Monitor Data Center Block Rules and Tune the Rulebase

Create custom reports to monitor traffic that matches the block rules designed to identify policy gaps and potential attacks.
Select

Monitor

Manage Custom Reports

.

Add

a report and give it a

Name

that describes the report’s purpose, in this example

DC Best Practice Policy Tuning

.

Set the

Database

to

Traffic Summary

. This also changes the

Available Columns

options.

From

Available Columns

, add

Source Zone

,

Destination Zone

,

Sessions

,

Bytes

,

Application

,

Risk of App

,

Rule

, and

Threats

to the

Selected Columns

list. If there are other types of information you want to monitor, select those as well.

Select the

Scheduled

box.

Set the desired

Time Frame

,

Sort By

, and

Group By

values. In this example we set the

Time Frame

to

Last 7 Days

, the

Sort By

to

Apps

, and the

Group By

to

App Sub Category

.

Define the query to match traffic hitting the rules designed to find policy gaps and potential attacks. You can create a single report for traffic that matches any of the rules using the

or

operator, or create individual reports to monitor each rule. In the

Query Builder

, specify the name of each rule you want to include in the report. This example uses the six blocking rules and uses the

Or

operator to include information about traffic that matches any of the rules:

(rule eq ‘Discover-Unknown-Users’)
(rule eq ‘Block-Bad-Apps’)
(rule eq ‘Unexpected-App-from-User-Zone’)
(rule eq ‘Unexpected-App-from-Any-Zone’)
(rule eq ‘Unexpected-User-App-Any-Port’)
(rule eq ‘Unexpected-App-Any-Port’)


Review the report (or reports) regularly to make sure you understand why traffic matches each block rule and either update policy to include legitimate applications and users, or use the information to assess the risk of traffic that matches the rules.