How to view threats, blocked activity over time

ccfritz — Mon, 28 Feb 2022 18:58:48 GMT

I am trying to understand how to view threats, malicious IPs, etc over time. For instance in the ACC tab I understand one can view threats, threat source IPs etc. I am not seeing how to view trends, for example if we want to see if there has been an increase in traffic from a certain country or threats from a certain source IP. I would like to be able to view a report and see if there were increases in a certain time frame. I am only seeing total count, a break down of information over a time would be useful. I would appreciate any help, thanks.

Re: How to view threats, blocked activity over time

BPry — Tue, 01 Mar 2022 15:36:37 GMT

@ccfritz,

You can generate a custom report of source country activity and add the date as criteria along with count to get a basic understanding of network increases it that's something that you are looking for. Historical trend information is generally something that I would offload to an external SIEM however (IE: Graylog/Splunk) to build detailed reporting dashboards however instead of the firewall's built-in reporting capability.

topic How to view threats, blocked activity over time in General Topics

How to view threats, blocked activity over time

Re: How to view threats, blocked activity over time