Check Point custom reporting

[Lucky_Muthavhin]

Good Day,

My management is conducting an investigation on one of our users and as such they want detail internet usage reports which I have provided but now after they saw the user spent much time on YouTube and they would like to find out what videos was the user watching. Does anyone know how I can accomplish this?

I have run a report and filtered Resource and it provides the links but the link are broken and I cannot access them.

Please help me out

Thanks,

Lucky Muthavhine

[ED · Accepted solution]

Hi,

Not sure if this will help but I will try.  My suggestion is to use advanced track options like "Detailed Log" and "Extended Log" if you have enabled one or more of these blades on the Layer: Applications & URL Filtering, Content Awareness, or Mobile Access

So if you create a new policy rule for Youtube in the "Service and Application" column and set the "Track" column to "Extended Log" the URLs will show in the Logs view hereafter. Don't know if you have already done this. 

• Detailed Log - Equivalent to the Log option, but also shows the application that matched the connections, even if the rule does not specify an application. Best Practice - Use for a cleanup rule (Any/Internet/Accept) of an Applications and URL Filtering Policy Layer that was upgraded from an R77 Application Control Rule Base.
• Extended Log - Equivalent to the Detailed option, but also shows a full list of URLs and files in the connection or the session. The URLs and files show in the lower pane of the Logs view.

Addditional logging adds a performance impact. 

This might also be relevant which is is added automatic I believe when you use an application in the "Service and Application" column. 

• Accounting - Select this to update the log at 10 minute intervals, to show how much data has passed in the connection: Upload bytes, Download bytes, and browse time.

[Alejandro_Mont1]

This looks good however keep in mind that it will not help you go back to see what the user was watching. It would only be helpful in reports generated after the updated policy was installed.