27 10, 2010

Google Claim 6.4% of Internet traffic. Help us put this to the test

By | 2010-10-27T02:54:13+00:00 October 27th, 2010|How To, Uncategorized, Vantage, WebSpy, WebSpy News Update|0 Comments

According to recent report, Google has a record slice, 6.4%, of the world’s Internet traffic. An accurate figure? Well, we wanted to put this claim to the test and therefore started off by investigating the share of WebSpy’s traffic to Google sites. We also encourage our Vantage and Analyzer users to do the same thing [...]

19 07, 2010

Tips from TMG Expert: Changing WebSpy Vantage Scheduled Task Recurrence Interval

By | 2010-07-19T03:57:08+00:00 July 19th, 2010|How To, Microsoft ISA Server, Microsoft Threat Management Gateway, Uncategorized|0 Comments

Microsoft ISA Server and Forefront TMG users are probably familiar with isaserver.org’s informative news articles, tutorials, blogs and forums. I just wanted to bring your attention to one of isaserver.org’s contributing blog authors, Richard Hicks. Richard has been working with Forefront Threat Management Gateway (TMG) 2010 and its predecessors for more than 12 years. He [...]

19 07, 2010

Why there is so much anonymous traffic in Microsoft TMG and ISA logs

By | 2010-07-19T03:18:29+00:00 July 19th, 2010|Aliases, Firewall Analysis, How To, Log File Analysis, Microsoft ISA Server, Microsoft Threat Management Gateway, Reports, Tips and Best Practices, Uncategorized, Vantage, Web Browsing Analysis, WebSpy|5 Comments

One of the most common questions we get asked by users of Microsoft TMG and ISA is why there is so much traffic attributed to the Anonymous user. Even though unauthenticated access to the web has been disabled, they still see the ‘Anonymous’ user as one of the top users in their reports. So let’s [...]

12 07, 2010

Website Categorization – Assessing Productivity

By | 2010-07-12T07:46:02+00:00 July 12th, 2010|How To, Uncategorized|0 Comments

Security and Threat Management solutions, such as Microsoft Forefront TMG, IronPort and Blue Coat, use predefined URL categorization to simplify blocking and filtering management. Different security vendors have different ways of categorizing websites but it generally involves referring to a gigantic, regularly updated database of millions of websites sorted into 50-100 relevant categories. Majority of [...]

18 06, 2010

Video: How to use WebSpy Vantage to report on IronPort log files

By | 2010-06-18T02:01:16+00:00 June 18th, 2010|Aliases, Firewall Analysis, How To, IronPort, Log File Analysis, Reports, Scheduled Tasks, Tips and Best Practices, Uncategorized, Vantage, Web Browsing Analysis, Web Module, WebSpy|0 Comments

I’ve produced a video on how to use WebSpy Vantage to report on IronPort’s Web Security Appliance’s access log files. It is quite a detailed look at the key tasks involved in setting up and using WebSpy Vantage with IronPort WSA access logs, and is therefore divided into several parts. The videos take you through [...]

11 06, 2010

Accessing Microsoft Forefront TMG's Log Files (SQL Express)

By | 2010-06-11T06:54:59+00:00 June 11th, 2010|Firewall Analysis, How To, Loaders, Log File Analysis, Microsoft Threat Management Gateway, Uncategorized, Vantage, Web Browsing Analysis, WebSpy|1 Comment

If you need to analyze and report on Microsoft Forefront Threat Management Gateway log files, the most common stumbling block is enabling access to the default SQL Express databases that contains the firewall and web proxy log files. The log databases are stored in an SQL Express instance named MSFW. By default these databases cannot [...]

27 05, 2010

How to report on bandwidth utilization using Cisco devices

By | 2010-05-27T07:59:13+00:00 May 27th, 2010|Firewall Analysis, FlowMonitor, How To, Reports, System Administration, Tips and Best Practices, Uncategorized, Vantage, WebSpy|1 Comment

Today I was speaking to a customer that had the following reporting request. "I would like to know how much of my bandwidth is being eaten by each protocol. I will then use this information to determine if circuit may need to be increased due to increased traffic". This customer was collecting syslog messages from a Cisco Firewall, then using WebSpy Vantage to generate reports. There's a simpler method.