topic Re: Custom applications in reports in Firewall and Security Management

Custom applications in reports

Borut — Fri, 27 Nov 2020 12:40:12 GMT

We have created a custom application/site object to use in the https inspection bypass rule. It contains trusted domains and services we want to exclude from inspection. Let's call it HTTPS_inspection_bypass. This custom app is only used in HTTPS inspection policy.

Since there is a lot of traffic to this domains this custom application is almost always on the top of the TOP applications list in the reports and the granular visibility per application/site is lost. So, instead of gmail.com, microsoft.com, lync.com etc., we only get HTTPS_inspection_bypass as an application, swallowing all the included domains, making reports somewhat lacking in precision.

I'm quite sure this is by design, but is there a way around that?

Re: Custom applications in reports

PhoneBoy — Fri, 27 Nov 2020 17:04:47 GMT

Perhaps instead of creating a single object, you create multiple and put them in a group in the rule instead?

Re: Custom applications in reports

Amir_Senn — Sun, 29 Nov 2020 08:45:49 GMT

I suggest going to the filters and filter this application out.

Select "Application Name" "Not Equals" "<custom_application_name>"

If you have issues with that you can also try to use "Custom Filter"

Re: Custom applications in reports

D_W — Tue, 01 Dec 2020 08:01:40 GMT

Hello

it seems I have the same question (https://community.checkpoint.com/t5/Logging-and-Reporting/Show-application-group-members-in-reports/td-p/103706/jump-to/first-unread-message)..

So now I added these filters but now i do not see any hits from this custom application right?

Cheers,
David

Re: Custom applications in reports

Borut — Tue, 01 Dec 2020 08:40:34 GMT

yes, i have the same concern. If you're talking about report filters, then nothing contained in the custom app will show in the report.

@D_W probably described our intentions better in his post: We would prefer to see the group members instead of the groups in the reports.

Re: Custom applications in reports

anstelios — Wed, 04 May 2022 12:23:33 GMT

2022 still this is the default behavior..

Is there a way to enforce logs/reports to ignore custom application category tag (not the data, just the tag) and try to show the real application on the report/log ??

A lot, if not all, of customers are asking for this...

Re: Custom applications in reports

Jimmy_Noel — Sun, 12 Mar 2023 12:57:42 GMT

Hello!

Are there any updates on this issue?

We recently switched our url-filter from another vendor to checkpoint.
We need reports to see every website (not grouped by custom application objects).
(We have several custom applications with about 100 urls.)
We can not present this kind of report to our internal affairs department.

Maybe are there any workarounds?

Re: Custom applications in reports

Amir_Senn — Sun, 12 Mar 2023 16:23:54 GMT

If you want to see all the application you will need to use a table widget.

The tables are also limited to a specific number that could be shown on screen but if you edit the view/report settings and check the "Split table over multiple pages" and select your table and "No page limit". Now when you perform export on this view it will show all the matches will split it across as many pages as needed.

Re: Custom applications in reports

anstelios — Sun, 12 Mar 2023 17:19:14 GMT

Very common issue after migrating from another vendor.

The only solution still remains what PhoneBoy said on the first answer,
Ditch the custom applications containing 100 URLs, and create one custom application for each URL with a name that is related to the URL so you can understand it in the reports... !!!
Then group these custom applications so you can use the groups in the rules.

Harsh,,,, I know..!!!

Re: Custom applications in reports

Jimmy_Noel — Fri, 17 Mar 2023 16:53:36 GMT

Thank you for your replies.
Well i unterestimated the amount of url entries.
In total we have above 3000 url entries... (yes)
So we are still thinking about alternatives.

Re: Custom applications in reports

Jimmy_Noel — Tue, 19 Aug 2025 06:07:48 GMT

Sadly, still no solution.
We also have to have some custom applications with url: *.tld
So it is impossible to get a granular report/view for each website (website.tld).