05-08-2016 09:25 PM - edited 03-12-2019 12:43 AM
In Cisco Firesight, how I create report template that shows specific users url list that he/she was browse.
Solved! Go to Solution.
05-09-2016 12:11 AM
Hello Team,
Please follow the steps to create a template and generate report based on the URL details.
A. Follow these steps
Log in to the WebUI of the FireSIGHT Manamgent Center
Go to Overview > Reporting > Report Template
Create a new template
Add a detailed view section
(option 4)
Choose the following options:
Table : Connection Events
Preset : None
Format : Table View (option 4)
Search : Click on the pencil to create a custom search
In the initiator user, enter ‘*’
In the URL field, enter ‘*’
In the URL Category, enter ‘*’
In the URL reputation, enter ‘*'
Click OK
Fields : Click on the pencil again
Add Field > Select URL, Date, Initiator User, URL, URL Category, URL reputation
Arrange this in the order you wish to
Change the time window to reflect a week, or a month, depending on how much data you want on the report
Change the maximum results to show a million events
Note : This number might need to be played around with till you get all your events for the timeframe specified
Here is a screenshot of a similar report template in my lab :
05-09-2016 12:11 AM
Hello Team,
Please follow the steps to create a template and generate report based on the URL details.
A. Follow these steps
Log in to the WebUI of the FireSIGHT Manamgent Center
Go to Overview > Reporting > Report Template
Create a new template
Add a detailed view section
(option 4)
Choose the following options:
Table : Connection Events
Preset : None
Format : Table View (option 4)
Search : Click on the pencil to create a custom search
In the initiator user, enter ‘*’
In the URL field, enter ‘*’
In the URL Category, enter ‘*’
In the URL reputation, enter ‘*'
Click OK
Fields : Click on the pencil again
Add Field > Select URL, Date, Initiator User, URL, URL Category, URL reputation
Arrange this in the order you wish to
Change the time window to reflect a week, or a month, depending on how much data you want on the report
Change the maximum results to show a million events
Note : This number might need to be played around with till you get all your events for the timeframe specified
Here is a screenshot of a similar report template in my lab :
05-09-2016 02:47 AM
Dear Jetsy,
Thank you very much for your quick reply about this matter. I've tried this but face some problem about this matter.
-> When I've tried to input '*' key in the custom search under url field / url Category / url reputation it says invalid data. But if I enter nothing in the custom search then it works.
-> Another issue is, the report give me total network not specific user's data. Is it possible to view specific user data against input his/her ip address?
Thank you again for the solution.
Best Regards
05-09-2016 04:00 AM
Hello Team,
Ideally it should work .
I have just tried the same in my lab and it worked successfully .
Try entering * without any space in the beginning.
If you can see the specific user details in the Analysis > connection events , then ideally you should see the same data while creating the report for the same.
Rate if this answer helps you.
Regards
Jetsy
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: