Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Damien
Explorer

SmartEvent - Report for usage of a specific ordered layer

Hi Experts,

 

We are using two ordered layers: the usual Security (mainly network access) + Application (in which we mainly filter on applications).

Damien_0-1654626419431.png

We are looking for a report that displays which Application rules a specific IP address has hit.

 

The thing is, in our report (see below), we are not able to distinguish Applications rules from Security rules.

By the way, the “Application Rule ID” doesn’t give any results.

Damien_1-1654626419442.png

 

In the following example of the result of our report, only the rule ID 39 is from the Application Policy, the other ones are from the Security policy.

Damien_2-1654626419446.png

Just to mention that we use R81.10.

 

Regards

2 Replies
Amir_Senn
Employee
Employee

I have a few suggestions:

1) adding "Access Rule Name" between the "Rule" and "Logs" columns. You can also add additional filters (blade equal to Application Control and URLF) to filter out irrelevant.

2) Browse through existing Application Control views and reports and try to find something similar to what you're trying to do. Copy it a modify it, sometime the best way to create widgets is try to base it on existing widgets.

Kind regards, Amir Senn
Damien
Explorer

Hello Amir,

 

Thank you for your answer.

I've tried your first suggestion. In that case, the report only displays the rule ID 39 from the Application Policy but the other rules of Application Policy hit by the server are still not displayed (see Test02.png).

In fact, it seems that only the rules of the Application Policy with the "Drop" action are displayed. In the log details, we can see the rules matched in the Security Policy and the Application Policy (see MatchedRules.png). However, when the action of both is "Allow", the report doesn't display the rule of the Application Policy.

As per your 2nd suggestion, I'm going to browse through existing Application Control views and reports to find something similar that can be reused.

 

Kind regards, Damien

0 Kudos