SonicWALL Analytics Quick start guide

Brand: SonicWALL

Model: Analytics

Type: Quick start guide

SonicWall

On-Premises

Analytics

Getting Started Guide

SonicWall CSC Getting Started

Contents

About On-Premises Analytics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Browser Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

MySonicWall Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Firewall Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Interface Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Guide Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Creating a MySonicWall Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Licensing On-Premises Analytics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Licensing Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Registering your Analytics Instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Other Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

CAS-Shadow IT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Firewall Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Moving between Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Analytics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Adding Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Configuring a Firewall in Analytics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Firewall Configuration for Syslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Firewall Configuration for IPFIX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Overview of Syslog-Based Analytics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Reports for Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Group Based Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Data Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

User Activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Scheduling Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Downloading Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Overview of IPFIX-Based Analytics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Discover Network Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Live Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Detailed Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Group-Based Analytics and Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Graph-Based Analytics and Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Schedule Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Contents

SonicWall CSC Getting Started

Contents

Download Reports in PDF or .csv Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Check Web Activity of Specific IPs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

View Session Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Investigate Suspicious External IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

SonicWall Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

About This Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

On-Premises Analytics Getting Started Guide

About On-Premises Analytics

SonicWall

On-Premises Analytics provides different ways view to everything that is happening inside a network

environment protected by SonicWall firewalls. Two reporting options are offered:

• Syslog-based

• IPFIX-based

Syslog is a message logging standard, allowing almost any device to send data about status, events diagnostics

and more. Syslog messages have a built-in severity level. Analytics takes the data, sorts and aggregates it and

then displays it. Many different types of reports are available for Syslog-based reporting. Refer to Overview of

Syslog-Based Analytics for more information.

For IPFIX-based reporting, flow information is collected from the network devices and processed by Analytics. At

its core is a powerful, intelligence-driven engine that automates the aggregation, normalization, correlation and

contextualization of security data flowing across all SonicWall firewalls and wireless access points. The

application’s interactive dashboard uses various forms of time-use charts and tables to create knowledge

representation of the data models. Refer to Overview of IPFIX-Based Analytics for more information.

This Getting Started Guide document helps you deploy On-Premises Analytics in a virtual environment and then

connect your on-premises firewalls to it. Once connected the Syslog or IPFIX data and other firewall data are

collected, processed and then presented for monitoring and review.

The rest of this chapter covers the following topics.

Topics:

• System Requirements

• Interface Conventions

• Guide Conventions

System Requirements

Your security infrastructure must meet certain minimum requirements:

• Browser Levels

• MySonicWall Account

• Firewall Requirements

NOTE: You need to choose either Syslog-based reporting or IPFIX-based reporting. On-Premises Analytics

does not offer a mixed mode.

On-Premises Analytics Getting Started Guide

About On-Premises Analytics

Browser Levels

Since On-Premises Analytics is a cloud service, you only need access to a web browser and an internet

connection to access On-Premises Analytics. The following browser levels are supported:

MySonicWall Account

To login into the set up your On-Premises Analytics account and access licensing information, you must have an

active MySonicWall account. Your MySonicWall credentials are also used to log into On-Premises Analytics.

Refer to Prerequisites for information on how to set up an account.

Firewall Requirements

The following firewall models can be managed by the Management, Reports, and Analytics services.

Additional requirements include the following:

• Each firewall must be licensed with the Comprehensive/Advanced Gateway Security Suite (CGSS/AGSS).

• Firewalls supported by an Analytics instance must be in a single Group or Tenancy.

• The firewalls connected to the Analytics instance must not be associated with a Cloud GMS 1.0

implementation.

• Each firewall must have HTTPS management enabled.

Browser Supported Notes

Google Chrome (latest version) This is the preferred browser for the real-time graphics

display on the Dashboard.

Apple Safari (latest version)

Microsoft Edge (latest version)

Mozilla Firefox (latest version)

Entry-Level Firewalls SOHO W

TZ Series

NSv 10—100

Mid-Range Firewalls NSA 2500—6600

NSa 2650—6650

NSv 200—400

High-End Firewalls SuperMassive 9000 Series

NSa 9250—9650

NSv 800—1600

IMPORTANT: For manually added firewalls, if a firewall is behind a NAT device, then the HTTPS

management port must be opened for the cloud services to communicate with the firewall.

On-Premises Analytics Getting Started Guide

About On-Premises Analytics

Interface Conventions

When acquiring devices for management and reporting, the Status screen (viewable on the HOME, MANAGE,

REPORTS, and ANALYTICS views) uses colored icons to indicate the various states of the devices being

monitored and managed.

Guide Conventions

The following text conventions are used in this guide:

Status Icon Definition

Indicates that a process is in progress. In some instances, specific details are

provided: for example, Requesting Licenses.

Indicates that a process has completed successfully. May provide the message

Success or something with more detail like Device parameters set up in Cloud

GMS complete.

Indicates that a task is in process or pending the completion of another task. The

message Pending is usually displayed, as well.

Indicates a potential issue. Messages provide additional detail to help you

resolve the issue.

Indicates an error. Additional information may be provided via an information

icon. Click the icon or mouse over it to see the message:

For example, Gateway Firewall is not available in GMS.

Convention Use

Bold text Used in procedures to identify elements in the user interface like dialog boxes,

windows, screen names, messages, and buttons. Also used for file names and

text or values you are being instructed to select or type into the interface.

Menu divider | Menu item >

Menu item

Indicates a multiple step menu choice on the user interface. For example,

System Setup | Users, Groups & Organizations > Users means find the menu

or section divider System Setup first, select Users, Groups & Organizations,

and then select Users.

Computer code Indicates sample code or text to be typed at a command line.

<Computer code

italic>

Represents a variable name when used in command line instructions within

the angle brackets. The variable name and angle brackets need to be replaced

with an actual value. For example in the segment serialnumber=<your

serial number>, replace the variable and brackets with the serial number

from your device: serialnumber=C0AEA0000011.

Italic Indicates the name of a technical manual. Also indicates emphasis on certain

words in a sentence, such as the first instance of a significant term or concept.

On-Premises Analytics Getting Started Guide

Prerequisites

Prior to configuring and deploying On-Premises Analytics cloud services, you need to create or validate your

MySonicWall account. A MySonicWall account is critical to receiving the full benefits from SonicWall security

services, firmware updates, and technical support. MySonicWall is also used to license your site and to activate

or purchase licenses for other security services, support, or software specific to your security solution.

If you already have a MySonicWall account skip to Licensing On-Premises Analytics.

Creating a MySonicWall Account

To create a new MySonicWall account from any computer:

1Navigate to https://www.mysonicwall.com.

2 In the login screen, click the SIGN UP link.

3 Complete the Account information, including email and password.

NOTE: Your password must be at least 8 characters, but no more than 30 characters. The system

reports how safe your password as you enter it.

On-Premises Analytics Getting Started Guide

Prerequisites

4 Click on Continue to go the Company page.

5 Complete the company information and click Continue.

6 On the Your info page, provide your name and title.

7 Select whether you want to receive security renewal emails.

8 Identify whether you are interested in beta testing new products.

9 Click Continue to go to the Extras page.

10 Select whether you want to add additional contacts to be notified for contract renewals.

11 To set up additional contacts:

a Input the First name.

b Input the Last name.

c Add the Email address for that person

d Click Add Contact.

12 Select whether you want to add tax information.

13 If providing tax information:

a In the Reseller for field, select the state from the drop-down menu.

b Add your Federal Tax ID.

c Add the Expiry (expiration) Date.

d Enter the Certificate ID.

e Click on ADD TAX ENTRY.

14 Select whether you want to add your distributor information.

15 To set up the distributor information:

a Input the Distributor Name.

b Input the Customer Number.

c Click Add Distributor.

16 Click DONE.

17 Check your email address for a verification code and enter it in the Verification Code* field. If you did not

receive a code, contact Customer Support by clicking on the link.

18 Click DONE. You are returned to the login window so you can login into MySonicWall with your new

account.

NOTE: This only applies to licensed partners or reseller.

On-Premises Analytics Getting Started Guide

Licensing On-Premises Analytics

SonicWall Analytics are offered in several different packages. Each package offers different features to meet your

needs. This chapter describes the different packages you may be licensed to use, how to navigate among them,

and how to complete licensing steps for On-Premises Analytics.

Licensing Packages

SonicWall offers several licensing packages for management, reporting, and analytics web applications.

Package Description CSC Tile

Basic Management Provides basic firewall management at the unit level. Is

automatically included when purchasing the CGSS or

AGSS package for your firewall.

Management Includes a more robust set of management features

including group management, inheritance, work flows

and others.

Management and Reporting Combines full management with a reporting subscription.

The reporting includes status reports, Live Monitor,

dashboards, and the ability to download or schedule

reports.

Analytics Adds additional data collection, analysis and drill down

capability. Also includes the license for Cloud App Security

(CAS). This product can be added to any level of

Management service.

On-Premises Analytics Getting Started Guide

Licensing On-Premises Analytics

Registering your Analytics Instance

Before starting this section, be sure to have the Activation Code. You receive this from your SonicWall

representative.

To register the appliance:

1Navigate to https://cloud.sonicwall.com.

2 Login with your MySonicWall credentials to get to the Capture Security Center.

3 Select the MySonicWall tile.

4 On the MySonicWall Dashboard, click on the Add Product icon.

5 Enter the Activation Code and click Continue.

6 Provide the Friendly name.

7 Select the Product group from the drop-down menu.

8 Click Register.

Now when you go to MyProducts on MySonicWall, you see the Analytics package:

9 Click on the information icon to the right.

You see the Serial Number and Authorization Code for the Analyzer Instance:

On-Premises Analytics Getting Started Guide

Licensing On-Premises Analytics

10 Now write down the Serial Number and Authorization Code to enter into the installation wizard the first

time you launch your Analytics instance as shown below.

Other Licensing

Topics:

• CAS-Shadow IT

• Firewall Licensing

CAS-Shadow IT

Analytics licensing includes Cloud App Security or CAS-Shadow IT. This supports On-Premises Analytics:

• Shadow IT discovery

Leverages existing firewall data to automate cloud discovery to identify risky applications being used.

• Application classification and control

Sets policies for unmanaged cloud applications based on an application risk score derived from

regulations, security certifications and reputation databases to classify as sanctioned (approved by IT) or

unsanctioned (allowed, but not approved by IT) applications.

For further information, refer to SonicWall Cloud App Security User Guide.

NOTE: To launch your Analytics instance, follow the instructions for the applicable virtual

environment, for example, in EXSi Environment for On-Premises Analytics.

On-Premises Analytics Getting Started Guide

Licensing On-Premises Analytics

Firewall Licensing

The Analytics instance only analyzes data which associated firewalls are licensed to collect.

To this end, On-Premises Analytics make good use of firewalls licensed for:

• Mandatory: CGMS or AGMS licensing

• Highly recommended: Licensing for Gateway AV/Anti-Spyware/Intrusions Prevention/App Control/App

Virtualization

• Recommended: Capture Advance Threat Protection

Navigation

You can use the Capture Security Center to navigate between the SonicWall web service offerings. On the

SERVICES view, which is the default shown in the following figure, you can see quickly which services are active

by looking at the tiles. The active services are white and selectable, and the disabled services are grayed out.

Click on a tile to access that service.

You can also click on the THREAT METERS view to see a summary of the data coming into the SonicWall Capture

Labs. It provides a three-page view of the worldwide attacks: world-wide attacks over the last 24 hours, Capture

Labs threat metrics, and Security News.

On-Premises Analytics Getting Started Guide

Licensing On-Premises Analytics

Moving between Services

You can move easily between services on the Capture Security Center. Click on a tile to activate a service and

click on the down arrow at the top, , to return to Capture Security Center. Clicking the up arrow at the

bottom of Capture Security Center, , allows you to return to the most recently selected service.

Management

Management offers two-top level navigation items.

Reports

Reports offers two top level navigation items.

Refer to Analytics HOME Administration and Analytics REPORTS Administration for more information.

Views Function

MANAGE The MANAGE view provides commands grouped by function. The functions

include: SETUP, SYSTEM, and SECURITY for the device selected. The

commands under each function can be expanded for additional options. These

commands can be used to manage your appliances. When you initially select

MANAGE, the default view is the Setup| System > Status.

CONSOLE The CONSOLE view provides commands grouped by function. The functions

include: WORKFLOW, TOOLS, SYSTEM SETUP, and HELP for the device

selected. The commands under each function can be expanded for additional

options. These commands can be used to manage your appliances. When you

initially select MANAGE, the default view is the Tools | V iew Log.

Views Function

HOME The HOME view provides an Overview and Summary or the device selected.

You can expand each of those options for more details. When you initially

select HOME, the default view is the Overview > Dashboard.

REPORTS The REPORTS view provides the options for Overview, Details, and Scheduled

Reports for the device selected. You can expand each of those options for

more details. When you initially select REPORTS, the default view is the

Overview > Live Reports.

On-Premises Analytics Getting Started Guide

Licensing On-Premises Analytics

Analytics

You can expand each of those options for more details. When you initially select ANALYTICS, the default view is

the Overview > Status.

On-Premises Analytics Getting Started Guide

Adding Firewalls

This chapter describes how to add firewalls to Analytics for monitoring.

Topics:

• Configuring a Firewall in Analytics

• Firewall Configuration for Syslog

• Firewall Configuration for IPFIX

Configuring a Firewall in Analytics

Currently, setting up additional firewalls requires that the firewalls meet the requirements in Firewall

Requirements.

When you first launch Analytics, it opens with Overview > Status selected:

To add a firewall:

1 Click on the DEVICE MANAGER icon to see the current collection of firewalls and security appliances

reporting to this Analytics instance.

NOTE: Zero Touch addition of firewalls is not currently supported.

NOTE: The images for IPFIX-based Analytics and Syslog-based Analytics varies slightly; however, the

instructions essentially the same. Differences are noted when required for clarity.

On-Premises Analytics Getting Started Guide

Adding Firewalls

2 Once the DEVICE MANAGER panel appears, click on the + sign to show the Add Firewall dialog box.

3 Fill in the Friendly Name of the firewall, the Serial Number and Model.

4 Click OK.

5 Open another browser window and log into the firewall.

6 If you have Syslog-based Analytics, refer to Firewall Configuration for Syslog for firewall configuration. If

you have IPFIX-based Analytics refer to Firewall Configuration for IPFIX for firewall configuration.

NOTE: Each version of Analytics has slightly different instructions after connecting to the firewall

below. Refer to the KB article listed in the interface for details.

For Syslog-based system

For IPFIX-based system

On-Premises Analytics Getting Started Guide

Adding Firewalls

Firewall Configuration for Syslog

To configure the firewall for Syslog-based Analytics:

1Navigate to Manage > Log Settings > SYSLOG.

2 Click Add.

3 Select the Name or IP address of the Syslog server from the drop-down list.

4In Syslog Format, select Enhanced from the drop-down list.

5 Click OK and the newly added Syslog system is listed.

On-Premises Analytics Getting Started Guide

Adding Firewalls

Firewall Configuration for IPFIX

To configure the firewall for IPFIX-based Analytics:

1Navigate to MANAGE > Appflow Settings > Flow Reporting:

2 In the Flow Reporting panel, take these steps:

a Enable Send AppFlow to SonicWall GMSFlow Server.

b Enable Send Real-Time Data To SonicWall GMSFlow Server.

c Enable Report on Connection CLOSE.

dIn Report Connections On Following Updates, enable all options:

• Threat detection

• Application detection

• User detection

• VPN tunnel detection

• URL detection

eIn Send Dynamic AppFlow For Following Tables, enable all options:

• Connections

• Users

• URL ratings

• VPNs

• Devices

• SPAMs

• Locations

On-Premises Analytics Getting Started Guide

Adding Firewalls

• VOIPs

f Click on the Accept button at the bottom of the page to confirm the configuration.

3Go to MANAGE > AppFlow Settings > GMS Flow Servers:

4 In the GMS Flow Server panel take these steps:

a Enable Auto-Synchronize GMSFlow Server.

b Enter the IP address of the Analytics instance as the GMSFlow Server Address.

c Set the Server Communication Timeout; 60 seconds is recommended.

d Click on the Test Connectivity button to ensure the Analytics instance is accessible. The

UP/REGISTERED message should appear.

e When configuration in this panel is complete, click on the Accept button to confirm the

configuration.

NOTE: If connectivity with the Analytics instance is a problem, go to MySonicWall and

check that the firewall and Analytics instance are in the same Group or tenancy/

SonicWall <Product Name> <Version> <GuideType>

Overview of Syslog-Based Analytics

This chapter describes the Syslog-based reporting. It walks through several representative user scenarios to

familiarize you with some of these reports and how navigate them.

• Reports for Devices

• Group Based Reporting

• Data Usage

• Applications

• User Activity

• Scheduling Reports

• Downloading Reports

Reports for Devices

The Syslog-based reporting is aggregated into several types of reports which are grouped into related topics.

Click on the topics in the left menu to expose the specific reports that are available. The topics include:

• Data usage

• Applications

• User activity

• Web activity

• Web filter

• VPN usage

• Intrusions

• Botnet

• Geo-IP

• Gateway Viruses

• Spyware

• Attacks

• Authentication

• Up/down status

• Custom reports

• Analyzers

• Configuration

Page is loading ...

SonicWALL Analytics Quick start guide

SonicWALL Analytics Quick start guide

SonicWALL Analytics Quick start guide

Related papers

Other documents