Tag: cyfin

Deploying Cyfin or CyBlock in Azure, AWS, Docker, or Other Environments

Applies to: Cyfin · CyBlock · Choosing a deployment format or requesting a non-standard environment.

Cyfin and CyBlock are delivered by default as a VMware OVA file, a Hyper-V installer, or as a hosted Cloud service. Azure is not one of the standard self-service deployment options — but Wavecrest can support it. If you want to run the Cyfin trial (or CyBlock) in Microsoft Azure, contact Wavecrest and we’ll provide the correct image and setup guidance for your environment.

Standard deployment options

Both Cyfin and CyBlock ship in these formats by default:

VMware OVA file
Hyper-V installer
Cloud service (hosted by Wavecrest)

If your environment supports one of these, use the matching option and follow its standard installation guide.

Other supported environments

Need something different? We can support additional environments — they’re just not self-service downloads. These include:

Microsoft Azure
Amazon Web Services (AWS)
Docker containers
Other VMware-compatible virtualization platforms

For any of these, contact Wavecrest so we can supply the correct image and setup guidance for your platform.

How to get help

To request a deployment for Azure, AWS, Docker, or another environment, reach out to us:

Phone: 321-953-5351
Support: support@wavecrest.net
Sales: sales@wavecrest.net
Contact form: https://www.wavecrest.net/company/contactinfo.html

Renewing or Updating Your License (Cyfin & CyBlock)

Applies to: Cyfin and CyBlock · Renewing a license or extending a trial.

Your Cyfin or CyBlock license is renewed by contacting Wavecrest sales, who provide a new activation key. You then enter that key on the Update License Information screen to apply it. The process and screen are the same in both products.

Who needs to contact sales

Existing customers renewing their license — sales issues a new activation key once your renewal is arranged.
Trial / evaluation users — an evaluation includes a 14-day trial license. To extend the trial beyond 14 days, contact sales for an extended trial key.

In all cases, the activation key comes from sales; it isn’t self-generated in the product.

Where to find your license screen

Go to Settings → License → Update License Information.
The License Details screen shows your Organization Name, Server Alias Name, Serial Number, Activation Key, and the Key Status — the latter shows how many days remain and the expiration date (for example, “240 Day(s), until Apr 29, 2027”). Check Key Status any time to see when your license expires.

How to apply a new activation key

Contact Wavecrest sales to arrange your renewal (or trial extension). Sales provides a new activation key.
In the product, go to Settings → License → Update License Information.
Enter the new key in the Activation Key field (replacing the existing one).
Click Submit. The Key Status updates to reflect the new expiration date.

Contact

To renew, extend a trial, or ask any question about your license, contact Wavecrest sales:

Phone: 321-953-5351
Email: sales@wavecrest.net

There’s also a Contact Sales link on the License Details screen.

How to Change the Time Zone in Cyfin

Applies to: Cyfin · Setting the time zone for a data source.

Cyfin sets the time zone per data source, not as a single system-wide setting. There’s no global “product time zone” toggle — you set the time zone inside each data source’s configuration. This is by design: a large organization may pull logs from offices in different regions, and each data source can be interpreted in its own local time so the timestamps in reports are correct for where the activity actually happened.

You change it in the Data Source Setup wizard.

Steps

Go to Data Management → Setup. This opens the Data Source Setup wizard.
Select the data source you want to configure. Its settings screen (Data Source Setup) is displayed.
Locate the Timezone field and select the correct time zone for that data source from the drop-down (for example, America/Los Angeles).
Check the Raw Date and Parsed Date shown on the screen to confirm the offset is being applied as expected — the Parsed Date reflects the time zone you selected.
Click Next, then name the configuration and complete the wizard to save.

Notes

Set it per source. If you have multiple data sources from different regions, repeat these steps for each one and set each to its own local time zone.
Verify with Raw vs. Parsed Date. The Raw Date is the timestamp as it appears in the log; the Parsed Date is how Cyfin will interpret it after applying the selected time zone. Use the two together to confirm you’ve picked the right zone before finishing.

Cyfin — Why Are User IDs Missing From My Reports?

Applies to: Cyfin · When reports show no usernames (blank or IP addresses instead of people).

Cyfin reports on whatever is contained in the log or syslog data it ingests from your firewall or proxy. User IDs are what let Cyfin attribute web activity to specific people. If your reports show activity by IP address or blank instead of by username, the User ID is missing from the data Cyfin is receiving — and it’s almost always one of the two causes below.

(This is different from activity that appears under Ungrouped IDs — that means IDs are being captured but haven’t been organized into your Groups and IDs tree. See the Terms Glossary for Ungrouped IDs. This article is about IDs not being captured at all.)

Cause 1 — Your firewall or proxy isn’t capturing the User ID

This is the most common cause, and the key fact to understand:

The User ID is not a default field in any firewall or proxy log. A firewall or proxy only records who made a request if authentication is enabled on that device. By default, most devices log the connection (IP, URL, time, bytes) but not the authenticated username. If authentication isn’t turned on, there is simply no User ID in the log for Cyfin to report on — this is a configuration on the device, not something Cyfin can add after the fact.

The fix: enable user authentication on the firewall or proxy that generates your logs, so the authenticated User ID is written into the log/syslog. Once the device is capturing usernames, they flow into Cyfin and appear in reports.

How to do it depends on your device. Every firewall and proxy vendor has its own process and terminology for this — it may be called user authentication, user identification, User-ID, identity awareness, or similar. Consult your device’s documentation (or its vendor support) for how to enable authenticated user logging. Common examples include Palo Alto (User-ID), SonicWall, Fortinet (FSSO), and Check Point (Identity Awareness), among others.

How to confirm it’s a device issue: look at the raw log or syslog Cyfin is ingesting. If there’s no populated username field in the records themselves, the gap is on the device side — enabling authentication there is the fix.

Cause 2 — Authentication is enabled and IDs are in the log, but not in reports

If your firewall/proxy authentication is already on and you can see usernames in the raw log/syslog, but those usernames still aren’t showing up in Cyfin reports, the issue is on the parsing side: the log/syslog format or fields may have changed, so Cyfin’s parser no longer maps the User ID field correctly.

The fix: contact Wavecrest Technical Support (support@wavecrest.net). Let them know authentication is enabled and usernames are present in the raw log but not appearing in reports. The log fields may have changed and Cyfin’s parser / data configuration may need to be updated to read the User ID from the current log format.

Quick summary

Reports show IPs/blank, and the raw log has no username → enable authentication on your firewall/proxy (Cause 1). The User ID is never a default log field.
Reports show IPs/blank, but the raw log does have usernames → contact Wavecrest Support; the parser may need updating (Cause 2).
Reports show usernames but they’re all under Ungrouped IDs → that’s a grouping issue, not a capture issue; build or sync your Groups and IDs tree (see the Terms Glossary).

Cyfin & CyBlock Terms Glossary — Key Terms Explained

Applies to: Cyfin and CyBlock · Plain-language definitions of the terms used across the products and their reports.

This glossary defines the terms customers most often ask about — the reporting metrics, the categorization concepts, and the product features that shape what you see. Unless noted, a term applies to both Cyfin and CyBlock. For the full report list, see the Report Glossary; for the full category list, see the Category Glossary.

Reporting metrics

Session — A period of continuous user activity with a single application/site, reconstructed from the log. Sessions rebuild scattered proxy/firewall connection records into readable browsing events and filter out non-human background traffic (OS updates, telemetry, ad trackers), so a report reflects what a person actually did rather than raw log volume. Session count is the primary metric in high-level reports.

Session Duration — The elapsed time from the first to the last record within a session, shown as HH:MM:SS — meaningful active time, not raw connection time. Available only in the session reports. It replaces the retired Time Online metric.

Session Thresholds — The conditions activity must meet to be recorded as a session (for example, a minimum duration, a minimum number of hits, an inactivity timeout, and a maximum duration). These are Wavecrest-managed settings and should not be changed without Wavecrest’s assistance — please contact Technical Support before adjusting them.

Sessions % — A given application/site’s or category’s share of all sessions, shown as a number and a classification-colored bar.

Session Duration % — A given application/site’s or category’s share of total reporting-period time. A site with few sessions can still show a high duration % if those sessions were long.

Hit — A single log record. One page load generates many hits (images, scripts, stylesheets, and background requests). Hits are the raw material sessions are built from and appear at the deepest drill-down level, not as a headline metric. In the hit-based reports (everything outside the session reports), activity is measured in hits and bytes.

Bytes — The volume of data transferred, shown in KB or MB.

Denied Request — A request blocked by your proxy or firewall before it reached its destination. A non-zero count means access to blocked content was attempted during the period or session.

What happened to Visits and Time Online?

Both metrics have been retired. Visits have been upgraded to Sessions, which capture a user’s continuous engagement with a site rather than a single-interaction count — a clearer, more accurate picture in today’s dynamic web. Time Online has been replaced by Session Duration, which is available in the session reports. The hit-based reports now measure activity by Hits and Bytes and no longer show Visits or Time Online. This reflects how the web changed, not a correction of past reporting.

Categorization terms

Category — The content category assigned to a website (e.g., Video Streaming, Gambling, News), drawn from the shared Wavecrest URL List. See the Category Glossary for the full list and definitions.

Classification — A label — Acceptable, Unacceptable, or Neutral — that a customer assigns to each category to reflect their company policy. It appears in reports (color-coded: green / orange / gray) to give the report consumer a policy-based read on activity. Classification affects reporting only; it does not by itself block anything.

Custom Category — A category you create yourself (beyond the 70+ standard categories) and populate with URLs of your choosing — for example, to track intranet sites or to group a set of sites for filtering. Custom category and URL changes override future Wavecrest URL List downloads.

OtherWise — An optional program Cyfin and CyBlock customers can opt into to help improve categorization. When enabled, domains that are missing a category or tag are forwarded to Wavecrest’s cloud list server for review and analysis. Only the domain that needs review is sent — no other information — and the result is better list quality for everyone.

Acceptable Use Policy (AUP) — Your organization’s own policy defining acceptable web use. Cyfin and CyBlock help you monitor and enforce your AUP through their customization features (categories, classifications, and — in CyBlock — filtering).

Users and groups

User ID — The network login identifier used to attribute activity to an individual across all reports (e.g., firstname.lastname). Cyfin reads IDs from the log; CyBlock obtains an ID via NTLM when creating a proxy connection.

Groups and IDs — The tree of users and groups the product uses to organize activity. You can build it manually or sync it from Active Directory (importing your existing group and ID structure). Reporting and policies can then be organized by group.

Ungrouped IDs — Where an ID lands when it isn’t matched to an entry in your Groups and IDs tree. When Cyfin reads an ID from the log — or CyBlock receives one via NTLM — that ID is checked against the tree; if it doesn’t match a defined ID, it’s placed in Ungrouped IDs. If you never build a tree or sync from Active Directory, all IDs go into Ungrouped IDs by default. (If you’re running a report and can’t find the IDs you expect, this is often why — they’re sitting in Ungrouped IDs because the tree hasn’t been built or synced.)

Product features

Coaching (CyBlock only) — A filtering option that, when enabled, adds an override link to the block message shown when an employee reaches a blocked site. The employee can choose to bypass the block and continue to the site — and that action is logged, so the organization can later verify whether the visit was legitimate. Customers use coaching as a safety valve in case a valid site is blocked and a user genuinely needs access.

Ingestion — The process of loading raw proxy/firewall log data into the product for a given user and period. Reporting begins after ingestion completes. By default, known non-human domains (ad trackers, telemetry, OS updates, endpoint security) are excluded during ingestion; this can be disabled if a full traffic record is needed.

Application / Web Site (App/Site) — A recognized web service that groups all its related domains under one friendly name (e.g., fbcdn.com rolls up under “Facebook”), keeping reports readable for non-technical reviewers.

Cyfin & CyBlock Category Glossary — Category Definitions & Descriptions

Applies to: Cyfin and CyBlock · The complete list of content categories and what each one means.

Cyfin and CyBlock classify every website into a content category using the shared Wavecrest URL List — the categories are identical in both products. This is the full glossary of those categories and their definitions (the same list shown in-product under Help → Category Description).

Categories vs. classifications. A category describes the type of content (Gambling, Shopping, News). A classification is the policy label — Acceptable, Unacceptable, or Neutral — that your organization maps onto each category based on its acceptable-use policy. Category definitions are fixed (below); the classification mapping is configurable and set by you, so the same category may be Acceptable at one organization and Unacceptable at another.

Custom categories. Beyond the standard categories below, you can create your own custom categories for sites of particular interest (for example, intranet sites). That’s a separate task from the standard categories defined here.

The categories are grouped below the way Wavecrest organizes them — by the kind of concern they typically represent. Within each group they’re listed alphabetically.

Security Threats

Anonymous/Public Proxy — Sites that provide information on how to bypass filtering or monitoring systems, or provide a way to surf anonymously, i.e., access URLs by bypassing a Web filter or monitor.

Download Sites — Sites pertaining to the download of software. It includes sites that provide software downloads available for full or trial use at no cost or for a nominal, usually voluntary, fee, such as freeware and shareware.

File Sharing — Sites related to sharing and synchronizing documents, photos, videos, and other files in the cloud with other users and across multiple devices. Examples include Dropbox, Box, Hightail, and WeTransfer.

Malware — Sites that deploy viruses, worms, Trojan horses, spyware, and other malicious programs and/or provide hacking instructions in order to disrupt information handling and transaction processing, steal sensitive information, and gain access to internal systems. Sites may also appear official in order to get personal information and display unwanted advertisements.

Legal Liability

Cults/Occults — Sites that promote or provide information on occults, satanism, witchcraft, voodoo rituals, and other alternative religions.

Fantasy Sports — Sites that allow individuals to build teams that compete against each other based on statistics of real individual players or teams of professional sports.

Gambling — Sites where users can place bets or get more information on gambling. This includes online casinos, physical casinos (that are not hotels), offshore gambling, lottery, and sports advisory services.

Hate/Crime — Sites that promote hate speech, racism and racial bigotry, terrorist activities, criminal activities, and instructions on criminal activities.

Illegal Drugs — Sites that promote or advocate the use of illegal drugs or the recreational use of prescription drugs. This includes sites that offer or sell drug paraphernalia and advocate the cultivation and manufacture of illegal or recreational drugs. This excludes sites about prescription drugs, over-the-counter drugs, educational information on the dangers of illegal and recreational drug use, or rehabilitation services for drug addiction.

Pornography — Sites that contain sexually explicit material that intends to be sexually arousing. This includes explicit sex images and videos, nudity, adult video sales, sex toys, prostitution, and prurient sex information. It excludes nonprurient art, medically-related images or information, and legitimate sex education.

High Bandwidth

Audio Streaming — Sites that provide streaming or downloading of radio, music, MP3 files, or other audio content.

Games — Sites that offer online games, downloadable games, video games, computer games, and information on cheat codes for games. It also includes sites that provide gaming tips, chatting, leagues, and networking.

System/Application Updates — Sites that provide updates to operating systems and desktop applications. Examples include Microsoft Windows, Adobe Reader, and antivirus software.

Video Streaming — Sites that provide streams or downloads of television, movies, or other video content.

VoIP Services — Sites that enable users to make phone calls via the Internet or to obtain information or software for that purpose.

Cloud Services

Cloud Infrastructure — Sites that provide the capability to provision servers, storage, data center space, networks, operating systems, and other essential computing resources as an on-demand service where the user is able to deploy and run software. Examples include Amazon Web Services, Bluelock, and CA Technologies.

Cloud Storage — Sites that provide the ability to upload, access, organize, back up, and share files, photos, and documents from any computer or mobile device. These sites essentially act as a personal or business hard drive on the Internet. Examples include Google Drive, OneDrive, Carbonite, and Flickr.

Collaboration — Sites that provide for collaboration among employees by videoconferencing, online training, Web-based e-mail, productivity apps, etc. Examples include Skype for Business, WebEx, Gmail, and Office 365.

CRM — Sites related to customer relationship management (CRM), customer engagement, customer service and support, and help desk management services. Examples include Zendesk, Salesforce, and Needle.

Development — Sites that provide open source software for software development including code collaboration and review, as well as software distribution, and also promote agile development software and services. Examples include GitHub, JIRA Software, Confluence, and Bitbucket.

HR — Sites promoting human capital management software solutions including onboarding, payroll services, performance management, recruiting software, applicant tracking software, and talent management. Examples include Workday, SuccessFactors, NetSuite, and Jobvite.

Productivity Drains

Auctions/Classifieds — Sites that support the offering, purchasing, and bartering of goods or services between individuals.

Blogs — Personal Web sites posted by individuals or groups chiefly devoted to personal expression. It excludes topic-specific blogs. For example, a blog about professional football would be located in the Sports category.

Chat/Instant Messaging — Sites that provide chat or IM services to communicate in real time with other individuals.

Entertainment — Sites related to movies, television, theater, comic books, anime, theme parks, fan clubs, and other recreational activities. It also includes sites about celebrities, celebrity gossip, etc.

Job Search — Sites that advertise jobs or are related to employment, such as resume writing, job placement, and recruiting.

News — Sites that report on current news and events, such as TV networks and stations, radio networks and stations, news organizations, online newspapers, and general interest magazines. It includes local news, TV, and radio. It excludes special interest media with narrow targeted audiences (e.g., a site publishing current sports news is categorized as Sports).

Personal E-Mail — Sites offering online or Web-based e-mail services for personal use. This excludes enterprise e-mail services.

Personals/Dating — Sites that provide networking for online dating, such as dating services, matchmaking, mail order brides, personal ads, singles groups, and dating advice. It excludes pornographic activities and mate swapping.

Shopping — Sites related to physical and Web-based retail activities and stores, shopping aids, coupons, and information about shopping. It excludes B2B sales, government purchasing, and online auctions.

Social Media — Social sites containing personal profiles with a wide range of images and text for purposes of social interaction. It excludes social sites specific to dating/personals.

Sports — Sites that include information about athletic activities, sports scores and news, and sports teams and leagues. It includes sites that solely sell sports merchandise. Hunting and fishing are included in this category.

Stock Trading — Sites that provide information on the stock market, stock quotes, stock tickers, personal stock transactions, and stock market news.

Travel — Sites that specialize in travel arrangements, airlines, hotels, cruises, travel agencies, and car rentals. It excludes local transportation.

Weather — Sites related to weather, forecasts, and meteorology.

Business Operations

Advertisements/Tracking Sites — Sites associated with ad serving technology and companies, and Web traffic analysis — that is, URLs that track Web analytics.

Agriculture/Environment — Sites about farming, ranching (including large-scale farming/ranching equipment sales), forestry, gardening, horticulture, etc. It also includes air quality, water quality, conservation, waste management, ecology, and animal protection. It excludes retail grocery and food operations.

Business Services — Sites that offer services to help run everyday business, such as printing and publishing, office supplies and furniture, consulting, accounting services, and maintenance and janitorial services.

Financial — Sites related to online and offline banking services, investment services, loans, bankruptcy, money management, tax consulting, and credit cards.

High Tech — Sites that develop and/or sell computer software and hardware products, and provide information on computers, technology, the Internet (non-ISP), and technology-related companies.

Insurance — Sites that provide information about or offer life, health, dental, automobile, and homeowner’s insurance.

IT Services — Sites for companies that provide Internet access (ISPs), IT services, data center services, Web site hosting, cloud infrastructure services (IaaS), etc.

Legal Services — Sites pertaining to law enforcement, courts, lawyers, litigation, and civil rights. It also includes do-it-yourself sites providing legal advice and online legal forms for wills, divorce, incorporating a business, etc.

Manufacturing — Mining and traditional manufacturing sites, such as electronics, textiles, and plastics. It excludes energy and vehicle manufacturing, petroleum refineries, and food processing.

Marketing — Sites that provide marketing and advertising services, information on marketing and advertising strategies, and Web site design services.

Real Estate/Construction — Sites that promote renting, buying, or selling of properties, or provide information on home ownership, property management, land use, and home and yard maintenance services. It also includes building or housing construction — contractors, construction methods, and architecture services.

Shipping — Sites that offer material shipping, packing and shipping, and mailing services.

Telecommunications — Sites that provide telecommunications services and products, cable TV services, and wireless services and products.

Transportation/Storage — Sites about commuter transportation, local train, bus, and taxi services and schedules, freight transportation, and commercial trucking companies. It also includes storage facilities, portable storage and moving containers, vehicle storage, etc. It excludes long-distance travel and car rentals.

Utilities/Energy — Sites related to energy exploration, processing and refinement, and distribution and marketing. It includes fuel for transportation, electricity, natural gas, wind energy, and solar energy.

General Interest

Animals/Pets — Sites related to pet care, pet adoption, animal training, and animal shows. It also includes breed-specific sites.

Arts/Culture — Sites that promote arts and culture including sculpture, paintings and other visual art forms, literature, dance, ballet, opera, and performance art. This includes museums and galleries, and sites about lifestyles, hobbies, and self-improvement.

Education/Reference — Sites about schools, universities, educational facilities, vocational and adult education, distance education, preschools and day care, homeschooling, faculty, and alumni groups. It also includes libraries, online dictionaries, language translation, book sites, maps, census information, almanacs, engineering and technical reference, scientific information, environmental science, political science, and medical research.

Government — Federal, state, and local government sites and sites about government functions and services.

Groups/Forums — Sites dedicated to user groups (e.g., Google or Yahoo groups) or general-topic forums. It excludes content-specific forums; for example, the Adobe forum is located in High Tech.

Health/Medical — Sites about hospitals, clinics, physicians, service providers, medical services, health products, and pharmaceuticals. Also sites that promote healthy living through diet and exercise, the dangers of illegal and recreational drug use and substance abuse, and rehabilitation.

IP Addresses — Numerical IP addresses that have not been categorized. This category is a red flag: it alerts you that further action may be needed to resolve a problem (such as malware or spyware on a computer) or gives a more complete picture of all Web activity. For why you might see many hits to an IP address and what to do, see the IP Addresses Category document.

Kids — Sites aimed at children’s interests. It excludes sites that sell children’s toys (those are in Shopping).

Military — Military sites and sites related to bases and general military information. It excludes military news and history.

Noncategorized/Other — Sites not previously categorized by Wavecrest Computing. Any accessed sites not yet categorized are assigned to “Other.” Through the free OtherWise service, organizations can send Wavecrest a Top Noncategorized Sites report; Wavecrest analysts then research, identify, and categorize the most popular unidentified URLs and update the Wavecrest URL List accordingly.

Nonprofit Organizations — Sites for charitable organizations, veterans’ organizations, and emergency support organizations.

Politics — Sites related to politics, such as political advocacy, political party organizations, and candidate Web pages, or any sites promoting a political party. It excludes official government organizations.

Regional Information — Sites that provide local events and local interest topics.

Religion — Sites that advocate religion or provide information on religion and religious activities, including specific organizations or places of worship. It excludes cults, religious hatred, and religious bigotry.

Restaurants/Food/Alcohol — Sites related to restaurants, diners, cafes, bars, pubs, recipes, cooking instructions, food services, grocery, beverages, and alcohol. It excludes cooking equipment sales.

Search Engines — Sites that provide Web search services, search directories, and search portals.

Tasteless/Offensive — Sites that include offensive information or excessive profanity. It excludes sites that fit into the Pornography and Hate/Crime categories.

Vehicles — Sites that sell and/or provide information about bicycles, automobiles, trucks, motorcycles, boats, and aircraft. It includes vehicle design and manufacturing, marketing and sales, maintenance and restoration, and vehicle clubs.

Weapons — Sites that sell, review, describe, or provide information on weapons, such as guns, knives, bombs, or martial arts devices. It excludes sites solely about hunting or hunting tools such as rifles and bows and arrows.

Additional categories

Artificial Intelligence — Websites employing AI technologies such as machine learning and deep learning to provide human-like services. This includes platforms offering chatbots, productivity tools, summarizers, transcription services, no-code solutions, and multimedia editing. It specifically targets sites actively hosting these AI functionalities, not just providing AI information. (A newer category; not yet reflected in every grouping.)

Cyfin & CyBlock Report Glossary — Report Definitions & Descriptions (Sessions-Based Reporting)

Applies to: Cyfin and CyBlock · A reference to what each standard report shows and when to use it.

Cyfin and CyBlock share the same reporting feature — the same reports, the same paths, and the same metrics in both products. Everything below applies identically to either one. This is the glossary of the standard reports — their definitions / descriptions — reflecting the current sessions-based reporting direction. Sessions are the primary metric in high-level reports; Hits appear at the deepest drill-down. (If you’re looking for the older “Visits” or “Time Online” metrics, see What happened to Visits and Time Online? at the end.)

How to use the reports together

There are two ways in, and most reviews use both in sequence:

Proactive / summary reports survey the whole population — who is most active, which sites and categories dominate. Use these to spot a user ID or a site of interest. (Top Users, Top Web Sites, Site Analysis, Site Audit Summary.)
Session investigation reports take a single user ID of interest and reconstruct exactly what that person did, drilling from a high-level summary down to individual URLs. This is the pathway for a focused review of one user — for example an employee web-activity investigation. (Session Analysis → Session Audit Summary → User Audit Detail.)

A typical review: scan the summary reports, find an ID or site that stands out, then run a session investigation on that specific ID.

Report metrics at a glance

Reports use two metric families, and which one you see depends on the report:

Session reports (Session Analysis, Session Audit Summary, User Audit Detail) use Sessions and Session Duration. Session Duration is available only in these reports.
All other reports are hit-based — they quantify activity by Hits and Bytes. They no longer include Visits or Time Online; both of those metrics have been retired.

So if you need duration, use a session report; the hit-based summary and detail reports measure activity by hit and byte volume.

Session Investigation Reports — the investigation pathway

These three reports are three levels of detail on the same user and period — you start high and drill down by clicking hyperlinks. Sessions reconstruct scattered firewall/proxy connection records into readable browsing events, filtering out non-human background traffic (OS updates, telemetry, ad trackers) so the report reflects what a person actually did, not raw log volume.

Session Analysis (Level 1 — start here)

A complete summary of one user’s web activity across the full investigation period: every application/site accessed, session counts, session duration, and content categories, with color-coded classifications. Ranked by session count so areas of concern surface first. Clicking an application opens the Session Audit Summary for that site. This is where every investigation begins.

Session Audit Summary (Level 2)

Narrows to one selected application and lists every session the user had on it — session start, session stop, and duration for each, plus the device IP address and category. Shows the pattern of access: how many sessions, how long each lasted, and whether activity clustered at particular times. Clicking a session opens the User Audit Detail.

User Audit Detail (Level 3 — the evidence)

The most granular level: every URL logged during one selected session, in chronological order, with timestamp, category, classification, and full clickable URL. Includes a URL search filter and a Total Denied Requests count. This is the evidentiary foundation for any formal action. Note: the list includes background and site-generated requests, so not every URL is a deliberate click — the session grouping above it is what isolates meaningful activity.

Summary / Proactive Reports

Use these to survey activity and identify who or what to investigate.

Site Analysis

A high-level, hit-based audit of activity from several perspectives — by classification (Acceptable / Unacceptable / Neutral), by category, by group, by user, and by user within each category, measured in hits and bytes. Individual sites are not identified. Good for broad or focused audits of activity volume across the population.

Top Users

Lists the most active users by activity volume (hits, denied hits, and bytes). An excellent screening tool: it surfaces the users with the highest activity so you can drill down or launch a session investigation on those IDs.

Top Web Sites

Lists all accessed sites (domains) with their category, hits, and bytes, sorted by activity volume. Individual user IDs are not shown, but each site links out for further analysis. Highlights the most-accessed sites; inappropriate ones can prompt deeper investigation or blocking.

Site Audit Summary

Lists the top groups and users who accessed a particular site (can be run for more than one site), with hit and byte totals and hourly breakdown, and a link to each user. A quick, summarized look at who is using a given site the most.

Detail & Audit Reports

Targeted deep-dives into a category, a site, search terms, or blocked requests.

Category Audit Detail

A detailed analysis of one selected category (e.g., Pornography): all URLs for each user who accessed that category, plus the top users, groups, and hourly activity within it. Useful for auditing possible misuse concentrated in a specific category.

Site Audit Detail

Focuses on one or more specific sites: every record to those URLs, listed chronologically for all users, with IP address, user, and full URL, plus top-group/user/hourly summaries. A complete view of who accessed a given site and what they did.

Search Term Audit Detail

Shows the search terms users entered on popular search engines (Google, etc.), with IP address, user, date/time, and search engine. A forensic aid — indicates how many search terms were entered and by whom.

Denied Requests

By category, shows which users were denied access to sites or pages during the period. Individual users are identified; specific URLs are not. If web filtering is enabled, this verifies it’s working and flags attempts to reach blocked content.

Denied Requests Detail

The URL-level version: the specific URLs to which each user was denied access, by user, in the requested category. A useful supplement to individual user audits, showing the number and type of blocked requests.

IT / Bandwidth Reports

Focused on network and bandwidth rather than individual behavior.

Network Information

Total hits, byte trends, and total bytes broken down by classification, category, group, IP address, and hourly activity. No individual users or sites are identified — it keeps the focus on bandwidth, helping admins spot network performance issues.

Site Analysis Bandwidth

Like Site Analysis, but focused on bandwidth consumption instead of hit counts: trend in bytes and total bytes by classification, category, group, user, and user within category. Helps IT manage bandwidth and identify the heaviest users per category.

Top Bandwidth Sites

The top bandwidth-consuming sites for a selected group, each with its category and byte consumption, sorted highest-first. Individual users are not shown. Quickly identifies which sites are driving bandwidth so unwarranted consumption can be investigated or blocked.

Key terms

Session — A period of continuous user activity with a single application/site, reconstructed from the log. Opens at the first qualifying activity and closes after a set inactivity period (commonly 10 minutes), and must meet minimum thresholds to be counted. Session count is the primary metric in high-level reports.

Session Duration — Elapsed time from the first to the last record within a session (HH:MM:SS) — meaningful active time, not raw connection time. Available only in the session reports. It replaces the retired Time Online metric.

Sessions % — A site’s or category’s share of all sessions, shown as a number and a classification-colored bar.

Session Duration % — A site’s or category’s share of total reporting-period time. A site with few sessions can still show a high duration % if those sessions were long.

Hit — A single log record. One page load generates many hits (images, scripts, stylesheets, background requests). Hits are the raw material sessions are built from and appear at the deepest drill-down level, not as a headline metric.

Application / Web Site (App/Site) — A recognized web service grouping all its related domains under one friendly name (e.g., fbcdn.com rolls up under “Facebook”), so reports stay readable.

Category — The product’s content category for a site (e.g., Video Streaming, Auctions/Classifieds, Shopping, News).

Classification — The policy label applied to categories: Acceptable (green), Unacceptable (orange), or Neutral (gray). The category-to-classification mapping is set by your organization’s acceptable-use policy.

Denied Request — A request blocked by your proxy or firewall before reaching its destination. A non-zero count means blocked content was attempted.

Bytes — Volume of data transferred (KB or MB).

Ingestion — Loading raw proxy/firewall log data into Cyfin for a user and period; reporting begins after ingestion completes. By default Cyfin excludes known non-human domains during ingestion; this can be disabled if a full traffic record is needed.

User ID — The network login identifier used to attribute activity to an individual across all reports (e.g., firstname.lastname).

What happened to Visits and Time Online?

Customers on legacy reports may still expect the Visit and Time Online metrics. Both have been retired:

Visits have been upgraded to Sessions. Sessions capture a user’s continuous engagement with a site or app, which gives a clearer, more accurate picture than a single-interaction count in today’s dynamic web — where one page pulls content from many servers and mixes in automated background traffic.
Time Online has been replaced by Session Duration, which is available only in the session reports.

The hit-based reports (everything outside the session reports) now measure activity by Hits and Bytes — they no longer show Visits or Time Online. Hits and Visits were the right tools for their time; sessions build on that foundation. This is a response to how the web changed, not a correction of past reporting.

Installing Your Own SSL Certificate on the Cyfin / CyBlock Web Interface (Secure Interface)

Applies to: Cyfin and CyBlock · Area: Settings → Secure Interface

The Secure Interface screen and this procedure are the same in both Cyfin and CyBlock. Where they differ, it’s noted inline.

Is this the article you need? This explains how to install your own SSL/TLS certificate on the product’s web interface so that when you connect to the Cyfin/CyBlock console over HTTPS, your browser shows a valid, trusted certificate that matches your domain — no security warning.

The one distinction that matters here: accessing the UI vs. inspecting user traffic. This article is only about a certificate for accessing the admin console/UI over validated HTTPS. It has nothing to do with inspecting your users’ web traffic.

If you’re trying to inspect users’ HTTPS traffic instead, that’s SSL inspection — a different thing entirely:

In CyBlock, SSL inspection is a proxy-only feature with its own screen: Settings → Proxy → SSL Certificates. Those are the client-authentication certificates the proxy uses to decrypt and inspect HTTPS traffic. That screen has nothing to do with reaching the UI, and it does not exist in Cyfin. If that’s what you want, go there — not the Secure Interface screen below.

In Cyfin, SSL inspection isn’t a Cyfin screen at all; it’s enabled on your firewall — see the SSL Inspection article.

The common case: use your own certificate that matches your domain

By default, the product serves its web interface with a built-in Wavecrest certificate. Because that certificate isn’t issued to your domain by a CA your browsers already trust, connecting over HTTPS shows a “not secure” / name-mismatch warning.

Most customers therefore install their own certificate — one issued to the exact hostname they use to reach the console (for example cyfin.yourcompany.com or cyblock.yourcompany.com, or a wildcard like *.yourcompany.com). Once installed and enabled, browsers show a valid certificate and the padlock, with no warning.

There are two ways to do it, depending on what you already have:

You already hold a certificate + private key issued to that hostname (for example a wildcard cert) → Option A.
You need the product to generate a signing request for your CA to issue against → Option B.

Before you begin

You’ll need administrator access.
Have the fully qualified domain name (FQDN) users will use to reach the console.
Your certificate and private key must be in PEM format.
Installing or changing the interface certificate triggers an automatic service restart — plan a brief maintenance window.

Option A — Install a certificate you already have (PEM)

Go to Settings → Secure Interface.
Click the edit (pencil) icon next to Current Certificate.
Under Certificate Type, select Custom.
Paste your signed certificate into Certificate Data (PEM), then append your private key at the bottom of the certificate in the same field.
Click Install. The product applies the certificate and restarts the service.

Continue to Enable the secure (HTTPS) connection.

Option B — Generate a CSR in the product and have your CA sign it

Use this when you don’t yet have a certificate and want your CA to issue one for the console hostname.

Go to Settings → Secure Interface.
Click Certificate Signing Request and complete the form:
- Domain Name (required) — the full domain of the server (for example cyblock.yourcompany.com).
- Country — 2-digit country code.
- State / City — if applicable.
- Organization — your organization name (defaults from the License screen).
- Email — the person responsible for the server (defaults to the current login’s email).
- Organization Units — optional departments/groups (for example “IT Group”); type next to New Unit and click +. Multiple units can nest (for example a “Security Audit” unit under “IT”). Remove All clears the box.
Click Generate. The product produces the CSR and private key in PEM format.
Save the private key in a secure location, then forward the CSR to your CA for signing.
When the CA returns your signed certificate:
- Return to Settings → Secure Interface and click the edit icon next to Current Certificate.
- Under Certificate Type, select Custom.
- Paste the signed certificate into Certificate Data (PEM) and append the private key you saved at the bottom.
- Click Install. The product applies the certificate and restarts the service.

Continue to Enable the secure (HTTPS) connection.

Enable the secure (HTTPS) connection

Installing the certificate is only half the job — you also enable HTTPS on the interface.

In Settings → Secure Interface, configure the connection type.
HTTP is enabled by default. Keep it (optionally changing the Port), or select Disable to turn it off.
For HTTPS, select Enable to use a secure browser connection. The Port is prefilled with a recommended value; change it if needed.
(Recommended the first time) Enable both HTTP and HTTPS so you can confirm the certificate loads before turning HTTP off.
With both enabled, the Force HTTP to HTTPS Redirect option appears. Select Enable so HTTP visitors are redirected to HTTPS.
Click Submit, then Continue to restart the service.

Verify

Browse to https://<your-console-domain>:<https-port>.
Confirm the browser shows the padlock and a valid certificate issued to your domain, with no warning.
Check the certificate details to confirm it’s your certificate, not the default Wavecrest one.

CyBlock note: when switching from an invalid to a valid certificate, you may need to close and reopen the browser for the address bar to show the updated certificate status.

If you still see a warning, the usual causes are a domain mismatch (the certificate isn’t issued to the hostname you’re browsing to) or an untrusted signing CA — common with an internal/enterprise CA, whose root must be distributed to client machines so browsers trust it.

Alternative: keep the default Wavecrest certificate

If you don’t install your own certificate, you can instead distribute the built-in Wavecrest root so clients trust the default certificate. From Settings → Secure Interface, click Wavecrest Certificate to download the Root Certificate Authority, and see the Wavecrest Certificate Installation Guide for how to install/distribute it. Most customers prefer their own certificate (above) because it matches their domain and validates without extra client-side distribution.

Cyfin / CyBlock — E-Mail Settings FAQ

Configuring and Testing Your E-Mail Settings

Why Isn’t My E-Mail Test Working?

When setting up e-mail in Cyfin or CyBlock, the E-Mail Settings page has both a Test button and a Submit button. It may seem natural to click Test first to verify your settings — but the Test button will not work until your settings have been saved first.

You must click Submit before clicking Test.

The Correct Order

Step 1 — Fill in your e-mail settings

Enter your e-mail configuration on the E-Mail Settings page:

Administrator’s Address — the address Cyfin will send reports and alerts to
Server Name — your outgoing mail server (SMTP) hostname
Server Port — typically 25, 465, or 587 depending on your mail server
Use SSL — check this if your mail server requires an encrypted connection
Does Server Require Authentication — select Yes and enter credentials if your SMTP server requires a login
Use Server Alias in E-Mail — optionally display a friendly sender name (e.g., “Cyfin”) in outgoing messages

Step 2 — Click Submit

Click the Submit button at the bottom of the page to save your settings. You must do this first, even if you intend to test right away.

Step 3 — Click Test

Once your settings are saved, click the Test button to send a test e-mail to the Administrator’s Address. Check that inbox to confirm the message was received.

If the test e-mail does not arrive, review your settings and click Submit again before re-testing.

Quick Reference

Button	What It Does	When to Use It
Submit	Saves your e-mail settings	Always first — before testing
Test	Sends a test e-mail using the saved settings	After Submit has been clicked

Common Mistake

Clicking Test without clicking Submit first will either produce an error or test against the previously saved settings — not the values currently shown on screen. Always save with Submit before running a test.

For additional assistance, contact Wavecrest Technical Support.

How to configure syslog on FortiGate

Below are the steps that can be followed to configure the syslog server:

From the GUI:

Log into the FortiGate.
Select Log & Report to expand the menu.
Select Log Settings.
Toggle Send Logs to Syslog to Enabled.
Enter the Syslog Collector IP address.
Select Apply.

If it is necessary to customize the port or protocol or set the Syslog from the CLI below are the commands:

config log syslogd setting 
    set status enable
    set server "192.168.1.19"
    set mode udp
    set port 514 
end

To establish the connection to the Syslog Server using a specific Source IP Address, use the below CLI configuration:

config log syslogd setting
    set status enable
    set server "192.168.1.19"
    set source-ip "192.168.1.1"
    set mode udp
    set port 514
end

The source ‘192.168.1.1’ can be any IP address of the FortiGate’s interface that can reach the syslog server IP of ‘192.168.1.19’ in the above example.

The ping and ping-options command from the CLI can be used to check basic connectivity to the Syslog server from a specific source IP.

exec ping-options source 192.168.1.1
exec ping 192.168.1.19
PING 192.168.1.19 (192.168.1.19): 56 data bytes
64 bytes from 192.168.1.19: icmp_seq=0 ttl=255 time=0.2 ms
64 bytes from 192.168.1.19: icmp_seq=1 ttl=255 time=0.1 ms
64 bytes from 192.168.1.19: icmp_seq=2 ttl=255 time=0.1 ms
64 bytes from 192.168.1.19: icmp_seq=3 ttl=255 time=0.1 ms
64 bytes from 192.168.1.19: icmp_seq=4 ttl=255 time=0.1 ms

--- 192.168.1.19 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.1/0.1/0.2 ms