S
ECTION
1: P
RODUCTIVITY
R
EPORTS
U
SE
S
ECURITY
R
EPORTER
TO
CONDUCT
AN
INVESTIGATION
M86 S
ECURITY
E
VALUATION
G
UIDE
9
Use Security Reporter to conduct an investigation
Once Custom Category Groups and User Groups have been created, administra-
tors can begin running their first reports. In most cases, administrators will employ
the Security Reporter as a forensic tool to determine if anomalous Internet
behavior exists in their organization. In order to facilitate this process, the Security
Reporter menu structure is organized to follow the normal process flow of an inves-
tigation.
1. First, the administrator is greeted by a Dashboard of high-level productivity
report information showing data for Blocked Requests and bar graph charts for
Top Categories by Requests, Top Security Risks by Requests, Top Blocked
Users by Requests, and Top Users by Requests. At a glance, the administrator
can see if there is any anomalous behavior that needs investigation.
Additional productivity report content is available by consulting “
Summary
Reports
.”
By viewing either of these types of reports, a specific username might be iden-
tified as receiving a large number of blocked requests. Or a high rate of traffic
might be identified in the “PornographyAdult Content” category. If something is
detected that warrants further investigation, one would then proceed to the
“
Drill Down Reports
” section.
2. The next stage of the investigation, Drill Down Reports, lets the administrator
probe the multi-dimensional database to target the source of any Internet
threat.
For example, if there is unusually high page count in the “Pornography/Adult
Content” category, the administrator can drill down into the Category/User
section to determine who is viewing this material. Once a specific end user is
identified, the administrator can then delve into the detail page view section to
see the exact pages that end user has been visiting.
This detailed information provides a wealth of information on the exact time the
page was visited, the user’s IP address, whether the site was blocked by the
Web Filter or SWG, how it was blocked (e.g. in URL library, blocked keyword,
proxy pattern blocking, etc), and the full-length URL. By viewing this detail, the
administrator can obtain an accurate gauge of the user’s intent—whether the
user repeatedly attempted to go to a forbidden site or whether it was an isolated
incident.
3. The last stage of an investigation is to document the long-term activity of a
policy violator, since most organizations require more than one or two events to
reprimand a user. Once the administrator determines the name of the user and
the Web sites visited in the Drill Down Report, the next step is to run a custom
report. The administrator can run a specific search of the policy violator for a
custom time period by selecting the “
Report Wizard
” option. When generating
this type of report, a custom time scope, specific category, and name of a
specific end user can be specified.
As an example, the administrator would probably run a custom report for the
policy violator by specifying the category “Pornography/Adult Content” and all
activity within that category within the last month. The administrator can then
save a PDF version of the report for documentation purposes. This custom