® Threat Analysis Reporter EVALUATION GUIDE Models: TAR HL/SL/MSA Software Version: 1.3.00 Document Version: 01.05.
THREAT ANALYSIS REPORTER EVALUATION GUIDE © 2009 8e6 Technologies All rights reserved. Printed in the United States of America Local: 714.282.6111 • Domestic U.S.: 1.888.786.7999 • International: +1.714.282.6111 This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine readable form without prior written consent from 8e6 Technologies. Every effort has been made to ensure the accuracy of this document.
CONTENTS THREAT ANALYSIS REPORTER EVALUATION GUIDE ..........................................1 Overview. ......................................................................................................................... 1 Note to Evaluators. ......................................................................................................... 1 Install, Configure, and Test TAR....................................................................................
CONTENTS CHAPTER 5: VIEW A URL TREND REPORT ....................................................14 Step 1: Access Trend Charts. ...................................................................................... 14 Step 2: Change the Time Span. ................................................................................... 14 CHAPTER 6: MONITOR BANDWIDTH GAUGES .................................................15 Step 1: Select Bandwidth and Outbound..................................................
THREAT ANALYSIS REPORTER EVALUATION GUIDE OVERVIEW THREAT ANALYSIS REPORTER EVALUATION GUIDE Overview The Threat Analysis Reporter helps administrators manage internal Web-based threats by monitoring Internet usage information by user in real-time, and by providing proactive remediation tools to enforce the organization’s Acceptable Use Policy. Note to Evaluators Thank you for taking the time to review 8e6’s Threat Analysis Reporter (TAR) appliance.
CHAPTER 1: ACCESS THE TAR WEB CLIENT STEP 1: LAUNCH IE CHAPTER 1: ACCESS THE TAR WEB CLIENT Step 1: Launch IE From your workstation, launch Internet Explorer to open an IE browser window. NOTE: If pop-up blocking software is installed on the workstation, it must be disabled. Information about disabling pop-up blocking software can be found in the TAR User Guide Appendix A: Disable Pop-up Blocking Software.
CHAPTER 1: ACCESS THE TAR WEB CLIENT STEP 3: LOG INTO THE APPLICATION URL dashboard with URL gauges 8E6 TECHNOLOGIES, THREAT ANALYSIS REPORTER EVALUATION GUIDE 3
CHAPTER 2: DRILL DOWN INTO A URL GAUGE STEP 1: HOW TO READ A GAUGE CHAPTER 2: DRILL DOWN INTO A URL GAUGE This section will step you through the manual monitoring of users in real-time via the URL gauge dashboard. Note that this is simply one of many ways to use TAR to monitor insider threats. There is also a robust automated alert component that does not require the system administrator to be monitoring gauges in order to be notified of a violation in process.
CHAPTER 2: DRILL DOWN INTO A URL GAUGE STEP 2: VIEW CHILD GAUGES Time Span Each gauge monitors events in real-time for a window of time between one and 60 minutes. This time span is customizable by the administrator. For example, if a gauge is set for 15 minutes, that gauge will indicate the number of page hits for the last 15 minutes of time. For example, if the current time is 12:00, the gauge score will reflect all activity from 11:45 to 12:00.
CHAPTER 2: DRILL DOWN INTO A URL GAUGE STEP 3: VIEW A LIST OF USERS AFFECTING A CHILD GAUGE Step 3: View a List of Users Affecting a Child Gauge Double-click the child gauge to open a window containing a list of users who are responsible for driving that gauge’s score. In this example, double-click the “Spyware” child gauge.
CHAPTER 2: DRILL DOWN INTO A URL GAUGE STEP 5: TAKE ACTION ON AN INDIVIDUAL’S ACTIVITY Step 5: Take Action on an Individual’s Activity In the Individual User View window, select the “Security” gauge from the list and then click the “Category View” button to view the hits and score the user obtained for each Security sub-category. The Individual User View window also lets you lock out the user from further accessing a category. This action is called a “manual lockout.
CHAPTER 2: DRILL DOWN INTO A URL GAUGE STEP 7: VIEW THE ACTUAL WEB PAGE VISITED BY THE USER Step 7: View the Actual Web Page Visited by the User You can now view the full URL details for this specific user. In this example, select the first URL in the list and then click “Open URL” to open the actual Web page the end user visited.
CHAPTER 3: CREATE A NEW URL GAUGE STEP 1: SELECT THE GAUGES MENU ITEM CHAPTER 3: CREATE A NEW URL GAUGE Step 1: Select the Gauges Menu Item In order to create a new custom gauge, select the “Gauges” menu item from the left-hand menu. This action will open a pop-up window (see Step 2). Select Gauges from left panel Step 2: Add a Gauge Group Click on the “Add Gauge Group” button to set parameters for the gauge.
CHAPTER 3: CREATE A NEW URL GAUGE STEP 3: DEFINE THE GAUGE Step 3: Define the Gauge This section will explain how to set parameters for the new custom gauge. Define components for the gauge 1. Type in a name in the “Group Name” field (name it whatever you like). 2. Put in ‘0’ in the “Lower Limit Value” field. 3. Put in ‘1000’ in the “Upper Limit Value” field.
CHAPTER 3: CREATE A NEW URL GAUGE STEP 4: ADVANCED SETTINGS Step 4: Advanced Settings For the purposes of this demonstration, click the “Next” button to open a window where you configure advanced settings. Specify thresholds and the gauge method In this window you can specify different thresholds for each child category. For example, if you deemed “Alcohol” more critical than “Art” you would set a lower threshold for Alcohol. Also, you can choose a different gauge method other than “All”.
CHAPTER 4: CREATE AN AUTOMATED ALERT STEP 1: SELECT ALERTS CHAPTER 4: CREATE AN AUTOMATED ALERT This section will step you through the process of creating an automated threshold per user, so you can be automatically notified via email and the violating user will be automatically locked out once a threshold is exceeded. Step 1: Select Alerts In the left-hand menu tree, click “Policy” to explode the sub-options, and then click “Alerts”. This action will open a pop-up window (see Step 2).
CHAPTER 4: CREATE AN AUTOMATED ALERT STEP 3: SPECIFY ALERT COMPONENTS Step 3: Specify Alert Components Create a new alert by performing the following actions: 1. Click on one of the gauge names in the “Current Gauge” list (e.g. “Adult Content”). 2. Enable Alert Action checkboxes for “Email” and “Lockout”. 3. Type in the name for your alert in the “Alert Name” field. 4. Type in an email address and click the “Add Email” button.
CHAPTER 5: VIEW A URL TREND REPORT STEP 1: ACCESS TREND CHARTS CHAPTER 5: VIEW A URL TREND REPORT TAR lets you generate historical trend reports that show activity by URL categories and bandwidth protocols for a specified time period. These trend reports are helpful for monitoring improvement of activity in a certain category as well as providing a good tool for setting appropriate thresholds for each TAR gauge.
CHAPTER 6: MONITOR BANDWIDTH GAUGES STEP 1: SELECT BANDWIDTH AND OUTBOUND CHAPTER 6: MONITOR BANDWIDTH GAUGES In addition to monitoring URL activity by user, TAR lets you view bandwidth activity by user, protocol and port for both inbound and outbound activity. This information can then be easily compared to the user’s URL activity, providing a complete picture of the user’s Web behavior. Step 1: Select Bandwidth and Outbound Select the “Bandwidth” menu option and the “Outbound” sub-menu option.
CHAPTER 6: MONITOR BANDWIDTH GAUGES STEP 3: SELECT PORT 21 CHILD GAUGE Step 3: Select Port 21 Child Gauge Double-click on “Port 21” child gauge. FTP Port 21 gauge Step 4: View the User Summary Select one of the IP addresses in the list and then click the “User Summary” button.
CHAPTER 6: MONITOR BANDWIDTH GAUGES STEP 5: VIEW PORT TRAFFIC Step 5: View Port Traffic Select the “FTP” protocol from the list and click the “Port View” button. The port traffic for this user will display for each of the ports assigned to FTP (e.g. Port 20 and 21).
CHAPTER 7: VIEW A BANDWIDTH TREND REPORT STEP 1: SELECT BANDWIDTH AND TREND CHART CHAPTER 7: VIEW A BANDWIDTH TREND REPORT As stated in Chapter 5, TAR has historical trend reports to demonstrate activity by URL categories and bandwidth protocols over a period of time. Bandwidth trend reports are helpful for monitoring bandwidth consumption improvement over time, as well as providing a good tool for setting appropriate thresholds for each TAR bandwidth gauge.
