Table of Contents

Getting Started

Overview

Working in TRITON - Web Security

Navigating in TRITON - Web Security

Reviewing, saving, and discarding changes

Today: Health, Security, and Value Since Midnight

Customizing the Today page

Monitoring Web Security status

History: Last 30 Days

Time and bandwidth saved

Customize the History page

Your subscription

Managing your account through the MyWebsense Portal

Configuring your account information

The Websense Master Database

Real-time database updates

Real-Time Security Updates™

Configuring database downloads

Websense Technical Support

Internet Usage Filters

Filtering categories and protocols

New Master Database categories and protocols

Special categories

Risk classes

Security protocol groups

Filtering actions

Using quota time to limit Internet access

Search filtering

Working with filters

Creating a category filter

Editing a category filter

Creating a protocol filter

Editing a protocol filter

Websense-defined category and protocol filters

Category and protocol filter templates

Configuring Websense filtering settings

Clients

Working with clients

Working with computers and networks

Working with users and groups

Directory services

Windows Active Directory (Mixed Mode)

Windows Active Directory (Native Mode)

Novell eDirectory and Oracle (Sun Java) Directory Server

Advanced directory settings

Working with custom LDAP groups

Adding or editing a custom LDAP group

Adding a client

Searching the directory service

Changing client settings

Password override

Account override

Moving clients to roles

Working with hybrid filtering clients

Internet Filtering Policies

The Default policy

Working with policies

Creating a policy

Editing a policy

Assigning a policy to clients

Filtering order

Filtering a site

Block Pages

Blocking graphical advertisements

Blocking embedded pages

Protocol block messages

Working with block pages

Customizing the block message

Changing the size of the message frame

Changing the logo that displays on the block page

Using block page content variables

Reverting to the default block pages

Creating alternate block messages

Using an alternate block page on another machine

Determining why a request was blocked

Request blocked by Filtering Service

Request blocked by hybrid filtering

Use Reports to Evaluate Filtering

What is Internet browse time?

Presentation reports

Copying a presentation report

Defining the report filter

Selecting clients for a report

Selecting categories for a report

Selecting protocols for a report

Selecting actions for a report

Setting report options

Customizing the report logo

Confirming report filter definition

Working with Favorites

Running a presentation report

Scheduling presentation reports

Setting the schedule

Selecting reports to schedule

Setting the date range

Selecting output options

Viewing the scheduled jobs list

Viewing job history

Reviewing scheduled presentation reports

Investigative reports

Summary reports

Anonymizing investigative reports

The Anonymous option

Multi-level summary reports

Flexible detail reports

Columns for flexible detail reports

User Activity Detail reports

User activity detail by day

User activity detail by month

Category mapping

Standard reports

Favorite investigative reports

Saving a report as a Favorite

Generating or deleting a Favorite report

Modifying a Favorite report

Scheduling investigative reports

Managing scheduled investigative reports jobs

Outliers reports

Output to file

Printing investigative reports

Accessing self-reporting

Real-Time Monitor

Real-Time Monitor in Multiple Policy Server Deployments

Scanning and SSL Bypass Options

Scanning options

Content categorization

Tunneled protocol detection

Security threats: Content scanning

Security threats: File scanning

Advanced options

Scanning exceptions

Data files used with scanning

Reporting on scanning activity

How scanning is logged

SSL decryption bypass

Configure Hybrid Filtering

Activate your hybrid filtering account

Define the locations filtered by hybrid filtering

Adding filtered locations

Editing filtered locations

Managing explicit proxies

Adding an explicit proxy

Editing an explicit proxy

Specify sites not filtered by hybrid filtering

Adding unfiltered destinations

Editing unfiltered destinations

Configure user access to hybrid filtering

Adding domains

Editing domains

Customizing hybrid block pages

Enabling HTTPS notification pages

What is a PAC file?

Send user and group data to the hybrid service

Configure Directory Agent settings for hybrid filtering

Configure how data is gathered for hybrid filtering

Oracle (Sun Java) Directory Server and hybrid filtering

Novell eDirectory and hybrid filtering

Adding and editing root contexts

Optimizing search results

Schedule communication with hybrid filtering

Monitor communication with the hybrid service

View hybrid service authentication reports

Filter Users Off Site

Using remote filtering software

When server communication fails

Configuring Remote Filtering settings

Configure remote filtering to ignore FTP or HTTPS traffic

Configure the Remote Filtering Client heartbeat interval

Applying hybrid filtering to off-site users

Configuring hybrid filtering for off-site users

Off-site user self-registration

Protect Vital Information

Refine Filtering Policies

Restricting users to a defined list of Internet sites

Limited access filters and filtering precedence

Creating a limited access filter

Editing a limited access filter

Adding sites from the Edit Policy page

Copying filters and policies to roles

Building filter components

Working with categories

Editing categories and their attributes

Reviewing all customized category attributes

Making global category filtering changes

Renaming a custom category

Creating a custom category

Filtering based on keyword

Defining keywords

Redefining filtering for specific sites

Defining unfiltered URLs

Recategorizing URLs

Prioritizing Security Risk categorization

Blocking posts to sites in some categories

Working with protocols

Filtering protocols

Editing custom protocols

Adding or editing protocol identifiers

Renaming a custom protocol

Making global protocol filtering changes

Creating a custom protocol

Adding to a Websense-defined protocol

Using Bandwidth Optimizer to manage bandwidth

Configuring the default Bandwidth Optimizer limits

Managing traffic based on file type

Working with file types

Adding custom file types

Adding file extensions to a file type

Using regular expressions

Using the Toolbox to verify filtering behavior

URL Category

Check Policy

Test Filtering

URL Access

Investigate User

Identifying a user to check policy or test filtering

User Identification

Transparent identification

Transparent identification of remote users

Manual authentication

Configuring user identification methods

Setting authentication rules for specific machines

Defining exceptions to user identification settings

Revising exceptions to user identification settings

Secure manual authentication

Generating keys and certificates

Activating secure manual authentication

Accepting the certificate within the client browser

DC Agent

Configuring DC Agent

Logon Agent

Configuring Logon Agent

RADIUS Agent

Processing RADIUS traffic

Configuring the RADIUS environment

Configuring RADIUS Agent

Configuring the RADIUS client

Configuring the RADIUS server

eDirectory Agent

Special configuration considerations

Configuring eDirectory Agent

Adding an eDirectory server replica

Configuring eDirectory Agent to use LDAP

Enabling full eDirectory Server queries

Configuring multiple agents

Configuring different settings for an agent instance

INI file parameters

Configuring an agent to ignore certain user names

Identification of hybrid filtering users

Deploying Web Endpoint

Distributing Web Endpoint via GPO

Deploying Websense Authentication Service

Websense Directory Agent

Directory Agent and User Service

When users are not identified

Delegated Administration and Reporting

The fundamentals of delegated administration

Delegated administration roles

Delegated administrators

Delegated administration and reporting permissions

Administrators in multiple roles

Multiple administrators accessing TRITON - Web Security

Preparing for delegated administration

Creating a Filter Lock

Locking categories

Locking protocols

Preparing delegated administrators

Managing delegated administration roles

Adding roles

Editing roles

Adding Administrators

Adding managed clients

Managing role conflicts

Updating delegated administration roles

Delete roles

Delete managed clients

Managing Super Administrator clients

Performing delegated administrator tasks

View your user account

View your role definition

Add clients to the Clients page

Create policies and filters

Apply policies to clients

Generate reports

Reviewing administrator accounts

Enabling network accounts

Web Security Server Administration

Websense Web Security product components

Filtering components

Reporting components

User identification components

Interoperability components

Understanding the Policy Database

Working with Policy Server

Reviewing Policy Server connections

Adding or editing Policy Server instances

Working in a multiple Policy Server environment

Changing the Policy Server IP address

Working with Filtering Service

Review Filtering Service details

Review Master Database download status

Resuming Master Database downloads

Working with Content Gateway

Managing Content Gateway connections

Viewing and exporting the audit log

Stopping and starting Websense services

Websense Web Security installation directories

Alerting

Flood control

Configuring general alert options

Configuring system alerts

Configuring category usage alerts

Adding category usage alerts

Configuring protocol usage alerts

Adding protocol usage alerts

Reviewing current system status

Backing up and restoring your Websense data

Scheduling backups

Running immediate backups

Maintaining the backup files

Restoring your Websense data

Discontinuing scheduled backups

Command reference

Reporting Administration

Planning your configuration

Configuring distributed logging

Managing access to reporting tools

Basic configuration

Assigning categories to risk classes

Configuring reporting preferences

Configuring how filtered requests are logged

Log Server Configuration utility

Configuring WebCatcher

Stopping and starting Log Server

Introducing the Log Database

Database jobs

Log Database administration settings

Configuring database partition options

Configuring Log Database maintenance options

Configuring how URLs are logged

Configuring Internet browse time options

Configuring investigative reports

Database connection and report defaults

Display and output options

Self-reporting

Network Configuration

Hardware configuration

Filtering IPv6 traffic

Network Agent configuration

Configuring global settings

Configuring local settings

Configuring NIC settings

Configuring monitoring settings for a NIC

Adding or editing IP addresses

Verifying Network Agent configuration

Troubleshooting

Installation and subscription issues

There is a subscription problem

Unable to verify the subscription key

After upgrade, users are missing from TRITON - Web Security

Master Database issues

The initial filtering database is being used

The Master Database is more than 1 week old

The Master Database does not download

Subscription key

Internet access

Verify firewall or proxy server settings

Insufficient disk space on the Filtering Service machine

Insufficient memory on the Filtering Service machine

Restriction applications

Master Database download does not occur at the correct time

Contacting Technical Support for database download issues

Filtering issues

Filtering service is not running

User Service is not available

High CPU usage on the Filtering Service machine

Sites are incorrectly categorized as Information Technology

Keywords are not being blocked

Custom or limited access filter URLs are not filtered as expected

A user cannot access a protocol or application as expected

An FTP request is not blocked as expected

Websense software is not applying user or group policies

Remote users are not filtered by correct policy

Network Agent issues

Network Agent is not installed

Network Agent is not running

Network Agent is not monitoring any NICs

Network Agent can't communicate with Filtering Service

Update Filtering Service IP address or UID information

Insufficient memory on the Network Agent machine

High CPU usage on the Network Agent machine

User configuration and identification issues

User and group-based policies are not applied

DC Agent has insufficient permissions

DC Agent unable to access required file

General DC Agent troubleshooting

Users are incorrectly filtered by the Default policy

Troubleshooting Logon Agent

Group Policy Objects

Domain controller visibility

NetBIOS

User profile issues

Troubleshooting eDirectory Agent

Enabling eDirectory Agent diagnostics

eDirectory Agent miscounts eDirectory Server connections

Running eDirectory Agent in console mode

Troubleshooting RADIUS Agent

Running RADIUS Agent in console mode

I cannot add users and groups to TRITON - Web Security

Directory service connectivity and configuration

Directory service configuration in TRITON - Web Security

User identification and Windows Server 2008

Turning on the Computer Browser service

Changing DC Agent, Logon Agent, and User Service permissions

User Service on Linux

Remote users are not prompted for manual authentication

Remote users are not being filtered correctly

Block message issues

No block page appears for a blocked file type

Users receive a browser error instead of a block page

A blank white page appears instead of a block page

Protocol block messages don't appear as expected

A protocol block message appears instead of a block page

Log, status message, and alert issues

Where do I find error messages for Websense components?

Websense Health alerts

Two log records are generated for a single request

Usage Monitor is not available

Usage Monitor is not running

Policy Server and Policy Database issues

I forgot my password

I cannot log on to Policy Server

The Websense Policy Database service fails to start

Policy Server stops unexpectedly

Delegated administration issues

Managed clients cannot be deleted from role

Logon error says someone else is logged on at my machine

Some users cannot access a site in the Unfiltered URLs list

Recategorized sites are filtered according to the wrong category

I cannot create a custom protocol

Log Server and Log Database issues

Log Server is not running

Low disk space on the Log Server machine

No Log Server is installed for a Policy Server

Log Database was not created

Log Database is not available

Log Database size

Configure Log Server to use a database account

Log Server is not recording data in the Log Database

Updating the Log Server connection account or password

Configuring user permissions for Microsoft SQL Server

Log Server cannot connect to the directory service

Wrong reporting page displayed

Investigative report and presentation report issues

Presentation Reports Scheduler not connected to Log Database

Inadequate disk space to generate presentation reports

Scheduled jobs in presentation reports failed

Data on Internet browse time reports is skewed

Bandwidth is larger than expected

Some protocol requests are not being logged

All reports are empty

Database partitions

SQL Server Agent job

Log Server configuration

Microsoft Excel output is missing some report data

Saving presentation reports output to HTML

Error generating presentation report, or report does not display

Investigative reports search issues

General investigative reports issues

Other reporting issues

Low memory on the Real-Time Monitor machine

Real-Time Monitor is not running

Real-Time Monitor is not responding

Cannot access certain reporting features

No charts appear on Today or History pages

Interoperability issues

Content Gateway is not running

Content Gateway is not available

Content Gateway non-critical alerts

Administrator unable to access other TRITON modules

Sync Service is not available

Sync Service has been unable to download log files

Sync Service has been unable to send data to Log Server

Hybrid filtering data does not appear in reports

Disk space is low on the Sync Service machine

The Sync Service configuration file

Directory Agent is not running

Directory Agent cannot connect to the domain controller

Directory Agent communication issues

Directory Agent does not support this directory service

The Directory Agent configuration file

Directory Agent command-line parameters

Alerts were received from the hybrid service

Unable to connect to the hybrid service

Hybrid service unable to authenticate connection

Missing key hybrid configuration information

User access no longer filtered following upgrade

Troubleshooting tips and tools

Where is the Websense "bin" directory?

The Windows Services dialog box

The Windows Event Viewer

The Websense log file