About cisco firesight report viewing

[STS Education Group]

In Cisco Firesight, how I create report template that shows specific users url list that he/she was browse.

[Jetsy Mathew · Accepted solution]

Hello Team,

Please follow the steps to create a template and generate report based on the URL details. 

A.  Follow these steps

 Log in to the WebUI of the FireSIGHT Manamgent Center

Go to Overview > Reporting > Report Template

Create a new template

 Add a detailed view section

 

(option 4)

Choose the following options:

Table : Connection Events

Preset : None

Format : Table View (option 4)

 Search : Click on the pencil to create a custom search

 In the initiator user, enter ‘*’

In the URL field, enter ‘*’

In the URL Category, enter ‘*’

In the URL reputation, enter ‘*'

Click OK

 Fields : Click on the pencil again

 Add Field > Select URL, Date, Initiator User, URL, URL Category, URL reputation

 Arrange this in the order you wish to

 Change the time window to reflect a week, or a month, depending on how much data you want on the report

 Change the maximum results to show a million events 

 Note : This number might need to be played around with till you get all your events for the timeframe specified

 Here is a screenshot of a similar report template in my lab :

Rate if this answer helps you .

Regards

Jetsy

[#3 · Accepted solution]

A.  Follow these steps

 Log in to the WebUI of the FireSIGHT Manamgent Center

Go to Overview > Reporting > Report Template

Create a new template

 Add a detailed view section

 

(option 4)

Choose the following options:

Table : Connection Events

Preset : None

Format : Table View (option 4)

 Search : Click on the pencil to create a custom search

 In the initiator user, enter ‘*’

In the URL field, enter ‘*’

In the URL Category, enter ‘*’

In the URL reputation, enter ‘*'

Click OK

 Fields : Click on the pencil again

 Add Field > Select URL, Date, Initiator User, URL, URL Category, URL reputation

 Arrange this in the order you wish to

 Change the time window to reflect a week, or a month, depending on how much data you want on the report

 Change the maximum results to show a million events 

 Note : This number might need to be played around with till you get all your events for the timeframe specified

 Here is a screenshot of a similar report template in my lab :

[STS Education Group]

Dear Jetsy,

Thank you very much for your quick reply about this matter. I've tried this but face some problem about this matter.

-> When I've tried to input '*' key in the custom search under url field / url Category / url reputation it says invalid data. But if I enter nothing in the custom search then it works.

-> Another issue is, the report give me total network not specific user's data. Is it possible to view specific user data against input his/her ip address?

Thank you again for the solution. 

Best Regards

[Jetsy Mathew]

Hello Team,

Ideally it should work .

I have just tried the same in my lab and it worked successfully .

Try entering * without any space in the beginning.

If you can see the specific user details in the Analysis > connection events , then ideally you should see the same data while creating the report for the same.

Rate if this answer helps you.

Regards

Jetsy