Zyxel Cloud CNM SecuReporter - SecuReporter User's Guide

Default Login Details

User’s Guide

SecuReporter

User Name myZyxel.com User Name

Password myZyxel.com Password

Version 2.5 Edition 1, 03/2021

IMPORTANT! READ CAREFULLY BEFORE USE. KEEP THIS GUIDE FOR FUTURE REFERENCE.

Screenshots and graphics in this book may differ slightly from what you see due to differences in release versions or your computer operating system. Every effort has been made to ensure that the information in this manual is accurate.

Note: The version number on the cover page refers to the version number you can see on the

bottom of the log in screen of the SecuReporter.

Document Conventions

Warnings and Notes

These are how warnings and notes are shown in this guide.

Warnings tell you about things that could harm you or your device.

Note: Notes tell you other important information (for example, other things you may need to

configure or helpful tips) or recommendations.

Syntax Conventions

• The Cloud CNM SecuReporter may be referred to as the “SecuReporter” in this guide.

• Product labels, screen names, field labels and field choices are all in bold font.

• A right angle bracket (>) within a screen name denotes a mouse click. For example, Analysis > Security Indicator > URL Threat Filter > by Destination IP means you first click Analysis in the navigation panel, then the Security Indicator sub menu, then the URL Threat Filter tab, and finally the by Destination IP tab to get to that screen.

SecuReporter User’s Guide

Table of Contents

Document Conventions ............................................ ................................................ ..........................3

Table of Contents.................................................................................................................................4

Chapter 1

Introduction ..........................................................................................................................................6

1.1 Overview ........................................................................................................................................... 6

1.1.1 Supported Zyxel Devices and Firmware Versions ................................................................ 6

1.1.2 SecuReporter Management Privileges ................................................................................ 7

1.1.3 License Options ....................................................................................................................... 8

1.2 Get Started ........................................................................................................................................ 8

1.3 Title Bar ............................................................................................................................................... 9

1.4 Threat History ................................................................................................................................... 10

1.4.1 Details ..................................................................................................................................... 11

1.5 Dashboard ...................................................................................................................................... 12

Chapter 2

Analysis...............................................................................................................................................15

2.1 Overview ......................................................................................................................................... 15

2.1.1 Tutorial .................................................................................................................................... 15

2.1.2 Sandboxing ............................................................................................................................ 18

2.1.3 Sandboxing Alerts ................................................................................................................. 20

2.2 Analysis Overview ........................................................................................................................... 20

2.3 Security Indicators .......................................................................................................................... 22

2.3.1 ADP ......................................................................................................................................... 22

2.3.2 IP Reputation ......................................................................................................................... 24

2.3.3 IDP ........................................................................................................................................... 25

2.3.4 DNS Filter ................................................................................................................................ 27

2.3.5 URL Threat Filter ...................................................................................................................... 29

2.3.6 Antivirus / Malware ............................................................................................................... 31

2.3.7 Sandboxing ............................................................................................................................ 32

2.3.8 Mail Protection ...................................................................................................................... 34

2.4 Application / Website .................................................................................................................... 36

Chapter 3

Logs.....................................................................................................................................................41

3.1 Overview ......................................................................................................................................... 41

3.2 Log Search ...................................................................................................................................... 41

3.2.1 Log Search Privileges ............................................................................................................ 42

3.2.2 Security Log Categories ....................................................................................................... 43

SecuReporter User’s Guide

Table of Contents

3.2.3 Event Log Categories ........................................................................................................... 49

3.2.4 Traffic Log Categories .......................................................................................................... 52

3.3 User ................................................................................................................................................... 54

3.3.1 Details ..................................................................................................................................... 55

Chapter 4

Alerts ...................................................................................................................................................58

4.1 Overview ......................................................................................................................................... 58

4.2 Trend & Details ................................................................................................................................ 58

4.3 Configuration .................................................................................................................................. 60

Chapter 5

Report..................................................................................................................................................65

5.1 Overview ......................................................................................................................................... 65

5.2 Summary Reports ............................................................................................................................ 65

5.3 Report Configuration ..................................................................................................................... 67

Chapter 6

Settings................................................................................................................................................70

6.1 Overview ......................................................................................................................................... 70

6.2 Organization & Device .................................................................................................................. 70

6.2.1 Add a Zyxel Device to an Organization ............................................................................. 71

6.2.2 Claimed Device .................................................................................................................... 74

6.3 User Account .................................................................................................................................. 75

Chapter 7

Troubleshooting..................................................................................................................................78

7.1 Getting More Troubleshooting Help ............................................................................................. 80

Appendix A Customer Support ....................................................................................................... 81

Appendix B Legal Information ......................................................................................................... 87

Index...................................................................................................................................................88

SecuReporter User’s Guide

CHAPTER 1

Introduction

1.1 Overview

SecuReporter is a cloud-based analytics tool that is part of the Cloud CNM suite developed by Zyxel. It aggregates logs of supported Zyxel Device across distributed locations, giving network administrators a centralized view of security events and flow data.

SecuReporter can collect data from different types of Zyxel Device models, including the Zyxel Security Gateway/AP/Switch series, with up to 40,000 units supported simultaneously.

Reports are generated using security intelligence techniques and automated data correlation with realtime traffic analytics, as opposed to merely relying on static and predefined rules. Insights relevant to a network’s security environment are available at a glance on an intuitive dashboard.

1.1.1 Supported Zyxel Devices and Firmware Versions

At the time of writing of this User’s Guide, SecuReporter supports the following Zyxel Devices:

Table 1 Supported Zyxel Devices and Firmware Version

SUPPORTED VERSION SUPPORTED MODELS

Version 4.32 and above USG20

USG20W-VPN

USG40

USG40W

USG60

USG60W

USG110

USG210

ZyWALL110

ATP200

ATP500

ATP800

Version 4.33 and above USG310

USG1100

USG1900

USG2200

ZyWALL310

ZyWALL1100

Version 4.35 and above ATP100

SecuReporter’s User’s Guide

Chapter 1 Introduction

Table 1 Supported Zyxel Devices and Firmware Version (continued)

SUPPORTED VERSION SUPPORTED MODELS

Version 4.50 and above USG FLEX 100

USG FLEX 200

USG FLEX 500

Version 4.60 and above USG FLEX 100W

USG FLEX 700

Note: If your product is not listed in the table above, please refer to the official

announcement posted in https://www.zyxel.com/products_services/Security-ServiceCloud-CNM-SecuReporter/license-and-spec for the SecuReporter’s availability.

Screens and widgets vary depending on the Zyxel Devices that you use. This table summarizes some of the features that are only available for the ZyWALL VPN series, ZyWALL USG series, ZyWALL and ZyWALL USG FLEX series

at the time of writing.

Table 2 Features Supported on the Zyxel Devices

ZYWALL VPN SERIES USG SERIES ATP SERIES USG FLEX SERIES

Anti Virus / Anti Malware Yes Yes Yes Yes

IDP Yes Yes Yes Yes

ADP Yes Yes Yes Yes

Mail Protection Yes Yes Yes Yes

Web Security Yes Yes Yes Yes

Application Patrol Yes Yes Yes Yes

Sandboxing Statistics No No Yes No

URL Threat Filter No No Yes Yes

IP Reputation No No Yes No

DNS Filter No No Yes No

ATP series

1.1.2 SecuReporter Management Privileges

A Zyxel Device owner can register a Zyxel Device at myZyxel. Only an owner can add Zyxel Devices to an organization. However, an owner can assign other people to manage Zyxel Devices.

SecuReporter’s User’s Guide

Chapter 1 Introduction

This table summarizes SecuReporter privileges at each level of the model:

Table 3 SecuReporter Management Privileges

ROLE TYPE SIGN IN AT MYZYXEL? PRIVILEGES

Agent (Owner) Yes • Can add/delete Zyxel Devices to/from an

Admin Yes • Can add/edit organizations

User Yes • Can configure dashboard widgets

organization

• Can add/edit organizations

• Can add/edit admin/user accounts

• Can configure alert notifications

• Can configure dashboard widgets

• Can configure analyses and reports

• Can create request for transfer of analytics and logs

• Can import analytics and logs

• Can create log download request and download archived logs

• Can configure alert notifications

• Can configure dashboard widgets

• Can configure analyses and reports

• Can import analytics and logs

• Can download archived logs

• Can view analyses and report

• Can configure alert notifications

• Can import analytics and logs

1.1.3 License Options

You can use SecuReporter with a free 30-day Trial license or buy a 1-year Standard license (SecuReporter Premium). You will receive a renewal notification before either expires. In addition, for the standard license, you will have an extra 15 day grace period to renew.

Note: SecuReporter will automatically delete logs when the grace period has expired.

1.2 Get Started

Use a browser that supports HTML5, such as Google Chrome, Mozilla Firefox, Safari, or Microsoft Edge. The recommended minimum screen resolution is 1366 by 768 pixels. In order to use SecuReporter you need to allow web browser pop-up windows from your computer.

To set up SecuReporter:

• You must enable SecuReporter on a supported Zyxel Device. Refer to the User’s Guide of the supported Zyxel Device for instructions.

• Register the Zyxel Devices using the same myZyxel account. To open an account at myZyxel, go to https://portal.myzyxel.com and click Sign Up.

• After you register the Zyxel Devices, follow the on-screen instructions to activate the SecuReporter license for the registered Zyxel Devices.

Once you are in the SecuReporter web portal, configure an organization with the Zyxel Devices.

SecuReporter’s User’s Guide

Note: See Section 6.1 on page 70 for an overview of how to get started using SecuReporter.

On your next login after configuring an organization, select an Organization first. Your registered devices will be shown in Device.

Figure 1 Select Organization and Device on Startup

1.3 Title Bar

The title bar provides some useful links that always appear over the screens below. If your Zyxel Device is in NCC mode, not all icons will be available in the Title Bar.

In this mode, which is also called cloud mode, you can manage and monitor the Zyxel Device through the Zyxel Nebula cloud-based network management system. This means you can manage devices remotely without the need of connecting to each device directly. It offers many features to better manage and monitor not just the Zyxel Device, but your network as a whole, including supported switches and gateways. Your network can also be managed through your smartphone using the Nebula Mobile app.

Chapter 1 Introduction

Table 4 NCC management Levels

Organization

Site A Site B

Device A-1 Device A-2 Device B-1 Device B-2

NCC allows different levels of management. You can configure each device on its own or configure a set of devices together as a site. You can also monitor groups of sites called organizations, as shown below.

Figure 2 Title Bar

The icons provide the following functions.

Table 5 Title Bar: Web Configurator Icons

LABEL DESCRIPTION

Click this to open the help page for the current screen or go to the Forum.

Click this to set up the following:

• Organization & Device – you see all organizations that you have already created and the Zyxel Devices (Model, Device and License Status).

• Members – to assign an administrator or user for organizations or Zyxel Devices within organizations that you created.

Click this to turn on or off SecuReporter’s Dark Mode display.

Note: This feature is not available at the time of writing of this User’s Guide.

Click this to show a list of apps provided by Zyxel available at the time of writing.

SecuReporter’s User’s Guide

Chapter 1 Introduction

Table 5 Title Bar: Web Configurator Icons (continued)

LABEL DESCRIPTION

Click this to open the myZyxel web site login page in a new tab or window.

Click this to open the NCC web site login page in a new tab or window.

Click this to open the SecuReporter web site login page in a new tab or window.

Click this to open the CNC web site login page in a new tab or window.

Click this to open the Circle web site login page in a new tab or window.

Click this to open the myZyxel web site login page in a new tab or window. You will be redirected to the Marketplace after you log in.

Click this to go to Zyxel Biz Forum, where you can get the latest Zyxel Device information and have conversations with other people by posting your messages.

Click this to view your account name, manage your account information (edit Profile, change Password, set up Two-Factor Authentication), or to log out.

1.4 Threat History

Refer to the right portion of the Dashboard to view the origins of attack packets detected by SecuReporter over the last 7 days.

The map pins identify the locations from which threats had originated. Pin color indicates the type of the attacks. A bigger pin means more threats.

SecuReporter’s User’s Guide

Figure 3 Threat History

Chapter 1 Introduction

1.4.1 Details

Click a pin on the Threat History in 7 Days on Map to view more information about the threats detected from that location.

SecuReporter’s User’s Guide

The following table describes the labels on this screen.

Table 6 Threat History

LABEL DESCRIPTION

Attack Type This displays the type of attack that was detected coming from the site. Common types

Hits This displays the number of times a single threat was sent from a site and blocked by the

Top Attack Origins This displays the percentage of the threat’s source country.

Top Attack Targets This displays the percentage of the threat’s destination country.

Top Attack Types This displays the percentage of the type of attack.

Top Attack Time Period This displays the percentage of the 3-hour time frame when the attacks occur.

Top Attackers IP Address

Top Attacked IP Address

1.5 Dashboard

Chapter 1 Introduction

of attacks include ADP, IDP, Malware (Anti Virus), spam, content filter, and mixed.

Zyxel Device. Click the arrow to arrange the threats by the number of hits.

This displays each threat’s source IP.

This displays each threat’s destination IP.

The Dashboard shows the key facts about your network’s security environment that were collected by SecuReporter in the last 30 days, 7 days, 24 hours, one hour, or custom range.

You need to create an organization with at least one Zyxel Device for information to display in the Dashboard – go to (More) (upper right icon) > Organization & Device > Add Organization.

By default, the dashboard will have the Alert Detected, License Status, Security Indicator, and Traffic Usage widgets. See Section 2.1.2 on page 18 and Section 2.1.3 on page 20 for more information about sandboxing.

Widgets are miniature views of SecuReporter’s data visualizations, the full versions of which are available under the Security Indicator and Application / Website screens.

SecuReporter’s User’s Guide

Figure 4 Default Dashboard

Chapter 1 Introduction

The following table describes the widgets on the default dashboard:

Table 7 Default Dashboard

LABEL DESCRIPTION

Alert Detected This is the total number of the latest alerts sent to administrators of a network in the last 7

License Status This shows if your SecuReporter license is active or inactive, and the number of days

Security Indicator

days.

remaining.

SecuReporter’s User’s Guide

Chapter 1 Introduction

Table 7 Default Dashboard (continued)

LABEL DESCRIPTION

Select the time frame to show your network’s security environment collected by SecuReporter.

• Last hour

• Last 24 hours

•Last 7 days

• Last 30 days (for SecuReporter Premium only)

• Custom Range (last 30 days custom range for SecuReporter Premium only) – click an

allowed start and end day, select the time frame, and then click Apply.

ADP Hits This displays the total number of anomalies detected by the Zyxel Devices. Anomalies are

based on violations of protocol standards (RFCs – Requests for Comments) or abnormal flows such as port scans.

Antivirus / Malware Hits This displays the total number of the most common malware and viruses detected and

blocked by the Zyxel Device.

URL Threat Filter Hits This displays the total number of times the Zyxel Device’s URL Threat filtering service

detected and blocked connection attempts to or from a site in an URL threat category.

IP Reputation Hits This displays the total number of times packets coming from an IPv4 address with a bad

IDP Hits This displays the total number of malicious or suspicious packets detected by IDP in the

Mail Protection Hits This displays the total number of the most common traffic classified as spam received by

Sandboxing Alerts This displays the total number of files that have been scanned through the sandboxing

DNS Filter Hits This displays the total number of URLs of FQDNs classified as a security threat to network

Traffic Usage

Top 3 Bandwidth User This displays the top three users of bandwidth on the network including percentage over

Top 3 Application Usage

Top 3 Destination Country

Top 3 Destination Port This displays the top three destination ports by bandwidth usage including percentage,

reputation occur and the number of times connection attempts to an IPv4 address with a bad reputation occur.

Zyxel Devices. IDP (Intrusion, Detection and Prevention) uses signatures to detect malicious or suspicious packets to protect against network-based intrusions.

the Zyxel Devices.

function.

devices behind the Zyxel Device.

Select the time frame to show your network traffic collected by SecuReporter.

• Last hour

• Last 24 hours

•Last 7 days

• Custom Range – click an allowed start and end day, select the time frame, and then

click Apply.

a selected time frame, which is 7 days by default.

This displays the network applications with the greatest bandwidth usage including percentage over a selected time frame, which is 7 days by default.

This displays the top three countries that received the most data traffic from Zyxel Devices including percentage, over a selected time frame.

over a specified time frame, which is 7 days by default.

SecuReporter’s User’s Guide

2.1 Overview

Analysis is a set of charts, tables, and other visualizations of data collected from Zyxel Devices. Analysis

provides a big-picture overview of network activity, while making it easy to “drill down” into granular detail on what users are doing.

2.1.1 Tutorial

In the Analysis section, the charts can be clicked to reveal event records.

In most cases, you can choose to analyze data collected over one of five time frames (see Section 1.5

on page 12):

•Last hour

• Last 24 hours

•Last 7 days

• Last 30 days (for SecuReporter Premium only)

• Custom Range (last 30 days custom range for SecuReporter Premium only) – click an allowed start

and end day, select the time frame, and then click Apply.

CHAPTER 2

Analysis

This tutorial uses the following example to show how to explore an URL threat filter hit detail that you want to investigate, specifically by destination IP.

1 Click Analysis > Security Indicator > URL Threat Filter.

SecuReporter’s User’s Guide

Figure 5 Top URL Threat Filter

Chapter 2 Analysis

2 Click the by Destination IP tab. To display the next set of malware or viruses, click the arrow on the lower

left of the screen.

SecuReporter’s User’s Guide

Chapter 2 Analysis

Figure 6 Top 10 URL Threat Filter Hit Detail > by Destination IP

The following screen appears.

Figure 7 Next Set of Top URL Threat Filter Hit Detail > by Destination IP

3 Clicking a Destination IP will display its Threat Website address, the number of Hits, and the percentage

(%) of hits to the destination IP address.

Note: You could select different metrics by clicking a tab to view the information of the

selected metric.

Figure 8 Source IP

4 Clicking a Source IP will display its Threat Website address, the number of Hits, and the percentage (%)

of hits from the source IP address.

SecuReporter’s User’s Guide

Figure 9 Source IP Information

Chapter 2 Analysis

2.1.2 Sandboxing

Zyxel cloud sandboxing is a security mechanism which provides a safe environment to separate running programs from your network and host devices. Unknown or untrusted programs or codes are uploaded to a cloud server and executed within an isolated virtual machine (VM) to monitor and analyze the zero-day malware and advanced persistent threats (APTs) that may evade the Zyxel Device’s detection, such as anti-malware. Results of cloud sandboxing are sent from the server to the Zyxel Device.

The Zyxel Device sandbox checks all received files against its local cache for known malicious or suspicious codes. Files with no detected malicious or suspicious codes found in the cache (‘unknown’) are copied and uploaded to the security cloud server for further inspection. The scan result from the cloud server is added to the Zyxel Device cache and used for future inspection.

Note: The Zyxel Device forwards all unknown files to users. For files with known malicious or

suspicious codes, you can configure the Zyxel Device to take specific actions, such as dropping the file.

Note: The scan result is removed from the Zyxel Device cache after the Zyxel Device restarts,

so all files are once again ‘unknown’.

SecuReporter’s User’s Guide

Chapter 2 Analysis

Figure 10 General Zyxel Sandbox Inspection

In the Zyxel Device, you can configure Advanced Zyxel Sandbox Inspection to hold and inspect unknown downloaded files for up to 2 seconds. After 2 seconds the Zyxel Device forwards the file even if the inspection is incomplete.

Figure 11 Advanced Zyxel Sandbox Inspection

Supported File Types for Sandboxing Inspection

Sandbox can only check the types of files listed under File Submission Options in the Sandboxing screen of the Zyxel Device. If you disabled Scan and detect EICAR test virus in the Anti Malware screen, then EICAR test files will be sent to Sandbox.

The EICAR test file is a standardized test file for signature based anti-malware scanners. When the scanner detects the EICAR file, it responds in the same way as if it found a real malware. Besides straightforward detection, the EICAR file can also be compressed to test whether the anti-malware software can detect it in a compressed file.

Note: Configure this setting on your Zyxel Device.

Turning on Sandboxing on Your Zyxel Device

To use the sandboxing function, you need to register your Zyxel Device and activate the service license at myZyxel, and then turn on the sandboxing function on the Zyxel Device.

SecuReporter’s User’s Guide

2.1.3 Sandboxing Alerts

SecuReporter sends sandboxing alerts to Zyxel Device administrators when:

1 The Zyxel Device forwarded files that were later discovered to be suspicious or malicious.

Note: In this case the Zyxel Device administrator should immediately contact the receiver of

the file and advise him or her not to open it. If he or she already opened it, then urge him or her to run an up-to-date anti-malware scanner.

2 The Zyxel Device sandbox (or Security Cloud) removed infected portions of files that were suspicious or

malicious.

Note: In this case the receiver of the file will not be able to open the file. The Zyxel Device

administrator should contact the receiver of the file to let him or her know.

2.2 Analysis Overview

Chapter 2 Analysis

Click Analysis > Security Indicator to show data visualizations related to the network’s security, management and what was blocked. The following screens will be displayed.

Data is displayed in the Analysis menus as follows.

Table 8 Analysis Overview

LABEL TYPE DESCRIPTION

Security Indicator ADP ADP Trend (Hits)

Top Signature Type

Top Event Severity Type

Top Source IP

Top Destination IP

IP Reputation IP Reputation Trend (Hits)

Top Risk IP

Top Type

Top Source IP

Top Destination IP

IDP IDP Trend (Hits)

Top Signature Type

Top Event Severity Type

Top Source IP

Top Destination IP

DNS Filter DNS Filter Trend (Hits)

Top DNS Filter Domain

Top Threat Category

Top Source IP

Top Query Type

SecuReporter’s User’s Guide

Chapter 2 Analysis

Table 8 Analysis Overview (continued)

LABEL TYPE DESCRIPTION

Security Indicator URL Threat Filter URL Threat Filter Trend (Hits)

Top Threat Website

Top Type

Top Source IP

Top Destination IP

Antivirus / Malware Antivirus / Malware Trend (Hits)

Top Virus / Malware

Top Source IP

Top Destination IP

Sandboxing Sandboxing Trend (Hits)

Top File Type

Top File Name

Top File Hash

Top User

Top Source IP

Top Destination IP

Mail Protection Mail Protection Trend (Hits)

Top Spam Email Subject

Top Spam Sender Email

Top Spam Received IP

Top Spam Sender IP

Application / Website

Web Security Blocked Website Access Trend (Hits)

Allowed Website Access Trend (Hits)

Top Accessed Blocked Website

Top Accessed Blocked Website Type

Top Accessed Allowed Website

Top Accessed Allowed Website Type

Top Source IP (to Blocked Website)

Top Destination IP (to Blocked Website)

Top Source IP (to Allowed Website)

Top Destination IP (to Allowed Website)

App Patrol Blocked Application Access Trend (Hits)

Allowed Application Access Trend (Hits)

Top Accessed Blocked Application

Top Accessed Blocked Application Type

Top Accessed Allowed Application

Top Accessed Allowed Application Type

SecuReporter’s User’s Guide

2.3 Security Indicators

Security Indicators data visualizations are categorized as:

•ADP

• IP Reputation

•IDP

• DNS Filter

• URL Threat Filter

• Antivirus / Malware

•Sandboxing

• Mail Protection

2.3.1 ADP

Anomaly Detection and Prevention (ADP) protects against anomalies based on violations of protocol standards (RFCs – Requests for Comments) and abnormal flows such as port scans. This section introduces ADP, anomaly profiles and applying an ADP profile to a traffic direction.

Chapter 2 Analysis

Traffic Anomalies

Traffic anomaly policies look for abnormal behavior or events such as port scanning, sweeping or network flooding. They operate at OSI layer-2 and layer-3. Traffic anomaly policies may be updated when you upload new firmware.

Protocol Anomalies

Protocol anomalies are packets that do not comply with the relevant RFC (Request For Comments). Protocol anomaly detection includes:

•TCP Decoder

• UDP Decoder

•ICMP Decoder

Protocol anomaly policies may be updated when you upload new firmware.

The following figure shows the Analysis > Security Indicator > ADP data visualizations.

SecuReporter’s User’s Guide

Chapter 2 Analysis

Figure 12 Analyzer > Security Indicators > ADP

The following table describes the labels on the Analysis > Security Indicator > ADP screen.

Table 9 Analysis > Security Indicator > ADP

LABEL DESCRIPTION

ADP Trend (Hits) This chart displays patterns in anomalies detected by the Zyxel Devices. Anomalies are

based on violations of protocol standards (RFCs – Requests for Comments) or abnormal flows such as port scans.

Move your cursor over a trend line to display the number of threats encountered over time.

Top Signature Type This chart displays the top 3 anomalies detected by the Zyxel Device.

Scroll down to ADP Hit Detail and click the by Signature tab to display details about the anomalies that were detected.

Top Event Severity Type This chart displays the top 3 anomaly severity types detected by the Zyxel Device.

Scroll down to ADP Hit Detail and click the by Type tab to display details about the anomalies that were detected.

Top Source IP This chart displays the source IP addresses of the top 3 incoming anomalies.

Scroll down to ADP Hit Detail and click the by Source IP tab to display details about the anomalies that were detected.

Top Destination IP This chart displays the destination IP addresses of the top 3 incoming anomalies.

Scroll down to ADP Hit Detail and click the by Destination IP tab to display details about the anomalies that were detected.

SecuReporter’s User’s Guide

2.3.2 IP Reputation

When you register for and enable the IP reputation service, your Zyxel Device downloads signature files that identifies reputation of IPv4 addresses. You can have the Zyxel Device forward, block, and/or log packets from IPv4 addresses based on these signatures and categories.

The priority for IP Reputation checking is as below:

•White List

•Black List

•External Black List

• Local Zyxel Device Signatures

The following figure shows the Analysis > Security Indicator > IP Reputation data visualizations.

Figure 13 Analysis > Security Indicator > IP Reputation

Chapter 2 Analysis

SecuReporter’s User’s Guide

Chapter 2 Analysis

The following table describes the labels on the Analysis > Security Indicator > IP Reputation screen.

Table 10 Analysis > Security Indicator > IP Reputation

LABEL DESCRIPTION

IP Reputation Trend (Hits) This chart displays the number of threats posed by IPs as detected by the Zyxel Devices.

Move your cursor over a trend line to display the number of threats encountered over time.

Top Risk IP This chart displays the top 3 IP addresses detected by the Zyxel Device as detected by

Top Type This chart displays the top 3 types of threats posed by IPs detected by the Zyxel Device

IP Reputation. Scroll down to IP Reputation Hit Detail and click the by Risk IP tab to display details

about the IP addresses that were detected by IP Reputation. Click an IP address to display the details.

as detected by IP Reputation. Threat categories include Negative Reputation, TOR

Proxies, Denial of Service, Scanners, Web Attacks, Exploits, Spam Sources, Anonymous Proxies, Phishing, and Botnets.

Scroll down to IP Reputation Hit Detail and click the by Type tab to display details about the threats posed by IPs detected by the Zyxel Device as detected by IP Reputation.

Note: See more details of threat categories in the ZyWALL ATP User’s Guides.

Top Source IP This chart displays the source IP addresses of the top 3 IP addresses detected by the

Zyxel Device as detected by IP Reputation. Scroll down to IP Reputation Hit Detail and click the by Source IP tab to display details

about the source IP addresses that were detected.

Top Destination IP This chart displays the destination IP addresses of the top 3 IP addresses detected by

the Zyxel Device as detected by IP Reputation.

2.3.3 IDP

Scroll down to IP Reputation Hit Detail and click the by Destination IP tab to display details about the destination IP addresses that were detected.

An IDP profile is a set of packet inspection signatures.

A signature is a pattern of malicious or suspicious packet activity. You can specify an action to be taken if the system matches a stream of data to a malicious signature. You can change the action in the profile screens. Packet inspection examine OSI (Open System Interconnection) layer-4 to layer-7 packet contents for malicious data. Generally, packet inspection signatures are created for known attacks while anomaly detection looks for abnormal behavior.

Changes to the Zyxel Device’s IDP settings affect new sessions, but not the sessions that already exists before you apply the new settings.

The following figure shows the Analysis > Security Indicator > IDP data visualizations.

SecuReporter’s User’s Guide

Chapter 2 Analysis

Figure 14 Analysis > Security Indicator > IDP

The following table describes the labels on the Analysis > Security Indicator > IDP screen.

Table 11 Analysis > Security Indicator > IDP

LABEL DESCRIPTION

IDP Trend (Hits) This chart displays malicious or suspicious packets detected by IDP in the Zyxel Devices.

IDP (Intrusion, Detection and Prevention) uses signatures to detect malicious or suspicious packets to protect against network-based intrusions.

Move your cursor over a trend line to display the number of threats encountered over time.

Top Signature Type This chart displays the top 3 malicious or suspicious packets detected by IDP in the Zyxel

Devices. Scroll down to IDP Hit Detail and click the by Signature tab to display details about the

intrusions that were detected.

Top Event Severity Type This chart displays the top 3 malicious or suspicious packet types detected by IDP in the

Zyxel Devices. Scroll down to IDP Hit Detail and click the by Type tab to display details about the

intrusions that were detected.

SecuReporter’s User’s Guide

Table 11 Analysis > Security Indicator > IDP (continued)

LABEL DESCRIPTION

Top Source IP This chart displays the source IP addresses of the top 3 incoming malicious or suspicious

Top Destination IP This chart displays the destination IP addresses of the top 3 incoming malicious or

2.3.3.1 Threat Intelligence

Click any item in the by Signature table to view the malicious or suspicious packets detected by IDP in detail.

Figure 15 Top Signature Details

Chapter 2 Analysis

packets detected by IDP in the Zyxel Devices. Scroll down to IDP Hit Detail and click the by Source IP tab to display details about the

source IP addresses of the incoming malicious or suspicious packets.

suspicious packets detected by IDP in the Zyxel Devices. Scroll down to IDP Hit Detail and click the by Destination IP tab to display details about

the destination IP addresses of the incoming malicious or suspicious packets.

2.3.4 DNS Filter

A Domain Name System (DNS) server records mappings of FQDN (Fully Qualified Domain Names) to IP addresses. A FQDN consists of a host and domain name. For example, www.zyxel.com is a fully qualified domain name, where “www” is the host, “zyxel” is the second-level domain, and “com” is the top level domain.

DNS filtering inspects DNS queries made by clients on your network and compares the queries against a database of blocked or allowed Fully Qualified Domain Names (FQDNs).

If a user attempts to connect to a suspect site, where the DNS query packet contains an FQDN with a bad reputation, then a DSN query is sent from the user’s computer and detected by the DNS Filter.

The Zyxel Device DNS filter will either drop the DNS query or reply to the user with a fake DNS response using the default dnsft.cloud.zyxel.com URL (where the user will see a “Web Page Blocked!” page) or a custom IP address.

The following type of DNS queries is allowed by the Zyxel Device:

• Type “A” for IPv4 addresses

SecuReporter’s User’s Guide

Chapter 2 Analysis

The Zyxel Device replies with a DNS server error for the following types of DNS queries:

• Enter “AAAA” for IPv6 addresses

• Enter “NS” (Name Server) to get information about the authoritative name server

• Enter “MX” (Mail eXchange) to request information about the mail exchange server for a specific DNS domain name

• Enter “CNAME” (Canonical Names) that specifies a domain name that has to be queried in order to resolve the original DNS query

• Enter “PTR” (Pointer) that specifies a reverse query (requesting the FQDN corresponding to the IP address you provided

• Enter “SOA” (Start Of zone Authority) used when transferring zones

Click Analysis > Security Indicator > DNS Filter to display the configuration screen as shown next.

Figure 16 Analysis > Security Indicator > DNS Filter

SecuReporter’s User’s Guide

Chapter 2 Analysis

The following table describes the labels on the Analysis > Security Indicator > DNS Filter screen.

Table 12 Analysis > Security Indicator > DNS Filter

LABEL DESCRIPTION

DNS Filter Trend (Hits) This chart displays the number of URLs of FQDNs that may pose a security threat to

Top DNS Filter Domain This chart displays the URLs of FQDNs that may pose a security threat to network

Top Threat Category This chart displays the categories of FQDNs that may pose a security threat to

Top Source IP This chart displays the source IP addresses of the incoming malicious and/or

Top Query Type This chart displays the types of DNS (Domain Name System) record of the security

network devices that were scanned.

Move your cursor over a trend line to display the number of URLs of FQDNs encountered over time.

devices behind the Zyxel Device. Scroll down to DNS Filter Hit Detail and click the by DNS Filter Domain tab to display

details about the URLs of FQDNs.

network devices behind the Zyxel Device. Scroll down to DNS Filter Hit Detail and click the by Threat Category tab to display

details about the categories of FQDNs.

suspicious files. Scroll down to DNS Filter Hit Detail and click the by Source IP tab to display details

about the source IP addresses.

threat to network devices behind the Zyxel Device.

2.3.5 URL Threat Filter

When you enable the URL Threat filtering service, your Zyxel Device downloads signature files that contain known URL Threat domain names and IP addresses. The Zyxel Device will also access an external database that has millions of web sites categorized based on content. You can have the Zyxel Device allow, block, warn and/or log access to web sites or hosts based on these signatures and categories.

The priority for URL Threat checking is as below:

•White List

•Black List

•External Black List

• Local Zyxel Device Signatures

•Cloud Query Cache

•Cloud Query

The following figure shows the Analysis > Security Indicator > URL Threat Filter data visualizations.

Scroll down to DNS Filter Hit Detail and click the by Query Type tab to display details about the DNS (Domain Name System) record type.

SecuReporter’s User’s Guide

+ 66 hidden pages

Zyxel Cloud CNM SecuReporter - SecuReporter User's Guide

Specifications and Main Features

Frequently Asked Questions

User Manual

Document Conventions

Table of Contents

Introduction

1.1 Overview

1.1.1 Supported Zyxel Devices and Firmware Versions

1.1.2 SecuReporter Management Privileges

1.1.3 License Options

1.2 Get Started

1.3 Title Bar

1.4 Threat History

1.4.1 Details

1.5 Dashboard

2.1 Overview

2.1.1 Tutorial

Analysis

2.1.2 Sandboxing

2.1.3 Sandboxing Alerts

2.2 Analysis Overview

2.3 Security Indicators

2.3.1 ADP

2.3.2 IP Reputation

2.3.3 IDP

2.3.4 DNS Filter

2.3.5 URL Threat Filter