topic Re: query for OS Name R80.30 smart console or smart event in Firewall & Security Management

query for OS Name R80.30 smart console or smart event

Daniel_Kavan — Wed, 17 Jun 2020 21:16:34 GMT

Hi,

Is there a way to query for 'OS Name' in tracker, smart event, or smart log? We want to find out who is still running 'windows 7' when they log into the MAB.

Re: query for OS Name R80.30 smart console or smart event

Dror_Aharony — Thu, 18 Jun 2020 06:20:43 GMT

Yes. Client OS Version field should be available for filtering in both SmartLog & SmartEvent's Views/Reports.

Does that help you?

Re: query for OS Name R80.30 smart console or smart event

Daniel_Kavan — Thu, 18 Jun 2020 13:31:05 GMT

Searching on "Client OS Version" bring up nothing.

I created a View with User in the X axis and OS Version in the Y axis, but it shows "Query Failed"

my first View

Re: query for OS Name R80.30 smart console or smart event

Dror_Aharony — Thu, 18 Jun 2020 13:34:46 GMT

I apologize, It's "Client Type OS".

Re: query for OS Name R80.30 smart console or smart event

Daniel_Kavan — Thu, 18 Jun 2020 13:38:25 GMT

No results Client Type OS

Re: query for OS Name R80.30 smart console or smart event

Dror_Aharony — Thu, 18 Jun 2020 13:49:04 GMT

No, that's the field name.

Add it as a field in SmartEvent's Views/Reports for filtering, as I've shown in my Pic & see if you get any results.

for SmartLog: Simply search the value as free-text, like "Windows 10".

Re: query for OS Name R80.30 smart console or smart event

Daniel_Kavan — Thu, 18 Jun 2020 14:04:01 GMT

I tried it as a field name in my view as well.

Thank you for your help, I'm not seeing your picture, but I am able to query on "Windows 7" thank you.

Re: query for OS Name R80.30 smart console or smart event

Daniel_Kavan — Thu, 18 Jun 2020 14:17:34 GMT

For whatever reason, a query of "Windows 7" or "Windows 10.0" doesn't return results from the Mobile Access Blade traffic.

See attached. This is a result isn't returned with a "Windows 7" or "Windows 10.0" query.

Re: query for OS Name R80.30 smart console or smart event

Daniel_Kavan — Thu, 18 Jun 2020 14:23:28 GMT

This query comes close, but does NOT include version number, I have to manually scroll thru the results.

blade:"Mobile Access" AND os_name:Windows