Network Visibility - Reporting

Transcription

1 January 11, 2011 Author: Audience: SWAT Team Evaluator Product: Cymphonix Network Composer EX Series, XLi OS version 9 Network Visibility - Reporting This document is focused on the Cymphonix Network Composer s award winning and live reporting engine. Through the live reporting engine, located under the Report Tab on top of the navigation pane, an administrator can quickly and easily correlate and filter through vast amounts of data to find actionable reports that will help them better manage their network. Live reporting is the ability to start with a broad set of data and quickly correlate and filter down to very specific pieces of data. Much of this is accomplished using the report options field above the graph and the RIGHT CLICK correlation menus available when Right Clicking on any results in the Details pane. As you run through the reporting test cases use the filters and right click options to drill down into data. In addition, Network Composer allows the user to open multiple tabs in the interface, save reports to an in application favorites list, and setup automatic broadcasts of reports. The ability to open a report in a new tab can be found when you right click on a report or right click on some data in the details pane. Overview based reports Network Node Directory User These reports allow you to quickly see who (by IP, user, or group) is responsible for the largest amount of data consumption for a specified time interval. From these reports you can further drill down with the live reporting engine as needed. As an example, let s say you get a request for more information relevant to a specific event happening on the network. Let s use Network Composer's live reporting engine to help us figure out what is going on, who is doing it, and what time of day it was done at. You get an alert from HR that one of the machines, IP address x.y.z.a, might be doing something inappropriate earlier today. However, they did not give you any more details. Let s look at what Network Composer can tell us about this network node. Begin by running a Network Node overview report Sandy Parkway Salt Lake City, UT

2 How to run a Network Node Overview report 1. Navigate to Report Tab -> Users -> Network Node Overview. This report is used to identify the top Network Nodes on the network in order of total traffic generated. As more users and/or nodes are discovered and added to the system, Network Composer will show these profiles 25 at a time. In the report options field you can change the selected date range, always last 24 hours by default, or quickly search for a specific IP address or directory user or group name. 2. Locate the specific node (IP address) that is in question within the details section and left click on it. You can find the details section below the graph. This takes you to the Network Node Detail report. The detail report is a combination of relevant data that has been collected on the selected node. This information includes the total traffic shown over time (What time of day was the traffic passed?), application traffic (What applications were being used by this node?), any Port-based signature traffic (Any custom applications that we may not have a signature for), top web hosts visited, top web categories, and any spyware or viruses that the user may be infected with.

3 Keep in mind that these are overview reports and subsequently show you the top 10 results for each given report. You ll also notice the titles of most of these reports are hyperlinked so you can easily click and gain immediate access to the full report which contains all of the data. 3. Left click Application Traffic 4. You will now be looking at the full report that contains the application set overview for that specific node. You can see that we are filtering by that specific node up in the top filter bar about the graph. You can change this filter, add nodes to the filter, or make other changes as needed.

4 Tip: There is a blue arrow in between the Admin tab and the report title bar. This arrow will let you move back to the previous screen. Using your browsers back arrow will result in an error message. Press the blue arrow to return to the Network Node detail report. How to run a Directory User Overview report The same scenario is likely to be given to you in regards to a specific user on the network. You get an alert from HR that a specific user might be doing something inappropriate earlier today. However, they did not give you any more details. Let s look at what Network Composer can tell us about this user by running a Directory User Overview report. 1. Navigate to Report Tab -> Users -> Directory User Overview. This report is used to identify the top Directory Users on the network in order of total traffic generated or to get a Directory User Detail report on a specific user. 2. Locate the specific Directory user that is in question within the details section and left click on their name. You can find the details section below the graph. This takes you to the Directory User Detail report. The detail report is a combination of relevant data that has been collected on the user. This information includes the total traffic shown over time (What time of day was the traffic passed?), application traffic (What applications were being used by this user?), any Port-based signature traffic (Any custom applications that we may not have a signature for), top web hosts visited, top web categories, and any spyware or viruses that the user may be infected with.

5 3. Click on the report labeled Web Requests by Hosts to quickly identify all the web sites the user has visited and identify any violations the HR department would be interested in and even e- mail the report if need be.

6 Application Reports Total Traffic Application Set Applications When performing an HR or security incident response, or when investigating how much bandwidth is being consumed is it vitally important to know who is passing the traffic, how much traffic was generated, what type of traffic is it, and what time of day was the traffic being generated. Once you gather this information you can make informed decisions when it comes to generating content filtering policies or shaping policies. Application Sets An application set is a grouping of applications that share a common theme. For example the Paging and Collaboration application set will contain SMTP, POP, IMAP, Webmail, etc, on the side. By grouping applications this way, administrators can quickly navigate through all of the applications to get a better view of what is going on. If you need to get specifics by application, you can Right Click and correlate by application. 1. Navigate to Report Tab -> Applications -> Application set overview. This report is where you will see how your total traffic, over a selected time frame, breaks down into Application Sets. An application set is a logical container of applications. Now you are able to see what application sets are consuming your bandwidth and exactly how much data is associated to each one. 2. As mentioned before, you can benefit from this live reporting style because you can always drill deeper down into your results listed in the Details pane. Hover over line item number 1 in the report details section; this will likely be streaming media or HTTP. (1) Right click any of the application sets followed by (2) highlighting report correlations. At this point you ll notice you have several options or correlations available to you. The option you choose depends on what data you want. (3) For this example click Correlate by Network Node, and you will see the nodes responsible for the selected Application Set.

7 Applications You can correlate any Application Set by application allowing you to see how much data is associated to unique applications. 1. Navigate to Report Tab -> Applications -> Application Set Overview. Hover over line item number 1 in the report details section and right click -> highlight report correlations -> correlate by application. If you have chosen Streaming Media you will likely see MIME Type: Video/X-flv, commonly referred to as Flash, or MIME Type: audio/mpeg as the top applications. 2. Explore the other areas of the application reports by filtering and correlating using the grey options pane above the graphs or correlating your data and in the Details pane using the right click option.

8 Web Usage Reports - These reports allow you to view all the details of the HTTP application. The Cymphonix Network Composer as an in-line appliance can give you more then just hit reports when it comes to web usage, Network Composer can also give you reported on the amount of bandwidth consumed by content category, URL, etc. Which categories are consuming the most bandwidth? To begin with you will discover which categories of websites are utilizing the most bandwidth. First, run a report that first lists all web hits broken down by Result Type (Blocked, Allowed, or Bypassed. Then correlate your allowed web sites by category. Navigate to Report Tab -> Web Usage -> Overview / Bandwidth. Right Click on Allowed and Correlate by Category to see the top categories that have been navigated to successfully and using the most bandwidth.

9 What websites make up my top categories by bandwidth? You will likely see the Streaming Media category listed towards the top if you previously navigated to and played some videos. Subsequent to finding the top category, you can continue to drill further into any of the categories by Right Clicking category name -> Correlate by Host to see the specific web sites within that category. What websites have been blocked on my network? When researching which sites have been requested but blocked by Network Copmoser, you can navigate to Report Tab -> Web Usage -> Overview / Hits -> Right Click Blocked -> Correlate by Host. You will see cnn.com and any other sites you previously navigated to within your blocked categories.

10 What blocked websites has a workstating (node) gone to and when? 1. Navigate to Report Tab -> Web Usage -> Network Node/ Hits. Locate your node in the Details section or search for your node in the options pane. Right click your node and then Correlate by Host. 2. In the options pane change your Result Type to Blocked. 3. After The results are returned you can left click on any of the hosts to return a Web Hits Over Time report allowing you to see exactly what time of day the blocked hits to a specific site by a specific node happened.

11 Using the Options pane Notice in the report options pane the ability change the date range, search for specific entries, change the result type, category and the filters. You can also change your correlations to drill down. Viewing full URL s that make up a host website. 1. To view URL Details it is an option that is turned off by default so must be enabled in your advanced settings. You can navigate there by going to Admin -> Configuration -> Advanced Settings and then checking Log full URL to database. 2. Navigate to Report Tab -> Web Usage -> Network Node/ Hits. Locate your node in the Details section or search for your node in the options pane. Right click your node and then Correlate by Host.

12 3. Right Click any host and choose View URL Details View my top categories and the users in one view There are additional report types in the Web Usage submenu that are multi-correlated reports which are used to show multiple levels of data at the same time. These reports are organized and grouped together under folders, either By Network Node or By Directory User. Navigate to Report Tab -> Web Usage -> By Network Node or Report Tab -> Web Usage -> By Directory User. Reporting summary Explore the Network Composer interface using these guidelines and you will continue to find additional details and powerful pieces of information.