topic SmartEvent Report - Remote Administration Application Category in Firewall and Security Management

SmartEvent Report - Remote Administration Application Category

Perry_McGrew — Tue, 07 May 2024 14:25:17 GMT

Running R81.20. We are going thru process of allowing specific Remote Administration applications (ex. LogMeIn) to specific devices. I was looking in SmartEvent for a standard report or view that would give me a listing of all Remote PC control application names that is in that Remote Application category that has been used or attempted in last "x" days.

Re: SmartEvent Report - Remote Administration Application Category

RobertoQ — Tue, 07 May 2024 20:59:10 GMT

I put together an example View that can help. You can use it as is or play with the filters and widgets to customize your results. You can import the attached template to use in your SmartEvent.

Re: SmartEvent Report - Remote Administration Application Category

Perry_McGrew — Tue, 14 May 2024 15:29:04 GMT

Thanks Roberto. I got some decent results. I could not get the Accepted Application Types to display what they were -- For example it showed 12 Accepted Application Types and below in the Top Allowed Applications, it only listed 2 enteries. You click on the 12 Accepted Application Typesand it takes you to the raw logs which are pages and pages - not a summary listing like the Blocked Applications. Also "Export" does not work as expected -- wanted to send report to the CIO. The PDF output only lists the 1st application in the Top Blocked Applications table listing. Maybe its the limitation of the View vs a Report template?

Re: SmartEvent Report - Remote Administration Application Category

RobertoQ — Wed, 15 May 2024 02:13:51 GMT

You can try changing the table settings to show the data in a different way(options>edit). Also the export to PDF should export a PDF image of the View itself. There should not be any limitation in exporting a view. A view is a single page layout consisting of widgets, a report is a multiple page layout consisting of a cover page and any number of views.

Re: SmartEvent Report - Remote Administration Application Category

Perry_McGrew — Wed, 15 May 2024 14:53:39 GMT

I did try tweaking the settings as you suggested. Did not make a difference. The export as PDF just did not include all the entries listed in the Blocked Applications table. If I chose export as CSV, then I got them. Unfortunately, SmartEvent has always proved difficult for my Team to work with to get meaningful reports.

But really appreciated the example you provided. I was able to change it to look back 30 days.