Product guide

• FTP Server
•
A directory on the report server
Log formats
Log formats determine how Content Security Reporter processes (also called parsing) data from log
files and stores it in the database. Accurate reports depend on Content Security Reporter using the
correct log format to recognize the type of data and store it correctly in the database.
Content Security Reporter is set up to recognize the structure of various log formats.
Log formats consist of automatic-discover and fixed-field log formats.
When your web filtering device generates logs that match one of the log formats listed in Content
Securit
y Reporter, all you need to do is select the log format from the list and Content Security
Reporter recognizes and stores the data correctly in the database. Content Security Reporter can
accept data in the following formats:
• McAfee Web Gateway (Webwasher) — Auto Discover format
• McAfee SmartFilter IFP SFv4 — Text format
• McAfee SaaS Web Protection Service
• McAfee Firewall Enterprise (Sidewinder) SFv4 — Text format
• McAfee SiteAdvisor Enterprise format
• McAfee Web Security format
• Blue Coat SG — Auto Discover format
Custom columns, rule sets, and user-defined columns overview
Custom columns and user-defined columns are similar, yet separate, features for use when processing
log files. When used, custom columns and user-defined columns use rule sets that act as a search and
replace function that will substitute specific log file data with a different string that better identifies the
data.
In this feature, the rule sets do most of the work. You set up rule sets to identify which data you want
to find and what you want to replace it with. For example, you want to find the URL category Auctions/
Classifieds and replace it with the string non-productive. Now that the rule set knows to find Auctions/
Classifieds and to replace it with non-productive, you need to point the rule set at the correct log file
record or header. In this case, you would apply this rule set to a user-defined column in the log source
setup and select the log record URL category.
• Custom columns are predefined columns with predefined rule sets. These columns and corresponding
rule sets cannot be deleted; however, the rule sets for the columns can be edited.
• User-defined columns are for you, the user, to configure. These columns and corresponding rules can be
deleted, copied, and used by more than one column at a time.
• Custom rule sets are instructions that tell Content Security Reporter to search for a specific string and
replace it with a different string.
5
Log sources and log formats
Log sources
overview
34
McAfee Content Security Reporter 1.0.0 Software Product Guide