topic Re: Reports Base on User Groups in Firewall and Security Management

Reports Base on User Groups

biskit — Fri, 05 Feb 2021 18:09:00 GMT

I'm trying to create a simple report for VPN user log in activity based on User Groups.

I'd like the report to be filtered on "User Group" > "Equals" > whatever.....

It isn't working.

When I add the User Group column to my report and filter on my username instead, I get a report but the User Group column is empty which explains why the report I want doesn't work.

Anyone know why User Group is empty in the report? The user shown in the report is a Check Point user, and is in multiple User Groups...

Re: Reports Base on User Groups

PhoneBoy — Sat, 06 Feb 2021 17:54:04 GMT

If you pull up the individual log entry, do the groups show there?

Re: Reports Base on User Groups

biskit — Sat, 06 Feb 2021 21:40:59 GMT

Yep. That username is in 3 groups, and all 3 groups show on the log card for the "Log In" event. So the data is there but the Reports aren't populating it 🙄

Re: Reports Base on User Groups

PhoneBoy — Mon, 08 Feb 2021 04:41:09 GMT

What kind of group is it?
One of the legacy ones or an Access Role?

Re: Reports Base on User Groups

biskit — Mon, 08 Feb 2021 09:52:49 GMT

This is all legacy users and groups.

Re: Reports Base on User Groups

Leader_Kiongi — Tue, 02 Jan 2024 17:04:40 GMT

@biskit , did you find a solution ? I have the same issue with SmartView. I can see those groups in SmartConsole but not with SmartView.

Thanks !

Regards,

Alain

Re: Reports Base on User Groups

Amir_Senn — Wed, 03 Jan 2024 16:09:12 GMT

Hi,

I tried to use the column in SmartView and I got answers (for both statistical and logs tables). Also worked as a filter.

So at this point I have a few ideas about this:

1. We have a few views that were made in the following link, perhaps one of those suits for you https://community.checkpoint.com/t5/SmartEvent/bd-p/SmartEvent

2. Please check that the relevant user group appears in the logs you filtered. Best way it to start drill down until you get the actual logs.

3. If information appears on VPN logs, might be the field is not indexed for SmartView. Perhaps creating an event based on this logs (via correlation unit/SmartEvent) we can take the relevant information from the correlated log instead of the VPN.

4. My test logs are IDA based, FYI.

Re: Reports Base on User Groups

Leader_Kiongi — Thu, 04 Jan 2024 08:46:57 GMT

Thanks @Amir_Senn for your response. Unfortunately, views you provided don't suit my needs. What I'm trying to do is exporting all AD groups still used for VPN authentication. I can only do that in SmartView. The issue is that User Group column is empty in SmartView but I do see data in SmartConsole. When I click on individual logs, I see those groups in logs details (see screenshots enclosed). What could be wrong ?

Thanks in advance for your help.

Regards,

Alain Ikula

Re: Reports Base on User Groups

Amir_Senn — Sun, 07 Jan 2024 09:12:57 GMT

In the table settings, click on the object and try to check this box:

Another possibility is that you're filtering too much logs. Try to apply the same filter from SmartView to logs view and see that the filter brings desired logs.

Re: Reports Base on User Groups

JozkoMrkvicka — Sun, 07 Jan 2024 10:10:43 GMT

use Web SmartView (https://xxx.xxx.xxx.xxx/smartview) with filter "Log In". With that, you can export all relevant logs and User Groups will be exported.

I never used SmartConsole SmartView tab for exporting, since you can export only logs which you see on screen. Anyway, there is some bug over there with showing User Groups in SmartConsole summary logs.

Re: Reports Base on User Groups

Leader_Kiongi — Mon, 08 Jan 2024 07:59:30 GMT

Which table are you talking about ? I'm using exactly the same filter in SmartConsole as in Web SmartView. Here's the filter:

(((action:"Log In")) AND (product:"Mobile Access")) AND (NOT action:"Failed Log In").

Thanks !

Regards,

Alain

Re: Reports Base on User Groups

Leader_Kiongi — Mon, 08 Jan 2024 08:01:50 GMT

This is exactly what I'm doing, as it's not possible to export logs to csv from SmartConsole (see enclosed).

Thanks !

Regards,

Alain IKULA

Re: Reports Base on User Groups

Amir_Senn — Mon, 08 Jan 2024 17:00:23 GMT

I meant comparing between SmartView (not webapp but views and reports tool) and logs view (no difference between webapp and SmartConsole).

This is how to edit the table in SmartView:

1. Open view in edit mode

2. Click on the wheel in the corner (highlighted)

3. Select the desired field (User Group)

4. Uncheck the "Show results with empty value".

Re: Reports Base on User Groups

JozkoMrkvicka — Tue, 09 Jan 2024 06:42:49 GMT

forgot to mention that within Web SmartView, you have to export ALL collumns, NOT the visible ones.

If you do export of all collumns, User Groups will be in csv.

Re: Reports Base on User Groups

Leader_Kiongi — Tue, 09 Jan 2024 10:01:22 GMT

Thanks @Amir_Senn . As User Group is also empty in Smartview (view s tool in SmartConsole, see enclosed), I have no data when I uncheck "Show results with empty value". So, this values seem to disappear between logs in SmartConsole and SmartView (whether views tool in SmartConsole or SmartView WebApp). Do you know why ?

Thanks again for your support.

Regards,

Alain

Re: Reports Base on User Groups

Amir_Senn — Tue, 09 Jan 2024 17:19:16 GMT

Then my next steps will be:

a. Version/JHF upgrade/update to see if issue was already solved

b. TAC support