User Guide Revision A. McAfee Web Reporter 5.2.1

Transcription

1 User Guide Revision A McAfee Web Reporter 5.2.1

2 COPYRIGHT Copyright 2012 McAfee, Inc. Do not copy without permission. TRADEMARK ATTRIBUTIONS McAfee, the McAfee logo, McAfee Active Protection, McAfee AppPrism, McAfee Artemis, McAfee CleanBoot, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, McAfee Enterprise Mobility Management, Foundscore, Foundstone, McAfee NetPrism, McAfee Policy Enforcer, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, SmartFilter, McAfee Stinger, McAfee Total Protection, TrustedSource, VirusScan, WaveSecure, WormTraq are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Web Reporter User Guide

3 Contents Preface 5 About this guide Audience Conventions What's in this guide Find product documentation Introduction 7 About McAfee Web Reporter Report language options Getting started 9 Access in the user interface My Profile settings Log on to McAfee Web Reporter Navigating the user interface Navigation bar Toolbars Set account preferences Configure default settings Configure Quick View Custom report results Configure default report results Configure the number format Configure the date and time format Change your password Quick View Reports 15 About Quick View reports Configure Summary reports View Summary reports Configure Quick View Custom reports Save custom reports as Advanced reports Favorites reports Save a Quick View Custom report as a Favorite report Add a Favorite report from the Advanced Reports window View multiple Quick View reports View additional details View sites and site reputation information Send Quick View reports Send Favorite reports from the Advanced Reports window Schedule Favorite or Custom Quick View reports Advanced reports 23 Preconfigured Advanced reports Customizing Advanced reports McAfee Web Reporter User Guide 3

4 Contents Queries Filters Default filters Custom filters Configure custom queries Add or edit filters Configure Advanced reports Use advanced settings to get multiple reports Run an Advanced report Schedule Advanced reports A Preconfigured queries 33 B Preconfigured filters 43 C Preconfigured Advanced reports 45 Index 51 4 McAfee Web Reporter User Guide

5 Preface This guide provides the information you need to use the product. Contents About this guide Find product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Users People who use the computer where the software is running and can access some or all of its features. Conventions This guide uses these typographical conventions and icons. Book title, term, emphasis Bold User input, code, message Interface text Hypertext blue Title of a book, chapter, or topic; a new term; emphasis. Text that is strongly emphasized. Commands and other text that the user types; a code sample; a displayed message. Words from the product interface like options, menus, buttons, and dialog boxes. A link to a topic or to an external website. Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product. McAfee Web Reporter User Guide 5

6 Preface Find product documentation What's in this guide This guide is organized to help you find the information you need. This guide is intended for a reporting administrator or user who uses McAfee Web Reporter to view web traffic data for an organization's network. Tasks include viewing real time report data in pre configured reports or creating, scheduling, and generating custom reports for viewing and sharing. This guide assumes the reporting administrator and user is familiar with: computer operating systems file types Internet networks Find product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase. Task 1 Go to the McAfee Technical Support ServicePortal at 2 Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version. 6 McAfee Web Reporter User Guide

7 1 Introduction 1 McAfee Web Reporter (Web Reporter) is a powerful reporting tool that allows you to create reports that show you how people in your organization are using the Internet. Contents About McAfee Web Reporter Report language options About McAfee Web Reporter McAfee Web Reporter provides the reporting tools to identify issues in your organization such as liability exposure, productivity loss, bandwidth overload, and security threats. You can use this information to modify web use policies and provide guidance for appropriate Internet use in your organization. McAfee Web Reporter is compatible with: McAfee Web Gateway McAfee SaaS Web Protection Service McAfee SiteAdvisor Enterprise software Other third party web filtering solutions McAfee SmartFilter software Report language options McAfee Web Reporter can translate some fields and data in predefined queries and predefined Advanced reports into one of the supported languages. When you send, save, schedule, or run a report immediately, you can select the language you want for the translatable fields and data. McAfee Web Reporter allows you to select a language when sending a Quick View Summary or Custom report, and when saving or scheduling a custom or Advanced report. This translation happens within the software only when you select a language for your report. This option does not translate fields and information within the user interface or customized reports (including customized queries, filters, and so on). Selecting a language will translate some data and the available translatable fields of a report, while everything else appears in the language used for the log files. For example, if you have log files that were generated in English and you select French for the translatable report fields and some data, you will get a report with French labels and data, with everything else appearing in English. McAfee Web Reporter User Guide 7

8 1 Introduction Report language options Translatable fields: Actions Translates the predefined actions in McAfee Web Reporter (Allow, Block, Bypass, Monitor, Override, Warn) Date and time formats Translates date and time formats to the selected language Report titles, labels, headings, and legends Translates these items in your report Category names Translates any [Global Threat Intelligence] web category name that appears in your report Reputation ratings Translates[Global Threat Intelligence] web reputation that appears in your report Protection areas Translates protection areas that are recognized in McAfee Web Reporter Any user defined field, such as a custom column name, is maintained in the original language. Select from the following list of languages: Chinese (Simplified) Japanese Chinese (Traditional) Korean English (US) Portuguese French Russian German Spanish Italian 8 McAfee Web Reporter User Guide

9 2 Getting 2 started Log on to the McAfee Web Reporter web based user interface to configure account settings. Contents Access in the user interface My Profile settings Log on to McAfee Web Reporter Navigating the user interface Set account preferences Change your password Access in the user interface Access to areas and menus of the user interface are based on the permissions defined on your McAfee Web Reporter account. A reporting administrator creates logon accounts for McAfee Web Reporter. During account creation, the administrator defines which areas and menus of the user interface the account can access. If you need access to additional McAfee Web Reporter user interface areas or menus, contact your reporting administrator. My Profile settings Configure account preferences to access McAfee Web Reporter and generate reports. Change profile settings using these menu options: Preferences Options that define sender and recipient addresses, default number of results per page in a report, number format, and date and time format Summary Reports Options that define the default Summary report that appears by default after logging on to McAfee Web Reporter, and filters for the default Summary report Logon Option to change your password or view your directory logon information Log on to McAfee Web Reporter Both reporting administrators and users log on to McAfee Web Reporter using the web based user interface. Before you begin Enable cookies for your browser. McAfee Web Reporter User Guide 9

10 2 Getting started Navigating the user interface A McAfee Web Reporter administrator will provide you with your user name and password. Task 1 Open McAfee Web Reporter using one of the following methods: Double click the McAfee Web Reporter desktop icon. [HTTP] Open a new browser window and type where address is the IP address or the fully qualified domain name (FQDN) of the computer on which the software is installed. [HTTPS] Open a new browser window and type where address is the IP address or the fully qualified domain name (FQDN) of the computer on which the software is installed. If the site s certificate is not verified because it is self signed, take the necessary action in your browser to continue to the site. 2 If prompted to install the Java Runtime Environment (JRE), click Yes. The JRE is required to open the McAfee Web Reporter interface. 3 Type your user name and password. 4 Click Options and select the directory your user name and password belong to. 5 Click Log On. The McAfee Web Reporter user interface opens. Navigating the user interface Use the navigation bar and various toolbars to access various windows and customize the display in the user interface. Navigation bar The navigation bar is your first step in accessing various windows throughout McAfee Web Reporter. Features include: Quick View Displays two types of condensed interactive reports for your organization Summary and Custom Reports Gives you the ability to create reports with more specific detail (Advanced reports) than Quick View reports My Profile Determines account preferences and the default Quick View Summary report, displays delegated reports access you have, and the option to change your account password Administration (for administrator accounts only) Gives administrators the ability to set up McAfee Web Reporter for use in your organization For more information about this menu, see the McAfee Web Reporter Product Guide. 10 McAfee Web Reporter User Guide

11 Getting started Navigating the user interface 2 Toolbars Use toolbars to further customize what is displayed in the user interface. There are a few different toolbars available depending on which window is displayed. Toolbars are located at the top of the list for Quick View and Reports windows. Figure 2-1 Quick View reports toolbar Figure 2-2 Advanced reports toolbars Figure 2-3 Additional Filters toolbar 2-1 Toolbar options Number Option Definition 1 Back Displays the previously viewed report. 2 Save Report Saves a Custom report as a Favorite or Advanced report. 3 Send Report Stores a Summary or Quick View Custom report on the McAfee Web Reporter server or sends it through or FTP. 4 Schedule Report Sets the schedule, such as frequency, format, delivery, and delegation, for a Quick View Custom report. 5 Bar Graph Displays the Summary or Quick View Custom report data in bar graph format. 6 Displays the Summary or Quick View Custom report data in table format. 7 Hits Displays or hides the total number of hits per category for a Quick View Custom report. 8 Percent Hits Displays or hides the percentage of total hits per category in a Quick View Custom report. McAfee Web Reporter User Guide 11

12 2 Getting started Set account preferences 2-1 Toolbar options (continued) Number Option Definition 9 Bytes Displays or hides the total number of bytes per category for a Quick View Custom report. 10 Percent Bytes Displays or hides the percentage of total bytes per category in a Quick View Custom report. 11 Current page of total pages Displays the current page number in view and the total number of pages for a Quick View Custom report. This option is also available for Advanced reports. 12 Results Displays the number of results present in a Quick View Custom report. This option is also available for Advanced reports. 13 Find Defines all or part of a filter name to search for. 14 Find Now Searches the filters list for matches to what you typed in the Find field. 15 Clear Clears any search terms entered in the Find field. 16 Reports Lists the names of Advanced reports in the Reports Results list. 17 Dates Lists time range options used to filter the Report Results list. 18 Display Specifies the type of filters to display in the list. Set account preferences Configure account preferences for Summary reports, Delegated reports, and logon user interface settings. Contents Configure default settings Configure Quick View Custom report results Configure default report results Configure the number format Configure the date and time format Configure default settings Enter a recipient and sender address to use when ing reports. These fields are optional you can leave one or both fields empty. The addresses entered here act as the default addresses when a report is ed. You can also choose to specify alternative recipient and sender addresses when configuring the report delivery. Task For option definitions, click? in the interface. 1 Select My Profile Preferences. 2 Type the full addresses for the recipient and sender. Use commas without spaces to separate multiple addresses. 3 Click Save. 12 McAfee Web Reporter User Guide

13 Getting started Set account preferences 2 Configure Quick View Custom report results Configure the maximum results per page for Quick View Custom reports. The number of results you select is the default number that appears in the Maximum report results field of the Quick View Custom toolbar. To override this number for a specific report or list, select a different number in the Maximum report results field. Task For option definitions, click? in the interface. 1 Select My Profile Preferences. 2 From the Maximum report results drop down list, select the number of results. 3 Click Save. Configure default report results Configure the default number of data rows per page. When setting the default number of results per page, if your Quick View Custom report contains a total of 50 results, and your default results per page is set to 10, there will be five pages of the report with only 10 results on each page. The number of results you select is the default number that appears in the Results field of the paging toolbar. To override this number for a specific report or list, select a different number in the Results field of the paging toolbar. Task For option definitions, click? in the interface. 1 Select My Profile Preferences. 2 From the Results per page drop down list, select the number of results. 3 Click Save. Configure the number format Control how numbers appear in reports by selecting a number format. Your region might use a different separator to indicate a number in the thousands or decimals such as a comma, period, or space. Use the number format option to specify the preferred separators. Task For option definitions, click? in the interface. 1 Select My Profile Preferences. 2 In the Thousands separator field, type the separator. Choose from these options: Comma (,) Period (.) Clear the field to use a blank space to separate thousands The default value is comma (,). McAfee Web Reporter User Guide 13

14 2 Getting started Change your password Examples: 123,456, In the Decimal separator field, type the separator. Choose from these options: Comma (,) Period (.) Clear the field to use a blank space to separate thousands Examples: ,456, Click Save. Configure the date and time format Date and time formats control the appearance of calendar dates and clock times. Specify the preferred calendar date and clock time formats. Task For option definitions, click? in the interface. 1 Select My Profile Preferences. 2 From the Date format drop down list, make a selection. 3 From the Time format drop down list, make a selection. 4 From the First day of week drop down list, make a selection. 5 Click Save. Change your password Profile settings displays your current name (user name) and provides the ability to change your password depending on your account type. This option is available only if your user account is a local McAfee Web Reporter account. If you log on using a network user name and password, you will not be able to change your password here. Task For option definitions, click? in the interface. 1 Select My Profile Logon. 2 Type and confirm a new password. 3 Click Save. 4 Log off and log back on to McAfee Web Reporter using your new password. 14 McAfee Web Reporter User Guide

15 3 Quick 3 View Reports Quick View reports are interactive, real time reports that provide a condensed view of your organization's data. Contents About Quick View reports Configure Summary reports Configure Quick View Custom reports Favorites reports View multiple Quick View reports View additional details View sites and site reputation information Send Quick View reports Schedule Favorite or Custom Quick View reports About Quick View reports Quick View reports appear when you log on to the McAfee Web Reporter user interface. When viewing a Quick View report, you can open multiple Summary, Quick View Custom and Favorite reports and drill down to view more detail in a report. Use tabs in the user interface to open more than one Quick View report at one time. Choose from these Quick View report options: Summary reports Predefined, interactive summary reports display a snapshot of network activity for the week. Reports consist of data for sites, user names, user IP addresses, user groups, applications, categories, malware, web reputation, protection areas, and actions. Summary reports also offer drill down capabilities to view more refined detail for the available data. The Quick View Summary report is the first report you see each time you log on Custom reports Customizable reports that provide additional date, data type, filter, and display configure options Favorite reports Custom reports you can save to access at a later time Configure Summary reports Configure how you want the first Summary report to appear when you log on to the user interface. You can include a risk group and select the data you want to display within this report. McAfee Web Reporter User Guide 15

16 3 Quick View Reports Configure Quick View Custom reports Task For option definitions, click? in the interface. 1 Select My Profile Summary Reports. 2 From the Default report drop down list, select a report. The default report type is Site. 3 From the Default risk group drop down list, select a risk group. This option is available only when the Categories report is chosen as the default report. When choosing a default risk group, the Categories report will display only those categories contained in the risk group you select. 4 Select filters to further restrict which data is displayed on the default Summary report. By default, the Summary reports display all of the available data as report results. 5 Click Save. Tasks View Summary reports on page 16 You can view ten preconfigured Summary reports that provide an interactive depiction of activity for today, yesterday, and the past seven days. View Summary reports You can view ten preconfigured Summary reports that provide an interactive depiction of activity for today, yesterday, and the past seven days. Task For option definitions, click? in the interface. 1 Select Quick View Summary. 2 Select the report type to view the report. Some reports might return a dash ( ) instead of a categories, malware, protection areas, user names, applications, or reputation. This dash indicates the item is uncategorized, not associated with a particular type (such as no malware, protection area, or reputation), or the user is anonymous. 3 To drill down to subreports, click an entry from the report displayed on your screen to display a list of submenus that will lead you to additional report data. Configure Quick View Custom reports Use Quick View Custom reports when you want to select the date, data type, filter, and display options for your report. Task For option definitions, click Help in the interface. 1 Select Quick View Custom. The Custom menus appear. By default, the menus are collapsed. 16 McAfee Web Reporter User Guide

17 Quick View Reports Configure Quick View Custom reports 3 2 Select the filters for expanding or narrowing the report data. Leave the All filter type selected to include all data Select a preconfigured filter or a user created filter to limit the data in the report Add a new filter by typing directly into a filter field Type the filter data exactly as it would appear in the log data or report Some filter fields automatically search log data for matching results as soon as you start typing and display the complete matching result above the field. If there are no matches, no results are displayed. For example, you want to filter on the user name jshepherd. You type js in the user name field and jshepherd appears above the field Use commas to separate multiple entries Unsaved filters appear in italics (new unsaved user group filters appear in bold) To save the new filter, click the down arrow next to the filter and select Save and complete configuring the filter To clear the field, select the All option for that filter type from the drop down list Before you change a report filter, review reports that use that filter. When you change a report filter, it affects all Quick View Custom and Advanced reports that use the filter. 3 Select display options for the report. 4 Click View to display the report. If the report does not include any data, verify that the report criteria is valid. If the criteria is valid, there might not be any matching report data. 5 When the Quick View Custom report takes more than a few seconds to appear, choose from these options: Wait for the report to display Keep this tab open until the report appears. While the report is generating, you can open a new tab to run another Custom report Schedule the report Click to open the Add Scheduled Report window and schedule the report to generate Cancel the report Click to cancel the generating report Tasks Save custom reports as Advanced reports on page 17 Save a custom report as an Advanced report to add queries and other configuration changes to further refine the report. Save custom reports as Advanced reports Save a custom report as an Advanced report to add queries and other configuration changes to further refine the report. McAfee Web Reporter User Guide 17

18 3 Quick View Reports Favorites reports Task For option definitions, click Help in the interface. 1 Create and view a custom report. 2 On the report viewing toolbar, click Save as Advanced Report. 3 Name the report and click OK. Any queries associated with the custom report are preserved and saved with the same name as the report. The report is added to the Advanced reports list, and a query with the same name appears in the queries list. View the report from Reports Advanced Advanced Reports. View the query from Reports Advanced Queries. You can change the report layout between table and bar graph views using options in the associated query, but you will not have interactive abilities for the created Advanced report. Favorites reports Create a Favorite report from a Quick View Custom report for use at a later time. Saving a Quick View Custom report as a Favorite preserves the properties used to generate the report, not the actual report data. Tasks Save a Quick View Custom report as a Favorite report on page 18 After viewing a Quick View Custom report, you can save it as a Favorite report. Add a Favorite report from the Advanced Reports window on page 19 Create a Favorite report without viewing it in the Quick View report window. Save a Quick View Custom report as a Favorite report After viewing a Quick View Custom report, you can save it as a Favorite report. Task For option definitions, click? in the interface.for option definitions, click Help in the interface. 1 Select Quick View Custom and create the Quick View Custom report. 2 From the toolbar, click Save as Favorite. 3 In the Favorite name field, type a descriptive name for the report. 4 Click OK. The new Favorite report appears in these locations: Quick View Favorites Reports Manage Reports Report Console 18 McAfee Web Reporter User Guide

19 Quick View Reports View multiple Quick View reports 3 Add a Favorite report from the Advanced Reports window Create a Favorite report without viewing it in the Quick View report window. Use the same options you would use to create a Quick View Custom report from the Quick View window when you create it in the Advanced Reports window. Task For option definitions, click? in the interface.for option definitions, click Help in the interface. 1 Select Reports Advanced Favorite Reports. 2 Click Add. 3 Configure the Favorite report, then click OK. The new Favorite report appears in these locations: Quick View Favorites Reports Manage Reports Report Console View multiple Quick View reports The tabbed reports feature allows you to view multiple Summary, Favorite, and Custom Quick View reports, and move within the drill down paths. Use tabs to quickly switch between two or more reports. There are three ways to view a report in a new, empty tab: Click New Tab to open a new, empty tab. Figure 3-1 New tab Right click a drill down link and select View in New Tab. Figure 3-2 New tab menu Right click a bread crumb and select View in New Tab. Figure 3-3 New tab menu for breadcrumb McAfee Web Reporter User Guide 19

20 3 Quick View Reports View additional details View additional details View additional report details in Quick View reports using the drilldown links. Click any of the underlined links in the report to view additional links and details. The clicked link appears as a Quick View Custom report. Figure 3-4 Drilldown links View sites and site reputation information When viewing a Site Activity report or a Detailed Activity report, click a URL to see the View Site and View Site Reputation links. Task 1 In a Quick View report, drill down until you see the full URL. The View Site Reputation and View Site links appear below the URL. Figure 3-5 View site and reputation links 2 Displaying the links: To open a new browser window that displays the selected website, click View Site. To open a new browser window that displays the TurstedSource.org website with reputation information for the URL, click View Site Reputation. Send Quick View reports Send Summary, Custom, and Favorite reports. Task For option definitions, click? in the interface.for option definitions, click Help in the interface. 1 Select Quick View. 2 View or create a Summary, Custom, or Favorite report. 20 McAfee Web Reporter User Guide

21 Quick View Reports Schedule Favorite or Custom Quick View reports 3 3 On the Quick View toolbar, click Send Report. 4 Format the report and configure delivery options. Use commas without spaces to separate multiple recipient addresses. 5 Click Send. Send Favorite reports from the Advanced Reports window Send Quick View Favorite reports from the Advanced Reports window. Task For option definitions, click? in the interface.for option definitions, click Help in the interface. 1 Select Reports Advanced Favorite Reports. 2 Select a favorite report from the list and click Run Now. 3 Format the report and configure delivery options. Use commas without spaces to separate multiple recipient addresses. 4 Click Send. Schedule Favorite or Custom Quick View reports After creating a Quick View Custom report or saving a Favorite report, schedule the report to run periodically according to your needs. When you schedule a report, you can run it as another person and automatically deliver it to the location of your choice. Task For option definitions, click Help in the interface. 1 Do one these options: Select Quick View, view a Favorite or Quick View Custom report, and click Schedule Report Select Reports Advanced Report Schedules and click Add 2 Name the scheduled report. 3 Select Saved favorite (quick view report). 4 Configure the options on the available tabs, then click OK. When adding multiple recipient addresses under the Delivery tab, separate the addresses using commas without spaces. McAfee Web Reporter User Guide 21

22 3 Quick View Reports Schedule Favorite or Custom Quick View reports 22 McAfee Web Reporter User Guide

23 4 4 Advanced reports Advanced reports include the most amount of detail and customization options. Where Quick View reports display a summary of interactive, real time data, Advanced reports give you the ability to fully customize and schedule offline reports. Customize Advanced reports using queries, filters, and layout options. Contents Preconfigured Advanced reports Customizing Advanced reports Configure custom queries Add or edit filters Configure Advanced reports Run an Advanced report Schedule Advanced reports Preconfigured Advanced reports McAfee Web Reporter is installed with preconfigured Advanced reports for each user and administrator. Each preconfigured Advanced report includes one or more queries and filters. The queries and filters associated with the preconfigured Advanced reports are available to any reporting administrator or user as preconfigured queries and filters. To view a list of preconfigured Advanced report definitions, refer to Appendix C. Customizing Advanced reports Customize the data and display options in Advanced reports. These report customizing options are available: McAfee Web Reporter User Guide 23

24 4 Advanced reports Customizing Advanced reports Queries Acts as a communicator between the database and the report, telling the database which types of data to display in the report Filters Communicates the precise data within the data type to pull from McAfee Web Reporter and display within reports Queries Queries are the foundation for advanced reports that define the type of data in a report and how that data is displayed in the report. A report is organized into sections of data, such as user names, websites, dates, and more. McAfee Web Reporter retrieves query data from log files that are stored in a registered database. Figure 4-1 McAfee Web Reporter workflow Contents Default queries Custom queries Default queries McAfee Web Reporter has preconfigured queries that are used in the preconfigured Advanced reports. However, you can also use these queries in your own reports. The name of each preconfigured query corresponds to a preconfigured Advanced report. However, the preconfigured queries were created using typical configurations for use with any Advanced report. Use the original configuration in your own Advanced reports, or copy the preconfigured query and modify it to match your reporting needs. McAfee Web Reporter shares preconfigured queries across all reporting users and administrators. To view a list of preconfigured queries, refer to Appendix A. Custom queries Custom queries are queries you configure to fit your specific reporting needs. Query types The query type determines the amount of detail in a report. There are two types of queries to choose from when setting up a query summary or detailed. Each query type has its own set of data options (also called columns) to select from. The data options define which data type is shown in your report, such as user name, dates, URL, and so on. The query type determines the amount of detail in the report for each type of data. 24 McAfee Web Reporter User Guide

25 Advanced reports Customizing Advanced reports 4 Query columns and order Query columns and the order of priority tells the report which type of data to get from the database and in which order to display it. Query-level filters Query level filters, called column properties, filter information on a single column (data type) according to parameters you define. Query level filters are different from report level filters in that query level filters offer limited filtering capabilities only for the query in which they are set up and are applied after any report level filters. For example, you want a report to show all URLs that include Google searches for used cars. In your query you would select the URL data column and type in the Include column property field. Use column properties to filter data only when report level filters cannot be used. The options available for column properties depend on the type of data column you select to filter on. Options include changing the display name of the column, including or excluding data, sorting, setting the measurement of data, decimal point placement, and more. When you want more filtering capabilities and control over data in any query such as filtering on user names, categories, or log sources use report level filters. Query layout McAfee Web Reporter provides a number of layout options to display that data it retrieves. Choose from a variety of layout options to best display your text. Filters After a query communicates to McAfee Web Reporter which type of data to display in the report, the filter then communicates with McAfee Web Reporter the exact data within the data type to pull for the report. Filter types McAfee Web Reporter offers several types of filters for use in Quick View Custom reports and Advanced reports. Use one of these filter types to refine the data for your reports: McAfee Web Reporter User Guide 25

26 4 Advanced reports Customizing Advanced reports 4-1 Filter types and descriptions Filter type Action Application Category File Type Log Source Malware Protection Area Protocol Site User IP Description Identifies the action taken on a URL request when a user visited a website. Actions correspond to the web filter policy in place on your network. For example, if you have a policy to block all gambling websites and a user attempts to visit gambling.example.com, the report shows that gambling.example.com was blocked. Identifies the Web application name as detected by McAfee Web Gateway and McAfee SaaS Web Protection Service. For example, if you want to view a report that includes only Social Networking applications, select Social Networking and select Include these applications. Identifies the requested URL's TrustedSource database category or corresponding risk group. For example, a Category filter configured to show data for the Productivity risk group will filter only the data categorized as a productivity risk group category. Identifies file types found in the URL. For example, a File Type filter configured to show data only for video files will display only those URL requests for websites that contain video files Identifies which log source the data came from. For more information about log sources, contact a reporting administrator. Identifies malware found in requested URLs. For example, if a user visited a website that was infected with a known virus, the virus name will show up as malware. Identifies protection areas that filtered the URL request. Protection areas are defined by the security feature that filtered the site. For example, if you are using McAfee Web Gateway, the corresponding protection area is one of the Web Filter choices. Identifies which Internet protocol the URL uses. For example, if you want to show a report that excludes FTP sites, select Exclude selected protocols and select the checkbox next to FTP. Identifies URLs for the websites. For example, to filter for all McAfee websites, type: *.mcafee.*. Identifies which user IP address made the URL request. For example, you might want data about specific IP addresses if you have a computer lab that allows any user or users with generic log on IDs to logon and visit websites. 26 McAfee Web Reporter User Guide

27 Advanced reports Configure custom queries Filter types and descriptions (continued) Filter type User Name (and Group) Description Identifies user names and group names that made URL requests. For example, to include the Management group, but exclude specific individuals within that group, place the group at the top of the list and the users at the bottom of the list. Groups filters work with LDAP groups or internal directory groups. Reputation Identifies the level of risk associated with a URL by associating the URL with a particular reputation score. For example, a website scored as Minimal Risk is from a legitimate source. Default filters McAfee Web Reporter includes four preconfigured filters, each filter corresponding to a risk group that contains specific TrustedSource database categories. The four preconfigured filters are designed for use with preconfigured Advanced reports. However, the preconfigured filters were created covering four common risk groups that you can use in any Advanced report or Quick View Custom report. To view a list of preconfigured filters, refer to Appendix B. Custom filters McAfee Web Reporter allows you to make your own filters to fit your exact reporting needs. Configure a filter using the following options: Use the filter to include data or exclude data. Select options based on the filter type. Filter example For example, you selected the Category column for your query, but you want data only for a particular set of categories (risk group), such as Productivity categories. To do this, you would create a Category filter that includes the Productivity risk group only. Configure custom queries Create your own custom queries using the query configuration options. Task For option definitions, click? in the interface. 1 Select query and data types a Select Reports Advanced Queries. b Click Add, or select an existing query from the list and click Edit. To modify a predefined query, first make a copy, and then edit the copy. McAfee Web Reporter User Guide 27

28 4 Advanced reports Add or edit filters c d From the Available Columns drop down list, select either Web Summary or Web Detailed. Select one or more data columns, and click the > arrow button to move it to the Selected columns field. Columns placed at the top of the Selected columns field are the first to have rules applied. For tables, the column placed at the top of the list appears as the first column on the left of the report. 2 Configure query level filters a Click the Column Properties tab. b c In the Column field, select the column to apply a query level filter. On the Properties for <column name> pane, type or select the query level filter settings, then click OK. If a value is entered for which no database records exist, the report will be blank. 3 Set up query layout a Click the Layout tab. b Select the type of layout and the number of results to include, then click OK. Add or edit filters Create a new filter, or edit an existing filter. Task For option definitions, click Help in the interface. 1 Select Reports Advanced Filters. 2 Click Add to create a new filter and select the filter type you want to use, or click Edit to modify an existing filter. 3 Configure the filter and click OK. Configure Advanced reports To generate an Advanced report, configure date range, query, filter, and advanced settings. Task 1 Name and select the queries for Advanced reports. a Select Reports Advanced Report Console. b c d e Click Add. Provide a name and description for the report. The name cannot contain parentheses. The report name is visible on the Current Jobs or Completed Jobs lists in the Advanced window for those with permission to manage the global report list. Select the queries and put them in the order you want them to appear in the report. Add any new columns. 28 McAfee Web Reporter User Guide

29 Advanced reports Configure Advanced reports 4 2 Select filters and dates. a Click the Filters tab. b c Select beginning and end dates, or specific days of the week for the data you want to view in the report. Select filters from the down down lists, then click OK. Tasks Use advanced settings to get multiple reports on page 29 Advanced settings allow you to run one report multiple times against additional parameters. You must have premium features enabled to use this feature. See also Queries on page 24 Add a Favorite report from the Advanced Reports window on page 19 Use advanced settings to get multiple reports Advanced settings allow you to run one report multiple times against additional parameters. You must have premium features enabled to use this feature. Advanced settings for advanced reports act like an advanced query, which allows you to run one Advanced report multiple times using either the results of a specified query column or a manual list you create. Task For option definitions, click Help in the interface. 1 Select Reports Report Console. 2 Click Add, and select Add Advanced from the drop down menu. 3 Click the Advanced tab. 4 Select the Run report multiple times using this data checkbox to generate a report for each of the items in your data set. 5 Configure the advanced options. 6 Click OK and run the report, or schedule the report to run at a later time. Multiple advanced reports results are available. Example of an Advanced report using advanced settings This feature is useful if you want to view a Top Sites report for each user in your organization. Instead of manually creating multiple Top Sites by Hits reports (one for each user), you can create a single Top Sites by Hits report and then select this report to automatically run for each user. To do this: 1 Create a query named Top Sites by Hits and any filters you want. 2 Configure an Advanced report. 3 On the Advanced tab of the Add Advanced Report window, select the Run report multiple times using this data checkbox. 4 Select either the Results of a query column data set and select the User Name column of an existing query, or select the Manual list data set to type in a list of users. McAfee Web Reporter User Guide 29

30 4 Advanced reports Run an Advanced report 5 Select how you want the report delivered. 6 Click OK. McAfee Web Reporter will generate a unique Top Sites by Hits report for each user. Run an Advanced report Run an Advanced report when you want view report results instead of waiting for results to appear after the next scheduled report job. Task For option definitions, click? in the interface. 1 Select Reports Manage Reports Report Console. 2 Select a report from the list. 3 Click Run Now. 4 Tabs for configuring report parameters are provided. Configure the dates, format, delivery, and filters options as needed. When adding multiple recipient addresses under the Delivery tab, separate the addresses using commas without spaces. 5 Click Run. The Details pane provides a real time status of running and waiting report jobs. 6 Select Reports Manage Reports Report Results to view the report. See also Report language options on page 7 Schedule Advanced reports Schedule an Advanced report to run automatically and at specific times. Select the time interval, report format, delivery type, and user you want the report to run as. Task For option definitions, click Help in the interface. 1 Select one of the following: Reports Manage Reports Report Console and in the Details pane, click Add Reports Advanced Report Schedules and click Add 2 Name the scheduled report. 3 Select Saved advanced report. 4 Configure the options on the available tabs, then click OK. When adding multiple recipient addresses under the Delivery tab, separate the addresses using commas without spaces. 30 McAfee Web Reporter User Guide

31 Advanced reports Schedule Advanced reports 4 The report is scheduled and appears in the list on the Report Schedules and Report Console windows. See also Report language options on page 7 McAfee Web Reporter User Guide 31

32 4 Advanced reports Schedule Advanced reports 32 McAfee Web Reporter User Guide

33 A Preconfigured queries McAfee Web Reporter is installed with these preconfigured queries: A-1 Preconfigured queries Query Name Selected Columns Layout Description Bandwidth: Volume by Category URL Category Displays each URL category with the volume in descending order of megabytes with unlimited results Bandwidth: Volume by Category (Chart) URL Category Graph Displays each URL category with the volume in descending order of megabytes for the top 30 results Bandwidth: Volume by Category (Detail) Percent of Bytes Percent of Hits Displays each URL category with the volume in descending order of megabytes and includes percent of bytes, number of hits, and percent of hits details with unlimited results URL Category Bandwidth: Volume by Day of Week (Chart) Day of Week Graph Displays each day of the week with the volume in megabytes Bandwidth: Volume by Day of Week (Detail) Percent of Bytes Day of Week Displays each day of the week with the volume in megabytes and includes percent of bytes, number of hits, and percent of hits details Percent of Hits Bandwidth: Volume by Hour (Chart) Hour Graph Displays each hour of the day with the volume in megabytes Bandwidth: Volume by Hour (Detail) Percent of Bytes Displays each hour of the day with the volume in megabytes and includes percent of bytes, number of hits, and percent of hits details Percent of Hits Hour Bandwidth: Volume by Month (Chart) Month Graph Displays each month of the year with the volume in megabytes McAfee Web Reporter User Guide 33

34 A Preconfigured queries A-1 Preconfigured queries (continued) Query Name Selected Columns Layout Description Bandwidth: Volume by Month (Detail) Percent of Bytes Percent of Hits Month Displays each month of the year with the volume in megabytes and includes percent of bytes, number of hits, and percent of hits details Bandwidth: Volume by Site Site Name URL Category Displays each site name and corresponding URL category with the volume in descending order of megabytes for the 30 most visited sites Category: Top 20 Sites by Volume (Site Detail) Percent of Bytes Percent of Hits Displays URL categories and site names with the volume in descending order of megabytes and includes percent of bytes, number of hits, and percent of hits for the 20 most visited sites Site Name URL Category Category: Usage by Hits Average Browse Time Percent of Bytes Displays URL categories in descending order of hits and includes the percent of hits, number of megabytes, percent of bytes, and the average browse time for the top 100 results Percent of Hits URL Category Category: Usage by Hits Top 20 (Chart) URL Category Graph Displays URL categories in descending order of hits for the top 20 results Categories: Usage by Volume Average Browse Time Percent of Browse Time Percent of Bytes Displays URL categories with the volume in descending order of megabytes and includes percent of bytes, hits, percent of hits, percent of browse time, and average browse time for the top 100 results Percent of Hits URL Category Category: Usage by Volume Top 20 (Chart) URL Category Graph Displays URL categories with the volume in descending order of megabytes for the top 20 results 34 McAfee Web Reporter User Guide