Product Documentation

Use cases

May 24, 2018

This document inculdes the following Secure Web Gateway (SWG) Analytics use cases:

Monitoring the SSL Interceptions

A NetScaler SWG appliance enables you to inspect your encrypted outbound traffic. You can intercept, bypass, or block any HTTPS requests on the basis of policies configured on the appliance. NetScaler MAS provides the following details about the SSL connections in the Outbound Traffic Dashboard for a selected time frame:

  • Number of SSL connections that are intercepted, not intercepted, and reset by the NetScaler SWG appliance
  • Transaction details of the SSL connections

Using these details, you can further fine tune the policies on your NetScaler SWG appliance to efficiently inspect the encrypted outbound traffic. For more information, see NetScaler Secure Web Gateway.

To display the number of SSL connections that have been intercepted, not intercepted, and reset:

Navigate to Applications > Outbound Traffic Dashboard. The Outboard Traffic Dashboard displays the number of SSL connections that are intercepted, not intercepted, and reset.

localized image

To display the transaction details of the SSL connections that have been intercepted:

1. Navigate to Applications > Outbound Traffic Dashboard.
2. On the Outboard Traffic Dashboard, click the total count in the SSL INTERCEPTS section.

localized image

The transaction details of the SSL connections that were intercepted during the selected time frame are displayed on the Transaction Details page.

localized image

You can further filter the transactions details by user and URL category.

To view the transaction details of the SSL connections on which traffic was not intercepted:
1. Navigate to Applications > Outbound Traffic Dashboard.
2, In the Outboard Traffic Dashboard, click the total count in the Not-intercepted SSL Connections section.

localized image

The transaction details of the SSL connections on which traffic was not intercepted during the selected time frame appear in the Transaction Details page.

localized image

You can further filter the transactions details by user and URL category.

To display the transaction details of the SSL connections that are reset:
1. Navigate to Applications > Outbound Traffic Dashboard.
2. On the Outboard Traffic Dashboard, click the total count in the Reset SSL Connections section.

localized image

The transaction details of the SSL connections on which traffic was not intercepted during the selected time frame appear on the Transaction Details page.

localized image

You can further filter the transactions details by the user and URL category.

Inspecting Endpoints

The policies you have configured on a NetScaler SWG appliance specify how the appliance logs all the user activities performed in your enterprise. NetScaler MAS provides key metrics that you can use to determine:

  1. Browsing behavior of users in your enterprise.
  2. URL categories accessed by the users in your enterprise.
  3. Top five users, based on their risk scores and the bandwidth they consume. For more information about risk scores, see Risk Score.
  4. Browsers used to access the URLs or domains.
  5. Amount web traffic generated by the users, based on the traffic reputation score.

For example, if a user with user id testuser3 constantly accesses malware related sites in your enterprise, NetScaler MAS identifies the user as high-risk activity user and assigns a higher risk score. The testuser3 information is displayed in the Top Users section of the User Dashboard.

localized image

You can click on testuser3 to filter the User Dashboard to display all the key metrics related to testuser3.

localized image

In the User Activity Investigation pane, the high-risk activity of testuser3 is displayed as events in the respective URL categories.

localized image

You can hover over the events to display the number of events, and you can click on events to investigate the transactions that occurred during the events.

localized image

With this information, you can determine whether the user’s system is infected by malware, or you can understand the bandwidth consumption pattern of the user and fine-tune your NetScaler SWG policies. For more information, see NetScaler Secure Web Gateway Documentation.

Reporting Bandwidth Consumption

The Outbound Traffic Dashboard and the User Dashboard provide multiple charts that summarize the websites or applications accessed from the enterprise network, and the activities performed by the users in your network.

The Outbound Traffic Dashboard provides the details of data-volume consumption by the URLs or domains that were accessed from your network. Navigate to Applications > Outbound Traffic Dashboard, where the data volume details are shown in the Data Volume section.

localized image

In the Outbound Traffic Overview pane, you can click on a domain or URL to display the details of the data volume consumed by the domain or URL.

localized image

The User Dashboard provides details about the bandwidth consumed by the users in your network. Navigate to Users > Dashboard to display the details of the bandwidth consumed by users in the DATA VOLUME section in the User Dashboard.

localized image

You can view the details of the bandwidth consumed by a user by selecting the user from the Top Users section. The DATA VOLUME section and other key metrics in the chart are filtered for the selected user.

localized image

Using these details, you can understand the bandwidth consumption and the reason for the consumption. For example, if a user is accessing social networking websites and this has caused a lot of bandwidth consumption, the administrator can access the NetScaler SWG appliance and configure a URL List feature to control access to the websites. For more information, see Use Case: URL Filtering by using Custom URL Set topic.

Viewing Outbound Traffic Distribution

The NetScaler SWG appliance provides URL categorization and filtering features that you can use to categorize the URLs that are accessed from your network. In NetScaler MAS, the Outbound Traffic Dashboard includes an Outbound Traffic Overview pane. In the Outbound Traffic Overview pane, NetScaler MAS groups the accessed URLs or domains into categories, such as Shopping, News, Mobile, and so on to show the outbound traffic distribution in your network. For a selected time frame, you can click on the URL, to understand the:

  1. Bandwidth consumed by accessing the URL
  2. Transactions that occurred while accessing the URL
  3. Number of SSL connections that were intercepted, not intercepted, and reset while accessing the URL

With this information, you can understand the outbound traffic pattern and make corrective decisions, such as whether to block certain URLs.

To view Outbound Traffic Distribution:
Navigate to Applications > Outbound Traffic Dashboard. The Outboard Traffic Dashboard displays the URLs in the Outbound Traffic Overview pane:

localized image

If you want to view the details of a particular URL, select the URL.

Using this information, you can understand the outbound traffic pattern and control your network traffic using a URL Filter configured on your SWG appliance. For more information, see URL Filtering.