useful custom reports

[MPI-AE]

Hey all,

I want to create some custom reports to get more useful information about what is going on in my network.

I would like to know - just informational - which reports do you use in your daily business?

Respectively which reports you consider as useful.

Until now, I created one report that shows me the denied packets for every last week.

Can you give me some more hints?

Thank you!

[MPI-AE]

@BPry

For example, when I want to create a custom report with the spyware infected hosts:

How can I do this?

There aren't so much options..

[BPry]

@MPI-AE,

The spyware report is actually pulling from the Threat database, with the ( subtype eq spyware ) as the actor. 

[DAYANAND]

Hi, we can create custom reports as per our requirement, you could define the filters which you wish to observes the logs for like desti, zone, etc..One could define a time frame as well  like daily, weekly and so on. 

However I have a few questions that I still need ansewrs for : 

1.) There is an option for grouping the traffic log reports based on destination etc.... There is a maximum limit of 500 logs only that it can produce logs for. Does that mean I get only 500 logs from the time of capture ? If I am right what happens to the traffic generated after that ? Is there a way to incerase the limit >500. Because a custome report on Panorama with a limit of 500 means nothing even if I capture hourly.

[BPry]

@DAYANAND,

It's the top 500 logs depending on whatever your sort criteria be. So if I use bytes for example, it's the TOP 500 logs as determined by the amount of bytes logged. If you are combining a 'Sort By' and 'Group By' operating within the same request you'll be limited to the Top 500 logs; however if you remove the 'Group By' you have access to as much as the Top 10,000 logs.

You have to get creative in the way you generate the reports so that the report actually gives you what you are looking for. I've yet to want to run any report that I wasn't able to work around these limitations in some way or another. 

I know that there are multiple FRs to increase this capability if you want to reach out to your SE and add your vote to those requests. 

[DAYANAND]

Hi @BPry

Thank you for the reply, after some thought your post made sense. I am still getting to know how the SORT BY and GROUPEDBY work in conjunction with eachother in generating reports. any explanantion in that direction will be helpful.  Is there any detailed documentation with examples where I can refer for further learning. Thank you

[MPI-AE]

@BPryI'm still overwhelmed.

There is that top egress interfaces report that shows all interfaces and the bytes which were transmitted.

How can I create a custom report for that, but not for one day, but for a whole week? To see the weekly amount of bytes of my interfaces.

[BPry]

@MPI-AE,

Some of that got cut off, but Select Columns I would start with Bytes, Count, Outbound Interface, Packets Received, Packets Sent, and Day. This will give you a break down for egress interface by day for the past seven days. Customize the Selected Columns to your liking.