In this video, I get to take a look at many of the default reports.
And I want you to remember that behind a report, there is also the option to
use things like templates
and charts and the data sets, identifying what data we're going to pull from
the SQL database.
But as we start with default reports, I just want to give you a big picture
look at how valuable they are.
So let's take a moment. I want to verify that I have my firewalls online.
So I got firewall two, firewall three, the headquarters firewall right here,
and the branch firewall right there. And they're all reporting to this 40 analy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the branch firewall right there. And they're all reporting to this 40 analy
zer in the root ADOM,
which is a fancy way of saying the root administrative domain. Because as a
reminder,
we can specify multiple different ADOMs with different Fortnite devices
reporting to specific ADOMs
and then have different administrators in charge of each of those. Now, that
also applies to reports.
So as we start customizing or scheduling reports, that's on a per ADOM basis.
So in this set of
videos, all four firewalls are reporting and saying their information to the
root ADOM here
on our 40 analyzer. So here we go. So here's the 40 analyzer. We're going to go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on our 40 analyzer. So here we go. So here's the 40 analyzer. We're going to go
ahead and log in as
admin. Also play the password. We'll click on log in. And because ADOMs are
enabled, it's asking me
now which ADOM to go into. I want to go into the root ADOM. So we'll click on a
root. And here we go.
So there's our current feature version of the 40 analyzer 7.63. Great, great,
great. This is
good a device manager and here in device manager, I have all four devices are
reporting. So these
three here at the headquarters site, as part of our fabric, and I've got the
branch firewall
reporting as well. Fantastic. So for reports on the far left side here, we'll WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
reporting as well. Fantastic. So for reports on the far left side here, we'll
go to reports.
Then I have a section for generated reports. So if you add some reports that
were created,
they would show up here and then we also have a timeframe you can sort by. So
if you said I want
to see all the reports that have been created in the last, for example, three
months, we could
put in a month's equals three there, press enter. And then currently I have no
generated reports
on this 40 analyzer. And that's okay. So we'll have some here in just a little
bit. So we go
to report definitions. Here are the built in report definitions. So in the tabs WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to report definitions. Here are the built in report definitions. So in the tabs
up on top,
I've got all reports. And then I've got a tab for templates. Again, a template,
think of it like
the cookie cutter for a report. If we want to use that template, I've got a
chart library
with a whole bunch of different pre defined charts, right, Iraq, I've got the
data sets tab,
which is the SQL queries they're going to be used to get the information out of
the SQL database.
And then we also have that subset. Well, I think of a subset of a data set. And
that's the macro
library, think of them like little itty bitty requests, looking for certain WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
library, think of them like little itty bitty requests, looking for certain
elements of data
from the SQL database. But for now, they could go back to all reports. And
there are a lot of them.
So here in the bottom right, it says 321, meaning there are 321 pre defined
reports
that we can choose from. And the little folder icon represents there's various
folders
that these reports are kept in. So when you think of a report, think of the
actual report that can
be generated. And then if we generate a report, there's also another section
for reports that we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for reports that we
can actually look at those generated reports. So let's sort and search for how
about 360. So I'm
going to do a search for 360 up here. And that's going to refine our list here
with the filter,
looking at anything that has 360 in it. So here is a sock 360 degree security
review. And over here,
it says it's built in. And here at the time period, it's showing how far back
it's going to go. So
for this right here, I may have modified it to be this year in the previous
seven days. But for the
360 degree security review, if we double click on it, that's going to take us WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
360 degree security review, if we double click on it, that's going to take us
into the first tab
here, the generated report. So if we had generated a report based on this
report, it would show up
here. Actually, if we generate in the last three months, it would show up here.
And if we click on
settings, here's where we can tweak and modify the settings for this report,
including things such
as what time period would you like this report to cover. So currently, I have a
set for this year.
And I also can specify which devices and or subnets I want to limit to. And
there's also some options
down here regarding scheduling and notification and auto cash and filters and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
down here regarding scheduling and notification and auto cash and filters and
advanced settings.
And we'll get back to those a little bit later in the set of videos. So that's
the settings tab.
And then here in the editor, so we're looking at here is text as part of this
report that if we
generate this text, and then here's one chart followed by this chart followed
by this chart,
I'm just scrolling down here, followed by this chart, this is going to have
this text, then it's
going to have this table, then it's going to have page break, and the list goes
on. So this is just a
visual representation of how the report will look based on the text here and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
visual representation of how the report will look based on the text here and
the charts being used,
and all that also could have come from the template that this report is
choosing to use. So I'm not
going to make any changes here. I'm going to click on return, and I'm going to
right click here,
and then from the dropdown, I can click run report. That's one way of running
this report.
Another way would be to highlight this report here, and then click here and run
report. That would do
it. Or we could do this. We could go into the generated reports here, and there
currently aren't any.
We could click on run report here. That also would run this report. Also just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We could click on run report here. That also would run this report. Also just
right here where it says
last end months, that's referring to what it's showing here as far as reports
that have been run
in the last three months. However, if we go to settings for this report, we're
here where it says
this year, the actual data in the report is pulling from this year as of this
recording. So it's going
to be January from 2025 to December 31st, 2025, because I'm recording this in
2025. All right,
so I'm going to go back to generated reports here and just click on run report,
and that will take
a little bit of time to run. So in a moment here, we should see a report WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a little bit of time to run. So in a moment here, we should see a report
showing up, and we'll give
that a minute to do that. And so it's on its way. It's not quite done yet. So
when it's done,
it'll fill in the format column here with options to see that report, including
HTML, PDF, there it is
XML, CSV, and JSON. So there's our reports. Let me go ahead and collapse this
left hand side.
So we're in the reports report definitions. I'm going to go ahead and collapse
that left,
give us a little more room, and it took 14 seconds to run that report. So to
see the report, we simply
click here on HTML. If you want to see an HTML version that'll open a new tab WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
click here on HTML. If you want to see an HTML version that'll open a new tab
for you, or if you
want to see XML raw, you can click on that if you want to see a PDF, you can
click there. So let's
click here on HTML and take a look at this report. So here's the report. So
over on the left,
this is all clickable. So if we want to go for example, to high risk
applications in use,
or high risk application, my category, we can click on any of these sections,
it'll take us there.
So let's scroll back to the top and as I scroll up, it's also tracking on the
left there. Fantastic.
So here's this report. Here's the summary. And then it has those tables based WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here's this report. Here's the summary. And then it has those tables based
on that report
definition and then information being populated based on the data set that was
being used in the
background to pull that information from the SQL database. So here's regarding
application
visibility and control, threat detection and prevention, no information on data
exfiltration,
then high risk applications in use, we got some proxy avoidance it looks like
and some peer-to-peer
applications. If he keeps crawling down, it has application risk definitions,
you know, all the
way from severe down to low, and then application categories, and then a table WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
way from severe down to low, and then application categories, and then a table
representing the
application categories. So as far as data throughput, the most used application
would be video/audio,
and that was 11 gigabytes based on this calendar year, and that's here in my
lab environment based
on those four, 48 firewalls. Then if we continue to scroll down, we have web
application section
here, and these are sorted by risk. So proxy websites, then BitTorrent, then
OneDrive, and blah,
blah, blah, blah, all the way down. And then we have web categories, including
their respective
bandwidth usage, so information technology, web analytics. And if you go down, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
bandwidth usage, so information technology, web analytics. And if you go down,
here's some for
gambling, malicious websites, proxy avoidance. And as we continue to scroll
down here, we have
threat detection and prevention. So we had an iCAR test file that I used a few
times,
and then we have some information here regarding malware and botnets. So for
malware botnets,
there was two sites that we were trying to reach. And as far as command and
control networks,
we're going to domains and IPs detected with DNS filtering. There's a whole
bunch here,
and these are all generated by me to build some logs that we could look at. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and these are all generated by me to build some logs that we could look at. And
then here is our
iCAR test file. And then we have top 10 victims of phishing sites, and here's
that information
here, and then top 25 malicious phishing sites, that information is here, and
then intrusion
and attacks. And again, it's all based on the details specified by that report.
So here we
had some IPS events, and then we scroll down has other sections as well, based
on that report.
And this opens up in a separate tab. So if we go back to the 40 analyzer, so
here back at the 40
analyzer, we're going to go ahead and open up the left hand column here, and we
get a report
definitions. If we scroll down, here's our SOC reports, here's our 360 degree WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
definitions. If we scroll down, here's our SOC reports, here's our 360 degree
security review,
if we double click on that, it'll then show us any reports that have been
generated based on
that report. Another way of seeing this report is we could go into reports to
generated reports,
and it's right here as well. We could also associate this report we needed to
our one or two
with an incident, and that way this report would be easily available as part of
that incident.
So now that we've taken a look at an example of running a default report, one
of the hundreds
available on the 40 analyzer in the next video, we're going to take a closer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
available on the 40 analyzer in the next video, we're going to take a closer
look at the wonderful
world of templates. So I'll see you in the next video in just a moment.