McAfee Content Security Reporter 2.6.x Installation Guide

Transcription

1 McAfee Content Security Reporter 2.6.x Installation Guide

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Content Security Reporter 2.6.x Installation Guide

3 Contents 1 Installation overview 5 Which type of installation do you need? First-time installation workflow Upgrade installation workflow System requirements 7 Requirements Compatible McAfee products Supported McAfee epo versions AWS port requirements Install software for the first time 9 Installing Content Security Reporter Download and install the product files Install the software Install the extension Upgrade to a new software version 11 Prepare for your upgrade Back up the current configuration Upgrade the software automatically Upgrade the software manually Update the database schema Post-installation tasks 17 Register the report server Select a database Configure a log source Configure a query Run a report Remove the software 19 Uninstall Content Security Reporter Remove the report server from McAfee epo Remove the extensions Remove the software Index 21 McAfee Content Security Reporter 2.6.x Installation Guide 3

4 Contents 4 McAfee Content Security Reporter 2.6.x Installation Guide

5 1 Installation 1 overview Contents Which type of installation do you need? First-time installation workflow Upgrade installation workflow Which type of installation do you need? You can install McAfee Content Security Reporter as a first-time installation or you can upgrade your current version to a newer version. First-time installation workflow To install Content Security Reporter for the first time, install the Content Security Reporter files on a system and then install the extension on McAfee epo. Content Security Reporter can co-exist with McAfee epo. See also Installing Content Security Reporter on page 9 McAfee Content Security Reporter 2.6.x Installation Guide 5

6 1 Installation overview Upgrade installation workflow Upgrade installation workflow You can upgrade Content Security Reporter to avail of the new features that the latest versions provide. See also Upgrade the software automatically on page 13 6 McAfee Content Security Reporter 2.6.x Installation Guide

7 2 System 2 requirements Contents Requirements Compatible McAfee products Supported McAfee epo versions AWS port requirements Requirements Verify that your computer and software meet the minimum requirements. Content Security Reporter 2.5 and later support McAfee epo There are no license restrictions to install Content Security Reporter. Hardware requirements Hardware requirements differ based on the size of your business needs. A specific hardware configuration is recommended for each customer type. Table 2-1 Hardware requirements Customer category Small Medium Large Hardware requirements Processor: 2.30 GHz (4 Core) Memory (RAM): 8 GB Processor: 2.30 GHz (8 Core) Memory (RAM): 24 GB Processor: 2.30 GHz (16 Core) Memory (RAM): 32 GB Software requirements Content Security Reporter supports 64-bit Microsoft server-class operating systems. McAfee Content Security Reporter 2.6.x Installation Guide 7

8 2 System requirements Compatible McAfee products Version Supported server operating systems 64-bit Windows Server 2008 Windows Server 2012 R2 Windows Server 2008 Service Pack 2 Windows Server 2016 Windows Server 2008 R2 Windows Server 2019 Windows Server 2012 For more information, see the Content Security Reporter Product Sizing Calculator. Compatible McAfee products Content Security Reporter is compatible with the following McAfee products. McAfee Advanced Threat Defense McAfee One Time Password (McAfee OTP) McAfee Common Catalog McAfee Web Gateway Cloud Service McAfee Gateway McAfee SiteAdvisor Enterprise McAfee Firewall Enterprise McAfee SmartFilter McAfee Network Security Manager McAfee Web Gateway Supported McAfee epo versions This release of Content Security Reporter is compatible with these McAfee epo versions. McAfee epo 5.3.1, or later McAfee epo 5.9.x McAfee epo 5.10.x We don't guarantee that Content Security Reporter works with other versions of McAfee epo. AWS port requirements For Content Security Reporter to start collecting log sources from HTTP, HTTPS, FTP, and FTPS and also to communicate with databases on Amazon Web Services (AWS), these ports must be opened. Default ports: 9121, 9111, 9112 If using internal database: 9129 If using external database: MySQL: 3306 Microsoft SQL Server : 1433 FTP / FTPS / SFTP: 21 and 22 Directories: McAfee Content Security Reporter 2.6.x Installation Guide

9 3 3 Install software for the first time Installing Content Security Reporter To set up Content Security Reporter, download the Content Security Reporter installation files from the McAfee downloads site, then install the extension and register the report server using McAfee epo. Contents Download and install the product files Install the software Install the extension Download and install the product files Download the Content Security Reporter product files from the McAfee Security Downloads page, then install them on your computer and McAfee epo. 1 Log on to your computer as an administrator. 2 Make sure that McAfee epo is installed and running correctly. 3 Download the product files. a Go to the McAfee Security Downloads page. b c Enter your Grant Number, then click Submit. Select and save these Content Security Reporter files for your operating system: Installation executable file appropriate for your computer Extension.zip file for McAfee epo 4 Install the software on the same system as McAfee epo or on a separate system that can communicate with McAfee epo. During installation, McAfee epo can be active. McAfee Content Security Reporter 2.6.x Installation Guide 9

10 3 Install software for the first time Installing Content Security Reporter If you use two computers, additional configuration might be needed to ensure that the computers can communicate through any firewall. a Run the installation executable file. b c Follow the on-screen prompts. When prompted, enter a passkey. Best practice: Use a strong passkey: Minimum of eight characters No spaces Case sensitive Mix of uppercase, lowercase, numeric, and special characters 5 Install the McAfee epo extension.zip file. a Log on to McAfee epo. b c Select Menu Software Extensions, then click Install Extension. Browse to the extension.zip file, then click OK. Install the software Install the Content Security Reporter software on your system. 1 Log on to the operating system as an administrator. 2 Run the installation executable file you downloaded, then follow the on-screen prompts. Install the extension Install the Content Security Reporter extension.zip file so it is available in McAfee epo. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Software Extensions, then click Install Extension. 3 Browse to the extension.zip file, then click OK. 10 McAfee Content Security Reporter 2.6.x Installation Guide

11 4 Upgrade 4 to a new software version Contents Prepare for your upgrade Back up the current configuration Upgrade the software automatically Upgrade the software manually Update the database schema Prepare for your upgrade Before you upgrade Content Security Reporter, you must back up your existing configuration settings and the internal database. Before you begin Close all files and folders that relate to Content Security Reporter. 1 Back up the current configuration settings, then save the backup.xml file on another computer. Save the backup.xml file on a different computer than the one you are using to upgrade Content Security Reporter. 2 If you are using an internal database, cancel all processing database maintenance jobs. a Log on to the McAfee epo server as an administrator. b c d e f g Select Menu Configuration Report Server Settings. From the Settings Categories menu, select Database Maintenance Status. Select all database maintenance jobs in process, then select Actions Cancel. From the Settings Categories menu, select Database Edit. Select the Connection Mode as Offline. Shut down the internal database service. McAfee Content Security Reporter 2.6.x Installation Guide 11

12 4 Upgrade to a new software version Back up the current configuration 3 If you are using an internal database, download the MariaDB internal database. a Verify that the available hard drive space is 1.5 times more than the reporting database. b Go to download MariaDB, then unzip the files to a temporary directory on the same computer where Content Security Reporter and its internal database reside. You can also download the MariaDB binaries with the Content Security Reporter software from the McAfee Product Downloads page. 4 If you are using an internal database, back up the existing internal database. a Verify that the McAfee Content Security Reporter Internal Database service is running. b From the command prompt, go to the bin directory in the MariaDB_Unzip folder, then execute the following command: mysqldump [-h localhost] -P u dba --password=dba reporting > (Any_Directory_Path)/mysqldata.sql Depending on the size of the internal database, the MySQL dump can take a long time. If you manually upgrade Content Security Reporter, save the MySQL dump file on a different computer than the one you are using to upgrade Content Security Reporter. Back up the current configuration You must back up the system settings so you can restore them after upgrading the software. 1 Select Menu Configuration Reporter Server Settings System Backup. 2 From the Setting Categories menu, select System Backup. 3 From the Actions menu, select Backup Now. 4 When the System Backup message appears, click OK. The backup process can take several minutes. A backup folder is created where is the time stamp. By default, this folder is created in C:\Program Files\McAfee\Content Security Reporter\reporter\conf\. A backup.xml file is saved in the backup folder. To create a backup file, wait until the file is created, then continue working without restoring it. Content Security Reporter includes the following settings in the backup file. Settings Database connection settings Description Saves the configuration settings that allow Content Security Reporter to communicate with the database. Database maintenance settings Saves scheduled database maintenance job settings and status messages. General settings Performance settings System status message Saves log source configuration and browse time settings. Saves database and system performance settings. Saves log parsing job history and database maintenance settings. If you plan to use the backup file after you uninstall and reinstall Content Security Reporter, save the backup file to a location other than the Content Security Reporter installation directory. 12 McAfee Content Security Reporter 2.6.x Installation Guide

13 Upgrade to a new software version Upgrade the software automatically 4 Upgrade the software automatically You can upgrade Content Security Reporter to the latest version to use the latest features and enhancements. In an automatic upgrade of the Content Security Reporter software, the internal data and settings are restored automatically after the upgrade. Before you begin If the mcc_help version earlier than installed on your system, uninstall the mcc_help extension before you upgrade. Verify that the following services are running. McAfee Content Security Reporter Server McAfee Content Security Reporter Internal Database or McAfeeCSRDefaultDB 1 Download the product files. a Start McAfee epo. b c d Go to the McAfee Product Downloads page. Under Download My Products, enter your grant number and click Go. Download the Content Security Reporter installation executable and extension.zip files. 2 Upgrade the Content Security Reporter server. McAfee epo can be active during this installation. a b c Log on to the operating system as an administrator. Run the installation executable file you downloaded. Follow the on-screen prompts to complete the installation. If you have more than 50 GB of data, use a supported external database. For more information, see the McAfee Content Security Reporter Product Guide. The amount of time it takes for the schema to update depends on the size of your database. For example, a database with 50 GB of data takes about 5 hours to update. 3 Upgrade the extension. a In McAfee epo, select Menu Software Extensions. b c Click Install Extension. Browse to the Content Security Reporter Help.zip file, then click OK. A message appears with the extensions installed or upgraded as part of the Content Security Reporter extension pack. Upgrade the software manually If the automatic software upgrade fails, you can manually upgrade the software. Before you begin If the mcc_help version earlier than installed on your system, uninstall the mcc_help extension before you upgrade. McAfee Content Security Reporter 2.6.x Installation Guide 13

14 4 Upgrade to a new software version Upgrade the software manually 1 Uninstall Content Security Reporter. 2 To reinstall Content Security Reporter, run the executable file you downloaded. 3 Verify that the following services are running. McAfee Content Security Reporter McAfeeCSRDefaultDB 4 If you are using an internal database, restore the MySQL internal database data. a Go to the [INTALLDIR]\reporter\mariadb\bin directory. b Execute the following commands: mysql -P u dba --password=dba drop database reporting; create database reporting; exit mysql -P u dba --password=dba reporting < mysqldata.sql The size of the internal database determines how long the upgrade takes to complete. Table 4-1 Internal database upgrade time estimates Internal database size 10 GB GB 1 30 GB GB 2 50 GB More than 3 Approximate time in hours If you have more than 50 GB of data, use a supported external database. For more information, see the McAfee Content Security Reporter Product Guide. 5 Log on to McAfee epo as an administrator, select Report Server Settings Database, then click Update Schema. The amount of time it takes for the schema to update depends on the size of your database. For example, a database with 50 GB of data takes about 5 hours to update. 6 Restore the Content Security Reporter data and settings. For more information about how to restore Content Security Reporter data and settings, see the McAfee Content Security Reporter Product Guide. After creating permission sets, if the Content Security Reporter is removed and reinstalled, you must enable those permissions again. To do this, you must edit and save each permission set. 14 McAfee Content Security Reporter 2.6.x Installation Guide

15 Upgrade to a new software version Update the database schema 4 Update the database schema You must update the database schema after upgrading Content Security Reporter, as the schema becomes out of date after the upgrade. Before you begin Make sure that you back up the database before updating the schema. The database schema is the definition of tables and fields used in the Content Security Reporter database. When Content Security Reporter detects that the database schema is out of date (such as after an upgrade), the database status is set to Offline. Schema is out of date. and an Update Schema button is provided. Depending on the size of your database, the database schema update can take a long time. 1 Select Menu Configuration Report Server Settings Database. 2 Click Update Schema. The database status appears as Connected. McAfee Content Security Reporter 2.6.x Installation Guide 15

16 4 Upgrade to a new software version Update the database schema 16 McAfee Content Security Reporter 2.6.x Installation Guide

17 5 Post-installation 5 tasks Contents Register the report server Select a database Configure a log source Configure a query Run a report Register the report server To start using Content Security Reporter you must register the report server with McAfee epo. 1 Log on to McAfee epo, then select Menu Configuration Registered Servers. 2 Click New Server. 3 From the Server type drop-down list, select Report Server. 4 Type a name for the server, or the IP address of the computer Content Security Reporter is installed on, then click Next. 5 Enter the server port, then enter the passkey you used during installation. 6 Click Test Settings. 7 Click Save. The report and database servers appear on the Registered Servers list. Select a database You can use the configured internal database, or configure Content Security Reporter to use a supported external database. 1 Select Menu Configuration Report Server Settings. 2 From the Setting Categories menu, select Database, then click Edit. McAfee Content Security Reporter 2.6.x Installation Guide 17

18 5 Post-installation tasks Configure a log source 3 In the Configuration section, choose one of these options: Select Default internal database. Select This external database, select the database type from the drop-down list, then configure the database settings. If you are using exernal database, it is recommended to partition the database. You can use Content Security Reporter to partition the database. 4 Click Save. Configure a log source You can configure a log source to collect your network data. 1 Select Menu Configuration Report Server Settings. 2 From the Setting Categories menu, select Log Sources. 3 From the Actions menu, select New. 4 Enter the log source name, configure the remaining options, then click OK. Configure a query You can configure a query to select the data that appears in your reports. 1 Select Queries & Reports Query. 2 Click New Query. 3 From the Database Type drop-down list, select Content Security Reporter. 4 Select the feature group and result type, then click Next. 5 Configure the remaining options, then click Run. 6 To save the query, click Save. Run a report You can run a report to view your organization's data. 1 Select Queries & Reports Report. 2 Click New Report. 3 From the Toolbox menu, click and drag the Query type to the Report Layout configuration area. 4 Configure the remaining options, click OK, then click Run. 18 McAfee Content Security Reporter 2.6.x Installation Guide

19 6 Remove 6 the software Uninstall Content Security Reporter To uninstall Content Security Reporter, remove the extensions from McAfee epo. You can use the Microsoft Windows Control Panel to remove the report server software. To remove Content Security Reporter, you must have administrator rights. Remove the report server from McAfee epo To uninstall Content Security Reporter, you must remove the Content Security Reporter report server from McAfee epo. 1 Select Menu Configuration Registered Servers. 2 Click Report Server, and select your configured server. 3 From the Action drop-down list, and select Delete. The configured report server is removed from the Registered Servers list. Remove the extensions To completely uninstall Content Security Reporter, you must remove the Content Security Reporter extensions from McAfee epo. The Catalog Framework and Core catalog extensions are installed with Content Security Reporter, but might be in use by other products. You can choose to remove these extensions from McAfee Common Catalog. 1 From McAfee epo, select Menu Software Extensions McAfee. 2 Select Help Content, then remove these extensions: mcc_help csr_help 3 Select Reporting, then remove the McAfee Content Security Reporter extension. McAfee Content Security Reporter 2.6.x Installation Guide 19

20 6 Remove the software Uninstall Content Security Reporter 4 Select Shared Components, then remove these extensions: Analytics Common Catalog Plugin Remove the software To remove Content Security Reporter, you must uninstall the Content Security Reporter report server software from the system where the Content Security Reporter files are installed. Before you begin Make sure you have administrator rights to remove Content Security Reporter. 1 In the Microsoft Windows Control Panel, select Programs and Features. You don't need to log off McAfee epo to remove the Content Security Reporter software. 2 Select McAfee Content Security Reporter, and click Remove. 20 McAfee Content Security Reporter 2.6.x Installation Guide

21 Index A analytics extension install 9, 10 I installation software 9 B backup current configuration 12 backup folder 12 C Common Catalog plugin install 9, 10 Content Security Reporter backup configuration 12 download product files 9 install extensions 9, 10 install software 9 remove extensions 19 remove software 20 report server 19 system backup 12 update database schema 15 upgrade software 13 D database schema update 15 E extensions install 9, 10 remove 19 H help content extension install 9, 10 Help Content extension remove 19 M managed platform, supported versions 8 P permissions remove extensions 19 remove software 20 R remove Content Security Reporter 19 overview 19 extensions 19 report server 19 software 20 report server remove 19, 20 remove extensions 19 reporting extension install 9, 10 Reporting extension remove 19 S saved configuration settings system backup 12 software remove 20 upgrade 13 supported management platform versions 8 system backup Content Security Reporter 12 system settings backup 12 McAfee Content Security Reporter 2.6.x Installation Guide 21

22 Index T troubleshooting back up configuration 12 U uninstall Content Security Reporter overview 19 uninstall (continued) extensions 19 software 20 update Content Security Reporter 15 database schema 15 upgrade Content Security Reporter 13 software McAfee Content Security Reporter 2.6.x Installation Guide

23 0-00