Migration Guide. McAfee Content Security Reporter 2.4.0

Migration Guide McAfee Content Security Reporter 2.4.0

COPYRIGHT Copyright 2017 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Content Security Reporter 2.4.0 Migration Guide

Contents 1 Overview of McAfee Content Security Reporter migration 5 Why do you need to migrate from Web Reporter to Content Security Reporter............ 5 How the migration works................................ 6 2 Planning your migration 9 Prerequisites for the migration.............................. 9 3 Migrating configuration settings 11 Configuring databases................................ 11 Configuring log sources................................ 11 Accept incoming log sources........................... 11 Redirect log sources.............................. 12 Collect log files in FTP server........................... 12 Configuring directories................................ 12 A Feature comparison matrix and schemas 15 Comparing Content Security Reporter and Web Reporter features................ 15 Comparing Content Security Reporter and Web Reporter schemas................ 17 McAfee Content Security Reporter 2.4.0 Migration Guide 3

Contents 4 McAfee Content Security Reporter 2.4.0 Migration Guide

1 Overview 1 of McAfee Content Security Reporter migration With McAfee Web Reporter reaching its end of life, you must migrate to McAfee Content Security Reporter to analyze your network activity. Content Security Reporter is a reporting software solution that helps you identify and analyze a broad range of data collected from your network devices. Content Security Reporter uses the latest technology to address all existing vulnerabilities affecting your network. Third-party software support is upgraded in the latest version of Content Security Reporter. Migrating to Content Security Reporter has the following advantages: Content Security Reporter is browser-independent. Web Reporter requires a browser with Java support. Content Security Reporter supports secure LDAP (LDAPS). Content Security Reporter supports McAfee epolicy Orchestrator (McAfee epo ). The migration does not have any dependency on systems that are currently running with Web Reporter. Contents Why do you need to migrate from Web Reporter to Content Security Reporter How the migration works Why do you need to migrate from Web Reporter to Content Security Reporter With Web Reporter reaching end of life, support for Web Reporter expires on December 31, 2017. McAfee will not provide technical support for Web Reporter after December 31, 2017. You can continue to use Web Reporter, but we recommend that you migrate to the supported product, Content Security Reporter. Another reason for migrating to Content Security Reporter is that you can manage your endpoints through McAfee epo. Also, Content Security Reporter accepts log sources from products such as McAfee Email Gateway and McAfee Network Security Platform that are not supported by Web Reporter. Products supported Web Reporter vs. Content Security Reporter Web Reporter and Content Security Reporter receives log files from various products. The following table compares the products supported in Web Reporter with Content Security Reporter. McAfee Content Security Reporter 2.4.0 Migration Guide 5

1 Overview of McAfee Content Security Reporter migration How the migration works Table 1-1 Supported data sources Supported log sources for Web Reporter McAfee Web Gateway McAfee SAAS Web Protection McAfee Firewall Enterprise McAfee Web Security Blue Coat McAfee SmartFilter (all platforms) Supported log sources for Content Security Reporter McAfee Web Gateway McAfee SAAS Web Protection McAfee Firewall Enterprise McAfee Web Security Blue Coat McAfee SmartFilter (Internet Filtering Protocol only) McAfee Email Protection McAfee Advanced Threat Defense McAfee Common Catalog McAfee Email Gateway McAfee epolicy Orchestrator (McAfee epo ) McAfee Network Security Manager McAfee One Time Password (McAfee OTP) McAfee Web Gateway Cloud Service (McAfee WGCS) McAfee SiteAdvisor Enterprise How the migration works To migrate from Web Reporter to Content Security Reporter, you must install and configure Content Security Reporter 2.4.0 in a newly set up server. The objective of the migration is to synchronize the reports generated in Web Reporter and Content Security Reporter. Input the same log sources in both Web Reporter and Content Security Reporter and run them simultaneously for a specific period. At the end of the specified time, the reports generated by both products should match. Once this synchronization is complete, you can continue to use Content Security Reporter and stop using Web Reporter. 6 McAfee Content Security Reporter 2.4.0 Migration Guide

Overview of McAfee Content Security Reporter migration How the migration works 1 For more information about installing Content Security Reporter, see the Content Security Reporter 2.4.0 Installation Guide. Figure 1-1 Migration flow McAfee Content Security Reporter 2.4.0 Migration Guide 7

1 Overview of McAfee Content Security Reporter migration How the migration works 8 McAfee Content Security Reporter 2.4.0 Migration Guide

2 Planning your migration Plan your migration to ensure that migration is successful and the logs and reports are generated flawlessly in Content Security Reporter. One of the benefits of planning your migration is that you can migrate and retain your organization s data accumulated over a specific period. Planning your migration includes identifying the processed logs/data that you want to migrate to Content Security Reporter. Prerequisites for the migration Make sure that your environment meets the required hardware and software requirements. Customer category Customers are categorized into three based on the number of users. The three categories of customers are small, medium, and large. Table 2-1 Customer category Customer category Definition Small Medium Large Customers are categorized as small, if the number of users are less than or equal to 25,000 and receive about 2.4 GB of data daily. Customers are categorized as medium, if the number of users are between 25,000 and 50,000 and receive about 9.6 GB of data daily. Customers are categorized as large, if the number of users are 50,000 or above and receive about 28.8 GB of data daily. Hardware requirements Hardware requirements differ based on the customer category. A specific hardware configuration is recommended for each customer type. The following table lists the customer types and their definitions. Table 2-2 Hardware requirements Customer category Small Medium Large Hardware requirements Processor: 2.30 GHz (4 Core) Memory (RAM): 8 GB Processor: 2.30 GHz (8 Core) Memory (RAM): 24 GB Processor: 2.30 GHz (16 Core) Memory (RAM): 32 GB McAfee Content Security Reporter 2.4.0 Migration Guide 9

2 Planning your migration Prerequisites for the migration Software requirements Content Security Reporter supports 64-bit Microsoft server-class operating systems. Version Supported server operating systems 64-bit Windows Server 2008 Windows Server 2012 Windows Server 2008 Service Pack 2 Windows Server 2012 R2 Windows Server 2008 R2 Windows Server 2016 For more information, see the Content Security Reporter Product Sizing Calculator. 10 McAfee Content Security Reporter 2.4.0 Migration Guide

3 Migrating 3 configuration settings To migrate the configuration settings, you must set up a new database for Content Security Reporter and configure the log source settings in both Content Security Reporter and Web Reporter. Contents Configuring databases Configuring log sources Configuring directories Configuring databases For Content Security Reporter, you can use the same database server that you have configured for Web Reporter. We recommend that you configure a separate database server for Content Security Reporter to reduce the load. It is recommended that you configure the database server on a separate machine from Content Security Reporter as your database depends on the volume of data that your organization receives on a daily basis. For more information about customer categorization, see the Prerequisites for the migration topic. Configuring log sources Before the migration, configure log sources for Content Security Reporter to accept log files from your network filtering devices. You can configure the log source settings so that the incoming log sources that are sent to Web Reporter for processing are also sent to Content Security Reporter. Accept incoming log sources Configure Content Security Reporter to receive unprocessed logs from Web Reporter for processing. The log sources are from various supported products that send their data to be processed. Task 1 Log on to McAfee epo. 2 Select Report Server Settings Log Source Action New. 3 From the Mode drop-down list, select Accept incoming log files and FTP/HTTP(S). 4 Select the required log format. McAfee Content Security Reporter 2.4.0 Migration Guide 11

3 Migrating configuration settings Configuring directories 5 In the Source tab, provide the logon name, password, and confirm the password. 6 Click OK to save. Redirect log sources Once the logs are processed in Web Reporter, redirect log sources to Content Security Reporter so that the log files are also processed in Content Security Reporter. Task 1 Log on to Web Reporter. 2 Select Administration Setup Log Sources. 3 Select appropriate log source name, then click Edit. 4 Select the Post-Processing tab. 5 Select FTP processed log files to this server. 6 Type the Content Security Reporter server IP address. 7 Type the logon ID and password that are configured in Content Security Reporter. 8 Type Port as 9121. 9 Type the directory as /. 10 Click OK to save the changes. Collect log files in FTP server Content Security Reporter provides an option to save the processed log files in an FTP server. By default, all processed log files are deleted in Content Security Reporter. To save the processed log files in an FTP server, provide the FTP server details. Task 1 Log on to McAfee epo. 2 Select Report Server Settings Log Source Action New. 3 Select Mode Collect Log Source FTP server. 4 Type the FTP server address, logon name, password, and the directory path. 5 Click OK. Configuring directories Before collecting log sources, connect your organization's user directories to the internal or external directories supported by Content Security Reporter. For more information about directories, see the McAfee Content Security Reporter 2.4.0 Product Guide. Configuring user accounts and network group accounts In McAfee epo, create separate user accounts and configure network group accounts to use Content Security Reporter. 12 McAfee Content Security Reporter 2.4.0 Migration Guide

Migrating configuration settings Configuring directories 3 Configuring email settings With email settings, you can email the reports in addition to viewing the reports in the dashboard. Unsupported settings Content Security Reporter does not support anonymous reports and custom log formats. For more information about directories, user accounts, network accounts, and email settings, see the McAfee Content Security Reporter 2.4.0 Product Guide. McAfee Content Security Reporter 2.4.0 Migration Guide 13

3 Migrating configuration settings Configuring directories 14 McAfee Content Security Reporter 2.4.0 Migration Guide

A Feature comparison matrix and schemas Content Security Reporter and Web Reporter share similar features, but different schemas. Contents Comparing Content Security Reporter and Web Reporter features Comparing Content Security Reporter and Web Reporter schemas Comparing Content Security Reporter and Web Reporter features Content Security Reporter offers all the features that Web Reporter provides, but on a faster and more secure platform. In addition to the basic features in Content Security Reporter, you can also use McAfee epo to view different types of reports and create custom dashboards. Anonymous reports and custom log format features are not supported in Content Security Reporter. McAfee Content Security Reporter 2.4.0 Migration Guide 15

A Feature comparison matrix and schemas Comparing Content Security Reporter and Web Reporter features Table A-1 Comparing Content Security Reporter and Web Reporter features Supported data source Web Reporter McAfee Web Gateway McAfee Saas Web Protection Blue Coat McAfee SmartFilter (all platforms) Content Security Reporter McAfee Web Gateway McAfee Saas Web Protection Blue Coat McAfee SmartFilter(Internet filtering protocol only) McAfee Email Gateway McAfee Network Security Platform McAfee Email Protection McAfee Advanced Threat Defense McAfee Common Catalog McAfee epolicy Orchestrator (McAfee epo ) McAfee Network Security Manager McAfee One Time Password (McAfee OTP) McAfee Web Gateway Cloud Service (McAfee WGCS) McAfee SiteAdvisor Enterprise Summary data Yes Yes Detailed data Yes Yes Anonymous data Yes With McAfee epo 5.9.1 or later. Custom log formats Yes No Management McAfee epo software integration No Management interface Web-based: Java Web-based: HTML Deployment Software: Microsoft Windows Server, Linux, Solaris Role-based administration Yes Yes Delegated reporting Yes Yes Database support MySQL, Microsoft SQL, Oracle MySQL, Microsoft SQL Database partitioning Yes Yes Localization English, German, Spanish, French, Japanese, Chinese Simplified Yes Software: Microsoft Windows Server, McAfee epo 5.3.1 or later. English Licensing Basic (free), Premium ($) Free Reporting Dashboards Yes (QuickView) Yes View McAfee Global Threat Intelligence (McAfee GTI) information Yes Yes 16 McAfee Content Security Reporter 2.4.0 Migration Guide

Feature comparison matrix and schemas Comparing Content Security Reporter and Web Reporter schemas A Table A-1 Comparing Content Security Reporter and Web Reporter features (continued) Web Reporter Actionable Workflows No Yes Quickview Yes No Ad-hoc reports Yes Yes Custom queries and reports Yes Yes Shared queries and reports Yes Yes Scheduled reports Yes Yes Group-based reports Yes Yes Content Security Reporter Output formats PDF, CSV, HTML, XML PDF, CSV, HTML, XML Email Yes Yes FTP Yes No External command No Yes Localization Log processing English, German, Spanish, French, Italian, Japanese, Korean, Portuguese, Chinese Simplified, Chinese Traditional, Russian Directory (local/network) Yes Yes FTP Yes Yes HTTP Yes Yes HTTPS Yes Yes Scheduled tasks Yes Yes English Comparing Content Security Reporter and Web Reporter schemas Content Security Reporter and Web Reporter differ in the way data is stored in the database. In Web Reporter, the processed product data is stored in common tables in the schema, whereas the Content Security Reporter schema has separate tables for each supported product. Content Security Reporter processes the data and places them in the respective product tables. Web Reporter schema Content Security Reporter schema Fields used by supported products Fields used by supported products scr_db_properties scr_dim_action scr_dim_action_request scr_dim_agent scr_dim_application scr_dim_category scr_dim_directory scr_dim_group scr_dim_ipaddress csr_dim_action csr_dim_action_request csr_dim_agent csr_dim_category csr_dim_category1 csr_dim_category2 csr_dim_category3 csr_dim_dest_ips_group csr_dim_directory McAfee Content Security Reporter 2.4.0 Migration Guide 17

A Feature comparison matrix and schemas Comparing Content Security Reporter and Web Reporter schemas Web Reporter schema scr_dim_log_source scr_dim_reason scr_dim_reputation scr_dim_site scr_dim_site_request scr_dim_status scr_dim_user scr_dim_usergroup scr_dim_virus scr_fct_exact_access scr_fct_web Content Security Reporter schema csr_dim_group csr_dim_groups_per_user csr_dim_ipaddress csr_dim_reason csr_dim_reputation csr_dim_site csr_dim_site_request csr_dim_status csr_dim_user csr_dim_usergroup csr_schema_properties Fields used by McAfee Web Gateway csr_fct_exact_access csr_fct_web Fields used by McAfee Email Protection, McAfee Email Gateway, McAfee Email and Web Security (Email) csr_dim_email_action csr_dim_email_connection_info csr_dim_email_dest_domain csr_dim_email_dest_ip csr_dim_email_destination csr_dim_email_event_type csr_dim_email_log_source csr_dim_email_log_source_device csr_dim_email_log_source_name csr_dim_email_log_source_type csr_dim_email_policy csr_dim_email_reason csr_dim_email_scanner csr_dim_email_sender csr_dim_email_sender_info csr_dim_email_src_domain csr_dim_email_src_ip csr_dim_email_virus csr_fct_exact_email_delivery csr_fct_exact_email_detection csr_fct_summary_email Fields used by McAfee One Time Password csr_dim_otp_delivery_method 18 McAfee Content Security Reporter 2.4.0 Migration Guide

Feature comparison matrix and schemas Comparing Content Security Reporter and Web Reporter schemas A Web Reporter schema Content Security Reporter schema csr_dim_otp_geo csr_dim_otp_hostname csr_dim_otp_identity csr_dim_otp_log_source csr_dim_otp_log_source_name csr_dim_otp_log_source_type csr_dim_otp_reason csr_dim_otp_result csr_dim_otp_username csr_fct_exact_otp Fields used by McAfee Advanced Threat Defense csr_dim_matd csr_dim_matd_action csr_dim_matd_action_request csr_dim_matd_agent csr_dim_matd_category csr_dim_matd_directory csr_dim_matd_file_hash csr_dim_matd_filename csr_dim_matd_group csr_dim_matd_groups_per_user csr_dim_matd_ipaddress csr_dim_matd_log_source csr_dim_matd_log_source_name csr_dim_matd_log_source_type csr_dim_matd_malware csr_dim_matd_reason csr_dim_matd_reputation csr_dim_matd_server csr_dim_matd_severity csr_dim_matd_site csr_dim_matd_site_request csr_dim_matd_status csr_dim_matd_user csr_dim_matd_usergroup csr_fct_exact_matd Fields used by McAfee Network Security Manager csr_fct_exact_ips_alerts csr_dim_ips_action McAfee Content Security Reporter 2.4.0 Migration Guide 19

A Feature comparison matrix and schemas Comparing Content Security Reporter and Web Reporter schemas Web Reporter schema Content Security Reporter schema csr_dim_ips_alert_information csr_dim_ips_alert_severity csr_dim_ips_alert_type csr_dim_ips_appinfo csr_dim_ips_application_category csr_dim_ips_application_name csr_dim_ips_application_protocol csr_dim_ips_application_risk csr_dim_ips_attack_category csr_dim_ips_attack_name csr_dim_ips_conninfo csr_dim_ips_dest_directory csr_dim_ips_dest_geo csr_dim_ips_dest_groups_per_user csr_dim_ips_dest_ip csr_dim_ips_dest_reputation csr_dim_ips_dest_user csr_dim_ips_dest_usergroup csr_dim_ips_detection_engine csr_dim_ips_group csr_dim_ips_groups_per_user csr_dim_ips_log_source csr_dim_ips_log_source_name csr_dim_ips_log_source_sensor csr_dim_ips_log_source_type csr_dim_ips_malware csr_dim_ips_malware_confidence csr_dim_ips_malware_filename csr_dim_ips_policy csr_dim_ips_src_directory csr_dim_ips_src_geo csr_dim_ips_src_ip csr_dim_ips_src_reputation csr_dim_ips_src_user csr_dim_ips_usergroup csr_dim_ips_virus_name 20 McAfee Content Security Reporter 2.4.0 Migration Guide

0-00