an overview of traffic and user activity on your network. This view
focuses on the top most-used applications, the top users who generate
traffic with a drill down into the bytes, content, threats, and
URLs accessed by the user, and the most used Security policy rules
against which traffic matches occur. In addition, you can view network
activity by source or destination zone, region, or IP address; by
ingress or egress interfaces; and by host information, such as the
operating systems of the devices most commonly used on the network.
—Displays an overview
of the threats on the network. It focuses on the top threats—vulnerabilities,
spyware, viruses, hosts visiting malicious domains or URLs, top
WildFire submissions by file type and application, and applications
that use non-standard ports. The Compromised Hosts widget supplements
detection with better visualization techniques. It uses the information
from the correlated events tab (Monitor
> Automated Correlation Engine > Correlated Events) to present
an aggregated view of compromised hosts on your network by source
users or IP addresses, sorted on severity.
—Focuses on traffic
that was prevented from coming into the network. The widgets in
this tab allow you to view activity denied by application name,
username, threat name, content (files and data), and the top security
rules with a deny action that blocked traffic.
Mobile Network Activity
visual representation of mobile traffic on your network using GTP
logs generated from your Security policy rule configuration. This
view includes interactive and customizable GTP Events, Mobile Subscriber
Activity, and GTP Rejection Cause widgets to which you can apply
ACC Filters and drill down to isolate the information you need.
When you enable SCTP Security, widgets on this tab display
a visual representation and details of SCTP events on the firewall,
as well as the number of chunks sent and received per SCTP Association
—Displays the activity
of tunnel traffic that the firewall inspected based on your tunnel
inspection policies. Information includes tunnel usage based on
tunnel ID, monitor tag, user, and tunnel protocols such as Generic
Routing Encapsulation (GRE), General Packet Radio Service (GPRS)
tunneling protocol for user data (GTP-U), and non-encrypted IPSec.
overview of user activity in your GlobalProtect deployment. Information
includes the number of users and number of times users connected,
the gateways to which users connected, the number of connection
failures and the failure reason, a summary of authentication methods
and GlobalProtect app versions used, and the number of endpoints
that are quarantined.