Each Firewalla box processes thousands of flows and many alarms each day. Firewalla MSP's Reports feature helps you easily and quickly understand all the valuable data that Firewalla gives you about your network by making it simple to identify important stats and trends across one or more Firewalla boxes. With Reports, You can do things like:
- See which devices are using up strange amounts of data
- Identify what activities your networks are being used for (gaming, video, social media, etc.)
- Find where in the world your top blocked flows are coming from
- And much more…
Reports are available through Firewalla Managed Security Portal (MSP), our web interface designed to make it easy, convenient, and efficient to manage a fleet of Firewalla boxes. You can learn more in our introduction article all about Firewalla MSP. Reports are only available for Flows and Alarms for now – we plan to add more data types in the future.
- Exploring Firewalla's Template Reports
- Customizing a Template Report
- Creating a Report from Scratch
- Editing and Deleting Reports
- Viewing Reports
- Exporting Reports
- Example: Top Security Alarms Report
Exploring Firewalla's Template Reports
To make getting started with Reports easy, Firewalla comes with a few pre-built template Reports. These templates already show you valuable insights about your network, and you can easily customize them to focus on the information you're interested in.
Template Reports for Flows:
- Top blocked regions
- Top blocked destinations
- Top bandwidth devices
- Top activities
Template Reports for Alarms:
- Top abnormal upload devices
- New device history
- Large bandwidth devices
- Alarms generated over time
Customizing a Template Report
You can quickly create a custom Report by modifying any of Firewalla's Template Reports and saving your changes as a new Report. To customize a Report, you can:
- Adjust the filters: Filter your data by Box, Status, Destination, Device, Category, Region, Upload/Download, and more.
- Enter search terms: Use the search bar to look for a key term. You can also apply filters through the search bar.
- Change the time range: Choose between the last 60 minutes, 24 hours, 7 days, 30 days, or a custom date range.
- Select which columns you are interested in
- Choose how the table should be sorted
When you're done making your customizations, just click Save As and enter a name for your new Report. The filters, search terms, time range, and columns you've configured will all be saved so you can access them again at any time. The original template report won't be changed.
If you spot a row of data in a report that you're interested in investigating further, hover over the row and click View Alarms/Flows on the right side of the row. It will open up a new page and show you all the data matching the related conditions.
Creating a Report from Scratch
You can create a new Report from scratch by navigating to the Reports and tapping + Create Report.
Enter a name for your Report, choose what kind of data you want to focus on (either Flows or Alarms), and then click Create. You'll see a summarized view of your flows to start with.
Click Save Report at the right of the screen to save the filters, time range, and columns you've configured.
Editing and Deleting Reports
You can change the name of a Report or delete it by opening the saved report from the Reports page and then clicking the Edit button in the top right corner.
From the dialog, you can enter a new name and click Save to confirm, or you can click Delete to permanently delete the Report.
Viewing Reports
Reports can be opened or updated from the Reports page or their data type page (Flows Reports can be opened from the Flows page, and Alarms Reports can be opened from the Alarms page). If you go to the Flows page or the Alarms page, the three most recently opened Reports will be listed at the top. Open a Report by clicking its name, and go back to see all Flows or Alarms by clicking All.
You can update a Report from the Flows page by tapping the Save button next to the search bar, or click Save As to create a new Report separate from the existing Report.
Exporting Reports
Any Report or set of Flows and Alarms can be downloaded as a CSV file with one click.
All your exports will be archived on the Reports -> Exports tab. Before they expire (within 48 hours), you can download them as many times as you want. Note that only up to 20 exports can be generated in a 48-hour span; we may increase this limit in the future.
Example: Top Security Alarms Report
You can easily create a Report that will tell you exactly which devices on which boxes are generating the most critical security alarms, helping you identify potential vulnerabilities in your network. First, create a new Report using Alarms data.
Next, modify the default Report so we only see security alarms and can easily see what device triggered the alarm:
- Filters: "Status: Active"; "AlarmType: Security Activity, Abnormal Upload, Open Port"
- Time Range: Last 30 Days (change this to focus on the time period you're interested in)
- Columns: Alarm Type, Box, Device, Alarm Count
- Sort By: Number of alarms
You'll then see a list of devices that have triggered critical security alarms. Hover and tap View Alarms to dig into each set of alarms. Before closing out of your new Report, make sure to click Save to make sure any changes are logged.
Comments
0 comments
Please sign in to leave a comment.