McAfee QUICKCLEAN 1.0 User's Guide

Product GuideRevision AMcAfee Content Security Reporter 1.0.0SoftwareFor use with ePolicy Orchestrator 4.6.2 Software

1IntroductionMcAfee Content Security Reporter features10McAfee Content Security Reporter 1.0.0 Software Product Guide

2Install Content Security ReporterContents System requirements Install Content Security Reporter What changes in ePolicy Orchestrator Conf

Install Content Security Reporter • Download the Content Security Reporter software from the McAfee download site.•Install the Content Security Report

Install the extensions Install the Content Security Reporter extension files in to ePolicy Orchestrator to be able to configurethe report server.Task1

What changes in ePolicy Orchestrator Installing the McAfee Content Security Reporter report server software and Content Security ReporterReporting ext

• System Backup — Create backup configuration files for the Report Server settings, and restore themto the server in case of system failure.• Support

• Log Sources | Custom Columns • Performance Options | Summary Cache• Log Sources | Custom Rule Sets •System Backup4Select active options that you use

4Click OK.The Report Server Settings menu item is removed from the menu bar.5Select the Content Security Reporter Help Content extension, and click Re

2Install Content Security ReporterUninstall McAfee Content Security Reporter18McAfee Content Security Reporter 1.0.0 Software Product Guide

3Configure the databaseMcAfee Content Security Reporter uses a database to store data from log files. Set up a database thatis appropriate for the siz

COPYRIGHTCopyright © 2012 McAfee, Inc. Do not copy without permission.TRADEMARK ATTRIBUTIONSMcAfee, the McAfee logo, McAfee Active Protection, McAfee

• For a small- to medium-size organization•Evaluating Content Security ReporterView information about the internal databaseThe internal database requi

External database useUse an external database when you have more than 50 GB of data to store.Connect McAfee Content Security Reporter to one of these

Database page and Edit Database dialog boxSee information about the database connection status, and get access to database configuration options.Datab

Task1Select Menu | Configuration | Report Server Settings.2Click Database, then click Edit.3Set the database online or offline.4Click Save to confirm

3Configure the databaseIntroduction to database use in McAfee Content Security Reporter24McAfee Content Security Reporter 1.0.0 Software Product Guid

4Maintain the databaseDatabase maintenance options allow you to perform tasks that increase database performance andfree database space.Contents Da

Set up regular database maintenance tasksTo reduce the load on the Content Security Reporter database, configure when and how you want tomanage the nu

Table 4-1 Option definitions (continued)Option DefinitionIndex maintenanceIndex maintenance prevents or corrects performance issues.By default, inde

6Click Save.7Select Database Maintenance | Status to see progress for scheduled maintenance jobs that havecompleted or are running.Rebuild indexes Per

TaskFor option definitions, click ? in the interface.1Select Menu | Configuration | Report Server Settings.2Click Database Maintenance, then click Edi

Contents PrefaceAbout this guide ...5Audience ...5Conventions ...

TaskFor option definitions, click ? in the interface.1Select Menu | Configuration | Report Server Settings.2Click Database Maintenance.3Click Manual M

Repopulate columnsRepopulate custom and user-defined columns to apply settings to existing database records.Perform maintenance during off-peak times.

5Click Yes to continue.The statistics job starts immediately. A message appears stating that the job is successfully queued.6Click OK to close the mes

5Log sources and log formatsMcAfee Content Security Reporter uses log sources to obtain data from log files from a filtering device.The log files cont

• FTP Server•A directory on the report serverLog formats Log formats determine how Content Security Reporter processes (also called parsing) data from

Log Sources pageSee a list of available log sources, and find one quickly. Enable, add, duplicate, delete, disable, importand process log files immedi

Table 5-2 Option definitionsOption DefinitionNameType the name that you want to associate with this particular log sourceModeEither:• Accept incoming

Statistics pageDisplays cumulative log statistics for all the logs processed since the record was last refreshed or reset.Table 5-4 Option definition

Guide to User-Defined ColumnsOn the User-Defined Columns tab, you can substitute column data values with a string that is morerecognizable for you and

TaskFor option definitions, click ? in the interface.1Select Menu | Configuration | Report Server Settings.2Click Log Source, then from the Actions me

5 Log sources and log formats 33Log sources overview ...33Log source modes ...33Log formats

Move log file data into the databaseUse these additional steps to put log file data into your database when your log source is set to acceptincoming l

4Browse to the log file you want to import.5Click Open.A message confirms that the selected log file is imported.6Click OK.Content Security Reporter p

Each custom column uses a rule set that is already configured to take technical data values from thebrowser or cache columns and substitute the value

Table 5-8 Option definitions (continued)Option DefinitionRulesShows the list of rules that are in that rule set, their priority in the list, and the

Custom Rule Sets pageDisplays information about created rule setsTable 5-9 Option definitionsOption DefinitionShow Filter / HideFilterDisplays the Qu

Configure rule setsAdd, edit, copy, and delete rule sets for use with user-defined columns to appear in your queries andreports.Rule sets are used in

5Log sources and log formatsBrowse time threshold46McAfee Content Security Reporter 1.0.0 Software Product Guide

6Queries, reports, and dashboardsMcAfee Content Security Reporter installs several queries, reports, and dashboards to ePolicyOrchestrator that aim to

TaskFor option definitions, click ? in the interface.1In McAfee ePolicy Orchestrator, select Queries & Reports in the menu bar, and select New fro

• The most used websites and applications•The biggest security threats to your organizationConfigure reportsSet up and run customized reports using da

PrefaceContents About this guide Find product documentationAbout this guideThis information describes the guide's target audience, the typo

6Select the report, its language, and whether you want to export the contents to a file, or send it tosomeone else, or run another command.If you are

4Click Add Monitor, and from the View drop-down menu, click Queries.5Drag the Queries icon onto the configuration area to open the New Monitor dialog

6Queries, reports, and dashboardsContent Security Reporter dashboards52McAfee Content Security Reporter 1.0.0 Software Product Guide

7Performance, maintenance, andmanagement featuresPerformance options for the McAfee Content Security Reporter database and system allow you tooptimize

Performance Options pageAllocate the amount of memory devoted to Content Security Reporter, and the number of jobs thatcan process at any one time.Tab

Table 7-3 Option definitions (continued)Option DefinitionCurrent MemoryUsageShows the estimated total amount of memory taken up by the cache's

Table 7-5 Option definitions (continued)Option DefinitionCurrent MemoryUsageShows the estimated total amount of memory taken up by the cache's

Configuration settings backupBack up specific report and administration configuration settings through the user interface.When McAfee Content Security

Restore Content Security Reporter settingsRestore the configuration settings when you need to return to previous settings or after you removeand re-in

Support for troubleshooting purposes. Feedback files are stored in your Content Security Reporterprogram directory.Table 7-8 Option definitionsOption

Find product documentationMcAfee provides the information you need during each phase of product implementation, frominstallation to daily use and trou

7Performance, maintenance, and management featuresSupport page60McAfee Content Security Reporter 1.0.0 Software Product Guide

AAutomatic-discover log formatsMcAfee Content Security Reporter supports some automatic-discover log formats. However, somemodifications to the log fi

Table A-1 Blue Coat header formats (continued)Format in extended log file Custom Content policy language Descriptioncs-method Request method used fr

Table A-1 Blue Coat header formats (continued)Format in extended log file Custom Content policy language Descriptioncs-uri-hostname• url.hostname•lo

Table A-1 Blue Coat header formats (continued)Format in extended log file Custom Content policy language Descriptiongmttime %t GMT date and time of

Table A-1 Blue Coat header formats (continued)Format in extended log file Custom Content policy language Descriptionx-cs-username-or-ip Used to iden

AAutomatic-discover log formats66McAfee Content Security Reporter 1.0.0 Software Product Guide

BFixed-field log formatsMcAfee Content Security Reporter supports some fixed-field log formats that do not require anyheader changes. Content Security

Table B-1 Non-automatic-discover log file formats (continued)Log file type Expected formats ExamplesMcAfee®FirewallEnterpriseSFv4 - TextFormatclient

IndexAabout this guide 5accept incoming log filesabout 33accept real-time log dataabout 33Actions menuoptions 15administratorsabout 7automatic-discove

1IntroductionMcAfee® Content Security Reporter (Content Security Reporter) is a powerful reporting tool that allowsyou to create queries and reports t

Ddashboardscreate new 50monitors 50overview 50dataon dashboards 50database server 13databasesmaintenance 31delete records 29execute SQL 23external 21i

Jjobsmaintenance statistics 32Llicense 11localelog source setup 39log datadatabase 40import 40log fieldscustom value 38skipped 38log filesaccept incom

multiple categorieslog source setup 39My ISAM 19MySQLbackup and restore database 20external database 21supported 19Ooperating systemssupported 11Ppage

SQL Server (continued)supported 19statisticsmaintenance jobs 31maintenance status 32refresh data 32Statusmaintenance results 31maintenance statistics

700-3703A00

• MySQL v5.0•Microsoft SQL Server 2005• Microsoft SQL Server 2008• Log sources — Log sources are devices on the network set up to generate (web filter

Table 1-1 Features (continued)Feature DescriptionRule sets Configure custom rule sets to tell Content Security Reporter to look for aspecific string