User manual SOPHOS SAFEGUARD PORTAUDITOR 3.20 USER HELP 3-2010

[. . . ] SafeGuard PortAuditor 3. 20 User help Document date: March 2010 SafeGuard® PortAudtior 3. 20, user help Important Notice This user help is delivered subject to the following conditions and restrictions: This user help contains proprietary information belonging to Sophos. Such information is supplied solely for the purpose of assisting explicitly and properly authorized SafeGuard PortAuditor users. No part of its contents may be used for any other purpose, disclosed to any person or firm or reproduced by any means, electronic or mechanical, without the express prior written permission of Sophos. The text and graphics are for the purpose of illustration and reference only. [. . . ] Upon scanning, the Auditor ignores such IP addresses and moves on to the next one in the range. 3. 5 Audit Filters After selecting the target computers you can further filter the auditing process to include or exclude specific ports, previously connected devices or specific device types/WiFi network types. This is does from the Audit Filters section, as described below. 3. 5. 1 Device Port SafeGuard PortAuditor supports scanning of the following endpoint ports: USB FireWire PCMCIA PCI Internal Storage - includes internal hard disks connected over IDE, SATA, SCSI etc. WiFi ­ includes all the networks to which the endpoint has connected (SSID, MAC of the Access Point and encryption/authentication schemes) By default when you open the application, USB, FireWire, PCMCIA and WiFi are selected to be audited. To include/exclude a port from the audit: Check/uncheck the port checkbox. Note: When using WMI for auditing it is not possible to distinguish between devices connected over PCMCIA and PCI. Important: WiFi auditing only includes networks that are/were connected through Windows standard WiFi support (WZC). Endpoints with non-Windows managed WiFi cards cannot be audited (i. e. It is also not possible to distinguish between WiFi networks that the computer is currently connected to and those to which it was connected in the past. For this reason the audit results display "n/a" in the "connected" field. 17 SafeGuard® PortAudtior 3. 20, user help 3. 5. 2 Additional Filters You can specify additional filters (device types, storage device types, WiFi networks) for your audit. To specify additional filters: Click More. . . . The More Filters window appears: 3. 5. 2. 1 Detect Connected Devices You can choose the audit report to include only devices connected to endpoints at the time of the scan, or devices previously connected as well. To include only the devices currently connected: In the Detect Connected Devices section, click the Detect currently connected devices only radio button. To include both currently connected and previously connected devices: In the Detect Connected Devices section, click the Detect both currently and previously connected devices radio button (this radio button is selected by default). Note: This definition does not filter WiFi networks, since it is not possible to distinguish between WiFi networks that the computer is currently connected to and those to which it was connected in the past. 18 SafeGuard® PortAuditor 3. 20, user help 3. 5. 2. 2 Device Types You can further limit the audit results to include only specific device types or WiFi networks. This is useful when you are only interested in specific device/network types (e. g. removable media), or not interested in a specific device type (e. g. Device types include: Devices (non-storage) Human Interface Device (keyboards, mice, joysticks etc. ) Printing Device PDA Windows Mobile / Pocket PC Device Blackberry Device Palm OS Device Mobile Phone Network Adapter Imaging Device 1 2 3 4 5 6 7 8 9 10 Audio/Video Device 11 Smart Card 12 Content Security Device (tokens and dongles aimed for software licensing etc. ) 13 Unclassified (to include devices which do not fall under any of the above categories) Storage Devices Removable Media (includes Disk On Keys and removable hard disks) CD/DVD Drive Floppy Drive Tape Drive Hard Disk (internally attached) WiFi Networks Network (infrastructure) Peer to Peer (ad hoc) 1 2 3 4 5 1 2 19 SafeGuard® PortAudtior 3. 20, user help To exclude a device type or a WiFi network type: Uncheck the checkbox for the devices/storage device/networks you wish to exclude, and click OK. If you have made any changes to the default selection (all selected) the message "Detect only selected device types" appears in Audit Filters section's More Filters field. 3. 6 Selecting Output Destination Before you perform the audit, you must set a folder in which the output data and the formatted results will be stored. You do this in the Output Options section. 3. 6. 1 Report Name Each time you perform a scan and create an audit report, SafeGuard PortAuditor also creates a folder in which to store all the report's files and data. The folder takes its name from the name you assign to the report. The results are saved in an HTML page called AuditRes. html which is found in the report folder. By default, the report (and folder) name is set to 'Report1'. [. . . ] Note: This feature requires Microsoft Excel 2003 to be installed on the same machine on which the report is generated. Note: It is important to allow the Excel creation process to fully complete and not to interfere with it. This process may take several seconds or minutes, depending on the number of records in your report. 25 SafeGuard® PortAudtior 3. 20, user help Once the process is complete, the Excel report opens: The tables in the Excel report are identical to those of the HTML view, although they are arranged in a different order. You may easily filter the data based on any of the available columns, using the button in the column heading in the header row (mark the header row to make the button appear). 3. 9 Exporting Audit Results SafeGuard PortAuditor enables you to export audit results to an XML file and store the file wherever you wish. [. . . ]