Sophos iView Administrator Guide
إعلان
إعلان
Sophos XG Firewall v 15.01.0 – Release Notes
Sophos iView
Administrator Guide v02
For Sophos and Cyberoam Customers
Document Date: November 2015
| Contents | 2
Contents
| Contents | 3
| Introduction | 4
Introduction
With the advent of new business technologies and evolving Internet threats, organizations are deploying an increasing number of solutions and devices to ensure security and business continuity. This includes firewalls, content filtering systems, unified threat management solutions, routers, servers, applications, operating systems and more which generate a vast amount of logs.
Sophos iView – Logging and Reporting Solution
Sophos iView is a logging and reporting solution that provides organizations with visibility into their networks across multiple devices for high levels of security, data confidentiality while meeting the requirements of regulatory compliance.
Enabling centralized reporting from multiple devices across geographical locations, Sophos iView offers a single view of the entire network activity. This allows organizations not just to view information across hundreds of users, applications and protocols, it also helps them correlate the information, giving them a comprehensive view of network activity.
Sophos iView aggregates log and report data from all your Sophos Firewall, Cyberoam and Sophos UTM Devices into a consolidated view of all your network activity. Get a clear picture of what is happening on your network at any time from a single pane of glass.
Moreover, organizations receive logs and reports related to intrusions, attacks, spam and blocked attempts, both internal and external, enabling them to take rapid action throughout their network.
Given below are some of the salient features of Reports:
• At-a-glance flow graphs show usage trends and web activity
• The daily summary Executive Report keeps you informed
• Report anonymization can hide user identities, where needed
• Built-in Syslog support and automated log backup options
Basics
This section provides basic instructions on how to view Reports, in addition to information on configuration settings related to Reports.
Given below are common screen components used to generate and view reports:
•
•
•
•
•
•
•
•
Export to HTML
•
•
•
•
| Introduction | 5
Date Selection
1.
Use icon to select the time interval for which you want to view the reports. By default, the report for the current date is displayed.
2. Click Generate to generate reports for the selected time interval.
Records per chart
Select the number of records (rows) of the report to be displayed per chart from Records per chart. A chart can have a minimum of 5 and a maximum 200 rows.
Note: If the number of records are more than 10, then the reports will be displayed in the form of in-line charts.
Page Controls
Every report displays the first page of the report along with total number of pages available for the report.
Use the following controls to navigate through pages:
•
•
•
:Navigate to the next page
•
:Navigate to the previous page
:Navigate to the first page
:Navigate to the last page
Reports Navigation
Navigation bar on the leftmost side provides access to various modules like Dashboard, Applications, Network &
Threats, etc. Each module consists of Level 2 menu items. However, the System module consists of Level 2 and
Level 3 menu items.
| Introduction | 6
Drop-down
Each reports dashboard has two drop-downs i.e. drop-down 1 and drop-down 2, as shown in the image below:
The drop-down 1 includes fellow sub-menu items, while drop-down 2 includes sub-reports, displayed as widgets on the reports dashboard. For example, in the image above, we've selected User Data Transfer Report as Level 2 submenu item. Use the:
• drop-down 1 to view fellow Level 2 sub-menu items falling under the Level 1 menu item i.e. Applications, as shown in the image below:
| Introduction | 7
• drop-down 2 to view sub-reports, displayed as widgets on the reports dashboard, as shown in the image below:
| Introduction | 8
Search Reports
Click icon to perform a search in a given report based on the following search criterion:
• is
• is not
• contains
• does not contain
For example, let's say you want to perform a search for a user with User Name Joseph in Internet Users report under
User Data Transfer Report, given below are sample results using each search criterion:
• is - Displays details of the user Joseph
• is not - Displays details of all the users other than Joseph
• contains - Displays details of all the users whose User Name or Name contains Joseph
• does not contain - Displays details of all the users whose User Name or Name does not contain Joseph
Filter Reports
A report can be further filtered or drilled-down using a specific filtering criteria.
For example, clicking the User Name hyperlink from the Internet Users report under User Data Transfer Report will display all the reports specific to the selected user. You can further drill-down the filtered reports by adding another filtering criteria, let's say - Client Type.
The filter criteria is displayed as:
| Introduction | 9
This means the Internet Users report is filtered to display data only for the user Joseph when logged in through the
Web Client. Click icon to remove any of the filter(s).
Export to PDF
Click PDF hyperlink given at the top right of a report to export the report in PDF format.
Export to MS Excel
Click EXCEL hyperlink given at the top right of a report to export the report in MS Excel format.
Bookmark
Use this to create a bookmark of a report page at any level of drill- down. Click Bookmark hyperlink given at the top right of a report to create a bookmark of the report page. The created bookmark(s) are displayed under the Bookmarks menu of the Reports navigation pane.
Schedule
Use this to configure report notification for a report page. Once configured, the Device sends report notification(s) to specified Email Addresses as per the configured frequency.
Info Icon (i)
The Info Icon beside any report title indicates one of the 3 things:
• Reports for devices running on Sophos Firewall OS
• Reports for devices running on CyberoamOS
• Does not report for devices running on Sophos UTM 9.x
Accessing Sophos iView
Logon procedure
After successful installation, Sophos - iView needs to be configured to collect the logs in order to generate the reports.
Access Admin Console, a browser-based Interface to configure and manage Sophos-iView as well as view reports.
Web Browser should meet the following requirements:
• Microsoft Internet Explorer 8+
• Mozilla Firefox 3.0
• Google Chrome
• Safari 5.1.2(7534.52.7)+
• Opera 15.0.1147.141+
Sophos-iView can be accessed over HTTP protocol. Browse to http://<IP address of the machine on which Sophos iView is installed i.e. local machine> and log on using default username ‘admin’ and password specified at the time of installation.
Log out procedure
To avoid unauthorized users from accessing Sophos iView, log off after you have finished working. This will end the session and exit from Sophos-iView.
| Introduction | 10
Using Online Help
Sophos - iView Online Help is a Web-based help which can be viewed from any of the pages of Web Admin console.
It is installed automatically with the software. To view context sensitive (page-specific) help topic:
• Click Help in the top right corner of the screen.
• Press F1.
| Dashboards | 11
Dashboards
Sophos-iView displays the Main Dashboard as soon as you log on to the Admin Console. Dashboards provide an overall view of the network traffic including application, web and mail traffic including what is happening on the network, such as top attacks or top spammers.
iView consists of following Dashboards:
•
•
•
•
Main Dashboard
Main Dashboard provides summary of allowed and denied traffic for the selected Sophos UTM, Cyberoam and/or
Sophos Firewall device(s) integrated with iView.
Main Dashboard provides a quick overview of top allowed and denied traffic of network including Web, FTP, mail, database and other applications.
It displays graphical and tabular overview of allowed and denied traffic of the top traffic generating applications for all the added devices in a Widget form.
Widget displays report in graphical as well as tabular format. By default, the report is displayed for the current date.
Report date can be changed through the Calendar available on the topmost row of the page.
Allowed Traffic Overview
Allowed Traffic Overview displays amount of data transferred by the top six traffic-generating applications for the devices.
The dashboard reports are displayed using a graph as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
.
Bar graph displays amount of data transferred by top applications while tabular report contains following information:
• Device: Name of the device as defined in Sophos-iView.
• Applications (e.g. Web, SSL, POP3 etc as shown in the below given screen): Amount of data transfer through each application.
• Others: Amount of data transfer through other applications.
Click Device hyperlink to view the Device-specific
for a particular Device.
| Dashboards | 12
Figure 1: Allowed Traffic Dashboard
Blocked Traffic Overview
Blocked Traffic Overview widget displays denied connection for the top five applications for each device.
The dashboard reports are displayed using a graph as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
.
Bar graph displays amount of denied traffic by IPS attacks, spam, virus, firewall and content filtering while tabular report contains following information
• Device: Name of the device as defined in Sophos-iView.
• Content Filtering Denied: Number of blocked Web access attempts.
• Firewall Denied: Number of blocked firewall rule attempts.
• IDP Attack: Number of Intrusion attack attempts.
• Spam: Number of blocked spam attempts.
• Virus: Number of blocked virus attempts.
Click Device hyperlink to view the
| Dashboards | 13
Figure 2: Blocked Traffic Overview
Traffic Dashboard
The Traffic Dashboard is a collection of widgets displaying comprehensive summary of the network traffic in terms of applications, web categories, users, hosts, source and destination countries, mail traffic and FTP activities.
The Traffic Dashboard consists of following reports in the form of widgets:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
• Allowed Traffic Summary
• Web Traffic Summary
• FTP Traffic Summary
Applications
This Report displays the list of applications along with application wise distribution of total data transfer and relative percentage distribution amongst those applications.
View the report by selecting Applications from
at the top left corner of the screen.
| Dashboards | 14
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per application, while the tabular report contains the following information:
• Application/Proto:Port: Name of the application. If the application is not defined in the Device, then this field displays the application identifier as a combination of protocol and port number.
• Category: Name of application category as defined in the Device.
• Risk: Risk level associated with the application. This is a numeric value. Higher value represents higher risk.
• Bytes: The amount of data transferred per application.
• Percent: The amount of data transfer per application, in percentage.
Click Application hyperlink in the table or the pie chart to view the
Filtered Reports
.
Figure 3: Applications
Application Categories
This Report displays the list of top application categories along with category wise distribution of the total data transfer and relative percentage distribution among those categories
View the report by selecting Applications Categories from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per application category, while the tabular report contains following information:
• Category: Name of the Application category as defined in the Device.
• Bytes: Amount of data transferred.
• Percent: Amount of data transfer in percentage.
Click Category hyperlink in the table or the pie chart to view the
Filtered Reports
.
| Dashboards | 15
Figure 4: Application Categories
Application Users
This Report displays list of top users along with the amount of traffic generated for various applications, hosts, destinations, domains and categories.
View the report by selecting Application Users from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per user, while the tabular report contains following information:
• User: Username of the user as defined in the Device. If the User is not defined, then it will display ‘N/A’ which means the traffic is generated by an undefined user.
• Bytes: Amount of data transferred.
• Percent: Amount of data transfer in percentage.
Click User hyperlink in the table or the pie chart to view the
Filtered Reports
| Dashboards | 16
Figure 5: Application Users
Hosts
This Report displays the list of top hosts along with host wise distribution of total data transfer and relative percentage distribution amongst those hosts.
View the report by selecting Hosts from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per host, while the tabular report contains following information:
• Host: IP Address of the host.
• Bytes: Amount of data transferred.
• Percent: Amount of data transfer in percentage.
Click the Host hyperlink in table or the pie chart to view the
Filtered Reports
.
| Dashboards | 17
Figure 6: Hosts
Source Countries
This Report displays the list of source countries from where the Internet traffic is originated along with the country wise distribution of total data transfer and relative percentage distribution amongst those countries.
View the report by selecting Source Countries from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per source country, while the tabular report contains following information:
• Country: Name of the country. Note that country association is not applicable to local hosts and N/A is displayed in such cases.
• Bytes: Amount of data transferred.
• Percent: Amount of data transfer in percentage.
Click the Source Country hyperlink in table or the pie chart to view the
Filtered Reports
| Dashboards | 18
Figure 7: Source Countries
Destination Countries
This Report displays the list of destination countries where the web traffic is directed along with country wise distribution of the total data transfer and relative percentage distribution amongst those countries.
View the report by selecting Destination Countries from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per destination country, while the tabular report contains following information:
• Country: Name of the country. Note that country association is not applicable to local hosts and <> is displayed in such cases.
• Bytes: Amount of data transferred.
• Percent: Amount of data transfer in percentage.
Click the Destination Country hyperlink in table or the pie chart to view the
Filtered Reports
.
| Dashboards | 19
Figure 8: Destination Countries
Allowed Policies
This Report displays the list of rules along with rule wise distribution of the total data transfer and relative percentage distribution amongst those rules.
View the report by selecting Allowed Policies from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per Firewall Rule ID, while the tabular report contains following information:
• Rule ID: Firewall Rule ID.
• Bytes: Amount of data transferred.
• Percent: Amount of data transfer in percentage.
Click the Rule ID hyperlink in the table or the pie chart to view the
Filtered Reports
Figure 9: Allowed Policies
Web Categories
This Report displays the list of top web categories along with category wise distribution of total data transfer and relative percentage distribution amongst those categories.
View the report by selecting Web Categories from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per web category, while tabular report contains following information:
• Category: Name of the Web category, as defined in the Device.
• Hits: Number of Hits to the Web category.
• Percent: Amount of data transfer in percentage.
Click the Category hyperlink in the table or the pie chart to view the
Filtered Reports
.
| Dashboards | 20
| Dashboards | 21
Figure 10: Web Categories
Web Users
This Report displays the list of Web users along with user wise distribution of total data transfer and relative percentage distribution amongst those Web users.
View the report by selecting Web Users from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per user, while the tabular report contains following information:
• User: Username of the user as defined in the Device. If the User is not defined then it will display ‘N/A’ which means the traffic is generated by an undefined user.
• Bytes: Amount of data transferred.
• Percent: Amount of data transfer in percentage.
Click the User hyperlink in the table or the pie chart to view the
Filtered Reports
| Dashboards | 22
Figure 11: Web Users
Web Domains
This Report displays the list of domains along with domain wise distribution of the total data transfer and the relative percent distribution amongst those domains.
View the report by selecting Web Domains from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per domain, while the tabular report contains following information:
• Domain: Displays the name of the domain.
• Bytes: Amount the of data transfer.
• Percent: Displays the amount of data transfer in percentage.
Click the Domain hyperlink in the table or the pie chart to view the
Filtered Reports
.
Figure 12: Web Domains
File Uploaded via Web
This Report displays the list of File Uploaded via web along with date, user, domain name, size and source from which it was uploaded.
View the report by selecting File Uploaded via Web from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
Tabular report contains the following information:
• Date: Date of file upload.
• Users: Name of the user.
• Source IP: IP Address of the source.
• Domain name: Name of the domain where file has been uploaded.
• File name: Name of the file.
• Size: Size of the file.
Figure 13: File Uploaded via Web
| Dashboards | 23
| Dashboards | 24
Files Uploaded via FTP
This Report displays the list of the files uploaded via FTP with file wise distribution of the total data transfer and the relative percentage distribution amongst those files.
View the report by selecting File Uploaded via FTP from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per uploaded file, while the tabular report contains the following information:
• File: Name of the top file uploaded via FTP.
• Bytes: Size of the top uploaded files.
• Percent: Relative percent distribution among the top files uploaded via FTP.
Click the File hyperlink in the table or the pie chart to view the
Filtered Reports
.
Figure 14: Files Uploaded via FTP
Files Downloaded via FTP
This Report displays list of the files downloaded via FTP along with file wise distribution of the total data transfer and relative percent distribution among those files.
View the report by selecting File Downloaded via FTP from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per downloaded file, while the tabular report contains the following information:
• File: Name of the top file downloaded via FTP.
• Bytes: Size of the top downloaded files.
• Percent: Relative percent distribution among the top files downloaded via FTP.
Click the File hyperlink in the table or the pie chart to view the
Filtered Reports
.
| Dashboards | 25
Figure 15: Files Downloaded via FTP
FTP Servers
This Report displays a list of FTP servers along with data transfer per server along with relative percent distribution among the FTP servers.
View the report by selecting FTP Servers from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays percentage distribution of data transfer per server, while the tabular report contains following information:
• Server: Name of the FTP server.
• Bytes: Total data transfer via FTP server.
• Percent: Relative percent distribution among the FTP servers.
Click the Server hyperlink in the table or the pie chart to view the
Filtered Reports
.
| Dashboards | 26
Figure 16: FTP Servers
Mail Traffic Summary
This Report displays type of Email traffic along with number of bytes and percentage distribution amongst the traffic type.
View the report by selecting Mail Traffic Summary from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays relative percentage distribution of traffic types, while the tabular report contains the following information:
• Traffic: The type of Email traffic. Possible types are :
• Clean Mail
• Spam
• Probable Spam
• Virus
• Hits: The number of hits per Email traffic type.
• Percent: Relative percentage distribution among the traffic types.
Click the Traffic hyperlink in the table or the pie chart to view the
Filtered Reports
.
| Dashboards | 27
Figure 17: Mail Traffic Summary
Mail Senders
This Report displays the list of top Email senders along with the number of hits that generated the most traffic for various users, destinations, hosts and applications.
View the report by selecting Mail Senders from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The Bar graph displays the relative percentage distribution of data transferred by each sender while the tabular report contains following information:
• Sender: Email ID of the sender.
• Hits: Number of Hits to the sender.
• Bytes: Amount of data transferred.
Click the Sender hyperlink in the table or the pie chart to view the
Filtered Reports
.
Figure 18: Mail Senders
Mail Recipients
This Report displays list of top Email recipients along with the number of hits that generated the most traffic for various users, destinations, hosts and applications.
View the report by selecting Mail Recipients from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The Bar graph displays the relative percentage distribution of data transferred by each recipient while the tabular report contains following information:
• Recipient: Email ID of the recipient.
• Hits: Number of Hits to the recipient.
• Bytes: Amount of data transferred.
Click the Recipient hyperlink in the table or the pie chart to view the
Filtered Reports
.
| Dashboards | 28
Figure 19: Mail Recipients
Allowed Traffic Summary
Report displays list of top Web protocols along with number of bytes and percentage of the traffic.
View report from Traffic Dashboard.
Report is displayed as graph as well as in tabular format.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
Pie chart displays amount of data transferred and percentage wise distribution of data transfer per Web Traffic protocol while tabular report contains following information:
• Allowed Traffic: Allowed traffic protocol.
• Bytes: Amount of data transferred.
• Percent: Relative percent distribution among allowed protocols.
| Dashboards | 29
| Dashboards | 30
Figure 20: Allowed Traffic Summary
Web Traffic Summary
Report displays list of top web traffic along with number of bytes and percentage of the traffic.
View report from Traffic Dashboard.
The report is displayed using a pie chart as well as in a tabular format. The pie chart displays amount of data per Web
Traffic type.
By default, the report is displayed for the current date. The report date can be changed from the
.
Pie chart displays amount of data transferred and percentage wise distribution of data transfer per Web Traffic type while tabular report contains following information:
• Traffic: Type of Web Traffic. Possible Types: CF Allowed, CF Denied, Virus.
• Bytes: Amount of data transferred.
• Percent: Relative percent distribution among the top web traffic types.
| Dashboards | 31
Figure 21: Web Traffic Summary
FTP Traffic Summary
Report displays list of top FTP traffic along with number of bytes and percentage of the traffic.
View report from Traffic Dashboard.
Report is displayed as pie chart. The chart displays amount of data FTP traffic type.
By default, the report is displayed for the current date. The report date can be changed from the
.
Chart displays amount of data transferred and percentage wise distribution of data transfer per FTP traffic type while tabular report contains following information:
• Traffic: Type of FTP traffic. Possible Types: Clean FTP, Virus.
• Bytes: Amount of data transferred.
• Percent: Relative percent distribution among the top FTP traffic types.
| Dashboards | 32
Figure 22: FTP Traffic Summary
Security Dashboard
The Security dashboard is a collection of widgets displaying information regarding the denied network activities and traffic. It also gives an overview of malware, spam as well as top source and destination countries.
View the dashboard from Reports > Dashboard > Security Dashboard.
The Security Dashboard consists of following reports in widget form:
•
High Risk Applications
•
High Risk Application Users
•
•
•
Objectionable Web Categories
•
Objectionable Web Domains
•
•
•
Objectionable Web Users
•
Blocked Web Users
•
Hosts - ATP
•
Users - ATP
•
Advanced Threats
•
Client Insights - ATP
•
Intrusion Attacks
•
Attackers
•
•
•
•
Detailed View - Client Health
•
Blocked Network Access
•
Attacked Web Servers
•
Web Server Attacks
| Dashboards | 33
Blocked Hosts
Report displays a list of top hosts which made the maximum attempts to access the blocked sites.
View report from Security Dashboard.
Report is displayed using a pie chart as well as in tabular format.
By default, the report is displayed for the current date. The report date can be changed from the
.
Pie chart displays number of hits and percentage wise distribution of hits per denied host while tabular report contains following information:
• Host: IP address of the hosts.
• Hits: Number of attempts to access the blocked site.
• Percent: Relative percent distribution among the denied hosts.
Click Host hyperlink in the table or the pie chart to view the
Filtered Reports
.
Figure 23: Top Blocked Hosts
Blocked Users
This Report displays a list of users who made the maximum attempts to access blocked applications.
View the report by selecting Blocked Users from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays relative percentage distribution of number of hits amongst the denied users, while the tabular report contains following information:
• User: Name of the denied user as defined in the Device.
• Hits: Number of attempts by a particular user to access blocked application(s).
• Percent: Relative percentage distribution amongst the denied users.
Click the User hyperlink in the table or the pie chart to view
Filtered Reports
.
| Dashboards | 34
Figure 24: Blocked Users
Blocked Applications
This Report displays a list of blocked applications which have the maximum number of access attempts.
View the report by selecting Blocked Applications from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays the percentage distribution of number of hits amongst the denied applications while the tabular report contains the following information:
• Application/Protocol: Displays the name of the application as defined in the Device. If application is not defined, then this field will display the application identifier as a combination of protocol and port number.
• Category: Name of the application category as defined in the Device.
• Risk: Risk level associated with the application. The risk level is a numeric value. A higher value represents higher risk.
• Hits: Number of attempts to access the application.
• Percent: Relative percentage distribution amongst denied applications.
Click the Application hyperlink in table or pie chart to view
Filtered Reports
.
| Dashboards | 35
Figure 25: Blocked Applications
Blocked Destination Countries
This Report displays a list of countries to where the maximum volume of Internet traffic is denied along with number of hits per country.
View the report by selecting Blocked Destination Countries from Security Dashboard.
The report is displayed using a graph as well as in a tabular format. By default, the report is displayed for the current
date. The report date can be changed from the
Bar graph displays list of denied destination Countries along with number of hits while tabular report contains following information:
• Country: Name of the country. Note that country association is not applicable to local hosts and N/A is displayed in such cases.
• Hits: Number of hits per host.
To view the granular reports for a particular Destination Country, filter by clicking the Destination Country hyperlink in the table. Refer to
Filtered Blocked User Apps
section for details on each filtered widget.
| Dashboards | 36
Figure 26: Blocked Destination Countries
Blocked Source Countries
This Report displays a list of countries from where the maximum volume of Internet traffic is denied along with number of hits per country.
View the report by selecting Blocked Source Countries from Security Dashboard.
The report is displayed using a graph as well as in a tabular format. By default, the report is displayed for the current
date. The report date can be changed from the
Bar graph displays list of denied source Countries along with number of hits while tabular report contains following information:
• Country: Name of the Country. Note that country association is not applicable to local hosts and N/A is displayed in such cases.
• Hits: Number of hits per host.
To view the granular reports for a particular Source Country, filter by clicking the Source Country hyperlink in the table. Refer to
Filtered Blocked User Apps
section for details on each filtered widget.
| Dashboards | 37
Figure 27: Blocked Source Coluntries
Blocked Rule ID
This Report displays a list of firewall rule ID along with number of hits per firewall rule.
View the report by selecting Blocked Rule ID from Security Dashboard.
The report is displayed using a graph as well as in a tabular format. By default, the report is displayed for the current
date. The report date can be changed from the
Bar graph displays list of firewall rule IDs along with number of hits while tabular report contains following information:
• Rule ID: Number displaying firewall rule ID.
• Hits: Number of hits per firewall rule.
• Percent: Percentage of traffic for each rule.
To view the granular reports for a particular Policy Rule, filter by clicking the Policy Rule hyperlink in the table.
Refer to
Filtered Blocked User Apps
section for details on each filtered widget.
| Dashboards | 38
Figure 28: Blocked Rule ID
Blocked Categories
This Report displays a list of blocked web categories that various users tried to access and the number of access attempts to each category.
View the report by selecting Blocked Categories from
at the top left corner of the screen.
Note: You can view this report from Security Dashboard as well.
The report is displayed using a graph as well as in a tabular format. By default, the report is displayed for the current
date. The report date can be changed from the
The bar graph displays list of categories along with number of hits per category while the tabular report contains the following information:
• Category: Name of the category.
• Hits: Number of hits per category.
Click the Category hyperlink in table or pie chart to view
Filtered Reports
.
| Dashboards | 39
Figure 29: Blocked Web Categories
Blocked Domains
This Report displays the list of blocked web domains that various users tried to access and the number of access attempts to each domain.
View the report by selecting Blocked Domains from
at the top left corner of the screen.
Note: You can view this report from Security Dashboard as well.
The report is displayed using a graph as well as in a tabular format. By default, the report is displayed for the current
date. The report date can be changed from the
The bar graph displays the list of domains along with number of hits per domain while tabular report contains the following information:
• Domain: Name of the domain.
• Hits: Number of Hits.
Click the Domain hyperlink in table or pie chart to view
Filtered Reports
.
| Dashboards | 40
Figure 30: Blocked Web Domains
Attacks
The Report enables to view the details of the attack that has hit the system and gives the detailed disintegration of attackers, victims and applications through individual reports.
View the report by selecting Intrusion Attacks from
at the top left corner of the screen.
The report is displayed using a graph as well as in a tabular format. By default, the report is displayed for the current
date. The report date can be changed from the
The bar graph displays the number of hits under each attack, while the tabular report contains the following information:
• Attack: Name of the attack launched.
• Hits: Number of hits for each attack.
• Percent: Percent of each attack as compared to all attacks.
To view granular reports for a particular attack, filter by clicking the Attack hyperlink in the table. Refer to
Filtered
Intrusion Attacks Reports
section for details on each filtered widget.
| Dashboards | 41
Figure 31: Attacks
Viruses
This Report lists viruses blocked by the Device as well as number of occurrence per blocked virus.
View the report by selecting Virus from
at the top left corner of the screen.
The report is displayed using a graph as well as in a tabular format. By default, the report is displayed for the current
date. The report date can be changed from the
The bar graph displays blocked web viruses along with number of counts per virus while the tabular report contains the following information:
• Virus: Name of the blocked web virus.
• Count: Number of times a virus was blocked.
• Percent: Percent of each virus as compared to total viruses found.
To view granular reports for a particular Virus, filter by clicking the Virus Name hyperlink in the table. Refer to
Filtered Blocked Web Attempts Report - Virus
section for details on each filtered widget.
Figure 32: Viruses
Spam Senders
This Report displays a list of Spam Senders along with number of hits and percent distribution among the spam senders.
View the report by selecting Spam Senders from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The Pie chart displays a percentage-wise distribution of spam per sender while the tabular report contains the following information:
• Sender: Email ID of the sender.
• Hits: Number of hits to the sender.
• Percent: Relative percent distribution among the spam sender.
Click the Sender hyperlink in the table or the chart to view the
Filtered Reports
.
| Dashboards | 42
| Dashboards | 43
Figure 33: Spam Senders
Spam Recipients
This Report displays a list of Spam Recipients along with number of hits and percent distribution among the spam recipients.
View the report by selecting Spam Recipients from
at the top left corner of the screen.
The report is displayed using a graph as well as in a tabular format. By default, the report is displayed for the current
date. The report date can be changed from the
The Pie chart displays a percentage-wise distribution of spam per recipient while the tabular report contains the following information:
• Recipient: Email ID of the recipient.
• Hits: Number of hits to the recipient.
• Percent: Relative percent distribution among the spam recipients.
Click the Recipient hyperlink in the table or the chart to view the
Filtered Reports
.
| Dashboards | 44
Figure 34: Spam Recipients
Blocked Traffic Summary
Report displays list of denied traffic types along with number of hits and relative percentage distribution.
View report from Security Dashboard.
Report is displayed using a pie chart as well as in tabular format.
The report is displayed using a graph as well as in a tabular format. By default, the report is displayed for the current
date. The report date can be changed from the
Pie chart displays number of hits and percentage wise distribution of hits per denied traffic type while tabular report contains following information:
• Traffic: Blocked traffic type.
• Hits: Number of hits per blocked traffic type.
• Percent: Relative percent distribution among the blocked traffic type.
| Dashboards | 45
Figure 35: Blocked Traffic Summary
Virus Summary
This Report provides an overview of Virus traffic in your network, in terms of protocols through which viruses were introduced in the network as well as number of counts per protocol.
View the report by selecting Virus Summary from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
The pie chart displays number of counts per protocol through which viruses were introduced in the network, while the tabular report contains following information:
• Application/Proto:Port: Name of the protocol through which viruses were introduced in the network.
• Count: Number of counts per protocol.
| Dashboards | 46
Figure 36: Virus Summary
Spam Summary
Report displays list of spam protocols along with number of hits and relative percentage distribution.
View report from Security Dashboard. Report is displayed using a pie chart as well as in tabular format.
The report is displayed using a graph as well as in a tabular format. By default, the report is displayed for the current
date. The report date can be changed from the
Pie chart displays number of hits and percentage wise distribution of hits per spam protocol while tabular report contains following information:
• Application: Name of the protocol.
• Hits: Number of hits per protocol.
• Percent: Relative percent distribution among the application protocol.
| Dashboards | 47
Figure 37: Spam Summary
IDP Attacks Summary
Report displays list of IDP attacks along with number of hits and relative percentage distribution.
View report from Security Dashboard. Report is displayed using a pie chart as well as in tabular format.
The report is displayed using a graph as well as in a tabular format. By default, the report is displayed for the current
date. The report date can be changed from the
Pie chart displays number of hits and percentage wise distribution of hits per IDP attack type while tabular report contains following information:
• Attack Type: Displays type of attacks.
• Hits: Number of hits per attack type.
• Percent: Relative percent distribution among the attack types.
| Dashboards | 48
Figure 38: IDP Attacks Summary
Content Filtering Blocked Summary
Report displays list of applications denied by Content Filtering along with number of hits and relative percentage distribution.
View report from Security Dashboard. Report is displayed using a pie chart as well as in tabular format.
The report is displayed using a graph as well as in a tabular format. By default, the report is displayed for the current
date. The report date can be changed from the
Pie chart displays number of hits and percentage wise distribution of hits per protocol denied by Content Filtering module while tabular report contains following information:
• Application: Protocol denied by Content Filtering module.
• Hits: Number of hits per denied protocol.
• Percent: Relative percent distribution among the denied protocols.
Figure 39: Content Filtering Blocked Summary
System Dashboard
Sophos - iView dashboard gives overview of main components of Sophos - iView. This page displays following information:
•
•
•
•
CPU Usage
View the report by selecting CPU Usage from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
Tabular report contains following information:
• CPU: State of CPU as Idle or Used.
• Percent: Percentage wise distribution of CPU state.
To view
drill down by clicking the CPU hyperlink in the table.
Figure 40: CPU Usage
| Dashboards | 49
| Dashboards | 50
Detailed CPU Usage Report
Report displays trend of CPU usage. View report from Dashboard > System Dashboard > CPU Usage Widget >
CPU
Tabular report contains following information:
• Time: Time in (YYYY-MM-DD HH:MM:SS) format.
• Usage: CPU usage corresponding to time.
Figure 41: Detailed CPU Usage Report
Memory Usage
View the report by selecting Memory Usage from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
Tabular report contains following information:
• Memory: Status of Sophos-iView memory as used and free.
• Usage: Usage of memory.
To view
drill down by clicking the memory hyperlink in the table.
Figure 42: Memory Usage
Detailed Memory Usage Report
Report displays trend of memory usage. View report from Dashboard > System Dashboard > Memory Usage
widget > Memory.
Tabular report contains following information:
• Time: Time in (YYYY-MM-DD HH:MM:SS) format.
• Usage: Memory usage corresponding to time.
Figure 43: Detailed Memory Usage Report
Disk Usage
View the report by selecting Disk Usage from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
Tabular report contains following information:
• Disk: Name and status of disk used to store database and archive logs.
• Usage: Disk usage
To view
drill down by clicking the Disk hyperlink in the table.
| Dashboards | 51
Figure 44: Disk Usage
Detailed Disk Usage Report
Report displays trend of disk usage in the form of database and archive usage. View report from Dashboard >
System Dashboard > Disk Usage > Disk.
Tabular report contains following information:
• Time: Time in (YYYY-MM-DD HH:MM:SS) format.
• Usage: Disk usage corresponding to time.
Figure 45: Detailed Disk Usage Report
Event Frequency
View the report by selecting Event Frequency from
at the top left corner of the screen.
The report is displayed using a pie chart as well as in a tabular format. By default, the report is displayed for the current date. The report date can be changed from the
Tabular report contains following information:
• Time: Displays average time slot.
| Dashboards | 52
• Events per minute: Displays event per minutes for time slot.
To view
drill down by clicking the Timehyperlink in the table.
| Dashboards | 53
Figure 46: Event Frequency
Detailed Event Frequency Report
Report displays device wise event frequency. View report from Dashboard > iView Dashboard > Event Frequency
widget > Time.
Graph displays number of events based on time slots while tabular report contains following information:
• Time: Time in (YYYY-MM-DD HH:MM:SS) format.
• Device: Device ID.
• Events: Number of events per device.
Figure 47: Detailed Event Frequency Report
System
System allows configuration for the following:
Available configurations:
•
Network
- Network menu establishes how your Sophos-iView device connects, interacts with your network, and allows configuring network specific settings.
•
- Administration provides options to configure general settings and administrative settings for the
device.
•
- Configuration allows you to add network devices to Sophos -iView, configure Sophos -iView for
generating reports for added devices and customize Sophos -iView as per requirement.
•
- Maintenance facilitates handling firmware versions, licensing services, updates and Backup &
Restore.
•
archive log file.
•
- Audit logs are required to ensure accountability, security and problem detection of a system.
•
- Diagnostics allows viewing of statistics to diagnose the connectivity problem, network problem and test network communication.
•
- Archives provides historical archived logs to provide historical view of network activities.
Network
Use Network pages to configure Sophos iView Device to operate in your network.
This section covers the following topics:
•
- Configure and manage the ports/interfaces of the device.
•
- Manage DNS servers to be used by the Device.
•
Interfaces
The Interfaces page contains a list of all the interfaces of the device and displays each of their configuration.
System > Network > Interface
The device is shipped with a number of physical interfaces/ports. The Interface page displays a list of physical interfaces and aliases.
Using this page, the physical interfaces can be configured. This page also allows you to configure Alias for each interface.
•
– Alias allows binding multiple IP addresses to a single physical interface.
Note:
• Updating interface details may affect dependent configurations including DNS and gateway.
Add Alias
Alias allows binding multiple IP addresses onto a single interface. This page describes how to add/edit an Alias.
1. Navigate to System > Network > Interfaces, click Add Alias.
2. Enter interface details.
| System | 54
Physical Interface
Select the interface for which an Alias should be bound.
IP Family
Select the IP family for the Alias.
Available Options:
IPv4 (Only for physical interfaces with IPv4 configuration)
IPv6 (Only for physical interfaces with IPv6 configuration)
IPv4/Netmask (Available only for IPv4)
Specify the IPv4 address and select the network subnet mask.
IPv6/Prefix (Available only for IPv6)
Specify the IPv6 address and the prefix.
Default - 64
Figure 48: Alias
3. Click Save.
Edit Interface
This page allows you to change IP address and sub netmask of the Interface and gateway (if defined).
1. Navigate to System > Network > Interface and click on the required Interface.
2. Enter general settings details.
Physical Interface
Physical Interface for example, Port A, Port B. It cannot be modified.
IPv4/Netmask
Specify IP Address and Netmask for the IPv4 Interface.
IPv6/Prefix
Specify IP Address and Prefix for the IPv6 Interface.
Gateway Name
Specify name of the gateway (It is available only when the gateway is defined on the interface)
IP Address
Specify IP Address of the gateway.
IPv6 Address (Available if IPv6 Configuration is enabled)
Specify IPv6 Address of the gateway.
| System | 55
Figure 49: General Settings
3. Enter advanced setting details.
Interface Speed
Select Interface speed for synchronization.
Speed mismatch between Firewall Manager and 3rd party routers and switches can result into errors or collisions on interface, no connection, traffic latency or slow performance.
Available Options:Auto Negotiate10 Mbps - Full duplex10 Mbps - Half duplex100 Mbps - Full duplex100
Mbps - Half duplex1000 Mbps - Full duplex1000 Mbps - Half duplex
Default - Auto Negotiate
MTU
Specify MTU value (Maximum Transmission Unit)
MTU is the largest physical packet size, in bytes, that a network can transmit. This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes. Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent.
Default - 1500
Input range - 576 to 1500
Figure 50: Advanced Settings
4. Click Save to save the settings.
WAN Link Manager
WAN Link routes traffic between the networks. By default, Firewall Manager supports only one WAN Link.
You must have configured the IP address for a default WAN Link at the time of deployment. You can change this configuration any time if required.
To configure WAN Link, go to System > Network > WAN Link Manager
| System | 56
| System | 57
Edit WAN Link
This page allows you to edit the WAN Link.
1. Navigate to System > Network > WAN Link Manager
2. Select the Gateway which you want to update.
3. Modify the gateway details.
Name
Gateway Name
IPv4 Address
Specify IP Address
IPv6 Address
Specify IPv6 Address
Interface
Specify Ethernet Port number that is to act as a Gateway.
Figure 51: WAN Link
4. Click Save to save the settings.
DNS
The Domain Name System (DNS) is a system that provides a method for identifying hosts on the Internet using alphanumeric names called fully qualified domain names (FQDNs) instead of using difficult to remember numeric IP addresses. In other words, it translates domain names to IP addresses and vice versa.
DNS server is configured at the time of deployment. You can add additional IP addresses of the DNS servers to which device can connect for name resolution. When multiple DNS are configured, they are queried in the order as they are entered.
To configure DNS, go to System > Network > DNS.
DNS List IPv4
Specify the DNS IP Address based on priority in DNS 1, DNS 2 and/or DNS 3.
Click Apply after adding new IP address to the DNS list.
Figure 52: DNS
Administration
Administration provides options to configure general settings of the device.
Available configurations:
•
: Appliance access allows limiting the administrative access of the device services .
•
: User Management allows to configure and maintain administrators, set user's administrative
access, password maintenance.
•
Central Management Integration
: Central Management allows managing and monitoring the device through
Central Management if deployed in your organization.
Device Access
Device access allows limiting the Administrative access of the following device services from various Interfaces/
Ports: HTTP, HTTPS, Telnet, SSH, ICMP, Syslog, SyslogS
Default Access Control Configuration
When device is connected and powered up for the first time, it will have a default Access configuration.
HTTP (TCP port 80), HTTPS (TCP port 443), Telnet (TCP port 23), SSH (TCP port 22), ICMP, Syslog and SyslogS services will be enabled for Port A and Port B.
Updating Default Access Control Configuration
Use access control to limit the access to the device for administrative purposes from the specific authenticated/trusted networks only. Enable/disable access to the device using following service from the specified zone: HTTP, HTTPS,
Telnet, SSH, ICMP, Syslog and SyslogS.
| System | 58
Figure 53: Device Access
Users
Use the System > Administration > Users page to configure and maintain administrators, set user's administrative access, password maintenance.
Screen components:
• Username: Login name preferred by the user.
• Name: Name of the user.
• Role: Role defines administrative access privilege.
• Email: Email address of the user.
| System | 59
• Created By: Username of the Administrator who added this user.
• Last Login Time: Last time when the user had logged in.
• Add button: Click to add a new user.
• Delete button: Click to delete a user.
Sophos -iView supports Three (3) types of user roles:
• Super Admin – Default account. No additional account can be created.
• Admin - Only administrator with the Super Admin role can add Admin roles.
• Viewer - Adminsitrator with Super Admin and Admin roles can add Viewer roles.
Below given table lists the various privileges associated with the each user type.
Super AdminFor all the devices
View
Y
AdminOnly for assigned devices
ViewerOnly for assigned device
Add
N
Update
N
Delete
N Mail Server
Configuration
User Management
Device Management
Device Group
Management
Custom View
Report Notification
Settings
Data Management Y
Bookmark Management Y
Y
Y
Y
Y
Y
Add
Y
Authentication Server
Chart Preferences
Audit Logs
Y
Y
Update
Y
Y
Y
Y
Y
Y
Y
Y
Y
Y
Delete
Y
Y
Y
Y
Y
Y
Y
Y
Y
Y
-
Super AdminFor all the devices
Y
Y
Y
Y
Y
Y
Y
Y
Y
Y
Y
N
N
Y
Y
Y
N
N
Y
Y
Y
N
N
Y
Y
Load and Search Archive Y
View Live Logs Y
View and Search Reports Y
Dashboards (Main,
Device, User, Host, Email
Address, iView)
Y
Y
Y
Y
Y
-
-
N
Y
N
Y
N
N
-
AdminOnly for assigned devices
ViewerOnly for assigned device
Y
Y
N
N
-
-
-
N
Y
Add/Edit User
1. Go to System > Administration > Usersand click Add.
2. Specify name of the user.
Y
N
N
Y
Y
View
N
N
N
N
Y
Y -
N
N
N
Y
N
N
N
N
N
Update
N
N
N
N
N
N
Add
N
-
-
-
N
Y
-
-
-
N
N
N
N
N
N
N
Delete
N
N
N
N
N
N
View
N
N
N
N
Y
N
| System | 60
3. Specify username, which uniquely identifies the user and will be used for login. Username can be any combination of alphanumeric characters and special characters “_”, “@” and “.”.
4. Specify authentication type. Possible authentication types: Local and External.
5. Specify password. Password is case sensitive.
6. Specify a valid Email ID. The Email ID can be any combination of alphanumeric characters and special characters
“_”, “@” and “.”.
7. Select user role from the drop down. Roles define administrative access privilege. Refer to Privilege Matrix for details.
8. Select the device or device group, which the user can manage. Click checkbox against the device/device group(s)
OR click Select All to select all device/device group(s).
9. Click Save to add the user. Depending on the role, user will be able to configure and view the information of the selected devices only.
Figure 54: User
Delete User
1. Go to System > Administration > Users.
2. Click checkbox against the user(s) to be deleted OR click the checkbox against Username column name to delete all the users.
3. Click Delete.
Central Management Integration
This page allows the administrator to configure necessary parameters required to integrate iView with third party solutions like Sophos Firewall Manager (SFM).
1. Go to System > Administration > Central Management Integration.
2. Specify name of the third party solution to be integrated.
3. Enter the Third Party Solution URL. Example: https://{ip address of the third-party solution}/{controller
path}
4. Specify the HTTP method to be used to communicate solution.
Available Options:
Post
Get
5. Enter Response Parameters provided by your Third Party Solution Provider. Example: https://{ip address of the
third-party solution}/{controller path}
Name username uniqueid
Value
{uname}
{uid}
Note: Parameter value of username and uniqueid must be enclosed within curly braces.
6. Click Save to save the configuration.
| System | 61
Figure 55: Central Management Integration
Settings
This page allows you to make modifications to general port settings. Using Port Configuration you can customize the ports using which you can access Sophos-iView device.
Web Admin Settings
HTTP Port
Provide the port number to configure HTTP Port for Admin Console access.
Default - 80
HTTPS Port
Provide the port number to configure HTTPS Port for Admin Console access.
Default - 443
Syslog port
Provide the port number to configure Syslog port using which devices can access the Sophos iView.
Default - 514
Figure 56: Web Admin Settings
Sophos Adaptive Learning
The product sends information periodically to Sophos which is used for the purpose of improving stability and prioritizing feature refinements. It includes configuration and usage information.
Configuration and usage data such as Device information (e.g. model, version), Firmware and License information,
Features in use [status, on / off, count] (e.g. schedule reports, custom views, bookmarks), amount of configured items
(e.g. count of devices added per device type, count of groups), Product errors, CPU, memory and disk usage (in percentage), is collected by default.
No user-specific information is collected. The information is transmitted to Sophos over HTTPS.
Figure 57: Sophos Adaptive Learning
Configuration
This section describes how to add network devices to Sophos -iView, configure Sophos -iView for generating reports for added devices and customize Sophos -iView as per requirement.
This section covers the following topics:
•
: Create and manage groups of devices to generate reports.
•
: Add and manage network devices.
•
Application Categories
: Create and update applications, application categories and technologies of classification in application reports.
•
: Create and manage customized view of reports.
•
: Send reports in PDF format to configured Email address.
•
: Create and manage report and report group bookmarks.
•
: Manage disk and data required to generate reports.
•
: Configure Email server to send report notifications.
•
: Enable verification of MD5 checksum of Web USage and DHCP related reports.
•
: Customize access to Sophos-iView Device over HTTP, HTTPS and Syslog ports.
•
: Configure external authentication servers.
•
: Set date and time, or sync with NTP server.
| System | 62
| System | 63
Device Group Management
Device group is logical grouping of devices available in the product category. It is mainly based on device location, device model or device administrator. For example, Group of all the UTM devices deployed at same geographical location to get network visibility of that area. For example, all the devices sending logs of Inventory department of the
Organization can be grouped to generate consolidated report.
Use System > Configuration > Device Group Management page to
and manage device groups in Sophos iView.
Add/Edit Device Group
1. Go to System > Configuration > Device Group.
2. Click Add to create a new Device Group.
3. Specify name of device group. Device group name can be any combination of alphanumeric characters and special characters “_”, “@” and “.”.
4. Specify device group description, if required.
5. Click drop-down to select the product category.
6. Click checkbox against device(s) to be added OR click Select All to add all devices.
7. Click Save to add devices in the device group.
Figure 58: Device Group
Devices
Sophos -iView provides consolidated reports for multiple devices. It helps the Admin to view consolidated reports and dashboards for devices at one shot. This section describes how to add and configure devices that communicate with Sophos -iView.
Use System > Configuration > Devices page to add and configure devices to communicate with Sophos -iView. Use this page to:
•
•
Add/Update Device
There are two ways to add device to the Sophos -iView:
• Device-Auto Discovery
• Manual Device Addition
Device Auto-Discovery
Sophos-iView uses UDP protocol to discover the network device automatically. In order to send logs to SophosiView, network device has to configure Sophos-iView as a Syslog server. On successful login, Super Admin is
prompted with a pop-up "New Device Found" if a new device is discovered; else the Main Dashboard is displayed.
This prompt will be displayed every time Super Admin logs in, until an action is taken on the newly discovered device.
Super Admin can:
1. ignore this prompt by clicking Cancel.
2. accept and activate the device by providing Device Name and Device Type. Sophos-iView will accept the logs only after device is activated.
3. accept and keep device in deactivated state. Sophos-iView will not accept the logs if device is in inactive state.
| System | 64
Figure 59: Add Device Pop-up
Manual Device Addition
1. Go to System > Configuration > Devices and click Add.
2. Specify device ID and device name. Device ID and device name can be any combination of alphanumeric characters and special characters “_”, “@” and “.”.
3. Specify IP address of the device.
4. Select device type from the drop down.
5. Specify device description, if required.
6. Select status of the device from drop down, default status of a device is ‘Inactive’. To receive logs from the device one needs to activate the device in Sophos-iView.
Figure 60: Add Device
Activate/Deactivate Device
Activate Device
1. Go to System > Configuration > Device and click Active/Inactive against device name.
2. You can also activate or deactivate the device by clicking on the required device for updating.
Custom View
Custom view of reports allows grouping of the most pertinent reports that requires the special attention for managing the device. Reports from different report groups can also be grouped in a single view. In a view, maximum 8 reports can be grouped.
Custom view provides a single page view of all the grouped reports.
Use Settings > Configuration > Custom View to create and manage custom views.
Custom View Name
Name of custom view.
Custom View Description
Description of the view.
Add Button
Click to add a new custom view.
Delete Button
Click to delete a custom view.
Use this page to:
•
•
• Delete Custom View
Add Custom View
Create a new Custom View.
Note: Added Custom Views will be displayed under Custom Views sub-menu of navigation pane.
| System | 65
1. Go to Settings > Configuration > Custom View.
2. Click Add to create a new Custom View
3. Specify Custom View Name. Custom view name can be any combination of alphanumeric characters and special characters “_”, “@” and “.”.
4. Specify description of the Custom View, if required.
5. Expand report group and select the reports to be added in custom view. Maximum 8 reports can be added per custom view.
6. Click Save to add selected reports in the Custom View.
| System | 66
Figure 61: Custom View
Report Scheduling
iView can send various reports to specified Email Addresses as per the configured frequency.
| System | 67
Use the Settings > Configuration > Report Scheduling page to create and manage report notifications.
Click to add a new report notification.
Click existing notification to update it.
Delete Button
Click to delete a report notification.
Name
Name of the report notification.
Report Group/Bookmark
Category of reports.
Device Name
Name of Device(s) whose reports are included in report notification.
Email Frequency
Report notification frequency- daily or weekly.
To Email Address
Email ID of recipient(s).
Last Sent Time
Last time when the report notification was sent.
Add Report Schedule
Create a new Report Notification for one or more reports, security assessment reports or ConnectWise reports.
1. Go to Settings > Configuration > Report Schedule.
2. Click Add to create a new report notification.
3. Select reports to be sent.
• Report Notification:
Specify report notification name. Name can be any combination of alphanumeric characters and special characters “_”, “@” and “.”.
Specify description of the report notification, if required.
Specify Email address of the recipient in ‘To Email Address’ field. Use comma, with no space in between, to specify multiple Email IDs.
Select Category.
Select notification type. Possible types of reports are Report Group and Bookmark.
Select sorting criteria from the Sorting Criteria field. Possible options are Hits and Bytes.
Select report category from the Report Group or Bookmark drop down list. Reports from selected category will be sent to the recipients.
Select the Devices whose reports are to be included in the notification. Select devices from the Available
Devices list. They appear in the Selected Devices list.
Set Email frequency and time. Reports can be mailed daily or weekly. For daily notification select time of the day to send the report. For weekly notification, select day of the week and time of the day to send the report.
| System | 68
Figure 62: Report Schedule
4. Click Save to save changes.
Bookmark Management
Bookmark management allows the user to create bookmark of any report at any level of report drill-down. It provides administrator with great level of network visibility based on any criterion.
For example, the administrator can monitor web usage of a particular user by creating bookmark of user based web usage report.
Every bookmark should be a part of a defined bookmark group; if the bookmark group is not created then bookmarks will be members of Default group.
Every bookmark can be sent to specified Email Address(s) in the form of report notification. Use Settings >
Configuration > Bookmark Management to create bookmark groups.
Bookmark Groups
Name of the bookmark group.
Add Bookmark Group Button
Click to add a new bookmark group.
| System | 69
Delete Icon
Click to delete a bookmark group.
Use this page to:
•
• Delete Bookmark Group
Add Bookmark Group
Create a new Bookmark Group.
1. Go to Settings > Configuration > Bookmark Management.
2. Click Add Bookmark Group to create a new Bookmark Group.
3. Specify Bookmark Group Name, name can be any combination of alphanumeric characters and special characters
“_”, “@” and “.”.
4. Click Save to add the bookmark group. The newly created bookmark group is displayed under Bookmarks.
Note:
• Created bookmark groups will be displayed under Bookmarks Sub menu of navigation pane.
• Created bookmark group will also be displayed under Bookmark Group drop down of Add Bookmark option.
| System | 70
Figure 63: Bookmark Group
Data Management
This section describes how to configure Log Retention Period.
Retention of data and log archives use enormous amount of disk space. To control and optimize the disk space usage, configure the data retention period of detailed and summarized table. Depending on the compliance requirement, configure the log retention period.
Use Settings > Configuration > Data Management to configure retention period of various data tables. You can configure retention period for various log types.
Note: Based on configured retention period, log data will be deleted on day-by-day basis.
Log Retention Report Period
Log Retention
Displays type of logs to be retained.
Report Period
Displays retention period for summary reports.
Figure 64: Log Retention
Archive Retention
Displays archive logs.
Report Period
Displays retention period for archive logs.
Figure 65: Archive Retention
| System | 71
Export Customization
Select Enable against ‘Export to Excel Parameters Customization’ to enable selection of reports and number of records per report while exporting reports in MS-Excel format.
| System | 72
Figure 66: Export Customization
Apply Button
Click to apply changes. Changes in the retention period will be applied at 12:00 O’ clock in the night.
Mail Server
System > Configuration > Mail Server
Device allows configuration of Email notifications for certain system-generated events and report notifications (as specified by administrator).
Configure a Mail Server IP Address, Port, and Email Address for the device to send and receive alert Emails. Below are the screen elements with their description:
Mail Server Settings
Mail Server IP - Port
Specify the Mail Server IP Address and Port number.
Default - 25
Display Name
Name to be displayed in notification.
From Email Address
Specify the Email Address from which the notification is to be mailed.
To Email Address
Specify the Email Address to which the notification is to be mailed.
SMTP Authentication
Enable to authenticate user before sending an Email.
Specify user credentials.
Username
Specify the User Name, which uniquely identifies user and will be used for login.
Password
Specify the password.
Send Test Mail
Click Send Test Mail button to send out a test Email to configured Email addresses.
Note: Mail Server configuration changes automatically when changed from the Network Configuration
Wizard and vice versa.
Figure 67: Mail Server
Log Integrity
To achieve compliance requirement of some geographical region, iView provides MD5 sum for DHCP and Web
Usage log files. It ensures integrity of log data, which means the log files are intact and log data is not manipulated.
1. Go to System > Configuration > Log Integrity to configure MD5 checksum generation.
2. Enable MD5 Checksum module for DHCP and/or Web Usage.
3. Click Save to save changes.
Figure 68: Log Integrity
Authentication Server
Sophos -iView supports user authentication against:
• an LDAP server
• a RADIUS Server
• an internal database defined in Appliance
User authentication can be performed using local user database, RADIUS, LDAP or any combination of these.
Local Authentication
Sophos-iView provides a local database for storing user information. You can configure Sophos -iView to use this local database to authenticate users and control their access to the network. Choose local database authentication over
LDAP or RADIUS when the number of users accessing the network is relatively small. Registering dozens of users
| System | 73
| System | 74 takes time, although once the entries are in place they are not difficult to maintain. For networks with larger numbers of users, user authentication using LDAP or RADIUS servers can be more efficient.
Combination of external and local authentication is useful in large networks where it is required to provide guest user accounts for temporary access while a different authentication mechanism like RADIUS for VPN and SSL VPN users provides better security as password is not exchanged over the wire.
External Authentication
External Authentication Servers can be integrated with the Sophos -iView for providing secure access to the users of those servers.
To manage external authentication servers, go to System > Configuration > Authentication Server.
Add Authentication Server
Server Type: Select the service with which you want to use your network.
Available Options:
•
•
Add/Edit LDAP Server
When Sophos-iView is installed in Windows environment with LDAP server, it is not necessary to create users again in it. Sophos-iView provides a facility to automatically create user(s) on first logon. Whenever the existing user(s) in LDAP logs on for the first time after configuration, user is automatically created in the appliance and is assigned to the default group. This reduces Administrator’s burden of creating the same users in Sophos-iView. User has to be authenticated by Sophos-iView before granting access the Internet. Sophos-iView sends the user authentication request to LDAP and LDAP server authenticates user as per supplied tokens. User can log on using their Windows authentication tokens.
1. Select LDAP Server. If user is required to authenticate using an LDAP server, appliance needs to communicate with LDAP server for authentication.
2. Specify name to identify the server.
3. Specify LDAP Server IP address.
4. Specify Port number through which Server communicates. Default port is 389.
5. Select LDAP version. For example, 2
6. Specify the base distinguished name (Base DN) of the directory service, indicating the starting point for searching user in the directory service. If you are not aware about Base DN, click Get Base DN to retrieve base DN. The top level of the LDAP directory tree is the base, referred to as the "Base DN". A base DN usually takes one of the three forms: Organization name, Company’s Internet Domain name or DNS domain name. For example dc=google, dc=com.
7. Specify Administrator Username for the user with Administrative privileges for LDAP server
8. Specify Password for the user with Administrative privileges for LDAP server.
9. Set authentication attribute. It is the attribute used to perform user search. By default, LDAP uses uid attribute to identify user entries. If you want to use a different attribute (such as given name), specify the attribute name in this field.
10. Click Test Connection button to check the connectivity between LDAP and the appliance.
| System | 75
Figure 69: LDAP
Add/Edit RADIUS Server
RADIUS stands for Remote Authentication Dial In User Service and is a protocol for allowing network devices to authenticate users against a central database. In addition to user information, RADIUS can store technical information used by network devices such as protocols supported, IP addresses, telephone numbers, routing information, and so on. Together this information constitutes a user profile that is stored in a file or database on the RADIUS server.
RADIUS servers provide authentication, authorization, and accounting functions but appliance uses only the authentication function of the RADIUS server.
Before you can use RADIUS authentication, you must have a functioning RADIUS server on the network.
1. Select RADIUS Server. If user is required to authenticate using a RADIUS server, appliance needs to communicate with RADIUS server for authentication.
2. Name to identify the RADIUS Server.
3. Specify RADIUS Server IP address.
4. Specify Port number through which Server communicates. Default port – 1812.
5. Specify share secret, which is to be used to encrypt information passed to the appliance
6. Click Test Connection button to check the connectivity between RADIUS and the appliance.
Figure 70: RADIUS
Time & Date
Sophos-iView current date and time can be set according to the device’s internal clock or synchronized with an NTP server. Device clock can be tuned to show the right time using global Time servers so that logs show the precise time and device internal activities can also happen at a precise time.
Below are the screen elements and their description for setting the Time and Date for the Device:
Current Time
Displays the current system time.
Time Zone
Select time zone according to the geographical region in which the device is deployed.
Set Date & Time
Select to configure the date and time for device’s clock.
Date
Specify the date by clicking calendar .
Time
Specify the time in HH:MM:SS format.
Use pre-defined NTP Server
Select to use the pre-defined NTP servers – asia.pool.ntp.org & in.pool.ntp.org.
NTP stands for Network Time Protocol, and it is an Internet standard protocol used to synchronize the clocks of device to some time reference.
Use Custom NTP Server
Specify the NTP server IPv4 Address or IPv6 Address or domain name to synchronize time with it. If custom
NTP server is defined, time is synchronized with custom server and not with pre-defined servers.
Devices use NTP Version 3 (RFC 1305). One can configure up to 10 NTP servers. At the time of synchronization, it queries each configured NTP server sequentially. When the query to the first server is not successful, device queries second server and so on until it gets a valid reply from one of the NTP servers configured.
Sync Status
Click Sync Now to synchronize device clock with the NTP Server.
| System | 76
Figure 71: Time and Date
Maintenance
Maintenance facilitates handling firmware versions, licensing services and Backup & Restore. You can perform the following functions from this tab:
•
: Backup and Restore System data.
•
: Allows you to upload/view firmware versions downloaded.
•
: View status of module licenses and synchronize/renew module licenses.
Backup Restore
Backup is the essential part of data protection. Backups are necessary in order to recover data from the loss due to disk failure, accidental deletion or file corruption. There are many ways of taking backup and just as many types of media to use as well.
| System | 77
The Backup and Restore menu enables you to back up and restore the iView Appliance. It is a good idea to backup the configuration on a regular basis to ensure that, should the system fail, you can quickly get the system back to its original state with minimal effect to the network. It is a good idea to back up the configuration after making any changes to the configuration of the iView Appliance.
Once the backup is taken, you need to upload the file for restoring the backup. Restoring data older than the current data will lead to the loss of current data.
Backup
To take the backup manually, go to System > Maintenance > Backup/Restore and click Backup Now.
| System | 78
Figure 72: Backup
Restore
To restore any backup onto the iView Appliance, select the backup file by clicking Browse.. and then click Upload
and Restore.
Figure 73: Restore
Backup Schedule
Backup Frequency
Select frequency in which Appliance backup is taken. In general, it is best to schedule backup on regular basis.
Depending on how much information you add or change will help you determine the schedule.
Available Options:
Never – Select this option if you do not want to take backup. Daily – Configure time at which the backup should be taken. Weekly – Configure day and time at which the backup should be taken.Monthly – Configure day and time at which the backup should be taken.
Backup Mode
Select how and to whom backup files should be sent.
Available Options:
FTP – If backup is to be stored on FTP server, configure FTP server IP address, username and password to be used.Mail – If back up is to be mailed, configure email id on which backup is to be mailed.
| System | 79
Figure 74: Backup Schedule
Manage Backup
This section displays the list of last five backups along with the time and size of the backup. It also provides an option to download the backup and restore it.
Figure 75: Manage Backup
Firmware
Firmware
Firmware page displays the list of available firmware versions downloaded. Maximum two firmware versions are available simultaneously and one of the two firmware versions is active.
Upload firmware
- Administrator can upload a new firmware. Click to specify the location of the firmware image or browse to locate the file. You can simply upload the image or upload and boot from the image. The uploaded firmware can only be active after the next reboot.
In case of Upload & Boot, firmware image is uploaded and upgraded to the new version, closes all sessions, restarts, and displays the login page. This process may take few minutes since the entire configuration is also migrated in this process.
Boot from firmware
- Option to boot from the downloaded image and activate the respective firmware.
Boot with factory default configuration - Device is rebooted and loads default configuration.
Note: Entire configuration will be lost if this option is selected.
Active - Active icon against a firmware suggests that the device is using that firmware.
Figure 76: Firmware
Available Latest Firmware
Check For New Firmware
Displays if any new firmware is available.
Firmware Version
List of available firmware versions that can be downloaded.
Type
Different types of firmware.
Available Options:BetaGA
Actions
Download Button to download the firmware. Once the firmware is downloaded, click the Install button to install the firmware.
Figure 77: Available Firmware
Over-the-Air Hotfix
Allow over-the-air Hot-fixes
Hot-fixes are applied automatically if available. Disable if you do not want to apply hot-fix.
Default - Enable
Figure 78: Over-the-Air Hotfix
Licensing
Sophos iView licenses are available in multiple tiers based on storage requirements and support terms offering great value for any size organization.
A limited capacity (100GB) version is available at no charge for evaluation, or for small customers who don’t need to store data for extended periods. Paid licenses are available for 500 GB, 1TB, 4 TB, 8TB, and unlimited storage requirements. The licenses and the recommended configurations are given below.
| System | 80
After Device Registration and License Activation, the Storage Subscriptions in iView are perpetual while the Support
Subscriptions need to be renewed periodically.
Sophos iView
Licenses
iView Light*
Storage limit
100 GB
Recommended
CPU**
Dual core
Recommended
Memory
(vRAM)
4 GB
Network
Interface support
(Minimum /
Maximum)
1 / 4
Approximate event capacity
iView 500 GB iView 1 TB iView 4 TB iView 8 TB
500 GB
1 TB
4 TB
8 TB iView Unlimited Unlimited
(16 TB recommended)
Dual core
Dual core
Quad core
Quad core
Quad core#
4 GB
4 GB
4 GB
4 GB
8 GB
1 / 4
1 / 4
1 / 4
1 / 4
1 / 4
Short-term evaluation only
Up to 300 events per second
Up to 300 events per second
Up to 600 events per second
Up to 600 events per second
Up to 2000 events per second
Event capacity varies with CPU family and hardware specs
* Free for evaluation purpose
** CPU frequency 2.7 GHz or equivalent
# CPU frequency 3.1 GHz or equivalent
Lower Threshold
The Lower Threshold monitors the storage utilization of iView as a percentage of the Licensed Capacity or Disk
Capacity (whichever is lower). iView sends alerts if the utilization exceeds the specified threshold.
To set the Lower Threshold, specify the percentage and click Apply.
The meter displays the Disk Capacity, License Capacity and the percentage of storage utilized.
| System | 81
Figure 79: Lower Threshold
Device Registration Details
Model
Displays License Information and Serial Number of Device.
Version
Firmware version.
Licensed Storage Capacity
Storage capacity of the iView device based on purchased License.
Company Name
Name of the company under which the device is registered.
Contact Person
Name of the contact person in the company.
Registered Email Address
Email address used for device registration.
Figure 80: Registration Details
Subscription Details
Module
Information of Storage or Support Subscription.
Status
Indicates the status of the module.
A module can have the following status:
• Active - Module is subscribed.
• Inactive - Module is not subscribed.
• Expired - Subscription expired.
Expiration Date
Module subscription expiry date.
Figure 81: Subscription Details
| System | 82
Manage Subscription
Modules can be subscribed directly from your device or from your MySophos Account. Once you subscribe, you need to synchronize licenses with your MySophos account.
Click Synchronize to synchronize licenses with your account.
Click Activate to activate your purchased subscriptions.
| System | 83
Figure 82: Manage Subscription
Live Logs
Once the device is added, Administrator can verify whether the device is sending the logs or not through Live Logs.
With the real-time logs, Administrator can view the most recent log received from the selected device without loading the archive log file.
1. Go to System > Live Logs.
2. Select network device from the device drop down given at top left.
3. Set Refresh Time to refresh logs automatically.
4. Select number of records to be displayed.
5. Click Go to view real time logs for selected device.
6. Click Start Update to start log view.
7. Click Stop Update to stop log views.
8. Click Refresh to refresh logs manually.
Note:
• Real time logs can be viewed for a single device only.
• Log view is refreshed automatically as per the configured refresh time. If you wish to refresh the log view in between, use refresh button.
Figure 83: Live Logs
Audit Logs
Audit logs are required to ensure accountability, security and problem detection of a system.
Use System > Audit Logs page to view audit logs for Sophos-iView.
Screen Components
Event Time: Event time represents time of the event.
Category: Sophos -iView shows audit logs for following categories with corresponding events and messages:
Category
Event Logs for
SMTP server configuration update
Message
SMTP server IP: Port <IP address>:<Port> has been setSMTP server IP: Port <IP address>:<Port> with username <username> has been set SMTP server IP: Port <IP address>:<Port> setting failedSMTP server
IP: Port <IP address>:<Port> with username
<username> setting failed
| System | 84
User
Device
Views
Data
Add Report Notification
Update Report Notification
Delete Report Notification
Sent report notification
User Login
User Log out
Add User
Update User
Delete User
Add Device
Update Device
Delete Device
Add Device Group
Update Device Group
Delete Device Group
Unauthorized access to web pages
Archived Logs
Detail Table
Report notification < report notification name> added successfully
Report notification < report notification name> updated successfully
Report notification < report notification name> deleted successfully
Mail with subject <subject> sent to
<recipient’s email ID>Mail sending failed :<error message>
User <username> login successfulUser
<username> login failedNot authenticated due to database connection error
User log out successful
User <username> added successfullyAdd failed due to duplicate user name
User <username> updated successfullyUser
<username>update failed
User <username> deleted successfullyUser
<username> delete failed
<device status> device <device name> is added
Device < device name> is updatedDevice status for < comma separated device name> updated
Device < comma separated device name> are deletedDevice < comma separated device name> are not deleted
Device group <device group name> is addedDevice group <device group name> add failed due to duplicate device group name
Device group <device group name> is updated
Device group <device group name> is deleted
Unknown user has tried to access unauthorized page name <page name>User has tried to access unauthorized page name
<<page name>>
Archived (cold) log file will be deleted till date(dd-mm-yyyy) <<configured removal date>>Archived Log configuration updated to <<archived limit>> days
Detail Table configuration updated to
<<detail table limit >> days
| System | 85
| System | 86
Report
Summary Table
Add Custom View
Update Custom View
Delete Custom View
Severity: Following are predefined severity levels in Sophos-iView:
• Emergency: System is not usable.
• Alert: Action must be taken immediately.
• Critical: Critical condition.
• Error: Error condition.
• Warning: Warning condition.
• Notice: Normal but significant condition.
• Info: Informational.
• Debug: Debug-level messages.
Message: Message is one line description of event.
Username: Username of the user associated with the event.
IP Address: IP address of the user.
Summary Table configuration updated to
<<summary table limit>> days
Custom view < custom view name> added successfullyCustom view < custom view name> addition failed
Custom view < custom view name> updated successfullyCustom view < custom view name> update failed
Custom view < custom view name> deleted successfullyCustom view < custom view name> deletion failed due to <error message><number of custom view> custom view(s) deleted successfully
Diagnostics
Using Diagnostics, one can view the statistics to diagnose the connectivity problem, network problem and test network communication. It assists in troubleshooting issues such as hangs, packet loss, connectivity, discrepancies in the network.
•
Ping
•
Traceroute
•
Name Lookup
•
Route Lookup
•
Consolidated Troubleshooting Report
Ping
Ping is the most common network administration utility used to test the reachability of a host on an Internet Protocol
(IP) network and to measure the round-trip time for messages sent from the originating host to a destination computer.
Ping sends ICMP echo request/replies to test connectivity to other hosts. Use standard ICMP ping to confirm that the server is responding. Ping confirms that the server can respond to an ICMP ping request.
Use Ping diagnostically to:
• Ensure that a host computer you are trying to reach is actually operating or address is reachable or not
• Check how long it takes to get a response
• Get the IP Address from the domain name
• Check for the packet loss
The parameters used and their descriptions are:
IP Address/Host Name
Specify the IP Address (IPv4/IPv6) or fully qualified domain name to be pinged.
It determines network connection between device and host on the network. The output shows if the response was received, packets transmitted and received, packet loss if any and the round-trip time. If a host is not responding, ping displays 100% packet loss.
IP Family
Select the type of IP Family from the options available:
Available Options
IPv4 IPv6
Interface
Size
Select the Interface through which the ICMP echo requests are to be sent.
Specify the Ping packet size, in bytes.
Default - 32 bytes
Size Range – 1 to 65507
| System | 87
Figure 84: Ping
Traceroute
Traceroute is a useful tool to determine if a packet or communications stream is being stopped at the device, or is lost on the Internet by tracing the path taken by a packet from the source system to the destination system, over the
Internet.
Use Traceroute to:
• find any discrepancies in the network or the ISP network within milliseconds.
• trace the path taken by a packet from the source system to the destination system, over the Internet.
The parameters used and their descriptions are:
IP Address/Host Name
Specify the IP Address (IPv4/IPv6) or fully qualified domain name.
It determines network connection between device and host on the network. The output shows all the routers through which data packets pass on way to the destination system from the source system, maximum hops and
Total time taken by the packet to return measured in milliseconds.
IP Family
Select the type of IP Family from the options available:
Available Options
IPv4 IPv6
Interface
Select the Interface through which the requests are to be sent.
| System | 88
Figure 85: Traceroute
Name Lookup
Name Lookup is used to query the Domain Name Service for information about domain names and IP Addresses. It sends a domain name query packet to a configured domain name system (DNS) server. If a domain name is entered, one gets back an IP Address to which it corresponds, and if an IP Address is entered, then one gets back the domain name to which it corresponds. In other words, it reaches out over the Internet to do a DNS lookup from an authorized name server, and displays the information in the user understandable format. Also one can view all the available DNS
Servers configured in device by selecting option Lookup using all Configured Servers from DNS Server IP dropdown list. Selecting this option will also provide information about the time taken by each DNS sever to resolve the query. Based on the least time, one can prioritize the DNS server.
The parameters used and their descriptions are:
IP Address/Host Name
IP Address (IPv4/IPv6) or fully qualified domain name that needs to be resolved.
DNS Server IP
Select the DNS server to which the query is to be sent.
Figure 86: Name Lookup
Route Lookup
If you have routable networks and wish to search through which Interface, the device routes the traffic then lookup the route for the IP Address (IPv4/IPv6).
| System | 89
Figure 87: Route Lookup
Archives
Sophos -iView provides historical archived logs to provide historical view of network activities:
•
•
•
Archived Files
Use System > Archives > Archive Files page to view archived log files generated by Sophos -iView.
Archive logs are collection of historical records, which are the initial line of forensic investigation. Sophos -iView retains archive log data for the configured period. Data Retention period can be configured from the System >
Configuration > Data Management page. For further details refer to
Searchable Archived Files
This page allows you to load, index, unload and search archive logs for forensic investigation and compliance purpose.
Use System > Archives > Archive Search page to perform search in log files generated by Sophos -iView.
Load Archive Files
1. Select one or multiple network devices from the device drop down given at top left.
2. Select date range from the given calendar.
3. Click OK to save the selection.
4. Click Load to upload the archive file for the selected date in Sophos -iView database. This process may take some time depending on the size of data.
Note: The check box will be disabled once the file is uploaded to the Sophos-iView database.
Unload Archive Files
Click Unload to unload all the loaded files.
Note:
• Unload operation will unload all the loaded files. User will not have option to unload individual file.
• Please note that unloading file does not delete the data from the Sophos-iView.
Archive Backup
iView allows the Administrator to take backup of historical archived logs to improve usage of available storage space. The Administrator can download and restore the backup files as and when required. Use System > Archives >
Archive Backup to:
• Backup Archive Files
• Download Backup Files
• Restore Backup Files
Backup Archive Files
1. Select one or multiple network devices from the device drop down given at top left.
2. Select date range from the given calendar.
3. Click OK to save the selection.
4. Click Go to view archived files for selected date.
5. Select the Backup Frequency, either Never or Daily, to schedule automatic backup. If DailyProvide details of
FTP server.
6. Select check box against file(s) and click Backup Now to take backup of the files in iView machine.
7. Select Full Day Backup checkbox and click Backup Now to take full day back up at once.
Note:
• Super Admin or Admin privilege required to take backup of archived file.
• Unloading of the archived file is required to take backup.
• If the archived file is partially loaded, then backup of only unloaded data will be taken.
• Once the backup file is created, Administrator can download the backup file on any machine including
Cyberoam-iView machine itself.
Download Backup Files
1. Click Download Backup Files.
2. Click Download against the filename. The file will be downloaded on local machine from where iView Admin
Console is accessed.
Note:
• Super Admin or Admin privilege required to download backup of archive file.
• To help identity the backup of each device, Backup file is named as <Device ID_
YYYYMMDDStartHourEndHour> Where:
• Device ID - As configured in Cyberoam-iView
• YYYYMMDD - Date as displayed on Archive Files page under Date column
• Start Hour End Hour – Time as displayed on Archive Files page under File Details column
Restore Backup Files
1. Browse file to be restored. Click Add to restore multiple files.
2. Click Restore.
Note: Super Admin or Admin privilege required to restore backup files.
| System | 90
Figure 88: Archive Backup
| System | 91
تنزيل
تم تحديث الرابط العام
رابط عام للمستند
إعلان
