GFI WebMonitor for ISA Server

Monitoring, Web Security and Access Control for ISA Server

GFI WebMonitor 2009 for ISA Server is an internet monitoring software, web security and access control solution that gives users comprehensive control of the use of the Internet by employees in an organization.

Designed as a plug-in for Microsoft’s Internet Security and Acceleration (ISA) Server, GFI WebMonitor 2009 provides an outstanding level of management to IT administrators who want to monitor, control and report on what employees are doing on the Internet.

GFI WebMonitor 2009 gives small and medium-sized businesses the tools they need to  ensure a safer browsing experience, reduce the risk of malware attacks from web-borne threats, boosting employee productivity by reducing cyber-slacking as well as lowering the risk of legal liabilities because of inappropriate browsing.

Plug-in integrates seamlessly with ISA Server

GFI WebMonitor 2009, which seamlessly integrates with ISA Server, complements the powerful firewalling features while giving IT Administrators the ability to get a much clearer picture of what type of traffic is being filtered, what type of Internet requests are being sent to the server and the ability to apply policies and rules based on IP, user or groups.

Internet Monitoring, categorization and web filtering coverage of over 205m URLs

GFI WebMonitor 2009 for ISA Server provides users with excellent Internet monitoring, categorization and web filtering coverage of over 205m URLs. This allows you to manage what sites users can browse and block access to websites in particular categories, such as adult material, online gaming, personal email, peer-to-peer, Facebook, MySpace and more.

Web security to protect against viruses, spyware, malware and phishing scams

GFI WebMonitor 2009’s powerful security features ensure that Internet users do not put the organization at risk of malware attacks, spyware and phishing attacks. The security edition of GFI WebMonitor 2009 for ISA Server allows IT administrators to monitor what files employees are downloading, to block file-types such as MP3s and to scan all files for viruses, spyware and malware using up to five multiple anti-virus engines.

GFI WebMonitor 2009 for ISA Server lowers the risk of social engineering by blocking access to phishing websites through the use of an auto-updatable database of phishing URLs. The web monitoring features also allow you to monitor and block Live Messenger (MSN) chat sessions and file transfers.

GFI WebMonitor 2009 for ISA Server has won ISAserver.org Readers' Choice Awards for four years running - a continued vote of confidence in our technology.

Why use GFI WebMonitor?

• Increase employee productivity by managing your employees' web browsing habits
• Protect the network from dangerous downloads in real-time
• Reduce cyber slacking – time wasted by employees online
• Effectively enforce an Internet Usage Policy
• Prevent data leakage through socially-engineered websites
• Benefit from multiple scanning engines to ensure that downloads are free of viruses and other malware.

Features:

GFI WebMonitor is now available in two versions:

• GFI WebMonitor 2009 – as a standalone proxy version which works in most network environments
• GFI WebMonitor for ISA Server – a dedicated plug-in for Microsoft ISA Server only

GFI WebMonitor™ is available in 3 editions:

• WebFilter Edition: Includes URL filtering and website categorization
• WebSecurity Edition: Includes anti-virus and anti-phishing protection and spyware detection
• UnifiedProtection Edition: Combines both WebFilter and WebSecurity editions

Freeware Version Available

GFI Software offers a FREEWARE version of GFI WebMonitor. This version features the monitoring component of GFI WebMonitor to provide organizations with a comprehensive picture of who is browsing the Internet, which sites they are visiting, what files are being downloaded and how much bandwidth is being used – at no cost.

Features of GFI WebMonitor - UnifiedProtection Edition (common features)

The features below are available with all editions.

Monitor or Block a Connection in Real-time
Administrators can see what websites users are currently browsing and what files are being downloaded. An active connection, browsing session or download can easily be blocked, simply by clicking the block connection icon. Very useful if you need to interrupt the download of an overlarge file.

Block Applications' Hidden Downloads
Some software applications will connect to their home pages to download updates without the user’s consent, using HTTP tunneling. Although this reduces software version administration, it also presents a security risk.  Unknown applications (or Trojans) often use the same technique to download malicious files. Without the user’s consent spyware, adware and pornware can be downloaded to his or her PC. GFI WebMonitor gives you control over which sites are allowed to distribute updates, ensuring only safe sites (for example www.microsoft.com) gain behind-the-scenes access to your computers.

Hidden Downloads Monitoring
This feature allows administrators to assess the legitimacy or otherwise of downloads that are not initiated by the user or the browser. By examining the list, the administrator will be able to block or allow future downloads by adding the URL to a blacklist or whitelist respectively. This feature will block and identify background processes from downloading payloads that may be malicious in nature or use up network resources.

Monitor Bandwidth
Through user and site bandwidth monitoring features, the administrator has the ability to track download and upload traffic and the number of URL hits over time, either on a user-by-user basis or on a website basis. Real-time monitoring is achieved through drilldown reporting complete with graphs, available within the user interface.

Allow Exceptions through Whitelist and Blacklists
Any URL or user or IP can be added permanently or temporarily to the whitelist or blacklist which will supersede all web filtering and web security policies. For example, you could temporarily grant access to a particular user for his or her personal webmail account for a specified period of time, say over employee lunch breaks.

Controlled Access to the Configuration and Monitoring
GFI WebMonitor allows you to select which users can access the program’s configuration and monitoring interfaces. You can assign rights based on either the IP of the computer from which access is being made or by the domain-authenticated username of the client trying to load the configuration. Only users in GFI WebMonitor’s authorized users or IP list will be given access.

Support for Virtual Environments
Organizations that are currently using or plan to use virtualization on their network can still install and use a range of GFI products with confidence. GFI WebMonitor supports and runs on the most common virtualization technologies in use, namely VMware, Microsoft Virtual Server and Microsoft Hyper-V.

Features of GFI WebMonitor - WebFilter Edition

WebGrade^TM Database coverage of 205m URLs
The WebGrade database has been drastically improved to increase URL coverage across multiple languages. The DB size has increased to 205 million domains.

WebGrade Online lookups
Due to the constantly changing nature of the web, GFI WebMonitor now also queries GFI servers for categorization of URLs that are not found in the local cached database. If a URL is found to be uncategorized, it is processed by the server and added to the database.

User / Site bandwidth monitoring
Through the user and site bandwidth monitoring features the administrator has the ability to track download/upload traffic and website hits either on a user or website basis. Reports also show the amount of bandwidth consumed by each website category.

Top Policy Breakers
GFI WebMonitor will now report details on all users who were stopped by GFI WebMonitor from breaching your company's Internet Usage Policy. Such breaches may include browsing restricted sites, downloading of malware infected files or file types that are blocked through download control policies .

WebFilter policy exceptions
Apart from a generic Blacklist/Whitelist, the admin can also define site exceptions for each particular policy. A typical example will be to block all news sites except CNN.com.

Time-based Filtering
Each of web-filtering policy may be configured to work on a schedule, meaning that administrators can configure the product to allow users or groups to access certain websites during specific intervals; for example allowing more open access to entertainment or webmail sites during employee break times.

Anti-phishing
GFI WebMonitor protects the users from the potential risks of social engineering by blocking access to phishing websites through an auto-updatable database of phishing URLs.

Mitigate Legal Liability
Without the ability to exercise some form of management over what your users are browsing, you leave yourself open to legal liability in any number of ways.  Provide your employees with safe, well managed access to the Internet while on your premises and you will safeguard your company, your employees and your bottom line.

Features of GFI WebMonitor - WebSecurity Edition

MSN control
Monitor and block MSN & MS Live Messenger incoming and outgoing messages through GFI WebMonitor’s IM Control Policies.

Phishing Site Protection
All websites that employees try to access are checked against an auto-updatable database. If a web site is found on the phishing URL list, it will be blocked and the user shown an appropriate message.

User/Group/IP based download control policies
The admin has the ability to create multiple user/group/IP based policies in order to reflect security policies in the organization. For example the admin can create a policy which prevents employees from downloading videos and MP3 files.

Scan Downloaded Files with Multiple Anti-virus Engines
GFI WebMonitor uses multiple virus scanners to protect you against inadvertently downloading malicious software. Using multiple scanners drastically reduces the average time taken to obtain the latest virus signatures, greatly reducing the risk to your site by each new virus. The single engine approach only protects you as far as that particular engine can, in terms of being the quickest to recognize and respond to a new outbreak.

By using multiple engines you get a much higher degree of protection, having multiple opportunities for your engine to be the early responder. Importantly, since each engine has its own heuristics and methods, each brings its own unique strength in detecting and correcting for the ever-increasing variety of viruses. Overall, more anti-virus engines means more virus protection.

Anti-virus Protection through Norman Virus Control and BitDefender

GFI WebMonitor is bundled with Norman Virus Control and BitDefender. Norman Virus Control is an industrial strength virus engine, having received the 100% Virus Bulletin award 19 times running. It also has ICSA and Checkmark certification. BitDefender is a very fast and flexible virus engine that excels by virtue of the number of formats it can recognize and scan. BitDefender is ICSA certified and has won the 100% Virus Bulletin award and countless awards for its excellent protection. GFI WebMonitor automatically checks and updates the Norman Virus Control and BitDefender definition files as they become available. The GFI WebMonitor price includes updates for one year.

Malware (trojans, spyware, etc.) blocking via Kaspersky – optional
To achieve greater security and enhance the benefits gained by scanning via multiple anti-virus engines, users can add the Kaspersky SuperSecure anti-virus engine, available as an optional add-on. The Kaspersky SuperSecure database includes support for the detection of malicious software that can perform remote administration, keyboard espionage, password detection, automatic dial-up to paid sites, automatic downloads of files containing explicit materials and more. GFI WebMonitor automatically checks and updates the Kaspersky definition files as they become available.

Protect Against Socially Engineered Phishing Websites
Phishing is a social engineering technique that is used by malicious hackers to acquire personal information such as usernames, passwords and credit card details.  These sites are designed to lead users to believe that they are passing on their details to the genuine company. Online shopping and credit card companies are among the most targeted phishing websites. GFI WebMonitor protects users from the potential risks of social engineering by blocking access to phishing websites. This is done through the use of an auto-updatable database of phishing URLs.

Manage which File Types Users can Download
You can create multiple user/group/IP-based control policies in order to block the download of particular file types (such as Javascript, MP3, MPEG, exe, and more) for particular users or groups or IP addresses. Dangerous files (for example Trojan downloader programs) often attempt to penetrate a system masked as an innocuous file. GFI WebMonitor uses its built-in file signature scanner to analyze and detect the real file type signatures of downloaded HTTP/FTP files.

GFI WebMonitor for ISA Server
Designed as a plug-in for Microsoft’s Internet Security and Acceleration (ISA) Server, GFI WebMonitor 2009 provides an outstanding level of management to IT administrators who want to monitor, control and report on what employees are doing on the Internet. GFI WebMonitor 2009, which seamlessly integrates with ISA Server, complements the powerful firewalling features while giving IT Administrators the ability to get a much clearer picture of what type of traffic is being filtered, what type of Internet requests are being sent to the server and the ability to apply policies and rules based on IP, user or groups.

Screenshots:

Click on a thumbnail to see that picture in full size!

GFI WebMonitor
GFI WebMonitor main screen	GFI WebMonitor Dashboard	Monitors connections and provides statistics
Monitors user online activity	User, IP and URL whitelists	User, IP and URL blacklists
Manage web access based on configurable web filters	Uses WebGrade database to categorize/filter website requests	Uses multiple anti-virus engines to scan for viruses and spam
Anti-phishing engine filters phishing content	Notifies administrators via email on critical issues	Quarantines malicious web traffic for review by administrator
Setting rules for IM Control policy	Top bandwidth consumption by categories
GFI WebMonitor ReportPack
Custom report wizard	List of default reports	Import and export configuration
Schedule report wizard	Bandwidth usage by websites	Hits by classification

GFI WebMonitor ReportPack:

The GFI WebMonitor 2009 ReportPacks are full-featured reporting companions that add on free to both editions of GFI WebMonitor 2009. It assists systems administrators in understanding what network users are up to on the Internet. The reports will show the most frequently accessed websites, bandwidth usage and the number of viruses that were blocked by GFI WebMonitor 2009's anti-virus engines.

The GFI WebMonitor 2009 ReportPack works on both standalone proxy version and ISA Server version and includes several default and customizable reports:

Sample Reports

• Bandwidth Usage by Users
• Bandwidth Usage by Classification Trend
• Bandwidth Usage by Classification
• Bandwidth Usage by Websites
• Hits Usage Classification Trend
• Hits Usage by Users
• Hits Usage by Website
• Hits Usage by Classification
• Blocked Viruses per Antivirus Engine
• Blocked Viruses per User
• Blocked Viruses

Other Reports

• Blocked Virus Downloads Trend
• Blocked Virus Downloads
• Blocked Virus Downloads by Anti-Virus
• Blocked Virus Downloads by Threat
• By Mime Type
• Blocked Phishing Sites

The GFI WebMonitor 2009 ReportPacks are free add-ons to the GFI WebMonitor 2009 software.

Please Download and Install GFI WebMonitor 2009 before installing the ReportPack.

NOTE: The GFI WebMonitor 2009 ReportPack integrates fully with GFI ReportCenter™.

Awards and Reviews:

 

	Best Channel Product 2009 Award Five Best Channel Product Awards organized by Business Solutions Magazine have been given to GFI's products. GFI rated exceptionally well in the Network Security category and very high in terms of ease of upgrade and VAR's ability to service the product. The winning products are: GFI MailArchiver, GFI MailEssentials, GFI EndPointSecurity, GFI WebMointor and GFI MAX, the latest offering from GFI specifically for VARs, MSPs and IT support companies.
	GFI WebMonitor 2009: effective and immediate results Italian website ISAserver.it endorses GFI WebMonitor 2009 as being a "rich and complete" solution with a thorough review of the product's installation process. ISAserver.it maintain that the software is easy to install and configure, to the point that, documentation, whilst available, is not even needed - ISAserver.it, June 2009
	GFI WebMonitor: comprehensive monitoring tool GFI WebMonitor installs directly on top of your existing ISA Server installation "adding much greater and simpler control of ingress and egress web traffic". Installation and deployment are simple thanks to the step by step wizard - BlogFoo, 2009
	GFI WebMonitor: one of the best monitoring tools GFI WebMonitor impresses Augusto Alvarez as "one of the best monitoring tools for bandwidth consumption" that is easy to configure and requires "minimum overhead in network connectivity" - Augusto Alvarez, 2009
	GFI WebMonitor for ISA Server receives four stars in a review in SC Magazine. The product is a comprehensive monitoring tool and is extremely useful to add features that are missing from Microsoft ISA Server. - SC Magazine, 2009
	GFI WebMonitor wins award in the Content Security category GFI WebMonitor™ has been selected the winner in the Content Security category of the ISAserver.org Readers’ Choice Awards, organized by the leading Microsoft ISA Server resource site. The award serves as a mark of excellence, providing the ultimate recognition from peers within the industry. - ISAserver.org, December 2008
	Web monitoring and anti-virus solution tops the Access Control category GFI WebMonitor™ has been selected as the best solution in the ISA Monitoring and Management category on ISAserver.org. - ISAserver.org, October 2008
	Network Product Guide Award for GFI WebMonitor GFI WebMonitor™ for ISA Server has been named the winner of the 2008 Best Products and Services Award in the web filtering category by Network Products Guide, a Silicon Valley Communications publication on technologies and solutions. - NetworkProductsGuide, August 2008
	Competent ISA add-in In a comparative review of Web Content Management in SC Magazine, GFI WebMonitor™ WebFilter Edition is given four stars out of five. The reviewer says that the product plugs right into ISA Server very easily and adds some nice filtering capability. He says it is “a competent add-in for MS ISA Server at a very good price”. - SC Magazine, April 2008
	GFI WebMonitor wins award in Monitoring & Management solution category GFI WebMonitor™ has been selected the winner in the Monitoring & Management solution category of the ISAserver.org Readers’ Choice Awards, organized by the leading Microsoft ISA Server resource site. The award serves as a mark of excellence, providing the ultimate recognition from peers within the industry. - ISAserver.org, October 2007
	4.5 out of 5 for GFI WebMonitor In a review on About.com, Ryan Groom says GFI WebMonitor™ "lives up to being one of those tools" to control users’ browsing activities and to protect the network against viruses and malware. He praises the product’s ease of installation and use, adding that it "is an excellent addition to any ISA installation. The control and knowledge that an administrator can glean from using the tool is definitely worth the price tag for the peace of mind it affords". He concludes with a recommendation: "If you have ISA 2006, get GFI WebMonitor for ISA." - BizSecurity.about.com, September 2007
	Excellent value solution In a review of GFI WebMonitor™, Tarek Majdalani describes the product as "solid, easy to use, well documented and well supported" and gives it 4.5 stars out of 5. He says it provides the perfect balance between best-of-breed security protection and ease of use, as well as being light on system resources. Priced at the low end of the spectrum, Majdalani said it is "excellent value for organizations of just about any size". Concluding, he recommends GFI WebMonitor for "its performance, feature set, cost and ease of use". - Elmajdal.net, September 2007
	GFI WebMonitor award in anti-virus category GFI WebMonitor™ has been selected the second runner-up in the Anti Virus category of the ISAserver.org Readers’ Choice Awards, organized by the leading Microsoft ISA Server resource site. The award serves as a mark of excellence, providing the ultimate recognition from peers within the industry. - ISAserver.org, June 2007
	GFI WebMonitor award in access control category GFI WebMonitor™ has been selected the winner for the second year running in the Access Control category of the ISAserver.org Readers’ Choice Awards, organized by the leading Microsoft ISA Server resource site. The award serves as a mark of excellence, providing the ultimate recognition from peers within the industry. - ISAserver.org, April 2007
	Web monitoring and anti-virus solution tops the Access Control category GFI WebMonitor for ISA Server was selected by ISAserver.org readers as the first runner up in the Content Security category of the ISAserver.org Readers’ Choice Awards. - ISAserver.org, December 2006
	GFI WebMonitor voted best in Monitoring and Administration ISAserver.org readers vote GFI WebMonitor™ as the winner in the Monitoring and Administration category of the ISAserver.org Readers’ Choice Awards. - ISAserver.org, October 2006
	GFI WebMonitor wins Access Control Readers' Choice Award ISAserver.org readers voted GFI WebMonitor™ for ISA Server as the winner in the Access Control category of the ISAserver.org Readers’ Choice Awards. The awards draw a huge response per category and are based entirely on the visitors’ votes. - ISAserver.org, April 2006
	Slick and easy to configure GFI WebMonitor™ for ISA Server received the Silver Award from popular resource site ISAserver.org. In a review about the importance of increasing protection against exploits that take place over the web, reviewer Thomas Schinder described GFI WebMonitor for ISA Server as "one of the slickest and easiest to configure and manage solutions". The review praises the product's "useful web access and monitoring features", which include the ability to "monitor user activity in real-time", "quickly view a URL history", "block access to adult websites/domains" and "check all web and web proxy mediated FTP downloads". - ISAserver.org, January 2006
	"A must have add-on for every ISA 2000/2004 installation" GFI WebMonitor™ 2 for ISA Server was described by reviewer Thomas Shinder as “a dream come true for ISA firewall administrators” since “it fills an important gap in the ISA Server 2000/2004 firewall feature set”. GFI WebMonitor 2 provides “a way to view in real-time what users are accessing on the web”. The reviewer also points out that slow Internet performance that arises from users who download large files can be stopped because the product allows for “an easy way to disconnect users who are downloading giant sized files” without having to “go through the ISA 2004 real-time log monitor” and additional steps. - ISAserver.org, July 2004
	GFI WebMonitor highlighted as exceptional product Windows & .Net Magazine reader, Peter Vogel of Vancouver, British Columbia applauded GFI Webmonitor™ in the magazine's What’s Hot section. The reader uses GFI WebMonitor in a school network environment with servers handling internal Internet traffic for both students and staff, as well as about two dozen sites. Mr. Vogel stated, “The product lets me get a quick snapshot of Internet traffic on those servers. As far as I know, short of going into the ISA Server traffic logs themselves, there’s no other way to get such a snapshot in what’s essentially real-time.” - Windows & .Net Magazine, June 2004
	5-star rating for GFI WebMonitor for ISA Server Softforall.com, a site providing high quality shareware and freeware, awarded GFI WebMonitor™ for ISA Server the highest possible rating of five stars. - Softforall.com, October 2003
	High score for GFI WebMonitor Sharewareriver.com, a web-site featuring a vast collection of shareware and freeware software on the Internet, awarded GFI WebMonitor™ for ISA Server 4 out of 5 points. - SharewareRiver.com, September 2003
	GFI WebMonitor for ISA Server awarded Top software distribution site FileTransit.com, which features high quality software, awarded GFI WebMonitor™ for ISA Server full marks, giving the product a 5-star rating. - FileTransit.com, May 2003
	Track down bandwidth hogs "The good folks at GFI have given us yet another great tool and the best news is it's free," writes well-known reviewer Andy Goodman. "Ever wonder who's doing what on the web tying up all that bandwidth? Well here is a way for you to find out, from anywhere on the network... GFI WebMonitor™ for ISA installs in under a minute as a Web filter and self-configures. It does require a restart of the Web Proxy Service, however you will not need to reboot the server." - DownHome Computers, December 2002

GFI WebMonitor FAQs:

What is the difference between the versions of GFI WebMonitor?
See the GFI WebMonitor features.

What types of authentication options are available in the standalone version of GFI WebMonitor?
See section 6.3.3 of Getting Started Guide for information on authentication.

How are users counted in GFI WebMonitor?
Licensing is based on users when authentication is enabled or IP addresses if it is not.

How do we configure clients to use GFI WebMonitor as the proxy and how do we prevent them from bypassing it?
The user's Internet browser must be configured to use the GFI WebMonitor server as the proxy to enforce web filtering.  With Internet Explorer, this can be configured with Group Policy.  With other browsers, it is best to use the port blocking or traffic forwarding options found in section 2.2.4 of Getting Started Guide.

What type of reporting is available?
From within the product, the user has access to extensive real-time drill-down reporting/monitoring data such as the top policy breakers, hidden downloads and so on. In addition, all customers get access to the free GFI WebMonitor 2009 ReportPack which is a full-featured reporting companion to both editions of GFI WebMonitor 2009. It assists systems administrators in understanding what network users are up to on the Internet. Amidst other info, the reports show the browsing history including the most frequently accessed websites, bandwidth usage trends, and the number of viruses that were blocked by GFI WebMonitor 2009's anti-virus engines. See the GFI WebMonitor ReportPack area for example reports.

Which features are available in the Freeware version of GFI WebMonitor?
The Freeware version includes the ability to monitor the browser activity of your users and the ability to configure WebFilter or WebSecurity policies that control user activity is available in the licensed versions.

GFI WebMonitor System Requirements for ISA server:

 

System Requirements: Hardware

Minimum hardware requirement depends on GFI WebMonitor edition.

WebFilter Edition – Minimum hardware requirements

• Processor: 2.0 GHz
• RAM: 1 GB (Recommended 4GB)
• Hard disk: 2 GB of available disk space.

WebSecurity Edition – Minimum hardware requirements

• Processor: 2.0 GHz
• RAM: 1 GB (Recommended 4GB)
• Hard disk: 10 GB of available disk space.

GFI WebMonitor for ISA UnifiedProtection Edition – Minimum hardware requirements

• Processor: 2.0 GHz
• RAM: 2 GB (Recommended 4GB)
• Hard disk: 12 GB of available disk space.

NOTE: Hard disc size depends on your environment, the size specified in the requirements is the minimum required to install and use GFI WebMonitor. The recommended is from 150-250GB.

System Requirements: Software

Supported Operating Systems

GFI WebMonitor for ISA server can be installed on:

• Windows 2000 Server SP4
• Windows 2003 Server

Other required components

• Microsoft ISA Server 2004 (SP3) or later
• Internet Explorer 6 or later
• .NET framework 2.0
• TCP/IP port 1007
• Microsoft Firewall

Documentation:

Download the GFI WebMonitor Data Sheet (PDF).