Summary of the content on the page No. 1
® Threat Analysis Reporter
EVALUATION
GUIDE
Models: TAR HL/SL/MSA
Software Version: 1.3.00
Document Version: 01.05.09
Summary of the content on the page No. 2
THREAT ANALYSIS REPORTER EVALUATION GUIDE © 2009 8e6 Technologies All rights reserved. Printed in the United States of America Local: 714.282.6111 • Domestic U.S.: 1.888.786.7999 • International: +1.714.282.6111 This document may not, in whole or in part, be copied, photocopied, reproduced, trans- lated, or reduced to any electronic medium or machine readable form without prior writ- ten consent from 8e6 Technologies. Every effort has been made to ensure the accuracy of this document. However, 8
Summary of the content on the page No. 3
CONTENTS THREAT ANALYSIS REPORTER EVALUATION GUIDE ..........................................1 Overview. ......................................................................................................................... 1 Note to Evaluators. ......................................................................................................... 1 Install, Configure, and Test TAR.................................................................................... 1 CHAPTER 1: ACCESS THE TA
Summary of the content on the page No. 4
CONTENTS CHAPTER 5: VIEW A URL TREND REPORT ....................................................14 Step 1: Access Trend Charts. ...................................................................................... 14 Step 2: Change the Time Span. ................................................................................... 14 CHAPTER 6: MONITOR BANDWIDTH GAUGES .................................................15 Step 1: Select Bandwidth and Outbound........................................
Summary of the content on the page No. 5
THREAT ANALYSIS REPORTER EVALUATION GUIDE OVERVIEW THREAT ANALYSIS REPORTER EVALUATION GUIDE Overview The Threat Analysis Reporter helps administrators manage internal Web-based threats by monitoring Internet usage information by user in real-time, and by providing proactive remediation tools to enforce the organization’s Acceptable Use Policy. Note to Evaluators Thank you for taking the time to review 8e6’s Threat Analysis Reporter (TAR) appli- ance. Your interest in our company and product
Summary of the content on the page No. 6
CHAPTER 1: ACCESS THE TAR WEB CLIENT STEP 1: LAUNCH IE CHAPTER 1: ACCESS THE TAR WEB CLIENT Step 1: Launch IE From your workstation, launch Internet Explorer to open an IE browser window. NOTE: If pop-up blocking software is installed on the workstation, it must be disabled. Information about disabling pop-up blocking software can be found in the TAR User Guide Appendix A: Disable Pop-up Blocking Software. Step 2: Type in the URL In the Address field of the browser window, type in the URL f
Summary of the content on the page No. 7
CHAPTER 1: ACCESS THE TAR WEB CLIENT STEP 3: LOG INTO THE APPLICATION URL dashboard with URL gauges 8E6 TECHNOLOGIES, THREAT ANALYSIS REPORTER EVALUATION GUIDE 3
Summary of the content on the page No. 8
CHAPTER 2: DRILL DOWN INTO A URL GAUGE STEP 1: HOW TO READ A GAUGE CHAPTER 2: DRILL DOWN INTO A URL GAUGE This section will step you through the manual monitoring of users in real-time via the URL gauge dashboard. Note that this is simply one of many ways to use TAR to monitor insider threats. There is also a robust automated alert component that does not require the system administrator to be monitoring gauges in order to be notified of a violation in process. Step 1: How to Read a Gauge
Summary of the content on the page No. 9
CHAPTER 2: DRILL DOWN INTO A URL GAUGE STEP 2: VIEW CHILD GAUGES Time Span Each gauge monitors events in real-time for a window of time between one and 60 minutes. This time span is customizable by the administrator. For example, if a gauge is set for 15 minutes, that gauge will indicate the number of page hits for the last 15 minutes of time. For example, if the current time is 12:00, the gauge score will reflect all activity from 11:45 to 12:00. Once the time is 12:01, the gauge will ref
Summary of the content on the page No. 10
CHAPTER 2: DRILL DOWN INTO A URL GAUGE STEP 3: VIEW A LIST OF USERS AFFECTING A CHILD GAUGE Step 3: View a List of Users Affecting a Child Gauge Double-click the child gauge to open a window containing a list of users who are responsible for driving that gauge’s score. In this example, double-click the “Spyware” child gauge. Open the child gauges window Step 4: View an Individual User’s Gauge Activity In the Spyware window, select the top name from the user list and click “User Summary” to
Summary of the content on the page No. 11
CHAPTER 2: DRILL DOWN INTO A URL GAUGE STEP 5: TAKE ACTION ON AN INDIVIDUAL’S ACTIVITY Step 5: Take Action on an Individual’s Activity In the Individual User View window, select the “Security” gauge from the list and then click the “Category View” button to view the hits and score the user obtained for each Security sub-category. The Individual User View window also lets you lock out the user from further accessing a category. This action is called a “manual lockout.” Lockouts can be define
Summary of the content on the page No. 12
CHAPTER 2: DRILL DOWN INTO A URL GAUGE STEP 7: VIEW THE ACTUAL WEB PAGE VISITED BY THE USER Step 7: View the Actual Web Page Visited by the User You can now view the full URL details for this specific user. In this example, select the first URL in the list and then click “Open URL” to open the actual Web page the end user visited. View URL Details 8 8E6 TECHNOLOGIES, THREAT ANALYSIS REPORTER EVALUATION GUIDE
Summary of the content on the page No. 13
CHAPTER 3: CREATE A NEW URL GAUGE STEP 1: SELECT THE GAUGES MENU ITEM CHAPTER 3: CREATE A NEW URL GAUGE Step 1: Select the Gauges Menu Item In order to create a new custom gauge, select the “Gauges” menu item from the left-hand menu. This action will open a pop-up window (see Step 2). Select Gauges from left panel Step 2: Add a Gauge Group Click on the “Add Gauge Group” button to set parameters for the gauge. Add a new gauge 8E6 TECHNOLOGIES, THREAT ANALYSIS REPORTER EVALUATION GUIDE 9
Summary of the content on the page No. 14
CHAPTER 3: CREATE A NEW URL GAUGE STEP 3: DEFINE THE GAUGE Step 3: Define the Gauge This section will explain how to set parameters for the new custom gauge. Define components for the gauge 1. Type in a name in the “Group Name” field (name it whatever you like). 2. Put in ‘0’ in the “Lower Limit Value” field. 3. Put in ‘1000’ in the “Upper Limit Value” field. NOTE: If you do not know what number to set for the upper limit threshold, you can get a better idea by running a URL Trend Report fo
Summary of the content on the page No. 15
CHAPTER 3: CREATE A NEW URL GAUGE STEP 4: ADVANCED SETTINGS Step 4: Advanced Settings For the purposes of this demonstration, click the “Next” button to open a window where you configure advanced settings. Specify thresholds and the gauge method In this window you can specify different thresholds for each child category. For example, if you deemed “Alcohol” more critical than “Art” you would set a lower threshold for Alcohol. Also, you can choose a different gauge method other than “All”. F
Summary of the content on the page No. 16
CHAPTER 4: CREATE AN AUTOMATED ALERT STEP 1: SELECT ALERTS CHAPTER 4: CREATE AN AUTOMATED ALERT This section will step you through the process of creating an automated threshold per user, so you can be automatically notified via email and the violating user will be automatically locked out once a threshold is exceeded. Step 1: Select Alerts In the left-hand menu tree, click “Policy” to explode the sub-options, and then click “Alerts”. This action will open a pop-up window (see Step 2). Sel
Summary of the content on the page No. 17
CHAPTER 4: CREATE AN AUTOMATED ALERT STEP 3: SPECIFY ALERT COMPONENTS Step 3: Specify Alert Components Create a new alert by performing the following actions: 1. Click on one of the gauge names in the “Current Gauge” list (e.g. “Adult Content”). 2. Enable Alert Action checkboxes for “Email” and “Lockout”. 3. Type in the name for your alert in the “Alert Name” field. 4. Type in an email address and click the “Add Email” button. This is the address of the person who will be notified when an ale
Summary of the content on the page No. 18
CHAPTER 5: VIEW A URL TREND REPORT STEP 1: ACCESS TREND CHARTS CHAPTER 5: VIEW A URL TREND REPORT TAR lets you generate historical trend reports that show activity by URL categories and bandwidth protocols for a specified time period. These trend reports are helpful for monitoring improvement of activity in a certain category as well as providing a good tool for setting appropriate thresholds for each TAR gauge. Step 1: Access Trend Charts Click the “Report/Analysis” menu and then the “Tre
Summary of the content on the page No. 19
CHAPTER 6: MONITOR BANDWIDTH GAUGES STEP 1: SELECT BANDWIDTH AND OUTBOUND CHAPTER 6: MONITOR BANDWIDTH GAUGES In addition to monitoring URL activity by user, TAR lets you view bandwidth activity by user, protocol and port for both inbound and outbound activity. This information can then be easily compared to the user’s URL activity, providing a complete picture of the user’s Web behavior. Step 1: Select Bandwidth and Outbound Select the “Bandwidth” menu option and the “Outbound” sub-menu opt
Summary of the content on the page No. 20
CHAPTER 6: MONITOR BANDWIDTH GAUGES STEP 3: SELECT PORT 21 CHILD GAUGE Step 3: Select Port 21 Child Gauge Double-click on “Port 21” child gauge. FTP Port 21 gauge Step 4: View the User Summary Select one of the IP addresses in the list and then click the “User Summary” button. View User Summary 16 8E6 TECHNOLOGIES, THREAT ANALYSIS REPORTER EVALUATION GUIDE
