topic Re: FTD 4115 Reporting in Network Security

FTD 4115 Reporting

D@1984 — Thu, 23 Jun 2022 16:27:39 GMT

Is there a way to show which rule traffic hit when generate a report? What I'm after is to be able to filter logs based on a rule name/number.

Thanks

Re: FTD 4115 Reporting

balaji.bandi — Thu, 23 Jun 2022 16:36:13 GMT

check this below may help you :

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212330-firepower-management-center-display-acc.html

Long back i made using output of - > show access-control-config ( daily basis and made report) (out of the box)

Re: FTD 4115 Reporting

Marvin Rhoads — Thu, 23 Jun 2022 16:36:40 GMT

If you're using FMC, use Analysis > Connection Events > Table View of Connection events. Assuming you have your rules set to log to FMC, that view will include the rule that the connection event hit. (You will have to scroll right to see it.)

You can generate a report from that page and add/remove columns as desired to display only the data you want.

Re: FTD 4115 Reporting

D@1984 — Fri, 24 Jun 2022 08:58:33 GMT

thanks Marvin, the last 3 column are url category, url reputation and device. I cant see any name or rule ID.

Re: FTD 4115 Reporting

Marvin Rhoads — Fri, 24 Jun 2022 17:49:19 GMT

D@1984 be sure to switch to the "Table View of Connection Events". Then use the horizontal scroll bar (or zoom out) to see all the columns.

Table View of Connection Events columns