Configure Log Sources

Create a Skyhigh Network Security Manager MySQL account

Create the MySQL database user account that Content Security Reporter uses to access Skyhigh Security Network Security Manager log sources.

NOTE: Skyhigh Security recommends that you create a MySQL database user account specifically for communication between Content Security Reporter and Skyhigh Security Network Security Manager.

1. Locate the Skyhigh Security Network Security Manager MySQL installation folder.
   Example: C:\Program Files (x86)\McAfee\Network Security Manager\MySQL
   1. Open a command prompt and type:
      cd <MySQL installation folder>\bin
   2. Press Enter.
2. Log on to MySQL.
   1. On the command prompt, type:
      mysql --user=root mysql -p
   2. Press Enter.
   3. When prompted, type your password.
3. Create the user account.
4. On the command prompt, type:
   CREATE USER 'user_name'@'<ip_address>' IDENTIFIED BY 'some_password';
5. Press Enter.
6. Grant permissions to the account for the appropriate database and tables.
   1. On the command prompt, type:
      GRANT SELECT ON <database_name>.* TO 'user_name'@'<ip_address>';
   2. Press Enter.

TIPS: 

• The default<database_name>is lf.
• <ip_address> is the Content Security Reporter server IP address.

For more information about adding user accounts, see the MySQL 5.0 Reference Manual.

Configure ATD log sources

To collect Skyhigh Security Advanced Threat Defense data, configure the Web Gateway and Advanced Threat Defense log sources.

Prerequisite

Content Security Reporter uses Web Gateway to collect Advanced Threat Defense scan result data. Before you configure Advanced Threat Defense log sources, verify that the Advanced Threat Defense settings are configured on Web Gateway.

1. To create each log source, follow these steps:
   1. Select Menu > Configuration > Report Server Settings.
   2. From the Setting Categories menu, select Log Sources.
   3. From the Actions menu, select New.
   4. In the New Log Source page, enter the unique log source name in the Name field.
   5. Verify that the Enable log source checkbox is selected.
2. To configure the Web Gateway log source, choose from one of these options.

Web Gateway log source configuration options

3. To configure the Advanced Threat Defense log source, choose from one of these options.

Advanced Threat Defense log source configuration options

Configure Content Security Reporter to accept log sources from Skyhigh Security Web Gateway Cloud Service

You can configure Content Security Reporter to receive log sources from Skyhigh Security WGCS.

1. From the Trellix ePO menu, select Configuration > Report Server Settings.
2. From the Setting Categories, select Log Sources.
3. From the Actions menu, select New.
4. On the New Log Source page, enter a unique log source name in the Name field, then select Enable log source.
5. To configure the Skyhigh Security Web Gateway Cloud Service log source, choose from one of these options.

Results

Skyhigh Security Web Gateway Cloud Service log source configuration options

NOTE: For information about analyzing the log sources using your own on-premise reporting solution, see the Skyhigh Security Web Gateway Cloud Service Product Guide.

NOTE: For more information on configuring Content Security Reporter, see Skyhigh Security Knowledge Base article KB91327.

Configure a region

You can configure a region to add new Geographies apart from the default regions added in Content Security Reporter. This is only applicable to log source with Skyhigh Security Web Gateway Cloud Service.

In the Source tab of the New Log Source, you have six regions added as default from where log files can be collected.

Check the status of Running logs

To check the logs that are currently processing, view the list of running jobs.

1. Select Menu > Configuration > Report Server Settings.
2. From the Setting Categories menu, select Log Sources.
3. Click the Current Jobs tab.
4. To update the status of jobs currently running, click Refresh.

Check the statistics for processed logs

View the statistics for logs processed by Content Security Reporter.

1. Select Menu > Configuration > Report Server Settings.
2. From the Setting Categories menu, select Log Sources.
3. Click the Statistics tab.
4. To update the Cumulative log statistics or Syslog client statistics, click Refresh.

Manage log processing jobs

Manage the list of log processing jobs that are queued, running, or completed.

1. Select Menu > Configuration > Report Server Settings.
2. From the Setting Categories menu, select Log Sources > Job Queue.
3. From the Actions menu, select a task you want to perform.

Modify custom column rule sets

Modify the data string sets for the corresponding custom columns used during log file processing.

1. Select Menu > Configuration > Report Server Settings.
2. From the Setting Categories menu, select Log Sources > Custom Columns.
3. From the Actions list, select Edit Rule Set.
4. On the Edit Rule Set page, select New from the Actions menu.
5. On the New Rule page, type the data string value in the Replace field.
6. From the With menu, choose any additional characters, then click OK.

Create user-defined column rule sets

Create custom rule sets for the user-defined columns used during log file processing.

1. Select Menu > Configuration > Report Server Settings.
2. From the Setting Categories menu, select Log Sources > Custom Rule Sets.
3. From the Actions menu, select New.
4. Enter a name and description for the rule set.
5. Add a data string to the Rules list.
   1. From the Actions menu, select New.
   2. From the New Rule page, type the data string value in the Replace field.
   3. From the With drop-down list, choose any additional characters, then click OK.

Configure browse time options

Choose the threshold and default time for estimated browsing session lengths.

1. Select Menu > Configuration > Report Server Settings.
2. From the Setting Categories menu, select Log Sources > Browse Time, then click Edit.
3. On the Edit Browse Time page, select the time in minutes from the Browse time threshold menu.
4. From the Default browse time menu, select the time in minutes, then click Save.

Import a single log file

Import log files from a directory on the client computer.

NOTE: To avoid errors, verify that the log file format matches the log source in your imported log files.

1. Select Menu > Configuration > Report Server Settings.
2. From the Setting Categories menu, select Log Sources.
3. Select a log source.
4. From the Actions menu, select Import Log.
5. On the Import Log page, click Browse, find the log file you want to import, then click Open
   • A message confirms that the selected log file is imported.
6. Click OK.