topic Re: Monthly user report. in Firewall and Security Management

Monthly user report.

Eric_Speake — Tue, 04 Dec 2018 15:21:30 GMT

I'm looking for documentation or ideas on being able to run monthly reports on user activity. We used to be able to do this and then an upgrade broke this. All ideas are appreciated.

Eric

Re: Monthly user report.

PhoneBoy — Wed, 05 Dec 2018 03:03:31 GMT

What version were you in before?

What report did you run before? In SmartEvent, Smart Reporter?

What version are you running now?

What report are you running now and what is the result?

More details will allow us to help you.

Re: Monthly user report.

Eric_Speake — Wed, 05 Dec 2018 15:00:46 GMT

It broke when we went to 77.30. We are finishing our 88.10 upgrade and running 88.10 console. I am trying to run the User activity report. I would like to script it or set it up to sort by user or create a report for each user. Our end goal would be to have reports available to upper level management and Human Resources without have to run individual reports. Also this would give us more history than the past month for their use.

Thanks,

Eric

Re: Monthly user report.

PhoneBoy — Wed, 05 Dec 2018 18:10:23 GMT

When you run the User Activity report now, what happens?

For the User Activity report to contain user information, you need to be using Identity Awareness.

Otherwise, you'll have to do something like this to the User Activity report and filter the report based on subnet or similar.

Note that I also set the "number of values" in Application Name to something more than 5 as well.

Re: Monthly user report.

Eric_Speake — Mon, 10 Dec 2018 13:31:11 GMT

Dameon,

We do use ID Awareness. And if I run an individual report it runs as it should. Our issue is that we will get a request for a time period from a couple of months ago and that information is archived. We used to be able to run an automatic report for each user. So I'm trying to get that reporting again. I'm not sure if it is possible without scripting to run the report.

Thanks,

Eric

Re: Monthly user report.

PhoneBoy — Mon, 10 Dec 2018 15:44:13 GMT

When you say "that information is archived" what do you mean?

The logs are archived off the system?

Because you should be able to run a report on a specific user for a timeframe in the past, assuming the logs are present.

Re: Monthly user report.

Eric_Speake — Wed, 12 Dec 2018 15:05:09 GMT

Yes it is off the system. We have way too much traffic to keep more than 30 days indexed. Maybe I'm being confusing. I want to schedule a report to the first day of the month that will show the user activity for each user as an individual report. This way when someone wants to look at the past month(s) they can get the information from a repository we setup. According to others on our team that have been using this FW longer than I have, we used to do this and it was broken on an upgrade.

Thanks,

Eric

Re: Monthly user report.

PhoneBoy — Wed, 12 Dec 2018 18:33:40 GMT

I understand what you want.

Before we can schedule reports, we first need to understand what happens when you run a report right now.

Are you able to run a report that shows you the required information on demand with the current data?