Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
jbfixurpc
Participant

Checkpoint Content Awareness reports

Greetings all

 

I have a question about the Content Awareness Report running on R80.30

The canned report shows activity which is of interest for us over a broad spectrum mainly tied to time (i.e. last 7 days, etc) However, when we specify a specific source (either User or IP address) the content of this report shows no information as it did with the broader view. As an example, with no search criteria I can see the top 5 file types, services and top files by size, but yet when I specify a single IP address this information is not there when in fact that IP address should show up with this data. 

I've opened a TAC case on this, and it's sounding like this is going to become a RFE.

Is no one actually using this means as a way of auditing? And/or if you are, how have you worked around this?

Ultimately we need to provide auditing based on user activity regarding file download/uploading but this feature appears to be broken via the Content Awareness report. 

 

 

CA_Report.JPG

 

Thanks in advance!

0 Kudos
1 Reply
Amir_Senn
Employee
Employee

A few suggestions that might solve some of your issues:

1. Try download latest JHF, since R80.30 release we fixed some issues that might be relevant.

2. Try to move the query to report filters under "Custom Filter" see if that brings results.

3. In logs view search for the same IP, validate you do have traffic that's relevant for Content Awareness.

4. For downloading/uploading make sure you have "Accounting" on relevant rules.

5. Feel free to play with the reports yourself, you can create more custom views/reports. 

Kind regards, Amir Senn
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events