topic Re: HTTPS Inspection in SmartEvent shows no data in Firewall and Security Management

HTTPS Inspection in SmartEvent shows no data

Danny — Fri, 18 Nov 2022 16:19:59 GMT

I copied the Rule UID of a HTTPS inspection rule to my clipboard.

I'm able to filter for this UID in SmartLog, however I'm unable to filter for it within SmartEvent / SmartView.
Is this a limitation? The behaviour is identical in every R81 / R81.10 environment I tried.

My goal was to create SmartEvent View for HTTPS Inspection to show the top HTTPSi bypass rules etc.

I checked sk144192 but I found no way to use these log fields in SmartEvent:

Security Gateway - HTTPS Inspection Fields
`https_inspection_rule_id`	HTTPS Inspection Rule ID	string	ID of the matched rule
`https_inspection_rule_name`	HTTPS Inspection Rule Name	string	Name of the matched rule
`app_properties`	Additional Categories	string	List of all found categories
`resource`	Resource	string	HTTPS resource Possible values: SNI or domain name
`https_validation`	HTTPS Validation	string	Precise error, describing HTTPS inspection failure
`https_inspection_action`	Inspection Action	string	HTTPS Inspection action (Inspect/Bypass/Error)

It seems that SmartEvent only has these two HTTPS Inspection fields:

Re: HTTPS Inspection in SmartEvent shows no data

PhoneBoy — Fri, 18 Nov 2022 19:53:53 GMT

Did you try just filtering on the rule UUID? (Treating it like a regular Access Policy rule)

Re: HTTPS Inspection in SmartEvent shows no data

Danny — Fri, 18 Nov 2022 23:09:02 GMT

That's what I did. Filtering the rule UID works in SmartLog,

but doesn't return anything in SmartEvent.

Re: HTTPS Inspection in SmartEvent shows no data

the_rock — Fri, 18 Nov 2022 23:47:12 GMT

Never really played around with https inspection filters in smart event, but will check next week. Yes, UUID does work in regular log filters.

Re: HTTPS Inspection in SmartEvent shows no data

Danny — Mon, 21 Nov 2022 07:46:44 GMT

I opened a SR with TAC. I'll update this thread when they find anything useful.