background image

S

ECTION

 1: P

RODUCTIVITY

 R

EPORTS

    

U

SE

 D

RILL

 D

OWN

 R

EPORTS

 

FOR

 

AN

 

INVESTIGATION

16

M86 S

ECURITY

 E

VALUATION

 G

UIDE

sports.com, that user will have visited three pages. If that same user addition-
ally visits www.espn.com/scores, the total number of sites visited would still 
count as three—and not as four—because the latter page is on the original 
ESPN site that was already counted.

• Page 

Count 

- displays the total number of pages visited. A user may visit only 

one site, but visit 20 pages on that site. If a user visits a page with pop-up ads, 
these items would add to the page count. If a page has banner ads that link to 
other pages, these items also would factor into the page count. In categories 
that use a lot of pop-up ads—porn, gambling, and other related sites—the page 
count usually exceeds the number of objects per page.

By clicking the link in this column, the detail report view displays data for all 
pages accessed, including hyperlinks to those pages. In the detail report view, 
you have the option to exclude Information columns for Category, User IP, User 
name, Site, Filter Action, Content Type, Content criteria, and Search String by 
deselecting the corresponding checkboxes via the Column visibility option.

• Object 

Count 

- displays the number of objects on a Web page. All images, 

graphics, multimedia items, and text items count as objects. The number of 
objects on a page is generally higher than the number of pages a user visits.

However, if an advertisement or banner ad (an object on the page) is actually a 
page from another site, this item would not be classified as an object but as a 
page, since it comes from a different server.

By clicking the link in this column, the detail report view displays data for all 
objects accessed, including hyperlinks to those objects. In the detail report 
view, you have the option to include Information columns for Category, User IP, 
User name, Site, Filter Action, Content Type, Content criteria, and Search 
String by deselecting the corresponding checkboxes via the Column visibility 
option.

NOTE

: If “Pages only” was specified in the Object Count frame of the Optional Features 

screen in the System Configuration user interface, 

all

 records of objects accessed by end 

users will be lost for the time period in which this option was enabled. Even if there were 
objects accessed by end users during that time period, zeroes (“0”) will display in the 
Object Count column in the report. See the Optional Features sub-section of the System 
Configuration Section for information about Object Count frame options.

Bandwidth and Time columns

In a summary drill down report view, the Bandwidth and Time columns provide 
additional information about a record.

• Bandwidth

 - Displays the amount of bandwidth in kB or MB used for each 

record, if using an SWG only with this SR.

• Time 

HH:MM:SS 

- Displays the amount of time a user spent at a given site. 

Each page detected by a user’s machine adds to the count. If a browser window 
is opened to a certain page and left there for an extended time period, and that 
page is refreshed by either the user or a banner ad, the counter starts again and 
continues as long as Web activity is detected. If that Web page contains an 
active banner ad that refreshes the page every 10 to 30 seconds, a user could 
show an incredibly high page count and many minutes, even though only one 
page was opened by that user.

Содержание 700

Страница 1: ...M86 Security Reporter EVALUATION GUIDE Models 300 500 700 705 730 735 Software Version 3 0 00 Document Version 10 30 10...

Страница 2: ...no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose M86 Security shall not be liable for any error or for inci...

Страница 3: ...Summary Report 11 How to export a Summary Report 13 Use Drill Down Reports for an investigation 14 How to generate a Summary Drill Down Report 14 Summary Drill Down Report navigation 15 Count columns...

Страница 4: ...eports only 33 For pie and bar charts only 33 Hide un Identified IPs checkbox 33 E Mail For e mail output only fields 34 Commonly used reports 35 How to generate a Sample Report 35 Report format 36 Ex...

Страница 5: ...he right side of the panel 60 Step D Save the alert 60 SECTION 3 SECURITY REPORTS 61 Understand the most common and useful features 61 Use security reports for a view of network activity 61 How to mod...

Страница 6: ...eduling the report 75 Method 1 Use the current report view 75 Method 2 Create a report using the Wizard 76 Step B Fill in the Report Details frame 76 Step C Include the users or group in the Users fra...

Страница 7: ...his view can be memorized and saved to a user defined report menu for repetitive scheduled execution and distribution Web Filter logs provide content for dynamic real time graphical snapshots of netwo...

Страница 8: ...Web Filter and or M86 Secure Web Gateway SWG appliance s must already be installed Either of these appli ances are required for this software release in order to send logs to the SR NOTE See the M86 W...

Страница 9: ...icy After stepping through this section of the Evaluation Guide you will understand how to set up powerful reports that can be e mailed on a regular basis thus mini mizing the effort required for ongo...

Страница 10: ...p reduces the time it takes to identify violations of this policy To create edit or delete a Custom Category Group navigate to Administration Custom Category Groups to display the Custom Category Grou...

Страница 11: ...p is to create User Groups which are customized groupings of users that reside on the organization s network For example most enterprise customers prefer to set up user groups for each department with...

Страница 12: ...one or more patterns in order to narrow the list of users to be included in the new group A pattern consists of a wildcard or a wildcard plus one or more alphanumeric characters 1 To add a pattern to...

Страница 13: ...P and Ending IP range in the Starting IP and Ending IP fields below If necessary edits can be made to these fields To add an IP address range without selecting from the Parent Ranges frame a Enter the...

Страница 14: ...splay in this list by using the Available Users Filter To use the Available Users Filter 1 Enter filter terms to narrow the selection of Available Users For example Type in 150 to only display results...

Страница 15: ...threat For example if there is unusually high page count in the Pornography Adult Content category the administrator can drill down into the Category User section to determine who is viewing this mate...

Страница 16: ...width Consumption for SWG only Bar chart depicting each top end user s total Mega Bytes for bandwidth requests Top 20 Users by Virus Hit Count for SWG only Bar chart report depicting each top end user...

Страница 17: ...access more detailed information about specified end user activity How to generate a Summary Report 1 To generate a Summary Report go to the navigation panel and click Reports Summary Reports to disp...

Страница 18: ...iew 4 To see details for the generated Summary Report view at the bottom of the report view click a Download Report option for PDF CSV or PNG to generate a report in the specified file format pdf csv...

Страница 19: ...ed label The body of the pages following the first page of the bar or pie chart report includes the following information Top 20 Users by Blocked Request report User NAME and corresponding BLOCKED REQ...

Страница 20: ...user activity IPs Includes Internet activity by user IP address Users Includes Internet activity by username Sites Includes activity on Web sites users accessed Category Groups Includes activity by Ca...

Страница 21: ...formation on using the reporting elements described in this sub section 4 The drill down view can be exported saved and or scheduled to run at a spec ified time Summary Drill Down Report navigation Co...

Страница 22: ...t but as a page since it comes from a different server By clicking the link in this column the detail report view displays data for all objects accessed including hyperlinks to those objects In the de...

Страница 23: ...porting a report only selected records are included To de select a record click the checkbox to remove the check mark from that checkbox To de select all records click Uncheck All at the bottom of the...

Страница 24: ...the suspected policy violator To generate a detail drill down report select the record and click the link in the Page Count column of the Summary Drill Down Report Detail Drill Down Report view Detai...

Страница 25: ...e time the log file was created Content Displays criteria used for determining the categorization of the record or N A if unclassified Search String Displays the full search string the end user typed...

Страница 26: ...g a suspected policy violator s Internet activity in the Detail Drill Down Report the administrator will have firm evidence on the user s intent which is critical forensic information to have in the e...

Страница 27: ...thod the productivity Report Wizard How to use the Report Wizard for a single user report The Report Wizard option provides an intuitive setup process for generating custom reports for one time use or...

Страница 28: ...e Includes viewed page results Specific User Detail by Object Includes viewed object results 2 Specify at least one of the following filters in the accordions at right to narrow your search for this e...

Страница 29: ...y report specify the number of records to be returned in the results Sort by Select column by which the results will be sorted and displayed in the report Order For a detail report indicate whether re...

Страница 30: ...ied IPs checkbox is de selected by default if the Hide Unidentified IPs checkbox is de selected in the Default Report Settings panel Output type Choose either E Mail As Attachment or E Mail As Link Fo...

Страница 31: ...report Report Wizard s Schedule Report panel a Enter a Name for the event b Select the Report to Run from the list c Select the frequency When to Run from the pull down menu Daily Weekly or Monthly I...

Страница 32: ...tries and to email the generated report to the designated recipient s After the report is emailed the Saved Reports panel displays if you need to run this report again or another report Saved Reports...

Страница 33: ...eld pull down menu specify the amount of data to be exported For this exercise choose Only selected rows on this page Step C Export data via Email or PDF Download 1 Make selections and or entries in a...

Страница 34: ...specified file format The view option lets you make any necessary adjustments to your report file settings prior to printing the report To print the report you must have a printer configured for your...

Страница 35: ...columns may display with truncated text but an entire column can be viewed by mani pulating the column width in the generated report file These reports can then be printed at a smaller percentage tha...

Страница 36: ...ick this radio button to only include the first set of records returned by the report query 3 Indicate the number of records to be included in a set by making an entry in the blank field represented h...

Страница 37: ...are stored on the SR Yesterday This option generates the report view for yesterday only Month to Yesterday This option generates the report view for the range of days that includes the first day of th...

Страница 38: ...ke a selection from the pull down menu for one of the available choices for which the summary report results will be limited Top Category Count Top IP Count Top User Count Top Site Count Top Page Coun...

Страница 39: ...s Category Group or User Group pie chart or bar chart report and determines by which column the report will be sorted By default the field displays greyed out and becomes activated when a pie or bar c...

Страница 40: ...ressee s Specify the following in the E Mail or For E Mail output only fields To Enter the email address of each intended report recipient separating each address by a comma and a space Subject Type i...

Страница 41: ...s created 10 different sample report formats to help first time users understand the various types of reports available in the Security Reporter For purposes of this Evaluation Guide only three of the...

Страница 42: ...ty Reporter and date range for today s date MM DD YYYY format report name description for that report type including the sort order and Page Count descending The body of the report contains rows of re...

Страница 43: ...the categories in the M86 Security library This is a useful tool to quickly scan for excessive use of any category Sample Category Users report Sample Report 2 Top 20 Sites by User Site This report w...

Страница 44: ...ple break report that shows all activity on the network broken out by category then user and then site This is a useful report if the administrator is looking for an all encompassing view of Internet...

Страница 45: ...our organization s policies and prevent them from continuing to pursue such activities Monitor URL gauges When clicking Gauges in the navigation toolbar the URL Dashboard displays URL dashboard with U...

Страница 46: ...of the gauge that is based upon the number of URL page hits see NOTE below that occur in this specific category in a given period of time NOTES In addition to page hits SR also counts blocked object...

Страница 47: ...or can react quickly Step B Identify the source of a gauge s activity Each gauge is comprised of one or more gauge components derived from library categories in the Web Filter Sometimes end user activ...

Страница 48: ...he Category View User panel showing a list of All Categories accessed by the selected end user for the gauge component View a list of Threats accessed by the user for that gauge Step D View URLs visit...

Страница 49: ...by clicking the greyish white Back button at the bottom left of the panel Click the User Name link for that user to display the User Summary panel View the user s gauge activity in the User Summary p...

Страница 50: ...o Reports URL Trend Charts to display the URL Trend Charts panel URL Trend Charts panel The pie trend chart is divided into pie slices named for each gauge in which there was activity The size of each...

Страница 51: ...g that gauge s activity within the specified time period View activity for a specified gauge TIP You can also go to the bottom of the pie chart and click a tab for a gauge to access the line chart for...

Страница 52: ...dle icon at the bottom of the gauge The gauge Trend Charts icon 2 The action of clicking the Trend Charts icon displays a pie Gauge Trend Chart for that gauge Gauge Trend Chart Note the pie slices in...

Страница 53: ...urrent end user bandwidth activity on your network To display this panel first select Gauges and then click the Bandwidth tab above the Dashboard Bandwidth gauges Dashboard Default bandwidth gauges in...

Страница 54: ...le showing all end user traffic for that protocol View bandwidth used by each end user for the protocol To the right of the User Name column are port numbers that comprise the protocol The number of b...

Страница 55: ...idth protocol usage Step C View a user s port usage information Now drill down and view a user s port usage for a particular gauge In the Gauge Readings frame click the Gauge Name to activate the Cate...

Страница 56: ...display the BandWidth Trend Charts panel BandWidth Trend Charts panel The pie trend chart is divided into pie slices named for each bandwidth gauge in which there was activity The size of each slice...

Страница 57: ...gauge To learn more about the activity for a particular gauge click the pie slice for that gauge to view a line chart depicting that gauge s activity within the specified time period NOTE The score on...

Страница 58: ...idth gauge In the bandwidth gauges Dashboard click the Trend Charts icon in the bottom middle of the gauge to display a pie trend chart for that gauge Bandwidth Gauge Trend Chart for a specified proto...

Страница 59: ...ws you a list of users affecting URL gauges and Bandwidth gauges all in one panel This ranking table is accessed by navigating to Gauges Overall Ranking Overall Ranking table Note the URL frame to the...

Страница 60: ...he panel by that name Select Add Edit Gauges By default the URL Gauges tab displays showing the list of URL gauges in the frame to the left If you wish to create a bandwidth gauge click the Bandwidth...

Страница 61: ...he following entries selections in the Gauge Information frame at the left side of the panel Define Gauge Information and Gauge Components in the URL Gauge panel In the URL Gauge panel do the followin...

Страница 62: ...Groups list box by selecting each cate gory and then clicking the add button Define Gauge Information and Gauge Components Step D Select users to be monitored by the gauge 1 Click the User Membership...

Страница 63: ...time How to create an automated gauge alert This section will step you through the process of creating an automated threshold per user so you can be automatically notified via email and the violating...

Страница 64: ...Select the Alerts option sample Alerts panel with Bandwidth Gauges tab selected 3 Choose the Gauge Name from the list in the left side of the panel and then click New Alert to display the next panel...

Страница 65: ...heckbox is selected For a URL gauge a Low selection will lock out the user by the categories monitored by the specified URL gauge only For a bandwidth gauge a Low selection will lock out the user by t...

Страница 66: ...hen an alert is triggered You can add multiple email addresses Specify email criteria sample Bandwidth Gauges panel For a URL gauge alert if a Low Lockout was specified click the Low Lockout Component...

Страница 67: ...ith productivity reports security reports generated in the Security Reporter are easily customizable and can be saved exported or scheduled to run on a regular basis Use security reports for a view of...

Страница 68: ...chart displays the name of the record along with the total hit count or bandwidth used in that record The Rule Transactions report also includes Actions and Policies information By default the bottom...

Страница 69: ...Y REPORTS FOR A VIEW OF NETWORK ACTIVITY M86 SECURITY EVALUATION GUIDE 63 Click this icon to re display the top six graphs and table of records the default view Click this icon to display the table of...

Страница 70: ...ustomized security report One method is by using the Report Settings Run feature and the other method is by generating a report view using the Report Wizard Step A Choose a Run option Option 1 Report...

Страница 71: ...ull down menu Today default Month to Date Year to Date Yesterday Month to Yesterday Year to Yesterday Last Week Last Weekend Current Week Last Month Date Range If using the Report Settings Run feature...

Страница 72: ...he end user IP address for filtering your results using the wildcard to return multiple IP addresses and then click Preview Users to display query results in the list box below For a Traffic Analysis...

Страница 73: ...CUSTOMIZED SECURITY REPORT M86 SECURITY EVALUATION GUIDE 67 Step D Run the report Click Run to generate the security report view Generated Security Report view The report can now be exported by selec...

Страница 74: ...he table and then clicking Export Selected Clicking either button opens the Export Report pop up window Export Report pop up window Step B Specify Break Type and URL limitation criteria 1 In the Expor...

Страница 75: ...printed saved or emailed Option 2 Email the report To email the report 1 Enter at least one Email address and then click Add to include the email address in the list box below 2 Specify the Delivery...

Страница 76: ...Generated by Filter information and Page number and page range The body of the first page of the report includes a bar chart showing the top six graphs with count indicators and the report name The bo...

Страница 77: ...SECTION 3 SECURITY REPORTS CAPTURE THE SECURITY REPORT IN PDF FORMAT M86 SECURITY EVALUATION GUIDE 71 Sample PDF for Rule Transaction Security Report page 2...

Страница 78: ...generated How to save a security report A security report can be saved only by using the Report Settings Save option Step A Select Report Settings Save option In the current security report view mous...

Страница 79: ...top URLs to be exported Step C Select the users or group in the Users frame In the Users frame select one of the accordions and indicate criteria to include in the report to be generated By User Group...

Страница 80: ...dress in the list box below 2 Specify the Delivery method for the email address To default Bcc or Cc 3 Type in the Subject for the email message 4 If you wish enter text to be included in the Body of...

Страница 81: ...Security Report Wizard Using the former method saves several steps since the panel will be pre populated with data from the current report view How to use Wizard panels for scheduling reports Step A C...

Страница 82: ...redefined Ranges If using the Report Wizard to generate and save a report this option is selected by default If choosing this option make a selec tion from the pull down menu Today default Month to Da...

Страница 83: ...n the list box below For a Traffic Analysis or Rule Transactions report you can narrow your search result by including filters 1 Click Filters at the bottom right of the panel to display the filter re...

Страница 84: ...cheduling 3 Select the frequency When to Run from the pull down menu Daily Weekly or Monthly If Weekly specify the Day of the Week from the pull down menu Sunday Saturday If Monthly specify the Day of...

Страница 85: ...o display the Report Schedule panel Report Schedule panel In the Report Schedule panel reports scheduled to be run display as rows of records The following information is included for each record Name...

Страница 86: ...the right of the table of report records View report schedule details The following information displays in this frame Name assigned to the scheduled event selected Report to Run interval When to Run...

Отзывы: