topic Re: Creating a query or report in MARS in Network Security https://community.cisco.com/t5/network-security/creating-a-query-or-report-in-mars/m-p/697507#M92329 <HTML><HEAD></HEAD><BODY><P>Thanks, I needed a sanity check.</P><P>I was able to do a query that I believe gave me the "top source" ip's for my site but the duration was not doable.</P><P>-Scott</P></BODY></HTML> Fri, 22 Sep 2006 19:21:55 GMT dfreemire 2006-09-22T19:21:55Z Creating a query or report in MARS https://community.cisco.com/t5/network-security/creating-a-query-or-report-in-mars/m-p/697505#M92324 <P>I need to create reports for two things:</P><P>How many users (IPs) hit our website more than once per day,</P><P>and How many users browse our site for more than 20 minutes at a time.</P><P>Since these "events" are normal and not breaking any "rules" can I query or report on them?</P><P>I have an FWSM and an IDSM2 behind that (inside) logging to the MARS.</P> Sun, 10 Mar 2019 10:14:09 GMT https://community.cisco.com/t5/network-security/creating-a-query-or-report-in-mars/m-p/697505#M92324 dfreemire 2019-03-10T10:14:09Z Re: Creating a query or report in MARS https://community.cisco.com/t5/network-security/creating-a-query-or-report-in-mars/m-p/697506#M92326 <HTML><HEAD></HEAD><BODY><P>Because of the way the HTTP protocol works,</P><P>what you're asking for would be very difficult [if not impossible] to do reliably based soley on events coming info CSMARS from FWSM and IDSM2.</P><P></P><P>If you really want to do this, your best bet is to use a tool to analyze the actual web server logs.</P></BODY></HTML> Fri, 22 Sep 2006 17:34:05 GMT https://community.cisco.com/t5/network-security/creating-a-query-or-report-in-mars/m-p/697506#M92326 mhellman 2006-09-22T17:34:05Z Re: Creating a query or report in MARS https://community.cisco.com/t5/network-security/creating-a-query-or-report-in-mars/m-p/697507#M92329 <HTML><HEAD></HEAD><BODY><P>Thanks, I needed a sanity check.</P><P>I was able to do a query that I believe gave me the "top source" ip's for my site but the duration was not doable.</P><P>-Scott</P></BODY></HTML> Fri, 22 Sep 2006 19:21:55 GMT https://community.cisco.com/t5/network-security/creating-a-query-or-report-in-mars/m-p/697507#M92329 dfreemire 2006-09-22T19:21:55Z