Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Cisco ScanCenter Administrator Guide, Release 5.2

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco ScanCenter Administrator Guide, Release 5.2

Chapter Title

Overview

Results

Updated:
April 11, 2019

Chapter: Overview

Overview

Dashboard

The dashboard gives you an overview of web activity at your organization over the last 24 hours.

Click the Dashboard tab to display the following data:

  • All blocks
  • Bandwidth usage
  • Facebook usage
  • Spyware blocks
  • Web Filtering blocks
  • Web Virus blocks

  • AMP blocks

The following data is displayed:

  • All blocks
  • Top 10 users by blocks

Use the drop-down menu to select one of the following options to filter the results:

  • Facebook usage
  • Spyware blocks
  • Web Filtering blocks
  • Web Virus blocks

  • AMP blocks

Select Bandwidth Usage to display data for:

  • Total bandwidth used
  • Bandwidth used by IP

Select Facebook Usage to display data for:

  • Facebook hits over time
  • Facebook bandwidth consumed over time
  • Users making the most hits
  • Top applications by hits
  • Activity by hits
  • Users consuming the most bandwidth

Select AMP Blocks to display data for:

  • AMP blocks over the last two weeks
  • Top SHA256s blocked by AMP over the last two weeks—Click on a bar in the bar graph to display the traffic for that SHA256

  • Number of files sandboxed over the last two weeks

    • Sandboxing is recommended to monitor suspicious files found by AMP. With sandboxing enabled, potentially malicious files are analyzed in a virtual environment to determine if they contain malicious code. Sandboxing can be enabled by navigating to Web Filtering > Management > Global Settings

    • Click on a bar in the bar graph to display the Sandbox Analysis page

      • Select Pending status to display data for files either waiting to be or currently being inspected in a sandbox

      • Select Completed status to display data for files that have been inspected in a sandbox

      • Specify time zone, time period, or date range

      • Submission time—When the file was submitted to the sandboxing service

      • Completion time—When the sandboxing run was completed

      • SHA256—SHA256 hash of the file being examined

      • Disposition—Indicates whether the file was found to be clean or malicious

      • Traffic Reports—Hyperlink to a report of every transaction with a Content SHA256 matching the SHA256 of this file

      • Sandbox Reports—Hyperlink to a report produced by the sandboxing service with details from the analysis of the file execution. See Sandboxing

Next Generation Dashboard and Reporting

The next generation Cisco ScanCenter introduces a refreshed user interface featuring an enhanced dashboard and reporting portal.

Portal 2.0 is implemented in phases so that you can continue using Portal 1.0 and components of Portal 2.0 when they are made available.

Currently, these capabilities are not yet available in the dashboard and reporting components of Portal 2.0:

  • Composite report

  • Scheduled report

  • User activity report

  • AMP dashboard

For information on accessing and using the next generation portal, see Portal 2.0.

Getting Started with Reports

The reporting functionality in Cisco ScanCenter is accessed from the Reports tab. Reports enable you to analyze:

  • Applications
  • Bandwidth
  • Blocks
  • Browse Time
  • Browsers
  • Categories
  • Facebook
  • Groups
  • Hosts
  • Legal Liability
  • Malware
  • Security
  • Users

There are three generic types of report

  • Standard reports use conditions, and up to two attributes to provide more detailed information for a chosen time period.
  • Time Analysis reports provide similar information to standard reports but for a single attribute over a chosen time period.
  • Detailed reports use conditions and multiple attributes to provide a higher level of detail than standard reports for a chosen time period.

There are also two special report types:

  • Allowed Traffic
  • User Audit Reports

In addition to these reports there are other reports that can be accessed from the Admin tab. For further information, see Audits.

Reports are generated by running searches. Cisco provides an extensive range of pre-defined searches. See Pre-Defined Searches. You can use these as the starting point for creating your own searches, or you can create searches from scratch.

The main steps to create any type of report are the same:

Procedure

Step 1

Choose a time period for the search, from the last hour to the last year.

Step 2

Choose a pre-defined search or saved search, or create a new search.

Step 3

Add filters based on reporting attributes or metrics.

Step 4

Choose the number of results to view, from 10 to 1000.

Step 5

Choose a reporting attribute by which to group the results.

Step 6

Choose to sort the results by name, bandwidth, browse time, bytes sent, bytes received, or hits.

Step 7

Choose to view the top or bottom results.

Step 8

(Optional) Add a second reporting attribute by which to group the results.

Step 9

Choose to view the report as a grid, bar, column, pie or line chart.

Step 10

Click Launch search.

Step 11

Store the search for future use.

What to do next

There are more than 60 unique attributes to choose from, so it is best to start by using pre-defined searches.

In addition to creating and modifying searches, from the Reports pane you can:

  • Create and manage sets of filters.
  • Combine searches into composite reports.
  • View reports online and print or export them.
  • Download reports to view offline or import into a spreadsheet or word processor.
  • Schedule reports for delivery by email to groups of recipients.

Note
The reporting functionality requires Adobe Flash 10 (or higher).

Calculating Browse Time

Because it not possible to tell when a user is away from their computer, or viewing a page that has finished loading, browse time is calculated based on web requests made within a distinct minute.

Any distinct minute in which one or more web requests are made is counted as a single minute of browse time. For example, if a complex web page results in 100 web requests made within a distinct minute, it will count as one minute of browse time.

The actual time taken for a web page to load is not measured. If a web page takes one and a half minutes to load, then web requests will be made across two distinct minutes measured as two minutes of browse time. However, if a user spends an hour reading a simple web page that loaded within a distinct minute that does not refresh itself, this is measured as one minute of browse time

When you create a reports including browse time, you should always use Host instead of URL to generate the most accurate report.


Note
Browse Time should not be relied on as a metric in two-level reports because this can result in the double counting of requests. For example, if a site is classified in more than one category, or if different Web requests are made in the same minute. It is not possible to determine if a web page refreshed itself.

Truncating Large Reports

Occasionally you may enter search criteria that would produce a report that is so large that it cannot be processed. When this happens, Cisco Cloud Web Security modifies the results returned to enable the report to run. If the report is part of a scheduled report, this will be highlighted in the accompanying email. When viewing reports online, the relevant error message is displayed.


Note
The original search is not modified. Reducing the time period may enable the search to run.

When a report of one or two levels, or a time analysis report, with the URL attribute is too large to run, the report will be modified:

  • Where one of the attributes is URL, it is replaced with the Host attribute.
  • Where the attributes are URL and Host, the result returned will be for a one-level report with Host as the attribute.
  • Where the report is so large that even these measures will not allow the report to run, the report will not be run.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Cisco Community Discussions

About Us
Contact Us
Work with Us