Appendix

This section provides supplemental information.

Enabling Split Authentication

In a Windchill setup with Single Sign On (SSO) implemented on the master/main server and a replica server connected to it, HaloCAD has a limitation when obtaining metadata from the replica server using SSO-based authentication.

Split authentication can overcome HaloCAD's limitation in accessing REST calls from the replica server to the main server. All other activities are performed using SSO authentication or customized authentication that the customer uses, except for HaloCAD operations on the replica server.

PTC has recommended this solution, and it can be found in Knowledge Base Article CS291543. The following example shows how to configure split authentication for the HaloCAD Controller endpoint on the main server.
Follow the steps for the configuration: 

1. Stop the Windchill and Apache servers.

2. In the HTTPServer directory <WT_HOME>\HttpServer\conf\conf.d (for example, C:\ptc\Windchill_12.0\HTTPServer\conf\conf.d), create a new configuration file with a number higher than the existing <number>-app-Windchill-Auth.conf file. For example, if there is a file with 39-app-Windchill-Auth.conf, you can create one with 40-app-Windchill-Auth.conf.

3. Now enter the following values into the file and save it.

   CODE

   <LocationMatch ^/+Windchill/+servlet/+HALOCADController(;.*)?>
         AuthName "Windchill"
         AuthType Basic
         AuthBasicProvider Windchill-LDAP 
         Require valid-user
   </LocationMatch>

4. Restart the Windchill and Apache servers.

Failover Mechanism for HaloENGINE in HaloCAD for PLM

Server failover between two systems supports uninterrupted operation and service reliability in case of a breakdown. The server failover configuration is "active-standby," meaning that the primary server is "active", and the secondary server is "standby." 

HaloCAD for PLM supports connection failover between two HaloENGINEs. Here's a summary of its purpose: 

1. High Availability: If the primary HaloENGINE fails, the secondary HaloENGINE will take over, reducing downtime and maintaining continuous operation.
   Example: Let us assume that your business process requires no downtime.
   As per the business security policy, your administrator has configured Fail-Safe Mode as Strict to block any file upload or download whenever an error occurs. If HaloENGINE encounters an unexpected issue, failure to obtain label information will prevent file download or upload. In this instance, the failover mechanism in HaloENGINE will be the ideal option for dealing with such unforeseen scenarios, with no impact on the end user. Thus, even if the primary HaloENGINE connection fails, HaloCAD recognizes the failure and instantly switches to the secondary HaloENGINE to continue providing services.
   Once the primary HaloENGINE is restored, it will be a standby for the secondary HaloENGINE. If there is any failure in the secondary HaloENGINE, the primary HaloENGINE will again take over the operations.

   

   Failover Mechanism for HaloENGINE in HaloCAD for PLM

2. Redundancy: It provides redundancy, which means there is always another HaloENGINE ready to take over if the primary one fails. This minimizes the possibility of a single point of failure. 

3. Data Integrity and Consistency: In the event of a failure, the failover technique can help guarantee that data is consistent and file upload/download activities are not lost, which is crucial for systems that rely on high data security. 

  Failover Mechanism Requirement 

1. Network Infrastructure: Minimal Secondary HaloENGINE needs to be segmented so that the primary and secondary HaloENGINEs don't share the same network. 

2. Make sure the secondary HaloENGINE has HaloENGINE service installed as well. 

3. Data replication: Both HaloENGINEs must have the same classification profiles and rules. 

Open-source Software

Third-party software/code is included or bundled with Secude's products according to its appropriate license. Secude conducts testing to make sure the third-party products are compatible with and perform as intended with Secude applications.

The third-party libraries and dependencies used by HaloCAD for Windchill are shown in the table below.

Open-source software

Metadata

The Windchill metadata present in the HaloENGINE is listed in the table below.

Windchill metadata

Download Log Definition

This section explains the log definition for every log format that HaloENGINE supports.

What is SIEM Integration?

SIEM, which stands for Security Information and Event Management, is a comprehensive approach to managing an organization's security information and events. SIEM integration refers to the process of incorporating SIEM solutions into an organization's existing IT infrastructure to enhance its ability to monitor, detect, and respond to security incidents. To support this approach, the HaloENGINE transmits logs in JavaScript Object Notation (JSON), Log Event Extended Format (LEEF), and Common Event Format (CEF).

1. Common Event Format is an open log management standard developed by HP ArcSight. CEF comprises a standard prefix and a variable extension that is formatted as key-value pairs. 

2. Log Event Extended Format is a customized event format for IBM Security QRadar. LEEF comprises a LEEF header, event attributes, and an optional Syslog header. 

3. JavaScript Object Notation is a lightweight text-based open standard designed for human-readable data interchange.

These logs are forwarded to the communications module, which transmits them to your collection server via UDP or TCP. Ideally, a SIEM (Microsoft Azure Sentinel, Splunk, RSA, and others) server would scan the received messages, sort them, and alert your security team.

Forwarding logs

Why CEF Standard?

The CEF format is an open log management standard that simplifies log management. CEF allows third parties to create their device schemas that are compatible with a standard that is used industry-wide for normalizing security events. Technology companies and customers can use the standardized CEF format to facilitate data collection and aggregation, for later analysis by an enterprise management system. CEF is an extensible, text-based format designed to support multiple device types by offering the most relevant information. It defines the syntax for log records consisting of a standard header and a variable extension, formatted as key-value pairs. 

Syslog and CEF Header

The data is normalized and categorized into the ArcSight CEF for easy correlation and analysis. CEF uses Syslog as a transport mechanism. It uses the following format, consisting of a Syslog prefix, a header, and an extension, as shown below. If an event producer is unable to write Syslog messages, it is still possible to write the events to a file.

CEF format

CEF format sample

CEF Header details

CEF sample

Why LEEF Standard?

The Log Event Extended Format (LEEF) is a customized event format for IBM Security QRadar that contains readable and easily processed events for QRadar. 

Syslog and LEEF Header

The LEEF format consists of a Syslog header, a LEEF header, and event attributes. The Syslog header is an optional field. The Syslog header contains the timestamp and IPv4 address or hostname of the system that sends the event. The LEEF header is a required field for LEEF events. The LEEF header is a pipe delimited (|) set of values that identifies your software or appliance to QRadar. Event attributes identify the payload information of the event that is produced by your appliance or software. Every event attribute is a key-value pair with a tab that separates individual payload events.

LEEF format

LEEF sample

LEEF Header details

Why JSON Standard?

The JSON format is a lightweight text-based interchange format used for serializing and transmitting structured data over the network connection. Furthermore, it supports Security Information and Event Management solutions (e.g., Microsoft Azure Sentinel, Splunk, etc.,) seamlessly.

JSON syntax is considered as a subset of JavaScript syntax; it includes the following: 

1. Data is represented in name/value pairs.

2. Curly braces hold objects and each name is followed by ':'(colon), the name/value pairs are separated by ','(comma).

3. Square brackets hold arrays and values are separated by ','(comma).  

JSON sample

Uninstalling the HaloCAD Component from Windows

Once you stop using the HaloCAD component, you can uninstall it. Uninstall removes all files and registry settings that were added to your computer at the time of initial installation.

Prerequisite: Make sure to stop the Windchill Server before performing uninstallation. Otherwise, an error message will appear such as "Windchill Server instance is running. So please stop the server and retry unistallation."

1. Click Start menu > go to Control Panel > Programs > Programs and Features > Uninstall a Program > select HaloCAD for Windchill application from the list > right-click and select Uninstall option or double-click on the installer HaloCAD_Windchill_Setup.exe file.

2. Depending on your Windows security settings, you may get a security warning as "Do you want to allow the following program to make changes to this computer?". If you get this security warning, click the Yes button to confirm that you want to uninstall the HaloCAD component.

3. The following confirmation message will appear.

   

   Uninstall Message #1

4. Click Yes to confirm that you want to remove it from the computer.

   

   Uninstall Message #2

   Results:

   1. The HaloCAD component has been successfully uninstalled.

   2. Click OK to close the dialog.

   3. The uninstalling process is complete.

5. Alternate option: Remove the configuration files with the Config tool, then run the following command.

   HaloCAD_Windchill_Setup.exe -uninstall

Uninstalling the HaloCAD Component from Linux

Prerequisite: Make sure to stop the Windchill Server prior to performing uninstallation. Otherwise, an error message will appear such as "Windchill Server instance is running. So please stop the server and retry uninstallation."

1. Run the HaloCAD Configuration Tool as mentioned in step 2.

2. Click the More… tab, then click on the Uninstall button in the configuration tool UI.

3. Click Apply.

4. Results:

   1. A confirmation message dialog is displayed if the configuration is successful. Click OK on the confirmation dialog box.

   2. The HaloCAD Configuration tool UI and Terminal will automatically close.