McAfee Policy Auditor Executive Reports Installation and Product Guide

Transcription

1 McAfee Policy Auditor Executive Reports Installation and Product Guide

2 COPYRIGHT Copyright 2009 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies. TRADEMARK ATTRIBUTIONS AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. License Attributions Refer to the product Release Notes. 2

3 Contents Policy Auditor Executive Reports Requirements Installing Policy Auditor Executive Reports Changing the logo on reports Using Policy Auditor Executive Reports Report options Customizing a report Subscribing to reports

4 Policy Auditor Executive Reports Policy Auditor Executive Reports provide advanced reporting capabilities with Microsoft SQL Server Reporting. The reports are not meant to replace the standard reports, but provide reports that are more customizable than the standard epolicy Orchestrator reports and enable you to analyze the reports from multiple perspectives. The reports are run from the SQL Server Reporting Services Interface. Contents Requirements Installing Policy Auditor Executive Reports Changing the logo on reports Requirements Policy Auditor Executive reports requires the following configuration: McAfee Policy Auditor Microsoft SQL Server 2005, Service Pack 2. SQL Server 2005 Reporting Services. Installing Policy Auditor Executive Reports Use this task to install and configure Policy Auditor Executive Reports. When you complete this task, you will be able to run the reports from the SQL Reporting Services interface. Before you begin You need a grant number to download Policy Auditor Executive Reports. Your System Administrator must configure SQL Reporting Services and the Executive Reports to comply with your organization's security policies. Task 1 Go to the Policy Auditor download site and download PolicyAuditorExecutiveReports.zip to the system where SQL Server 2005 is installed. 2 Unzip the archive, then copy the DeploySRSReports folder to the root of the system where SQL Server is installed. For example: c:\deploysrsreports. 3 From Windows Explorer, double-click the DeployReports.cmd file to begin the installation. You are prompted to type the following information: 4

5 Policy Auditor Executive Reports Changing the logo on reports The Reporting Services URL. For example: The epolicy Orchestrator database server name and, if one exists, instance name. For example: Eposerver\epoinst The epolicy Orchestrator database name. The location of the RS.exe file in the SQL Server folder. For example: C:\Program Files\Microsoft SQL Server\90\Tools\Bin\RS.exe. 4 After the reports are installed, you can view the RS Scripter Load Log.txt file to view messages, including any errors, from the installation. 5 Go to the SQL Report Server home page and click Policy Auditor Executive Reports. 6 Click AuditResultsDS. Change the Data Source to your database server, initial Catalog, and, if one exists, instance name, to the epolicy Orchestrator database name. Click Apply. Changing the logo on reports Use this task to change the logo used on the Benchmark Compliance Report. Task 1 In SQL Server Reporting Services, go to Policy Auditor Executive Reports. 2 Click corporatelogo.jpg. The corporatelogo.jpg page appears. 3 Click Replace. The Import Resource page appears. 4 Click Browse. The Choose file dialog box appears. Select a gif, jpg, or png file containing the logo for your organization. Click Open. 5 Click OK. 5

6 Using Policy Auditor Executive Reports Policy Auditor Executive Reports consists of a master report, Benchmark Compliance Report, and five primary sub-reports: Compliance by Benchmark Compliance by System Compliance by Tag Compliance Trend Compliance Top Ten Each of the sub-reports can be run as its own independent report by clicking it. For example, if you are primarily interested in the compliance trend for a specific benchmark in an audit, click the Benchmark Compliance Trend Report. Policy Auditor Executive Reports provides options to customize reports. Once a report is customized to suit your needs, you can save it to be run and delivered according to schedule options and delivery methods that you specify. Contents Report options Customizing a report Subscribing to reports Report options Policy Auditor Executive Reports provides a number of options for customizing the master report, Benchmark Compliance Report, or the sub-reports. You can read more about these options in the McAfee Policy Auditor 5.1 Product Guide and the McAfee Benchmark Editor 5.1 Product Guide. When you select a parameter from a drop-down list, it filters the available parameters for drop-down lists that depend upon it. When you select an audit, the benchmark you can select is limited to the benchmarks in the selected audit. When you select a benchmark, the rule you can select is limited to the rules in the selected benchmark. Also, the benchmark sections are limited to the sections in the selected benchmark. Option As of Date Definition The date by which the state of the systems are evaluated. You can that show the status of systems at a date in the past for comparison or archival purposes. 6

7 Using Policy Auditor Executive Reports Report options Option Audit Audit Status Benchmark Benchmark Section Export Minimum Passing Score Report Title Rules Scoring Model System System Tree Tag Trend Begin Date Trend End Date Trend Measure Definition An audit contains one or more benchmarks and is an independent evaluation of a computer system to determine whether it is in compliance with corporate and industry security standards and to recommended improvements, if needed, that reduce risks. The status of an audit: Pass Systems that have passed the selected audit. Fail Systems that have failed the selected audit. Unknown Policy Auditor is unable to determine whether a system has passed or failed an audit. Situations yielding a status of Unknown include systems that are turned off or not connected to the network. Expired Audit results exist, but are not current. Exempt Systems that are exempt from being audited by the selected audit. Benchmarks are documents containing an organized set of rules that describe the desired state of a set of systems. Benchmarks are often composed of multiple sections, with each section containing rules that apply to different aspects of a system. Examples are whether a firewall is present or the length of the system password. Export the report to different formats, such as PDF or an Excel spreadsheet. An system is considered to have passed an audit if the audit score is equal to or greater than the Minimum Passing Score. Title of the report. Rules contain one or more checks that generally reference OVAL (Open Vulnerability Assessment Language) definitions. When Policy Auditor performs an audit on a system, it produces output that includes the compliance score. Policy Auditor supports the four scoring models described in the XCCDF specifications: Flat unweighted scoring model (pre-configured model for Policy Auditor). Default scoring model. Flat scoring model. Absolute scoring model. Computer. The System Tree contains systems that are managed by epolicy Orchestrator. The System Tree is usually organized into groups of systems for easier classification. Tags are a method of classifying systems. Examples include server, workstation, finance, New York office. The starting date for trend reports. The ending date for trend reports. The time period covered by trend reports. 7

8 Using Policy Auditor Executive Reports Customizing a report Customizing a report Use this task to create and customize a Policy Auditor Executive Report. Task 1 In SQL Server Reporting Services, go to Policy Auditor Executive Reports. 2 Click Benchmark Compliance Report for a comprehensive report or one of the other sub-reports that is more narrowly tailored to your needs, like Benchmark Status Compliance Trend Report. 3 Customize your report by selecting the options that you want the report to include. The page updates each time you change an option. 4 Click View Report. 5 Drill down into report details and navigate between sections using the following tools: Navigation buttons. Hyperlinks. Control symbols (+ and ) to expand and contract lists. Subscribing to reports Use this task to schedule a report to be run and delivered on a regular schedule. You can subscribe to multiple reports. Task For option definitions, click? in the interface. 1 In SQL Server Reporting Services, go to Policy Auditor Executive Reports. Click a report and customize it fit your organizational needs. 2 Click New Subscription. 3 Use the Delivered by drop-down list to select the delivery method. The available delivery methods depend on how your System Administrator has set up SQL Server Reporting Services. 4 Click Select Schedule. The Schedule details page appears. Set the scheduling options according to your needs. Click OK. 5 Under Report Parameter Values, set the options according to your needs. 6 Click OK. 8

9 Index C create and customize a report 8 I install and configure 4 installation requirements 4 P Policy Auditor Executive Reports changing logo 5 creating and customizing report 8 Policy Auditor Executive Reports (continued) installation requirements 4 installing and configuring 4 report options 6 subscribing to reports 8 R report options 6 report subscriptions 8 S subscribing to reports 8 9

10 Index 10