Reports

In This Section: Reports Tab Predefined Reports 3D Security Analysis Report Custom Reports Configuring Reports Running Reports

Reports Tab

Use the Reports tab to see, manage and generate reports that show a summary of events identified by SmartEvent. You can generate report for these supported blades:

• Application Control and URL Filtering events
• Data Loss Prevention events
• IPS events
• Anti-Bot and Anti-Virus events
• All - Tabular list of all events, including events not related to these supported blades

Each supported blade has its own filter criteria and format that for presenting the information.

Each report contains a high-level summary of event patterns followed by detailed analyses and graphs. Each report has its own format and filter criteria.

You can generate reports that show events on a daily, weekly or monthly basis. Some blades can show events summarized by domain.

SmartEvent includes these output options for your generated reports:

• Show on the Reports tab
• Open in a Web browser
• Print
• Save as a PDF file
• Send as an email attachment to specified individuals

Predefined Reports

SmartEvent includes many predefined reports that you can run right out of the box. This release includes predefined reports for daily, weekly, monthly and user-specified time frames (Shown as Other in the Reports tree).
You can identify predefined reports by the predefined report icon in the Reports tree. You cannot change the default time frame or filter parameters for predefined reports.

3D Security Analysis Report

The 3D Security Analysis Report lets administrators analyze an endpoint computer and get a report that shows its current security status. This report is included in SmartEvent, but is not activated by default.

To activate the 3D Security Analysis Report:

1. Open SmartEvent.
2. Select View > 3D Security Analysis Report.
3. Close SmartEvent and then rerun it.

To run the 3D Security Analysis Report, click 3D Security Analysis Report on the Overview pane toolbar.

For more information about the 3D Security Analysis Report, see

Custom Reports

You can define custom reports that show the information necessary to identify and handle security threats. Custom reports are based on existing predefined or custom reports.
You can identify custom reports in the Reports tree by the custom report icon .

To create a custom report:

1. Right-click an existing report in the Reports tree.
2. Select Save As from the options menu.
3. In the Save Report as window, enter a name for the new report.
4. Continue with the procedures in the Configuring Reports section.

You can also click a report definition and then save, rename or delete it.

Configuring Reports

You can configure predefined and custom reports in accordance with your requirements. Reports are based on queries using these criteria:

• Period - Defines the default time frame for a report (custom reports only)
• Filter - Defines the filter conditions for a report (custom reports only)
• Schedule - Defines when a report will run automatically (all report types)
• Email - Sends the report by email and defines the default email addresses to use (all report types)

To configure a report:

1. Select a report in the Reports tree and click Manage.
2. In the Configuration window, configure the report criteria using the procedures for the applicable blade or report type. The individual procedures show in the next sections.
3. Click OK.

Defining the Time Frame

You can define a default period of time (time frame) for each report. These defaults are used for reports that run automatically on a predefined schedule. When you manually generate a report, you define the time frame at run time.

There are five predefined time frames that you can use for all reports:

• Today
• Yesterday (default for predefined daily reports)
• This week
• Last week (default for predefined weekly and other reports)
• This month
• Last Month (default for predefined monthly reports)

Specific Dates - Select a start and end date

To define the time frame:

1. Select a report in the Reports tree.
2. Select Manage from the options menu.
3. On the Period page, do one of these steps:
   • Select a predefined time frame from the list.

     or

   • Define a custom date or range of dates in the Specific Dates field.

Report Filters

You can use filters with reports to identify and summarize applicable events. Each report has one or more optional filters that you can use. You can define you own filters for custom reports but you cannot change filter definitions for predefined reports.

Each filter type has its own configuration window, from which you can select values from a list or manually enter values. See the online help for an explanation of the fields in each window type.

You can also add Run-Time Filters, where users enter filter criteria each time they run the report.

To define a report filter:

1. In the Configuration window, go to the Filter pane.

2. In the Filter Settings pane, do one or more of these steps to work with the filter settings:
   • Click a Filter link in a row or select a row and click Edit.
   • In the Filter window that opens, enter or select one or more criteria.

     The options and selection procedure is different for each type or criterion. See the online help for an explanation of the options.

   • To let the user enter or select criteria at run time, select the Run-Time Filter option.
3. Select the Active option to include the selected filter in this report.

   Clear to exclude the selected filter.

4. Click OK.

Special Considerations for User Groups

Unlike most objects used in SmartEvent filters, User Group filters use objects that are defined in SmartDashboard. Before you can work with user group objects in filters, you must first define Access Roles for them. You can create SmartEvent reports for user groups that are not in your network, but these must also have defined Access Roles.

See the online help or Creating Access Roles section in the R77 Firewall Administration Guide for more information.

Note: You must enable Identity Awareness on your management server to use Access Roles.

Automatic Report Scheduling

You can configure a report to run automatically at specified times. A report can have more than one defined schedule.

To configure an automatic report schedule:

1. Go to the Schedule Settings window.
2. Select the Active option (cleared by default).

   You must select this option to run reports automatically.

3. Select the report frequency from the list. The available options are:
   • Once - Run one time, at the specified time.
   • Daily - Run one time each day, at the specified time.
   • Weekly - Run one time each week, on the specified week day(s) and time.
   • Monthly - Run one time each month, on the specified date(s) and time.
4. Select or enter a run time for the report.
5. Select the Start on date.

   This is the date on which the report first runs.

6. Optional: Select the Expire on option and then select the date on which the report runs for the last time.

   By default, this option is cleared.

7. Optional: Click Add an additional schedule to define more schedules for this report.

Configuring Email Settings

You can configure SmartEvent to automatically send reports to specified, default recipients each time the report runs. You define these default recipients on the Settings page in the Reports tree. You can also send a report to different recipients at run-time, instead of the default recipients.

You must configure the Outgoing SMTP mail server and the Sender Email Address before you can send email.

To configure email settings:

1. Go to the Settings branch in the Reports tree.
2. Enter the SMTP mail server URL in the applicable field.
3. Enter the sender email address in the applicable field.

   The sender email address shows on all report emails sent by SmartEvent.

4. Click Test Connection to make sure that the defined SMTP connection works correctly.
5. Enter the default recipient email addresses in the To and Cc fields.

   You can enter more than one email address in each field, separated by semicolons.

To configure email settings for each defined report:

1. Select a report in the Reports tree and click Manage.
2. Go to the Email Settings pane.
3. Select the Send By Email option (cleared by default).

   You must select this option to automatically send reports by email.

4. Select the Custom option.
5. Enter recipient email addresses in the To and Cc fields.

   You can enter many email addresses in each field, separated by a semicolon.

6. Select the Report Format:
   • HTML
   • PDF

   MHT - MIME HTML archive format

Running Reports

You can use the predefined graphical report templates for the most frequently seen security issues. Try these before you create a customized report.

To generate a predefined report:

1. Open the Reports tab.
2. Choose a Default Report for a Software Blade.
3. Click Generate
4. In the Generate a Report window, choose a time period.
5. Click Generate.

   Your reports are saved in the Report History.

To schedule a predefined or custom report for generation and email:

1. In the tree, click Settings.
2. Configure your email server and the email addresses of the people who should get the report.
3. In the SmartEvent menu, click Save.
4. Select a report.
5. Click Schedule (top of the workspace).
6. In the window that opens, configure when the report is to be automatically generated.

   You can configure multiple dates and times. For example, you can generate a report daily and monthly.

7. In Email Settings, click Send By Email.