Finding the URL that triggers Web.Reputation.1 during Protection Engine file scans

Products

• Protection Engine for NAS
• Protection Engine for Cloud Services

Issue/Introduction

How to identify the URL(s) that trigger a Web.Reputation.1 detection when scanning files with Symantec Protection Engine (SPE).

Environment

SPE 9.2.1 and older

Cause

SPE versions 9.2.1 and older do not include functionality to show the URL(s) that triggered a Web.Reputation.1 detection.

Resolution

As of SPE 9.3 the SSE########.log file includes the URL(s) that triggered a Web.Reputation.1 detection.  Broadcom support recommends customers upgrade to SPE version 9.3 or newer to enable this functionality.

If you are on SPE 9.2.1 and can not upgrade to SPE 9.3 or newer, please use the steps listed below.

1. Ensure that SPE 9.2.1 is installed **REQUIRED**
2. Download the file HF_9_2_1.zip attached to this KB
3. Upload HF_9_2_1.zip to the SPE and unzip the file
4. Stop the SPE services using the following command:
   • Linux:
     

     sudo /etc/init.d/symcscan stop;sudo /etc/init.d/symcrestapiservice stop

   • Windows:
     

     net stop symcscan && net stop symcrestapiservice

7. Navigate to SPE install location
   

   cd /<SPE_INSTALL_LOCATION>

8. Make a backup of the following files
   • symcscan
   • libcsapi.so
   • logconverter
   • xmlmodifier
9. Copy the following files from the hotfix directory (HF_9_2_1/<OS>/<SPE_TYPE>) to the SPE Install folder:
   • symcscan
   • libcsapi.so
   • logconverter
   • xmlmodifier
10. Copy the following file from HF_9_2_1 to the SPE Install folder:
    • category3.xml
11. Ensure the permission and ownership of the copied files are identical to backed-up file
12. Edit the category3.xml file and set 'LogSuspiciousURL' to 'true'
13. Navigate to the RestAPI folder
    

    cd /<SPE_INSTALL_LOCATION>/RestAPI

14. Make a backup of the following file:
    
    • sperestapi.jar
15. Copy the sperestapi.jar from the HF_9_2_1 folder to the RestAPI folder
16. Ensure the permission and ownership of the copied file is identical to backed-up file
17. Restart the SPE services using the following command:
• Linux:
  

  sudo /etc/init.d/symcscan stop;sudo /etc/init.d/symcrestapiservice stop

• Windows:
  

  net stop symcscan && net stop symcrestapiservice

13. Use the SPE to scan a file that is known to trigger the URLInsight feature
14. Review /<SPE_INSTALL_LOCATION>/log/SSE########.log to verify that the URL(s) show in the log