Nominated Discussion: How to View Correlated Logs on the Firewall

kiwi — Tue, 24 Oct 2023 14:23:15 GMT

This Nominated Discussion Article is based on the post "How to view correlated logs on the FW ?" by @${userLoginName} and replied to by @kiwi, @OtakarKlier, @Terje_Lundbo

I currently have an environment with TP, GP, ADVURL and WF and sometimes I need to see the full info of a user instead of going to traffic and check some portion then go to URL filtering and find something "maybe" related and so on.

I keep getting results of using ACC but even there it is split in tabs, so I can check traffic but then I need to switch to threats to see some more.

Is there a way even via ACC to create a view that shows everything related to that traffic?

If you go to the detailed log view you'll get related logs for the same session at the bottom.

Notice how this example shows the related url logs and threat logs (identified by the TYPE column) at the bottom for the selected traffic log:

In addition to that you can look at the Unified logs. This combines the Traffic, URL, and Threat logs into the same view. Then when you find the log you wish to drill down into, click the Magnifying glass icon.

You can control which logs are shown in Unified by clicking on the two down arrows to the left of the query field and choose your log types. To get reasonable quick responses I have been advised by TAC to limit the log types to maximum 3.

In addition to this, if you put a date and time then a great then feature, this will also speed things up.

( receive_time geq '2023/10/06 00:00:00' ) will filter on any logs created after 12am on Oct 10.

article Nominated Discussion: How to View Correlated Logs on the Firewall in General Articles

Nominated Discussion: How to View Correlated Logs on the Firewall