User Guide

1-11

Cisco Advanced Web Security Reporting Installation, Setup, and User Guide

Chapter 1 Installation and Setup

Set Up On-going Data Transfers

Before You Begin

• Import and Index Historical Data, page 1-9

• Know the path to your log files: Create the Folder Structure for Access and Traffic Monitor

Log Files, page 1-9.

• Log into the Enterprise Web as admin.

Configure Data Inputs for WSA Logs

Note To configure data input from multiple WSAs, repeat the following steps for each host.

Step 1 In the Advanced Web Security Reporting application:

• Choose Settings > Data inputs > Files & directories.

Step 2 Disable any inputs labeled CiscoWSA.

Step 3 Click New.

Step 4 Click Continuously Monitor and provide the full path to the Advanced Web Security Reporting FTP

directory to which WSA logs will be sent.

This path and the FTP path provided on the WSA’s Log Subscription page must match.

Step 5 Click Next.

Step 6 Click Manual as the Sourcetype and provide the Sourcetype label (either wsa_accesslogs or

wsa_trafmonlogs in this case).

Step 7 Choose Cisco WSA - Advanced Reporting from the App Context menu.

Step 8 Click Constant value and provide the Advanced Web Security Reporting host name in the Host field

value field.

Step 9 Choose Default as the destination Index.

Step 10 Click Review and review the values you provided.

Step 11 Click Submit.

Note You can navigate to Settings > Data inputs > Files & directories to confirm the new data input entry.

Configuration Of Data Input for WSA Syslogs

Step 1 In the Advanced Web Security Reporting application:

• Choose Settings > Data inputs > TCP.

Step 2 Click New.

Step 3 Click the TCP button and enter 514 in the Port field; leave the rest of the fields blank.

Step 4 Click Next.