E Sec 2013 Report Pack
E Sec 2013 Report Pack
The information and content in this document is provided for informational purposes only and is
provided "as is" with no warranty of any kind, either express or implied, including but not limited to
the implied warranties of merchantability, fitness for a particular purpose, and non-infringement.
GFI Software is not liable for any damages, including any consequential damages, of any kind that
may result from the use of this document. The information is obtained from publicly available
sources. Though reasonable effort has been made to ensure the accuracy of the data provided, GFI
makes no claim, promise or guarantee about the completeness, accuracy, frequency or adequacy
of information and is not responsible for misprints, out-of-date information, or errors. GFI makes
no warranty, express or implied, and assumes no legal liability or responsibility for the accuracy or
completeness of any information contained in this document.
If you believe there are any factual errors in this document, please contact us and we will review
your concerns as soon as practical.
All product and company names herein may be trademarks of their respective owners.
GFI EndPointSecurity is copyright of GFI SOFTWARE Ltd. - 1999-2013GFI Software Ltd. All rights
reserved.
Document Version: 1.1.1
Last updated (month/day/year): 1/28/2014
Contents
1 Introduction 5
1.1 About GFI ReportCenter 5
1.2 About the GFI EndPointSecurity GFI ReportPack 6
1.3 Components of the GFI EndPointSecurity GFI ReportPack 6
1.3.1 GFI Report Center Framework 7
1.3.2 GFI EndPointSecurity default reports 8
1.3.3 Report scheduling service 8
1.4 Key Features 8
1.4.1 Centralized reporting 8
1.4.2 Wizard assisted configuration 9
1.4.3 Report scheduling 9
1.4.4 Distribution of reports via email 9
1.4.5 Report export to various formats 9
1.4.6 Default reports 9
1.4.7 Report customization 9
1.4.8 Favorites 9
1.4.9 Printing 9
2 Installation 10
2.1 System Requirements 10
2.2 Installation procedure 10
2.3 Selecting a Product 13
2.4 Launching the GFI EndPointSecurityreports for GFI ReportCenter 14
4 Custom Reports 21
4.1 Creating a new custom report 21
4.2 Configuring Data Filter Conditions 22
4.2.1 Example: Using multiple filters 24
4.2.2 Example: Creating a custom report based on data collected during a particular
month 24
4.3 Run a custom report 27
4.4 Editing a Custom Report 27
4.5 Deleting a custom report 27
4.6 Adding custom reports to the list of favorite reports 28
5 Scheduling Reports 29
5.1 Scheduling a report 29
5.2 Configuring Advanced Settings 31
5.2.1 Report Export Formats 32
5.2.2 Configuring report export to file options 32
5.2.3 Configuring report emailing options 33
5.3 Viewing a list of Scheduled Reports 35
5.4 Viewing the Scheduled Reports activity 36
5.5 Enable or disable a scheduled report 37
5.6 Editing a Scheduled Report 37
5.7 Deleting a Scheduled Report 38
5.8 Example Scheduling a Report 38
8 General Options 47
8.1 Entering your license key after installation 47
8.2 Viewing product Report Pack version details 48
8.3 Checking the web for newer builds 48
10 Glossary 53
11 Index 57
1 Introduction
GFI EndPointSecurity includes a reporting feature which enables you to generate text and graphical
reports based on information obtained from security scans. This chapter provides you with an
overview of the available reports as well as how to create your own reports for a tailored solution.
Topics in this chapter
GFI ReportCenter is a centralized reporting framework that allows you to generate various reports
using data collected by different GFI products. GFI releases specialized reports for each of its
products, referred to as a GFI ReportPack; for example, the GFI EndPointSecurityGFI ReportPack. A
GFI ReportPack can be downloaded as an add-on to the GFI product.
A GFI ReportPack plugs into the GFI ReportCenter framework; allowing you to generate, analyze,
export and print the information generated through these reports.
Navigation Use this pane to access the navigation buttons/configuration options provided with GFI ReportCenter.
Pane
Product Use this drop-down list to select the GFI product for which to generate reports. The Product Selection
Selection drop-down list displays all the products for which you have installed a GFI ReportPack.
drop-down
list
Favorite Use this navigation button to access your favorite/most used reports. For more information on how to add
Reports reports to this list refer to the ‘Adding default reports to the list of favorite reports’ and ‘Adding custom
reports to the list of favorite reports’ sections in this manual.
Default Use this navigation button to access the default list of reports which can be generated for the selected
Reports product. For more information on default reports refer to the ‘GFI EndPointSecurity default reports’ sec-
tion in this manual.
Custom Use this navigation button to access the list of customized reports which can be generated for the selec-
Reports ted product. For more information on how to create custom reports refer to the ‘Getting Started: Enter-
taining custom reports’ section in this manual.
Note
The GFI EndPointSecurity GFI ReportPack only allows you to generate reports for data
contained in the SQL Server database backend of GFI EndPointSecurity.
2. If the current version of GFI ReportCenter framework is not compatible with the GFI EndPointSe-
curity GFI ReportPack, you will be prompted to download and install an updated version. Select
Download and install the GFI ReportCenter… and click Next.
3. Choose whether you want the installation wizard to search for a newer build of the GFI
EndPointSecurity GFI ReportPack on the GFI website and click Next.
4. In the license dialog, read the licensing agreement carefully. Select the I accept the Licensing
agreement option and click Next.
5. Specify the details of the SQL Server that is hosting your GFI EndPointSecurity database backend,
and click Next.
6. Specify the default email settings that will be used for report distribution and click Next.
7. Specify the product installation path or click Next to install GFI Report Pack in the default path.
The installation will need approximately 100 MB of free disk space.
8. The installation wizard is now ready to copy the required files and finalize the installation. Click
Next.
For example, to run the reports provided in the GFI EndPointSecurity GFI ReportPack:
1. Launch GFI ReportCenter from Start > Program Files > GFI ReportCenter.
2. Select GFI EndPointSecurity GFI ReportPack from the Product Selection drop down list.
Note
Select the All Products option to display and navigate all the GFI ReportPackthat are
currently installed in GFI ReportCenter.
Note
Click a report node to view a description and a sample output of what the selected
report will contain.
2. Right-click on the report that you wish to generate, select Generate report and specify which
device activity data will be represented in the report.
Note:
Default reports can be based on the device activity data collected today, yesterday,
during the last 7 days or over the last 30 days. Further to this, you can also base your
reports on data collected during a particular day, month or date/time period.
3. Select Day option and expand the provided drop down. This will launch the date selection cal-
endar.
4. Navigate to the required month (For Example. September) and select the required day (i.e. 15).
5. Click Finish to generate the report.
Example 3: Generating a “Device usage summary” report based on data collected over a
specific date/time period.
This example demonstrates how to generate a Device usage summary report based on the data
collected by GFI EndPointSecurity between August 18, 2009 and September 1, 2009.
1. Click on the Default Reports navigation button to launch the list of available reports.
2. Right-click on Device usage summary and select Generate report > For Custom Date.
Note:
Date and time format are based on the regional settings configured on your computer.
Screenshot 8: Generated reports are displayed in the right pane of the management console
Generated reports are shown in the right pane of the GFI ReportCenter. Use the toolbar at the top of
the report pane to access common report related functions:
Print report.
You can group and access frequently used reports through the Favorite Reports navigation button. To
add a default report to the list of favorite reports:
1. Click on the Default Reports navigation button to launch the list of available reports.
2. Right-click on the default report that you wish to add to favorites and select Add to favorites list.
3. Select the data source that will be used to generate the custom report.
4. Configure the data filter conditions that will be applied against the selected data source. Click on
Next to continue.
Note
For more information on how to configure filter conditions, refer to the section
Configuring data filter conditions in this manual.
5. Specify a name and description for the customized report. Click on Next to continue.
6. Click on Finish to finalize your configuration settings.
Click Add… to launch the Edit filter properties dialog. Configurable options in this dialog include:
Filter condition – This is the data source area on which the filter will focus (for example, select
Computer Name to filter the device activity data that is related to a particular computer).
Logical relation – The condition comparison parameter.
Value – The string to which source data will be compared.
For example to generate a report which contains only information related to a workstation called
“WinXp01”, configure your filter parameters as shown below:
The data which will be included in this custom report will vary according to how these filters will be
applied against your data. This is defined through the ‘Filter property condition…’ drop-down.
4.2.2 Example: Creating a custom report based on data collected during a particular month
This example demonstrates how to generate a device usage summary report called Device Usage on
September 2009. This report will be based on the device usage activity:
6. Click on the Add… button and configure the parameters of filter 1 as follows:
Filter condition : Computer Name
Condition : Equal to
Value : WinXp01
7. Click OK to finalize your filter configuration settings.
8. Click again on the Add… button and configure the parameters of filter 2 as follows:
Filter condition : User Name
Condition : Equal to
Value : Bob Jones
Filter Property condition… : and
9. Click OK to finalize your filter configuration settings.
10. Click Next and specify the following parameters:
Report Name : Device usage on September 2009
Report Title : Device usage by Bob Jones on computer WinXp01
2. Right-click on the custom report that you wish to modify and select Edit. This will launch the Cus-
tom Reports Wizard through which you can make the required changes.
Note
For more information on how to configure the parameters of a custom report refer to
the Creating a custom report section in this chapter.
You can group and access frequently used reports through the Favorite Reports navigation button. To
add a custom report to the list of favorite reports:
1. Click on the Custom Reports navigation button to launch the list of available reports.
2. Right-click on the custom report that you wish to add to favorites and select Add to Favorites
List.
Note
For information on how to configure export-to-file settings refer to Configuring report
export to file options section in this chapter.
6. To automatically distribute generated reports via email, select the Send by mail option. To cus-
tomize the email settings used for report distribution click on the Settings button underneath this
option.
Note
For information on how to configure email settings refer to the Configuring report
emailing options in this chapter.
7. Specify a name and description for this scheduled report. Click on Next to continue.
8. Click on Finish to finalize your settings.
Format Description
Adobe Use this format to allow distribution of a report on different systems such as Macintosh and Linux while pre-
Acrobat serving the layout.
(.PDF)
MS Excel Use this format if you want to further process the report and perform more advance calculations using
(.XLS) another (external) program such as Microsoft Excel.
MS Word Use this format if you want to access this report using Microsoft Word.
(.DOC)
Rich text Use this format to save the report in a format that is small in size and which allows accessibility through dif-
format ferent word processors in different operating systems.
(.RTF)
HTML Use this format to save the report in a platform independent format which can be viewed through a web
(.HTM) browser. For example, you can include reports exported in html format directly on your website or
intranet.
2. Select the Override the default folder options for this report.
3. Specify the complete path where the exported report will be saved.
4. Specify the file format in which the exported report will be saved.
5. Click OK to finalize your configuration settings.
Note:
For information on how to configure the default export to file settings refer to the
Configuring default scheduling options section in this manual.
1. From the ‘Advanced Settings’ dialog, click on the Settings button underneath the ‘Send by email’
option.
Click on the Scheduled Reports navigation button to show the list of scheduled reports which are
currently configured for automatic generation. This information is displayed in the right pane of the
management console and includes the following details:
Schedule Name: The custom name that was specified during the creation of the new scheduled
report.
Report Name: The names of the default or custom report(s) that will be generate.
Last Generated: Indicates the date/time when the report was last generated.
Next Sent: Indicate the date/time when the report is to be next generated.
Description: The description that you have entered for each schedule.
GFI ReportCenter also includes a schedule activity monitor through which you can view events related
to all scheduled reports that have been executed.
To open the schedule activity monitor, click on the Scheduled Reports navigation button and select
the Scheduled Reports Activity node. This will launch the activity information in the right pane of the
GFI ReportCenter management console .
The activity monitor displays the following events:
Note:
The scheduled report was successfully executed and sent by email and/or saved to disk.
Warning:
The scheduled report was not executed because product license is invalid or has
expired.
Note:
The description is often the most useful piece of information, indicating what happened
during the execution of a scheduled report or the significance of the event.
To enable or disable a scheduled report, right-click on the respective report and select
Enable/Disable accordingly.
3. Click Next and perform the required changes. For information on how to configure the para-
meters of a scheduled report refer to the Creating a scheduled report section in this chapter.
4. Select the option Relative and from the provided drop down list select Today. Click on Next to
proceed to the next dialog.
5. Since no data filters will be applied in this example, click Next to proceed to the next dialog.
6. To generate this report on daily basis, select the option Generate this report every: and set the
interval to 1 Day.
7. Set the start date to 09/16/2009 and time to 12:00:00 AM. Click Next to proceed to the next
dialog.
12. From Advanced Settings dialog, click Settings button under Send by email option.
13. Select Override the default email options for this report:
14. Specify the following parameters:
To : [email protected]
From : [email protected]
Server : Win2k3serv
14. From the report format drop down select PDF and click OK to finalize your email settings.
15. Click Next and specify the following parameters:
Report Name : Daily device usage report
Report Title : Daily device usage report
Report Description: This report is generated on a daily basis at 12:00 AM. It shows all device
usage activity recorded throughout the day.
16. Click Next to proceed to the final dialog.
17. Click Finish to finalize your custom report configuration settings.
Through the Options navigation button you can configure the following parameters:
Database source: Use this node to specify the database backend from where the GFI ReportPack
will extract the required reporting data.
Default scheduling settings: Use this node to configure the default export to file parameters and
report emailing parameters of scheduled reports.
3. Select the database type (For example. MS SQL Server) from the provided list of supported data-
bases.
Note:
GFI EndPointSecurity database backend supports only MSDE/MS SQL Server.
4. Specify the name or IP address of your MSDE/MS SQL Server database backend.
5. To use the credentials of an SQL Server account, select Use SQL Server authentication option
and specify the user name and password in the provided fields.
Note:
By default, the GFI EndPointSecurity GFI ReportPack uses Windows logon credentials to
authenticate to the SQL Server.
Click Database Source to view in the right pane window the current database source settings.
2. From the pull-down menu, click on the Tools > Default Scheduling Options.
3. Configure the required parameter as described in the Configuring Advanced Settings section of
the Scheduling Reports topic.
Note:
Entering the License Key should not be confused with the process of registering your
company details on our website. This is important since it allows us to give you support
and notify you of important product news. You may register and obtain your GFI
customer account from: http://www.gfi.com/pages/regfrm.htm
1. Select the respective product (e.g. GFI EndPointSecurity) from the Product Selection drop down
list.
2. Click on the Options navigation button.
3. Right-click on the Licensing node and select Set Licensing…. This will launch the Licensing dia-
log.
Note:
You can configure GFI EndPointSecurity GFI ReportPack to check for newer builds on
startup.
9.6 Troubleshooting 51
9.7 Knowlegebase 52
9.6 Troubleshooting
The troubleshooting chapter explains how you should go about resolving any software issues that you
might encounter. The main sources of information available to users are:
The manual – most issues can be solved by reading this manual.
GFI Knowledge Base articles
Web forum
Contacting GFI Technical Support
Note:
Before you contact our Technical Support team, please have your Customer ID
available. Your Customer ID is the online account number that is assigned to you when
you first register your license keys in our Customer Area at: http://customers.gfi.com.
We will answer your query within 24 hours or less, depending on your time zone.
A
Access permissions
A set of permissions (access, read and write) that are assigned to users and groups per device
category, connectivity port or a specific device.
Active Directory
A technology that provides a variety of network services, including LDAP-like directory ser-
vices.
Alert recipient
A GFI EndPointSecurity profile account to hold the contact details of users intended to
receive e-mail alerts, network messages and SMS messages.
Alerts
A set of notifications (e-mail alerts, network messages or SMS messages) that are sent to alert
recipients when particular events are generated.
Automatic discovery
A GFI EndPointSecurity feature to search and discover computers that were newly connected
to the network at configured scheduled times.
B
BitLocker To Go
A Microsoft Windows 7 feature to protect and encrypt data on removable devices.
C
Connectivity port
An interface between computers and devices.
Device blacklist
A list of specific devices whose usage is blocked when accessed from all the target computers
covered by the protection policy.
Device category
A group of peripherals organized in a category.
Device scan
A GFI EndPointSecurity feature to search for all devices that are or have been connected to
the scanned target computers.
Device whitelist
A list of specific devices whose usage is allowed when accessed from all the target computers
covered by the protection policy.
Digest report
A summary report giving an account of the activity statistics as detected by GFI EndPointSe-
curity.
E
Event logging
A feature to record events related to attempts made to access devices and connection ports
on target computers and service operations.
F
File-type filters
A set of restrictions that are assigned to users and groups per file-type. Filtering is based on
file extension checks and real file type signature checks.
G
GFI EndPointSecurity agent
A client-side service responsible for the implementation/enforcement of the protection
policies on the target computer(s).
Global permissions
A Create Protection Policy wizard step that prompts the user to either block or else to allow
access to all devices falling in a category or which are connected to a port of the target com-
puters covered by the protection policy.
GPO
See Group Policy Objects.
H
Human Interface Devices
A specification that is part of the universal serial bus (USB) standard for a class of peripheral
devices. These devices, such as a mice, keyboards, and joysticks, enable users to input data
or to interact directly with the computer.
M
MSI file
A file generated by GFI EndPointSecurity for later deployment using GPO or other deployment
options. It can be generated for any protection policy and contains all the relevant configured
security settings, including installation settings for unprotected target computers.
P
Power user
A power users is automatically given full access to devices connected to any target computer
covered by the protection policy.
Q
Quick Start wizard
A wizard to guide you in the configuration of GFI EndPointSecurity with custom settings. It is
launched upon the initial launch of GFI EndPointSecurity management console and is intended
for first time use.
S
Security encryption
A set of restrictions configured to either block or else to allow users/groups to access specific
file-types stored on devices that are encrypted with BitLocker To Go. These restrictions are
applied when the encrypted devices are connected to the target computers covered by the
protection policy.
T
Target computer
A computer that is protected by a GFI EndPointSecurity protection policy.
Temporary access
A period of time during which users are allowed to access devices and connection ports (when
such access is normally blocked) on protected target computers, for a specified duration and
time window.
U
User message
A message that is displayed by GFI EndPointSecurity agents on target computers, when
devices are accessed.
B
Build notifications 52
D
database backend 10, 12, 15, 43-44
G
GFI EndPointSecurity
agent
application
management console
Temporary Access tool
version 5-10, 13-16, 31, 43-
44, 47, 49-51
Glossary 53
K
Knowledge Base 51-52
L
licensing 12
T
Technical Support 51-52
Troubleshooting 51
V
versions 47
W
wizard
Create Protection Policy wizard