topic Re: Filtering logs based on number of entries (source and destination) in Cloud Firewall

Filtering logs based on number of entries (source and destination)

ahmed_aburaihan — Mon, 16 Sep 2024 14:54:32 GMT

Hallo dear Seniors and Juniors

I am using Smartview to get Logs for a specific time period (for example from Date to Date).

I want that if the LOGS are generated for the same Source and Destination more than one time, it should not be shown.

Is there any nice query which could do that?

Thank you.

AAA.

Re: Filtering logs based on number of entries (source and destination)

PhoneBoy — Wed, 18 Sep 2024 17:44:26 GMT

For future logs...you can ensure the relevant rules logs by Session (instead of by Connection).
Even with that, I suspect you won't be able to suppress all the logs.

Re: Filtering logs based on number of entries (source and destination)

the_rock — Thu, 19 Sep 2024 02:57:55 GMT

Hey Ahmed,

What @PhoneBoy said is exactly the way to do it. I worked with a client few years back who inquired about the same and TAC actually gave them this answer. Not sure if there is alternate method of doing this, but this is what Im also aware of.

Best,

Andy

Re: Filtering logs based on number of entries (source and destination)

emmap — Thu, 19 Sep 2024 05:02:40 GMT

Anything beyond that would involve exporting the logs to CSV and using external tools to do your filtering/compressing.

Re: Filtering logs based on number of entries (source and destination)

ahmed_aburaihan — Thu, 19 Sep 2024 05:27:53 GMT

Hi @emmap

I actually did the same (ms excel), thank you for the comment.