End-of-Life (EoL)

Botnet Report Settings

  • Monitor > Botnet > Report Setting
Before generating the botnet report, you must specify the types of traffic that indicate potential botnet activity (see Configuring the Botnet Report). To schedule a daily report or run it on demand, click
Report Setting
and complete the following fields. To export a report, select it and
Export to PDF
Export to CSV
, or
Export to XML
Botnet Report Settings
Test Run Time Frame
Select the time interval for the report—
Last 24 Hours
(default) or
Last Calendar Day
Run Now
Run Now
to manually and immediately generate a report. The report displays in a new tab within the Botnet Report dialog.
No. of Rows
Specify the number of rows to display in the report (default is 100).
Select this option to automatically generate the report daily. By default, this option is enabled.
Query Builder
queries to the Query Builder to filter the report output by attributes such as source/destination IP addresses, users, or zones. For example, if you know that traffic initiated from the IP address contains no potential botnet activity, you can add
not (addr.src in
as a query to exclude that host from the report output.
  • Connector
    —Select a logical connector (
    ). If you select
    , the report will exclude the hosts that the query specifies.
  • Attribute
    —Select a zone, address, or user that is associated with the hosts that the firewall evaluates for botnet activity.
  • Operator
    —Select an operator to relate the
    to a
  • Value
    —Enter a value for the query to match.

Recommended For You