Chat now with support
Chat with Support

Welcome, erwin customers to Quest Support Portal click here for for frequently asked questions regarding servicing your supported assets.

InTrust 11.3 - InTrust Reports

Security

Advanced Forensic Analysis

Faults

Audit subsystem faults

This InTrust report displays ISA Server audit subsystem faults. It helps you identify logging and auditing problems. In some cases, these faults are specifically provoked to prevent logging. Therefore, such situations need to be monitored.

ISA services faults

This InTrust report displays ISA Server audit subsystem faults. It helps you identify logging and auditing problems. In some cases, these faults are specifically provoked to prevent logging. Therefore, such situations need to be monitored.

ISAS miscellaneous faults

This InTrust report shows miscellaneous faults, such as network configuration errors or insecure configuration errors.

ISAS Packet filtering faults

This InTrust report helps you analyze problems related to packet filtering, such as packet filtering protocol violations, disabled packet filtering, and others. Use the Events filter to specify what events will be included in the report.

Network Activity

Firewall all connections

This InTrust report helps you analyze sessions that take place through the firewall.

Firewall all connections [detailed]

This InTrust report helps you perform a detailed analysis of connections through the firewall.

Requests by Network [chart]

This InTrust report shows how many requests were received by the selected destination network from the selected source networks in the specified time period. The report is based on data from the ISAS Firewall and ISAS WebProxy logs.

VPN Sessions [by Server and User]

This InTrust report shows the VPN sessions grouped by RAS server and User. Information shown includes session duration and volume of the transferred data. Report is based on data from Windows System Log.

Web proxy all requests

This InTrust report helps you analyze Web proxy requests.

Server Management

ISA services tracking

This InTrust report displays tracking events (start, stop, pause, and resume) for ISAS services (Firewall Service, Web Proxy Service, and ISAS Control Service). Use the Events filter to specify which service tracking events will be included in the report.

Common Security Incidents

Attacks

Network Probes

  • Firewall port scanning

This InTrust report displays information on frequent sessions (or series) of port scanning. Port scanning is used by intruders to detect server configuration.

  • Firewall well-known ports connection attempts

Intruders scan well-known ports to determine specific services available on the server. Well-known ports are those with numbers from 0 to 1023. You can use the Ports filter to limit the report to a subset of these ports.

Firewall triggered rules

To prevent unwarranted access to resources, firewall rules are configured. When a firewall rule is triggered due to a corporate policy violation, an event is logged in the ISAS Firewall log. This InTrust report helps you determine who violated the firewall policy.

ISAS built-in intrusion detection

This InTrust report shows information on several well-known types of attacks detected by ISA Servers built-in intrusion detection system. The report provides information on spoof attacks, ping-of-death attacks, UDP bomb attacks, and others.

Prohibited User Activity

Web proxy web surfing daily statistics

This InTrust report displays attempts to browse restricted web pages by user. You can use the Restricted Pages filter to define what pages are proscribed. To do it, add a list of keywords to the filter. Such pages may include pornography or e-commerce sites.

Usage Statistics

ISA Firewall

Firewall daily traffic [chart]

This InTrust chart shows statistics on daily requests for ISA Firewall service.

Firewall total statistics

This InTrust report provides aggregate statistics for ISA Firewall service.

Firewall users activity daily distribution

This InTrust chart shows the daily activity levels of ISA Firewall clients.

Firewall users activity hourly distribution

This InTrust chart shows the hourly activity levels of ISA Firewall clients.

ISA Web Proxy

Authenticated Clients Audit and Statistics

Web proxy site requests by date

Web proxy site requests by user

Web proxy traffic by user [chart]

This InTrust chart provides traffic statistics (in Kbytes) for Web Proxy authenticated clients.

Files Statistics

Web proxy file downloads

This InTrust report lists all potentially dangerous files downloaded by the Web Proxy clients.

General Information

Web proxy daily traffic [chart]

This InTrust chart shows the daily incoming/outgoing traffic of ISA Web Proxy service.

Web proxy total statistics

This InTrust report provides aggregate statistics for ISA Web Proxy service.

Hosts Audit and Statistics

Web proxy requests statistics

This InTrust report contains information on all requests for ISA Web Proxy hosts.

Web proxy traffic by host [chart]

This InTrust chart provides traffic statistics (in Kbytes) for ISA Web Proxy hosts.

Report Pack_VMware vCenter_ESX_ESXi

VMware vCenter and ESX/ESXi Reports

This section contains a list of reports included in the InTrust11.3 VMware vCenter and ESX/ESXi Reports. These reports are based on VMware vCenter, ESX and ESXi tasks and events retrieved via vSphere Web Services SDK.

VMware vCenter and ESX/ESXi

Virtual machine creations and deletions

This InTrust report shows information about virtual machine creation, deletion and cloning.

Virtual machine reconfigurations

This InTrust report shows virtual machine configuration changes.

Virtual machine snapshot activity

This InTrust report shows all captured activity that involves snapshots: creation, deletion and reversion.

Virtual machine startups and shutdowns

This InTrust report shows all virtual machine starts, shutdowns, suspends, and details as to who initiated them and when they happened.

VMware All Events

This InTrust report shows all events related to VMware vCenter and ESX/ESXi.

VMware ESX Configuration Changes

This InTrust report shows events related to vCenter and ESX/ESXi server configuration changes, such as account, host and data store management.

VMware Permission Changes

This InTrust report shows permission changes on virtual machines. The report refers to users and groups that get role-based permissions as grantees.

VMware User Logon and Logoff

This InTrust report shows all user logon and logoff attempts, both successful and failed, and provides reason information for the failed attempts.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating