Finding the URL that triggers Web.Reputation.1 during Protection Engine file scans

Products

• Protection Engine for NAS
• Protection Engine for Cloud Services

Issue/Introduction

How to identify the URL(s) that trigger a Web.Reputation.1 detection when scanning files with Symantec Protection Engine (SPE).

Environment

SPE 9.2.1

Cause

The SPE does not currently have functionality to show the URL(s) that triggered a Web.Reputation.1 detection.

Resolution

The Broadcom Engineering team has committed to fixing this issue in a future build. 

As a temporary workaround a hot fix can be installed, using the steps below, which will show the URL(s) that triggered a Web.Reputation.1 detection.

1. Ensure that SPE 9.2.1 is installed **REQUIRED**
2. Download the file HF_9_2_1.zip attached to this KB
3. Upload HF_9_2_1.zip to the SPE and unzip the file
4. Stop the SPE services using the following command:
   • Linux:
     

     sudo /etc/init.d/symcscan stop;sudo /etc/init.d/symcrestapiservice stop

   • Windows:
     

     net stop symcscan && net stop symcrestapiservice

7. Navigate to SPE install location
   

   cd /<SPE_INSTALL_LOCATION>

8. Make a backup of the following files
   • symcscan
   • libcsapi.so
   • logconverter
   • xmlmodifier
9. Copy the following files from the hotfix directory (HF_9_2_1/<OS>/<SPE_TYPE>) to the SPE Install folder:
   • symcscan
   • libcsapi.so
   • logconverter
   • xmlmodifier
10. Copy the following file from HF_9_2_1 to the SPE Install folder:
    • category3.xml
11. Ensure the permission and ownership of the copied files are identical to backed-up file
12. Edit the category3.xml file and set 'LogSuspiciousURL' to 'true'
13. Navigate to the RestAPI folder
    

    cd /<SPE_INSTALL_LOCATION>/RestAPI

14. Make a backup of the following file:
    
    • sperestapi.jar
15. Copy the sperestapi.jar from the HF_9_2_1 folder to the RestAPI folder
16. Ensure the permission and ownership of the copied file is identical to backed-up file
17. Restart the SPE services using the following command:
• Linux:
  

  sudo /etc/init.d/symcscan stop;sudo /etc/init.d/symcrestapiservice stop

• Windows:
  

  net stop symcscan && net stop symcrestapiservice

13. Use the SPE to scan a file that is known to trigger the URLInsight feature
14. Review /<SPE_INSTALL_LOCATION>/log/SSE########.log to verify that the URL(s) show in the log