User manual SOPHOS REPORTING INTERFACE 1.0

[. . . ] Sophos Reporting Interface user guide This guide provides information on how to install and use: Sophos Reporting Interface Sophos Reporting Log Writer Product version: 1. 0 Document date: January 2011 Contents 1 About this guide. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2 What do I install?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3 What are the key steps?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 4 Check the requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 5 Check the version of Enterprise Console. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 6 Install Sophos Reporting Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 7 Configure Reporting Interface with Crystal Reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 8 Install Sophos Reporting Log Writer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 9 Configure Log Writer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 10 What information can be accessed?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 11 Reporting Interface data sources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 12 Log Writer data sources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 13 What happens if I upgrade Enterprise Console?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 14 Uninstall Sophos Reporting Interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 15 Uninstall Sophos Reporting Log Writer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 16 Technical support. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 17 Legal notices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 2 user guide 1 About this guide This guide describes Sophos tools that enable you to use third-party reporting and log-monitoring software to generate reports from threat and event data in Sophos Enterprise Console. It is intended for use by system administrators and database administrators. It is assumed that you are familiar with and already using Sophos Enterprise Console (SEC) version 4. 0 or later. Sophos documentation is published at http://www. sophos. com/support/docs/. 2 What do I install? You install Sophos Reporting Interface and (optionally) Sophos Reporting Log writer. Sophos Reporting Interface enables direct access to the Enterprise Console database and allows the use of third-party applications such as Crystal Reports to communicate with the SQL server directly. [. . . ] In the Sophos Reporting Log Writer Setup dialog box, click Next. A wizard guides you through installation. 6 user guide 4. When installation is complete, click Finish. If you have the Show configuration file check box selected, a window appears with the default configuration file, SophosLogWriterConfig. xml, highlighted. If you want to use the default configuration that is provided with Log Writer, continue to the next step and start the Log Writer service. For information on default configuration, see Default Log Writer configuration (page 7). To edit the Log Writer configuration file, see Configure Log Writer (page 7). To start the Log Writer service: a) Open Control Panel and double-click Administrative Tools. b) In Administrative Tools window, double-click on Services. The list of available services is displayed. c) Select Sophos Reporting Log Writer and click Start to start the service. Log Writer reads the configuration file when it is first started and requires a restart of the service for any configuration changes. 8. 3 Default Log Writer configuration The default configuration file contains two datafeeds. The first datafeed will write to a log file DefaultCommonEvents. log. It extracts common event data using the EventsCommonData data source. The second datafeed will write to a log file DefaultThreats. log. It extracts the threat event data using the ThreatEventData data source. The default log file will be in the 'Log Files' folder using the default data formatting files in the 'Configuration Files' folder located in the Log Writer installation folder. Data for the last 7 days will be extracted when the service is started with the default configuration. 9 Configure Log Writer The Configuration Files folder is located in the Log Writer's installation folder. Define custom datafeeds to extract information from the database. We recommend adding only one feed at a time as this helps in troubleshooting and reduces the load on the database. The datafeed definition is as follows: Note: Each datafeed must specify a single <tick> and <logFile> element. They specify the frequency to check the database for new data and the location to save data. The <applyLogFormat> element takes a value of either true or false and specifies whether to prefix each line with the date and time the line was written to the log file. [. . . ] Note: Letter of the alphabet listed beside each data source is used in the table below to represent its availability for the data field. EventsDeviceControlData 16 user guide E. EventsTamperProtectionData (SEC 4. 5 and above) G. ThreatInstances The data fields available for each of these data sources are listed in the table below. [. . . ]