WatchGuard Firebox System 4.6 User Guide

Using report filtersUsing report filtersBy default, a report displays information on the entire contents of a log file. Theremay be times, however, when you want to view only information about specifichosts, services, or users. Use report filters to narrow the range of data reported upon.Filters can be one of two types:IncludeCreates a report that includes only those records that meet the criteria set in theHost, Service, or User Report Filters tabs.ExcludeCreates a report that excludes all records that meet the criteria set in the Host,Service, or User Report Filter tabs.You can filter an Include or Exclude report based on three criteria:HostFilter a report based on host IP address.PortFilter a report based on service name or port number.UserFilter a report based on authenticated username.Creating a new filterUse Historical Reports to create a new report filter. Filters are stored in theWatchGuard installation directory, in the subdirectory report-defs with the fileextension .ftr. From Historical Reports:1 Click Filters. Click Add.2 Enter the name of the filter as it will appear in the Filter drop list in the ReportProperties Setup tab. This name should easily identify the filter.3 Select the filter type.An Include filter displays only those records meeting the criteria set on the Host, Service andUser tabs. An Exclude filter displays all records except those meeting the criteria set on the Host,Service, and User tabs.4 Complete the Filter tabs according to your report preferences.For a description of each control, right-click it, and then click What’s This?.5 When you are finished modifying filter properties, click OK.The name of the filter appears in the Filters list. The Filter Name.ftr file is created in thereport-defs directory.Editing a filterAt any time, you can modify the properties of an existing filter. From the Filtersdialog box in Historical Reports:1 Highlight the filter to modify. Click Edit.The Report Filter dialog box appears.2 Modify filter properties according to your preferences.For a description of each property, right-click it, and then click What’s This?.User Guide 113