Smartview log export

[Ihenock1011]

Hi All,

I want to optimize a rule written for a specific service and I wrote two rules. The first rule allows any source to a specific server, and the second rule allows that specific server to any destination. After about 15 days of learning the rule, I want to extract the logs. What I need to know is: Is it possible in SmartView to export logs from those specific rules only, or what kind of mechanism can I use?

Thanks

[the_rock]

Thats an excellent question. Let me test this in the lab and see what options it gives. I also have dedicated smart event server going, so might be possible there as well.

Best,

Andy

[the_rock]

Is this similar to what you might be after?

Andy

 

[Ihenock1011]

@the_rock Thanks a lot it works as I was intended. Thanks a lot

[JozkoMrkvicka · Accepted solution]

If you want to export only logs for specific rule(s), you can use rule UID. In SmartConsole, right click on specific rule number and select "Copy rule UID". Then go to the Web SmartView and paste that rule UID into search field. If more rules are needed to be exported, just add "OR" between rule UIDs in search field. Once logs are loaded, follow steps by Andy 😉