, your administrator has configured Fail-Safe Mode as Strict to block any file upload or download whenever an error occurs. If HaloENGINE encounters an unexpected issue, failure to obtain label information will prevent file download or upload. In this instance, the failover mechanism in HaloENGINE will be the ideal option for dealing with such unforeseen scenarios, with no impact on the end user. Thus, even if the primary HaloENGINE connection fails, HaloCAD recognizes the failure and instantly switches to the secondary HaloENGINE to continue providing services.
   Once the primary HaloENGINE is restored, it will be a standby for the secondary HaloENGINE. If there is any failure in the secondary HaloENGINE, the primary HaloENGINE will again take over the operations.

   

   Failover Mechanism for HaloENGINE in HaloCAD for PLM

2. Redundancy: It provides redundancy, which means there is always another HaloENGINE ready to take over if the primary one fails. This minimizes the possibility of a single point of failure. 

3. Data Integrity and Consistency: In the event of a failure, the failover technique can help guarantee that data is consistent and file upload/download activities are not lost, which is crucial for systems that rely on high data security. 

  Failover Mechanism Requirement 

1. Network Infrastructure: Minimal Secondary HaloENGINE needs to be segmented so that the primary and secondary HaloENGINEs don't share the same network. 

2. Make sure the secondary HaloENGINE has HaloENGINE service installed as well. 

3. Data replication: Both HaloENGINEs must have the same classification profiles and rules.

Open-source Software

Third-party software/code is included or bundled with Secude's products according to its appropriate license. Secude conducts testing to make sure the third-party products are compatible with and perform as intended with Secude applications.

The third-party libraries and dependencies used by HaloCAD for Teamcenter are shown in the table below.

Open-source software

Metadata

The Teamcenter metadata present in the HaloENGINE is listed in the table below.

Teamcenter metadata

Download Log Definition

This section explains the log definition for every log format that HaloENGINE supports.

What is SIEM Integration?

SIEM, which stands for Security Information and Event Management, is a comprehensive approach to managing an organization's security information and events. SIEM integration refers to the process of incorporating SIEM solutions into an organization's existing IT infrastructure to enhance its ability to monitor, detect, and respond to security incidents. To support this approach, HaloENGINE transmits logs in JavaScript Object Notation (JSON), Log Event Extended Format (LEEF), and Common Event Format (CEF).

1. Common Event Format is an open log management standard developed by HP ArcSight. CEF comprises a standard prefix and a variable extension that is formatted as key-value pairs. 

2. Log Event Extended Format is a customized event format for IBM Security QRadar. LEEF comprises a LEEF header, event attributes, and an optional Syslog header. 

3. JavaScript Object Notation is a lightweight text-based open standard designed for human-readable data interchange.

These logs are forwarded to the communications module, which transmits them to your collection server via UDP or TCP. Ideally, a SIEM (Microsoft Azure Sentinel, Splunk, RSA, and others) server would scan the received messages, sort them, and alert your security team.

Forwarding logs

Why CEF Standard?

The CEF format is an open log management standard that simplifies log management. CEF allows third parties to create their device schemas that are compatible with a standard that is used industry-wide for normalizing security events. Technology companies and customers can use the standardized CEF format to facilitate data collection and aggregation, for later analysis by an enterprise management system. CEF is an extensible, text-based format designed to support multiple device types by offering the most relevant information. It defines the syntax for log records consisting of a standard header and a variable extension, formatted as key-value pairs. 

Syslog and CEF Header

The data is normalized and categorized into the ArcSight CEF for easy correlation and analysis. CEF uses Syslog as a transport mechanism. It uses the following format, consisting of a Syslog prefix, a header, and an extension, as shown below. If an event producer is unable to write Syslog messages, it is still possible to write the events to a file.

CEF format

CEF format sample

CEF Header details

CEF sample

Why LEEF Standard?

The Log Event Extended Format (LEEF) is a customized event format for IBM Security QRadar that contains readable and easily processed events for QRadar. 

Syslog and LEEF Header

The LEEF format consists of a Syslog header, a LEEF header, and event attributes. The Syslog header is an optional field. The Syslog header contains the timestamp and IPv4 address or hostname of the system that sends the event. The LEEF header is a required field for LEEF events. The LEEF header is a pipe delimited (|) set of values that identifies your software or appliance to QRadar. Event attributes identify the payload information of the event that is produced by your appliance or software. Every event attribute is a key-value pair with a tab that separates individual payload events.

LEEF format

LEEF format sample

LEEF Header details

Why JSON Standard?

The JSON format is a lightweight text-based interchange format used for serializing and transmitting structured data over the network connection. Furthermore, it supports Security Information and Event Management solutions (e.g., Microsoft Azure Sentinel, Splunk, etc.,) seamlessly.

JSON syntax is considered as a subset of JavaScript syntax; it includes the following: 

1. Data is represented in name/value pairs.

2. Curly braces hold objects and each name is followed by ':'(colon), the name/value pairs are separated by ','(comma).

3. Square brackets hold arrays and values are separated by ','(comma).  

JSON format

Deactivating the HaloCAD for Teamcenter

For any diagnostic testing purposes in connection with HaloCAD, you may need to deactivate the HaloCAD for a while. In such cases, follow the below procedure:

1. Step 1. Stop fsc service. 

   Remove the changes done in FMS master file fmsmaster_FSC_<ComputerName>_Teamcenter.xml

   For example, <loadbalancer id="ReverseProxy" address="http://tclu0310.Secude.local:8080/tc/fms/" />

2. Step 2. Remove the changes made in the FCC file.

   1. Go to <installed_path>\Teamcenter12\tccs\bin>, and execute CMD with administrator privilege.

   2. Type fccstat.exe -stop and press Enter.

   3. Remove the changes at the line in the fcc.xml file.

   4. FCC Line format: <parentfsc address="http://:/tc/fms" priority="0" transport="lan"/> <assignment address="parentfsc address">

   5. Alternatively, you use the backup files of these two.

3. Step 3. Start fsc service.

   1. Type fccstat.exe -start and press Enter.

   2. Type fccstat.exe -status and press Enter. You will receive a confirmation message without the Haloproxy port number, which confirms that HaloCAD is not active.

4. Step 4. Remove the two system variables - Default_Transient_Server and Fms_BootStrap_Urls.

5. Step 5. Restart Server Manager from services.msc.

6. Complete your investigation and then activate it, as described in the section “TCCS Configuration - Step 2”.

Uninstalling the HaloCAD for Teamcenter

Once you stop using the HaloCAD component, you can uninstall it. Uninstall removes all files and registry settings that were added to your computer at the time of initial installation.

Prerequisite: Make sure to close the configuration tool before performing uninstallation. Otherwise, an error message will appear such as "Kindly close the running config tool and proceed uninstallation!"

 Method #1 

1. Click Start menu > go to Control Panel > Programs > Programs and Features > Uninstall a Program > select HaloCAD for Teamcenter application from the list > right-click and select Uninstall option or double-click on the installer HaloCAD_Teamcenter_Setup.exe file.

2. Depending on your Windows security settings, you may get a security warning as "Do you want to allow the following program to make changes to this computer?". If you get this security warning, click the Yes button to confirm that you want to uninstall the HaloCAD component.

3. The following confirmation message will appear.

   

   Uninstall Message #1

4. Click Yes to confirm that you want to remove it from the computer.

   

   Uninstall Message #2

5. The HaloCAD component has been successfully uninstalled. Click OK to close the dialog.

6. The uninstalling process is complete.

Method #2

The HaloCAD component can be removed using the command line, as illustrated in the sample below.

1. Open a command prompt.

2. Navigate to the HaloCAD component's directory.
   Example: HaloCAD_Teamcenter_Setup.exe -uninstall

3. The uninstalling process is complete.