How to Integrate WSA in AWSR

[ccg-security]

We would like to know how to integrate WSA in AWSR?

[Handy Putra]

Hi,

AWSR is an extension for reporting(with more granular controls and options) purposes for WSA. This will require a separate license for AWSR to be purchased.

You will need to install the AWSR image to your either windows server or Linux server. See below for the hardware requirements (release note):

https://www.cisco.com/c/dam/en/us/td/docs/security/wsa/Advanced_Reporting/WSA_Advanced_Reporting_6/Advanced_Reporting_release_notes_6x.pdf

To integrate with WSA, you will need to push the WSA logs to the AWSR as a raw file for AWSR to build up its reporting database and display the reporting.

WSA logs that you can push to AWSR for advance reporting are:

Accesslogs

AMP logs

Trafmon logs.

And the push method can be either via FTP or Syslog.

Please see below link for more information and steps by steps guide on how to configure that:

https://www.cisco.com/c/dam/en/us/td/docs/security/wsa/Advanced_Reporting/WSA_Advanced_Reporting_6/Advanced_Web_Security_Reporting_6_3.pdf

Hope this helps.

Regards

Handy Putra

[silvercrow06]

hi, on WSA log subscription > access logs > remote on FTP, we're having problem on setting up the directory. we have this directory C:\Program Files\Cisco\wsa_wsa170.ironportmgmt.com\wsa_accesslogs, and we don't see any logs from WSA.

[Handy Putra]

Hi,

you can check from WSA system_logs to see if the log push having trouble to get the reason.

Also make sure that you have set permission of that folder/file (share) and nothing in the network path that might blocking the connection.

Regards

Handy Putra