topic Re: Monitor the application usage for our users in Firewall and Security Management

Monitor the application usage for our users

constant69 — Tue, 23 Mar 2021 07:53:55 GMT

Hello Team,

We are trying to monitor the application usage for your users.

HTTPS Inspection is enabled.

I have attached a afileand you can see from the screenshot provided, that some applications that we have in the rule explicitly work correctly, but something like Facebook, does not.

From what we have observed, we need to explicitly place the application in the application section. Since Facebook was not, but Evernote was, Evernote was logged in, but not Facebook.

I hope I can find somebody here to confirm that.

Regards

Re: Monitor the application usage for our users

G_W_Albrecht — Tue, 23 Mar 2021 08:10:14 GMT

screenshots are much too small to be able to see anything, and i do not understand your question !

Re: Monitor the application usage for our users

constant69 — Tue, 23 Mar 2021 08:16:36 GMT

I have attached a screenshot of the both rules.

Re: Monitor the application usage for our users

G_W_Albrecht — Tue, 23 Mar 2021 09:42:29 GMT

But what is your question ? This rule does not make sense to me, as you allow something, and in next rule, allow all ?

I can see neither evernote nor faceboog here...

Re: Monitor the application usage for our users

constant69 — Tue, 23 Mar 2021 09:54:04 GMT

We are trying to monitor the application usage for your users and my intention was to create only one rule (the second in the picture) and I have created both rule for the following test

- If we gain access to “evernote” or “gmail”, the rule 1 of layer “Application” log correctly field “Application Control”
- If we gain access to another “Application Control” (Like Facebook), the rule 2 of layer “Application” does not log the field “Application Control”.

Re: Monitor the application usage for our users

G_W_Albrecht — Wed, 24 Mar 2021 09:03:24 GMT

Look into https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_NexGenSecurityGateway_Guide/136972.htm#o158017 on how to do this! As long as no services and applications are added to the column, rule will not match, also see sk73220 ATRG: Application Control for details of matching.

Re: Monitor the application usage for our users

PhoneBoy — Tue, 23 Mar 2021 20:50:39 GMT

Set the Track for Rule 2 to be Detailed Log as otherwise it is not necessary for App Control to be active for this rule to be enforced otherwise.

Re: Monitor the application usage for our users

constant69 — Wed, 24 Mar 2021 09:07:04 GMT

I have tried set the track for rule 2 to be Detailed Log and the result is the same: this rule match but I still haven't got the information related to "Application Control"

Re: Monitor the application usage for our users

constant69 — Wed, 24 Mar 2021 09:11:02 GMT

I'm going to read sk73220 ATRG again, maybe I forgot something.

Precision: the rule 2 match for others applications (Those not specified in the rule 1), but the logs related to this rule 2 haven't got the information related to "Application Control"

Re: Monitor the application usage for our users

G_W_Albrecht — Wed, 24 Mar 2021 09:15:27 GMT

You can ask TAC and let them explain it to you 8)

Re: Monitor the application usage for our users

Martin_Raska — Wed, 24 Mar 2021 10:28:41 GMT

are you look at logs with blade: Application Control?

Re: Monitor the application usage for our users

constant69 — Wed, 24 Mar 2021 15:44:02 GMT

Yes!

Re: Monitor the application usage for our users

Martin_Raska — Tue, 30 Mar 2021 09:18:20 GMT

Show us the rules you are trying to hit and the exact log you are actually hitting.

Re: Monitor the application usage for our users

constant69 — Thu, 01 Apr 2021 19:27:00 GMT

The solution consist to select "Detailed Log" in the field Track