New Release Available in October – Stay tuned!
HaloENGINE GenNXT
HaloENGINE GenNXT
Breadcrumbs

Configuring the Tomcat Service

The HaloENGINE GenNXT Tomcat Service communicates directly with the Microsoft Purview Information Protection service to fetch the MPIP labels. These labels are then available under the Label option on the Rules page.

Any changes to labels in the Microsoft Entra admin center require restarting the HaloENGINE GenNXT Tomcat service.
If an MPIP label is added, removed, or modified in the Microsoft Entra admin center, or if you change the service registry settings, the administrator must restart the HaloENGINE GenNXT Tomcat service to ensure that the changes take effect. By doing this, labels are updated and synchronized with the Microsoft Entra admin center.

Configuration Tool

During installation, the Microsoft Entra ID application details are used to initialize the HaloENGINE GenNXT Tomcat service. After successful authentication, the sensitivity labels are retrieved automatically. Use heslibconfig.exe to update MPIP-related settings, such as the Application ID.

Default locations of log files

Name

Default Path

Configuration tool

C:\Program Files\Secude\HaloENGINE\HaloENGINEService\lib\heslibconfig.exe

MIP logs

C:\Program Files\Secude\HaloENGINE\HaloENGINEService\logs\mip_cache_storage\mip\logs

Default locations

To update your Microsoft Entra ID application details, follow the procedure below.

  1. Open the Command Prompt with elevated rights (Run as Administrator).

  2. Navigate to the directory where heslibconfig.exe is located.

  3. To view the list of available Silent Mode options, enter the following command:
    Type heslibconfig.exe -help
    Press Enter
    Output
    Usage:
    heslibconfig.exe -testmip
    heslibconfig.exe -view
    heslibconfig.exe -update -applicationid <application_id> -tenantid <tenant_id> -thumbprint <thumb_print> -certstore <LocalComputer|CurrentUser>
    heslibconfig.exe -testprotection <label_id>

Example Commands and Output

To display the labels, enter the following command:

heslibconfig.exe -testmip
MIP test started with config path C:\Program Files\Secude\HaloENGINE\HaloENGINEService\config
Using policy from file: C:\Program Files\Secude\HaloENGINE\HaloENGINEService\logs\mippolicy.xml
Using policy from file: C:\Program Files\Secude\HaloENGINE\HaloENGINEService\logs\mippolicy.xml
Protection engine ID: b96cd9fb-72de-483a-bf69-a17e3beb4801
MPIP Initialization test passed. getting label details...
{
  "TotalLabels": 69,
  "labels": [
    {
      "id": "erd28959f-6ab8-4193-8580-a310ac1a5529",
      "isActive": true,
      "name": "Confidential"
    },
    {
      "id": ghefa4170-0d19-0005-0000-bc88714345d2",
      "isActive": true,
      "name": "Personal"
    },

To display the tenant details, enter the following command:

heslibconfig.exe -view
Application Id:9f0de2dd-8d49-4a3f-9676-bf4b6ff17d44
Tenant Id:8c425ee7-352a-4657-ac77-7dc198712cb3
ThumbPrint Id:d0d739fd4b4128f5e16c8d241360220ea8fb11fa
Certificate Store:LocalComputer

To update the JSON file, enter the following command:

heslibconfig.exe -update -applicationid 9f0de2dd-8d49-4a3f-9676-bf4b6ff17d44 -tenantid 8c425ee7-352a-4657-ac77-7dc198712cb3 -thumbprint d0d739fd4b4128f5e16c8d241360220ea8fb11fa -certstore LocalComputer
Updating the config json file located in C:\Program Files\Secude\HaloENGINE\HaloENGINEService\config\HaloENGINESVCMIPInfo.enc
Configuration file updated successfully.

To verify that protection is successful, enter the following command:

heslibconfig.exe -testprotection ttf1473d-74f4-47ca-9843-e735f94fa797
MIP protection test started with config path C:\Program Files\Secude\HaloENGINE\HaloENGINEService\config
Using policy from file: C:\Program Files\Secude\HaloENGINE\HaloENGINEService\logs\mippolicy.xml
Using policy from file: C:\Program Files\Secude\HaloENGINE\HaloENGINEService\logs\mippolicy.xml
Protection engine ID: 8d56d1bd-972a-4450-b0b1-dc26573c87g5
MPIP Initialization test passed. Proceeding with protection...
Label Id...99f1473d-74f4-47ca-9843-e735f94fa797
File name ...C:\Program Files\Secude\HaloENGINE\HaloENGINEService\lib\testfile.txt
File protected successfully
Protected file C:\Program Files\Secude\HaloENGINE\HaloENGINEService\lib\testfile.ptxt

Configuration Changes in the JSON File

After installation, navigate to the configuration folder ...\HaloENGINEService\config. The folder contains the JSON file that stores the HaloENGINE GenNXT Tomcat Service configuration properties. Note: Modify only the parameters listed below, and only when necessary. All other parameters must remain at their default values to ensure proper system functionality and stability.

Name

Description

block_pii

Enable or disable the visibility of Personally Identifiable Information (PII) in the MIP SDK logs.

  • false — PII is visible in clear text in the MIP SDK logs.

  • true — PII is masked with asterisks in the MIP SDK logs, helping to protect PII confidentiality.

cachetype

Specifies the MPIP cache storage type used by the service.

  • In Memory (0) — Stores the cache in application memory.

  • On Disk (1, default) — Stores the SQLite3 database on disk in the directory specified in the settings object. The database is stored in plain text.

  • On Disk Encrypted (2) — Stores the SQLite3 database on disk in the directory specified in the settings object. The database is encrypted by using operating system-specific APIs.

cacheuserlicense

Controls whether the End User License (EUL) is stored in the MPIP cache.

  • 0 (false) — The End User License (EUL) is not stored in the MPIP cache.

  • 1 (true, default) — The End User License (EUL) is stored in the MPIP cache.

databoundary

Specifies the geographic region where audit and telemetry events are stored and processed.

 enabledke   

Enables or disables Double Key Encryption (DKE).

  • 0 (default) — Disables DKE in the HaloENGINE GenNXT Tomcat Service.

  • 1 (On) — Enables DKE in the HaloENGINE GenNXT Tomcat Service.

Note: DKE labels are visible only when DKE is enabled.

enablefiletracking

Registers protected files for tracking and access revocation.

  • 0 (default) — Protected files are not registered for file tracking or access revocation.

  • 1 — Protected files are registered for file tracking and access revocation.

enableminimaltelemetry

   

Controls the diagnostic information transmitted to Microsoft.

  • 0 (default) — All diagnostic events are transmitted.

  • 1 — Only minimum diagnostic events are transmitted.

log_level   

Specifies the logging level. Available values are ERROR, WARNING, INFO, and DEBUG.

log_purge   

It indicates the removal of files older than a defined time frame. By default, log files older than 7 days are deleted.

streambuffersize   

Specifies the buffer size used for memory-based encryption with the MIP SDK. When the configured buffer size is exceeded, additional memory equal to the configured stream buffer size is allocated. This process continues until the encryption or decryption operation is complete. The default value is 10 MB.

templatefile_purge

Defines the purge time of template files that are generated for each CAD assembly file (compound file) download. The default value is one hour. For example, when a file is downloaded at 15:25, the HaloENGINE GenNXT Tomcat Service creates a template file in the tmp\GUID folder, which is located in the HaloENGINE GenNXT Tomcat Service user's profile folder. In the background, it checks for and deletes files that have reached the configured purge time, for example, after 16:25.
Note: This setting applies only to CAD assembly file labeling.

HaloENGINE GenNXT Tomcat service configuration

WinHTTP Proxy Settings

To allow MIP SDK to use the proxy settings set up in your environment, follow the steps below:

Determine whether the proxy server has been properly set up by running the following command: C:\Windows\system32>netsh winhttp show proxy

Current WinHTTP proxy settings: Direct access (no proxy server).

If the response is as shown above, the proxy server has not been configured in the WinHTTP registry.

To configure the proxy server for WinHTTP, use the following command:

Syntax: C:\Windows\system32>netsh winhttp set proxy <proxyservername>:<portnumber>

Example: C:\Windows\system32>netsh winhttp set proxy 190.160.166.191:8080

In this case, the proxy server has been set up with 190.160.166.191:8080. Once this command is executed successfully, the registry is updated with the proxy server URL, and the HaloENGINE GenNXT Tomcat Service ensures that the configured proxy settings are applied.

Last updated: