SmartEvent in mixed multi domain environment

[Maarten_Sjouw]

We have a weird situation and we have some questions about Scheduled reports in the R80.10 SmartEvent server.

We run a R77.30 MDS environment with about 150 customer domains. Connected to this I just added a new R80.10 SmarEvent server, first problem I ran into was that after adding some domains, I found I could not add them to the Correlation Unit untill I enabled Smartlog on the domain itself? We have a R80 SmartEvent connected to the same setup but there we could add the domains without enabling SmartLog first.

While that now all works, I was adding some scheduled reports, while connected with the R80.10 SmartConsole directly to the SmartEvent server as a superuser and they show up under the Scheduled reports.

Then I connected using the HTTPS://<SE-IP>/SmartView/ page to access the SmartEvent server as a customer, with a customer account that was allowed SmartEvent control for his domain only. Next I created a new scheduled report for this customer.

Now these are the issues I ran into:

For email I needed to enter a email server both on the global level but also when logged in as a customer, as it was not copied from the Global level, this user should never be prompted for this. We also tested this again with another superuser, here he also needed to add the email server settings again. In the R80 server this was setup in the legacy client on machine level, is this something I have overlooked in the R80.10?

The scheduled report list only shows the reports for the user itself, so even reports created on a global level by user A are not visible for user B. It does not matter what kind of user it is.

The way I would like to see this working is that we are able to see all reports scheduled when logged in as a superuser, it would certainly help to see a column that shows the related domain for that report.

When logged in as a domain user I would like to be able to see all reports scheduled for that domain.

[Maarten_Sjouw]

I just checked on the full blown R80.10 Multi domain setup we also have, the problems are the same at this level.

The email settings, I could not find anywhere to store these globally.

The report created by a Domain user are not visible by any other user, not even from the same domain. As a MSP we need to be able to support our customers and be able to see their scheduled reports to be able to assist them.

Even worse is the case where I can create a report for a customer and my colleagues are not able to adjust or delete the report. When I leave the company all reports scheduled by me are orphaned and inaccessible by everyone else and they cannot stop the schedule.

[Maarten_Sjouw]

Really, nobody?

[PhoneBoy]

Have you opened a TAC case on any of these issues?

[Maarten_Sjouw]

not yet, I first wanted to see what the community was thinking about this, but it seems nobody has an opinion on this.

Maybe it's due to where I placed it?

[PhoneBoy]

Possibly. 

It should at least have a https://community.checkpoint.com/community/management/visibility-monitoring?sr=search&searchId=7cddb...‌ mention, if not be moved there.

[Maarten_Sjouw]

Can you move it there, I don't know how. Or if you can tell me how, I will do it.

[PhoneBoy]

Already did.

[Maarten_Sjouw]

Thanks for moving.

I today also opened a case for this and pointed them to this post as well.

[G_W_Albrecht]

i do have an opinion on this - but my opinion will not be able to make it work the way you need it to .

[Maarten_Sjouw]

Well, In the case I got the response that this was by design and as this is not a technical issue, this would not need to be handled by TAC but should be taken up with the local country engineers.

So my question here would be the following: when things work the way they are supposed to in R80 and in R80.10 this functionality is broken, is this a technical issue or not?

This was the response:

I would like to summarize that I have tested the behavior which you have described, on clean environment and this is the design.

As this is not a technical issue I would suggest to contact the local office.

To summarize these are the 2 issues on a R80.10 Multi domain SmartEvent setup:

1. Reports scheduled by superuser A cannot be seen by superuser B, same goes for 2 domain level users.
2. Mail server settings are stored per user, this means every user has to set this before he can have a report mailed, this should be a global setting not a user setting

In R80 both items were still in the old SmartEvent client, now they have moved to SmartConsole.

[PhoneBoy]

If the product is indeed "operating as specified" then, yes, there's not much the TAC can do to change that.

As far as potentially changing things, there is a formal process that TAC mentioned which starts with the local account teams.

It sometimes ends in specific customer releases for specific scenarios, which in some cases become part of a maintrain release.

Less formally, of course, there is CheckMates, which R&D leverages to understand how customers are using (or wish to use) the products.

[RickHoppe]

Did TAC point to sk120674?

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Maarten_Sjouw]

Nope they did not, but what I read there is not correct for R80, this is only true for R80.10 for the Scheduled part, custom reports created in the SmartConsole are indeed specific to each user since R80

[Kfir_Dadosh]

Hi Maarten,

I was referred to this thread by Tomer Sole, whom you spoke yesterday. I really appreciate the feedback and understand the problems you have described. We will try to address those issues in one of the next releases.

You said that as a super-admin, you would like to see the schedule settings of all domains. Is it true also for the actual generated reports in the archive?

[Maarten_Sjouw]

Hi Kfir,

As we are a MSP you might understand our need better, today I'm working a request for customer a and tomorrow my colleague works the same customer, so to us it is really important that we are able to see each others work and results.

Regards, Maarten.

PS we are in the Arad room when you want to have a chat.

[Schafi]

"The report created by a Domain user are not visible by any other user, not even from the same domain."

Same for R80.20 MDS