eTrust Content Inspection Management Tools - Audit Viewer

The Audit Viewer provides an activity log, displaying all audited events, and audited security collisions and crashes. This log provides the administrator with a permanent record of the activities in the security systems, which may be used in conjunction with the organization's management to control overall security in the organization.

Audit Viewer User Interface

The Audit Viewer user interface displays data regarding objects that were analyzed by the Gateway application, and were identified as events marked for auditing. All logged events are stored in the Audit Viewer database for later examination. In addition the Audit Viewer provides a security log, a history database and a log filtering facility.

Audit Viewer Information

Gateway Log Audit List The Gateway Log as illustrated above provides the following information about objects that were marked in the Policy Manager for logging (other objects will not appear here):

Gateway This field indicates the IP address of the gateway at which the object was analyzed and logged (194.90.79.108) Client This indicates the IP Address of the workstation that requested the object. (194.90.79.108) URL This field displays the full URL address of the object, including the host web site, path and filename that were logged. (http://194.90.79.97) Services/Status The Services/Status field indicates the downloadable service that caused the object to be audited, or rejected and audited (i.e. the service, which made the object not conform to the security plan). It also indicates whether the object was compressed, whether the object was disabled, and whether the object was signed or not. If the digital signature analysis failed, it lists on which step. (Signed, Issuer c..) Action The Action field indicates whether the object was passed (i.e. executed), or rejected (i.e. blocked at the gateway and therefore not executed), as well as audited (i.e. logged in the Audit Viewer database). (Rejected) Date and Time This field displays the date and time when the object was analyzed at the Gateway. (08/12/99 .. )

Security Log Audit List The Security Log as shown above provides the following information about connections made by any recognized operators to any of the eTrust Content Inspection components:

User This field identifies the operator connected to the corresponding eTrust Content Inspection component. (User-A) Terminal Type This is the eTrust Content Inspection component that was logged on to. (Gateway) Terminal Address This refers to the IP address of the workstation on which the eTrust Content Inspection component is installed. (194.90.79.108) Action This field indicates the current status of the corresponding eTrust Content Inspection component. (Logged on) Date and Time This field shows the date and time the connection to the component was made. (8/12/99 9:24:34)