M86 Security 700 Evaluation Manual

Security reporter
Hide thumbs Also See for 700:
Table of Contents

Advertisement

M86 Security Reporter
EVALUATION GUIDE
Models: 300, 500, 700, 705, 730, 735
Software Version: 3.0.00
Document Version: 10.30.10

Advertisement

Table of Contents
loading

Summary of Contents for M86 Security 700

  • Page 1 M86 Security Reporter EVALUATION GUIDE Models: 300, 500, 700, 705, 730, 735 Software Version: 3.0.00 Document Version: 10.30.10...
  • Page 2 Every effort has been made to ensure the accuracy of this document. However, M86 Security makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. M86 Security shall not be liable for any error or for incidental or consequential damages in connec- tion with the furnishing, performance, or use of this manual or the examples herein.
  • Page 3: Table Of Contents

    ONTENTS ............1 ECURITY EPORTER VALUATION UIDE Product Overview......................1 Note to Evaluators......................1 Install, Configure, and Test the Security Reporter............2 About this Evaluation Guide..................2 1: P ..............3 ECTION RODUCTIVITY EPORTS Understand the most common and useful features............ 3 Use Custom Category Groups to narrow your search.
  • Page 4 ONTENTS Step C: Specify Filters ..................... 22 Step D: Specify Other Report Components ..............23 Step E: Specify when to Generate the Report ..............23 Step F: Save the Report ....................24 Export Summary Drill Down Reports................27 How to export selected records ....................27 Step A: Select records to be exported ................
  • Page 5 ONTENTS Monitor Bandwidth gauges..................47 How to view the Bandwidth gauges Dashboard ..............47 How to drill down into a Bandwidth gauge ................48 Step A: View Bandwidth protocol traffic information ............48 Step B: View a user’s protocol usage information ............48 Step C: View a user’s port usage information ..............
  • Page 6 ONTENTS Step D: Populate the Email Settings frame ..............74 Step E: Save the report ....................74 Two methods for scheduling security reports............75 How to use Wizard panels for scheduling reports ..............75 Step A: Choose the method for scheduling the report ............. 75 Method 1: Use the current report view ...............
  • Page 7: Security Reporter Evaluation Guide

    Filter and/or M86 Secure Web Gateway (SWG) appliance(s), real time reports from a Web Filter, and security reports from an SWG. Using a Web Filter, you have the option to use an SR 300, 500, 700 or 730 Equus model, or an SR 705 or 735 IBM model.
  • Page 8: Install, Configure, And Test The Security Reporter

    Configuration Guide for information on setting up the Secure Web Gateway on your network. About this Evaluation Guide The M86 Security Reporter Evaluation Guide is divided into three sections to cover each of the basic reporting types: • Section 1: Productivity Reports •...
  • Page 9: Section 1: Productivity Reports

    1: P ECTION RODUCTIVITY EPORTS NDERSTAND THE MOST COMMON AND USEFUL FEATURES 1: P ECTION RODUCTIVITY EPORTS Understand the most common and useful features This section of the Evaluation Guide leads the evaluator through the most common and useful features of the Security Reporter, starting with the elements that should be configured first, then moving on to the usage of the many different types of reports available in the SR.
  • Page 10: Use Custom Category Groups To Narrow Your Search

    Prior to running any reports, there are a few recommended configuration steps that create a more customized experience for the evaluator. The first step is to create Custom Category Groups, which are customized groupings from the M86 Security library of more than 100 filter categories. For example, most customers prefer to set up a category group for those categories that are not allowed under their orga- nization’s Acceptable Use Policy.
  • Page 11: Use Custom User Groups To Narrow Your Search

    1: P ECTION RODUCTIVITY EPORTS SE CUSTOM ROUPS TO NARROW YOUR SEARCH • Bandwidth - In the Port Number field, type in a specific value in the pre-popu- lated field, and/or use the up/down arrow buttons to increment/decrement the current value by one, and then click Add Port > to move the selection to the Assigned Ports list box.
  • Page 12: Patterns Frame

    1: P ECTION RODUCTIVITY EPORTS SE CUSTOM ROUPS TO NARROW YOUR SEARCH New User Group panel 3. Enter at least three characters for the Group Name to be used for the new user group. 4. Click the checkbox(es) at the top of the panel to activate the pertinent corre- sponding frame(s) below: Patterns, IP Ranges, Single Users/Exclude.
  • Page 13: Ip Ranges Frame

    1: P ECTION RODUCTIVITY EPORTS SE CUSTOM ROUPS TO NARROW YOUR SEARCH IP Ranges frame The IP Ranges frame is used for specifying IP ranges to be used by the new group. Add user group, IP Ranges frame 1. To add an IP address range, do one of the following: •...
  • Page 14: Single Users/Exclude Frame

    1: P ECTION RODUCTIVITY EPORTS SE CUSTOM ROUPS TO NARROW YOUR SEARCH Single Users/Exclude frame The Single Users/Exclude frame is used for adding one or more users to the group. NOTES: Only users previously selected from the base user group will be included in the Available Users list.
  • Page 15: Use Security Reporter To Conduct An Investigation

    1: P ECTION RODUCTIVITY EPORTS ECURITY EPORTER TO CONDUCT AN INVESTIGATION Use Security Reporter to conduct an investigation Once Custom Category Groups and User Groups have been created, administra- tors can begin running their first reports. In most cases, administrators will employ the Security Reporter as a forensic tool to determine if anomalous Internet behavior exists in their organization.
  • Page 16: Use Summary Reports For A High Level Overview

    1: P ECTION RODUCTIVITY EPORTS UMMARY EPORTS FOR A HIGH LEVEL OVERVIEW report provides the necessary forensic information to support any internal repri- mand and to protect the organization in the event the incident goes to court. To summarize, the aforementioned steps were provided to give the user a most- likely use case for the Security Reporter.
  • Page 17: How To Generate A Summary Report

    1: P ECTION RODUCTIVITY EPORTS UMMARY EPORTS FOR A HIGH LEVEL OVERVIEW • Total Permitted vs. Blocked Requests - Pie chart report depicting the total Page Count for all filtering categories Permitted to pass and all filtering catego- ries set up to be Blocked. •...
  • Page 18 1: P ECTION RODUCTIVITY EPORTS UMMARY EPORTS FOR A HIGH LEVEL OVERVIEW 3. Click one of the report type thumbnails beneath the Date Scope to display that report view. 4. To see details for the generated Summary Report view, at the bottom of the report view, click a Download Report option for PDF, CSV, or PNG to generate a report in the specified file format (.pdf, .csv, or .png): Sample Bar Chart Summary Report in the PDF format...
  • Page 19: How To Export A Summary Report

    1: P ECTION RODUCTIVITY EPORTS UMMARY EPORTS FOR A HIGH LEVEL OVERVIEW The footer of the report includes the date and time the report was generated (M/D/ YY, HH:MM AM/PM), administrator login ID (Generated by), and Page number and page range. The body of the first page of the report includes the following information: •...
  • Page 20: Use Drill Down Reports For An Investigation

    1: P ECTION RODUCTIVITY EPORTS RILL EPORTS FOR AN INVESTIGATION Use Drill Down Reports for an investigation In the event that Summary Reports in the Security Reporter dashboard reveal abnormal activity, the next step in the investigation would be to drill down into the particular category or user information.
  • Page 21: Summary Drill Down Report Navigation

    1: P ECTION RODUCTIVITY EPORTS RILL EPORTS FOR AN INVESTIGATION • Top section - includes navigational links in the row beneath the navigation toolbar. Beneath this row, Report Type tabs let you generate another summary drill down report by clicking that tab (Categories, IPs, Users, Sites, Category Groups, or User Groups).
  • Page 22: Bandwidth And Time Columns

    1: P ECTION RODUCTIVITY EPORTS RILL EPORTS FOR AN INVESTIGATION sports.com, that user will have visited three pages. If that same user addition- ally visits www.espn.com/scores, the total number of sites visited would still count as three—and not as four—because the latter page is on the original ESPN site that was already counted.
  • Page 23: Column Sorting Tips

    1: P ECTION RODUCTIVITY EPORTS RILL EPORTS FOR AN INVESTIGATION Column sorting tips To sort summary report view records in ascending/descending order by a specified column, click that column’s header: Category Count, IP Count, User Count, Site Count, Bandwidth, Page Count, Object Count, or Time HH:MM:SS. Click the same column header again to sort records for that column in the reverse order.
  • Page 24: How To Generate A Detail Drill Down Report

    1: P ECTION RODUCTIVITY EPORTS RILL EPORTS FOR AN INVESTIGATION How to generate a Detail Drill Down Report By using the Summary Drill Down Report, the administrator should have narrowed the investigation to a specific category (e.g. “Pornography/Adult Content”) and a specific user name.
  • Page 25: Detail Drill Down Report Exercise

    1: P ECTION RODUCTIVITY EPORTS RILL EPORTS FOR AN INVESTIGATION • Category - Displays the category name (e.g. “Alcohol”). • User IP - Displays the IP address of the user’s machine (e.g. “200.10.101.80”). • User - Displays any of the following information: username, user IP address, or the path and username (e.g.
  • Page 26: Step D: Sort By "Content Type

    URL in the Web Filter category library and “Search KW” indicates a user typed in a prohibited word into a search engine text box. One of M86 Security’s differentia- tors is “Proxy Pattern Blocking,” which will show up in the “Content Type” section if an Internet proxy site was blocked by M86 Security’s proprietary proxy signature...
  • Page 27: Create A Custom Report For A Specific User

    1: P ECTION RODUCTIVITY EPORTS REATE A CUSTOM REPORT FOR A SPECIFIC USER Create a custom report for a specific user After reviewing the detail drill down report, if the administrator is confident that an individual has violated the Internet Acceptable Use Policy (AUP), the most common step to take next is to run a custom report for this specific individual that covers a greater time period period.
  • Page 28: Step B: Specify The Report Type

    1: P ECTION RODUCTIVITY EPORTS REATE A CUSTOM REPORT FOR A SPECIFIC USER Report Wizard panel for detail reports Step B: Specify the Report Type Summary report Make a choice for the Type of report to be generated; for this exercise, choose “Categories”...
  • Page 29: Step D: Specify Other Report Components

    1: P ECTION RODUCTIVITY EPORTS REATE A CUSTOM REPORT FOR A SPECIFIC USER For a detail report, select the username and click the right arrow ( > ) to move the username into the Added user names list box. Step D: Specify Other Report Components Specify criteria for the remaining components to be used in the report: •...
  • Page 30: Step F: Save The Report

    1: P ECTION RODUCTIVITY EPORTS REATE A CUSTOM REPORT FOR A SPECIFIC USER Step F: Save the Report 1. Click the Save button to display the Basic Options tab of the Report Wizard > Save Report panel: Report Wizard’s Save Report panel Basic Options tab 2.
  • Page 31 1: P ECTION RODUCTIVITY EPORTS REATE A CUSTOM REPORT FOR A SPECIFIC USER • Detailed Info - Uncheck any checkbox corresponding to a column that should not be included in the report. • Limit Detail Result - Indicate the maximum number of records to be included in the report, and whether these records will only include blocked end user queries, or also records of non-blocked end user queries.
  • Page 32 1: P ECTION RODUCTIVITY EPORTS REATE A CUSTOM REPORT FOR A SPECIFIC USER • Save and Email - Click this button to save your entries and to email the generated report to the designated recipient(s). After the report is emailed, the Saved Reports panel displays if you need to run this report again or another report.
  • Page 33: Export Summary Drill Down Reports

    1: P ECTION RODUCTIVITY EPORTS XPORT UMMARY RILL EPORTS Export Summary Drill Down Reports For this exercise, you will learn how to export a customized Summary Drill Down Report. How to export selected records Step A: Select records to be exported To only include specific records in the report, click the Uncheck All button at the bottom of the panel, and then click the checkboxes corresponding to the records to be exported.
  • Page 34: View And Print Options

    1: P ECTION RODUCTIVITY EPORTS XPORT UMMARY RILL EPORTS 1. In the Export pop-up box, enter the following information: • To field - Type in the email address of each intended report recipient, sepa- rating each address by a comma (,) and a space. •...
  • Page 35: Sample Report File Formats

    Text”, “PDF”, “Rich Text Format”, “HTML”, “Comma-Delimited Text”, “Excel (Chinese)”, “Excel (English)”. NOTES: M86 Security recommends using the PDF and HTML file formats over other file format selections—in particular for detail reports—since these files display and print in a format that is easiest to read. Lengthy text in PDF, HTML, and Rich Text Format files wraps around within the column so all text is captured without displaying truncated.
  • Page 36: Summary Drill Down Reporting Tools

    1: P ECTION RODUCTIVITY EPORTS UMMARY RILL EPORTING TOOLS Summary Drill Down Reporting tools The Security Reporter has a variety of different reporting options. In a fashion similar to the specific user report creation process, administrators can also create custom reports from any Drill Down Report view. These reports can be set up to be automatically emailed to the administrator on a regular basis in a variety of formats (e.g.
  • Page 37: Records Fields

    1: P ECTION RODUCTIVITY EPORTS UMMARY RILL EPORTING TOOLS At the Date Scope field, make a selection from the pull down menu for the time frame you wish to use in your query: “Today”, “Month to Date”, “Monthly", “Year to Date", “Daily", “Yesterday", “Month to Yesterday", “Year to Yesterday", “Last Week", “Last Weekend", “Current Week", “Last Month”.
  • Page 38: Filter And Filter String Fields

    1: P ECTION RODUCTIVITY EPORTS UMMARY RILL EPORTING TOOLS Filter and Filter String fields The filter fields are used for narrowing results that display in the current summary drill down report view. At the Filter field, make a selection from the pull-down menu for the filter term to be used: “None”, “Contains”, “Starts with”, “Ends with”.
  • Page 39: For Additional-Break Reports Only

    1: P ECTION RODUCTIVITY EPORTS UMMARY RILL EPORTING TOOLS For additional-break reports only The # Records and Sort By fields are used when exporting double-break and triple- break summary drill down reports and are deactivated by default. # Records field The # Records field is used for specifying the number of records that will display for the selected sort option.
  • Page 40: E-Mail / For E-Mail Output Only Fields

    1: P ECTION RODUCTIVITY EPORTS UMMARY RILL EPORTING TOOLS included in report views. Changing this selection will not affect the setting previ- ously saved in the Default Report Settings panel. E-Mail / For e-mail output only fields E-Mail fields are used for entering email criteria pertinent to the report to be sent to the designated addressee(s).
  • Page 41: Commonly Used Reports

    Internet threats arising from within the organization. M86 Security has created 10 different sample report formats to help first time users understand the various types of reports available in the Security Reporter. For purposes of this Evaluation Guide, only three of the 10 are described in detail below.
  • Page 42: Report Format

    1: P ECTION RODUCTIVITY EPORTS OMMONLY USED REPORTS • By Category/User/Site 3. From the open PDF file, the Sample Report can be exported in some of the following ways: • print the report - click the print icon to open the Print dialog box, and proceed with standard print procedures.
  • Page 43: Examples Of Available Sample Reports

    Examples of available Sample Reports Sample Report 1: “Top 20 Users by Category/User” This report shows the top 20 users for each of the categories in the M86 Security library. This is a useful tool to quickly scan for excessive use of any category.
  • Page 44: Sample Report 3: "By Category/User/Site

    1: P ECTION RODUCTIVITY EPORTS OMMONLY USED REPORTS Sample User/Sites report Sample Report 3: “By Category/User/Site” This is an example of a triple break report that shows all activity on the network, broken out by category, then user, and then site. This is a useful report if the administrator is looking for an all-encompassing view of Internet activity within the organization.
  • Page 45: Section 2: Real Time Reports

    2: R ECTION EPORTS NDERSTAND THE MOST COMMON AND USEFUL FEATURES 2: R ECTION EPORTS Real time reporting features are available if using a Web Filter with your Security Reporter. Understand the most common and useful features In this section of the Evaluation Guide, you will learn how to read URL Dashboard gauges that target areas on your network that could potentially endanger its secu- rity and/or usurp most of its bandwidth, and how to identify users who are violating your organization’s policies and prevent them from continuing to pursue such...
  • Page 46: How To Drill Down Into A Url Gauge

    2: R ECTION EPORTS ONITOR GAUGES How to drill down into a URL gauge This exercise will step you through the manual monitoring of users in real time via the URL gauges Dashboard. Note that this is simply one of many ways to use SR to monitor insider threats.
  • Page 47: Threat Level

    2: R ECTION EPORTS ONITOR GAUGES Threat Level The colored threat level indicates the current state of threat based on the customizable ceiling created by the administrator. For example, if the administrator creates a gauge with a threshold of 100, when the score reaches 67 the gauge dial will move into the red threat level section, the score will turn red, and a yellow warning triangle symbol will appear and begin to flash.
  • Page 48: Step C: View A List Of Threats The End User Accessed

    2: R ECTION EPORTS ONITOR GAUGES Step C: View a list of Threats the end user accessed In the Gauge Ranking panel, click the highest score in a column for a component; this action displays the Category View User panel showing a list of All Categories accessed by the selected end user for the gauge component: View a list of Threats accessed by the user for that gauge Step D: View URLs visited by the end user...
  • Page 49: Step E: Further Investigate A User's Activity

    2: R ECTION EPORTS ONITOR GAUGES Step E: Further investigate a user’s activity Now that you’ve identified the current trend of Internet activity on your network and targeted key participants engaging in undesired Internet usage, you can further investigate a specific end user’s activity and then take the appropriate steps for disciplinary action.
  • Page 50: How To View Url Trend Reports

    2: R ECTION EPORTS ONITOR GAUGES How to view URL Trend Reports SR lets you generate historical trend reports that show activity by URL threats for a specified time period. These trend reports are helpful for monitoring improve- ment of activity in a certain library category as well as providing a good tool for setting appropriate thresholds for each URL gauge.
  • Page 51: Step B: View A Line Chart For A Single Url Gauge

    2: R ECTION EPORTS ONITOR GAUGES Step B: View a line chart for a single URL gauge To uncover more information about activity in a particular gauge, click the pie slice for that gauge to view a line chart depicting that gauge’s activity within the specified time period: View activity for a specified gauge TIP: You can also go to the bottom of the pie chart and click a tab for a gauge to access...
  • Page 52: How To View A Pie Chart For A Url Gauge

    2: R ECTION EPORTS ONITOR GAUGES How to view a pie chart for a URL gauge Now that you know how to access a pie trend chart showing overall gauge activity and how to drill down to view a line chart for a specific gauge, you will next learn how to access a pie chart for a specific gauge.
  • Page 53: Monitor Bandwidth Gauges

    2: R ECTION EPORTS ONITOR ANDWIDTH GAUGES Monitor Bandwidth gauges Once you’ve seen how URL gauges help you monitor end user Internet traffic, you will probably want to explore the ways bandwidth gauges help you monitor inbound and outbound bandwidth usage on your network. How to view the Bandwidth gauges Dashboard The bandwidth gauges Dashboard gives you an overview of current end user bandwidth activity on your network.
  • Page 54: How To Drill Down Into A Bandwidth Gauge

    2: R ECTION EPORTS ONITOR ANDWIDTH GAUGES How to drill down into a Bandwidth gauge Looking at the bandwidth gauges Dashboard, you can see at a glance which band- width gauge has the highest score. To identify the end users affecting that gauge, you will need to drill down into that gauge.
  • Page 55: Step C: View A User's Port Usage Information

    2: R ECTION EPORTS ONITOR ANDWIDTH GAUGES User Summary panel showing the user’s bandwidth protocol usage Step C: View a user’s port usage information Now drill down and view a user’s port usage for a particular gauge. In the Gauge Readings frame, click the Gauge Name to activate the Category View button.
  • Page 56: How To View Bandwidth Trend Chart Activity

    2: R ECTION EPORTS ONITOR ANDWIDTH GAUGES How to view Bandwidth Trend Chart activity As you have seen with URL gauges, in addition to drilling down into a gauge to find out which end users are driving that gauge’s activity, you can get an overall picture of a bandwidth gauge’s current activity by generating a trend chart.
  • Page 57: Step B: View A Line Chart For A Single Bandwidth Gauge

    2: R ECTION EPORTS ONITOR ANDWIDTH GAUGES Step B: View a line chart for a single Bandwidth gauge To learn more about the activity for a particular gauge, click the pie slice for that gauge to view a line chart depicting that gauge’s activity within the specified time period: NOTE: The “score”...
  • Page 58: How To View Charts For A Specific Bandwidth Gauge

    2: R ECTION EPORTS ONITOR ANDWIDTH GAUGES How to view charts for a specific Bandwidth gauge In the bandwidth gauges Dashboard, click the Trend Charts icon in the bottom middle of the gauge to display a pie trend chart for that gauge: Bandwidth Gauge Trend Chart for a specified protocol (HTTP) Click the pie slice or tab below to view a line chart showing traffic for that port: Line chart for a specified port...
  • Page 59: Get The Complete Picture

    2: R ECTION EPORTS ET THE COMPLETE PICTURE Get the complete picture As you have seen so far, the real time reporting section of the SR user interface lets you monitor URL and bandwidth gauge activity on your network. Analyzing data from both sources will give you a complete picture of the user’s Internet usage behavior.
  • Page 60: How To Create A New Gauge

    2: R ECTION EPORTS ET THE COMPLETE PICTURE How to create a New Gauge After working with the URL and bandwidth gauges for awhile, you may want to customize the default gauges or create your own to more effectively monitor the type of traffic on your network.
  • Page 61: Step C: Specify Gauge Information

    2: R ECTION EPORTS ET THE COMPLETE PICTURE Add a New URL Gauge Step C: Specify Gauge Information Set parameters for the custom gauge by making the following entries/selections in the Gauge Information frame at the left side of the panel: Define Gauge Information and Gauge Components in the URL Gauge panel In the URL Gauge panel, do the following: 1.
  • Page 62: Step D: Select Users To Be Monitored By The Gauge

    2: R ECTION EPORTS ET THE COMPLETE PICTURE 5. In the Gauge Components accordion at the right side of the panel, go to the Available Categories/Groups box and move the “Adware”, “Alcohol” and “Art” selections into the Available Categories/Groups list box by selecting each cate- gory and then clicking the add >...
  • Page 63: Step E: Save Gauge Settings

    2: R ECTION EPORTS ET THE COMPLETE PICTURE Step E: Save gauge settings Once you click Save, the Add/Edit Gauges panel redisplays and includes the Gauge Name of the gauge you just added. Your new gauge is now ready to show traffic.
  • Page 64 2: R ECTION EPORTS ET THE COMPLETE PICTURE Select the Alerts option (sample Alerts panel with Bandwidth Gauges tab selected) 3. Choose the Gauge Name from the list in the left side of the panel, and then click New Alert to display the next panel where you set parameters for the alert: Add a New Alert (sample Bandwidth Gauges panel) M86 S ECURITY...
  • Page 65: Step B: Specify Alert Information

    2: R ECTION EPORTS ET THE COMPLETE PICTURE Step B: Specify Alert Information Set parameters for the alert by making the following entries/selections in the Alert Information frame at the left side of the panel: Specify Alert Information (sample Bandwidth Gauges panel) 1.
  • Page 66: Step C: Specify Criteria In The Right Side Of The Panel

    2: R ECTION EPORTS ET THE COMPLETE PICTURE Step C: Specify criteria in the right side of the panel If the Email Addresses accordion is closed, click to open it. Type in an Email Address and click the Add Email button. This is the address of the person who will be notified when an alert is triggered.
  • Page 67: Section 3: Security Reports

    3: S ECTION ECURITY EPORTS NDERSTAND THE MOST COMMON AND USEFUL FEATURES 3: S ECTION ECURITY EPORTS Security reporting features are available if using an SWG with your Security Reporter. Understand the most common and useful features This section of the Evaluation Guide supplies the evaluator information on employing basic tools in the Security Reporter to generate security reports using log feeds of an SWG appliance running software versions 9.2.x and higher.
  • Page 68: How To Modify The Current Report View

    3: S ECTION ECURITY EPORTS SE SECURITY REPORTS FOR A VIEW OF NETWORK ACTIVITY • Traffic Analysis - Shows activity for end user access of objects utilizing an excessive amount of network bandwidth. • Rule Transactions - Includes each instance in which an end user triggered a threshold in an SWG Security Policy.
  • Page 69 3: S ECTION ECURITY EPORTS SE SECURITY REPORTS FOR A VIEW OF NETWORK ACTIVITY • Click this icon to re-display the top six graphs and table of records (the default view) • Click this icon to display the table of records only: Sample records only view M86 S ECURITY...
  • Page 70: Create A Customized Security Report

    3: S ECTION ECURITY EPORTS REATE A CUSTOMIZED SECURITY REPORT Create a customized security report In addition to using one of the four basic security reports, you can generate a customized security report containing content relevant to the area of your network you wish to target.
  • Page 71: Step B: Populate The Report Details Frame

    3: S ECTION ECURITY EPORTS REATE A CUSTOMIZED SECURITY REPORT Security Report Wizard panel Step B: Populate the Report Details frame 1. In the Report Details frame, if using the Report Wizard to create the report, choose the Report Type from the pull-down menu (“Blocked Viruses”, “Security Policy Violations”, “Traffic Analysis”, “Rule Transactions”);...
  • Page 72: Step C: Use Accordions In The Users Frame

    3: S ECTION ECURITY EPORTS REATE A CUSTOMIZED SECURITY REPORT Step C: Use accordions in the Users frame In the Users frame, select one of the accordions and indicate criteria to include in the report to be generated: • By User Group - If selecting this option, choose the User Group for your report query results.
  • Page 73: Step D: Run The Report

    3: S ECTION ECURITY EPORTS REATE A CUSTOMIZED SECURITY REPORT Step D: Run the report Click Run to generate the security report view: Generated Security Report view The report can now be exported by selecting one of the two export options. M86 S ECURITY VALUATION...
  • Page 74: Capture The Security Report In Pdf Format

    3: S ECTION ECURITY EPORTS APTURE THE SECURITY REPORT IN FORMAT Capture the security report in PDF format How to export current report view data From the current report view, you can select specified records or all records to be exported in the PDF format, and then download or email the PDF on demand.
  • Page 75: Step C: Download Or Email The Report

    3: S ECTION ECURITY EPORTS APTURE THE SECURITY REPORT IN FORMAT Step C: Download or email the report Now you must choose whether to download or email the report. Option 1: Download the report To download the report in PDF format, click Download Report. The PDF file can be printed, saved, or emailed.
  • Page 76: Security Report Format

    3: S ECTION ECURITY EPORTS APTURE THE SECURITY REPORT IN FORMAT Security Report format The generated Security Report PDF file includes the following information: Sample PDF for Rule Transaction Security Report, page 1 The header of the generated report includes the date range, report type, and criteria details.
  • Page 77 3: S ECTION ECURITY EPORTS APTURE THE SECURITY REPORT IN FORMAT Sample PDF for Rule Transaction Security Report, page 2 M86 S ECURITY VALUATION UIDE...
  • Page 78: Save The Security Report You Generated

    3: S ECTION ECURITY EPORTS AVE THE SECURITY REPORT YOU GENERATED Save the security report you generated How to save a security report A security report can be saved only by using the “Report Settings” Save option. Step A: Select Report Settings, Save option In the current security report view, mouse over Report Settings and choose Save to display the Security Report Wizard panel for that report: Report Settings Save option...
  • Page 79: Step B: Specify Criteria In The Report Details Frame

    3: S ECTION ECURITY EPORTS AVE THE SECURITY REPORT YOU GENERATED Step B: Specify criteria in the Report Details frame 1. In the Report Details frame, type in the Report Name. 2. Specify the Report Time Span by choosing one of two options: •...
  • Page 80: Step D: Populate The Email Settings Frame

    3: S ECTION ECURITY EPORTS AVE THE SECURITY REPORT YOU GENERATED Step D: Populate the Email Settings frame 1. In the Email Settings frame, enter at least one Email address and then click Add to include the email address in the list box below. 2.
  • Page 81: Two Methods For Scheduling Security Reports

    3: S ECTION ECURITY EPORTS WO METHODS FOR SCHEDULING SECURITY REPORTS Two methods for scheduling security reports A security report can be scheduled to run using either the Report Settings Schedule method or the Security Report Wizard. Using the former method saves several steps, since the panel will be pre-populated with data from the current report view.
  • Page 82: Method 2: Create A Report Using The Wizard

    3: S ECTION ECURITY EPORTS WO METHODS FOR SCHEDULING SECURITY REPORTS Method 2: Create a report using the Wizard Navigate to Reports > Security Reports > Report Wizard to open the Security Report Wizard panel: Security Report Wizard panel Step B: Fill in the Report Details frame In the Report Details frame: 1.
  • Page 83: Step C: Include The Users Or Group In The Users Frame

    3: S ECTION ECURITY EPORTS WO METHODS FOR SCHEDULING SECURITY REPORTS • All URLs - Check this checkbox to export all URLs • Top - Specify the number of top URLs to be exported Step C: Include the users or group in the Users frame In the Users frame, select one of the accordions and indicate criteria to include in the report to be generated: •...
  • Page 84: Step E: Set The Schedule For Running The Report

    3: S ECTION ECURITY EPORTS WO METHODS FOR SCHEDULING SECURITY REPORTS Step E: Set the schedule for running the report 1. Go to the lower right corner of the panel and click Schedule Settings to open the Schedule Settings pop-up window: Schedule Settings pop-up window 2.
  • Page 85: How To Access And View The Report Schedule Panel

    3: S ECTION ECURITY EPORTS WO METHODS FOR SCHEDULING SECURITY REPORTS How to access and view the Report Schedule panel The Report Schedule panel is used for maintaining a schedule for generating a customized productivity or security report. Navigate to Reports > Report Schedule to display the Report Schedule panel: Report Schedule panel In the Report Schedule panel, reports scheduled to be run display as rows of records.
  • Page 86: View Details For A Scheduled Report Run Event

    3: S ECTION ECURITY EPORTS WO METHODS FOR SCHEDULING SECURITY REPORTS View Details for a Scheduled Report Run Event To view additional information on a scheduled report run event, select the record from the list to display the report schedule details frame to the right of the table of report records: View report schedule details The following information displays in this frame: Name assigned to the scheduled...

This manual is also suitable for:

500705300730735

Table of Contents