Best Practice: Configuring Content Security Reporter log source for McAfee Web Gateway

Version 1

     

    Introduction

     

    This document contains the steps needed to set up a McAfee Web Gateway log source in Content Security Reporter that will accept log files that are being pushed from Web Gateway.

    Alternatively, it is possible to have Content Security Reporter collect logs from McAfee Web Gateway using the steps provided in

    https://kc.mcafee.com/corporate/index?page=content&id=KB77478.

     

    Configuring McAfee Web Gateway

     

    For information on configuring McAfee Web Gateway to push logs to Content Security Reporter, see the section Configuring the McAfee Web Gateway in the document

    Best Practice: Configuring McAfee Web Reporter log source for McAfee Web Gateway.

     

    Configuring Content Security Reporter

     

    To configure a McAfee Web Gateway log source in Content Security Reporter that will accept log files that are being pushed from Web Gateway:

     

    1. Log in to ePO and go the Report Server Settings menu.
    2. Click on Log Sources, then Actions, and select New.
    3. The Mode should be "Accept incoming log files" with the type set to "FTP / HTTP(S)".  For the Log format, select "McAfee Web Gateway (Webwasher) - Auto Discover".
    4. Enter a name for the log source that does not contain spaces.
    5. Enter a username and password in the Logon name and Password fields that will be used by McAfee Web Gateway to access this log source when pushing logs.

    CsrLogSourceConfig.PNG

       6. (Optional) Configure any other desired options for the log source under the User-Defined Columns, Processing, and Post-Processing tabs.

       7. Click OK in the bottom-right corner to save the log source.

     

    Validating Log Source Configuration

     

    If everything was configured properly and a log file push was triggered on Web Gateway, there should be log file jobs displayed in Content Security Reporter.

    Log file jobs can be found under Report Server Settings by expanding Log Sources and then selecting Job Queue.

     

    Here is an example of successful log jobs as they are displayed in the user interface:

    CsrLogJobs.PNG

     

    Common Issues and Troubleshooting

     

    For information on troubleshooting issues that may result from configuring McAfee Web Gateway to push logs to Content Security, please see Common issues and Troubleshooting in the document

    Best Practice: Configuring McAfee Web Reporter log source for McAfee Web Gateway.  The process of pushing logs is the same in the case of Web Reporter as it is for Content Security Reporter, so the same troubleshooting applies.