topic Re: How to view correlated logs on the FW in General Topics

How to view correlated logs on the FW

${userLoginName} — Thu, 05 Oct 2023 11:43:27 GMT

Hello,

I currently have an environment with TP, GP, ADVURL and WF and sometimes I need to see the full info of a user instead of going to traffic and check some portion then go to URL filtering and find something "maybe" related and so on.

I keep getting results of using ACC but even there it is split in tabs, so I can check traffic but then I need to switch to threats to see some more.

Is there a way even via ACC to create a view that shows everything related to that traffic?

Thank you very much.

Re: How to view correlated logs on the FW

kiwi — Thu, 05 Oct 2023 13:08:28 GMT

Hi @${userLoginName} ,

If you go to the detailed log view you'll get related logs for the same session at the bottom.

Notice how this example shows the related url logs and threat logs (identified by the TYPE column) at the bottom for the selected traffic log :

Hope this helps,

-Kim.

Re: How to view correlated logs on the FW

OtakarKlier — Thu, 05 Oct 2023 14:30:06 GMT

Hello,

In addition to what Kiwi stated, look at the Unified logs. This combines the Traffic, URL, and Threat logs into the same view. Then when you find the log you wish to drill down into, click the Magnifying glass icon.

Hope that helps.

Re: How to view correlated logs on the FW

Terje_Lundbo — Fri, 06 Oct 2023 09:53:50 GMT

You can control which logs are shown in Unified by clicking on the two down arrows to the left of the query field and choose your log types. To get reasonable quick responses I have been advised by TAC to limit the log types to maximum 3.

Re: How to view correlated logs on the FW

OtakarKlier — Fri, 06 Oct 2023 16:40:37 GMT

Hello,

In addition to this, if you put a date and time then a great then feature, this will also speed things up.

( receive_time geq '2023/10/06 00:00:00' ) will filter on any logs created after 12am on Oct 10.

Regards,

Re: How to view correlated logs on the FW

${userLoginName} — Fri, 06 Oct 2023 21:16:22 GMT

Really appreciate all the replies, I will spare some time to check the suggestions and get back here if needed.

Thanks a lot.