Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Lucky_Muthavhin
Explorer
Jump to solution

Check Point custom reporting

Good Day,

My management is conducting an investigation on one of our users and as such they want detail internet usage reports which I have provided but now after they saw the user spent much time on YouTube and they would like to find out what videos was the user watching. Does anyone know how I can accomplish this?

I have run a report and filtered Resource and it provides the links but the link are broken and I cannot access them.

Please help me out Smiley Happy

Thanks,

Lucky Muthavhine

1 Solution

Accepted Solutions
ED
Advisor

Hi,

Not sure if this will help but I will try.  My suggestion is to use advanced track options like "Detailed Log" and "Extended Log" if you have enabled one or more of these blades on the Layer: Applications & URL Filtering, Content Awareness, or Mobile Access

So if you create a new policy rule for Youtube in the "Service and Application" column and set the "Track" column to "Extended Log" the URLs will show in the Logs view hereafter. Don't know if you have already done this. 

  • Detailed Log - Equivalent to the Log option, but also shows the application that matched the connections, even if the rule does not specify an application. Best Practice - Use for a cleanup rule (Any/Internet/Accept) of an Applications and URL Filtering Policy Layer that was upgraded from an R77 Application Control Rule Base.
  • Extended Log - Equivalent to the Detailed option, but also shows a full list of URLs and files in the connection or the session. The URLs and files show in the lower pane of the Logs view.

Addditional logging adds a performance impact. 

This might also be relevant which is is added automatic I believe when you use an application in the "Service and Application" column. 

  • Accounting - Select this to update the log at 10 minute intervals, to show how much data has passed in the connection: Upload bytes, Download bytes, and browse time.

View solution in original post

2 Replies
ED
Advisor

Hi,

Not sure if this will help but I will try.  My suggestion is to use advanced track options like "Detailed Log" and "Extended Log" if you have enabled one or more of these blades on the Layer: Applications & URL Filtering, Content Awareness, or Mobile Access

So if you create a new policy rule for Youtube in the "Service and Application" column and set the "Track" column to "Extended Log" the URLs will show in the Logs view hereafter. Don't know if you have already done this. 

  • Detailed Log - Equivalent to the Log option, but also shows the application that matched the connections, even if the rule does not specify an application. Best Practice - Use for a cleanup rule (Any/Internet/Accept) of an Applications and URL Filtering Policy Layer that was upgraded from an R77 Application Control Rule Base.
  • Extended Log - Equivalent to the Detailed option, but also shows a full list of URLs and files in the connection or the session. The URLs and files show in the lower pane of the Logs view.

Addditional logging adds a performance impact. 

This might also be relevant which is is added automatic I believe when you use an application in the "Service and Application" column. 

  • Accounting - Select this to update the log at 10 minute intervals, to show how much data has passed in the connection: Upload bytes, Download bytes, and browse time.
Alejandro_Mont1
Collaborator

This looks good however keep in mind that it will not help you go back to see what the user was watching. It would only be helpful in reports generated after the updated policy was installed.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events