SmartEvent - Report for usage of a specific ordered layer

[Damien]

Hi Experts,

We are using two ordered layers: the usual Security (mainly network access) + Application (in which we mainly filter on applications).

We are looking for a report that displays which Application rules a specific IP address has hit.

The thing is, in our report (see below), we are not able to distinguish Applications rules from Security rules.

By the way, the “Application Rule ID” doesn’t give any results.

In the following example of the result of our report, only the rule ID 39 is from the Application Policy, the other ones are from the Security policy.

Just to mention that we use R81.10.

Regards

[Amir_Senn]

I have a few suggestions:

1) adding "Access Rule Name" between the "Rule" and "Logs" columns. You can also add additional filters (blade equal to Application Control and URLF) to filter out irrelevant.

2) Browse through existing Application Control views and reports and try to find something similar to what you're trying to do. Copy it a modify it, sometime the best way to create widgets is try to base it on existing widgets.

[Damien]

Hello Amir,

Thank you for your answer.

I've tried your first suggestion. In that case, the report only displays the rule ID 39 from the Application Policy but the other rules of Application Policy hit by the server are still not displayed (see Test02.png).

In fact, it seems that only the rules of the Application Policy with the "Drop" action are displayed. In the log details, we can see the rules matched in the Security Policy and the Application Policy (see MatchedRules.png). However, when the action of both is "Allow", the report doesn't display the rule of the Application Policy.

As per your 2nd suggestion, I'm going to browse through existing Application Control views and reports to find something similar that can be reused.

Kind regards, Damien