cyfin Archives - Wavecrest Knowledge Base

Cyfin / CyBlock — E-Mail Settings FAQ

Configuring and Testing Your E-Mail Settings

Why Isn’t My E-Mail Test Working?

When setting up e-mail in Cyfin or CyBlock, the E-Mail Settings page has both a Test button and a Submit button. It may seem natural to click Test first to verify your settings — but the Test button will not work until your settings have been saved first.

You must click Submit before clicking Test.

The Correct Order

Step 1 — Fill in your e-mail settings

Enter your e-mail configuration on the E-Mail Settings page:

Administrator’s Address — the address Cyfin will send reports and alerts to
Server Name — your outgoing mail server (SMTP) hostname
Server Port — typically 25, 465, or 587 depending on your mail server
Use SSL — check this if your mail server requires an encrypted connection
Does Server Require Authentication — select Yes and enter credentials if your SMTP server requires a login
Use Server Alias in E-Mail — optionally display a friendly sender name (e.g., “Cyfin”) in outgoing messages

Step 2 — Click Submit

Click the Submit button at the bottom of the page to save your settings. You must do this first, even if you intend to test right away.

Step 3 — Click Test

Once your settings are saved, click the Test button to send a test e-mail to the Administrator’s Address. Check that inbox to confirm the message was received.

If the test e-mail does not arrive, review your settings and click Submit again before re-testing.

Quick Reference

Button	What It Does	When to Use It
Submit	Saves your e-mail settings	Always first — before testing
Test	Sends a test e-mail using the saved settings	After Submit has been clicked

Common Mistake

Clicking Test without clicking Submit first will either produce an error or test against the previously saved settings — not the values currently shown on screen. Always save with Submit before running a test.

For additional assistance, contact Wavecrest Technical Support.

How to configure syslog on FortiGate

Below are the steps that can be followed to configure the syslog server:

From the GUI:

Log into the FortiGate.
Select Log & Report to expand the menu.
Select Log Settings.
Toggle Send Logs to Syslog to Enabled.
Enter the Syslog Collector IP address.
Select Apply.

If it is necessary to customize the port or protocol or set the Syslog from the CLI below are the commands:

config log syslogd setting 
    set status enable
    set server "192.168.1.19"
    set mode udp
    set port 514 
end

To establish the connection to the Syslog Server using a specific Source IP Address, use the below CLI configuration:

config log syslogd setting
    set status enable
    set server "192.168.1.19"
    set source-ip "192.168.1.1"
    set mode udp
    set port 514
end

The source ‘192.168.1.1’ can be any IP address of the FortiGate’s interface that can reach the syslog server IP of ‘192.168.1.19’ in the above example.

The ping and ping-options command from the CLI can be used to check basic connectivity to the Syslog server from a specific source IP.

exec ping-options source 192.168.1.1
exec ping 192.168.1.19
PING 192.168.1.19 (192.168.1.19): 56 data bytes
64 bytes from 192.168.1.19: icmp_seq=0 ttl=255 time=0.2 ms
64 bytes from 192.168.1.19: icmp_seq=1 ttl=255 time=0.1 ms
64 bytes from 192.168.1.19: icmp_seq=2 ttl=255 time=0.1 ms
64 bytes from 192.168.1.19: icmp_seq=3 ttl=255 time=0.1 ms
64 bytes from 192.168.1.19: icmp_seq=4 ttl=255 time=0.1 ms

--- 192.168.1.19 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.1/0.1/0.2 ms

Understanding Data Storage for Cyfin: Cloud and On-Premises Environments

When using Cyfin, it’s important to understand how we handle and store data, whether you’re running in our cloud environment or deploying an on-premises version. This article outlines the key points for both types of deployments and explains the storage of processed and enhanced data—not raw log data.

Data Processing and Storage in Cyfin

Cyfin’s primary function is to receive a syslog data stream from firewalls or other supported sources, and then process, parse, and enhance this data. During this process, Cyfin only ingests the specific fields required for analysis and reporting. Once the data is ingested, we apply compression and store only the valuable, enriched data used for generating employee-focused web usage reports that are manager and HR-friendly. Importantly, Cyfin does not store the original raw log files sent to us; instead, we store the processed and optimized data ready for reporting and analysis.

Cloud Environment Customers: Storage Options and Costs

If you are running Cyfin in our cloud environment, your data will be securely stored within the Cyfin metric cloud ecosystem. We offer two types of storage based on your operational needs:

Cold Storage: This option is suitable for customers who do not require real-time access to their data. It offers a lower cost per gigabyte, though retrieval times may be slower. Cold storage is ideal for customers who initiate investigations based on internal requests rather than constant monitoring.
Hot Storage: For customers who need faster access to their data, hot storage provides quicker retrieval times at a higher per-gigabyte rate. This option is best suited for customers who require immediate access to the data for monitoring or investigations.

You also have the flexibility to combine both hot and cold storage to optimize cost and performance based on your retention policy. For example, if your retention policy is one year, you could use hot storage for the first three months to ensure rapid access to more recent data for investigations, and cold storage for the remaining nine months, where quick access is less critical. This hybrid approach allows you to balance speed and cost depending on your data access needs over time.

Since each customer’s storage requirements can vary based on web resource usage and the fields we ingest, we recommend starting with a proof of concept to determine the actual storage required. To obtain an accurate storage estimate for your retention policy (such as one year), you will need to syslog your live data stream and allow Cyfin to ingest data for a sufficient period. This will give you a clearer idea of your peak and slow ingestion periods and help you properly estimate long-term storage needs.

On-Premises VM Customers: Provisioning Your Own Storage

For customers installing Cyfin on an on-premises virtual machine (VM), you will need to provision storage in your own environment. Similar to our cloud offering, you will be responsible for storing the processed and enhanced data, not the raw log files. We recommend evaluating the product by syslogging your live data stream over a period long enough to capture both peak and slow periods. This will help you estimate the storage needed to retain data for your required retention policy, typically one year.

Just like with our cloud-based offering, on-premises customers can also opt to combine hot and cold storage for a more tailored solution. For instance, you might provision hot storage for data you need immediate access to and cold storage for older data that you don’t access frequently, helping you manage costs without sacrificing performance when it matters most.

Conclusion

Understanding the storage requirements for Cyfin is essential for optimizing both cost and performance. Whether you choose our cloud-based storage options or an on-premises deployment, rest assured that only the processed and enhanced data is stored, and we can tailor storage solutions to fit your specific needs. You also have the flexibility to combine hot and cold storage to balance retrieval speed and cost over time. To accurately assess storage for your retention policy, it’s critical to evaluate Cyfin by ingesting live data over a suitable period. If you need assistance calculating storage requirements or determining the best storage solution for your setup, feel free to contact our support team.

No Usernames in SonicWall Reports? Here’s Why and How to Fix It

If your Cyfin reports and dashboards are only displaying IP addresses instead of usernames, it indicates that SonicWall is not authenticating users.

Why Are There No Usernames?

Cyfin relies on SonicWall to log usernames. When SonicWall does not authenticate users, only IP addresses are captured in the log data. As a result, Cyfin will show the IP address in place of a username.

How to Enable User Authentication in SonicWall

To report on actual usernames, user authentication must be enabled on your SonicWall firewall. Here’s how to ensure usernames are included in your logs:

Configure Authentication Settings – Go to Users | Settings in your SonicWall appliance and set up an authentication method. Typically, this will be one of the following:
- LDAP + Local Users
- Active Directory Single Sign-On (SSO) using the SonicWall SSO Agent.
Force User Authentication – After configuring authentication, you need to set access rules that require users to authenticate before traffic is allowed through the firewall. For detailed instructions, refer to the SonicWall Knowledge Base article How to Force User Authentication Prior to Allowing Traffic Through the Firewall.
Verify AD SSO is Working – If you’re using Active Directory Single Sign-On, ensure it’s functioning correctly by following the test steps outlined at the end of the SonicWall guide.

By enabling authentication on your SonicWall, Cyfin will be able to log and display usernames, providing more meaningful and detailed reports.

How to Verify SonicWall is Authenticating Users

You can confirm whether SonicWall is logging usernames (independently of Cyfin) by checking SonicWall’s built-in log monitor. Follow these steps:

Step 1: Ensure SonicWall is Logging Internet Usage Events

Go to Log | Settings and expand the Log | Syslog section.
Click the Configure button next to Syslog Website Accessed events.
Ensure that the option Display Events in Log Monitor is enabled and set the display interval to 0 seconds.

Step 2: Investigate Logs for User Authentication

Navigate to Investigate | Event Logs.
Filter the logs by:
- Priority = Inform
- Category = Log
- Source IP = (enter the IP address you want to check, such as your own for testing purposes).
  This will display all web traffic for that IP address.
Click the More Details button (three lines) next to any event to view additional details.

Step 3: Check the Username Field

In the event details, look for the Username field. If this field is blank, it means that the IP address in question is not being authenticated for web traffic.

Additional Support

If you need further help with authentication issues, it’s best to contact SonicWall support. When troubleshooting, show them the issue using the SonicWall log monitor as described above.

Once SonicWall is logging authenticated users, Cyfin Reporter will be able to match usernames with their corresponding Active Directory objects. This allows you to take advantage of features like reporting on Departments and Security Groups. For more information, see our article on SonicWall Reporting on Users, Departments, and AD Security Groups.

Learn More

Cyfin Deployment Options

At Wavecrest, we understand that every organization has unique needs when it comes to deploying web monitoring and reporting solutions. That’s why Cyfin offers multiple deployment options that allow you to seamlessly integrate our solution into your existing infrastructure or leverage the cloud for a simplified, maintenance-free experience. Below, we outline the available deployment choices and their respective benefits:

1. Virtual – Container (On-Premise or Private Hybrid Cloud)

Virtual – Container

With Cyfin’s virtual and container-based deployment options, your organization can leverage highly scalable and easily expandable VM resources, perfect for environments requiring flexibility and growth potential. Cyfin supports popular virtualization platforms such as:

VMware & VMware-Compatible Systems: Deploy Cyfin quickly and efficiently using our pre-packaged VMware OVA Template, designed for seamless integration into any VMware environment. Whether you’re running VMware natively or a compatible system, Cyfin’s VM deployment is tailored for easy integration.
Microsoft Hyper-V: If your infrastructure is built around Hyper-V, Cyfin’s Windows Hyper-V Installer makes installation simple and ensures a smooth setup process. Our Hyper-V deployment is designed to meet your specific infrastructure needs with minimal hassle.
Container Environments (Docker): For organizations leveraging containerized environments, Cyfin offers Docker support, enabling lightweight, portable deployments that can easily adapt to evolving infrastructure requirements.

Benefits:

Flexible scalability and resource optimization
Integration support for major VM and container environments
No need for specialized hardware, reducing upfront costs
Tailored deployment to suit your unique infrastructure

2. Wavecrest Cloud Platform Deployment

Cloud-Based Solution

Experience the convenience and security of deploying Cyfin on the Wavecrest Cloud Platform, designed to simplify the deployment process while delivering advanced web monitoring and reporting capabilities.

Cyfin’s cloud deployment offers:

Quick Deployment: Start monitoring in minutes with a step-by-step setup process that requires no additional hardware or software.
Zero Maintenance: Our cloud-based platform takes the burden of ongoing maintenance and updates off your IT team, letting you focus on what matters most.
SSAE 18, SOC 3, SOC 2 Certified Infrastructure: Cyfin’s cloud services are backed by top-tier certifications, ensuring data security and compliance with HIPAA and HITECH standards.

Benefits:

No additional infrastructure required
Reduced operational and maintenance costs
Fast, intuitive deployment process
Industry-leading security and compliance certifications

Each option offers distinct advantages, whether you’re looking for on-premise control with VM or container environments or the ease and reliability of our cloud-based platform. Our team is here to help guide you in selecting the best deployment method for your organization.

Learn More