Drill Down Views

[Roy_Smith]

Hi

How do I create a "Drill Down" view in R80.10? In some of the default views, you can drill down and it loads another view, rather than just the logs view. How do I add this fuctionality to my own custom views? Or is this a feature that is locked by Check Point.

Thanks

Roy 

[PhoneBoy]

Can you provide a concrete example?

[victorstorex]

Hello! I have the same problem. I'll describe the details.
I need to change the source type in the "view" Access Control.
In the original report, the source is "User".
I cloned the "Access Control" report and changed the source in the "Top Users by traffic" section.
Instead of "User" I specified "Source".
After this "Drill Down" does not work. I compared the parameters of my reports - they are identical except for the source.
I need these changes and the new “view” to view all sources by IP addresses, since not all PCs are in the Active directory domain. Local PC users are not identified and this is normal behavior.
Can you give us a recommendation in this matter?
Thank you

[PhoneBoy]

Version/JHF?
Do the rules involve create sessions?
They would need to involve App Control/URL Filtering or be explicitly set to log by Session (instead of by Connection).
Screenshots of relevant configurations (with sensitive details redacted) would help.

[victorstorex]

Hello
My management server version is R81.10 Jumbo Hotfix Take 110.
Application control/URL filtering layer entry rules are configured to:
-Log entry level is “Detailed”.
-Accounting
-Peer Connection and peer Session
In the logs I can see that the traffic is going through according to my Application Control/URL Filtering rule.
But "Views". User Access Control displays "Drill Down Views", but Source IP Access Control does not display "Drill Down Views".
Thank you.

[Amir_Senn · Accepted solution]

Hi,

Tell me if this flow is what you intended:

Drill down seems to work in my lab. Make sure you exit edit mode when trying to drill down.

If you edited the widget too much you can always return to default for this view and edit the same way I did: Go to settings, edit User and change it to Source. There could be a difference to edit or to remove and add another field in a statistical table.

[victorstorex]

Hi
Thanks for your answer Amir Senn!
You gave me a good idea for a solution.
I deleted my new "View"
I cloned it from the original one and changed the fields from Users to Source.
Moreover, after deleting Users, I saved the report and only then added “Source”.
Perhaps I had a lot of edits to the report and that was the source of the problem.
Problem solved.
Thank you!