WatchGuard Firebox System 4.6 User Guide

Report sections and consolidated sectionsReport sections and consolidated sectionsYou can use Historical Reports to build a report that includes one or more sections.Each section represents a discrete type of information or network activity.You can consolidate certain sections to summarize particular types of information.Consolidated Sections summarize the activity of all devices being monitored as agroup as opposed to individual devices.Report sections can be divided into two basic types:• Summary – Report sections that rank information by bandwidth or connections.• Detailed – Report sections that display all activity with no summary graphs orranking.The following is a listing of the different types of report sections and consolidatedsections.Firebox StatisticsA summary of statistics on one or more log files for a single Firebox.Authentication DetailA detailed list of authenticated users sorted by connection time. Fields include:authenticated user, host, start date of authenticated session, start time ofauthenticated session, end time of authenticated session, and duration of session.Time Summary – Packet FilteredA table, and optionally a graph, of all accepted connections distributed along userdefinedintervals and sorted by time. If you chose the entire log file or specific timeparameters, the default time interval is daily. Otherwise, the time interval is basedon your selection.Host Summary – Packet FilteredA table, and optionally a graph, of internal and external hosts passing trafficthrough the Firebox sorted either by bytes transferred or number of connections.Service SummaryA table, and optionally a graph, of traffic for each service sorted by connectioncount.Session Summary – Packet FilteredA table, and optionally a graph, of the top incoming and outgoing sessions, sortedeither by byte count or number of connections. The format of the session is: client -> server : service. If the connection is proxied, the service is represented in allcapital letters. If the connection is packet filtered, Historical Reports attempts toresolve the server port to a table to represent the service name. If resolution fails,Historical Reports displays the port number.Time Summary – Proxied TrafficA table, and optionally a graph, of all accepted connections distributed along userdefinedintervals and sorted by time. If you chose the entire log file or specific timeparameters, the default time interval is daily. Otherwise, the time interval is basedon your selection.User Guide 115