8e6 Technologies TAR User Manual Download

Page: 1 / 222

Threat Analysis Reporter

USER

GUIDE

Model: TAR

Release 1.3.00 • Manual Version 1.01

Summary of Contents for TAR

Page 1: ... Threat Analysis Reporter USER GUIDE Model TAR Release 1 3 00 Manual Version 1 01 ...

Page 2: ...ii 8E6 TECHNOLOGIES THREAT ANALYSIS REPORTER USER GUIDE ...

Page 3: ... respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular pur pose 8e6 Technologies shall not be liable for any error or for incidental or consequential damages in connection with the furnishing performance or use of this manual or the exam ples herein Due to future enhancements and modifications of this product the information described in...

Page 4: ...iv 8E6 TECHNOLOGIES THREAT ANALYSIS REPORTER USER GUIDE ...

Page 5: ...ts 8 Installation Prerequisite 8 Getting Started 9 Initial Setup 9 Login window 10 Log in 11 Navigation panel menu topics 12 Help 12 Log out 13 Exit the interface 13 Navigation Tips and Conventions 14 PRELIMINARY SETUP SECTION 16 Introduction 16 Chapter 1 User Groups Setup 17 View User Group Information 19 User group status key 19 View a list of members in a user group 19 Add a User Group 21 Patte...

Page 6: ... User Group 31 Chapter 2 Admin Groups Setup 32 Add a Group 33 View an Admin Group s Permissions 34 Edit an Administrator Group 36 Delete an Administrator Group 37 Chapter 3 Admins Setup 38 View Account Info 39 View Account Info 40 Add an Administrator Profile 41 Account Info tab 41 Contact Info tab 42 Groups tab 43 Edit Account Info 44 Change Password 45 User Groups Add or remove a group 46 Add a ...

Page 7: ...uge 66 Delete a Gauge 67 View End User Gauge Activity 69 View Overall Ranking 70 View a URL gauge ranking table 71 View a library category gauge ranking table 72 Monitor Restrict End User Activity 74 View a list of categories accessed by the user 75 View a list of URLs accessed by the user 77 Manually lock out an end user 78 End user workstation lockout 81 Chapter 3 Alerts Lockout Management 83 Ad...

Page 8: ...ivity 100 Perform a custom search 100 View a list of Users who accessed a Category 100 View URLs within the accessed category 102 Print the results 103 Access a URL 103 BANDWIDTH MANAGEMENT SECTION 104 Introduction 104 Chapter 1 Monitor Bandwidth Gauges 105 Bandwidth Gauge Components 105 View Bandwidth Gauges 108 View bandwidth usage for a specified protocol 109 View End User Bandwidth Gauge Activ...

Page 9: ...the MUL Database 133 View End User Activity 134 Synchronize TAR with the R3000 134 Chapter 3 View Administrator Activity 135 Perform a Search on a Specified Activity 136 Search Results 137 Chapter 4 Maintain the Device Registry 139 R3000 Device Maintenance 141 View edit R3000 device criteria 141 Add an R3000 to the registry 142 Delete an R3000 from the registry 142 Threat Analysis Reporter Mainten...

Page 10: ... 7 View Hard Disk Status 160 TECHNICAL SUPPORT PRODUCT WARRANTIES 162 Technical Support 162 Hours 162 Contact Information 162 Domestic United States 162 International 162 E Mail 162 Office Locations and Phone Numbers 163 8e6 Corporate Headquarters USA 163 8e6 Taiwan 163 Support Procedures 164 Product Warranties 165 Standard Warranty 165 Technical Support and Service 166 Extended Warranty optional ...

Page 11: ...o administrators 181 Administrator usage of System Tray 183 Use the TAR Alert icon s menu 183 Status of the TAR Alert icon 184 View System Tray alert messages 185 Appendix C 186 RAID Maintenance 186 Part 1 Hardware Components 186 Part 2 Server Interface 187 LED indicators in SL and HL units 187 Front control panels on H SL and HL units 189 Rear panels on H and HL units 191 Part 3 Troubleshooting 1...

Page 12: ...CONTENTS xii 8E6 TECHNOLOGIES THREAT ANALYSIS REPORTER USER GUIDE Step 4 Contact Technical Support 199 Fan failure 200 Identify a fan failure 200 Appendix D 201 Glossary 201 INDEX 205 ...

Page 13: ...orpo rate Internet usage policies 8e6 s Threat Analysis Reporter TAR appliance is designed to offer administrators or management dynamic real time graphical snapshots of their network s Internet traffic supported by remediation tools to manage and control user generated Web threats Working in conjunction with 8e6 s R3000 Enterprise Filter TAR interprets end user Internet activity from the R3000 s ...

Page 14: ...on This section includes infor mation on creating and maintaining user accounts Configuration Section This section includes informa tion on configuring TAR to alert you to any end user Internet activity not within your organization s Internet usage policies Bandwidth Management Section This section includes information on monitoring and managing inbound and outbound traffic on your network Adminis...

Page 15: ...o Use this User Guide Conventions The following icons are used throughout this user guide NOTE The note icon is followed by italicized text providing additional information about the current subject TIP The tip icon is followed by italicized text giving you hints on how to execute a task more efficiently WARNING The warning icon is followed by italicized text cautioning you about making entries in...

Page 16: ...allows you to toggle between two choices By clicking in this box a check mark or an X is placed indi cating that you selected the option When this box is not checked the option is not selected dialog box a box that opens in response to a command made in a window or screen and requires your input You must choose an option by clicking a button such as Yes or No or Next or Cancel to execute your comm...

Page 17: ...o indicate its function or purpose list box an area in a dialog box window or screen that accommo dates and or displays entries of items that can be added or removed panel the top left or right section of a screen the right side which is replaced by a different view when clicking a pertinent button pop up box or pop up window a box or window that opens after you click a button in a dialog box wind...

Page 18: ... windows frames fields tables text boxes list boxes icons buttons and radio buttons tab one of at least two related pages each individ ually labeled and contained within the same window but only displaying its page in the window when accessed text box an area in a dialog box window or screen that accommodates your data entry A text box is a type of field See field window displays on a screen and c...

Page 19: ...ng Internet Explorer IE 6 0 or later or Firefox 3 0 Macintosh OS X Version 10 5 running Safari 3 1 2 or Firefox 3 0 Flash plug in version 8 or later Screen resolution set at 1024 x 768 with color quality set at 16 bits 256MB RAM Pentium III 600 MHz or higher or equivalent Network card and ability to connect to the TAR server and R3000 server Email client that can be set up to receive email alerts ...

Page 20: ...tions HTTPS connection to 8e6 s software update server Internet connectivity for downloading Java virtual machine Flash if not already installed Installation Prerequisite 8e6 R3000 running software version 2 0 10 or later NOTE The R3000 must be running software version 2 0 00 or later in order to use the time based lockout feature defined in Chapter 3 of the Configuration Section ...

Page 21: ...ide explains how to perform the initial configuration of the server so that it can be accessed via an IP address on your network NOTE If you do not have the Threat Analysis Reporter Quick Start Guide contact 8e6 Technologies immediately to have a copy sent to you Once the TAR unit is set up on the network the designated global administrator of the TAR server should be able to access the unit via i...

Page 22: ... up Blocking Software 2 In the Address field of the browser window type in the URL for the TAR server in which x x x x represents the IP address specified during quick start procedures http x x x x 8080 This action opens the TAR login window Fig 1 1 1 TAR Login window This window serves as a portal for administrators to log into TAR NOTE In this window TAR s software version number displays beneat...

Page 23: ...ype in your password If you are logging in as the global administrator for the first time enter the password registered during the quick start wizard procedures If you are logging in as a group administrator enter the password set up for you by the global administrator This entry displays as a series of asterisks for security purposes 3 Click the Log In button to open the application displaying th...

Page 24: ...tivity Administration click this topic to access menu options for setting up and maintaining administrator profiles and managing the TAR unit Policy click this topic to access menu options for setting up and maintaining policies used for triggering warnings when gauges approach their upper threshold limits Report Analysis click this topic to access menu options for analyzing Internet usage data Ba...

Page 25: ...SER GUIDE 13 Log out To log out of the application click the Logout button in the upper right corner of the screen When your session has been terminated the login window re displays Exit the interface To exit the interface click the X in the upper right corner of the browser window ...

Page 26: ... of each window Scroll up and down and across a list If available use the scrollbar to the right or along the bottom of a frame or list box to view an entire list An extensive list can be viewed in its entirety by clicking the back to back left and right arrow buttons circled in the image above in order to navigate to the previous or next section of the list In some panels the previous and next bu...

Page 27: ...his task Ctrl Key To select multiple items from a list box click each item while pressing the Ctrl key on your keyboard Shift Key To select a block of consecutive items from a list box click the first item and then press the Shift key on your keyboard while clicking the last item Once the group of items is selected click the appropriate button to perform the action on the items Sort records by ano...

Page 28: ...ude setting up user groups administrator permission groups and group administrator profiles Chapter 1 User Groups Setup This chapter explains how to set up user groups whose Internet activity will be monitored by group administrators Chapter 2 Admin Groups Setup This chapter explains how to set up permissions so that an administrator in your group will only be able to access areas of the TAR conso...

Page 29: ...rs in this section 1 In the navigation panel click Administration to open that menu 2 Click User Groups to open the User Groups manage ment panel which is comprised of the User Groups frame to the left and its target frame to the right Fig 2 1 1 User Groups management panel If any user groups were previously added by the admin istrator these display in the User Groups frame in a white or orange co...

Page 30: ... in a user groups panel mousing over that icon displays information about entries or actions that can be made in that panel Click Back to Gauges in the upper right corner of the panel to re display the default gauges view NOTES This version of TAR will import user groups from a source R3000 using IP group authentication or the following LDAP server types Active Directory Mixed Mode Active Director...

Page 31: ...y being rebuilt The user groups icon with an exclamation point indi cates the user group cannot be rebuilt on demand View a list of members in a user group To view a list of members that belong to an existing user group 1 Select the user group from the User Groups frame by clicking on the Name to highlight the row Based on this selection the following occurs If the selected user group is ready to ...

Page 32: ...d for that user group Single Users tab view a list of the individual users previously selected from the Available Users list for that user group Fig 2 1 2 View user group information Single Users tab NOTES If using the LDAP user authentication method user names display in the Username column If using IP groups IP addresses of user machines display instead of usernames For LDAP authentication the m...

Page 33: ...nel for adding a user group Fig 2 1 3 Add user group Patterns tab This panel for adding a user group is comprised of the Group Name field at the top and the following tabs popu lated with information from the base group Patterns IP Ranges and Single Users By default the Patterns tab displays 3 Make entries in any of the tabs as described in the tab sub sections on the following pages 4 Enter at le...

Page 34: ...be included in the new group A pattern consists of a wildcard or a wildcard plus one or more alphanumeric characters If any patterns have been inherited from the base group these display in a grey colored row in the Parent Patterns frame and can be added to the new user group Add a new pattern To add a pattern to the new user group 1 Do one of the following To add an inherited pattern select the p...

Page 35: ...right Fig 2 1 4 Add user group Patterns Preview Users The Patterns frame displays the pattern you added and the Resolved Users frame includes a list of each user resolved by the pattern including that user s Username for LDAP authentication or IP address for IP group authentication and the IP address of the user s machine 3 Click the Back button to return to the previous panel Remove a pattern To ...

Page 36: ...s and netmask The right side of this tab includes a frame with Parent Ranges Default Parent Ranges display in a grey colored row The Assigned Ranges list box below will include any IP ranges that have been added NOTE If using IP group authentication parent ranges do not display in this tab unless an IP range was originally set up for this user group s parent user group To set up the first parent u...

Page 37: ...lds at the left of the tab If necessary edits can be made to these fields To add an IP address range without selecting from the Parent Ranges frame a Enter the Starting IP address b Enter the Ending IP address To calculate an IP address range a Click the Calculate IP Range checkbox which activates the IP Address and Netmask fields below b Enter the IP Address c Enter the Netmask which activates th...

Page 38: ... range from the list box Single User tab When creating a user group the Single Users tab is used for adding one or more users to the group This tab includes a Filter to be used with the Available Users frame that is popu lated with individual users from the base user group For each record in the list the Username IP address and corre sponding IP address display The frame to the right includes the ...

Page 39: ...ber of results that display in this list by using the filter Use the filter to narrow Available Users results To use the available user list filter 1 Enter filter terms to narrow the selection of Available Users For example Type in 150 to only display results matching an IP address that begins with 150 2 Click Apply to display filtered results in the Available Users frame Select users to add to th...

Page 40: ...that now displays to the right NOTE Users added to the Add tab will still be listed in the Avail able Users list Remove users from the Add tab To remove users from this user group 1 Select the user s from the Add tab this action activates the Remove button Fig 2 1 8 Add user group remove user from Single Users tab 2 Click Remove button to remove the user s from the Add tab ...

Page 41: ...er group i e if the Patterns tab had a setting made in it that tab displays if the Single Users tab was the only tab with settings made in it that tab displays 3 Make any of these edits in a tab or field Click a tab to access it and then make any necessary modifications Patterns tab add or remove a pattern IP Ranges tab add or remove an IP address range Single Users tab add or remove one or more u...

Page 42: ...e user group s status to rebuilt to make the screen turn hazy and to open the Rebuild Started alert box with the message Your group rebuild has started This action might take a few minutes 3 Click OK to close the alert box and to make the screen reappear as normal 4 After a few minutes click the green reload icon above the User Groups frame to refresh the status of the rebuilt user group Note in t...

Page 43: ...om the User Groups list 2 Click Delete to turn the screen hazy and to open the Delete dialog box with the message Do you really want to delete this group WARNING If the user group to be deleted has been delegated to an administrator that user group will be removed from that administrator s User Groups list as well as your User Groups list TIP Click Cancel to close the dialog box and to return to t...

Page 44: ...ole that you specify This function is available to a group administrator only if permissions were granted by the administrator who set up his her account as detailed in this chapter and in Chapter 3 In the navigation panel click Admin Groups to open the Group Management pop up window Fig 2 2 1 Group Management Groups previously set up display in the Groups frame From this pop up window you can add...

Page 45: ...other names such as those set up for user groups 3 By default Gauges is selected and therefore greyed out This indicates the administrator to be added will be able to view and modify gauge content Click the appro priate checkbox es to specify the type of access the administrator will be granted on the TAR console or its related devices User Profiles manage a list of end users logged events Admins ...

Page 46: ...e ER application to generate reports on end user Internet activity Bandwidth Gauges monitor and manage bandwidth gauges for inbound and outbound traffic TIP To remove a checkmark from any active checkbox containing a checkmark click the checkbox 4 Click Submit to close both pop up windows The Group Name you just entered will appear in the Groups frame the next time you open the Group Management po...

Page 47: ... bandwidth IP address range for TAR can also be added or removed add another R3000 or add an ER if the latter was not previously added view infor mation about devices connected to the TAR server or synchronize with TAR the source R3000 s supplied library category updates custom categories and devices connected to TAR Custom Categories maintain the list of custom library categories to be used by ga...

Page 48: ...gement pop up window click the name of the administrator group to highlight the group name and to activate all buttons see Fig 2 2 3 2 Click Edit a Group to open the Edit Group pop up window Fig 2 2 5 Edit Group 3 Perform any of the following actions Modify the Group Name Add functions to be monitored by the administrator Remove functions to be monitored by the administrator 4 Click Submit to clos...

Page 49: ...up to highlight the group name and to activate all buttons see Fig 2 2 3 2 Click Delete a Group to open the Delete Group dialog box Fig 2 2 6 Delete Group 3 Click Delete Group to remove the administrator group This action closes the dialog box and the Group Manage ment pop up window NOTE Clicking Cancel closes the dialog box without removing the administrator group and returns you to the Group Man...

Page 50: ...pter 1 In the navigation panel click Admins to open the Admin System pop up window Fig 2 3 1 Admin System At the left side of this window the Active Users frame displays TAR Login IDs of administrator accounts previ ously set up in this window NOTE In addition to seeing account IDs he she set up in this window a global administrator will also see the TAR Login ID established during the quick start...

Page 51: ... delete a group administrator profile as neces sary 2 After performing the intended actions in this window click the X in the upper right corner of the window to close it View Account Info In the Active Users frame click the TAR Login ID of the administrator to display that user s account information in the Account Info frame Fig 2 3 2 Admin System Active Users selection ...

Page 52: ...ion information LDAP Username Domain Comments NOTES By default the Administrator Group pull down menu displays the first alphanumeric entry in the list this does not reflect the selection saved for the group administrator s profile The global administrator profile that was created during the quick start wizard hardware installation process displays at minimum the TAR Login ID and Email address For...

Page 53: ...ll use to access the TAR interface 3 Type in the Password the group administrator will use in conjunction with the TAR Login ID and enter that same password again in the Confirm Password field These entries display as asterisks for security purposes 4 Select the Administrator Group previously set up in the Admins Group menu option from the available choices in the pull down menu 5 If the administr...

Page 54: ...e and Domain entered in these fields should be the same as the login ID and password the group administrator uses to authenticate on his her workstation See Configuration Section Chapter 3 Alerts Lockout Management and Appendix B System Tray Alerts Setup Usage for details on setting up and using the System Tray feature 7 Click Next to go to the Contact Info tab Contact Info tab TIP Click Back at t...

Page 55: ...ed with the group administrator s account 7 Click Next to go to the Groups tab Groups tab TIP Click Back at the bottom left of this tab if you need to return to the Contact Info tab In the Group tab you select the user group s to be moni tored by the group administrator Fig 2 3 5 Add new Administrator Groups 1 In the Available list click the user group s to highlight your selection s and to activa...

Page 56: ...e following information can be modified or updated Employee Name TAR Login ID Administrator Group selection Work Phone number Email address LDAP Username or Domain name the latter two fields are available if using LDAP The following information can be added modified or deleted Home Phone number Location information Comments The following actions can also be performed Change TAR Login Password Add ...

Page 57: ...p window Fig 2 3 6 Change Password 2 Type the new password in the Enter New Password field and the Retype Password field These entries display as asterisks for security purposes 3 Click Submit to close the Change Password pop up window and to activate the new password NOTE If the administrator whose password was changed is currently logged into TAR he she will need to log out and log back in again...

Page 58: ... Assigned list box NOTE A user group added to the Assigned list box can be removed but at least one user group must be included in the Assigned list box in order to save your entries 3 After adding the user group s to the Assigned list box click Submit to close the Add new user group pop up window and to display the added group s in the User Groups list box of the Admin System pop up window Remove...

Page 59: ... be deleted 1 In the Admin System pop up window select the TAR Login ID of the group administrator from the Active Users frame 2 Click Delete Admin to open the Delete Administrator dialog box Fig 2 3 8 Delete Administrator TIP Clicking Cancel closes the dialog box without removing the group administrator profile and returns you to the Admin System pop up window 3 Click Delete Admin to close the di...

Page 60: ...ement Chapter 2 Custom Gauge Setup Usage This chapter explains how gauges are configured and monitored Chapter 3 Alerts Lockout Management This chapter explains how alerts are set up and used and how to manage end user lockouts Chapter 4 Analyze Web Usage Trends This chapter explains how URL trend reports are used for assessing end user Internet network activity For additional or historical inform...

Page 61: ...natomy of a gauge will help you deter mine the threat score to assign a library category affecting that gauge The illustration below depicts a URL dashboard gauge and a library category gauge Fig 3 1 1 URL dashboard gauge anatomy The name of the gauge displays above the gauge icon The timespan for the gauge s activity displays beneath the URL dashboard gauge icon while the threat score weight disp...

Page 62: ...score assigned to the library category For example A group administrator sets up a custom gauge labeled Unacceptable Material that includes the following library categories Pornography Adult Content Child Pornography and Shopping Pornography Adult Content and Child Pornography have been assigned a threat score of 3 and Shopping has been assigned a threat score of 2 Bob Larry and Sue are included a...

Page 63: ... 1 2 Scoring Weight Editor All library categories set up on the source R3000 connected to this TAR server display in the Category list By default each Category is assigned a Severity threat score weight of 1 indicating a low threat NOTE In order to reduce complexity it is recommended that first time users of TAR should leave all threat score weights at 1 3 After performing the intended actions in ...

Page 64: ...ld editable 3 One of the following entries can be made Enter 1 to assign a low threat score for the least dangerous sites such as those in the News category Enter 2 to assign a medium threat score for mid level threats such as Shopping or Sports categories Enter 3 to assign a high threat score for the most dangerous sites such as those in the Child Pornog raphy category 4 After modifying all threa...

Page 65: ...hreat score weights established a group administrator can begin setting up gauges for monitoring end users Internet activity 1 In the navigation panel go to the URL Dashboard and click Gauges to open the Gauge Management pop up window Fig 3 2 1 Gauge Management By default the Current Gauge Groups include Adult Content Bandwidth Illegal Security Shopping ...

Page 66: ...ge name to display a list of library categories and threshold criteria set up for that gauge Fig 3 2 2 Gauge Management Gauge Components 3 To exit this window click the X in the upper right corner of the window to close it Add a Gauge In the Gauge Management window click Add Gauge Group to open the Add a new Gauge Group pop up window Fig 3 2 3 Add a new Gauge Group ...

Page 67: ...e Add Gauge Information In the Gauge Information box 1 Type in at least four characters for the Gauge Name using upper and or lowercase alphanumeric characters and spaces if desired 2 Type in the Lower Limit Value of the floor for any gauge activity The recommended value is 0 zero 3 Type in the Upper Limit Value of the ceiling for gauge activity The recommended value is 200 This can be adjusted af...

Page 68: ...es the gauge will use for monitoring end user activity NOTE At least one library category must be selected when creating a gauge The maximum number of library categories that can be selected is 15 1 From the Available Categories list select one or more library categories 2 Click Add to move the selection s to the Assigned Cate gories list box TIP To remove one or more library categories from the A...

Page 69: ...ved This group consists of all end users whose network activities are set up to be monitored by the desig nated group administrator 2 From the Groups list select the user group to highlight it 3 Click Add to move the user group to the Assigned list box TIP To remove a user group from the Assigned list box click the user group to highlight it and then click Remove to move the group back to the Grou...

Page 70: ...up gauge components 1 The floor and ceiling threshold settings that were estab lished for the gauge group display in the Lower Upper Limit fields of each library category These values can be edited as necessary 2 If necessary make a selection from the Set a gauge method pull down menu to change the end user Internet usage method s for determining gauge activity All default Keyword URL Others passe...

Page 71: ...2 CUSTOM GAUGE SETUP USAGE 8E6 TECHNOLOGIES THREAT ANALYSIS REPORTER USER GUIDE 59 3 Click Next to close the Add a new Gauge Group windows and to display the new gauge in the URL dashboard gauge view Fig 3 2 6 New Gauge Group added ...

Page 72: ... gauges library category gauges protocol bandwidth gauges and port gauges Gauges that display in the URL dashboard are comprised of library categories Library category gauges display in a pop up window for the URL dashboard gauge Inbound Outbound protocol bandwidth gauges are comprised of ports Port gauges display in the a pop up window for the protocol bandwidth gauge See Bandwidth Management Sec...

Page 73: ...m the score displays in black text If the threat for a gauge is high exceeding 66 percent of the ceiling established for a gauge group or gauges contained within the group the score displays in flashing red text However if the score drops below 66 percent within the timespan set up for the gauge the text changes from blinking red to solid black again If a gauge group parent gauge displays flashing...

Page 74: ...y the total byte score As with URL dashboard gauges the score in the middle of the icon displays in flashing red text if activity registers in the upper threshold limit established for the gauge See Band width Management Section The image to the right shows a gauge for the Internet_Radio library category in the URL dashboard s Bandwidth gauge Note the Threat Rating displays beneath the gauge icon ...

Page 75: ...anel to open the Gauge Management pop up window Fig 3 2 7 Group Management edit gauge 1 In the Current Gauge Groups list box select the gauge to be edited This action highlights the gauge name and populates the Gauge Components box with a list of library categories set up to be monitored by that gauge 2 Click the Edit Gauge Group button to open the Edit Gauge Group pop up window Fig 3 2 8 Edit Gau...

Page 76: ...ion Gauge Name Lower Upper Limit Value s Timespan in minutes see Add Gauge Infor mation Assigned Categories see Select Library Categories Assigned Groups see Assign User Groups 4 Click Next to go to the second Edit Gauge Group pop up window Fig 3 2 9 Edit a Gauge Group gauge components 5 Edit any of the following criteria as necessary Lower Upper Limit fields for gauge activity in each library cat...

Page 77: ...certain URL gauges and their asso ciated library categories options are available to hide spec ified URL gauges Temporarily hide a URL gauge To hide a URL gauge for the current session only 1 In the URL dashboard right click the gauge to open its pop up menu see Fig 3 2 12 2 Select Hide Gauge to remove the URL gauge from the current view NOTE Using this option any gauges hidden during this session...

Page 78: ...re currently visible in the URL dashboard include a green circle with a checkmark in the lower right corner of the gauge icon Gauges that are currently hidden from view include a red circle with an X in the lower right corner of the gauge icon TIP To view the library categories included in a URL gauge click the URL gauge name to open the tree Click the gauge name again to close the list of library...

Page 79: ...ay in trend reports see View URL Trend Reports in Chapter 4 Analyze Web Usage Trends Delete a Gauge 1 To delete a gauge begin by either selecting the gauge from the dashboard or by using the navigation panel If you select the gauge from the dashboard Fig 3 2 11 Gauge pop up menu a In the gauges view right click the gauge to open its pop up menu see Fig 3 2 11 b Select Delete Gauge Group to open th...

Page 80: ...ibrary categories set up to be monitored by that gauge c Click the Delete Gauge Group button to open the Delete Gauge dialog box see Fig 3 2 12 TIP Clicking Cancel in the Delete Gauge dialog box closes the dialog box without removing the gauge and returns you to the Gauge Management pop up window 2 Click Delete Gauge to remove the gauge Fig 3 2 12 Edit Gauge Group This action closes the dialog box...

Page 81: ...n see View Overall Ranking This option also lets you drill down and view information on gauges affected by a specified end user End user activity by URL gauge For a snapshot of a URL gauge s current activity ranked in order by the highest to lowest end user score use the Ranking Table option see View a URL gauge ranking table End user activity by library category gauge For a snap shot of a library...

Page 82: ...ords for each end user who is currently affecting one or more gauge For each record in the list the following information displays Name username IP address and corresponding Score End users are ranked in descending order by their score 2 To drill down and view additional information about an end user s activity click the Name to highlight it 3 Click User Summary to open the Individual User View po...

Page 83: ...f records for each end user who is affecting this URL gauge For each record in the list the following information displays Name username IP address and corresponding Score End users are ranked in descending order by their score NOTE The URL gauge s ranking table pop up window is also accessible via the following options Double clicking a URL dashboard gauge to open the URL gauge s pop up window an...

Page 84: ...w see Monitor Restrict End User Activity 5 Click the X in the upper right corner of this pop up window to close it View a library category gauge ranking table To view details about a specified library category gauge s current activity 1 Right click the URL dashboard gauge to open its pop up menu see Fig 3 2 12 2 Choose View Gauge Details to open a pop up window displaying library category gauges c...

Page 85: ... gauge s ranking table pop up window is also accessible by double clicking a URL dashboard gauge to open the URL gauge s pop up window and then clicking a library cate gory gauge 4 To drill down and view additional information about an end user s activity click the Name to highlight it This action activates the two buttons in this window URL Details click this button to open the View Details pop u...

Page 86: ... end user s record selected click User Summary to open the Individual User View pop up window Fig 3 2 17 Individual User View This window contains Gauge Readings for each URL gauge Name ranked in descending order by the end user s Score for the corresponding gauge The user name IP address and end user s IP display above At the right side of this window the Group Membership to which the user belong...

Page 87: ... it View a list of categories accessed by the user To view a list of categories the end user accessed 1 In the Individual User View pop up window see Fig 3 2 17 select the Name of the URL dashboard gauge to highlight it 2 Click Category View to open the View by Hits pop up window Fig 3 2 18 View by Hits A list of each library Category gauge and its corre sponding Hits and Score for the URL dashboa...

Page 88: ...E6 TECHNOLOGIES THREAT ANALYSIS REPORTER USER GUIDE accessed by the end user within that category see View a list of URLs accessed by the user 5 After performing the intended actions in this window click the X in the upper right corner of this window to close it ...

Page 89: ...dow see Fig 3 2 18 or by selecting the Name username IP address and then clicking the URL Details button in the Library category gauge pop up window see Fig 3 2 16 Fig 3 2 19 View Details In the View Details window a list of each URL and corre sponding Timestamp displays using military time in the YYYY MM DD HH MM SS format for each URL accessed in that library category NOTE Drill Down Reports in ...

Page 90: ...window see Fig 3 2 17 select the Name of the URL dashboard gauge to highlight it 2 Specify the Duration hours for the lockout by making a selection from the pull down menu Unlimited Half Hour 1 1 1 2 8 NOTE If Unlimited is selected the end user remains locked out of the specified areas on the Internet network until the adminis trator unlocks his her workstation To unlock the end user go to the Loc...

Page 91: ...ens the Lockout by Categories pop up window Fig 3 2 21 Lockout by Categories a From the Available Categories list select the available library category containing URLs the end user should not access b Click Add to move the library category to the Assigned Categories list box TIPS To remove a library category from the Assigned Categories list box click the library category to highlight it and then ...

Page 92: ...gories click Next to open the alert box stating The user has been locked out d Click the X in the upper right corner of the box to close it If a Medium or High severity was selected a Clicking Yes in the Lockout dialog box opens the the alert box stating The user has been locked out b Click the X in the upper right corner of the box to close it ...

Page 93: ...mpts to access a URL for a library category set up to be monitored by that gauge the following lockout page displays for the end user Fig 3 2 22 Low severity lockout page This page contains the following information message Access Denied by TAR USER name IP address URL denied access Category in which the URL resides and end user s Score Medium severity lockout In this scenario after attaining the ...

Page 94: ...R GUIDE Fig 3 2 23 Medium severity lockout page This page contains the following information 502 Access Denied by 8e6 R3000 Enterprise Filter High severity lockout In this scenario after attaining the designated score established for a gauge the end user will be unable to access the organization s network ...

Page 95: ...d user was locked out of Internet network for an indefinite time period as a result of his her Internet activity the admin istrator can determine when to unlock that end user s work station This function is available to a group administrator only if permissions were granted by the administrator who set up his her account as detailed in Chapters 2 and 3 of the Preliminary Setup Section 1 In the nav...

Page 96: ...ert 3 Type in the Alert Name to be used for the alert that will be delivered to the group administrator 4 In the Threshold field enter the number for the threshold limit that will trigger the alert NOTE An alert is triggered for any end user whose current score for a gauge matches the designated threshold limit See Gauge score methodology in Chapter 1 of this section for information on how scoring...

Page 97: ...re is only available for an administrator with an Active Directory LDAP account username and domain and is not available if using IP groups 6 After making all entries in this window click Submit to save your entries and to close the Add a new Alert pop up window Email alert function Configure email alerts To set up the email alert function 1 Click the checkbox corresponding to Email to display the...

Page 98: ...y for each URL accessed by the user that triggered this alert Lockout function Configure automatic lockouts To set up the lockout function 1 Click the checkbox corresponding to Lockout to display the Severity and Duration hours pull down menus at the right side of this window 2 Specify the Severity of the end users lockout Low choosing this option opens the Lockout by Cate gories pop up window see...

Page 99: ...ay alert function If using LDAP with an Active Directory username account and domain to set up the feature for System Tray alerts click the checkbox corresponding to System Tray and follow the instructions in Appendix B System Tray Alerts Setup Usage NOTE In order to use this feature the LDAP Username and Domain set up in the administrator s profile account see Chapter 3 in the Preliminary Setup S...

Page 100: ...t to open the Alert Viewer pop up window Fig 3 3 4 Alert Viewer The Alert Name Threshold Severity and Duration hours display along with any options specified in the Add a new Alert or Edit an Alert pop up window These options include Email Contacts checkbox es for Email Lockout and or System Tray features and Lockout Categories if a Low Severity was specified NOTE The System Tray alert feature is ...

Page 101: ...dit Alert to open the Edit an Alert pop up window Fig 3 3 5 Edit an Alert 2 The following items can be edited Alert Name Threshold Alert Action selections Email Lockout System Tray the latter is only functional for Active Directory LDAP Email Addresses Severity selection Duration hours selection 3 Click Submit to save your edits and to close the Edit an Alert pop up window ...

Page 102: ...e Alert Manager pop up window click Delete Alert to open the Delete Alert dialog box Fig 3 3 6 Delete Alert 2 Click Delete Alert to close the Delete Alert dialog box and to remove the alert from the Current Alerts box NOTE Clicking Cancel closes the dialog box without removing the alert and returns you to the Alert Manager pop up window ...

Page 103: ...In the Policy menu click Alert Log to open the Alert Log Viewer pop up window Fig 3 3 7 Alert Log Viewer The alert log contains a list of alert records for the most recent 24 hour time period Each record displays in a separate row For each row in the list the following infor mation displays Time the alert was sent using the YYYY MM DD HH MM SS military time format User username IP address IP addre...

Page 104: ... the Internet or using the network can only have his her workstation unlocked by an administrator To view the current lockout list 1 Go to the navigation panel and select URL Dashboard 2 Click Lockout to open the View All Lockouts pop up window Fig 3 3 8 View All Lockouts The lockout list contains records for all end users currently locked out of the Internet network Each end user s record display...

Page 105: ... corner of the pop up window to close it View a specified time period of lockouts If the lockout list is populated with many records using the Date Range feature will only show you records within the range of dates you specify 1 In the Date Range field click the calendar icon on the left to open the larger calendar for the current month with today s date highlighted TIP To view the calendar for th...

Page 106: ...ted date 5 Click Search Dates to display records for only the selected dates TIP Click Refresh to clear all records returned by the search query and to display the default records all lockout records in the window 6 Click the X in the upper right corner of the pop up window to close it Unlock a workstation 1 In the View All Lockouts pop up window click the record to highlight it 2 Click Unlock to ...

Page 107: ...etwork If more information is required in your analysis the R3000 s Real Time Probe tool or the Enterprise Reporter s Web Client if the ER server is installed and connected to your R3000 can be accessed via the TAR interface so you can generate customized reports to run for a time period of your specifications These functions are available to a group administrator only if permissions were granted ...

Page 108: ...on panel click Report Analysis to open that menu 2 Click Trend Chart to open the All Visible Gauges trend chart Fig 3 4 1 All Visible Gauges trend chart By default this chart contains the following information graphical depiction of last hour s end user Score for all visible URL dashboard gauges fixed time increments using the MM DD YYYY HH MM SS format all Enabled Gauges selected Timespan pull do...

Page 109: ...L dashboard gauge see Fig 3 2 15 2 Click Trend Chart to open the Trend Chart for that URL dashboard gauge Fig 3 4 2 Trend Chart for selected URL dashboard gauge By default this chart contains the following information graphical depiction of last hour s end user Score for that URL gauge fixed time increments using the MM DD YYYY HH MM SS format all library categories Enabled Categories selected Tim...

Page 110: ...rom the Timespan pull down menu One Hour this selection displays gauge score averages in 10 minute increments for the past 60 minute time period Six Hours this selection displays gauge score averages in 30 minute increments for the past six hour time period Twelve Hours this selection displays gauge score aver ages in one hour increments for the past 12 hour time period One Day this selection disp...

Page 111: ...al Internet usage trend data Access the R3000 Real Time Probe tool 1 In the navigation panel click Report Analysis to open that menu 2 Click R3000 Probe to launch the login window of the R3000 Real Time Probe interface NOTE See the Reporting screen chapter from the Global Admin istrator Section of the R3000 User Guide for information on configuring and using Real Time Probes Access the ER Web Clie...

Page 112: ... frequented you can target offending entities by performing a custom search to identify URLs being accessed in such library categories Perform a custom search View a list of Users who accessed a Category To view a list of end users who accessed a specified library category 1 In the navigation panel go to URL Dashboard and click Custom Search to open the Custom Search pop up window Fig 3 5 1 Custom...

Page 113: ...he Result field becomes activated Make a selection for the maximum number of users records to return in the results Top 10 Top 20 Top 50 Top 100 6 Click Search to display any records returned by the query in the table at the right side of the window see Fig 3 5 1 For each record in the table the following infor mation displays User username IP address Category name and the user s total Score for t...

Page 114: ...ails to display a list of records showing the Timestamp using the YYYY MM DD HH MM SS format and corresponding URL for each URL in the library cate gory the end user visited within the specified time period Fig 3 5 2 List of URLs visited by the user TIP Click Back to return to the previous page where you can perform another query You can now print the results displayed in this window or access a s...

Page 115: ...en the Print dialog box where you specify criteria for printing the report 3 After performing the intended actions in this window click the X in the upper right corner of this window to close it Access a URL 1 If a URL in the list is linked to a page or object select the URL in the list and then click Open URL to open the page object in a separate browser window 2 After performing the intended act...

Page 116: ... is comprised of three chapters with information on monitoring inbound and outbound traffic adjusting bandwidth gauge settings and using reports for analyzing network traffic data in order to more effectively manage your resources Chapter 1 Monitor Bandwidth Gauges This chapter explains how bandwidth gauges are used for monitoring inbound and outbound traffic Chapter 2 Modify Bandwidth Gauges This...

Page 117: ...ocol The latter type of bandwidth gauge is a subset of the former type of bandwidth gauge NOTE Unlike URL dashboard gauges protocol bandwidth gauges cannot be added to or removed from the interface However protocol port numbers can be changed based on end user utilization in your organization See Chapter 2 Edit Port Settings for information on changing port numbers to be moni tored Bandwidth Gauge...

Page 118: ...P UDP data port for file transfer 21 FTP TCP UDP control command port for file transfer SMTP Simple Mail Transfer Protocol gauge monitors the protocol used for transferring email messages from one server to another This protocol gauge is comprised of gauges for moni toring the following ports by default 25 SMTP TCP UDP port used for email routing between mail server email messages 110 POP3 Post Of...

Page 119: ...DP port for Napster 6881 TCP UDP port for BitTorrent IM Instant Messaging gauge monitors the protocol used for direct connections between workstations either locally or across the Internet This protocol gauge is comprised of gauges for moni toring the following ports by default 1863 TCP UDP port for MSN Messenger 5050 TCP UDP port for Yahoo Messenger 5190 TCP UDP port for ICQ and AOL Instant Messe...

Page 120: ...o open its menu 2 Click either Inbound or Outbound to open the View Incoming Outgoing Bandwidth Gauge pop up window Fig 4 1 1 View Incoming Bandwidth The total score in bytes KB MB GB displays in each of the following gauge icons HTTP FTP SMTP P2P IM The timespan for gauge activity displays beneath each gauge icon 3 Click the X in the upper right corner of the pop up window to close it ...

Page 121: ...idth usage for a specified protocol 1 In the View Incoming Outgoing Bandwidth gauge pop up window right click the bandwidth protocol gauge to open its pop up menu Fig 4 1 2 Bandwidth gauge pop up menu 2 Select View Gauge Details to open the protocol gauge s pop up window containing port gauges Fig 4 1 3 Protocol gauge pop up window ...

Page 122: ... activity Overall end user bandwidth gauge activity For a snap shot of all current bandwidth gauge activity ranked in order by the highest to lowest end user score use the Overall Ranking option see View Overall Ranking for bandwidth This option also lets you drill down and view information on bandwidth gauges affected by a specified end user End user activity by protocol gauge For a snapshot of a...

Page 123: ... default this window includes rows of records for each end user who is currently affecting one or more band width gauge for Outbound traffic For each record in the list the following information displays user IP address and corresponding Score in bytes End users are ranked in descending order by their byte score NOTE To view current bandwidth gauge activity for incoming traffic click Inbound 2 To ...

Page 124: ...click the bandwidth gauge to open its pop up menu see Fig 4 1 2 2 Choose View Rankings to open the bandwidth protocol gauge s ranking table pop up window Fig 4 1 5 Bandwidth Protocol Rankings By default this window includes rows of records for each end user who is affecting this protocol gauge For each record in the list the following information displays user IP address and corresponding Score in...

Page 125: ... s activity click the IP address to highlight it 4 Click User Summary to open the Individual User View pop up window see Fig 4 1 7 and perform any of the actions described for this window see Monitor Restrict Bandwidth Usage 5 Click the X in the upper right corner of this pop up window to close it View a port gauge ranking table To view details about a specified port gauge s current activity 1 Rig...

Page 126: ...ore in bytes End users are ranked in descending order by their byte score TIP To view current port gauge activity for outbound end user traffic click Outbound for inbound traffic click Inbound 4 To drill down and view additional information about an end user s activity click the IP address to highlight it 5 Click User Summary to open the Individual User View pop up window see Fig 4 1 7 and perform...

Page 127: ...ary to open the Individual User View pop up window Fig 4 1 7 Individual User View The Threat Assessment Levels for the username IP address display in this window including Gauge Read ings for each bandwidth gauge Protocol with the end user s corresponding score in bytes for Inbound and Outbound bandwidth traffic This window also includes the Duration hours pull down menu and Port View and Lockout ...

Page 128: ...dwidth port traffic 1 In the Individual User View pop up window see Fig 4 1 7 select the protocol gauge to highlight it 2 Click Port View to open the View Details pop up window Fig 4 1 8 View Details This window contains Port numbers and the end user s corresponding score in bytes for Inbound and Outbound bandwidth traffic 3 Click the X in the upper right corner of the window to close it ...

Page 129: ...unlocks his her workstation To unlock the end user go to the Lockout window in the URL Dashboard section of the naviga tion panel For information on this feature see Chapter 3 Alerts Lockout Management in the Configuration Section 3 Click Lockout to open the Lockout dialog box see Fig 3 2 20 TIP Click No to close this dialog box without locking out the user 4 Specify the Severity of the lockout fr...

Page 130: ...ies list box Click Sync All Categories after custom library categories have been added to the list in order to force synchronization between the R3000 and the TAR unit c After adding all library categories click Next to open the alert box stating The user has been locked out d Click the X in the upper right corner of the box to close it If a Medium or High severity was selected a Clicking Yes in t...

Page 131: ...f permissions were granted by the administrator who set up his her account as detailed in Chapters 2 and 3 of the Preliminary Setup Section Modify Protocol Gauge Settings 1 To modify a bandwidth protocol gauge s settings click Gauges in the Bandwidth section of the navigation panel to open the Bandwidth Gauges pop up window for All Protocol Gauges Fig 4 2 1 Bandwidth Gauges This window includes th...

Page 132: ...tings 1 To change a protocol gauge s port settings in the Band width Gauges pop up window see Fig 4 2 1 click Port Setup to open the Port Setup pop up window for Custom Port Setup Fig 4 2 2 Port Setup This window contains Current Setting fields for each Protocol port 2 To use a different port number other than one currently displayed in this window enter a valid port number for the Protocol 3 Clic...

Page 133: ...emand to show total gauge score averages for a specified limited time period All Bandwidth Gauges trend chart and the specified bandwidth protocol gauge trend chart View All Bandwidth Gauge Activity 1 In the navigation panel click Bandwidth to open that menu 2 Click Trend Chart to open the All Bandwidth Gauges trend chart Fig 4 3 1 All Bandwidth Gauges By default this chart contains the following ...

Page 134: ...ing Outgoing Bandwidth pop up window see Fig 4 1 1 2 Double click a bandwidth protocol gauge to open a pop up window displaying port gauges comprising that protocol gauge see Fig 4 1 3 3 Click Trend Chart to open the Trend Chart for that protocol gauge Fig 4 3 2 Trend Chart for selected protocol gauge By default this chart contains the following information graphical depiction of last hour s end u...

Page 135: ...r a Different Time Period To view a different time period of byte averages make a selection from the Timespan pull down menu One Hour this selection displays byte averages in 10 minute increments for the past 60 minute time period Six Hours this selection displays byte averages in 30 minute increments for the past six hour time period Twelve Hours this selection displays byte averages in one hour ...

Page 136: ...apter explains how the global administrator maintains criteria for Custom Categories set up on the source R3000 connected to this TAR server Chapter 2 View the Master User List This chapter explains the options for viewing end user information comprising the Master User List Chapter 3 View Administrator Activity This chapter explains how to use the Log Viewer to view activity performed on TAR by t...

Page 137: ...UIDE 125 Chapter 6 Install Software Updates This chapter explains how the global administrator installs software updates on the TAR server Chapter 7 View Hard Disk Status This chapter explains how to view the current hardware drive status on a TAR SL HL or H server with RAID technology ...

Page 138: ...nnected to this TAR server 1 In the navigation panel go to URL Dashboard and click Custom Categories to open the Custom Categories pop up window Fig 5 1 1 Custom Categories From this window details about custom categories can be viewed custom categories can be added or deleted and synchronization between the source R3000 and this TAR unit can be executed on demand 2 After performing the intended a...

Page 139: ...opulates fields checkbox es and tab s and activates the Delete Category button Fig 5 1 2 View Custom Category details To the right of the Custom Categories frame the Cate gory Name Description and the checkbox es corre sponding to the tab s configured for this custom cate gory display URL URL with wildcard Search Engine Keyword and URL Keyword 2 Click an available tab URLs URLs with Keyword URL Ke...

Page 140: ... uppercase charac ters 3 Enter the Description for the category 4 Click in any of the checkboxes to display the corre sponding elements below Fig 5 1 3 New custom category URL clicking this checkbox displays the URL field and URLs tab below URL with wildcard clicking this checkbox displays the URL with Wildcard field and URLs with tab below Search Engine Keyword clicking this checkbox displays the...

Page 141: ...can be entered is three e g yahoo com and the maximum number of levels is six e g mail attachments message yahoo com Search Engine Keyword type in up to 64 alphanu meric characters including spaces and then click Add to include the entry in the Keywords tab URL Keyword type in up to 64 alphanumeric charac ters and then click Add to include the entry in the URL Keywords tab TIP Prior to saving your...

Page 142: ...ed to TAR new custom categories that were added in TAR are added to the source R3000 custom category additions deletions that were made in the source R3000 are executed in TAR custom category additions deletions that were made in TAR are executed in the source R3000 custom library categories that were removed in the source R3000 are removed from TAR custom library categories that were removed in T...

Page 143: ...2 Click Delete Category to open the Delete Custom Cate gory dialog box Fig 5 1 4 Delete custom category TIP Click Cancel to close the dialog box and to return to the Custom Categories window 3 Click Delete Category to close the dialog box and to remove the category from the Custom Categories list This action also removes the category from the Custom Categories list on the source R3000 connected to...

Page 144: ...chronization can be forced between the two servers The View Master List window is available to a group admin istrator only if permissions were granted by the adminis trator who set up his her account as detailed in Chapters 2 and 3 of the Preliminary Setup Section 1 In the navigation panel click Administration to open that menu 2 Click User Profiles to open the View Master User List pop up window ...

Page 145: ... menu to specify the type of user search to perform PUID this selection performs a search by end user Personal User IDs IP this selection performs a search by end user IP addresses Display Name this selection performs a search by end user usernames IP addresses TIP To narrow your search criteria make an entry in the wildcard field by entering the beginning characters to be included in the search f...

Page 146: ...Summary to open the Individual User View pop up window see Fig 3 2 17 and perform any of the actions described for this window see Monitor Restrict End User Activity in the Configuration Section Chapter 2 Custom Gauge Setup Usage Synchronize TAR with the R3000 If changes were made to the user list on the LDAP server or on the source R3000 click Import Now to force synchroni zation between the serv...

Page 147: ...the most recent administrative activity performed on TAR by the global or group administrators for a period of time up to the past 30 days 1 In the navigation panel click Administration to open that menu 2 Click Log Viewer to open the Log Viewer pop up window Fig 5 3 1 Log Viewer 3 After performing the intended actions in this window click the X in the upper right corner of the window to close it ...

Page 148: ...Range field click the calendar icon on the left to open the larger calendar for the current month with today s date highlighted TIP To view the calendar for the previous month click the left arrow To view the calendar for the next month click the right arrow 3 Click the starting date to select it and to close the calendar pop up window This action populates the field to the left of the calendar ic...

Page 149: ... Type of search performed and if an administrator name was specified in the Search by Admin Name field The Target field displays information only as applicable for any of the following actions executed by the administrator AdminName Add New Group the Target column for this selection displays the group administrator name added in the Group Management window Add New Administrator the Target column f...

Page 150: ...ia the User Groups management panel Password Change the Target column for this selection displays the group administrator name of the entity whose password was modified in the Admin System window Delete Admin the Target column for this selection displays the group administrator name for the entity whose profile was deleted from the Admin System window Delete Group the Target column for this select...

Page 151: ...ia and add or delete an R3000 or ER 1 In the navigation panel click Administration to open that menu 2 Click Device Registry to display the Device Registry panel Fig 5 4 1 Device Registry At the top of the panel the following buttons display Sync All Devices click to open a pop up window that lets you specify which types of items to synchronize New R3000 click to open a panel that lets you add ano...

Page 152: ...ing labels icons and buttons display R3000 Enterprise Internet Filter server ER Enterprise Reporter server TAR Threat Analysis Reporter server envelope icon SMTP Server globe with link icon Proxy Server clock icon NTP Server asterisk icon Source R3000 server patch icon Patch Server Refresh Devices click this button if any square representing a device does not properly display in the interface Prev...

Page 153: ...0 device criteria 1 Click Edit to display the R3000 panel Fig 5 4 2 R3000 panel The Device Type R3000 displays and cannot be edited 2 Edit any of the following Name the name of the server IP IP address of the server Source R3000 if populated this checkbox displays greyed out If this checkbox is not populated and the R3000 will now be the source R3000 click in the checkbox to place a check mark her...

Page 154: ... to close this panel and to return to the main Device Registry panel 5 Click Save to save and process your information and to return to the main Device Registry panel where a square representing the R3000 device you added now displays Delete an R3000 from the registry Click Delete to delete an R3000 device from the registry and to remove the square representing that R3000 from the main Device Regi...

Page 155: ...e View edit TAR device criteria 1 Click Edit to display the Threat Analysis Reporter panel Fig 5 4 3 Threat Analysis Reporter panel On the left side of this panel the Device Type TAR Name of the server Threat Analysis Reporter and IP address es entered during the quick start wizard process display and cannot be edited On the right side of this panel fields and buttons for adding or removing a band...

Page 156: ...IP address range a Type in the Bandwidth IP address b Type in the Bandwidth Netmask c Click Add Range to add the bandwidth IP range in the list box To remove a bandwidth IP address range a Select the record for the IP range from the list box b Click Remove Range 3 After making edits in this panel click Save to save your entries and to return to the previous panel ...

Page 157: ...ise Reporter panel add device The Device Type Enterprise Reporter displays and cannot be edited 2 Type in the Name of the server 3 Type in the IP address of the server TIP Click Cancel to close this panel and to return to the main Device Registry panel 4 Click Save to save your entries and to return to the main Device Registry panel where a square representing the ER device now displays NOTE Once ...

Page 158: ...y panel in the square representing the ER device 1 Click Edit to display the ER panel Fig 5 4 5 ER panel edit The Device Type Enterprise Reporter displays and cannot be edited 2 Edit any of the following Name the name of the server IP IP address of the server TIP Click Cancel to close this panel and to return to the main Device Registry panel 3 Click Save to save your edits and to return to the ma...

Page 159: ...n Device Registry panel This action also adds the New ER button to the top of the panel View Other Device Criteria view only actions are performed in the main Device Registry panel for the following devices SMTP Patch Server NTP Server and Proxy Server View SMTP device criteria 1 Click View to open the SMTP pop up window Fig 5 4 6 SMTP window The following information displays Name of server Devic...

Page 160: ... passive 2 Click Close to close this pop up window View NTP Server device criteria 1 Click View to open the NTP Server pop up window The following information displays Name of server NTP Server Device Type NTP Server IP address 2 Click Close to close this pop up window View Proxy Server device criteria 1 Click View to open the Proxy Server pop up window The following information displays Name of s...

Page 161: ... and TAR devices and to activate the Synchronize button Categories Make this selection to sync 8e6 supplied library category updates and custom library categories from the source R3000 to TAR Source R3000 Devices Make this selection to sync information from all devices tied to the source R3000 server SMTP server patch server proxy server NTP server to TAR User Groups Make this selection to sync LD...

Page 162: ... her account as detailed in Chapters 2 and 3 of the Preliminary Setup Section Backup and restoration files include settings pertinent to the administrator who config ured the gauges and do not include other administrator s configuration settings By default TAR performs an automatic backup each morning at 2 00 a m storing up to seven days of automatic backup files NOTE In the event that TAR should ...

Page 163: ...st of up to seven of the most recent automatic backup files and any backup files created on demand by the administrator Automatic backup files display in the following format auto date in the MD format time in the HHMMSS format and year in the YYYY format For example auto 123 020001 2007 displays for an automatic backup executed on December 3 2007 at 2 00 01 2 00 a m and one second 3 After perform...

Page 164: ... section of the window enter the File Name for the backup file to activate the Backup Personal Data button Fig 5 5 2 Backup on demand 2 Click Backup Personal Data to back up current user settings saved in the interface Upon successfully executing the file backup the file name is added to the Restoration File list and a pop up box opens displaying the following message The operation was successful ...

Page 165: ...t the file to be restored by clicking on it to highlight it Fig 5 5 3 Restore Personal Settings 2 Click Restore Personal Settings to restore user settings from the selected file Upon successfully executing the file restoration a pop up box opens displaying the following message The operation was successful 3 Click the X in the upper right corner of the message box to close it ...

Page 166: ...and administrator and group settings cannot be restored 1 Click Restore to Factory Defaults to display the Backup Restore Global Data frame to the right of the Backup user configuration frame Fig 5 5 4 Restore to Factory Defaults 2 In the first field in this frame type in the eight case sensi tive alphanumeric characters exactly as displayed above 3 In the field below type in your administrator pa...

Page 167: ... new software update is available it is downloaded to TAR and an email message is dispatched to the global administrator whose email address was supplied during the TAR Wizard installation procedures This email informs the administrator of the software release version that is ready for installation Check for Available Software Updates To check the console for available software updates 1 In the na...

Page 168: ...rming the intended actions in this window click the X in the upper right corner of this window to close it Apply a Software Update If a software update is available 1 In the Install New Patches tab click the software update listed in the table to select and highlight it see Fig 5 6 1 2 Click README to open a pop up box containing informa tion about the software release Fig 5 6 2 Readme file 3 Afte...

Page 169: ... the browser s cache 8 Log back in to TAR using the login window NOTE See View Software Installation Details to determine whether the software was successfully applied Revert to a Previous Software Installation NOTE Only the most recently applied software update can be uninstalled unless the Description for the software update speci fies that the upgrade cannot be uninstalled WARNING If a software...

Page 170: ...NSTALL SOFTWARE UPDATES 158 8E6 TECHNOLOGIES THREAT ANALYSIS REPORTER USER GUIDE Fig 5 6 4 Software Update Patch History 2 Click Undo 3 Launch a new browser window 4 Clear the browser s cache 5 Log back in to TAR using the login window ...

Page 171: ... Software Installation Details To view information about the software installation 1 Click the View Software Update Log tab to display infor mation about the software update recently applied to the server Fig 5 6 5 Software Update View Software Update Log 2 Click the X in the upper right corner of the window to close it ...

Page 172: ...window Fig 5 6 6 Hardware Detector hard disks OK NOTE If the TAR server is a TAR S or TAR MSA unit when clicking Hardware Detector the following message displays in a pop up box This is not a RAID box Click the X in the upper right corner to close the pop up box If no hard disk failure has been detected on the TAR server with RAID the status of each hard drive displays as OK and the following mess...

Page 173: ...ANALYSIS REPORTER USER GUIDE 161 the Rebuild button displays at the bottom of the window in place of the status message Fig 5 6 7 Hardware Detector hard disk failure See Appendix C RAID Maintenance for information on troubleshooting RAID and replacing and rebuilding the hard drive ...

Page 174: ...r contact us by phone by email or in writing Hours Regular office hours are from Monday through Friday 8 a m to 5 p m PST After hours support is available for emergency issues only Requests for assistance are routed to a senior level techni cian through our forwarding service Contact Information Domestic United States 1 Call 1 888 786 7999 2 Select option 3 International 1 Call 1 714 282 6111 2 Se...

Page 175: ...ne Numbers 8e6 Corporate Headquarters USA 828 West Taft Avenue Orange CA 92865 4232 USA Local 714 282 6111 Fax 714 282 6116 Domestic US 1 888 786 7999 International 1 714 282 6111 8e6 Taiwan 7 Fl No 1 Sec 2 Ren Ai Rd Taipei 10055 Taiwan R O C Taipei Local 2397 0300 Fax 2397 0306 Domestic Taiwan 02 2397 0300 International 886 2 2397 0300 ...

Page 176: ... problem and attempt to resolve the issue directly If your issue needs to be escalated you will be given a ticket number for reference and a senior level technician will contact you to resolve the issue If your issue requires immediate attention such as your network traffic being affected or all blocked sites being passed you will be contacted by a senior level techni cian within one hour Your tro...

Page 177: ...ogies 8e6 Technologies warrants that the 8e6 product s do es not infringe on any third party copyrights or patents This warranty shall not apply to the extent that infringement is based on any misuse or modification of the hardware equip ment or software provided This warranty does not apply if the infringement is based in whole or in part on the customer s modification of the hardware equipment o...

Page 178: ...hnician can be reached by voice line Technical support information Online http www 8e6 com support html Toll Free 888 786 7999 press 3 Telephone 1 714 282 6111 press 3 E mail support 8e6 com Have the following information ready before calling tech nical support Product Description ______________________________ Purchase Date __________________________________ Extended warranty purchased __________...

Page 179: ...ts will be furnished as necessary to maintain the proper operational condition of the product s If parts are discontinued from production during the Warranty Period immediate replacement product s or hardware parts will be available for exchange with defective parts from 8e6 Technologies local reseller or distributor Extended Technical Support and Service Extended technical support is available to...

Page 180: ... instructions on how to disable pop up blocking software for the following products Yahoo Toolbar Google Toolbar AdwareSafe and Windows XP Service Pack 2 SP2 Yahoo Toolbar Pop up Blocker Add the Client to the White List If the Client was previously blocked by the Yahoo Toolbar it can be moved from the black list and added to the white list so that it will always be allowed to pass To do this 1 Go ...

Page 181: ...he Yahoo Pop Up Blocker dialog box Fig A 2 Allow pop ups from source 3 Select the source from the Sources of Recently Blocked Pop Ups list box to activate the Allow button 4 Click Allow to move the selected source to the Always Allow Pop Ups From These Sources list box 5 Click Close to save your changes and to close the dialog box ...

Page 182: ...e Client to the White List To add the Client to the white list so that it will always be allowed to pass go to the Google Toolbar and click the blocked icon Fig A 3 blocked icon enabled Clicking this icon toggles to the Site pop ups allowed icon adding the Client to your white list Fig A 4 Site pop ups allowed icon enabled ...

Page 183: ...and disabling pop up blocking Popup protection off by clicking the pop up icon 1 In the IE browser go to the SearchSafe toolbar and click the icon for popups blocked to toggle to Popup protec tion off This action turns off pop up blocking 2 After you are finished using the Client go back to the SearchSafe toolbar and click the icon for Popup protec tion off to toggle back to popups blocked This ac...

Page 184: ...ndows XP SP2 Set up Pop up Blocking There are two ways to enable the pop up blocking feature in the IE browser Use the Internet Options dialog box 1 From the IE browser go to the toolbar and select Tools Internet Options to open the Internet Options dialog box 2 Click the Privacy tab Fig A 5 Enable pop up blocking 3 In the Pop up Blocker frame check Block pop ups 4 Click Apply and then click OK to...

Page 185: ... go to the toolbar and select Tools Pop up Blocker Turn On Pop up Blocker Fig A 6 Toolbar setup When you click Turn On Pop up Blocker this menu selec tion changes to Turn Off Pop up Blocker and activates the Pop up Blocker Settings menu item You can toggle between the On and Off settings to enable or disable pop up blocking ...

Page 186: ...ur white list Use the IE Toolbar 1 With pop up blocking enabled go to the toolbar and select Tools Pop up Blocker Pop up Blocker Settings to open the Pop up Blocker Settings dialog box Fig A 7 Pop up Blocker Settings 2 Enter the Address of Web site to allow and click Add to include this address in the Allowed sites list box Click Close to close the dialog box The Client has now been added to your ...

Page 187: ...bar and select Tools Pop up Blocker Pop up Blocker Settings to open the Pop up Blocker Settings dialog box see Fig A 7 2 In the Notifications and Filter Level frame click the checkbox for Show Information Bar when a pop up is blocked 3 Click Close to close the dialog box Access the Client 1 Click the Information Bar for settings options Fig A 8 Information Bar menu options 2 Select Always Allow Po...

Page 188: ...S THREAT ANALYSIS REPORTER USER GUIDE 3 Click Yes to add the Client to your white list and to close the dialog box NOTE To view your white list go to the Pop up Blocker Settings dialog box see Fig A 7 and see the entries in the Allowed sites list box ...

Page 189: ...account and domain and is not available if using IP groups authentication NOTE In order to use this feature the LDAP Username and Domain set up in the administrator s profile account see Chapter 3 in the Preliminary Setup Section must be the same ones he she uses when logging into his her workstation LDAP server configuration Create the System Tray logon script Before administrators can use the TA...

Page 190: ...SIS REPORTER USER GUIDE 2 In the Run dialog box type in the path to the scripts folder C WINDOWS sysvol domain scripts 3 Click OK to open the scripts folder Fig B 2 C WINDOWS sysvol domain scripts window 4 Right click in this Windows folder to open the pop up menu ...

Page 191: ... launch a New Text Document Fig B 3 New Text Document 6 Type the following text in the blank document file echo off start X X X X win tartrayw32 exe ta X X X X in which X X X X represents the IP address of the TAR server and win tartrayw32 exe refers to the location of the TAR Alert executable file on the TAR server ...

Page 192: ...File Save As to open the Save As window Fig B 4 Save As dialog box 8 In the File name field type in the name for the file using the filename bat format For example tartray21 bat NOTE Be sure that the Save as type field has All Files selected 9 Click Save to save your file and to close the window ...

Page 193: ...m Tray logon script to as many administrators as needed 1 From the taskbar of the LDAP server go to Start Programs Administrative Tools Active Directory Users and Computers to open the Active Directory Users and Computers folder Fig B 5 Programs Administrative Tools Active Directory Users 2 In the Active Directory Users and Computers folder double click the administrator s Name in the Users list t...

Page 194: ...ve Directory Users folder 3 In the Properties dialog box click the Profile tab to display its contents 4 In the Login script field type in the bat filename For example tartray21 bat 5 Click Apply to save your entry 6 Click OK to close the dialog box 7 Click the X in the upper right corner of the folder to close the window ...

Page 195: ...t icon will not load in the System Tray if the TAR server is not actively running Use the TAR Alert icon s menu When right clicking the TAR Alert icon the following pop up menu items display Tar Admin Interface clicking this menu selection launches a browser window containing the TAR Adminis trator Interface s login window Reconnect clicking this menu selection re establishes the TAR Alert icon s ...

Page 196: ...pearance from the standard gauge to a yellow gauge pictured to the far left in the image below The following message appears briefly above the yellow gauge New 8e6 TAR Alert The following message displays whenever mousing over this icon New 8e6 TAR Alert If more than one alert is triggered for the administrator the message reads New 8e6 TAR Alert X Total in which X represents the total number of n...

Page 197: ...AR button displays beneath this message followed by the Close button If more than one alert was triggered the alert box includes the following message and button to the right of the Close button X more alerts in which X represents the number of additional alerts and the Next button 2 Click Logon to TAR to launch the TAR login window see Fig 1 1 1 If there are additional alerts click Next to view t...

Page 198: ... drives power supplies or fans NOTE As part of the ongoing maintenance procedure for your RAID server 8e6 recommends that you always have a spare drive and spare power supply on hand Contact 8e6 Technical Support for replacement hard drives and power supplies Part 1 Hardware Components The TAR H SL and HL RAID server contains two hard drives two power supplies and five sets of dual cooling fans 10...

Page 199: ...Part 2 Server Interface LED indicators in SL and HL units On an SL and HL unit the following LED indicators for software and hardware status monitoring display on the left side of the front panel LOG Log Download Status RAID Hard Drive Status DB Database Status UPDT Software Update Status ...

Page 200: ...SL and HL unit LED Indicator Color Condition Description LOG Green On Downloading a log Off No log download detected RAID Green On RAID mode enabled and running Off RAID mode is inactive Red On Hard drive fault or failure DB Green On Database is active Red On Database in inactive UPDT Amber On Software update detected Off No software update detected ...

Page 201: ... an icon alerts you to the status of that feature on the unit H chassis front panel SL chassis front panel HL chassis front panel The buttons and LED indicators for the depicted icons func tion as follows UID button On an H or HL server when the UID button is pressed a steady blue LED displays on both the front and rear of the chassis see also Rear of chassis These indicators are used for easy loc...

Page 202: ...n to displaying in the control panel this icon also displays on the front panel on each hard drive carrier Hard drive activity is indi cated by a green LED on an H or HL server and by an amber LED on an SL server An unlit LED on a drive carrier may indicate a hard drive failure See Hard drive failure in the Troubleshoot ing sub section for information on detecting a hard drive failure and resolvin...

Page 203: ...ndi cator displays when the UID button on the control panel is pressed This LED remains lit until the UID button is pressed again Power Supplies LED indicators The power supplies are located at the right on the rear of the chassis An LED indi cator is located above each of the power plugs See Power supply failure in the Troubleshooting sub section for infor mation on detecting a power supply failu...

Page 204: ... is sent to the admin istrator of the server This email identifies the failed hard drive by its number HD 1 or HD 2 Upon receiving this alert the administrator should verify the status of the drives by first going to the Hardware Detector window in the Administrator console WARNING Do not attempt to remove any of the drives from the unit at this time Verification of the failed drive should first b...

Page 205: ... Hardware Detector window The Hardware Detector window displays the current RAID Array Status for the two hard drives HD 1 and HD 2 Normally when both hard drives are functioning without failure the text OK displays above the hard drive number and no other text displays in the diagram However if a hard drive has failed the image of the drive displays in red and the message FAIL displays above the ...

Page 206: ...rive in the Administrator console go to the server to replace the drive Press the red release button to release the handle on the carrier and then extend the handle fully and pull the carrier out towards you Replace the failed drive with your spare replacement drive NOTE Contact Technical Support if you have any questions about replacing a failed hard drive ...

Page 207: ...has been replaced return to the Hardware Detector window in the Administrator console and click Rebuild to display instructions on how to proceed with the rebuild process Fig C 3 Hardware Detector window step 2 B Click Diagram to return to the previous display see Fig C 2 or click Rebuild Now to initiate the process for rebuilding the hard drive ...

Page 208: ...D Log back into the Administrator console and navigate to Administration Hardware Detector window that still displays the failed image see Fig C 2 E Click Rebuild again to redisplay the instructional page of the wizard see Fig C 3 F Click Rebuild Now again to initiate the drive rebuild process and to display a message stating that after the hard drive is rebuilt it will take a couple of hours for ...

Page 209: ...might display indicating that the server has timed out G If you log back into the Administrator console and navi gate to Administration Hardware Detector window note that the failed hard drive now displays an OK status even though the rebuild process has been initiated and is running in the background Fig C 6 Hardware Detector window rebuild steps completed ...

Page 210: ... The administrator of the server is alerted to a power supply failure on the chassis by an audible alarm and an amber power supply LED or an unlit LED on the front and rear of the chassis NOTE A steady amber power supply LED also may indicate a disconnected or loose power supply cord Verify that the power supply cord is plugged in completely before removing a power supply WARNING Be sure the corre...

Page 211: ...r supply module towards you 3 Note that an audible alarm sounds and the LED is unlit when the power supply is disengaged Replace the failed power supply with your spare replacement power supply The alarm will turn off and the LED will be a steady green when the replacement power supply is securely locked in place Step 4 Contact Technical Support Contact Technical Support to order a new replacement...

Page 212: ...urn Merchandise Authorization number and for instructions on returning the unit to 8e6 A steady red LED on and not flashing indicates an over heating condition which may be caused by cables obstructing the airflow in the system or the ambient room temperature being too warm Check the routing of the cables and make sure all fans are present and operating normally The LED will remain steady as long ...

Page 213: ...ories and sync them to the source R3000 FTP File Transfer Protocol is used for transferring files from one computer to another on the Internet or an intranet global administrator An authorized administrator of the network who maintains all aspects of TAR The global administrator configures TAR sets up user groups adminis trator groups and group administrators and performs routine maintenance on th...

Page 214: ... real time The report generated by the probe lets the administrator know whether end users are using the Internet appropriately search engine A program that searches Web pages for specified keywords and returns a list of the pages or services where the keywords were found SMTP Simple Mail Transfer Protocol is used for transfer ring email messages between servers synchronization A process by which ...

Page 215: ...omputers can send short messages sometimes known as datagrams to one another URL An abbreviation for Uniform Resource Locator the global address of Web pages and other resources on the Internet A URL is comprised of two parts The first part of the address specifies which protocol to use such as http The second part specifies the IP address or the domain name where the resource is located such as 2...

Page 216: ...APPENDICES SECTION APPENDIX D 204 8E6 TECHNOLOGIES THREAT ANALYSIS REPORTER USER GUIDE ...

Page 217: ...1 traffic monitoring 104 base group 21 57 definition 201 button terminology 4 byte score 62 111 123 C checkbox terminology 4 Ctrl key 15 custom category 126 definition 201 custom search 100 D device registry 139 dialog box terminology 4 disable pop up blockers 168 E Enterprise Reporter 35 Enterprise Reporter Web Client 77 environment requirements 7 ER 34 48 95 99 124 ...

Page 218: ...definition 201 group administrator 2 definition 201 H H server 186 hit score 61 75 104 HL server 186 How to access the Alert Manager window 83 access the Gauge Management window 53 add a new alert 84 add a new gauge 54 add a new gauge in the dashboard 59 drill down into a gauge 72 navigate the interface 12 14 set up email alert notifications 85 view an email alert 86 view end user gauge activity 7...

Page 219: ...plorer 7 10 171 IP group authentication method 177 IPGROUP 20 J Java virtual machine 8 K keyword dashboard gauge method 58 L LDAP 20 177 definition 202 server types supported 18 LED indicators 187 library categories definition 201 list box terminology 5 lockout 42 74 83 115 automatic 86 end user workstation 81 function 85 list management 92 manual 78 unlock workstation 94 log into TAR 11 out of TA...

Page 220: ... terminology 5 peer to peer definition 202 pop up blocking disable 168 pop up box window terminology 5 port gauge 60 number 105 Product Warranties section 165 protocol bandwidth gauge 60 105 definition 202 pull down menu terminology 6 Q quick start installation procedures 10 38 40 124 143 155 Quick Start Guide 9 R R3000 1 7 8 34 35 48 49 95 99 124 126 130 132 139 end user lockout 86 117 ...

Page 221: ...n custom category 128 Shift key 15 SL server 186 SMTP 106 definition 202 software updates 155 synchronization custom category update 79 118 definition 202 Master User List update 132 update device registry 139 system requirements 7 System Tray 177 T tab terminology 6 TCP 105 definition 202 technical support 162 text box terminology 6 threat score 51 61 assign weight 52 timespan 55 61 64 96 108 121...

Page 222: ...m category 128 dashboard gauge method 58 lock out user from bandwidth usage 117 lock out users from access 79 86 92 trend reports 95 trend reports for bandwidth usage 121 with wildcard in custom category 128 URL Keyword custom category 129 URL definition 203 W window terminology 6 wizard 9 11 39 workstation requirements 7 ...

Search results

Summary of Contents for TAR

Reviews:

Related manuals for TAR

Brands by name

Popular brands

8e6 Technologies TAR, User Manual

Search results

Summary of Contents for TAR

Reviews:

Related manuals for TAR

Brands by name

Popular brands