Can I configure complex views using smart reporter?

[Blason_R]

Hello,

I am really curious whether complex operations can be visualized through views in Smart Console? I require a plot of source IP addresses that have communicated with destination IP addresses exceeding 20 GB within a single day. These should be grouped by destination address, excluding port 443 and UDP 53, and the destination addresses must not be RFC1918.

[PhoneBoy · Accepted solution]

From what I remember of SmartEvent, I don't think you can create a report like that.

[the_rock · Accepted solution]

Customer asked me that exact thing last year and TAC told me it was not possible. They did mention it could be doable possibly by exporting logs to external tool, but not via smart console.

Andy

[Blason_R]

Yeah that is right but then I built elaticsearch and started ingesting logs there to build a complex queries.

[the_rock]

Yeah, you can do that. I had one of my colleagues show me, he is SIEM genius...lots of possibilites.

Andy