Extended logging info in log export

[AB136785]

Hi all,

We have Extended Logging enabled on a particular rule in our firewall. We want to extract URLS from traffic that matches that rule and make the decision to add them to our allowlist or not. However, when I export logs to CSV with our rule and timeframe of interest, the URLs that are shown in the "Session > Web Traffic > Resource (see pic below)" subsection of the connection are not shown in the log file, even with all columns enabled. I was unable to find anything to have this information to show up in that log (or any other log), even though I have tried every logical search term that I can think of. Is there a setting that we're missing? Is there another way to get this information in a nice, orderly manner, perhaps with the Log Exporter? I am happy to read the documentation necessary, but right now I just cannot find _what_ I need exactly. Hope you guys are willing to point me in the right direction 🙂

Cheers,

AB

1900/2000 appliance, version R81.10, cannot find information on which take is installed. Application Control & URL Filtering blades are enabled.

[Lesley]

is it possible to share $EXPORTERDIR/targets/<Name of Log Exporter Configuration>/conf/FilterConfiguration.xml ?

[PhoneBoy]

Original poster was exporting logs from SmartView, which likely does not contain all the log fields.
Changing that would likely require an RFE. 

Log Exporter is for sending logs to a SIEM, which is probably not what you're looking for here.
I believe SmartEvent can provide this information (with the right report).

[AB136785]

Thank you both for the replies so far. Indeed, I was exporting logs using the Web Smartconsole, apologies for not clarifying that initially. All I'm looking for is a table/list of URLs that were visited in a specified timeframe by specific hosts, preferrably with an easier method than manually going through the logs, clicking on the events of interest, and looking at the session info manually for every event I need. Since you're suggesting filing a Request for Enhancement, I take it that that functionality does not exist (yet).

I'll create the RFE. In the meantime, if anyone else has some suggestions to achieve this - or another method to specifically filter specific destinations and downloads - feel free to contribute.

[PhoneBoy]

If you don't mind getting your hands dirty, maybe you can pull the information from the API: https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-logs~v2.1%20

[Lesley]

Ah my mistake was thinking this was about log exporter