Search Tab, offers numerous options for making your searches more precise and getting more useful results from the Aggregated Logs Database. It also allows you to search from the Raw Firewall Logs.
In Advance Search, you can search the logs for the selected devices, from the aggregated logs database or raw firewall logs, and define matching criteria.
In this section, you can choose the devices for which you want the logs to be searched. If no device is selected or you want to change the list of selected devices, select the devices.
The selected devices are displayed in this section.
In this section, you can select one from the two options:
Select this option if you want to search from the aggregated logs database.
Select this option if you want to search from the raw firewall logs. Selecting this option will enable the following options:
- Raw VPN Logs
- Raw Virus/Attack Logs
- Raw Device Management Logs
- Raw Denied Logs
Select the above logs options as per your requirement.
This section, enables you to search the database for attributes using more than one following criteria's:
|Protocol||Refers to the list of protocols and protocol identifiers that are available in the Protocol Groups page (Settings >> Protocol Groups)
example: 8554/tcp, rtsp, IPSec
Refers to the source host name or IP address from which requests originated
|Destination||Refers to the destination host name or IP address to which requests were sent|
|User||Refers to the authenticated user name required by some firewall's
example: john, kate
|Virus||Refers to the Virus name.
examples: JS/Exception, W32/Mitglieder
|Attack||Refers to the attack name.
examples: UDP Snort, Ip spoof
|URL||Refers to the URL, which you want to search|
|Rule||Refers to the Firewall Rule, which you want to search|
|Device||Refers to the device from which logs are collected|
|Message||Refers to the log message texts stored in the DB|
You can carry out Advanced Search on the imported Firewall logs.