User guide

Chapter 15: Generating Reports of Network Activity
210 WatchGuard Firebox System
Host
Filter a report based on host IP address.
Port
Filter a report based on service name or port number.
User
Filter a report based on authenticated username.
Creating a new report filter
Use Historical Reports to create a new report filter. Filters are stored in the
WatchGuard installation directory, in the subdirectory
report-defs
with the file extension
.ftr.
From Historical Reports:
1 Click Filters. Click Add.
2 Enter the name of the filter as it will appear in the Filter drop list in
the Report Properties Setup tab. This name should easily identify the
filter.
3 Select the filter type.
An Include filter displays only those records meeting the criteria set on the Host,
Service and User tabs. An Exclude filter displays all records except those meeting
the criteria set on the Host, Service, and User tabs.
4 Complete the Filter tabs according to your report preferences.
For a description of each control, right-click it, and then click What’s This?. You
can also refer to the “Field Definitions” chapter in the Reference Guide.
5 When you are finished modifying filter properties, click OK.
The name of the filter appears in the Filters list. The Filter Name.ftr file is created
in the report-defs directory.
Editing a report filter
At any time, you can modify the properties of an existing filter. From the
Filters dialog box in Historical Reports:
1 Highlight the filter to modify. Click Edit.
The Report Filter dialog box appears.
2 Modify filter properties according to your preferences.
For a description of each property, right-click it, and then click What’s This?. You
can also refer to the “Field Definitions” chapter in the Reference Guide.