Arista Networks SS300ATC60 SpectraGuard Access Point / Sensor User Manual 3

AirTight Networks, Inc. SpectraGuard Access Point / Sensor Users Manual 3

Users Manual-3

Locations Tab
SpectraGuard® Enterprise User Guide
121
Placing Locations on a Location Folder with an Attached Image
The system enables you to place locations on a location folder that has an attached image. This helps you identify the
physical position of each of the locations. The locations placed on the attached image are indicated by colored circles.
A green circle indicates that the location is Secure, while a red circle indicates that the location is Vulnerable.
Use the following steps to place locations on the attached image and view their details:
1. In the Location tree, select a location folder.
2. Under Available Locations, drag and drop the required locations on the attached image.
3. To view details about the location hold the mouse cursor over the colored circle.
4. To go to a particular location placed on the image, do one of the following:
Click the colored circle representing the location.
Point to the colored circle representing the location, then right-click and select Jump to this
location.
Note: You can traverse to a particular location node by following step 4 until you reach the destination location node.
Placing Locations on a Location Folder with an Attached Image and Viewing Details
Detaching an Image
Use the following steps to detach an image:
1. In the Location tree, select the location from which you wish to detach an image.
2. Do one of the following:
Right-click and from the resulting context-sensitive menu, select Detach Image.
Click the Detach Image from floor icon in the right corner.
Locations Tab
SpectraGuard® Enterprise User Guide
122
Detaching an Image from a Location
3. Click Yes in the Confirm dialog to remove the selected image.
Note: On detaching an image, all the placed locations go back to the Available Locations list.
Importing a Planner file into a Location Node
The system enables you to specify a layout for each location node using a blank canvas, a layout image, or a .SPM file
exported from Planner. Use the following steps to import a Planner file:
1. In the Location tree, select the location node into which you wish to import the .SPM file and then right-
click.
2. From the resulting context-sensitive menu, select Import Location.
Importing a Location
3. In the Select SpectraGuard Planner (.spm) File dialog, browse to the appropriate Planner
exported .SPM file and then click Open.
Creating your Layout
This section shows you how to place devices on your floor map, view details of the layout, reset your canvas, and
edit floor properties.
Locations Tab
SpectraGuard® Enterprise User Guide
123
Placing APs and Sensors on the Floor map and Viewing Details
The system enables you to place APs and Sensors on the floor map to view live RF coverage maps for a location node
and perform on-floor location tracking of visible 802.11 devices. Use the following steps to place APs and Sensors on
the floor map and view their details:
1. In the Location tree, select a location node.
2. Under Available Devices, select either the APs or the Sensors tab, then drag and drop the APs or
Sensors on your floor map. As soon as you drag and drop the APs or Sensors on your floor map, the RF
views of the APs or Sensors are displayed.
3. To view details about the AP or Sensor hold the mouse cursor over the appropriate device.
4. Double-clicking the AP or Sensor displays the AP or Sensor Details screen in the Devices tab.
Placing APs and Sensors on the Floor map and Viewing Details
5. Right-click the AP or Sensor the following menu items appear.
Delete: Deletes the device
Set Coordinates: Select Set Coordinates to move the device to the specified coordinates. Enter the X
and Y Coordinate in the Set Coordinates dialog.
Set Coordinates
Locations Tab
SpectraGuard® Enterprise User Guide
124
Change RF Property: Select RF Property to change the RF properties of the device. In AP RF
Properties dialog, select the Interface name from the Interface drop-down list. Enter Transmit
Power (mW) and Transmission Calibration Factor (dB). Click Apply and then OK.
AP RF Properties dialog
In the Sensor RF Properties dialog select the Interface name from the Interface drop-down list. Enter
Reception Calibration Factor (dB). Click Apply and then OK.
Sensor RF Properties dialog
Setting Coordinates and Deleting Devices from a Floor map
The system enables you to set the coordinates of APs and Sensors placed on the floor map for precise positioning.
You can delete APs and Sensors from your floor map so that the deleted devices can be placed again on the floor map.
Such devices become available under Available Devices. Use the following steps to set the coordinates of a device or
delete a device.
1. Right-click an AP/Sensor placed on the floor map. Do one of the following from the resulting menu:
Select Set Coordinates to open a dialog where you can specify the X and Y coordinates of the
selected device. To set the coordinates, click OK.
Select Delete to remove the AP/Sensor from the floor map.
Resetting your Canvas
The system enables you to reset a canvas to revert to a blank canvas. This option removes all folders and location
information from a location folder. It removes all device and location information, including the background image
and/or any imported Planner file from a location node. All placed devices go back to the Available Devices list. The
system retains the original size and the location name in the sub-list of locations.
Use the following steps to reset a canvas:
1. In the Location tree, select the location at which you wish to reset the canvas and then right-click.
2. From the resulting context-sensitive menu, select Reset Canvas.
3. Click Yes on the Confirm dialog to reset the canvas.
Editing Floor Properties
The system enables you to edit the properties of an existing floor map to change its name and dimensions. Use the
following steps to edit the floor properties:
1. In the Location tree, select the location node whose properties you wish to edit and then right-click.
Locations Tab
SpectraGuard® Enterprise User Guide
125
2. From the resulting context-sensitive menu, select Edit Properties.
3. On the Location Node Properties dialog, edit the required properties.
Editing the Properties of a Location Node
4. To change the properties, click Save.
Note: If you resize a location node to a smaller dimension, the objects placed on the floor map are drawn beyond the floor
boundaries. The system removes all the devices that fall outside the resized area. The system scales the attached image according
to the new size. The size of the objects placed on the floor map however, remains unaltered.
Tagging Locations
The System enables you to tag different locations on the floor map. You can add notes to a floor map. Similarly, you
can edit notes, delete notes, hide notes that are displayed on the floor map, and show hidden notes on the floor map.
Adding Location Notes to a Floor Map
Do the following steps to tag an element or location on the floor map.
1. Right click the element or location on the floor map to be tagged.
2. The Add Notes menu is displayed. The following figure shows the Add Notes menu.
Locations Tab
SpectraGuard® Enterprise User Guide
126
Adding Notes to Floor Map Elements
3. Select Add Notes.
4. The Add note dialog is displayed. Following figure shows the Add Note dialog.
Add Notes dialog
5. Add the note and its description. The X Coordinate and Y Coordinate are sensed by the System
and populated in the Add note dialog.
6. To save the note, click OK. Click Cancel to cancel the operation.
7. On saving the note, note is added to the floor map element. The following figure displays a floor
map with notes.
Locations Tab
SpectraGuard® Enterprise User Guide
127
Floor Map with a Location Note
Editing Location Notes on a Floor Map
You can edit existing location notes at any given point. To do this, right click the note to be edited. Select the Edit
note option to edit the location notes. Following figure displays the Edit Note option.
Locations Tab
SpectraGuard® Enterprise User Guide
128
Editing Location Tags
On Selecting Edit Note option, Edit Note dialog appears.
Following figure displays the Edit Note dialog.
Edit Note dialog
You can edit all fields in the dialog.
Hiding Location Notes shown on a Floor Map
You can hide location notes that are visible on a floor map. To do this, right click anywhere on the floor map. Select
the Hide notes option to hide all the Location notes. Following figure displays the Hide notes option.
Locations Tab
SpectraGuard® Enterprise User Guide
129
Hiding Location Notes visible on Floor Map
Displaying Hidden Location notes shown on a Floor Map
You can display hidden location notes on a floor map. To do this, right click anywhere on the floor map. Select the
Show notes option to show all the Location notes. Following figure displays the Show notes option.
Locations Tab
SpectraGuard® Enterprise User Guide
130
Show notes on Floor Map
Click Show Notes button to display all the notes defined for the floor map.
Deleting Location Notes from Floor Map
You can delete Location notes that are visible on a floor map. To do this, right click the note/location tag to be
deleted. Select the Delete note option to delete the location note. Following figure displays the Delete note option.
Locations Tab
SpectraGuard® Enterprise User Guide
131
Deleting Note from Floor Map
The note is deleted from the floor map.
Printable View
The RF views for the floormap can be saved as printable view in jpg, png, and HTML formats.
Locations Tab
SpectraGuard® Enterprise User Guide
132
Locations Tab – Printable View Icon
Note: The Printable View icon is available on the Location nodes and not in the Location folders.
Click the Printable View icon and save the printable view as jpg, png, or HTML as shown in the figure.
Locations Tab
SpectraGuard® Enterprise User Guide
133
Saving the Printable view of the RF views
Viewing RF Coverage Maps
To view a live RF coverage map for a location node, Authorized APs and Sensors must be placed on the floor map.
Use the following steps to view live RF coverage maps:
1. Place devices on the floor map using the steps given in the Placing APs and Sensors on the Floor map
and Viewing Details section.
2. Select one of the following views.
AP Coverage View
The AP Coverage View enables you to view an 802.11 RF coverage map based on the dBm at each point on the layout.
This information is useful to find out available signal strength at each point. The color-coding scheme used enhances
the readability of the map.
Locations Tab
SpectraGuard® Enterprise User Guide
134
AP Coverage View
AP Channel View
The AP Channel View enables you to view all the 802.11 channels available for connection at each point on the floor.
It helps in preventing potential channel interference scenarios.
Locations Tab
SpectraGuard® Enterprise User Guide
135
AP Channel View
AP Link Speed View
The AP Link Speed View enables you to view the maximum downlink rate with which a Client at a particular point
can connect to an AP on the floor.
Locations Tab
SpectraGuard® Enterprise User Guide
136
AP Link Speed View
Sensor Coverage View
The Sensor Coverage View enables you to view the detection and prevention zones of visibility for selected Sensors.
Locations Tab
SpectraGuard® Enterprise User Guide
137
Sensor Coverage View
Detection Range is the area over which Sensors can reliably detect wireless activity of devices operating at a power
level greater than the value set in the Transmit Power slider. The Intrusion Detection Display Threshold
determines the threshold for this range.
Prevention Range is the area over which Sensors can prevent unauthorized wireless activity. The Intrusion
Prevention Display Threshold determines the threshold for this range.
Note: Prevention Range view is not visible if WIDS license is applied.
Both detection and prevention ranges are affected by various parameters under AdministrationGlobalLocation
SettingsRF Propagation. The reliability of the prevention also depends on the Intrusion Prevention Level chosen
under AdministrationLocalOperating PoliciesIntrusion Prevention Intrusion Prevention Level.
Calibrating RF Views
Calibration helps in tuning RF parameters used by the system to compare the AP and Sensor predictions to actual
observations. The system has a robust calibration technique that also allows manual intervention in case of
discrepancy. Use the following steps to calibrate RF views:
1. Generate the RF Coverage map using the steps explained in the Viewing RF Coverage Maps section and
then clicking Calibration.
2. To improve predictions, fine-tune the Min. Signal Decay Constant and the Max. Signal Decay
Constant.
Note: Min. Signal Decay Constant specifies the amount of signal loss that is acceptable for regions close to the transmitter
(Sensor). Max. Signal Decay Constant specifies the amount of signal loss that is acceptable for regions away from the
transmitter. Signal loss is directly proportional to the signal decay constants.
Locations Tab
SpectraGuard® Enterprise User Guide
138
3. Change the values of the Signal Decay Slope (Beta) and the Signal Decay Inflection (Alpha). The
system uses these parameters when computing the RF and defines the region around the transmitter
that is unobstructed.
Note: When you change the Min. Signal Decay Constant, Max. Signal Decay Constant, Signal Decay Slope (Beta), and
Signal Decay Inflection (Alpha) the RF view and location tracking for unobstructed regions is affected. In the obstructed
regions, only Location Tracking is affected, RF view is not affected.
4. Click Update Graph to view your selection against the predicted values.
Important: The Predicted value curve should overlap the Observed value curve as much as possible.
5. Click Calibrate to complete calibration if you have adjusted the parameters manually such that the two
curves are parallel (but not coinciding).
6. Click Apply to commit your changes.
RF Calibration Dialog
Reports Tab
SpectraGuard® Enterprise User Guide
139
Reports Tab
Reports: Panel for Generating Reports
The Reports screen enables you to generate predefined and customized reports. The system uses a query-based
mechanism to generate various reports. The system provides predefined compliance reports: Health Insurance
Portability and Accountability Act (HIPAA), Sarbanes-Oxley (SOX), Gramm-Leach-Bliley (GLBA), Payment Card
Industry (PCI) Standard, and so on. Additionally, information about devices and events is also available in the form
of ready made reports.
Reports Screen
You can open the Reports screen by selecting the Reports tab on the navigation bar.
Report Definitions Screen: Shared Reports Tab
The Reports screen includes two panes.
On the left, the Location tree.
On the right, the report panel.
Location Tree
The Location tree shows the complete list of locations created for your WLAN in the system. You can select locations
for which you need to generate the report.
Report Panel
On the top of the Reports screen, Selected Location gives the path of the selected location.
The Reports screen includes two tabs:
1. Report Definitions: This tab consists of two sub-tabs:
Reports Tab
SpectraGuard® Enterprise User Guide
140
Shared Reports: Contains reports that all the users can view and schedule. These include
Assessment Reports, Compliance Reports, Incident Reports, Device Inventory Reports,
Performance Reports, SAFE Client Reports, and Custom Reports.
My Reports: Contains reports available only to those users who have generated them. These are
custom reports. You can import a custom report by clicking Import Report.You can import a report
created in SpectraGuard Enterprise. You can export a report by clicking Export Report. The
Import Report and Export Report buttons are enabled only for My Reports.
Report Definitions Screen: My Reports Tab
2. Archived Reports: This tab allows you to view saved or archived reports generated on the server. These
reports are useful for trend analysis. An archived report is visible to a user if the user generated the report.
A superuser can see all archived reports.
On the two tabs – Shared Reports and My Reports are two tables described in the following sections.
List of Reports
The List of Reports table displays reports available for all the locations. This table consists of the following columns:
Report Name: Displays the name of each report
Report Description: Displays a brief description of each report
Report Delivery Schedule: Displays the delivery schedule of each report for the selected location. The
schedule is only visible to the user who created it.
In the List of Reports table, you can perform the following operations under Shared Reports–Custom Reports tab or
My Reports:
Add, edit, delete, and move a report to a different tab
Add, edit, and cancel a report schedule
Under Shared Reports – Assessment Reports, Compliance Reports, Incident Reports, Device Inventory Reports,
Performance Reports, and SAFE Client Reports tabs, you can only view a report and add a report delivery schedule.
Reports Tab
SpectraGuard® Enterprise User Guide
141
List of Sections
The List of Sections table displays sections created for a selected report. This table consists of the following columns:
Section Name: Displays the name of the section contained in the selected report
Section Description: Displays a brief description of each section
Note: Throughout the user interface, events can have one of the three states (Live, Instantaneous, or Expired); however, while
defining Reports Instantaneous and Live events are grouped into a single status (Past).
Depending on whether or not you want Section Summary, Section Listing for a particular section to appear in the
report, you can select or deselect the check box under Section Summary, Section Listing for that section. To have
Section Summary for all the sections in the report, select the check box next to Section Summary. To have Section
Listing for all sections in the report, select the check box next to Section Listing. Click the Save button to save these
settings. The setting is saved for the individual user, for the report. In this way, every user can have different settings
for each report based on individual requirement.
By default, Section Summary and Section Listing for all sections are selected.
This feature is available for Shared Reports and My Reports.
In the List of Sections table, you can perform the following operations under Shared Reports–Custom Reports tab or
My Reports:
Add, edit, and delete a section of a report
Organize the sections in the report using and
Generate a report, save a report with the same, or different name
Under Shared Reports – Assessment Reports, Compliance Reports, Incident Reports, Device Inventory Reports,
Performance Reports, and SAFE Client Reports tabs, you can only view a section of a report, generate a report, and
save a report with a different name. The saved report is available under Shared Reports – Custom Reports tab.
On the Archived Reports tab, the following information is available:
Reports Tab
SpectraGuard® Enterprise User Guide
142
Archived Reports Tab
User Name: Displays the name of the user who generated the report.
Location: Displays the name of the location at which the report is generated. If the Location tree is updated
after a report is generated, this field is not updated.
Report Name: Displays the name of the report that appears at the time of report generation. Updating the
report name does not update the name here.
Format: Specifies the format of the report; that is HTML, XML, or PDF.
Generation Date: Indicates the time of report generation.
Size (KB): Displays the report size. This parameter is useful when deleting reports.
Managing Reports
This section shows how to add a report, edit a report, delete, and move a report. You can perform these operations
either under the My Reports tab or the Shared Reports–Custom Reports tab.
Adding a Report
The system enables you to define customized reports so that you can view precise details that you require. Use the
following steps to add a report:
1. Select the tab My Reports.
Reports Tab
SpectraGuard® Enterprise User Guide
143
2. Under List of Reports, click Add Report.
Report Details Screen showing Report Header Tab
3. On the Report Details dialog, under Report Name, enter a unique, user-friendly name for the
report.
4. Under Report Description, enter brief note to help identify the report.
5. Click Use default look and feel, to retain the default text, title, and colors for the reports.
6. Alternatively, click Customize look and feel, to customize the appearance of the report.
7. Select the Report Header tab.
8. Under Report Header, specify the following parameters to be customized in the generated report:
Left Aligned Header Text: Specify the text that should appear in the header on the left side.
Right Aligned Header Text: Specify the text that should appear in the header on the right side.
Click Pick… and select the Text Color and Background colors for the Report Header.
9. Under Report Title, specify the following parameters to be customized in the generated report:
Title Text: Specify a title that appears below the header on the left side. The Report Description
follows this title.
Click Pick… and select the Text Color and Background colors for the Report Title.
Select the checkbox, Display Report Generation Information to view the following information
below the Report Title
Duration for which the report is generated
Reports Tab
SpectraGuard® Enterprise User Guide
144
Location for which the report is generated
User who generated the report
Date and time when the report is generated
Select the checkbox, Display Report Description Text to view a detailed description of the report.
10. Select the Report Summary tab.
Report Details Screen showing Report Summary Tab
Clear the checkbox, Display Report Summary if you do not wish to view the Report Summary in a
tabular form.
Alternatively, select the checkbox, Display Report Summary to customize parameters in the
Report Summary table in the generated report.
Specify the Report Summary Text that should appear as the Report Summary table
heading.
Click Pick… and select the Text Color and Separator colors for the Report Summary table
heading.
Under Summary Table, select the checkbox, Include Section with zero results to view sections in
which the result count is zero.
Under Summary Table Header, click Pick…, select the Text Color, and Background colors for the
Report Summary table row header.
Reports Tab
SpectraGuard® Enterprise User Guide
145
Under Summary Table Column Header Definition, select the checkbox, Display Report
Summary Table to customize the following column names in the Report Summary table in the
generated report.
Section Name
Section Description
Query Type
Result Count
Jump to
Under Summary Charts, select an option button to view the charts in the desired format.
11. Select the Report Sections tab.
Report Details Screen showing Report Sections Tab
Under Section Title, specify the following parameters to be customized in the generated report:
Section Name Title: Specify the text that should appear as a common heading for all the Section Names.
Click Pick… and select the Text Color and Separator colors for the Section Name Title.
Under Section Header, specify the following parameters to be customized in the generated report:
Click Pick…, select the Text Color, and Background colors for the table row headers in the Section
Summary and Section Results sections.
Reports Tab
SpectraGuard® Enterprise User Guide
146
Select Display Section Description text to view a brief description for each section of the report.
Select Display Section Query to view all the constraints specified in the database query for that section.
11. To add the report to the List of Reports, click Save. The new report appears under the List of Reports
table.
Editing a Report
The system enables you to edit user-defined reports. You cannot edit pre-defined reports. AirTight recommends that
you do not edit a shared report scheduled by multiple users for delivery. Instead, save the report under a different
name and then modify that report. Use the following steps to edit a selected report:
1. From the List of Reports table select the report that you want to edit.
2. Click Edit Report.
3. On the Report Details dialog, change the Report Name, Report Description, default look and feel,
or customize the look and feel.
Editing a Report
4. To save the changes, click Save.
Deleting a Report
Reports Tab
SpectraGuard® Enterprise User Guide
147
The system enables you to delete a user-defined report. You cannot delete pre-defined reports or a shared report
scheduled by other users. Use the following steps to delete a report:
1. From the List of Reports table, select the report that you want to delete.
2. Click Delete Report.
3. Click Yes on the Confirm dialog to delete the report.
Moving a Report
The system enables you to move a report from Shared Reports–Custom Reports to My Reports and vice versa. Use
the following steps to move a report:
1. From the List of Reports table, select the report that you want to move.
2. Click Move Report.
3. Click Yes on the Confirm dialog to move the report.
You cannot move:
A report from Shared Reports–Custom Reports to My Reports if more than one user share or schedule it
for delivery at that location.
A report from My Reports to Shared Reports–Custom Reports if a user schedules it for delivery at that
location.
Reports provided under Shared Reports – Assessment Reports, Compliance Reports, Incident Reports,
Device Inventory Reports, Performance Reports, and SAFE Client Reports to My Reports
Working with Sections of a Report
This section shows you how to add a section to a report, edit a section of a report, and delete a section of a report.
Adding a Section to a Report
A report consists of one or more sections. Each section is a query to the database. The system then searches its
database for those records that satisfy the conditions that you impose. You cannot however add sections to
predefined reports. Use the following steps to add a section to a report:
1. From the List of Reports table, select the report to which you need to add a section.
2. Click Add Section to Report.
Reports Tab
SpectraGuard® Enterprise User Guide
148
Adding a Section to a Report
3. On the Add Section to Report dialog, enter a Section Name and a Section Description for the newly
added section.
4. Select the checkbox Display this section to view this section in the generated report.
5. Under Section Query Type, select Device, Event, or SAFE as the query type.
6. Select any combination of the AP, Client, and Sensor checkboxes to include these device types in the
results. These checkboxes are not available for a SAFE query.
7. Describe the Section Query construction logic by selecting the following:
A column from Select Column
A condition from Select Condition
An object for the query, which you can select or enter
8. Optionally, select one or more Boolean connectors (OR or AND) to join two or more queries. Click
Delete to delete a query.
9. Under Select Columns to be displayed in Section Results, do the following:
Click Add to view a list of attributes and select an attribute.
Select the checkbox Display to view the selected attribute in the generated report.
Under Summary, you can choose to do the following:
Select the type of chart from the drop-down list to view a graph for the selected attribute.
Reports Tab
SpectraGuard® Enterprise User Guide
149
Select the checkbox Table to view a tabulated count for the selected attribute.
Note: Pie charts are not visible in an HTML report. You can view pie charts only in a PDF report.
Select an attribute and click <Delete> to delete that attribute.
Select an attribute and click <Up> or <Down> to organize the attributes that appear as columns in
the Section Results table of the generated report.
10. To save the section to an existing report, click <Save Section to Report>. To save the section with a new
name, click <Save to Report as New Section>.
Note: When the Section Query Type is Event Query, and you select Event from the Select Column list to construct the
section query, a list of predefined events appears in the Select Value list. This list also includes deprecated events. A deprecated
event has the strike-through style applied to the event name. For example: AP MAC Spoofing
Editing a Section of a Report
The system enables you to edit a report’s section information, query, or attributes to display in the generated report.
AirTight recommends that you do not edit a shared report scheduled by multiple users for delivery.
Use the following steps to edit a section of a report:
1. From the List of Sections table, select the section that you want to edit.
2. Click Edit Section.
3. On the Edit Section in Report dialog, make changes to the required field(s).
4. To save the changes in an existing section, click Save Section to Report. To save the edited section
with a new name, click Save to Report as New Section.
Deleting a Section of a Report
The system enables you to delete a section from a report if you no longer need the query defined in that section.
Note: Be careful when deleting a section of a report. The system cancels any existing delivery schedules for the selected report in
the selected location. Further, if you delete the last section of a report, scheduling and report generation functions are disabled.
Use the following steps to delete a section from a report:
1. From the List of Sections table, select the section that you want to delete.
2. Click Delete Section.
3. Click OK on the Confirm dialog to delete the section.
Scheduling a Report
The system enables you to schedule email delivery of a report. You can select one time delivery or recurring delivery.
Important: Scheduled reports are emailed at incorrect times if incorrect time zone settings are configured in the Server
Initialization and Configuration Wizard from the Server Config shell so choose the time zone carefully.
Setting a Report Schedule
Use the following steps to schedule email delivery of a report:
1. From the List of Reports table, select the report that you want to schedule.
2. Click Add Schedule. The Generation and Delivery Options for Selected Location dialog appears.
Reports Tab
SpectraGuard® Enterprise User Guide
150
Scheduling a Report for One Time Generation
3. From the Format drop-down list, select the output type for the report, that is, HTML, XML, or PDF.
Note: The system does not support PDF report generation on older versions of IE (versions lower than 7.0).
4. Select either One Time Generation or Recurring Generation.
To schedule a report for One Time Generation, perform the following:
Under Schedule Report, click the calendar icon to specify the date and the time on which to
generate the report.
Under Report Time Period, customize the duration for which the report should be generated by
doing either of the following:
Select Last and then the number of hours, days, or months before the report delivery time.
Select Customize and then the exact date and time in From Date and To Date fields.
Reports Tab
SpectraGuard® Enterprise User Guide
151
Scheduling a Report for Recurring Generation
To schedule a report for Recurring Generation, perform the following:
Under Schedule Report, from the Generate Report Every drop-down list select the number of
hours, days, or months over which to deliver the report.
Click the calendar icon next to Start Date to select the start date and time for the report.
Click the calendar icon next to End Date to select the end date and time for the report. The End
Date must be greater than the Start Date. The system automatically selects the End Date and Time
from the Start Date.
Under Report Time Period, customize the duration for which the report should be generated by
selecting Last and then the number of hours, days, or months before the report delivery time.
5. Under Delivery Options, perform the following:
Select Archive Report and then choose the following:
Never Delete to retain the report forever.
Delete after ‘n’ days to delete the report after the specified number of days
Select Email Report to email a copy of the report to the selected user(s).
Select Zip before email to compress the report before emailing it.
6. Click Add Recipients to open Report Delivery dialog. Here, you can do the following:
Select one or more email addresses under System Users and then click to move the
chosen email address(s) to Recipients. The system delivers scheduled reports to the users under
Recipients.
Reports Tab
SpectraGuard® Enterprise User Guide
152
Click Add to open Additional Email Addresses dialog where you can specify a custom
email address for a non-system user who will receive a scheduled report. In this dialog, you can
add multiple email addresses one at a time.
Specifying Additional Email Addresses for Report Delivery
7. Click OK to close the Additional Email Addresses dialog.
8. Click OK to close the Report Delivery dialog.
9. To schedule the report, click Save.
Editing a Report Schedule
The system enables you to edit a report schedule in response to your requirements. Use the following steps to edit a
report schedule:
1. From the List of Reports table, select the report whose schedule you want to edit.
2. Click Edit Schedule.
3. On the Generation and Delivery Options for Selected Location dialog, make the necessary changes
using the steps given in the Setting a Report Schedule section.
4. To save the changes, click Save.
Canceling a Report Schedule
The system enables you to cancel a report schedule based on your requirements. Use the following steps to cancel a
schedule:
1. From the List of Reports table, select the report whose schedule you want to cancel.
2. Click Cancel Schedule.
3. Click Yes on the Confirm dialog to cancel the schedule.
Generating a Report Instantly
The system enables you to generate a report instantly to display detailed information about your WLAN for a
selected period. Use the following steps to generate a report:
1. From the List of Reports table, select a report that has at least one section.
2. Click Generate.
Reports Tab
SpectraGuard® Enterprise User Guide
153
Generating a Report
3. On the Generate Report dialog, select the Report Time Period by doing one of the following:
Select the number of days or hours from the drop-down list over which to collect data. Use the calendar
icons to the right of the From and To fields to select the start time and end time for which to collect the data.
4. Select the Format in which to generate the report, that is, HTML, XML, or PDF.
5. Under Report Archival, select Archive Report and then select one of the following:
Never Delete to retain the archived report in the database forever.
Delete after ‘n’ days to delete the archived report after the selected number of days
6. Click OK to generate the report.
7. An HTML or PDF report opens in another browser window.
Report in HTML Format
Reports Tab
SpectraGuard® Enterprise User Guide
154
Report in PDF Format
8. Alternatively, to save a report in XML format, in the Save dialog, specify the path where you want to
save the report.
Report in XML Format
Sample Report Generation
The example given in this section walks you through the process of creating a new report and shows you how to add
a new section consisting of several database queries to the report.
Following are the steps involved in generating a report:
Creating a report
Adding a section
Specifying a section query
Selecting columns
Saving the section
Generating the report
These steps are illustrated with an example of a report that lists of all the Rogue APs in the WLAN that:
Operate only on the 802.11 b protocol.
Reports Tab
SpectraGuard® Enterprise User Guide
155
Use either Channel 6 or Channel 11 for wireless communication
Creating a Report
1. Select the tab My Reports.
2. Add a new report to the List of Reports table by clicking Add Report.
3. On the Report Details dialog, enter a Report Name for the new report (for example, Rogue AP
Associations), a Report Description to identify the report, and optionally customize the look and feel of
the report.
4. Click Save. The new report appears under the List of Report table.
Adding a Section
1. Select the newly added report.
2. Click Add Section to Report.
3. On the Add Section to Report dialog, enter a Section Name and a brief Section Description.
4. Select the checkbox Display this section to view this new section in the generated report.
Specifying a Section Query
1. Under Section Query Type, select Device Query.
2. Under Select Device Type to include in Results, select the AP checkbox. By default, the system selects
this checkbox.
3. Under Section Query, from left to right, select the following:
Violates Security Policy? is equal to Yes; the Boolean connector AND joins the first query
to the second
Active Status is equal to Inactive; the Boolean connector AND joins the second query to
the third
Channel is equal to 6; the Boolean connector OR joins the third query to the fourth
Channel is equal to 11
Note: The following steps explain a suggested method of implementing this query. You can implement the same query by
changing the order of the queries.
4. Under Select Columns to be displayed in Section Results, do the following
Click Add to view a list of attributes.
Select the following attributes one at a time and click OK.
MAC Address
SSID
Network Status
Protocol
Channel
Device Folder
Ensure that you select the following under Select Columns to be displayed in Section Results.
Attribute
Display
Summary
Chart
Table
MAC Address
Selected
-
-
SSID
Selected
Pie
Selected
Network Status
Selected
Bar
Selected
Protocol
Selected
Pie
Selected
Channel
Selected
Bar
Selected
Device Folder
Selected
Bar
Selected
Saving the Section
To save this section to the report (Rogue AP Associations), click Save Section to Report. The new section appears
under the List of Sections table.
Generating the Report
1. Select the newly created report (Rogue AP Associations).
Reports Tab
SpectraGuard® Enterprise User Guide
156
2. Click Generate. The Generate Report dialog appears.
3. Under Report Time Period, select 7 days.
4. Under Format, select PDF.
5. Under Report Archival, select Archive Report and then select Delete after 360 days to retain the
archived report for 360 days.
6. Click OK. The PDF report opens in a different browser window.
Report in PDF format for ‘Rogue AP Associations’
7. To view the Section Summary and Section Results of a section, click the corresponding link(s) in the
Jump to column in the Report Summary table.
Reports Tab
SpectraGuard® Enterprise User Guide
157
Report for ‘Rogue AP Associations’ showing Section Summary
Reports Tab
SpectraGuard® Enterprise User Guide
158
Report for ‘Rogue AP Associations’ showing Section Results
Forensics Tab
SpectraGuard® Enterprise User Guide
159
Forensics Tab
Forensics: Panel for Threat Forensics
The Forensics screen enables you to drill down into forensic data about wireless threats detected in the network. The
system captures important details about the detected threats and presents them in a human-readable format. You can
review details such as device identities and configurations, connection records, device locations, system responses,
and administrator actions about the detected wireless threats using this tab.
Note: The Forensics Tab is not visible if WIDS license is applied.
Forensics Screen
You can open the Forensics screen by selecting the Forensics tab on the navigation bar.
Forensics Screen
The Forensics screen includes two panes.
On the left, the Location tree.
On the right, the Forensics tab: Time Filter, Threats List, and Pie Charts showing the AP and Client-Related Instances
in graphical form.
Forensics: Location Tree
The Location tree shows the complete list of locations created for your WLAN in the system. To view a list of wireless
threats, select a location in the Location tree, and a list of threats appears for the selected location and its child
locations.
Forensics: Time Filter, Threat List, and Pie charts
This pane shows:
Path of the selected location.
List of threats that have occurred at that location
Graphical representation of AP and Client threats as pie chart
Forensics Tab
SpectraGuard® Enterprise User Guide
160
You can view the threats based on the Time Filter, do one of the following:
Select Time Period and select Last 4 Hours, Last 12 Hours, Last 24 Hours, or Last 48 Hours from the drop-
down list.
Select From click the icon to specify a start date and time. Under To, click the icon to specify an end
date and time and then click Apply.
Threat list is organized such that it is easy to determine whether it is AP based threat or Client based threat, based on
the primary device involved in the threat.
AP Based Threats: These are threats wherein the main participating/effected device is an AP. AP based
threats are sub-categorized as follows:
Rogue AP
Mis-configured AP
Honeypot AP
Banned AP
DoS
Client Based: These are threats wherein main participating/effected device is a Client. Client based threats
are sub-categorized as follows:
Unauthorized Association
Mis-association
Bridging Client
Banned Client
Ad hoc Networks
You can also view the summary information about threats in the form of pie charts under the AP related instances
and Client related instances.
Viewing Threats List
Forensics analysis of threats involve systematic drill down into the threat details. Viewing the threat list is the first of
those actions. Use the following steps to view threat list:
1. In the Location tree, select a location.
2. In the right pane, the threat list displays. The threat list has the following columns:
Forensics Tab
SpectraGuard® Enterprise User Guide
161
Threats List
Primary Device: Specifies the category of the threat (AP or Client) based on the primary device
involved/effected by the threat.
Threat: Specifies the actual name of the threat type (such as Rogue AP, Honeypot AP, Ad hoc Networks ,
and so on).
Instances: Specifies the number of threats of the respective type in the given time frame.
Devices: Specifies the number of unique Primary Devices which were involved in this threat type.
Details: When you click Details, the Forensics Details dialog opens. This helps you drill down into the
details of that threat type.
Forensics Tab
SpectraGuard® Enterprise User Guide
162
Forensics Details Dialog
The various fields and buttons in the Forensics Details dialog are:
Short Description: Provides a brief description of the selected AP/Client threat. This is presented as bold
text at the top of the dialog.
All Devices Filter: Displays unique list of all the Primary Devices which where involved in the threat in the
time frame selected in the Time Filter in the Threats List screen. Click the All Devices Filter icon, the
Device Filter dialog opens. Select the appropriate Device/All Devices in the Search. Click <OK>.
Device Filter dialog
Event Details: Specifies the event details. Right click option of Events is also available. Refer to Viewing
Events Lists section in the Events tab for details.Event Start Time: Displays the event start time.
Forensics Tab
SpectraGuard® Enterprise User Guide
163
Event End Time: Displays the event end time. If the event is live, the Event End Time is Ongoing.
Refer to AP Based Threats section or Client Based Threats section for more details about Association, Prevention,
and Admin tabs depending on the threat type.
AP Based Threats
The AP Based Threats Details dialog gives information about the AP based threat, which helps you determine the
actions taken after the threat was detected.
To open the AP Based Threat Details dialog, select an AP Threat row on the Forensics screen, and click Details. The
AP Based Threat Details dialog has the following tabs namely: Association, Prevention, and Admin. By default, the
Association tab appears.
AP Based Threat Details dialog
AP Based Threat – Association Tab
Association Tab shows the number of connection attempts that where made to the AP selected for the duration of
the selected Event. The fields in Association Tab are as follows:
AP: In case of AP based threats, AP is the Primary Device. Click AP, the AP Details dialog opens.
Client: Client is the device, which is associated to the Primary Device. Click Client, the Client Details
dialog opens.
Association Start Time: Specifies the start time when the Primary Device associates with the device.
Association End Time: Specifies the end time when the Primary Device ends association with the device.
Locate: Click Locate, the Location dialog opens. Select the AP/Client participating in the event from Locate
Device drop down list. Select Start Time of Association and End Time of Association from At drop down
list. Click Locate the location of the selected device at the selected time is displayed in the Thermometer
Forensics Tab
SpectraGuard® Enterprise User Guide
164
View. Click Floor Map View to view the location of the selected device at the selected time in the Floor Map
View.
Location dialog
Note: The first row in the AP based threat displays the Event Time, while rest of the rows displays the Start/End Time of
Association. This is valid for all AP based threats, except DoS.
AP Based Threat – Prevention Tab
Prevention Tab shows the details of the Quarantine status of the association in the Association tab.
Forensics Tab
SpectraGuard® Enterprise User Guide
165
AP Based Threat Details – Prevention Tab
The fields in Prevention Tab are as follows:
AP
Client
Association Start Time
Association End Time
Quarantine: Specifies the action taken on both the devices in the association. Even one of device is
quarantined, the association is Quarantined, otherwise it is Not Quarantined. Click Quarantined, the
Quarantine Details dialog opens.
Quarantine Details dialog
Click Not Quarantined, the Not Quarantined Reason dialog opens.
Forensics Tab
SpectraGuard® Enterprise User Guide
166
Not Quarantined Reason
AP Based Threat – Admin Tab
Admin Tab shows all the administrator actions taken on the AP between the Event Start Time and Event End Time.
AP Based Threat Details – Admin Tab
Forensics Tab
SpectraGuard® Enterprise User Guide
167
The fields in Admin Tab are as follows:
User: Specifies the name of the user who took action on the threat.
Action: Specifies the action taken by the user for the AP based threat such as AP added to quarantine, AP
name changed
Time: Specifies the time when the user action was taken
Note: All the above tabs Association, Prevention, and Admin shows the information based on the Device and Event selected
in the Threats List dialog.
Note: AP Based Threat – Rogue AP, Mis-configured AP, and Honeypot AP have the same fields for the tabs Association,
Prevention, and Admin. However AP Based Threat – DoS has some different fields as discussed in the section below.
AP Based Threat – DoS
DoS is classified into two categories:
Unicast: In Unicast only one Client connected to the AP is effected in the DoS attack
Broadcast: In Broadcast all the Clients connected to the AP are effected in the DoS attack
To open the AP – DoS Threat Details dialog, select the AP – DoS threat row on the Forensics screen, and click
Details. The AP – DoS Threat Details dialog opens.
AP – DoS Threat Details dialog
AP DoS Threat – Association tab
The fields in Association Tab are as follows:
AP
Client: Incase of Unicast, a single Client name appears, click the Client name, the Client Details screen
opens. Incase of Broadcast, All Clients is displayed in the Client name.
Forensics Tab
SpectraGuard® Enterprise User Guide
168
Association Start Time
Association End Time
Locate Click Locate, the Location dialog opens. In case of Unicast, select the AP/Client/DoS Attacker
participating in the event from Locate Device drop down list. Incase of Broadcast, select the AP/DoS
Attacker participating in the event from Locate Device drop down list. Select Start Time of Association and
End Time of Association from At drop down list. Click Locate the location of the selected device at the
selected time is displayed.
AP DoS Threat – Prevention tab
Click on Prevention Tab in the AP – DoS Threat Details dialog.
AP – DoS Threat Details – Prevention tab
The fields in Prevention tab are as follows:
AP
Client: Incase of Unicast, a single Client name appears, click the Client name, the Client Details screen
opens. Incase of Broadcast, All Clients is displayed in the Client name.
Association Start Time
Association End Time
Quarantine: Specifies the action taken during the association, whether the device was Salvaged/Not
Salvaged. Salvage unblocks the effected communication of the Authorized AP. Click Salvaged, the
Quarantine Details dialog opens. Click Not Salvaged, the Not Quarantined Reason dialog opens
AP DoS Threat – Admin Tab
Click on Admin Tab in the AP – DoS Threat Details dialog.
Forensics Tab
SpectraGuard® Enterprise User Guide
169
AP – DoS Threat Details – Admin tab
The fields in Admin tab are as follows:
User
Action
Time
Client Based Threats
The Client Based Threats Details dialog gives information about the Client based threat, which helps you determine
the actions taken after the threat was detected.
To open the Client Based Threat Details dialog, select a Client Threat row on the Forensics scree,n and click Details.
The Client Based Threat Details dialog has the following tabs namely: Association, Prevention, and Admin. By
default, the Association tab appears.
Forensics Tab
SpectraGuard® Enterprise User Guide
170
Client Based Threat Details dialog
Client Based Threat – Association Tab
Association Tab shows the number of connection attempts that where made to the Client selected for the duration of
the selected Event. The fields in Association Tab are as follows:
Client: In case of Client based threats, Client is the Primary Device. Click Client, the Client Details dialog
opens.
AP: AP is the device which is associated to the Primary Device. Click AP, the AP Details dialog opens.
Association Start Time: Specifies the start time when the Client associates with the AP.
Association End Time: Specifies the end time when the Client ends association with the AP.
Locate: Click Locate, the Location dialog opens. Select the AP/Client participating in the event from Locate
Device drop down list. Select Start Time of Association and End Time of Association from At drop down
list. Click Locate the location of the selected device at the selected time is displayed in the Thermometer
View. Click Floor Map View to view the location of the selected device at the selected time in the Floor Map
View.

Navigation menu