Websense SQL Queries. David Buyer June 2009

Transcription

1 Websense SQL Queries David Buyer June 2009

2 Introduction The SQL queries that are listed here I have been using for a number of years now. I use them almost exclusively as an alternative to the Websense Explorer and Reporter which are limited. Hope you can get some use out of them. These queries were written and used with a bunch of different versions of Websense Enterprise. They haven t modified their database in awhile so these should still work until they decide to modify it. They work in a Microsoft SQL Server 2000 and That said, if you want to see what Websense Explorer is doing then in order to see some of the queries that Websense uses you can set the value "&gubed=1" (without the quotes) in the Websense Exporter after running a report to get all the debug and SQL info. It should be appended to the end of the URL and takes some practice to get it right. You also have to filter out all the extra "stuff" from the code to actually get something you can build on. The Websense database is not too complex but complex enough that it will take some work to understand and be able to code queries for. Just take your time and start hacking at it. If you come up with some other useful queries please let me know and I'll add them to this doc and give you credit.

3 Code 1 /*Websense uses the number of unique IP addresses within a 24 hour period for its license count. Run this for a 24 hour period to check on that count. If you have been getting those pesky "exceeded license count" s then run this to see how many licenses you will need to purchase. You can also use their ConsoleClient but this query is a more accurate measure.*/ SELECT COUNT (DISTINCT SOURCE_IP) AS IPs FROM INCOMING_VIEW --set start and end dates here WHERE (DATE_TIME > {d 'YYYY-MM-DD'}) (DATE_TIME < {d 'YYYY-MM-DD'})

4 Code 2 /*The Websense Explorer and Reporter are "ok" tools if you need to run a one user report but if you need to run a report on multiple users then it simply can't do it. Sure you could run multiple reports for each user but there just isn t enough time in the day. Use this query to run a report on multiple user names. If you only have one user you can still use this query. Just change the "in" parameter to "=" where noted*/ SELECT INCOMING.DATE_TIME as 'Date and Time', USER_NAMES.USER_FULL_NAME as 'Full Name', USER_NAMES.USER_LOGIN_NAME as 'Login ID', PROTOCOLS.NAME as 'Protocol', INCOMING.PORT as 'Port', INCOMING.FULL_URL as 'URL', CATEGORY.NAME as 'Category' FROM INCOMING (NOLOCK), USER_NAMES (NOLOCK), PROTOCOLS (NOLOCK), CATEGORY (NOLOCK) WHERE INCOMING.USER_ID = USER_NAMES.USER_ID INCOMING.PROTOCOL_ID = PROTOCOLS.ID INCOMING.CATEGORY = CATEGORY.CATEGORY --insert the user ids here --if using just one user then use the equal sign instead of the 'in' parameter USER_NAMES.USER_LOGIN_NAME in ( 'user1', 'user2', 'user3' ) --set start date here INCOMING.date_time BETWEEN convert (datetime, 'YYYY-MM-DD 00:00:00', 120) --set end date here convert (datetime, 'YYYY-MM-DD 23:59:59', 120) ORDER BY USER_NAMES.USER_FULL_NAME ASC, convert (varchar(10),incoming.date_time, 120) ASC, convert (varchar(10),incoming.date_time, 108) ASC

5 Code 3 /*This query is similar to the multiple users query but instead of multiple users it queries on multiple SOURCE IP addresses. Again, the Explorer and Reporter are good for single items but can't run reports on multiple sources. Use this query for this purpose. If you only have one IP you can still use this query. Just change the "in" parameter to "=" where noted*/ SELECT INCOMING.DATE_TIME as 'Date and Time', dbo.inttoip(incoming.source_ip_int) as 'IP Address', USER_NAMES.USER_FULL_NAME as 'Full Name', USER_NAMES.USER_LOGIN_NAME as 'Login ID', PROTOCOLS.NAME as 'Protocol', INCOMING.PORT as 'Port', INCOMING.FULL_URL as 'URL', CATEGORY.NAME as 'Category', DISPOSITION.DESCRIPTION as 'Disposition' FROM INCOMING (NOLOCK), USER_NAMES (NOLOCK), PROTOCOLS (NOLOCK), CATEGORY (NOLOCK), DISPOSITION (NOLOCK) WHERE INCOMING.USER_ID = USER_NAMES.USER_ID INCOMING.PROTOCOL_ID = PROTOCOLS.ID INCOMING.CATEGORY = CATEGORY.CATEGORY INCOMING.DISPOSITION_CODE = DISPOSITION.DISPOSITION_CODE --insert the ints of the IP here --if using just one IP then use the equal sign instead of the 'in' parameter INCOMING.SOURCE_IP_INT in ( ' ', ' ', ' ' ) --set start date here INCOMING.date_time BETWEEN convert (datetime, 'YYYY-MM-DD 00:00:00', 120) --set end date here convert (datetime, 'YYYY-MM-DD 23:59:59', 120) ORDER BY dbo.inttoip(incoming.source_ip_int) ASC, USER_NAMES.USER_FULL_NAME ASC, convert (varchar(10),incoming.date_time, 120) ASC, convert (varchar(10),incoming.date_time, 108) ASC

6 Code 4 /*This query is again similar to the multiple users query but instead of multiple users it queries on multiple DESTINATION IP addresses. If you only have one IP you can still use this query. Just change the "in" parameter to "=" where noted*/ SELECT INCOMING.DATE_TIME as 'Date and Time', dbo.inttoip(incoming.source_ip_int) as 'IP Address', USER_NAMES.USER_FULL_NAME as 'Full Name', USER_NAMES.USER_LOGIN_NAME as 'Login ID', PROTOCOLS.NAME as 'Protocol', INCOMING.PORT as 'Port', INCOMING.FULL_URL as 'URL', CATEGORY.NAME as 'Category', DISPOSITION.DESCRIPTION as 'Disposition' FROM INCOMING (NOLOCK), USER_NAMES (NOLOCK), PROTOCOLS (NOLOCK), CATEGORY (NOLOCK), DISPOSITION (NOLOCK) WHERE INCOMING.USER_ID = USER_NAMES.USER_ID INCOMING.PROTOCOL_ID = PROTOCOLS.ID INCOMING.CATEGORY = CATEGORY.CATEGORY INCOMING.DISPOSITION_CODE = DISPOSITION.DISPOSITION_CODE --insert the integer of the destination IP here --if using just one IP then use the equal sign instead of the 'in' parameter INCOMING.DESTINATION_IP_INT in ( ' ', ' ', ' ', ' ' ) --set start date here INCOMING.date_time BETWEEN convert (datetime, 'YYYY-MM-DD 00:00:00', 120) --set end date here convert (datetime, 'YYYY-MM-DD 23:59:59', 120) ORDER BY dbo.inttoip(incoming.source_ip_int) ASC, USER_NAMES.USER_FULL_NAME ASC, convert (varchar(10),incoming.date_time, 120) ASC, convert (varchar(10),incoming.date_time, 108) ASC

7 Code 5 /*Websense doesn't store IP addresses as IP addresses. It stores them in converted integer form after performing a simple algorithm to them. In order to use the DESTINATION and SOURCE queries you must first convert IP addresses into integer form. Use this query to convert IP addresses to their intger values that Websense recognizes. You can use multiple IP addresses or just one.*/ varchar(20) varchar(255) bigint bigint bigint bigint bigint int int int int int --put IP's here = ' , , , , , , ' --gets rid of the newline if using column of IP's, I hate when lines go beyond the screen so I use columns = replace(@strallip,char(13)+char(10),'') IF substring(@strallip, LEN(@strAllIp)-1,1)<>',' + ',' --add a comma to the end if it isn't there = 0 WHILE charindex(',',@strallip) > 0 BEGIN = substring(@strallip,0, charindex(',',@strallip)) --removes the first item from the list = substring(@strallip, charindex(',',@strallip)+1, LEN(@strAllIp) = as bigint) = cast((substring(@strip, as bigint) as bigint) = (@ci2-@ci1-1))) as bigint) as bigint)

8 = (@ci3-@ci2-1))) as bigint) = len(@strip) = as bigint) END = (@octet1 * ) + (@octet2 * 65536) + (@octet3 * 256)

9 Conclusion Once they are run you can save the query results as a TAB delimited csv file and then import that into an Access database. The table structure is as follows: For the User based queries: For the IP based queries: Once you have the data in the database you can then run some nice pretty reports. I have created some Crystal Reports that format all this data and make a nice report. I know there is probably a way to run the SQL code right from Crystal Reports so you can skip all the import stuff but I don t know Crystal Reports that well to pull it off. If you have a way to do it let me know. If you want the Crystal Reports that I have created me at be281@bfn.org and Ill send them to you. Here is generally what the Crystal Reports look like (real name and user name have been altered for obvious reasons).: