I am trying to create a customized version of the canned "Threat Prevention" report that focuses only on a specific network group. However, I'm getting an odd result as soon as I try to add the "Source" filter to the "Global" Filter.
To accomplish this, I cloned the supplied "Threat Prevention" report and gave it a different name. Then, I edited the report, and began to modify the Global Filters to drill down on the specific traffic I wanted. The first filter limits the traffic to a single Gateway Cluster based on "Origin". This filter works as expected. With just this filter applied, I still see data appearing in the report.
Then, I try to add on another filter setting "Source" equals "<name of network group object>". As soon as I add this filter and apply, all the data from the report vanishes and is replace with "Query Failed". Oddly, I am able to remove the "Source" filter and instead add "src:<name of network group object>" to the search filter bar at the top and that works. I see exactly the data I want filtered in the report.
However, we need this report scheduled and run daily. So, I don't want to have to rely on manual generation of this report. Does anyone have any idea what I might be doing wrong? We presently have this same report running in Smart Event NGSE using the same filter logic. Any assistance is greatly appreciated!
R80 CCSA / CCSE
