FAQ Archive - Wavecrest Knowledge Base

Understanding Data Storage for Cyfin: Cloud and On-Premises Environments

When using Cyfin, it’s important to understand how we handle and store data, whether you’re running in our cloud environment or deploying an on-premises version. This article outlines the key points for both types of deployments and explains the storage of processed and enhanced data—not raw log data.

Data Processing and Storage in Cyfin

Cyfin’s primary function is to receive a syslog data stream from firewalls or other supported sources, and then process, parse, and enhance this data. During this process, Cyfin only ingests the specific fields required for analysis and reporting. Once the data is ingested, we apply compression and store only the valuable, enriched data used for generating employee-focused web usage reports that are manager and HR-friendly. Importantly, Cyfin does not store the original raw log files sent to us; instead, we store the processed and optimized data ready for reporting and analysis.

Cloud Environment Customers: Storage Options and Costs

If you are running Cyfin in our cloud environment, your data will be securely stored within the Cyfin metric cloud ecosystem. We offer two types of storage based on your operational needs:

Cold Storage: This option is suitable for customers who do not require real-time access to their data. It offers a lower cost per gigabyte, though retrieval times may be slower. Cold storage is ideal for customers who initiate investigations based on internal requests rather than constant monitoring.
Hot Storage: For customers who need faster access to their data, hot storage provides quicker retrieval times at a higher per-gigabyte rate. This option is best suited for customers who require immediate access to the data for monitoring or investigations.

You also have the flexibility to combine both hot and cold storage to optimize cost and performance based on your retention policy. For example, if your retention policy is one year, you could use hot storage for the first three months to ensure rapid access to more recent data for investigations, and cold storage for the remaining nine months, where quick access is less critical. This hybrid approach allows you to balance speed and cost depending on your data access needs over time.

Since each customer’s storage requirements can vary based on web resource usage and the fields we ingest, we recommend starting with a proof of concept to determine the actual storage required. To obtain an accurate storage estimate for your retention policy (such as one year), you will need to syslog your live data stream and allow Cyfin to ingest data for a sufficient period. This will give you a clearer idea of your peak and slow ingestion periods and help you properly estimate long-term storage needs.

On-Premises VM Customers: Provisioning Your Own Storage

For customers installing Cyfin on an on-premises virtual machine (VM), you will need to provision storage in your own environment. Similar to our cloud offering, you will be responsible for storing the processed and enhanced data, not the raw log files. We recommend evaluating the product by syslogging your live data stream over a period long enough to capture both peak and slow periods. This will help you estimate the storage needed to retain data for your required retention policy, typically one year.

Just like with our cloud-based offering, on-premises customers can also opt to combine hot and cold storage for a more tailored solution. For instance, you might provision hot storage for data you need immediate access to and cold storage for older data that you don’t access frequently, helping you manage costs without sacrificing performance when it matters most.

Conclusion

Understanding the storage requirements for Cyfin is essential for optimizing both cost and performance. Whether you choose our cloud-based storage options or an on-premises deployment, rest assured that only the processed and enhanced data is stored, and we can tailor storage solutions to fit your specific needs. You also have the flexibility to combine hot and cold storage to balance retrieval speed and cost over time. To accurately assess storage for your retention policy, it’s critical to evaluate Cyfin by ingesting live data over a suitable period. If you need assistance calculating storage requirements or determining the best storage solution for your setup, feel free to contact our support team.

No Usernames in SonicWall Reports? Here’s Why and How to Fix It

If your Cyfin reports and dashboards are only displaying IP addresses instead of usernames, it indicates that SonicWall is not authenticating users.

Why Are There No Usernames?

Cyfin relies on SonicWall to log usernames. When SonicWall does not authenticate users, only IP addresses are captured in the log data. As a result, Cyfin will show the IP address in place of a username.

How to Enable User Authentication in SonicWall

To report on actual usernames, user authentication must be enabled on your SonicWall firewall. Here’s how to ensure usernames are included in your logs:

Configure Authentication Settings – Go to Users | Settings in your SonicWall appliance and set up an authentication method. Typically, this will be one of the following:
- LDAP + Local Users
- Active Directory Single Sign-On (SSO) using the SonicWall SSO Agent.
Force User Authentication – After configuring authentication, you need to set access rules that require users to authenticate before traffic is allowed through the firewall. For detailed instructions, refer to the SonicWall Knowledge Base article How to Force User Authentication Prior to Allowing Traffic Through the Firewall.
Verify AD SSO is Working – If you’re using Active Directory Single Sign-On, ensure it’s functioning correctly by following the test steps outlined at the end of the SonicWall guide.

By enabling authentication on your SonicWall, Cyfin will be able to log and display usernames, providing more meaningful and detailed reports.

How to Verify SonicWall is Authenticating Users

You can confirm whether SonicWall is logging usernames (independently of Cyfin) by checking SonicWall’s built-in log monitor. Follow these steps:

Step 1: Ensure SonicWall is Logging Internet Usage Events

Go to Log | Settings and expand the Log | Syslog section.
Click the Configure button next to Syslog Website Accessed events.
Ensure that the option Display Events in Log Monitor is enabled and set the display interval to 0 seconds.

Step 2: Investigate Logs for User Authentication

Navigate to Investigate | Event Logs.
Filter the logs by:
- Priority = Inform
- Category = Log
- Source IP = (enter the IP address you want to check, such as your own for testing purposes).
  This will display all web traffic for that IP address.
Click the More Details button (three lines) next to any event to view additional details.

Step 3: Check the Username Field

In the event details, look for the Username field. If this field is blank, it means that the IP address in question is not being authenticated for web traffic.

Additional Support

If you need further help with authentication issues, it’s best to contact SonicWall support. When troubleshooting, show them the issue using the SonicWall log monitor as described above.

Once SonicWall is logging authenticated users, Cyfin Reporter will be able to match usernames with their corresponding Active Directory objects. This allows you to take advantage of features like reporting on Departments and Security Groups. For more information, see our article on SonicWall Reporting on Users, Departments, and AD Security Groups.

Learn More

CyBlock Deployment Options

We understand that each organization has unique requirements for deploying web filtering and monitoring solutions. That’s why CyBlock offers flexible deployment options to meet your specific needs, whether you prefer an on-premise setup, a private hybrid cloud, or the Wavecrest Cloud platform. Below are the available deployment options and the benefits of each.

Virtual – Container (On-Premise or Private Hybrid Cloud)

Leverage the scalability and flexibility of virtual and container environments to deploy CyBlock within your infrastructure. This deployment option supports:

VM Resources: Easily scale with virtual machine environments, ensuring you have the resources you need as your organization grows.
VMware & VMware-Compatible Systems: Full support for VMware systems, making it a seamless addition to your existing virtual infrastructure.
Microsoft Hyper-V: Compatible with Microsoft’s Hyper-V virtualization platform, allowing for easy integration and management.
Container Environments: Take advantage of containerization with Docker support, providing fast deployment and improved scalability for hybrid or private cloud solutions, such as Azure.

This option provides maximum control over your data, privacy, and security while integrating directly with your existing IT infrastructure.

Wavecrest Cloud Platform (Cloud and Hybrid Cloud)

Enjoy the convenience and low maintenance of our cloud-hosted CyBlock solution. This deployment option is perfect for organizations looking to simplify IT management while maintaining the highest standards of security and compliance.

Cloud Deployment: Deploy CyBlock in minutes with easy-to-follow, intuitive steps. This option requires no additional hardware or software, reducing complexity and minimizing maintenance costs.
Secure Infrastructure: Benefit from our state-of-the-art data center, certified for SSAE 18, SOC 3, SOC 2 compliance, and audited for HIPAA and HITECH. Rest assured that your data is protected with the highest security and privacy standards.
Hybrid Option: If you require a blend of on-premise and cloud solutions, CyBlock also supports hybrid deployments, allowing you to maintain control over specific resources while benefiting from the Wavecrest Cloud for other functions. This approach combines flexibility with efficiency, ensuring your deployment is tailored to your business needs.

With this option, you’ll enjoy continuous updates, enhanced security, and seamless access to our U.S.-based support team.

Learn More

Cyfin Deployment Options

At Wavecrest, we understand that every organization has unique needs when it comes to deploying web monitoring and reporting solutions. That’s why Cyfin offers multiple deployment options that allow you to seamlessly integrate our solution into your existing infrastructure or leverage the cloud for a simplified, maintenance-free experience. Below, we outline the available deployment choices and their respective benefits:

1. Virtual – Container (On-Premise or Private Hybrid Cloud)

Virtual – Container

With Cyfin’s virtual and container-based deployment options, your organization can leverage highly scalable and easily expandable VM resources, perfect for environments requiring flexibility and growth potential. Cyfin supports popular virtualization platforms such as:

VMware & VMware-Compatible Systems: Deploy Cyfin quickly and efficiently using our pre-packaged VMware OVA Template, designed for seamless integration into any VMware environment. Whether you’re running VMware natively or a compatible system, Cyfin’s VM deployment is tailored for easy integration.
Microsoft Hyper-V: If your infrastructure is built around Hyper-V, Cyfin’s Windows Hyper-V Installer makes installation simple and ensures a smooth setup process. Our Hyper-V deployment is designed to meet your specific infrastructure needs with minimal hassle.
Container Environments (Docker): For organizations leveraging containerized environments, Cyfin offers Docker support, enabling lightweight, portable deployments that can easily adapt to evolving infrastructure requirements.

Benefits:

Flexible scalability and resource optimization
Integration support for major VM and container environments
No need for specialized hardware, reducing upfront costs
Tailored deployment to suit your unique infrastructure

2. Wavecrest Cloud Platform Deployment

Cloud-Based Solution

Experience the convenience and security of deploying Cyfin on the Wavecrest Cloud Platform, designed to simplify the deployment process while delivering advanced web monitoring and reporting capabilities.

Cyfin’s cloud deployment offers:

Quick Deployment: Start monitoring in minutes with a step-by-step setup process that requires no additional hardware or software.
Zero Maintenance: Our cloud-based platform takes the burden of ongoing maintenance and updates off your IT team, letting you focus on what matters most.
SSAE 18, SOC 3, SOC 2 Certified Infrastructure: Cyfin’s cloud services are backed by top-tier certifications, ensuring data security and compliance with HIPAA and HITECH standards.

Benefits:

No additional infrastructure required
Reduced operational and maintenance costs
Fast, intuitive deployment process
Industry-leading security and compliance certifications

Each option offers distinct advantages, whether you’re looking for on-premise control with VM or container environments or the ease and reliability of our cloud-based platform. Our team is here to help guide you in selecting the best deployment method for your organization.

Learn More

Does CyBlock Support Remote Desktop Environments?

Yes, CyBlock fully supports remote desktop environments. As long as users log in with their individual accounts, CyBlock will function seamlessly whether the user is physically sitting at their computer or remotely connected to it. This ensures that all features and monitoring capabilities are consistent and effective, regardless of the user’s location.