[KB7969] Log all activity blocked by Web control rules in ESET PROTECT (8.x – 9.x)

Issue

Solution

I. Create a new Web control rule

If you have already created a Web control rule and want to create a Dashboard report, first make sure to change each rule's Logging severity to Warning (see step 7 below) and then skip to part II.

  1. Open the ESET PROTECT Web Console in your web browser and log in.

  2. Click Policies, select the desired Built-in policy and then select the policy that you want to modify.

  3. Click Actions Edit.

    Figure 1-1
    Click the image to view larger in new window 
  4. Click SettingsWeb and EmailWeb control.

  5. Click the slider bar next to Enable Web control. Next to Rules, click Edit.

    Figure 1-2
    Click the image to view larger in new window 
  6. Click Add (or select an existing rule and then click Edit to change the Logging severity).

    Figure 1-3
    Click the image to view larger in new window  
  7. Type the name of the rule and select the appropriate settings for the rule (Type, Access rights). Type the URLs you want the rule to apply to.

  8. In the Logging severity drop-down menu, select Warning and click OK.

    Figure 1-4
    Click the image to view larger in new window  
  9. Click Save.

    Figure 1-5
    Click the image to view larger in new window  
  10. Click Finish.

    Figure 1-6
    Click the image to view larger in new window 
  11. An error message appears anytime a client attempts to visit a URL blocked by Web control. Continue to Part II.

    Figure 1-7
    Click the image to view larger in new window 
You can create new Web control rules including category names, URL groups, and blocked webpage message/graphic. 

II. Create a new Web control logs report template in ESET PROTECT

  1. Open the ESET PROTECT Web Console in your web browser and log in.

  2. Click Reports → New Report Template.

    Figure 2-1
    Click the image to view larger in new window 
  3. In the Name field, type a name for your report. Under Category, click No category selected.

    Figure 2-2
    Click the image to view larger in new window 
  4. Select the check box next to the Computers and click OK.

    Figure 2-3
    Click the image to view larger in new window 
  5. Click Chart. Select the check box under Display Table.

    Figure 2-4
    Click the image to view larger in new window 
  6. Click Data → Add Column.

    Figure 2-5
    Click the image to view larger in new window 
  7. Expand the ComputerComputer category, select Computer name and click OK.

    Figure 2-6
    Click the image to view larger in new window
  8. Click Add Column. Expand Web controlAction performed, select Action performed, and click OK.

    Figure 2-7
    Click the image to view larger in new window

     

  9. Click Add Column. Expand Web controlCategory, select Category, and click OK.

  10. Click Add Column. Expand Web controlMatching URL, select Matching URL, and click OK.

  11. Click Add Column. Expand Web controlTime of occurrence, select Time of occurrence, and click OK.

  12. Click Add Column. Expand Web controlUser, select User, and click OK. Then click Finish.

Figure 2-8
Click the image to view larger in new window 

III. Add new Web control logs Dashboard report

  1. Open the ESET PROTECT Web Console in your web browser and log in.

  2. Click Dashboard and then click the plus icon to add a new dashboard.

    Figure 3-1
    Click the image to view larger in new window 
  3. Type a name for your new dashboard and click Add Dashboard.

    Figure 3-2
    Click the image to view larger in new window 
  4. Click the plus icon.

    Figure 3-3
    Click the image to view larger in new window 
  5. Select the report you created in Part II (in this example, Web Control Logs), and click OK.

    Figure 3-4
    Click the image to view larger in new window 
  6. Your dashboard is now available. When a URL is blocked by Web control, each URL is listed in the new Dashboard report.

    Figure 3-5
    Click the image to view larger in new window