05-04-2020 01:37 PM - edited 05-04-2020 01:38 PM
Hi,
I am creating reports on FMC but cant see any data showing when reports generated.
Am I missing anything, All the access rules have logging enabled.
05-04-2020 05:54 PM
05-04-2020 06:57 PM
Thanks,
I have 6.4.7 version on FMC.
I tried to accessed bbc.com but when generate report I cant see any Data in report. I want below to be added in my report.
1 - Intrusion Events
2 - Malware Events
3 - Users accessing Internet ( user names and URL details accessed by users)
etc
05-04-2020 07:38 PM
05-05-2020 07:40 PM
Hi,
Yes I can see many users activity under Connection events, I also can see unknown user but dont know why.
But when I generate Report , I cant see users data reflected in report like what applications or URLs accessed by those users.
05-06-2020 04:33 AM
What is your identity source?
If it is only passive identity and not integrated with ISE or User Agent then Firepower will have very limited insight into User-IP address mapping.
05-06-2020 01:26 PM
Hi,
we have ISE PIC in the middle for IP to User mapping.
Plus I see lot of unknown users in connections table.
I can see everything in report but No information of users accessing external public URLs like bbc.com, facebook.com etc
05-06-2020 08:23 PM
Have you setup a network discovery policy? Defined your $HOME_NET and $EXTERNAL_NET variables?
To see URL destinations in the events you should have at least one ACP to monitor URLs.
05-07-2020 12:26 AM
Thanks Marvin,
Yes I have URL filtering policies on FMC with block and deny actions. Block is for dodgy sites like gambling etc and allow is for company URL and Plus social media access to linkedin etc.
I can access all of these sites and can see in event connections but Its not reflecting in reports,
Reports just shows no data for URL category
05-07-2020 04:05 PM
05-08-2020 12:28 AM
Thanks ,
Actually I can see all other data except users visiting URLs.
We wana see users access what external sites , for example If I access linkedin.com , this should be reflected in Report.
Plus Intrusion events in report
05-09-2020 04:58 AM
FMC reporting is not as granular as some other products (e.g. WSA or Umbrella) for reporting user activity. You can get some data however by customizing a report as described here:
05-09-2020 01:38 PM
Thanks Marvin,
This link was helpful to get some data.
But still it doesnt shows client user or ip address accessing URLs.
As you mentioned that Its not possible to get client username or IP address accessing specific URLs.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide