67-16
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 67 Managing Reports
Understanding the Predefined System Reports in Report Manager
Understanding General VPN Reports
Report Manager includes predefined system reports that you can use to analyze general remote access
VPN usage in your network. These reports are not specific to the connection types used in the VPN.
The following reports are available in the System Reports > VPN folder.
•User Report—This report provides a summary of the bandwidth utilization, connection duration
and throughput usage for each remote access VPN user. The report shows the usernames, the
bandwidth in total number of bytes sent and received, the connection duration time in days
hours:minutes:seconds format, and the throughput for each user in kbps. The throughput is
calculated as 8.0*(bandwidth of the user in bytes)/(duration for which the user is connected in
seconds*1000.0).
Each username appears on a single row, even if the user connected to the VPN uses more than one
type of connection. When a user uses more than one type of connection, the statistics for each
connection type are added together in the report.
The default report includes information for all connection technologies and all users. You can
customize the report to focus on a single technology type or one or more specific users (see Editing
Report Settings, page 67-21).
•VPN Device Usage Report—This report provides a summary of the usage statistics for each device
that hosts remote access VPN connections. The report shows the device (using the Security Manager
display name), the average number of users logged into the VPN at any given time during the
reported time range, the total bandwidth of all users in the VPN in bytes (sent and received), the total
connection duration time in days hours:minutes:seconds format, and the average throughput in kbps
at any given time during this report period.
The default report includes information for all connection technologies. You can customize the
report to focus on a single technology type (see Editing Report Settings, page 67-21).
The parameter used to define the reporting time period is defined in the system defaults as described in
Configuring Default Settings for Reports, page 67-24. You can also edit the report settings and create
custom versions of the reports, as described in the following topics:
•Editing Report Settings, page 67-21
•Creating Custom Reports, page 67-20
Understanding IPS Top Reports
Report Manager includes predefined system reports that you can use to analyze top attackers, victims,
and signatures for IPS alerts in your network.
The following reports are available in the System Reports > IPS folder.
•Top Attackers—This report ranks the attacker (source) addresses that generated the highest
numbers of recorded IPS alerts. The report shows the attacker IP address, the count of the number
of alerts for each address, and the percentage of the count compared to the sum of all counts in the
report.
The default report includes information for all attackers, victims, and signatures for both blocked
and unblocked actions. You can customize the report to focus on subsets of attackers, victims, or
signatures, or limit the analysis to blocked only or unblocked only actions (see Editing Report
Settings, page 67-21).