M86 Security Threat Analysis Reporter User manual

M86 Threat Analysis Reporter
USER GUIDE
Software Version: 2.1.10
Document Version:06.01.10

II M86 SECURITY USER GUIDE
M86 THREAT ANALYSIS REPORTER USER
GUIDE
© 2010 M86 Security
All rights reserved.
828 W. Taft Ave., Orange, CA 92865, USA
Version 1.01, published June 2010 for software release 2.1.10
Printed in the United States of America
This document may not, in whole or in part, be copied, photo-
copied, reproduced, translated, or reduced to any electronic
medium or machine readable form without prior written con-
sent from M86 Security.
Every effort has been made to ensure the accuracy of this
document. However, M86 Security makes no warranties with
respect to this documentation and disclaims any implied war-
ranties of merchantability and fitness for a particular purpose.
M86 Security shall not be liable for any error or for incidental
or consequential damages in connection with the furnishing,
performance, or use of this manual or the examples herein.
Due to future enhancements and modifications of this product,
the information described in this documentation is subject to
change without notice.
The latest version of this document can be obtained from
http://www.m86security.com/support/Threat-Analysis-
Reporter/documentation.asp
Trademarks
Other product names mentioned in this manual may be trade-
marks or registered trademarks of their respective companies
and are the sole property of their respective manufacturers.
Part# TAR-UG_v1.01-1006

M86 SECURITY USER GUIDE iii
CONTENTS
I NTRODUCTORY S ECTION .................................................. 1
Threat Analysis Reporter ........................................................... 1
About this User Guide ................................................................ 2
How to Use this User Guide ....................................................... 3
Conventions ...................................................................................... 3
Terminology ...................................................................................... 4
Environment Requirements ....................................................... 8
Workstation Requirements ................................................................ 8
Network Requirements ...................................................................... 9
Installation Prerequisite ..................................................................... 9
Getting Started .......................................................................... 10
Initial Setup ..................................................................................... 10
Procedures for Logging On, Off ...................................................... 11
Access the TAR Administrator Login window ........................... 11
Log in ........................................................................................ 12
Navigation toolbar menu links and topics ................................. 13
Exit the user interface ............................................................... 14
Navigation Tips and Conventions ...........................................15
P RELIMINARY S ETUP S ECTION ........................................ 17
Introduction ............................................................................... 17
Chapter 1: User Groups Setup ................................................. 18
View User Group Information .......................................................... 20
User group status key ............................................................... 20
View a list of members in a user group ..................................... 20
Add a User Group ........................................................................... 22
Patterns frame .......................................................................... 23
Add a new pattern ............................................................... 23
View users resolved by the pattern .................................... 24
Remove a pattern................................................................ 24

CONTENTS
iv M86 SECURITY USER GUIDE
IP Ranges frame ....................................................................... 25
Specify an IP range ............................................................ 26
Remove an IP address range ............................................. 27
Single Users frame . .................................................................. 28
Add one or more individual users ....................................... 29
Use the filter to narrow Available Users results ............ 29
Select users to add to the Assigned Users list ............. 29
Remove users from the Add tab ........................................ 30
Edit a User Group ........................................................................... 31
Rebuild the User Group .................................................................. 32
Delete a User Group ....................................................................... 32
Chapter 2: Admin Groups Setup ............................................. 33
Add a Group .................................................................................... 34
View, Edit an Admin Group’s Permissions ...................................... 36
View Admin Group settings ...................................................... 36
Edit Admin Group settings . ....................................................... 37
Delete an Administrator Group ........................................................ 37
Chapter 3: Admins Setup ......................................................... 38
Add an Administrator Profile ........................................................... 39
View, Edit Admin Detail ................................................................... 42
View Admin Details ................................................................... 42
Edit Account Info . ..................................................................... 43
Delete Admin ................................................................................... 44
C ONFIGURATION S ECTION ............................................... 45
Introduction ............................................................................... 45
Chapter 1: Gauge Components ............................................... 46
Types of Gauges ............................................................................. 46
Anatomy of a Gauge ....................................................................... 47
How to Read a Gauge ..................................................................... 48
Bandwidth Gauge Components ...................................................... 49
Gauge Usage Shortcuts .................................................................. 51
Chapter 2: Custom Gauge Setup, Usage ................................53
Add a Gauge ................................................................................... 55
Specify Gauge Information . ...................................................... 56
Define Gauge Components ...................................................... 57

CONTENTS
M86 SECURITY USER GUIDE v
Assign user groups ................................................................... 58
Save gauge settings ................................................................. 59
Modify a Gauge ............................................................................... 60
Edit gauge settings ................................................................... 60
Hide, Disable, Delete, Rearrange Gauges ...................................... 62
Hide a gauge . ........................................................................... 64
Disable a gauge ........................................................................ 64
Show a gauge ........................................................................... 64
Rearrange the gauge display in the dashboard ........................ 64
Delete a gauge ......................................................................... 65
View End User Gauge Activity ........................................................ 66
View Overall Ranking ............................................................... 66
View a Gauge Ranking table .................................................... 67
Monitor, Restrict End User Activity .................................................. 69
View User Summary data ......................................................... 69
Access the Threat View User panel ......................................... 70
URL Gauges tab selection .................................................. 70
Bandwidth Gauges tab selection ........................................ 72
Manually lock out an end user .................................................. 73
Low severity lockout............................................................ 74
Medium and High severity lockout ..................................... 75
End user workstation lockout .............................................. 75
Low severity URL, medium URL/bandwidth lockout..... 75
High severity URL, low/high bandwidth lockout............ 76
Chapter 3: Alerts, Lockout Management ................................77
Add an Alert .................................................................................... 79
Email alert function ................................................................... 80
Configure email alerts ......................................................... 80
Receive email alerts............................................................ 81
System Tray alert function ........................................................ 81
Lockout function . ...................................................................... 82
View, Modify, Delete an Alert .......................................................... 83
View alert settings . ................................................................... 84
Modify an alert . ......................................................................... 85
Delete an alert .......................................................................... 86
View the Alert Log ........................................................................... 87
Manage the Lockout List ................................................................. 89
View a specified time period of lockouts ................................... 90
Unlock workstations .................................................................. 91
Access User Summary details .................................................. 91

CONTENTS
vi M86 SECURITY USER GUIDE
Chapter 4: Analyze Usage Trends ...........................................92
View Trend Charts .......................................................................... 93
View activity for an individual gauge ......................................... 93
View overall gauge activity . ...................................................... 95
Navigate a trend chart .............................................................. 96
View gauge activity for a different time period ................... 97
Analyze gauge activity in a pie chart .................................. 98
Analyze gauge activity in a line chart ................................. 99
View In/Outbound bandwidth gauge activity .................... 101
Print a trend chart from an IE browser window ................. 101
Access Web Filter, ER Applications .............................................. 102
Access the Web Filter ............................................................. 102
Access the ER Web Client application ................................... 102
Access the ER Administrator console ..................................... 102
Chapter 5: Identify Users, Threats ......................................... 103
Perform a Custom Search ............................................................. 103
Specify Search Criteria . .......................................................... 104
View URLs within the accessed category ........................ 106
A DMINISTRATION S ECTION ............................................ 107
Introduction ............................................................................. 107
Chapter 1: View the User Profiles List .................................. 109
Search the User Database ............................................................ 110
View End User Activity ........................................................... 110
Chapter 2: View Administrator Activity ................................. 111
Perform a Search on a Specified Activity ...................................... 112
Search results ......................................................................... 114
Chapter 3: Maintain the Device Registry ..............................115
Generate an SSL Certificate for TAR ............................................ 117
Restart the TAR server ................................................................. 117
Shut down the TAR server ............................................................ 117
Web Filter Device Maintenance .................................................... 118
View, edit Web Filter device criteria ........................................ 118
Add a Web Filter to the device registry ................................... 119
Delete a Web Filter from the device registry ........................... 119
Threat Analysis Reporter Maintenance ......................................... 120

CONTENTS
M86 SECURITY USER GUIDE vii
View TAR device criteria ........................................................ 120
Add, remove a bandwidth range ............................................. 121
ER Device Maintenance ................................................................ 122
Add an ER to the device registry ............................................ 122
View, edit ER device criteria ................................................... 123
Delete the ER device from the registry ................................... 123
View Other Device Criteria ............................................................ 124
View SMTP device criteria ...................................................... 124
View Patch Server device criteria ........................................... 124
View NTP Server device criteria ............................................. 125
View Proxy Server device criteria ........................................... 125
Sync All Devices ........................................................................... 125
Chapter 4: Perform Backup, Restoration .............................. 127
Execute a Backup on Demand ...................................................... 129
Restore User Settings ................................................................... 130
Restore to Factory Default Settings .............................................. 131
Reset to Factory Default Settings frame ................................. 131
Wizard Login window .............................................................. 132
T ECHNICAL S UPPORT / P RODUCT W ARRANTIES ............. 135
Technical Support ................................................................... 135
Hours ............................................................................................. 135
Contact Information ....................................................................... 135
Domestic (United States) ........................................................ 135
International ............................................................................ 135
E-Mail ..................................................................................... 135
Office Locations and Phone Numbers .................................... 136
M86 Corporate Headquarters (USA)................................. 136
M86 Taiwan....................................................................... 136
Support Procedures ...................................................................... 137
Product Warranties ................................................................. 138
Standard Warranty ........................................................................ 138
Technical Support and Service .....................................................139
Extended Warranty (optional) ....................................................... 140
Extended Technical Support and Service ..................................... 140
A PPENDICES S ECTION ................................................... 141

CONTENTS
viii M86 SECURITY USER GUIDE
Appendix A .............................................................................. 141
Disable Pop-up Blocking Software ................................................ 141
Yahoo! Toolbar Pop-up Blocker .................................................... 141
Add the Client to the White List .............................................. 141
Google Toolbar Pop-up Blocker .................................................... 143
Add the Client to the White List .............................................. 143
AdwareSafe Pop-up Blocker ......................................................... 144
Disable Pop-up Blocking ........................................................ 144
Mozilla Firefox Pop-up Blocker ..................................................... 145
Add the Client to the White List .............................................. 145
Windows XP SP2 Pop-up Blocker ................................................ 147
Set up Pop-up Blocking .......................................................... 147
Use the Internet Options dialog box.................................. 147
Use the IE Toolbar ............................................................ 148
Add the Client to the White List . ............................................. 149
Use the IE Toolbar ............................................................ 149
Use the Information Bar ................................................... 150
Set up the Information Bar.......................................... 150
Access the Client ........................................................ 150
Appendix B .............................................................................. 152
System Tray Alerts: Setup, Usage ................................................ 152
LDAP server configuration ...................................................... 152
Create the System Tray logon script................................. 152
Assign System Tray logon script to administrators ........... 156
Administrator usage of System Tray ....................................... 158
Use the TAR Alert icon’s menu ......................................... 158
Status of the TAR Alert icon.............................................. 159
View System Tray alert messages.................................... 160
Appendix C .............................................................................. 161
RAID Maintenance and Troubleshooting ...................................... 161
Part 1: Hardware Components . .............................................. 162
Part 2: Server Interface .......................................................... 162
LED indicators in SL and HL units .................................... 162
Front control panels on H, SL, and HL units ..................... 164
Rear panels on H and HL units ......................................... 166
Part 3: Troubleshooting .......................................................... 167
Hard drive failure............................................................... 167
Step 1: Review the notification email.......................... 167
Step 2: Verify the failed drive in the Admin console ... 168

CONTENTS
M86 SECURITY USER GUIDE ix
Step 3: Replace the failed hard drive.......................... 169
Step 4: Rebuild the hard drive .................................... 170
Step 5: Contact Technical Support ............................. 171
Power supply failure.......................................................... 171
Step 1: Identify the failed power supply ...................... 171
Step 2: Unplug the power cord ................................... 171
Step 3: Replace the failed power supply .................... 172
Step 4: Contact Technical Support ............................. 172
Fan failure ......................................................................... 173
Identify a fan failure .................................................... 173
Appendix D .............................................................................. 174
Glossary ........................................................................................ 174
I NDEX ........................................................................... 177

CONTENTS
xM86 SECURITY USER GUIDE