Events tab in R80.10 removed?

[Nader_Assi]

Hi,

I've noticed that many tabs in R80.10 SmartEvent GUI client have been removed, especially the "Events tab". I didn't find any official notes from CP regarding this change. I'm assuming it has been integrated inside the R80.10 SmartConsole however I can't find any equivalent of the legacy "Events Tab".

Can anybody confirm this change? And how/where to review the Events (other than using the Views)?

Thanks,

Nader

[Marko_Keca]

Hello Nader,

You're right, Events tab is integrated in R80.10.

I had conversation with Check Point Management Technology Leader about that topic and here are the answers:

Regarding integration:

"As I understand, you had recently upgraded your SmartEvent server to R80.10 and you are missing some of the tabs that existed before.

I would like to let you know that this is actually by design, as the tabs you are “missing” are actually integrated into the SmartConsole and removed from the legacy SmartEvent GUI."

Regarding replacement:

"The replacement for the Events tab is simply the Logs tab in R80.10 under Logs & Monitor section."

Regards,

--

Marko

[PBC_Cyber]

It also appears to occur when using r77 management, So does that mean R80.10 smartevent is no longer backwards compatible, because the documentation seems to indicate otherwise.

Bryan

[PhoneBoy]

Yes, it is still backwards compatible.

The lack of "Events" tab has nothing to do with backward compatibility, it's just the UI in R80+ is very different from R77.x

Along the top of the Logs and Monitor view, you will see a tab with a plus; click that.

From there, you can select the view/report you are interested in (similar to how the Events tab worked).

If there's something specific you'd like to see from the Events tab in R77.x that you can't find in R80.10, let me know.

[Pravesh_Jangbah]

I'm unable to find the button/menu to close events.

The Admin Guide does not mention closing events, did that change also?

[PhoneBoy]

The ticketing features are missing from SmartEvent R80.10 currently, as documented here: Check Point R80.10 Known Limitations

[Amos_Reiss]

Customers that use ticketing today in SmartEvent on R77.30 and needs an upgrade please ask your SE to open RFE ticket to solution center so we can plan it.

[Botond_Velkei]

In fact, I can't find the events generated based on the "Event Policy" settings in any views in the "Logs & Monitor" section. Also, in the R77.30 Smart Event, you could view the "important security events" under the "event" tab, not limited to the IPS or Threat prevention events.
What I'm missing is the firewall blade's security related events in a view, that should contain the "Event Policy" based events (like. scans from external host) and the "Inspection settings" based events (like non compliant dns).

[PhoneBoy]

They are not prebuilt but it's easy to create a view with this information.

I don't recall if I got the views EXACTLY as they were in R77.x, but this should be enough to get you started to create whatever view you're looking for.

I created a view that looks something like this:

To create a view, in Logs and Monitor (or in SmartView) you click the Plus, then click Views > New > New Views

Give it a name, Click Ok.

Then you create a couple of widgets:

The filter for this widget is:

The Inspection Setting widget looks like:

The filter: 

(Note I also checked the two "Engine Settings" options as well)

[Botond_Velkei]

Thanks for your ideas!

In fact, I've started to create my own views and reports too, but gave it up since I've found it's not working as intended. 

In views, if I add a new field in the widget settings, sometimes the content / result of the widget is empty, and even so if I delete the new field, the original content is gone and the table is empty. :S I need to re-crate the widget from scratch.

Also, in the reports, the filtering has bugs. Sometimes, adding an additional filtering criteria makes the report unusable. A red mark appears at the filtering setting, and the settings can not be corrected. Even after restarting the client, it remains the same, and I have to create a new report. 

Thanks anyway! I'm sure I will create views based on your suggestions!

[Kfir_Dadosh]

Hi Botond,

Can you please share your debug logs with us, so we can look into the filter "red mark" error?

As for the events grid, it was removed in R80.10, and we are planning to add a new feature in R80.20 to allow grouping logs, giving a similar, but more powerful, experience to the Event Grid.

We used to have a view called Correlated Events, although now I see it is missing, but as Dameon suggested, you can create your own pretty easily (aside from the issues you are experiencing).

[Botond_Velkei]

Hi Kfir,

I've opened a case at CP, so they are going to investigate it tomorrow via a remote session. I'll get back with the result.