topic Re: export "application seen" to csv/pdf ? in General Topics

export "application seen" to csv/pdf ?

sascha.burger — Fri, 21 Aug 2020 14:44:11 GMT

Hi folks,

following situation: one of my customers has a rule that allows any traffic from trust to untrust.

the rule detects over 400 application with more than 2 terrabytes of data in the last 30 days.

is the any kind of way to export the "seen apps" to a csv or pdf list or anything else?

we need such a list to sort out unwanted apps and sort the rest in multiply applications groups

greetings from germany

Re: export "application seen" to csv/pdf ?

BPry — Fri, 21 Aug 2020 15:06:37 GMT

@sascha.burger,

I'm not aware of any way to export this list from the policy optimizer, although it might be a good idea to put in a feature request for this feature.

You can utilize a custom detailed traffic report to start to generate an exportable application list pretty easily. Create a detailed traffic report and only have the columns "Application" and "Rule" selected. In the query section just put (rule eq EntryName) so that the output is limited to the rule that you actually care about. The generated output will be any application that has hit the selected rule for as far back as your logs allow.

Re: export "application seen" to csv/pdf ?

SutareMayur — Fri, 21 Aug 2020 16:29:28 GMT

@sascha.burger

The other option would be ACC tab. By keeping proper filters according to your requirements, you can export the details.

Re: export "application seen" to csv/pdf ?

sascha.burger — Mon, 24 Aug 2020 09:46:22 GMT

@BPry

@SutareMayur

thank you guys for your quick reply.

i have testet both methods but i think to build a custom report is the better way for a user friendly export.

both ways need a lot of time and generate a high load of the customer firewall becauce the time frame is really big 01/29-24/08/2020

i think i must start the custom report at night, so the daily business of my customer gets in no trouble because the cpu and dataplane load is to high.

at my first tests with custom reports, the customer firewall disconnects from our panorama.

the firewall was pingable but for more than 10 minutes no web or ssh access possible.