Checkpoint Content Awareness reports

[jbfixurpc]

Greetings all

I have a question about the Content Awareness Report running on R80.30

The canned report shows activity which is of interest for us over a broad spectrum mainly tied to time (i.e. last 7 days, etc) However, when we specify a specific source (either User or IP address) the content of this report shows no information as it did with the broader view. As an example, with no search criteria I can see the top 5 file types, services and top files by size, but yet when I specify a single IP address this information is not there when in fact that IP address should show up with this data. 

I've opened a TAC case on this, and it's sounding like this is going to become a RFE.

Is no one actually using this means as a way of auditing? And/or if you are, how have you worked around this?

Ultimately we need to provide auditing based on user activity regarding file download/uploading but this feature appears to be broken via the Content Awareness report. 

Thanks in advance!

[Amir_Senn]

A few suggestions that might solve some of your issues:

1. Try download latest JHF, since R80.30 release we fixed some issues that might be relevant.

2. Try to move the query to report filters under "Custom Filter" see if that brings results.

3. In logs view search for the same IP, validate you do have traffic that's relevant for Content Awareness.

4. For downloading/uploading make sure you have "Accounting" on relevant rules.

5. Feel free to play with the reports yourself, you can create more custom views/reports.