ScriptLogic Enterprise Security Reporter. VERSION 3 Reporting Guide

Transcription

1 I ScriptLogic Enterprise Security Reporter VERSION 3 Reporting Guide

2 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE I Copyright 2011 by ScriptLogic Corporation All rights reserved. This publication is protected by copyright and all rights are reserved by ScriptLogic Corporation. It may not, in whole or part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or computer readable form without prior consent, in writing, from ScriptLogic Corporation. This publication supports Enterprise Security Reporter 3.x. It is possible that it may contain technical or typographical errors. ScriptLogic Corporation provides this publication as is, without warranty of any kind, either expressed or implied. ScriptLogic Corporation 6000 Broken Sound Parkway NW Boca Raton, Florida Trademark Acknowledgements: Enterprise Security Reporter is a registered trademark of ScriptLogic Corporation in the United States and/or other countries. Microsoft Windows, Windows NT, and Microsoft SQL Server are registered trademarks of Microsoft Corporation.

3 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE II DOCUMENTATION CONVENTIONS Typeface Conventions Bold Indicates a button, menu selection, tab, dialog box title, text to type, selections from drop-down lists, or prompts on a dialog box. CONTACTING SCRIPTLOGIC ScriptLogic may be contacted about any questions, problems or concerns you might have at: ScriptLogic Corporation 6000 Broken Sound Parkway NW Boca Raton, Florida Sales and General Inquiries Technical Support Fax SCRIPTLOGIC ON THE WEB ScriptLogic can be found on the web at Our web site offers customers a variety of information: Download product updates, patches and/or evaluation products. Locate product information and technical details. Find out about Product Pricing. Search the Knowledge Base for Technical Notes containing an extensive collection of technical articles, troubleshooting tips and white papers. Search Frequently Asked Questions, for the answers to the most common nontechnical issues. Participate in Discussion Forums to discuss problems or ideas with other users and ScriptLogic representatives.

4 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE III Contents INTRODUCTION...1 REPORTING CONSOLE...2 STARTING THE REPORTING CONSOLE...2 EXAMINING THE REPORTING CONSOLE...3 File Menu...4 View Menu...4 Options Menu...4 Help Menu...5 Toolbar...5 Status Bar...5 CONFIGURING THE REPORTING CONSOLE...6 Configuring Database Settings...6 Configuring Group Membership Subreports...7 Adding a Watermark...9 OPTIONAL REGISTRY SETTINGS...10 REPORTS...11 RUNNING A REPORT...11 EXPORTING REPORTS...16 EXPORTING REPORT RESULTS ING REPORTS...19 DEFINING CATEGORIES...20 CREATING A NEW REPORT...21 MANAGING REPORTS...31 Exporting Report Definitions...31 Importing Report Definitions...32 Editing a Report...35 VIEWING DISCOVERY LOGS...35 SCHEDULING A REPORT...37 USING THE COMMAND LINE UTILITY: ESRREPORT.EXE...41 AD-HOC QUERY BUILDER...42 BUILDING A QUERY...42 VIEWING RESULTS...48 Grouping Results...49 Exporting Results...49 Printing Results...50 CREATING REPORTS...50 SAVING A QUERY...50 SCHEDULING A QUERY...50 REPORT DESIGNER...51 EXAMINING THE REPORT DESIGNER...52 File Menu...52 Edit Menu...53 Report Menu...53 Edit Toolbar...54 Layout Toolbar...54 Format Toolbar...56 Report Tools...57

5 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE IV Fields Toolbox...57 Report Contents Toolbox...58 Properties Toolbox...58 Appearance Behavior Data 61 Design Layout Misc Summary ADDING REPORT SECTIONS...64 Deleting Report Sections...65 Reordering Groups...65 ADDING CONTROLS...66 Moving Controls...66 Layering Controls...66 Formatting a Border...67 LOADING A REPORT LAYOUT...68 SETTING REPORT PRINT OPTIONS...68 Page Setup...69 Printer Settings...70 Styles...71 Global Settings...72 EXPORTING THE REPORT LAYOUT...73 GLOBAL REPORTS LIST...74 ALL DOMAIN ACCOUNT REPORTS...75 Domain Account SID Report Sorted by Account Name Domain Account SID Report Sorted by Account SID COMPLIANCE...75 HIPAA Compliance Reporting Administrative Safeguards (a)(1) Security Management (A) Risk Analysis Common Vulnerabilities Open Shares Everyone Full Control Trust Relationships By Domain Resource Identification All Computers in Domain Discovered Computer List Domain Controller Report Extended Domain User Information Full Group Membership Report by Domain Member Servers Printer by Computer Public Shares by Computer Show Members of All Local Groups (B) Risk Management Event Log Changes Event Log Configuration Report Password Older than N Days Sorted by Account Services with Domain Logon Accounts (a)(3) Workforce Security (A) Authorization and/or Supervision Authorization... 78

6 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE V Account Right Report Sorted by Computer, Right, Account All Permissions Under File or Folder All Permissions Under Share Folders & Files with Any Effective Permissions Full Group Membership Report by Domain Show Groups for Selected Members Show Members of All Local Groups Show Members of Local Administrator Groups Specific folders that do not inherit permissions, showing +, -, *, = difference (C) Termination Procedures Account Expiration Report By Expiration Date Full Group Membership Report by Domain Logon in Last N Days No Logon in Last N Days Password Changed in Last N Days Sorted By Account (a)(4) Information Access Management (B) Access Authorization Account Right Report Sorted by Account, Right, Computer Account Right Report Sorted by Computer, Right, Account All Permissions Under File or Folder All Permissions Under Share Domain Users with Administrative Rights Full Group Membership Report by Domain Show Groups for Selected Members Show Members for All Local Groups Specific Folders that do not inherit permission, showing +, -, *, = differences (a)(5) Security Awareness Training (D) Password Management Expired Passwords Passwords Changed in Last N Days Sorted by Date Passwords Older than N Days Sorted by Date Technical Safeguards (a)(1) Access Control (i) Unique User Identification Extended Domain User Information Full Group Membership Report By Domain PCI Compliance Reporting...85 Build and Maintain a Secure Network Requirement 2 Do not use vendor-supplied defaults for system passwords and other security parameters Change vendor-supplied defaults Password Changed in Last N Days Sorted by Account Password Changed in Last N Days Sorted by Date Develop configuration standards for all system components Implement only one primary function per server Selected Services by Computer Services by Computer Disable all unnecessary and insecure services and protocols Selected Services by Computer Service Permissions by Computer Services by Computer Services with Domain Logon Accounts Configure system security parameters to prevent misuse... 87

7 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE VI Computer Policy Report Implementing Strong Access Control Measures Requirement 7 Restrict access to cardholder data by business need to know Limit access to computing resources and cardholder information only to those individuals whose job requires such access Restriction of access rights to privileged user IDs to least privileges necessary to perform job responsibilities Folders & Files with Any Effective Permissions Folders & Files with Any Effective Permissions, under Selected File or Folder SharePoint Effective Permissions Report SQL - Effective Database Object Permissions Report All Folder Permissions Report All Permissions Report All Permissions Under File or Folder All Permissions Under Share SharePoint All List and Folder Permissions On Site SharePoint All Permissions On Site SQL Database Object Permissions Report SQL Permissions for Selected Database Objects Limit access to computing resources and cardholder information only to those individuals whose job requires such access Assignment of privileges is based on individual personnel s job classification and function From a user perspective, these reports will show all groups that contain the user as a member Show Groups for All Members By Domain Show Groups for Selected Members SQL Effective Database Role Membership Report SQL Effective Server Role Membership Report These reports highlight where a user is granted direct access, not through group membership All Folder Permissions for Account All Permissions for Account SharePoint All List and Folder Permissions for Account SharePoint All Permissions for Account SQL Effective Database Object Permissions Report Requirement 8 Assign a unique ID to each person with computer access Ensure proper user authentication and password management for non-consumer users and administrators, on all system components Control addition, deletion, and modification of user IDs, credentials, and other identifier objects 92 Folders & Files with Any Effective Permissions Folders & Files with Any Effective Permissions, under Selected File or Folder SharePoint Effective Permissions Report SQL Effective Database Object Permissions Report Require a minimum password length of at least seven characters Computer Policy Report Use passwords containing both numeric and alphabetic characters Computer Policy Report Do not allow individuals to submit a new password that is the same as any of the last four passwords they have used Computer Policy Report Limit repeated access attempts by locking out the user ID after not more than six attempts Computer Policy Report Set first-time passwords to a unique value for each user and change immediately after the first use 94

8 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE VII Password Change Not Allowed Immediately revoke access to any terminated users Disabled Domain User Accounts Folders & Files with Any Effective Permissions Folders & Files with Any Effective Permissions under Selected File or Folder No Logon in Last N Days No Logon Since Specific Date SharePoint Effective Permissions Report SQL Effective Database Object Permissions Report Remove inactive user accounts at least every 90 days No Logon in Last N Days No Logon Since Specific Date Enable accounts used by vendors for remote maintenance only during the time period needed. 97 Extended Domain User Information Do not use group, shared, or generic accounts and passwords Disabled Domain User Accounts Non-Disabled Guest Accounts Non-renamed Administrator Accounts Non-renamed Guest Accounts Change user passwords at least every 90 days Password Never Expires Password Older than N Days Sorted by Account Password Older than N Days Sorted by Date Regularly Monitor and Test Networks Requirement 10 Track and monitor all access to network resources and cardholder data Secure Audit trails so they cannot be altered Limit viewing of audit trials to those with a job-related need All Permissions Under File or Folder SQL Database Object Permissions Report Protect audit trails from unauthorized modifications All Permissions Under File or Folder SQL Database Object Permissions Report SOX Compliance Reporting Corporate Responsibility for Financial Reporting (a)(5)(a) and (B) Deficiencies in Internal Controls Common Vulnerabilities Open Shares - Everyone Full Control Group Membership Full Group Membership Report By Domain Show Groups for Selected Members Show Members for Selected Groups Show Members of All Local Groups Management Assessment of Internal Controls Administrative Access Controls Domain Users with Administrative Rights Common Security Settings Event Log Changes Event Log Configuration Report Password Older than N Days Sorted by Date Computer Assessment Services by Computer Services with Domain Logon Accounts

9 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE VIII Data Access Control All Permissions Under File or Folder All Permissions Under Share Open Shares Everyone Full Control Specific folders that do not inherit permissions, showing +, -, *, = differences Domain Trusts Trust Relationships By Domain User Account Assessment Account Right Report Sorted by Computer, Right, Account No Logon in Last N Days COMPUTER REPORTS Computer Accounts Computer Password Change Report Discovered Computer List Domain Controller Report Hidden computers (from domain discovery) Hidden computers (from local computer discovery) Member Servers Computer IP Addresses Computers with specific IP addresses Sorted by Computer Name Computers with specific IP addresses Sorted by IP Address Computer Polices Account Right Report Sorted by Account, Right, Computer Account Right Report Sorted by Computer, Right, Account Computer Policy Report Event Logs Event Log Configuration Report Files Duplicate Files Report Files Created in Date Range Sorted By Date Created Files Created in Date Range Sorted By Path Files Created in Last N Days Sorted By Date Created Files Created in Last N Days Sorted By Path Files Larger than a Specific Size Files Last Accessed In Date Range Sorted By Date Last Accessed Files Last Accessed in Date Range Sorted by Path Files Last Accessed in Last N Days Sorted by Date Last Accessed Files Last Accessed in Last N Days Sorted by Path Files Modified in Date Range Sorted by Date Modified Files Modified in Date Range Sorted by Path Files Modified in Last N Days Sorted by Date Modified Files Modified in Last N Days Sorted by Path Files with Specific Extensions Folders Folder Size Report Sorted by Path Folder Size Report Sorted by Size Folders Created in Date Range Sorted By Date Created Folders Created in Date Range Sorted By Path Folders Created in Last N Days Sorted By Date Created Folders Created in Last N Days Sorted By Path Folders Modified in Date Range Sorted By Date Created Folders Modified in Date Range Sorted By Path

10 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE IX Folders Modified in Last N Days Sorted By Date Created Folders Modified in Last N Days Sorted By Path Local Accounts Local Account SID Report Sorted by Account Name Local Account SID Report Sorted by Account SID Ownership All Files and Folders by Owner All Files and Folders Under Folder by Owner Files and Folders by Owner Files and Folders Under Folder by Owner Permissions Everyone Group Permissions Report Permissions on Computer Report Protected Security Descriptor Report Unique User Permissions Under Folder All Permissions Explicit and Inherited All Folder Permissions for Account All Folder Permissions Report All Permissions for Account All Permissions for all Domain User Accounts All Permissions Report All Permissions Under File or Folder All Permissions Under Share Denied Permissions Denied Permissions Report Sorted by Account Denied Permissions Report Sorted by Path Differences between Parent and Child Folders Folders on computer that do not inherit permissions, showing +, -, *, and = differences Folders on computer that do not inherit permissions, showing +, - and * differences Folder under specific shares that do not inherit permissions, showing +, - and * differences Folders under specific shares that do not inherit permissions, showing +. -, *, and = differences Specific Folders that do not inherit permissions, showing +, - and * differences Specific Folders that do not inherit permissions, showing +, -, *, and = differences Explicit Permissions Explicit Folder Permissions for Account Explicit Folder Permissions Report Explicit Permissions for Account Explicit Permissions for all Domain User Accounts Explicit Permissions Report Explicit Permissions Under File or Folder Explicit Permissions Under Share Files & Folders with Permissions for Selected Accounts Account, or group it is a member of, has explicit or inherited permissions Folders & Files with Any Effective Permissions Folders & Files with Any Effective Permissions, under Selected File or Folder Folders with Any Effective Permissions Account, or group it is a member of, has explicit permissions Folders & Files with Explicit Effective Permissions Folders & Files with Explicit Effective Permissions under a Selected Folder or File Folders with Explicit Effective Permissions No Effective Permissions Groups with No Effective NTFS Access Report

11 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE X Groups with No Effective NTFS Access Report (By Computer) Printers Printer By Computer Printer Permission By Computer Services Selected Services by Computer Service Permissions by Computer Services by Computer Services with Domain Logon Accounts Shares Administrative Shares by Computer Computers with No Public Shares Effective Share Permission Report Hidden Shares By Computer Open Shares Everyone Any Access Open Shares Everyone Full Control Public Shares by Computer Share Permissions by Computer Volumes Volumes by Computer DELTAS SNAPSHOT COMPARISON REPORTS Account Changes Consolidated Change Report Event Log Changes Folder & File Changes Group Membership Changes NTFS Permission Changes Service Changes Share Changes Share Permissions Changes SQL Change Report DISCOVERY REPORTS Discovery Errors for Computer or Domain Discovery Errors Report Discovery Group Configuration Discovery Job Log Report DOMAIN REPORTS All Computers in Domain Domain Controller Report Hidden Computers (from domain discovery) Trust Relationships By Domain GROUP MEMBERSHIP REPORTS Domain Groups Domain Groups that are members of local Administrators groups Domain Groups with Unknown Members Empty Domain Groups Full Group Membership Report by Domain Show Groups for All Members By Domain Show Groups for Selected Members Show Members for Selected Groups Local Groups Empty Local Groups

12 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE XI Local Groups with Unknown Members Show Groups for Selected Members Show Members for Selected Groups Show Members of All Local Groups Show Members of Local Administrator Groups SHAREPOINT Documents and Libraries SharePoint - All Documents By Author SharePoint - Documents Created in Date Range Sorted by Date Created SharePoint - Documents Created in Data Range Sorted by Path SharePoint - Documents Created in Last N Days Sorted by Date Created SharePoint - Documents Created in Last N Days Sorted by Path SharePoint - Documents Modified in Date Range Sorted by Date Modified SharePoint - Documents Modified in Date Range Sorted by Path SharePoint - Documents Modified in Last N Days Sorted by Date Modified SharePoint - Documents Modified in Last N Days Sorted by Path SharePoint - Site Document Report Groups and Users SharePoint - Group Membership Report Permissions SharePoint - Permission Level Report All Permissions SharePoint - All List and Folder Permissions for Account SharePoint - All List and Folder Permissions On Site SharePoint - All Permissions for Account SharePoint - All Permissions for All Domain User Accounts SharePoint - All Permissions on Site SharePoint - All Permissions on Site Except Builtin Groups Effective Permissions SharePoint - Effective Permissions Report Explicit Permissions SharePoint - Explicit List and Folder Permissions for Account SharePoint - Explicit List and Folder Permissions On Site SharePoint - Explicit Permissions For Account SharePoint - Explicit Permissions for All Domain User Accounts SharePoint - Explicit Permissions On Site SharePoint - Explicit Permissions On Site Except Builtin Groups Sites and Webs SharePoint - Site Report SQL SERVER REPORTS Database Reports SQL - Database Listing Report SQL - Database Object Report Permission Report SQL - Database Object Permissions Report SQL - Database Schema Permissions Report SQL - Effective Database Object Permissions Report SQL - Permissions for Selected Database Objects Role and User Reports SQL - Database Role Membership Report SQL - Database User Report SQL - Effective Database Role Membership Report

13 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE XII SQL - Effective Server Role Membership Report SQL - Server Login Report SQL - Server Role Membership Report USER REPORTS Domain Users Account Creation Date Account Expiration Report By Account Account Expiration Report By Expiration Date Disabled Domain User Accounts Domain Users with Administrative Rights Extended Domain User Information Local Admin Access Report Locked Domain User Accounts Logon in Last N Days Logon Since Specific Date No Logon in Last N Days No Logon Since Specific Date Password Reports Expired Passwords Password Change Allowed Password Change Not Allowed Password Changed in Last N Days Sorted By Account Password Changed in Last N Days Sorted By Date Password Expiration Report (Sorted By Account) Password Expiration Report (Sorted by Expiration Date) Password Never Expires Password Older than N Days Sorted by Account Password Older than N Days Sorted by Date Local Users Disabled Guest Accounts Non-Disabled Guest Accounts Non-Renamed Administrator Accounts Non-Renamed Guest Accounts Renamed Administrator Accounts Renamed Guest Accounts REPORT TYPES AND TABLES Domain Reports Domain Account Reports Domain Computer Reports Domain Controller Reports Domain OU Reports Domain Site Reports Domain Trust Reports Computer Reports Computer Account Reports File Reports Files Under Folder Reports Folder Reports Folder Under Folder Reports Effective Folder Permission Reports Folder & File Permission Reports Permissions Under Folder Reports Effective Permissions Under Folder Reports...159

14 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE XIII Permissions Under Share Reports Delta Permissions Under Share Reports Folder & File Delta Permissions Reports Folder & File Delta Permissions Under Folder Reports Folder & File Ownership Reports Folder & File Ownership Under Folder Reports Share Reports Share Permission Reports SharePoint Permission Level Reports SharePoint Site Reports SharePoint Node Reports SharePoint Node Permission Reports SharePoint Group Membership Reports Effective SharePoint Permission Reports SQL Server Reports SQL Server Login Reports SQL Server Role Reports SQL Server Role Member Reports SQL Database Reports SQL Database Object Reports SQL Database Object Permission Reports SQL Database Role Reports SQL Database Role Member Reports SQL Database Schema Reports SQL Database Schema Permission Reports SQL Database User Reports Volume Reports Service Reports Service Permission Reports Printer Reports Printer Permission Reports Registry Key Reports Registry Value Reports Event Log Reports Local Account Right Reports Local Computer Policy Reports Computer Address Reports Domain User Reports Local User Reports All User Reports Domain Group Member Reports Local Group Member Reports All Group Member Reports Discovery Delta Reports Discovery Configuration Reports Discovery Job Reports Discovery Job Error Reports Discovery Job Log Reports TROUBLESHOOTING INDEX...175

15 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 1 Introduction Enterprise Security Reporter is an agent less, fast, comprehensive discovery and reporting solution for analyzing file security, group memberships and other security settings on Windows file servers, Active Directory servers, SharePoint servers, and SQL Servers. Enterprise Security Reporter provides the administrator with tools to compare, analyze, query and report on the security and configuration of the network. Enterprise Security Reporter includes numerous ready made and customizable reports, with output in eight popular file formats.

16 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 2 Reporting Console Enterprise Security Reporter comes with a wide array of built in reports and queries to help you understand the security on your network. These reports and queries were developed in conjunction with many of our customers, and are designed to meet real world needs. In addition to these standard reports, you can create custom reports, which help to form the backbone of security analysis in a Microsoft Windows Network environment. STARTING THE REPORTING CONSOLE The Reporting Console is provided as a separate module to make it easier to distribute to end users who need only the reporting capabilities. Click Start, point to Programs ScriptLogic Corporation Enterprise Security Reporter 3, and then select Reporting Console. From the Discovery Console, click Tools menu., or choose Open reporting console from the

17 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 3 EXAMINING THE REPORTING CONSOLE After starting the Reporting Console, you see the main application window where you can run reports and create custom reports. The Enterprise Security Reporter Reporting Console main window opens to the list of Recent Reports, which on initial installation will be empty. As you run reports, this list will grow. Enterprise Security Reporter comes with several reports that are located in the Global Reports category. If you select a report, a description and the report parameters display in the lower pane. For a complete list of reports, see Global Reports List.

18 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 4 File Menu Option Import Report Export Report Open Scheduled Report File Exit Description Load an ESR Report Definitions (*.xrd) file into the Reporting Console. See Defining Categories. Save report definitions to an ESR Report Definitions (*.xrd) file. See Exporting Report Definitions. Load a command configuration (*.xrc) file for editing or scheduling. See Scheduling a Report. Close Reporting Console. View Menu Option Recent Reports Global Reports Local Reports Description Display recent reports in the top right pane. Display list of reports available to an organization. Display list of reports stored locally on a specific computer available only to the user of that computer. Options Menu Option Synchronize Reports Settings Description Overwrites Global Reports with the current version of each report located in the Program Files\ScriptLogic Corporation\ESR3\ Discovery Console\Database\Reports folder. Customize the Reporting Console. See Configuring the Reporting Console.

19 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 5 Help Menu Option Contents About ESR3: Reporting Console Description Displays online help. View information about the version of Enterprise Security Explorer Reporting Console installed on your computer, to apply a license file, or to visit the ScriptLogic website. Toolbar The buttons in the Report Explorer group are used to organize reports. The buttons in the Report Manager group are used to create new reports and manage the Reporting Console. You can open and close the list by clicking and respectively. You also can customize the toolbar. See Error! Reference source not found.. Button Description View and run reports that you ran most recently. View and run global reports that are available within your organization. These reports are stored in the Program Files\ScriptLogic Corporation\ESR3\Discovery Console\ Database\Reports folder. View and run reports that you have created or modified locally based on your specific needs. Build an ad-hoc query to select specific data items for a custom report. See Building a Query. Create a new report. See Creating a New Report. Manage the categories used to organize reports. See Importing Report Definitions. Browse Discovery Logs to find detailed information about discoveries that have been run. See Viewing Discovery Logs. Configure the Reporting Console. See Configuring the Reporting Console. Status Bar The status bar displays the discovery and report database connection.

20 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 6 CONFIGURING THE REPORTING CONSOLE Since the reporting console often is used by people who are not involved in the discovery process, we have made it very easy to distribute the reporting console to end users and have it pull the configuration data from a master server. All you need to do is configure one server with the reporting console, and then configure each user s reporting console to pull its configuration data from that master server. From the Reporting Console main window, click User Settings. Alternatively, select Settings from the Options menu. The Report Console Settings box opens to Database Settings. Configuring Database Settings On each computer where the Reporting Console resides, you must set the discovery server, and the discovery and reporting database. You also can adjust the amount of time before the computer times out trying to access the databases.

21 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 7 Configuring Group Membership Subreports Some computer permission reports have the option to include a Group Membership Subreport. For these Group Membership Reports, you can select fields to include in every report, exclude specific group members from the report, and edit a report template. Selecting Fields On the Select Fields tab, select fields that you want to include on every Group Membership Subreport.

22 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 8 Excluding Group Members To exclude groups from the report, open the Exclude Group Members tab, select a group, and then click. Editing Subreport Layouts To edit a subreport layout, select the type of report to edit, click Browse to select a subreport layout, and then click Designer. See the Report Designer chapter.

23 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 9 Adding a Watermark You can add a watermark to appear on each report. When you load an image from any location, a copy will be stored in the ScriptLogic Corporation\ESR3\Reporting Console\Watermarks folder.

24 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 10 OPTIONAL REGISTRY SETTINGS There are a few settings you can add to the registry on a user s computer to configure the Report Console. HKEY_CURRENT_USER\SOFTWARE\ScriptLogic Corporation\Enterprise Security Reporter\v3\ReportExecutingSettings RenderWarningPageCount When a report reaches 10,000 pages, report generation pauses and a message displays asking the user to continue or not. You can suppress this message by setting this value to 1. CacheRowLimit (default value is 50,000) Determines the number of rows that a data set must contain in order to cause the report to be cached to disk. Disk caching is slower, and therefore should not be used unless the report is very large. RenderMaxVirtualMemorySize (default value is 1,536,000,000) (or 1.5GB) Sets the amount of memory that may be consumed by the report before rendering is automatically stopped. Some reports can get beyond a size that can fit in memory, even when using disk caching. If the computer runs out of virtual memory, it will cause unpredictable behavior, therefore, by default, rendering stops once 1.5GB of memory is consumed. If the report will not render in 1.5GB of memory, then you can increase this value or modify the report design to remove graphical elements, such as the ScriptLogic icon in the page footers. MaxGridMemorySize (default value is ) (or 500MB) Sets the maximum amount of virtual memory that the results grid is allowed to consume. Although the data grid may not be allowed to display all rows (because it does not support a disk caching mechanism), the full dataset is still available via the export option on that grid. The full dataset can be exported to a CSV or XML file. MaxGridRowCount (default value is 1000 rows) Sets the number of rows that the grid can display. If this number is very large, the MaxGridMemorySize value limits the amount of data displayed. TempFolder (default value is C:\Documents and Settings\userID\Local Settings\Temp\) Designate the folder for generation of.xml report file. Type the full path to the folder.

25 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 11 Reports RUNNING A REPORT 1. From the Reporting Console, select a report to run from the Recent Reports, Global Reports, or Local Reports groups. Point the cursor at a report name to view a brief description. When you select a report, the bottom pane displays a description of the report and the report parameters. This report has three required parameters and three hidden parameters.

26 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE Double click the name of the report; or right click the report name, and then select Run Report. If the report has parameters to enter, the first box lists the parameters in the left pane. The name of the parameter displays at the top of the box. Next to the name, either (Required) or (Optional) displays to indicate whether entry is required or optional. There are several different types of parameter entry options depending on the report. Note: If you use the * wildcard for a parameter, % displays instead. Example 1 In this example, you first select how you want to enter the data. Computer Name is selected, so you would either type a computer name or select one from the dropdown list. To add the entry, click. To remove a selected entry from the list, click.

27 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 13 Example 2 In this example, you select a discovery item from the drop down list. Note: You can configure the Group Membership Subreports. See Configuring Group Membership Subreports. 3. Select the parameter. If there are more parameters, Next stays available. Click Next to enter the next parameter. 4. Click Finish. The report runs. Note: If you need to stop the report generation, click. After the report finishes executing, the Print Preview window appears where you can print the report, view a table of contents, search for an item in the report, export the report, and view the query used to produce the report. Note: If your report does not return any data, there could be several possibilities: a discovery was not done on the selected domain or computer, the reporting data is not included in the current discovery, one or more selected parameters was incorrect, or there is no data to be found. Open the Discovery Console and check the current discovery. Try running the report again.

28 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 14 Toolbar Item Description Stops report generation. Opens the Export Wizard. See Exporting Reports. Send the report as a PDF attachment to selected recipients. See ing Reports. Opens a Contents pane to the left of the report. If the report groups data, such as by computer or account, you can quickly jump to a particular item by clicking the name in the Contents pane. Opens the Print dialog box. You can change printer properties and output settings before printing the report. Not applicable Opens the Find dialog box. In the Find What box, type the text to find, and then click Find Next. Displays one page at a time. Displays multiple pages at a time. Display continuous pages. Zooms in or out. You also can select a zoom percentage from the list. Switches pages in the report. You also can type a page number in the box, and then press Enter. To view the results in table format, open the Results tab. Note: Only the first 1,000 results display. If you export the report, all results are included in the file.

29 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 15 To view the results in XML format, open the XML Results tab. To view the query behind the report, open the Query tab.

30 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 16 EXPORTING REPORTS You can export a report to another format, such as a PDF file for attaching to an or a TIFF file for including in a slide presentation. 1. From the Print Preview window, click. 2. If prompted, enter any report parameters. The Export Wizard opens. 3. From the Export Format list, select a format. The available options are HTML, PDF, RTF, Delimited Text, TIFF, and Microsoft Excel. 4. In the Export File box, type a path and name for the exported file, or click to locate a path for the file. 5. Click Next. Depending on the format you chose, the next box displays the default settings for that format. HTML (*.htm, *.html)

31 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 17 Portable Document Format (*.pdf) Rich Text Format (*.rtf) No options. Delimited Text (*.txt, *.cvs) Tagged Image File Format (*.tif)

32 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 18 Microsoft Excel (*.xls) 6. After selecting options for the export file, click Finish. EXPORTING REPORT RESULTS You can export report results to a text file for use in another application. 1. Open the Results tab, and then click. The Export Results box opens. 2. Click to choose a location and name the file. The full path displays in the Export File box. 3. From the File Delimiter list, choose a format. 4. Click Finish.

33 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 19 ING REPORTS You can a report to recipients. The report is sent as a PDF file attachment. 1. From the Print Preview window, click. The Report box opens with the report title displayed in the Subject box. 2. Complete the appropriate boxes, and then click Send.

34 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 20 DEFINING CATEGORIES Categories are provided with Enterprise Security Reporter to organize the standard reports that are included with the product. You might want to keep these standard reports separate from the custom reports that you create. Simply create a new category for your custom reports. You could also create a category for your favorite standard reports, and then copy and paste selected reports into that category for easy access. Under the Report Manager group, click Define Categories. The ESR3: Category Editor list displays the current categories. To manage the list, right click either the window or a category to display the shortcut menu. Menu Option Cut Copy Paste New Category Delete Category Description Cut the selected category to the Clipboard. Copy the selected category to the Clipboard. Paste a cut or copied category to the specified location. Create a new category beneath the selected category. To create a top level category, right-click a blank area in the window. Delete the selected category.

35 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 21 CREATING A NEW REPORT Although Enterprise Security Reporter ships with a wide variety of reports, we realize that you may need to modify the existing reports or add your own. The Report Composer wizard provides the means to create a new report or edit an existing report. Note: If you are interrupted during the process of creating a new report, click Finish to save the report. When you are ready to continue, right click the report, and then choose Edit Report. The Report Composer Wizard opens and you can continue creating the report. 1. Open the Report Composer Wizard. How you access the Report Composer Wizard determines where the report is stored. To create a new global report, click Global Reports, right click the group under which to store the report, and then choose New Report. Alternatively, select a group, and then press Insert. To create a new local report, click Local Reports, right click the group under which to store the report, and then choose New Report. Alternatively, select a group, and then press Insert. To create a new local report, click Define Reports in the Report Manager area. The Report Composer wizard opens to the Compose a New Report page. 2. From the Report Type list, choose a type of report. The report types are listed in alphabetical order. This table lists the types of reports in groups related by type. The report type defines the set of tables and columns that can be included in the report. Group Group Membership User Information Computer-Related Discovery-Related Report Type All Group Member Domain Group Member Local Group Member All User Domain User Local User Computer Computer Account Computer Address Discovery Configuration Discovery Delta Discovery Group Discovery Job Discovery Job Error Discovery Job Log

36 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 22 Group Domain-Related NTFS Permission-Related Computer Object SharePoint Report Type Domain Domain Account Domain Computer Domain Controller Domain OU Domain Site Domain Trust Effective Folder Permission Effective Permissions Under Folder Effective Printer Permission Effective Service Permission Effective Share Permission Folder & File Permission Folder & File Delta Permissions Folder & File Delta Permissions Under Folder Permissions Under Folder Permissions Under Share Delta Permissions Under Share Event Log File Files Under Folder Folder Folder Under Folder Folder & File Ownership Folder & File Ownership Under Folder Local Account Right Local Computer Policy Printer Printer Permission Registry Key Registry Value Service Service Permission Share Share Permission Volume SharePoint Group Membership SharePoint Node SharePoint Node Permission SharePoint Permission Level SharePoint Site

37 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 23 Group SQL Miscellaneous Report Type SQL Database SQL Database Object SQL Database Object Permission SQL Database Role SQL Database Role Member SQL Database Schema SQL Database Schema Permission SQL User SQL Server SQL Server Login SQL Server Role SQL Server Role Member Custom Note: Select custom only if you want to create the SQL query from scratch. 3. In the Report Name box, type a name for the report. 4. In the Description box, type a description of the report. You also can add an author and date for the report. The description, author, and date display in the lower right pane when the report is selected. 5. Click Next. The Report Categorization box displays the current categories. To keep your custom reports separate, make a new category. To create a new top level category, right click in a blank area of the box, and then select New Category. To create a sublevel category, right click a category, and then select New Category.

38 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 24 In this example, we created a Custom Reports top level category, and then created a subcategory for Accounting Reports. 6. Select the category under which to store the report, and then click Next. The Define Select List box displays the tables and columns available for the type of report you selected on the first page of the wizard. Note: If you do not see the table or column you want, you may need to change the report type. Click Back until you see the Compose a New Report box, and then change the Report Type.

39 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE Select the tables and columns to include in the report, and then click Next. The Report Sort Order list displays the tables and columns available for the report. 8. To add a column on which to sort, double click the name in the left pane. The column is added to the right pane. The report is sorted by the fields in the order they appear on this list. To manage the list, right click a name to display the shortcut menu. Shortcut Menu Option Toggle Sort Direction Move Up Move Down Delete Clear All Description Change the sort direction from Ascending (default) to Descending or vice versa. Move the selected field up the list. Move the selected field down the list. Delete the selected field from the list. Delete all fields from the list. 9. When you are finished creating the sort order for the report, click Next. The Report Parameters box appears.

40 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE Click Add. The Select Parameter list displays the parameters available based on the selections you made. If you select a parameter in the list, a description displays in the right pane. 11. Select the parameter to include in the report, and then click Next. The Parameters Detail box displays the settings specific for the parameter you chose. Note: The Parameters Details box is unique to each parameter. The box you see may not be the same as what is shown here.

41 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE After you configure the first parameter, click Finish. The Report Parameters list displays the settings you chose. Here you can add more parameters and manage the list of parameters for the report. The parameters are presented in the order displayed to the user running the report. Use Current Discovery By default, the current discovery is used to run the report. If you want to be able to select a discovery when running the report, clear the check box. Shortcut Menu Option Add Edit Remove Clear All Move Up Move Down Description Add another parameter to the report. Edit the selected parameter. Remove the selected parameter from the list. Remove all parameters from the list. Move the selected parameter up the list. Move the selected parameter down the list. 13. When the parameter list is set, click Next. The Report Query box displays the dynamic query built by Enterprise Security Reporter based on your selections.

42 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 28 Use Dynamic Report Generation By default, the query generated by Enterprise Security Report is used to create the report. Use Custom Query Select to edit the query. The box becomes available so you can make changes to the query generated by Enterprise Security Reporter. 14. Click Next. The Report Layout box appears. You can load an existing report layout, select a report layout from an existing report, or edit an existing report layout using the Active Report Designer. Load an existing report layout Click Browse. There are templates included with Enterprise Security Reporter. Select one of the existing templates or the new report layout you created with the Report Designer, and then click Open.

43 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 29 A message displays the report layout is loaded. To clear the layout and choose another, click Clear. Select a report layout from an existing report To select a layout from an existing report, click Browse. The Select Report list appears. Select a report, and then click OK. A message displays the report layout is loaded. To clear the layout and choose another, click Clear.

44 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 30 Edit existing report layout Click Designer. The Report Designer opens. Important: If you choose to edit an existing report layout, see the Report Designer chapter for guidance. When you finish editing the report layout, export the layout to an Active Report (*.rpx) file, and then load it as an existing report layout. 15. Click Next. The Report Title Parameter Display Formatting box lists the parameters you added. To add a title to the report, type a title in the Report Title box. Choose the Report Section and Display Control from the lists. To display the parameters, click and drag a parameter to the Report Parameter Display box. Choose the Report Section and Display Control from the lists. 16. Click Finish. The report appears under the group you chose.

45 ENTERPRISE SECURITY REPORTER 3 REPORTING GUIDE 31 MANAGING REPORTS The report definition and layout specifications are stored in an ESR Report Definitions (*.xrd) file. Enterprise Security Reporter provides several standard reports that you can import into your Local Reports area to use as the basis for creating a new report. You also can export a custom report that you created to the Global Reports area for use by others in your organization. Exporting Report Definitions If you created a custom local report, you can export the definition so others can benefit from using the report. The report definition is saved in an ESR Report Definitions (*.xrd) file. 1. Select the report to export, and then choose Export Report from the File menu. Alternatively, right click the report name, and then choose Export Report Definition. The Export list box opens to the Reports folder in the Enterprise Security Reporter installation directory for the Discovery Console. 2. If you want the report definitions file to be available in the Global Reports area, click Save. If you want to save the report definition file in another folder, change the path displayed in the Save In box before clicking Save.