McAfee Content Security Reporter 2.6.x Interface Reference Guide Interface Reference topics Edit Permission Set page (Permission Sets page) Specify Content Security Reporter permissions and grant user access to reports and report server settings. Table 1 definitions Content Security Reporter Settings Email Content IPS Content OTP Content Web Content Delegated Reports Allows or prevents users to view and edit the Report Server settings. Allows or prevents users to access report email server data. Allows or prevents users to access report IPS server data. Allows or prevents users to access report McAfee OTP server data. Allows or prevents users to access report web server data. Allows users to view all or selected report data. Details page Report Servers (Registered Server Builder wizard) View and modify the report server settings. Table 2 definitions Server Name or IP Address Server port Passkey Specifies the name of the of the connected server or IP address of the computer on which Content Security Reporter is installed. Specifies the port for this server. Specifies the passkey that you set during installation. 1
Table 2 definitions (continued) Change Passkey Test Settings Provides the ability to change the passkey that you set during installation. Verifies that the connection with the database server works. McAfee recommends that you do not edit the database server details from the list of registered servers. To edit the database, select Menu Configuration Report Server Settings Database Servers. Details page Advanced Threat Defense Server (Registered Server Builder wizard) View and modify the Advanced Threat Defense server settings. Table 3 definitions Password Server Name or IP Address Test Settings User name Specifies your Advanced Threat Defense password. Specifies the name of the of the connected server or IP address of the computer on which Advanced Threat Defense is installed. Verifies that the connection with the server works. Specifies your Advanced Threat Defense user name. Server Status page View information about the state of the report server and available updates. Table 4 definitions Elapsed time since startup Product updates Refresh Server local time Server version Duration of time since the server was last restarted. Reports when a software update is available. Updates the server status and available update information. System time of the server. The version of the report server in the following format: <major>.<minor>.<patch>.<build> 2
Log Sources tab Manage the log files in Content Security Reporter from a list of available log sources. Table 5 definitions Actions Actions to perform from this page include: Delete Removes the log source. Disable Prevents Content Security Reporter from accepting incoming log data until you choose to re-enable it. Duplicate Creates a log source based on the settings of a selected log source. Edit Modifies the log source settings. Enable Allows Content Security Reporter to accept incoming data from a selected log source. Import Log Manually imports log files from a local directory on the client computer. New Creates a log source. Process Now Pulls data to Content Security Reporter from a selected log source. This option works with Collect log files from log source modes. Drag items from the Actions menu on to the Content Security Reporter toolbar. Format Log Source Name Next Scheduled Job Schedule Show Filter / Hide Filter Determines the ability of your web filtering device to send log files. The name associated with the log source. Next scheduled time to pull log files from the directory. A preset time for when log files are pulled from the directory. Displays the Quick find feature, which provides the ability to search for specific text in the Table name column. New, Edit, and Duplicate Log Source page (Log Sources page) Configure or modify log source settings. The Log type area of the page remains at the top regardless of which tab you choose. 3
Table 6 definitions Enable log source Log format When selected, allows Content Security Reporter to accept or collect log file data. These log format options are available to configure a log source: McAfee Web Gateway (Webwasher) Auto Discover McAfee Web Gateway (MATD) Auto Discover McAfee Web Gateway Cloud Service McAfee Email Gateway McAfee Email and Web Security (Web) McAfee Email and Web Security (Email) McAfee SiteAdvisor Enterprise McAfee Firewall Enterprise (Sidewinder) SFv4 Text format McAfee SmartFilter IFP SFv4 Text format Blue Coat SG Auto Discover format McAfee Network Security Platform McAfee One Time Password Mode These mode options are available to configure a log source: Accept incoming log files: FTP(S) / HTTP(S) Syslog Collect log files from: McAfee Web Gateway 6.x (Webwasher) McAfee Web Gateway 7.x McAfee Web Gateway 7.x (MATD) McAfee Web Gateway Cloud Service FTP(S) Server Directory on report server McAfee Network Security Manager The mode you select depends on the ability of your web filtering device to send log files. Name Specifies the name for the log source. 4
Source tab (New, Edit, and Duplicate Log Source page) Configure the source options for your log source. Table 7 definitions Accept incoming log files FTP(S) / HTTP(S) Accept Log Files from the Network Device To accept log files from the network device, this information is used to create a logon account: Logon name Password For more information about accepting log files using FTP(S)/HTTP(S) options, consult the documentation for your network device. Table 8 definitions Accept incoming log files Syslog Accept Log Files from the Network Device Web Gateway Settings This information is used to accept syslog messages files from the network device: Client address Server Port Protocol Specifies the log header. Only available when you select these log formats: McAfee Web Gateway (Webwasher) - Auto Discover McAfee Web Gateway (MATD) - Auto Discover For more information about accepting Syslog messages, consult the documentation for your network device. Table 9 definitions Collect log files from McAfee Web Gateway 6.x (Webwasher) Webwasher Server Test This information is used collect log files from the Webwasher server: Device address Password UI Port Connect using TLS Logon name Verifies the connection to the Webwasher server. 5
Table 10 definitions Collect log files from McAfee Web Gateway 7.x Web Gateway Server Test This information is used to collect log files from the McAfee Web Gateway server: Device address UI Port Connect using TLS Logon name Password Appliance Name (UUID) Log File Base Name Automatically collect logs from node with active GUI Verifies the connection to the Web Gateway server. Table 11 definitions Collect log files from McAfee Web Gateway 7.x (MATD) Web Gateway Server Test This information is used to collect Advanced Threat Defense log files from the McAfee Web Gateway server: Device address UI Port Connect using TLS Logon name Password Appliance Name (UUID) Log File Base Name Automatically collect logs from node with active GUI Verifies the connection to the Web Gateway server. Table 12 definitions Collect log files from McAfee Web Gateway Cloud Service McAfee Web Gateway Cloud Service Test This information is used to collect log files from McAfee Web Gateway Cloud Service : Customer ID Sent in your McAfee Web Gateway Cloud Service Service registration documentation Logon name Password Region You can specify the region as US or EU. Verify that your firewall allows communication between: For US https://msg.mcafeesaas.com and port 443 For EU https://eu.msg.mcafeesaas.com and port 443 Content Security Reporter server and the Internet Content Security Reporter collects 15 maximum days of data from McAfee Web Gateway Cloud Service Verifies the connection to McAfee Web Gateway Cloud Service Service. 6
Table 13 definitions Collect log files from FTP(S) server FTP Server Test This information is used to collect log files from the FTP, FTPS, or SFTP server: File protocol Logon name FTP Server Address Password Port Directory Verifies the connection to the FTP(S) server. Table 14 definitions Collect log files from Directory on report server Report Server Directory Test Specifies the report server directory information. Verifies the connection to the report server directory. Table 15 definitions Collect log files from McAfee Network Security Manager McAfee Network Security Manager Test This information is used to collect log files from McAfee Network Security Manager: Device Address Device Port Logon name Password Verifies the connection to McAfee Network Security Manager. User-Defined Columns (New, Edit, and Duplicate Log Source page) Configure the settings for up to four user-defined columns. Table 16 definitions Settings for User-Defined columns Settings used to configure user-defined columns include: Populate this column Populates the selected column based on the source data options. Log record Identifies which log record column populates the user-defined column. Log file header Specifies which miscellaneous log file header from a log file populates the user-defined column. When entering a value in the Log file header field, do not use quotation marks. Apply this rule set Applies the selected rule to the identified column when processing log files. User-defined columns Provides a way to obtain data from log file columns normally skipped, or to assign a custom value to data obtained from any log file column. 7
Processing tab (New, Edit, and Duplicate Log Source page) Configure how Content Security Reporter handles log file data. Table 17 definitions Log Records These processing options are available to configure a log source: Condense log records into page views Consolidates multiple lines of data into a single page view record in reports. Store log records for detailed reports Stores complete log records, which are used from the detailed user report and when reporting on URLs that have multiple categories for summary reports. Use client host names when storing log records for unknown users Uses client (computer) host names for unknown users. Stop parsing when error line exceed Stops parsing log files when the amount of errors surpasses the number in the exceed field. Ignore log file lines that match this regular expression Skips lines in the log file that match the contents of the regular expression field. Character format Specifies the format of characters. Choose from these character formats: US-ASCII ISO-8859-1 UTF-8 UTF-16 Post-Processing tab (New, Edit, and Duplicate Log Source page) Configure how Content Security Reporter handles log files after processing is complete. Table 18 definitions Post-Processing Log Files These post-processing options are available to configure a log source: Delete processed log files Removes processed log files from the server. Move processed log files to this directory Moves processed log files to the specified directory. Browse Navigates to the directory location. Directory Defines the directory location. FTP processed log files to this server Moves processed log files to the FTP server location. File protocol Specifies the protocol as FTP, FTPS, or SFTP. Server Specifies the host name or IP address of the server. Logon name Specifies the name used to log on the FTP server. Password Specifies the password used to log on to the FTP server. Port Specifies the port number the FTP server uses to communicate. The default port number for FTP and FTPS is 21. The default port number for SFTP is 22. Directory Specifies the file path to store the log files on the FTP server. 8
Schedule tab (New, Edit, and Duplicate Log Source page) Create a schedule to process log sources. The Schedule tab is only available when Collect log files from is selected. Table 19 definitions Dates Process logs Start time Specifies the dates for when to begin and end log file collection from the device. Specifies the frequency of log file collection from the device. Specifies when to begin log file collection from the device. Import Log window (Log Sources tab) View details about existing log sources and import a log file. Table 20 definitions Import Log Log format Log source name Processing Provides the option to browse and select a specific log file. Displays the log format for the selected log source. Identifies the name of the log source. Displays processing options for the selected log source. Current Jobs tab (Log Sources) View information about the currently running log processing jobs. Table 21 definitions Refresh Status Updates the job information currently in progress. Displays this information about the current log processing jobs in progress: The number of records in the log file The number of records and bytes processed The number of errors detected The number of records the job has not processed The percentage of the log processing job that is complete How long the job has taken, and a time estimate for when the job finishes The name and size of the log file 9
Statistics tab (Log Sources) Displays cumulative log statistics for all the logs processed since the record was last refreshed or reset. Table 22 definitions Cumulative statistics Displays these log statistics: Log records processed Displays the number of log records processed and includes errors and ignored records for the corresponding group. Bytes processed Displays the number of bytes processed for the corresponding statistics group. Byte/log record ratio Displays the average number of bytes per log record processed. Log parsing rate Displays the number of records per second and the number of bytes per second currently being processed. Estimated time to process all log records Displays the total length of time to complete all log processing jobs to date. Elapsed time Displays the length of time that processing has been running since the last server restart or last manual reset. Waiting jobs Displays the number of log jobs waiting to be processed. Quick Find Refresh Reset Search for a specific Syslog client to filter. Retrieves the latest statistics from the report server. Sets the statistics back to zero. Cumulative statistics cannot reset while a log processing job is running. Syslog client statistics can be reset at any time. Show Clients Syslog client statistics Filter which Syslog client statistics to display based on status. Displays these Syslog client statistics: Messages processed Messages cached Job Queue page View a list of log processing jobs that are completed, or currently in progress. Table 23 definitions Actions Actions to perform from this page include: Delete All Completed Jobs Removes all completed log processing jobs. Delete/Cancel Stops and removes selected log processing jobs. Refresh Updates the list of log processing jobs. Job ID Log Source Log source details The number assigned to a log processing job. The name of the log source. Detailed information regarding each selected log processing job. 10
Table 23 definitions (continued) Show Filter / Hide Filter Status Submitted Total size Displays the Quick find feature, which provides the ability to search for specific text in the Table name column. The state of the log processing job. The time the job started. The size, in bytes, of the created log file. Custom Columns page Content Security Reporter is configured with default predefined, or editable custom columns. Table 24 definitions Actions Name of Custom Column Show Filter / Hide Filter Opens the Edit Rule Set window that allows you to make changes to the selected custom column rule set. Displays the available custom columns. Displays the Quick find feature, which provides the ability to search for specific text in the Table name column. Custom Rule Sets page Configure custom rule sets to use in user-defined columns. Table 25 definitions Actions Actions to perform from this page include: Delete Removes the selected rule. Duplicate Copies an existing custom rule set. Edit Modifies an existing custom rule set. New Adds a new custom rule set. Name of Custom Rule Set Show Filter / Hide Filter Displays the name of the rule set. Displays the Quick find feature, which provides the ability to search for specific text in the Table name column. 11
New, Edit, or Duplicate Rule Set page (Custom Columns page or Custom Rule Sets page) Create a new rule set or change the rules used in a selected rule set. Table 26 definitions Actions Actions to perform from this page include: Add Above / Add Below Opens the New Rule dialog box and place a new rule above or below the selected rule. Decrease Priority Moves the selected rule down the rule list. Export Rule Set Saves the selected rule to a file in the default or user-selected location. Import Rule Set Copies an exported rule into the current rule set. Increase Priority Moves the selected rule up the rule list. New Adds a new rule to the Rules field. If an individual rule is selected in the rule set, and depending on the rule's location in the Rules table, these options become available from the Actions list: Delete Removes the selected rule. You cannot remove the default rule. Edit Makes the rule fields editable for the selected rule. General Rules Test The name of the rule, and an optional description. List of rules in the rule set, the priority of the rule, and the replacement text that appears in the query or report. Replacement text that appears in the query or report. Browse Time page View the default browse time for all users. Table 27 definitions Browse time threshold Default browse time Edit The maximum length of time a user is expected to spend viewing a single webpage. The amount of time recorded in the database when the browse time threshold is exceeded. Opens the Edit Browse time dialog box, where you change the browse time threshold and default browse time. 12
Edit Browse Time page (Browse Time page) Configure the default browse time for all users. Table 28 definitions Browse time threshold Default browse time Specifies the maximum length of time a user is expected to spend viewing a single webpage. Specifies the amount of time recorded in the database when the browse time threshold is exceeded. The 3 minutes default values produce the best results. Database page View the database settings and connection status. Table 29 definitions Edit Configuration Connection Mode Status Update Schema Opens a dialog box that allows you to modify database settings. Displays the active database and database settings such as the address, port, and logon details. Displays whether the database connection is online or offline. Displays whether the database is connected or disconnected. Appears when connected to a database from a previous version of Content Security Reporter. Edit Database page (Database page) Access and manage the database configuration options used to process log data. If you choose to use an internal database, the database requires no additional configuration. Table 30 definitions Advanced Displays the Advanced Database Status dialog box to view more information about the currently connected database. This option appears on the Edit Database dialog box and is only available to select when the database is connected. Configuration Choose between Default internal database or This external database to activate a database. If the Content Security Reporter and McAfee epo databases share the same SQL Server instance, you must configure separate databases for each. Connection Mode If you choose to use an external database, the Database settings value box becomes active to enter setting information such as the address, port, and logon details. A checkbox to enable SSL connection to the database is also available. Displays whether the database connection is online or offline. When you set the database to offline, the Advanced button is no longer available. 13
Table 30 definitions (continued) Execute SQL Refresh Status Test Update Schema Opens a window that enables a reporting administrator to provide and execute SQL statements. Use this function for troubleshooting when working with technical support. Updates the availability status of the connected database. Displays whether the database is connected or disconnected. Verifies the database configuration settings. Upgrades the database schema. Table 31 Advanced Database Status dialog box Partition Schema Provides the option to partition your schema. If you are not sure what partitioning is, or if you need it, do not partition your schema. Status Displays this database status information: Availability Displays whether the database is connected or offline. Schema version Displays the connected report database schema version. Partitioning Displays if partitioning is supported for: Microsoft SQL Server 2008 MySQL 5.5 Microsoft SQL Server 2012 MYSQL 5.6 Microsoft SQL Server 2014 MYSQL 5.7 Microsoft SQL Server 2016 Permissions Displays the SQL permissions for the user specified in the Logon name field on the Database page. Table 32 Test Status dialog box Status Details Identifies the connection status to the report database. Provides the details for the connected database. Database Maintenance page View the database maintenance jobs schedule, and the maintenance tasks that run during maintenance. Table 33 definitions Delete database records Edit Index maintenance Maintenance options Schedule database maintenance Displays the records to delete from the database during scheduled maintenance. Opens a window where you can modify maintenance settings. Displays the frequency for when the indexes are rebuilt. Displays the number of records deleted in a single maintenance task. Displays the frequency for database maintenance jobs, and the date and time for the next scheduled job. 14
Edit Database Maintenance window (Database Maintenance page) Configure automated database maintenance jobs. Table 34 definitions Delete database records Configures the age of summary and detailed data to delete during database maintenance. By default, summary and detailed records older than 12 months are removed from the database. If reports are taking a long time to generate, schedule Content Security Reporter to delete database records more frequently. Index maintenance Configures the frequency for when the indexes are rebuilt. By default, indexes are rebuilt on the first Sunday of each month. Ensure that index maintenance is scheduled on the same day as database maintenance. For example, if index maintenance is scheduled for Monday, but database maintenance is scheduled for Tuesday, then index maintenance will not run. Maintenance options Schedule database maintenance Set Schedule Configures the maximum number of records deleted at any one time. Configures the frequency of database maintenance jobs, and the date and time for the next scheduled job. Opens a dialog box to configure the frequency and start time for scheduled database maintenance jobs. Table 35 Set Schedule dialog box Frequency Start time Configures the frequency for scheduled database maintenance jobs. Configures the start time for scheduled database maintenance jobs. Manual Maintenance page Select and start database maintenance jobs. Table 36 definitions Manual database maintenance by date range Manual database maintenance by log source Custom and user-defined columns Specifies the type of data to remove from the database within a specified date range. Deletes all database records for a selected log source. Repopulates specified custom and user-defined columns. If you choose to repopulate user-defined columns, you can select the specific log source whose report columns you want to repopulate, and set date parameters to speed up the process. Only log sources with user-defined columns are available to select. Index maintenance Database Statistics Rebuilds the indexes to improve record insertion and report performance without running other maintenance tasks. Runs statistics for updated database information without running other maintenance tasks. 15
Table 37 Repopulate Columns dialog box Custom columns User-defined columns Specifies which custom columns to repopulate. Repopulates user-defined columns using current rules. Status page View the database maintenance jobs in the maintenance queue. Table 38 definitions Actions Actions to perform from this page include: Delete Removes the selected database maintenance jobs. Delete All Completed Jobs Removes all completed database maintenance jobs. Refresh Updates the list of database maintenance jobs. Job Job details Show Filter / Hide Filter Started / Completed Status The name of a maintenance job. Select and view detailed information for a selected job. Displays the Quick find and Preset features. The start and end time of the job. Reports whether the job was successful or unsuccessful. System Maintenance page View automated system maintenance job options. Table 39 definitions Edit Schedule system maintenance Delete system status Opens a window where you can modify maintenance settings. Displays the frequency for when system maintenance jobs are run. Displays the age of deleted system status information and server logs during system maintenance. Edit System Maintenance page (System Maintenance page) Configure the automated system maintenance job settings. Table 40 definitions Schedule system maintenance Delete system status Configures the age of deleted system status information and server logs during system maintenance. Specifies the frequency for when system maintenance jobs are deleted. 16
Manual Maintenance page (System maintenance) Manually run system maintenance jobs. Table 41 definitions Delete Now Delete system status Provides the option to immediately delete system statuses. Specifies which system statuses to delete by age. Status page View the system maintenance jobs in the maintenance queue. Table 42 definitions Actions Actions to perform from this page include: Delete Remove the selected system maintenance jobs. Delete All Completed Jobs Remove all completed system maintenance jobs. Refresh Update the list of system maintenance jobs. Job details Preset / Show selected rows Show Filter / Hide Filter Started / Completed Status Select and view detailed information for a job. Select which system maintenance jobs to display in the queue. Displays the Preset and Show selected rows feature. The start and end time of the job. Reports whether the job was successful or unsuccessful. Performance s page View the current amount of allocated memory and number of concurrent log processing jobs. Table 43 definitions Concurrent jobs Edit Memory Displays the current number of log processing jobs that can run at any one time. Opens the dialog boxes to modify the amount of RAM to dedicate to Content Security Reporter and how many log processing jobs can run simultaneously. Displays the current amount of RAM dedicated to the Content Security Reporter server. Table 44 Memory dialog box Memory Restore Defaults Specifies the amount of RAM to dedicate to the Content Security Reporter server. Restores the memory allocation to 1 GB. Table 45 Concurrent jobs dialog box Concurrent jobs Specifies the number of log processing jobs that can run simultaneously. Restore Defaults Restores the number of concurrent log processing jobs to 2. 17
Cache page View setting and status information for the log processing caches. To modify the settings on this page, the database must be online and maintenance jobs cannot be running. When the database is reconnected, changes made to database settings before going offline are retained. If the database goes offline while changes are made in the caches, these changes will not be saved. Table 46 definitions Actions Actions to perform from this page include: Choose Columns Select which columns to display, and the order they appear. Additional columns include: Elapsed Time Displays the duration of time that has passed since the statistics began calculation. Maximum Entries Shows the maximum number of entries that can be held in memory. Default value is different for each row. Preload Displays the preload status; this is deselected by default. Yes Loads the maximum number of entries into memory when the database comes online or the server is restarted. No Does not load the content into memory when the database comes online or the server is restarted. Enabling preload can significantly increase the amount of time to connect to the database. Edit Opens a dialog box that allows you to modify the entries in the summary cache. Refresh Refreshes the content in the caches. Reset Statistics Resets the hit ratio and the elapsed time to zero. Current Entries Displays the current number of entries held in the cache. Set to zero by default. Current Memory Usage Hit Ratio Show Filter / Hide Filter Table Name Displays the estimated total amount of memory used by the cache's entries. Displays the: Ratio between the number of hits versus the sum of the number of hits Number of misses Displays the Quick find feature, which provides the ability to search for specific text in the Table name column. Displays the cache names in the configured database. 18
Edit Cache Settings page (Cache page) Modify the entry settings stored in the summary cache. Table 47 s Maximum Entries Mode Table Name Displays the maximum number of entries that can be stored in the summary cache. Provides the option to preload the cache on initialization. Displays the name of the table in the configured database. Summary Cache page View settings and status information for the summary table caches. To modify the settings on this page, the database must be online and maintenance jobs cannot be running. When the database is reconnected, changes made to database settings before going offline are retained. If the database goes offline while changes are made in the caches, these changes will not be saved. Table 48 definitions Actions Actions to perform from this page include: Choose Columns Select which columns to display, and the order they appear. Additional columns include: Average Preload Batch Size Displays the average size of batches the system has attempted to load. Elapsed Time Displays the duration of time that has passed since the statistics began calculation. Maximum Entries Displays the maximum number of entries that can be held in memory. Default value is different for each row. Maximum Preload Batch Size Displays the size of the largest batch that the system attempts to load. Time Units Currently Loaded Displays the number of entry groups that the cache has active. Edit Opens the Cache Settings dialog box. Refresh Refreshes the content in the summary cache. Reset Statistics Resets the hit ratio and elapsed time to zero, and recalculates the Maximum Preload Batch Size and Average Preload Batch Size. Current Entries Displays the current number of entries held in the cache. Set to zero by default. Current Memory Usage Hit Ratio Displays the estimated total amount of memory used by the cache entries. Displays: Ratio between the number of hits versus the sum of the number of hits Number of misses 19
Table 48 definitions (continued) Show Filter / Hide Filter Table Name Displays the Quick find feature, which provides the ability to search for specific text in the Table name column. Displays the name of the summary table in the configured database. System Backup page View the backup file that is used to restore Content Security Reporter to a previous configuration. The backup configuration file does not create a backup of any reports, queries, or McAfee epo settings. Note that the server is not available during a system backup. Table 49 definitions Actions Backup Date and Time File Path in Report Server Size Creates a backup file of the current configuration. By default, the backup.xml file is stored in this report server directory: C:\Program Files \McAfee\Content Security Reporter\reporter\conf Displays the date and time the backup file was created. Displays the path to the backup file. Displays the size of the backup file. Support page Generate a feedback file that includes report server information for use by technical support. Table 50 definitions Start Support Generates the feedback file. Describes what information is collected in the feedback file and where the file is stored. Copyright 2018 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. 20 0-00