cancel
Showing results for 
Search instead for 
Did you mean: 
McAfee Employee jebeling
McAfee Employee
Report Inappropriate Content
Message 1 of 9

How Do I Use and Log McAfee Client Proxy (MCP) Process Information with MWG and WGCS?

Jump to solution

A fantastic new feature was added to McAfee Client Proxy (MCP) 2.3.5 the industry's most robust centrally managed web redirection agent.  MCP now supplies calling process information to be used in filtering decisions and logging. Rules based on process name supplied by MCP can be used with MWG on premise, or in AWS, or in Azure, or in McAfee Web Gateway Cloud Service when policy is managed from MWG. All supported versions of on premise Content Security Reporter can be used for reporting by using a User - Defined field.

Having process information to assist with filtering decisions is an amazingly useful feature. Maybe you want to coach browser access to uncategorized sites but completely block other processes such as powershell from going to anything but fully trusted sites. Maybe you want to restrict any process other than a browser from going to any sites that aren't approved or fully trusted. Maybe you  want to adjust anti-malware filtering or bypass other filters for specific processes but still want to log and proxy the access. Perhaps you want to restrict a process claiming to be dropbox.exe to only connect to dropbox sites.

How do I set it up?

Capture.JPG

2 Solutions

Accepted Solutions
McAfee Employee jebeling
McAfee Employee
Report Inappropriate Content
Message 2 of 9

Re: How Do I Use and Log McAfee Client Proxy (MCP) Process Information with MWG and WGCS?

Jump to solution

Requirements:

McAfee Client Proxy 2.3.5 or later

McAfee Web Gateway 7.8.2 or later (the property is Client.ProcessName)

Content Security Reporter on premise (any supported version)

You need to log the process name and change your log header to include it

You need to set up process name as one of the user-defined fields on import. ( I used the 4th  )

Your queries have to be detailed queries (due to user-defined field use)

MWG process filtering ruleset (attached)

ePolicy Orchestrator dashboard example in reply to this reply

Some explanatory configuration screenshots below.


Capture3.JPGAccess Log Config

 

Capture2.JPGLog Handler

 Capture1.JPGCSR User-Defined Field

 

 

McAfee Employee jebeling
McAfee Employee
Report Inappropriate Content
Message 3 of 9

Re: How Do I Use and Log McAfee Client Proxy (MCP) Process Information with MWG and WGCS?

Jump to solution

Feedback, suggestions and improvements to this post welcome as always.

8 Replies
McAfee Employee jebeling
McAfee Employee
Report Inappropriate Content
Message 2 of 9

Re: How Do I Use and Log McAfee Client Proxy (MCP) Process Information with MWG and WGCS?

Jump to solution

Requirements:

McAfee Client Proxy 2.3.5 or later

McAfee Web Gateway 7.8.2 or later (the property is Client.ProcessName)

Content Security Reporter on premise (any supported version)

You need to log the process name and change your log header to include it

You need to set up process name as one of the user-defined fields on import. ( I used the 4th  )

Your queries have to be detailed queries (due to user-defined field use)

MWG process filtering ruleset (attached)

ePolicy Orchestrator dashboard example in reply to this reply

Some explanatory configuration screenshots below.


Capture3.JPGAccess Log Config

 

Capture2.JPGLog Handler

 Capture1.JPGCSR User-Defined Field

 

 

McAfee Employee jebeling
McAfee Employee
Report Inappropriate Content
Message 3 of 9

Re: How Do I Use and Log McAfee Client Proxy (MCP) Process Information with MWG and WGCS?

Jump to solution

Feedback, suggestions and improvements to this post welcome as always.

Re: How Do I Use and Log McAfee Client Proxy (MCP) Process Information with MWG and WGCS?

Jump to solution

Hello,

Does this work with a log source of McAfee SaaS Web Protection Service? I have followed your guide and this works great with a web gateway and CSR Log source of McAfee Web Gateway 7.x but nothing is populated in User-Defined 1 when using the WGCS log source. 

Can you confirm it works with MGCS and that custom fields in Access.log log handler are used in WGCS.

McAfee Employee jebeling
McAfee Employee
Report Inappropriate Content
Message 5 of 9

Re: How Do I Use and Log McAfee Client Proxy (MCP) Process Information with MWG and WGCS?

Jump to solution

It will not work with automated log pull from WGCS with any CSR version up to and including current 2.6. The reason is the process name information is not currently part of the standard CSR schema. That's also why you need to use User-Defined field with MWG. CSR 2.6 also pulls version 4 from the WGCS API and process name is only available in version 5 and later logs. So you could write a script to download version 5 and put the downloaded file in a repository that CSR can pull from and then define a user defined field for the import in the file based log source.

Link to example powershell script you could run on CSR or other Windows

https://community.mcafee.com/t5/Documents/Web-Gateway-Cloud-Service-Cloud-Log-Puller-for-Windows/ta-...

Link to example bash script you could run on MWG or other Linux:

https://community.mcafee.com/t5/Web-Gateway/Example-Bash-Script-for-Log-Pull-from-Web-Gateway-Cloud-...

Re: How Do I Use and Log McAfee Client Proxy (MCP) Process Information with MWG and WGCS?

Jump to solution

Thanks! Invaluable information!

Do we know if a future version of CSR will support WGCS Reporting API v5?

Highlighted

Re: How Do I Use and Log McAfee Client Proxy (MCP) Process Information with MWG and WGCS?

Jump to solution

I tried to find the property in our configuration 7.7.2.19 but I don't find it?

 

 

Re: How Do I Use and Log McAfee Client Proxy (MCP) Process Information with MWG and WGCS?

Jump to solution

I think you made a mistake. In your example xml file the version is 7.8.2... so I expect this property was new in 7.8.2 instead of 7.7.2

McAfee Employee jebeling
McAfee Employee
Report Inappropriate Content
Message 9 of 9

Re: How Do I Use and Log McAfee Client Proxy (MCP) Process Information with MWG and WGCS?

Jump to solution

Thanks, I believe you are correct. I couldn't find the appropriate reference guides or anything in the release notes so I edited above to reflect 7.8.2 because I know its there for sure. I will do some more investigation and if its available in an earlier release, I will update again.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community