8e6 Technologies TAR HL/SL/MSA manual

® Threat Ana lysis Repo r ter EV ALUA TION GUIDE Models: T AR HL/SL/MSA Software V ersion: 1.3.00 Document V ersion: 01.05.09[...]

ii 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATIO N G UIDE T HREAT A NALYSIS R EPORTER E VALUATION G UIDE © 2009 8e6 T echnologies All rights reserved. Prin ted in the United S t ates of America Local: 714.28 2.61 1 1 • Domestic U.S.: 1.8 88.786.7999 • International: +1.714.282.61 1 1 This document may not, in whole or in part, b[...]

8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATION G UIDE iii C ONTENT S T HREAT A NALYSIS R EPORTER E VALUATION G UIDE .............. ................ ............ 1 Overview. ............................................. ..................................................... .................... ... 1 Note to Evaluators. ...............[...]

C ONTENTS iv 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATION G UIDE C HAPTER 5: V IEW A URL T REND R EPORT ................ ............... ........... .......... 14 Step 1: Access Trend Charts. ............................................ .......................................... 14 Step 2: Change the Time Span. ....................[...]

T HREAT A NALYSIS R EPORTER E VALUATION G UIDE O VERVIEW 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATION G UIDE 1 T HREAT A NALYSIS R EPORTER E VALUATION G UIDE Overview The Threat Analysis Reporter help s administrators manage internal W eb-based threats by monitoring Inte rnet usage information by user in real-time , and by providin[...]

C HAPTER 1: A CCESS THE TAR W EB C LIENT S TEP 1: L AUNCH IE 2 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATIO N G UIDE C HAPTER 1: A CCESS THE TA R W EB C LIENT S tep 1: Launch IE From your workstation , launch Internet Explorer to op en an IE browser window . NOTE : If pop-up blocking sof tware is inst alled on the workstation, it mu[...]

C HAPTER 1: A CCESS THE TAR W EB C LIE NT S TEP 3: L OG IN TO THE A PPLICATION 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATION G UIDE 3 URL dashboard with URL gauges[...]

C HAPTER 2: D RILL D OWN INTO A URL G AUGE S TEP 1: H OW TO R EAD A G AUGE 4 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATIO N G UIDE C HAPTER 2: D RILL D OWN INTO A URL G AUGE This section will step you through the manual monitoring of users in real-time via the URL gauge dashboard. Note that this is simply one of many ways to use T A[...]

C HAPTER 2: D RILL D OWN INTO A URL G AUGE S TEP 2: V IEW C HI LD G AUGES 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATION G UIDE 5 Ti m e S p an Each gauge monitors events in real-time for a window of time between on e and 60 minutes. This time sp an is customizable by the admin istrator . For example, if a gauge is set for 15 minutes[...]

C HAPTER 2: D RILL D OWN INTO A URL G AUGE S TEP 3: V IEW A L IST OF U SERS A FFECTING A C HILD G AUGE 6 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATIO N G UIDE S tep 3: V iew a List of Us ers Affecting a Child Gauge Double-click the child gauge to open a window cont aining a list of users who are responsible for driving that gauge’[...]

C HAPTER 2: D RIL L D OWN INTO A URL G AUGE S TEP 5: T AKE A CTION ON AN I NDIVIDUAL ’ S A CTIVITY 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATION G UIDE 7 S tep 5: T ake Action on an Individual’ s Activity In the Individual User V iew window , select the “Security” gauge from the list and then click the “Category V iew” b[...]

C HAPTER 2: D RILL D OWN INTO A URL G AUGE S TEP 7: V IEW THE A CT UAL W EB P AGE V ISITED BY THE U SER 8 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATIO N G UIDE S tep 7: V iew the Actual W eb Page V isited by the User Y ou can now view the full URL details for this specific user . In this example, select the first URL in the list and[...]

C HAPTER 3: C REATE A N EW URL G AUGE S TEP 1: S ELECT THE G AUGES M ENU I TEM 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATION G UIDE 9 C HAPTER 3: C REATE A N EW URL G AUGE S tep 1: Select the Gauges Menu Item In order to create a new cust om gauge, select the “Gauges” men u item from the left-hand menu. This action will op en a [...]

C HAPTER 3: C REATE A N EW URL G AUGE S TEP 3: D EFINE THE G AUGE 10 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATIO N G UIDE S tep 3: Define the Gauge This section will explain how to se t parameters fo r the new custom gauge. Define components for the gauge 1. T ype in a name in the “Group Name” field (name it wha tever you like)[...]

C HAPTER 3: C REATE A N EW URL G AUGE S TEP 4: A DVANCED S ETTINGS 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATION G UIDE 11 S tep 4: Advanced Settings For the purposes of this demo nstration, click the “Next” button to open a window where you configure advanced settings. Specify thresholds and the gau ge method In this window you[...]

C HAPTER 4: C REATE AN A UTO MATED A LERT S TEP 1: S ELECT A LERTS 12 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATIO N G UIDE C HAPTER 4: C REATE AN A UTOMATED A LERT This section will step you through the proc ess of creating an automated threshold per user , so you can be automatically no tified via email and the violating user will[...]

C HAPTER 4: C REATE AN A UTOMATED A LERT S TEP 3: S PECIFY A LERT C OMPONENTS 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATION G UIDE 13 S tep 3: S pecify Alert Component s Create a new alert by performing the follo wing actions: 1. Click on one of the gauge names in the “Cu rrent Gauge” list (e.g. “Adult Content”). 2. Enable A[...]

C HAPTER 5: V IEW A URL T REND R EPORT S TEP 1: A CCESS T REND C HARTS 14 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATIO N G UIDE C HAPTER 5: V IEW A URL T REND R EPORT T AR lets you generate historical trend reports t hat show activity by URL categories and bandwidt h protocols for a specified time period. These trend reports are hel[...]

C HAPTER 6: M ONITOR B ANDWIDTH G AUGES S TEP 1: S ELECT B ANDWIDTH AND O UTBO UND 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATION G UIDE 15 C HAPTER 6: M ONITOR B ANDWID TH G AUGES In addition to monito ring URL activity by us er , T AR lets you view bandwidth activity by user , protocol and port for both inbound and outbound activit[...]

C HAPTER 6: M ONITOR B ANDWIDTH G AUGES S TEP 3: S ELECT P ORT 21 C HILD G AUGE 16 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATIO N G UIDE S tep 3: Select Port 21 Child Gauge Double-click on “Port 21” child gauge. FTP Port 21 gauge S tep 4: V iew the User Summary Select one of the IP addresses in the list and then click the “Use[...]

C HAPTER 6: M ONITOR B ANDWIDTH G AUGES S TEP 5: V IEW P ORT T RAFFIC 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATION G UIDE 17 S tep 5: V iew Port T raffic Select the “FTP” protocol from the list and click the “Port V iew” button. The port traffic for th is user will display for each of the port s assigned to FTP (e.g. Port 2[...]

C HAPTER 7: V IEW A B ANDWIDTH T REND R EPORT S TEP 1: S ELECT B ANDWIDTH AND T REND C HAR T 18 8 E 6 T ECHNOLOGIES , T HREAT A NALYSIS R EPORTER E VALUATIO N G UIDE C HAPTER 7: V IEW A B ANDWID TH T REND R EPORT As stated in Chapter 5, T AR has historical trend report s to demonstrate activity by URL categories and bandwid th protocols over a peri[...]