WatchGuard Technologies Firebox X manual Using Report Filters, Complete the Filter tabs

Using Report Filters

torical Reports. To calculate Internet use report data, Historical Reports counts the number of HTTP pro- tocol transactions. NetIQ calculates the number of URL requests.

Note

The WatchGuard HTTP proxy logging must be set to ON to supply NetIQ with the information that is necessary.

You can find the report in:

My Documents\My WatchGuard\Shared WatchGuard\reports

Using Report Filters

A report includes data from the full log file unless you create and use report filters. You can use a report filter to show only data about specified hosts, services, or users. A filter can be one of two types:

Include

To make a report that includes records with the properties set in the Host, the Service, or the User Report Filters tabs.

Exclude

To make a report that does not include records with the properties set in the Host, the Service, or the User Report Filters tabs.

You can set a filter to Include or Exclude data in a report with three properties:

Host

Host IP address

Port

Service name or port number

User

Authenticated user name

Creating a new report filter

Use Historical Reports to make a new report filter. You can find the filters in the WatchGuard® installa- tion directory, in the subdirectory report-defswith the file extension.ftr.

1From Historical Reports, click Filters. Click Add.

2Type the name of the filter. This name appears in the Filter drop-down list on the Report Properties Setup tab.

3Select the filter type.

As an example, if you have 45 hosts, graph the top 10 and list the remaining hosts as “other.” For a description of include and exclude, see above.

4Complete the Filter tabs.

To see the function of each item, right-click it, and then click What’s This?.

User Guide 53