topic Share your custom SmartView views & reports at CheckMates in Firewall and Security Management

Share your custom SmartView views & reports at CheckMates

Tomer_Sole — Tue, 22 Jun 2021 21:24:36 GMT

Hi everyone,

R80.10 SmartEvent has a very capable engine for customized views and reports based on logs & audit logs. The front-end is called SmartView.

We want to use this community to share our customized dashboards and reports created with SmartView.

Let's have this thread as the main discussion of all custom reports - so that newcomers to SmartEvent will have one place with a repository of custom reports to choose from. I'm thinking of having this thread as the UI-equivalent of the highly popular My Top 3 Check Point CLI commands

Re: Share your custom SmartView views & reports at CheckMates

Tomer_Sole — Thu, 07 Jan 2021 06:04:42 GMT

Using SmartView for Change Management:

R80.10 SmartView works with logs as well as audit logs.

In this example, I created a new customized report to describe what were the changes that my administrators performed this week. I used the Cloud Demo Mode for the data.

Please unzip the attached file, and import the .cpr file to your SmartConsole.

Re: Share your custom SmartView views & reports at CheckMates

Tomer_Sole — Fri, 23 Mar 2018 07:24:10 GMT

To share:

1. Export your view or report, either within SmartConsole or from your web browser by clicking here:

2. Open a new tab

3. Navigate to Scheduled Reports-->Archive

4. Find your exported view or report in the list and choose "Download". Save this .cpr file on your computer

5. Now go back to the CheckMates Community and choose to post a new file.

By default, a posted file is a thread of its own, and other users can comment on it. You can choose whether you want to keep these settings, or lock users

In the next steps, we will make sure that we don't go lost by pointing the file to this thread rather than a thread per file.

6. For the clarity of things, you can rename the name of the posted file and add some comments, most importantly - make sure that you post this file under Logs & Monitor.

7. In order to avoid confusion, let's have this thread as the main discussion of all custom reports - so that newcomers to SmartEvent will have one place with a repository of custom reports to choose from. I'm thinking of having this thread as the UI-equivalent of the highly popular My Top 3 Check Point CLI commands

Do this by restricting users from commenting on the topic that was opened for your newly-uploaded file:

8. OK - you have your file posted, now reply in this thread with the link, and add a nice screenshot.

To import a shared file:

In SmartConsole or in your browser, open a new SmartView tab, and choose "Import".

Please note that imported views will appear at the Views page and imported reports will appear at the Reports page. So you may end up importing a report file at Views only to found out it went to the Reports page.

Re: Share your custom SmartView views & reports at CheckMates

Kaspars_Zibarts — Fri, 23 Mar 2018 08:10:41 GMT

Silly Q: in MDS case what are actual SmartEvent license requirements? Is it per CMA?

Re: Share your custom SmartView views & reports at CheckMates

Marco_Valenti — Fri, 23 Mar 2018 08:35:44 GMT

smart event license is required for using smartview and if I am correct it is not relative to the cma as long you activate the cma in the smart event ofc

Re: Share your custom SmartView views & reports at CheckMates

Marco_Valenti — Fri, 23 Mar 2018 10:32:38 GMT

Nice work thanks for sharing , trying to set up this report for multidomain at the moment

Re: Share your custom SmartView views & reports at CheckMates

PhoneBoy — Fri, 23 Mar 2018 12:55:41 GMT

In an MDS environment, I believe you have to run SmartEvent on a separate server entirely.

It's licensed based on number of gateways.

That said, I believe SmartView should work without a SmartEvent license since it is also a log viewer.

Re: Share your custom SmartView views & reports at CheckMates

Vladimir — Fri, 23 Mar 2018 17:26:47 GMT

Tomer,

Thank you for sharing and I intend to do the same, should I come-up with something worthy:)

Can you suggest how to configure report for the Remote Access duration summary and per user filtered over time?

Re: Share your custom SmartView views & reports at CheckMates

Vladimir — Fri, 23 Mar 2018 17:28:40 GMT

I've noticed that "Policies" and "Sessions" numbers in your report are identical as were in mine. I suspect this is incorrect.

Re: Share your custom SmartView views & reports at CheckMates

Kfir_Dadosh — Fri, 23 Mar 2018 17:58:36 GMT

SmartEvent is global and so is the license.

Make sure to assign global policy from MDS and connect to the MDS or CMA ip.

Re: Share your custom SmartView views & reports at CheckMates

Kim_Moberg — Sat, 24 Mar 2018 09:21:25 GMT

Tomer,

Awsome idea. What are the intention of the report? what time frame should be used here?

I mean, I understand the report intention is to track all changes made.

I have imported your report, but the 3rd page doesn't how all changes.. For example if I generate one report from January 1st until today, I know that I made a lot of changes, and the result on page 3, doesn't show all the changes.

Are your intention on weekly basis to generate this kind of report or what are the time line acceptance for this report?

Kim

Re: Share your custom SmartView views & reports at CheckMates

Tomer_Sole — Sun, 25 Mar 2018 05:25:19 GMT

If both of us used the Cloud Demo Mode which goes live with the same fake logs data then this makes sense.

Re: Share your custom SmartView views & reports at CheckMates

Vladimir — Sun, 25 Mar 2018 13:21:21 GMT

Nope, run it in my lab.

Re: Share your custom SmartView views & reports at CheckMates

Tomer_Sole — Sun, 25 Mar 2018 17:30:27 GMT

Reports are generated weekly.

Re: Share your custom SmartView views & reports at CheckMates

Kim_Moberg — Tue, 27 Mar 2018 15:27:42 GMT

I am trying to use some parts of your report and some from views from a view called cyber kill view made by a collegue of yours. It is a view based on Lockhead Martins Cyber Kill Chain.

So combined with your change mgmt / Audit logs I might being able to generate a Weekly report

When I can the report i only got three pages but when I can the report as a view I had a lot of entries on page 3.

Kim

Re: Share your custom SmartView views & reports at CheckMates

Chad_Hubich — Thu, 29 Mar 2018 15:22:16 GMT

I made this change to make 'Changes in each session' span multiple pages:

Options > Edit > View Settings > Split table across multiple pages with No page limit

Re: Share your custom SmartView views & reports at CheckMates

Vladimir — Fri, 30 Mar 2018 14:23:01 GMT

Guys,

I feel like a complete schmuck: I cannot figure out how to create a report for the remote access activity with summary for all users and individual users' logon/logoff and duration.

Help?

Re: Share your custom SmartView views & reports at CheckMates

Vladimir — Fri, 21 Jun 2019 09:00:52 GMT

Never mind, there is a bug in your widgets that prevents them from graphing the right stuff: the Duration is being measured in quantities of something, rather than time. Please kick it to RnD to take a look at. See https://community.checkpoint.com/thread/7343-buggy-widgets post for details.

Thank you,

Vladimir

Re: Share your custom SmartView views & reports at CheckMates

Christopher_Ta1 — Mon, 02 Apr 2018 01:50:37 GMT

I just want to view in the report who did the changes (delete object)?

Re: Share your custom SmartView views & reports at CheckMates

Tomer_Sole — Mon, 02 Apr 2018 05:23:29 GMT

Edit this widget and choose to add the column "Administrator".