Dataset Reference List
The following tables list the datasets included with FortiAnalyzer. The tables contain the name, SQL query syntax, and log category for each dataset.
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Traffic-Bandwidth-Summary-Day-Of-Month |
Traffic bandwidth timeline |
traffic |
select $flex_timescale(timestamp) as hodex, sum(traffic_out) as traffic_out, sum(traffic_in) as traffic_in from ###(select timestamp, sum(bandwidth) as bandwidth, sum(traffic_out) as traffic_out, sum(traffic_in) as traffic_in from ###base(/*tag:rpt_base_t_bndwdth_sess*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, appcat, apprisk, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, count(*) as sessions, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in from $log-traffic where $filter and (logflag&(1|32)>0) group by timestamp, dvid, srcip, dstip, epid, euid, appcat, apprisk, user_src, service /*SkipSTART*/order by timestamp desc/*SkipEND*/)base### base_query group by timestamp order by bandwidth desc)### t where $filter-drilldown group by hodex having sum(traffic_out+traffic_in)>0 order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Session-Summary-Day-Of-Month |
Number of session timeline |
traffic |
select $flex_timescale(timestamp) as hodex, sum(sessions) as sessions from ###(select timestamp, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_bndwdth_sess*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, appcat, apprisk, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, count(*) as sessions, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in from $log-traffic where $filter and (logflag&(1|32)>0) group by timestamp, dvid, srcip, dstip, epid, euid, appcat, apprisk, user_src, service /*SkipSTART*/order by timestamp desc/*SkipEND*/)base### base_query group by timestamp order by sessions desc)### t where $filter-drilldown group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Users-By-Bandwidth |
Bandwidth application top users by bandwidth usage |
traffic |
select user_src, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(sessions) as sessions from ###(select user_src, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by user_src order by sessions desc, bandwidth desc)### t group by user_src having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-App-By-Bandwidth |
Top applications by bandwidth usage |
traffic |
select app_group_name(app) as app_group, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(sessions) as sessions from ###(select appid, app, appcat, apprisk, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by appid, app, appcat, apprisk /*SkipSTART*/order by sessions desc, bandwidth desc/*SkipEND*/)### t group by app_group having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-User-Source-By-Sessions |
Top user source by session count |
traffic |
select user_src, sum(sessions) as sessions from ###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, count(*) as sessions from $log where $filter and (logflag&1>0) group by user_src order by sessions desc)### t group by user_src order by sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-App-By-Sessions |
Top applications by session count |
traffic |
select app_group, sum(sessions) as sessions from ###(select app_group_name(app) as app_group, appcat, service, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by app_group, appcat, service order by bandwidth desc)### t group by app_group order by sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Destination-Addresses-By-Sessions |
Top destinations by session count |
traffic |
select
coalesce(
nullifna(
root_domain(hostname)
),
ipstr(dstip)
) as domain,
count(*) as sessions
from
$log
where
$filter
and (
logflag&1>0
)
group by
domain
order by
sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Destination-Addresses-By-Bandwidth |
Top destinations by bandwidth usage |
traffic |
select
coalesce(
nullifna(
root_domain(hostname)
),
ipstr(dstip)
) as domain,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth,
sum(
coalesce(rcvdbyte, 0)
) as traffic_in,
sum(
coalesce(sentbyte, 0)
) as traffic_out
from
$log
where
$filter
and (
logflag&1>0
)
and coalesce(
nullifna(
root_domain(hostname)
),
ipstr(`dstip`)
) is not null
group by
domain
having
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
)> 0
order by
bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
DHCP-Summary-By-Port |
Event top dhcp summary |
event |
drop table if exists rpt_tmptbl_1; drop table if exists rpt_tmptbl_2; drop table if exists rpt_tmptbl_3; create temporary table rpt_tmptbl_1 as select devintf, mac from ###(select concat(interface, '.', devid) as devintf, mac from $log where $last3day_period $filter and logid_to_int(logid) = 26001 and dhcp_msg = 'Ack' group by devintf, mac)### t group by devintf, mac; create temporary table rpt_tmptbl_2 as select devintf, mac from ###(select concat(interface, '.', devid) as devintf, mac from $log where $filter and logid_to_int(logid) = 26001 and dhcp_msg = 'Ack' group by devintf, mac)### t group by devintf, mac; create temporary table rpt_tmptbl_3 as select distinct on (1) devintf, cast(used*100.0/total as decimal(18,2)) as percent_of_allocated_ip from ###(select distinct on (devintf) concat(interface, '.', devid) as devintf, used, total, itime from $log where $filter and logid_to_int(logid)=26003 and total>0 /*SkipSTART*/order by devintf, itime desc/*SkipEND*/)### t order by devintf, itime desc; select t1.devintf as interface, percent_of_allocated_ip, new_cli_count from rpt_tmptbl_3 t1 inner join (select devintf, count(mac) as new_cli_count from rpt_tmptbl_2 where not exists (select 1 from rpt_tmptbl_1 where rpt_tmptbl_2.mac=rpt_tmptbl_1.mac) group by devintf) t2 on t1.devintf=t2.devintf order by interface, percent_of_allocated_ip desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Wifi-Client-By-Bandwidth |
Traffic top WiFi client by bandwidth usage |
traffic |
select
user_src,
srcssid,
devtype_new,
hostname_mac,
sum(bandwidth) as bandwidth
from
(
select
user_src,
srcssid,
get_devtype(srcswversion, osname, devtype) as devtype_new,
hostname_mac,
sum(bandwidth) as bandwidth
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, ap, srcintf, srcssid, srcssid as ssid, srcmac, srcmac as stamac, coalesce(nullifna(`srcname`), `srcmac`) as hostname_mac, max(srcswversion) as srcswversion, max(osname) as osname, max(osversion) as osversion, max(devtype) as devtype, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as subtotal from $log-traffic where $filter and (logflag&1>0) and (srcssid is not null or dstssid is not null) group by user_src, ap, srcintf, srcssid, srcmac, hostname_mac /*SkipSTART*/order by bandwidth desc, subtotal desc/*SkipEND*/)### t group by user_src, srcssid, devtype_new, hostname_mac having sum(bandwidth)>0 union all select user_src, ssid as srcssid, null as devtype_new, stamac as hostname_mac, sum(bandwidth) as bandwidth from ###(select $flex_timestamp as timestamp, stamac, stamac as srcmac, ap, ssid, ssid as srcssid, user_src, sum(coalesce(sentdelta, 0)) as sentdelta, sum(coalesce(rcvddelta, 0)) as rcvddelta, sum(coalesce(sentdelta, 0)+coalesce(rcvddelta, 0)) as bandwidth from (select itime, stamac, ap, ssid, coalesce(`user`, ipstr(`srcip`)) as user_src, sentbyte-lag(coalesce(sentbyte, 0)) over (partition by stamac order by itime) as sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) over (partition by stamac order by itime) as rcvddelta from $log-event where $filter and subtype='wireless' and stamac is not null and ssid is not null and action in ('sta-wl-bridge-traffic-stats', 'reassoc-req', 'assoc-req')) as t group by timestamp, stamac, ap, ssid, user_src /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t where user_src is not null group by user_src, ssid, devtype_new, stamac having sum(bandwidth)>0) t group by user_src, srcssid, devtype_new, hostname_mac order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Traffic-History-By-Active-User |
Traffic history by active user |
traffic |
select
$flex_timescale(timestamp) as hodex,
count(
distinct(user_src)
) as total_user
from
###(select timestamp, user_src, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_bndwdth_sess*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, appcat, apprisk, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, count(*) as sessions, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in from $log-traffic where $filter and (logflag&(1|32)>0) group by timestamp, dvid, srcip, dstip, epid, euid, appcat, apprisk, user_src, service /*SkipSTART*/order by timestamp desc/*SkipEND*/)base### base_query group by timestamp, user_src order by sessions desc)### t where $filter-drilldown group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Allowed-Websites-By-Requests |
UTM top allowed web sites by request |
traffic |
select
hostname,
catdesc,
count(*) as requests
from
$log
where
$filter
and (
logflag&1>0
)
and utmevent in (
& #039;webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter') and hostname is not null and (utmaction not in ('block', 'blocked') or action!='deny') group by hostname, catdesc order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-50-Websites-By-Bandwidth |
Webfilter top allowed web sites by bandwidth usage |
traffic |
select
domain,
string_agg(
distinct catdesc,
& #039;, ') as agg_catdesc, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from ###(select coalesce(nullifna(hostname), ipstr(`dstip`)) as domain, catdesc, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out from $log where $filter and (logflag&1>0) and utmaction!='blocked' and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) group by domain, catdesc having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t group by domain, catdesc order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Blocked-Websites |
UTM top blocked web sites by request |
traffic |
select
hostname,
count(*) as requests
from
$log
where
$filter
and (
logflag&1>0
)
and utmevent in (
& #039;webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter') and hostname is not null and (utmaction in ('block', 'blocked') or action='deny') group by hostname order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Web-Users-By-Request |
UTM top web users by request |
traffic |
select
user_src,
devtype_new,
srcname,
sum(requests) as requests
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, get_devtype(srcswversion, osname, devtype) as devtype_new, srcname, action, utmaction, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as requests from $log where $filter and (logflag&1>0) and utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter') group by user_src, devtype_new, srcname, action, utmaction order by requests desc)### t group by user_src, devtype_new, srcname order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Allowed-WebSites-By-Bandwidth |
UTM top allowed websites by bandwidth usage |
traffic |
select
appid,
hostname,
catdesc,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth,
sum(
coalesce(rcvdbyte, 0)
) as traffic_in,
sum(
coalesce(sentbyte, 0)
) as traffic_out
from
$log
where
$filter
and (
logflag&1>0
)
and utmevent in (
& #039;webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter') and hostname is not null group by appid, hostname, catdesc having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Blocked-Web-Users |
UTM top blocked web users |
traffic |
select
user_src,
devtype_new,
srcname,
sum(requests) as requests
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, get_devtype(srcswversion, osname, devtype) as devtype_new, srcname, action, utmaction, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as requests from $log where $filter and (logflag&1>0) and utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter') group by user_src, devtype_new, srcname, action, utmaction order by requests desc)### t where (utmaction in ('block', 'blocked') or action='deny') group by user_src, devtype_new, srcname order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-20-Web-Users-By-Bandwidth |
Webfilter top web users by bandwidth usage |
traffic |
select
coalesce(
f_user,
euname,
ipstr(`srcip`)
) as user_src,
coalesce(
epname,
ipstr(`srcip`)
) as ep_src,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
(
select
dvid,
f_user,
srcip,
ep_id,
eu_id,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
###(select dvid, coalesce(nullifna(`user`), nullifna(`unauthuser`)) as f_user, srcip, (case when epid<1024 then null else epid end) as ep_id, (case when euid<1024 then null else euid end) as eu_id, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out from $log where $filter and (logflag&1>0) and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) group by dvid, f_user, srcip, ep_id, eu_id having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t group by dvid, f_user, srcip, ep_id, eu_id order by bandwidth desc) t1 left join (select epid, euid, srcmac as epmac, dvid from $ADOM_EPEU_DEVMAP dm inner join devtable dt ON dm.devid=dt.devid and dm.vd=dt.vd) t2 on t1.ep_id=t2.epid and t1.eu_id=t2.euid and t1.dvid=t2.dvid left join $ADOM_ENDPOINT t3 on t1.ep_id=t3.epid and t2.epmac=t3.mac left join $ADOM_ENDUSER t4 on t1.eu_id=t4.euid group by user_src, ep_src order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Web-Users-By-Bandwidth |
UTM top web users by bandwidth usage |
traffic |
select
user_src,
devtype_new,
srcname,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, get_devtype(srcswversion, osname, devtype) as devtype_new, srcname, action, utmaction, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as requests from $log where $filter and (logflag&1>0) and utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter') group by user_src, devtype_new, srcname, action, utmaction order by requests desc)### t group by user_src, devtype_new, srcname having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Video-Streaming-Websites-By-Bandwidth |
UTM top video streaming websites by bandwidth usage |
traffic |
select
appid,
hostname,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth,
sum(
coalesce(rcvdbyte, 0)
) as traffic_in,
sum(
coalesce(sentbyte, 0)
) as traffic_out
from
$log
where
$filter
and (
logflag&1>0
)
and catdesc in (
& #039;Streaming Media and Download') group by appid, hostname having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Email-Senders-By-Count |
Default top email senders by count |
traffic |
select
user_src,
sum(requests) as requests
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, count(*) as requests from $log where $filter and (logflag&1>0) group by user_src, service order by requests desc)### t where service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') group by user_src order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Email-Receivers-By-Count |
Default email top receivers by count |
traffic |
select
user_src,
sum(requests) as requests
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, count(*) as requests from $log where $filter and (logflag&1>0) group by user_src, service order by requests desc)### t where service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp') group by user_src order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Email-Senders-By-Bandwidth |
Default email top senders by bandwidth usage |
traffic |
select
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth
from
$log
where
$filter
and (
logflag&1>0
)
and service in (
& #039;smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') group by user_src having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Email-Receivers-By-Bandwidth |
Default email top receivers by bandwidth usage |
traffic |
select
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth
from
$log
where
$filter
and (
logflag&1>0
)
and service in (
& #039;pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp') group by user_src having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Malware-By-Name |
UTM top virus |
virus |
select
virus,
max(virusid_s) as virusid,
(
case when virus like & #039;Riskware%' then 'Spyware' when virus like 'Adware%' then 'Adware' else 'Virus' end) as malware_type, sum(totalnum) as totalnum from ###(select virus, virusid_to_str(virusid, eventtype) as virusid_s, count(*) as totalnum from $log where $filter and nullifna(virus) is not null group by virus, virusid_s /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t group by virus, malware_type order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Virus-By-Name |
UTM top virus |
virus |
select
virus,
max(virusid_s) as virusid,
(
case when virus like & #039;Riskware%' then 'Spyware' when virus like 'Adware%' then 'Adware' else 'Virus' end) as malware_type, sum(totalnum) as totalnum from ###(select virus, virusid_to_str(virusid, eventtype) as virusid_s, count(*) as totalnum from $log where $filter and nullifna(virus) is not null group by virus, virusid_s /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t group by virus, malware_type order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Virus-Victim |
UTM top virus user |
virus |
select user_src, sum(totalnum) as totalnum from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, eventtype, logver, virus, count(*) as totalnum from $log where $filter group by user_src, eventtype, logver, virus /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t where nullifna(virus) is not null group by user_src order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Attack-Source |
UTM top attack source |
attack |
select user_src, sum(totalnum) as totalnum from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, eventtype, logver, count(*) as totalnum from $log where $filter group by user_src, eventtype, logver /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t group by user_src order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Attack-Victim |
UTM top attack dest |
attack |
select
victim,
count(*) as totalnum
from
(
select
(
CASE WHEN direction =& #039;incoming' THEN srcip ELSE dstip END) as victim from $log where $filter) t where victim is not null group by victim order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Static-IPSEC-Tunnels-By-Bandwidth |
Top static IPsec tunnels by bandwidth usage |
event |
select
vpn_name,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
###(select devid, vd, remip, vpn_trim(vpntunnel) as vpn_name, tunnelid, tunnelip, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select devid, vd, remip, tunnelid, tunnelip,vpntunnel, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ipsec%' and nullifna(vpntunnel) is not null and tunnelid!=0 group by devid, vd, remip, vpn_name, tunnelid, tunnelip order by bandwidth desc)### t where (tunnelip is null or tunnelip='0.0.0.0') group by vpn_name having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-SSL-VPN-Tunnel-Users-By-Bandwidth |
Top SSL VPN tunnel users by bandwidth usage |
event |
select
user_src,
remip as remote_ip,
from_dtime(
min(s_time)
) as start_time,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
###(select devid, vd, remip, coalesce(nullifna(`user`), ipstr(`remip`)) as user_src, tunnelid, tunneltype, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `user`, duration, tunnelid, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ssl%' and coalesce(nullifna(`user`), ipstr(`remip`)) is not null group by devid, vd, user_src, remip, tunnelid, tunneltype order by bandwidth desc)### t where tunneltype='ssl-tunnel' group by user_src, remote_ip having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Dial-Up-IPSEC-Tunnels-By-Bandwidth |
Top dial up IPsec tunnels by bandwidth usage |
event |
select
vpn_name,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
###(select devid, vd, remip, vpn_trim(vpntunnel) as vpn_name, tunnelid, tunnelip, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select devid, vd, remip, tunnelid, tunnelip,vpntunnel, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ipsec%' and nullifna(vpntunnel) is not null and tunnelid!=0 group by devid, vd, remip, vpn_name, tunnelid, tunnelip order by bandwidth desc)### t where not (tunnelip is null or tunnelip='0.0.0.0') group by vpn_name having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Dial-Up-IPSEC-Users-By-Bandwidth |
Top dial up IPsec users by bandwidth usage |
event |
select
coalesce(
xauthuser_agg,
user_agg,
ipstr(`remip`)
) as user_src,
remip,
from_dtime(
min(s_time)
) as start_time,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
(
select
devid,
vd,
string_agg(
distinct xauthuser_agg,
& #039; ') as xauthuser_agg, string_agg(distinct user_agg, ' ') as user_agg, remip, tunnelid, min(s_time) as s_time, max(e_time) as e_time, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from ###(select devid, vd, remip, nullifna(`xauthuser`) as xauthuser_agg, nullifna(`user`) as user_agg, tunnelid, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ipsec%' and not (tunnelip is null or tunnelip='0.0.0.0') and tunnelid!=0 group by devid, vd, remip, xauthuser_agg, user_agg, tunnelid order by bandwidth desc)### t group by devid, vd, remip, tunnelid) tt where bandwidth>0 group by user_src, remip order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Dial-Up-IPSEC-Users-By-Duration |
Top dial up IPsec users by duration |
event |
select
coalesce(
xauthuser_agg,
user_agg,
ipstr(`remip`)
) as user_src,
from_dtime(
min(s_time)
) as start_time,
sum(duration) as duration,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
(
select
devid,
vd,
remip,
string_agg(
distinct xauthuser_agg,
& #039; ') as xauthuser_agg, string_agg(distinct user_agg, ' ') as user_agg, tunnelid, min(s_time) as s_time, max(e_time) as e_time, (case when min(s_time)=max(e_time) then max(max_duration) else max(max_duration)-min(min_duration) end) as duration, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from ###(select devid, vd, remip, nullifna(`xauthuser`) as xauthuser_agg, nullifna(`user`) as user_agg, tunnelid, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ipsec%' and not (tunnelip is null or tunnelip='0.0.0.0') and tunnelid!=0 group by devid, vd, remip, xauthuser_agg, user_agg, tunnelid order by bandwidth desc)### t group by devid, vd, remip, tunnelid) tt where bandwidth>0 group by user_src order by duration desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-SSL-VPN-Web-Mode-Users-By-Bandwidth |
Top SSL VPN web mode users by bandwidth usage |
event |
select
user_src,
remip as remote_ip,
from_dtime(
min(s_time)
) as start_time,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
###(select devid, vd, remip, coalesce(nullifna(`user`), ipstr(`remip`)) as user_src, tunnelid, tunneltype, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `user`, duration, tunnelid, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ssl%' and coalesce(nullifna(`user`), ipstr(`remip`)) is not null group by devid, vd, user_src, remip, tunnelid, tunneltype order by bandwidth desc)### t group by user_src, remote_ip having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-SSL-VPN-Web-Mode-Users-By-Duration |
Top SSL VPN web mode users by duration |
event |
select
user_src,
remip as remote_ip,
from_dtime(
min(s_time)
) as start_time,
sum(duration) as duration
from
(
select
devid,
vd,
user_src,
remip,
tunnelid,
min(s_time) as s_time,
(
case when min(s_time)= max(e_time) then max(max_duration) else max(max_duration)- min(min_duration) end
) as duration
from
###(select devid, vd, remip, coalesce(nullifna(`user`), ipstr(`remip`)) as user_src, tunnelid, tunneltype, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `user`, duration, tunnelid, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ssl%' and coalesce(nullifna(`user`), ipstr(`remip`)) is not null group by devid, vd, user_src, remip, tunnelid, tunneltype order by bandwidth desc)### t where tunneltype='ssl-web' group by devid, vd, user_src, remip, tunnelid) tt group by user_src, remote_ip order by duration desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-SSL-VPN-Users-By-Duration |
Top SSL VPN users by duration |
event |
select
user_src,
tunneltype,
sum(duration) as duration,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
(
select
devid,
vd,
remip,
user_src,
tunneltype,
tunnelid,
(
case when min(s_time)= max(e_time) then max(max_duration) else max(max_duration)- min(min_duration) end
) as duration,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out,
sum(bandwidth) as bandwidth
from
###(select devid, vd, remip, coalesce(nullifna(`user`), ipstr(`remip`)) as user_src, tunnelid, tunneltype, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `user`, duration, tunnelid, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ssl%' and coalesce(nullifna(`user`), ipstr(`remip`)) is not null group by devid, vd, user_src, remip, tunnelid, tunneltype order by bandwidth desc)### t group by devid, vd, remip, user_src, tunnelid, tunneltype) tt where bandwidth>0 group by user_src, tunneltype order by duration desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-User-Login-history |
VPN user login history |
event |
select
$flex_timescale(timestamp) as hodex,
sum(tunnelup) as total_num
from
(
select
timestamp,
devid,
vd,
remip,
tunnelid,
max(tunnelup) as tunnelup,
max(traffic_in) as traffic_in,
max(traffic_out) as traffic_out
from
###(select $flex_timestamp as timestamp, devid, vd, remip, tunnelid, max((case when action='tunnel-up' then 1 else 0 end)) as tunnelup, max(coalesce(sentbyte, 0)) as traffic_out, max(coalesce(rcvdbyte, 0)) as traffic_in from $log where $filter and subtype='vpn' and (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and action in ('tunnel-up', 'tunnel-stats', 'tunnel-down') and tunnelid is not null group by timestamp, devid, vd, remip, tunnelid /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t group by timestamp, devid, vd, remip, tunnelid having max(traffic_in)+max(traffic_out)>0) t group by hodex order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Failed-Login-Atempts |
VPN failed logins |
event |
select
f_user,
tunneltype,
sum(total_num) as total_num
from
###(select coalesce(nullifna(`xauthuser`), `user`) as f_user, tunneltype, count(*) as total_num from $log where $filter and subtype='vpn' and (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and action in ('ssl-login-fail', 'ipsec-login-fail') and coalesce(nullifna(`xauthuser`), nullifna(`user`)) is not null group by f_user, tunneltype)### t group by f_user, tunneltype order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Traffic-Usage-Trend-VPN-Summary |
VPN traffic usage trend |
event |
select
hodex,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out,
sum(ssl_traffic_bandwidth) as ssl_bandwidth,
sum(ipsec_traffic_bandwidth) as ipsec_bandwidth
from
(
select
$flex_timescale(timestamp) as hodex,
devid,
vd,
remip,
tunnelid,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out,
(
case when t_type like & #039;ssl%' then sum(bandwidth) else 0 end) as ssl_traffic_bandwidth, (case when t_type like 'ipsec%' then sum(bandwidth) else 0 end) as ipsec_traffic_bandwidth, min(s_time) as s_time, max(e_time) as e_time from ###(select $flex_timestamp as timestamp, devid, vd, remip, tunnelid, (case when tunneltype like 'ipsec%' then 'ipsec' else tunneltype end) as t_type, (case when action='tunnel-up' then 1 else 0 end) as tunnelup, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(nullifna(`xauthuser`), nullifna(`user`), ipstr(`remip`)) as f_user, tunneltype, action, count(*) as total_num from (select itime, dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and tunnelid is not null) t where (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') group by timestamp, devid, vd, remip, t_type, tunnelid, action, f_user, tunneltype /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t where action in ('tunnel-up','tunnel-stats', 'tunnel-down') and tunnelid is not null and tunnelid!=0 group by hodex, devid, t_type, vd, remip, tunnelid) tt group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-S2S-IPSEC-Tunnels-By-Bandwidth-and-Availability |
Top S2S IPsec tunnels by bandwidth usage and avail |
event |
select
vpntunnel,
tunneltype,
sum(traffic_out) as traffic_out,
sum(traffic_in) as traffic_in,
sum(bandwidth) as bandwidth,
sum(uptime) as uptime
from
(
select
vpntunnel,
tunneltype,
tunnelid,
devid,
vd,
sum(sent_end - sent_beg) as traffic_out,
sum(rcvd_end - rcvd_beg) as traffic_in,
sum(
sent_end - sent_beg + rcvd_end - rcvd_beg
) as bandwidth,
sum(duration_end - duration_beg) as uptime
from
###(select tunnelid, tunneltype, vpntunnel, devid, vd, min(coalesce(sentbyte, 0)) as sent_beg, max(coalesce(sentbyte, 0)) as sent_end, min(coalesce(rcvdbyte, 0)) as rcvd_beg, max(coalesce(rcvdbyte, 0)) as rcvd_end, min(coalesce(duration, 0)) as duration_beg, max(coalesce(duration, 0)) as duration_end from $log where $filter and subtype='vpn' and action='tunnel-stats' and tunneltype like 'ipsec%' and (tunnelip is null or tunnelip='0.0.0.0') and nullifna(`user`) is null and tunnelid is not null and tunnelid!=0 group by tunnelid, tunneltype, vpntunnel, devid, vd /*SkipSTART*/order by tunnelid/*SkipEND*/)### t group by vpntunnel, tunneltype, tunnelid, devid, vd order by bandwidth desc) t where bandwidth>0 group by vpntunnel, tunneltype order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Dialup-IPSEC-By-Bandwidth-and-Availability |
Top dialup IPsec users by bandwidth usage and avail |
event |
select
user_src,
remip,
sum(traffic_out) as traffic_out,
sum(traffic_in) as traffic_in,
sum(bandwidth) as bandwidth,
sum(uptime) as uptime
from
(
select
user_src,
remip,
tunnelid,
devid,
vd,
sum(sent_end - sent_beg) as traffic_out,
sum(rcvd_end - rcvd_beg) as traffic_in,
sum(
sent_end - sent_beg + rcvd_end - rcvd_beg
) as bandwidth,
sum(duration_end - duration_beg) as uptime
from
###(select tunnelid, coalesce(nullifna(`xauthuser`), nullifna(`user`), ipstr(`remip`)) as user_src, remip, devid, vd, min(coalesce(sentbyte, 0)) as sent_beg, max(coalesce(sentbyte, 0)) as sent_end, min(coalesce(rcvdbyte, 0)) as rcvd_beg, max(coalesce(rcvdbyte, 0)) as rcvd_end, min(coalesce(duration, 0)) as duration_beg, max(coalesce(duration, 0)) as duration_end from $log where $filter and subtype='vpn' and action='tunnel-stats' and tunneltype like 'ipsec%' and not (tunnelip is null or tunnelip='0.0.0.0') and tunnelid is not null and tunnelid!=0 group by tunnelid, user_src, remip, devid, vd /*SkipSTART*/order by tunnelid/*SkipEND*/)### t group by user_src, remip, tunnelid, devid, vd order by bandwidth desc) t where bandwidth>0 group by user_src, remip order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-SSL-Tunnel-Mode-By-Bandwidth-and-Availability |
Top SSL tunnel users by bandwidth usage and avail |
event |
select
user_src,
remote_ip,
sum(traffic_out) as traffic_out,
sum(traffic_in) as traffic_in,
sum(bandwidth) as bandwidth,
sum(uptime) as uptime
from
(
select
user_src,
remip as remote_ip,
tunnelid,
devid,
vd,
sum(sent_end - sent_beg) as traffic_out,
sum(rcvd_end - rcvd_beg) as traffic_in,
sum(
sent_end - sent_beg + rcvd_end - rcvd_beg
) as bandwidth,
sum(duration_end - duration_beg) as uptime
from
###(select tunnelid, tunneltype, coalesce(nullifna(`user`), ipstr(`remip`)) as user_src, remip, devid, vd, min(coalesce(sentbyte, 0)) as sent_beg, max(coalesce(sentbyte, 0)) as sent_end, min(coalesce(rcvdbyte, 0)) as rcvd_beg, max(coalesce(rcvdbyte, 0)) as rcvd_end, min(coalesce(duration, 0)) as duration_beg, max(coalesce(duration, 0)) as duration_end from $log where $filter and subtype='vpn' and action='tunnel-stats' and coalesce(nullifna(`user`), ipstr(`remip`)) is not null and tunnelid is not null group by tunnelid, tunneltype, user_src, remip, devid, vd /*SkipSTART*/order by tunnelid/*SkipEND*/)### t where tunneltype in ('ssl-tunnel', 'ssl') group by user_src, remote_ip, tunnelid, devid, vd order by bandwidth desc) t where bandwidth>0 group by user_src, remote_ip order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-SSL-Web-Mode-By-Bandwidth-and-Availability |
Top SSL web users by bandwidth usage and avail |
event |
select
user_src,
remote_ip,
sum(traffic_out) as traffic_out,
sum(traffic_in) as traffic_in,
sum(bandwidth) as bandwidth,
sum(uptime) as uptime
from
(
select
user_src,
remip as remote_ip,
tunnelid,
devid,
vd,
sum(sent_end - sent_beg) as traffic_out,
sum(rcvd_end - rcvd_beg) as traffic_in,
sum(
sent_end - sent_beg + rcvd_end - rcvd_beg
) as bandwidth,
sum(duration_end - duration_beg) as uptime
from
###(select tunnelid, tunneltype, coalesce(nullifna(`user`), ipstr(`remip`)) as user_src, remip, devid, vd, min(coalesce(sentbyte, 0)) as sent_beg, max(coalesce(sentbyte, 0)) as sent_end, min(coalesce(rcvdbyte, 0)) as rcvd_beg, max(coalesce(rcvdbyte, 0)) as rcvd_end, min(coalesce(duration, 0)) as duration_beg, max(coalesce(duration, 0)) as duration_end from $log where $filter and subtype='vpn' and action='tunnel-stats' and coalesce(nullifna(`user`), ipstr(`remip`)) is not null and tunnelid is not null group by tunnelid, tunneltype, user_src, remip, devid, vd /*SkipSTART*/order by tunnelid/*SkipEND*/)### t where tunneltype='ssl-web' group by user_src, remote_ip, tunnelid, devid, vd having sum(sent_end-sent_beg+rcvd_end-rcvd_beg)>0 order by bandwidth desc) t where bandwidth>0 group by user_src, remote_ip order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Admin-Login-Summary |
Event admin login summary |
event |
select
f_user,
ui,
sum(login) as total_num,
sum(login_duration) as total_duration,
sum(config_change) as total_change
from
(
select
`user` as f_user,
ui,
(
case when logid_to_int(logid)= 32001 then 1 else 0 end
) as login,
(
case when logid_to_int(logid)= 32003 then duration else 0 end
) as login_duration,
(
case when logid_to_int(logid)= 32003
and state is not null then 1 else 0 end
) as config_change
from
$log
where
$filter
and nullifna(`user`) is not null
and logid_to_int(logid) in (32001, 32003)
) t
group by
f_user,
ui
having
sum(login)+ sum(config_change)> 0
order by
total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Admin-Login-Summary-By-Date |
Event admin login summary by date |
event |
select $flex_timescale(timestamp) as dom, sum(total_num) as total_num, sum(total_change) as total_change from ###(select timestamp, sum(login) as total_num, sum(config_change) as total_change from (select $flex_timestamp as timestamp, (case when logid_to_int(logid)=32001 then 1 else 0 end) as login, (case when logid_to_int(logid)=32003 and state is not null then 1 else 0 end) as config_change from $log where $filter and logid_to_int(logid) in (32001, 32003)) t group by timestamp having sum(login)+sum(config_change)>0 /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t group by dom order by dom
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Admin-Failed-Login-Summary |
Event admin failed login summary |
event |
select `user` as f_user, ui, count(status) as total_failed from $log where $filter and nullifna(`user`) is not null and logid_to_int(logid) = 32002 group by ui, f_user order by total_failed desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
System-Summary-By-Severity |
Event system summary by severity |
event |
select
severity_tmp as severity,
sum(count) as total_num
from
###(select coalesce(nullifna(logdesc), msg) as msg_desc, (case when level in ('critical', 'alert', 'emergency') then 'Critical' when level='error' then 'High' when level='warning' then 'Medium' when level='notice' then 'Low' else 'Info' end) as severity_tmp, count(*) as count from $log where $filter and subtype='system' group by msg_desc, severity_tmp /*SkipSTART*/order by count desc/*SkipEND*/)### t group by severity order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
System-Summary-By-Date |
Event system summary by date |
event |
select
$flex_timescale(timestamp) as dom,
sum(critical) as critical,
sum(high) as high,
sum(medium) as medium
from
###(select $flex_timestamp as timestamp, sum(case when level in ('critical', 'alert', 'emergency') then 1 else 0 end) as critical, sum(case when level = 'error' then 1 else 0 end) as high, sum(case when level = 'warning' then 1 else 0 end) as medium from $log where $filter and subtype='system' group by timestamp /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t group by dom order by dom
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Important-System-Summary-By-Date |
Event system summary by date |
event |
select
$flex_timescale(timestamp) as dom,
sum(critical) as critical,
sum(high) as high,
sum(medium) as medium
from
###(select $flex_timestamp as timestamp, sum(case when level in ('critical', 'alert', 'emergency') then 1 else 0 end) as critical, sum(case when level = 'error' then 1 else 0 end) as high, sum(case when level = 'warning' then 1 else 0 end) as medium from $log where $filter and subtype='system' group by timestamp /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t group by dom order by dom
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
System-Critical-Severity-Events |
Event system critical severity events |
event |
select
msg_desc as msg,
severity_tmp as severity,
sum(count) as counts
from
###(select coalesce(nullifna(logdesc), msg) as msg_desc, (case when level in ('critical', 'alert', 'emergency') then 'Critical' when level='error' then 'High' when level='warning' then 'Medium' when level='notice' then 'Low' else 'Info' end) as severity_tmp, count(*) as count from $log where $filter and subtype='system' group by msg_desc, severity_tmp /*SkipSTART*/order by count desc/*SkipEND*/)### t where severity_tmp='Critical' group by msg, severity_tmp order by counts desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
System-High-Severity-Events |
Event system high severity events |
event |
select
msg_desc as msg,
severity_tmp as severity,
sum(count) as counts
from
###(select coalesce(nullifna(logdesc), msg) as msg_desc, (case when level in ('critical', 'alert', 'emergency') then 'Critical' when level='error' then 'High' when level='warning' then 'Medium' when level='notice' then 'Low' else 'Info' end) as severity_tmp, count(*) as count from $log where $filter and subtype='system' group by msg_desc, severity_tmp /*SkipSTART*/order by count desc/*SkipEND*/)### t where severity_tmp='High' group by msg, severity_tmp order by counts desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
System-Medium-Severity-Events |
Event system medium severity events |
event |
select
msg_desc as msg,
severity_tmp as severity,
sum(count) as counts
from
###(select coalesce(nullifna(logdesc), msg) as msg_desc, (case when level in ('critical', 'alert', 'emergency') then 'Critical' when level='error' then 'High' when level='warning' then 'Medium' when level='notice' then 'Low' else 'Info' end) as severity_tmp, count(*) as count from $log where $filter and subtype='system' group by msg_desc, severity_tmp /*SkipSTART*/order by count desc/*SkipEND*/)### t where severity_tmp='Medium' group by msg, severity_tmp order by counts desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Top-Traffic-Summary |
UTM drilldown traffic summary |
traffic |
select srcip, srcname from ###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, srcip, srcname, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter and (logflag&1>0) group by user_src, srcip, srcname order by bandwidth desc)### t where $filter-drilldown group by srcip, srcname
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Top-User-Destination |
UTM drilldown top user destination |
traffic |
select appid, app, dstip, sum(sessions) as sessions, sum(bandwidth) as bandwidth from ###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, appid, app, dstip, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter and (logflag&1>0) and dstip is not null and nullifna(app) is not null group by user_src, appid, app, dstip having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)### t where $filter-drilldown group by appid, app, dstip order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Email-Senders-Summary |
UTM drilldown email senders summary |
traffic |
select
sum(requests) as requests,
sum(bandwidth) as bandwidth
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, sender, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter and (logflag&1>0) and service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') group by user_src, sender order by requests desc)### t where $filter-drilldown
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Email-Receivers-Summary |
UTM drilldown email receivers summary |
traffic |
select
sum(requests) as requests,
sum(bandwidth) as bandwidth
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, recipient, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter and (logflag&1>0) and recipient is not null and service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp') group by user_src, recipient order by requests desc)### t where $filter-drilldown
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Top-Email-Recipients-By-Bandwidth |
UTM drilldown top email recipients |
traffic |
select
recipient,
sum(bandwidth) as bandwidth
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, recipient, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter and (logflag&1>0) and recipient is not null and service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp') group by user_src, recipient order by requests desc)### t where $filter-drilldown group by recipient having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Top-Email-Senders-By-Bandwidth |
UTM drilldown top email senders |
traffic |
select
sender,
sum(bandwidth) as bandwidth
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, sender, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter and (logflag&1>0) and service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') group by user_src, sender order by requests desc)### t where $filter-drilldown and sender is not null group by sender having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Top-Allowed-Websites-By-Bandwidth |
UTM drilldown top allowed web sites by bandwidth |
traffic |
select
appid,
hostname,
sum(bandwidth) as bandwidth
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, appid, hostname, (case when utmaction in ('block', 'blocked') then 1 else 0 end) as blocked, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and (logflag&1>0) and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) and hostname is not null group by user_src, appid, hostname, blocked order by bandwidth desc)### t where $filter-drilldown and blocked=0 group by appid, hostname order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Top-Blocked-Websites-By-Request |
UTM drilldown top blocked web sites by request |
webfilter |
select appid, hostname, sum(requests) as requests from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, 0 as appid, hostname, (case when action='blocked' then 1 else 0 end) as blocked, count(*) as requests from $log where $filter and hostname is not null group by user_src, appid, hostname, blocked order by requests desc)### t where $filter-drilldown and blocked=1 group by appid, hostname order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Top-Virus-By-Name |
UTM drilldown top virus |
virus |
select virus, sum(totalnum) as totalnum from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, virus, count(*) as totalnum from $log where $filter and nullifna(virus) is not null group by user_src, virus order by totalnum desc)### t where $filter-drilldown group by virus order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Top-Attacks |
UTM drilldown top attacks by name |
attack |
select attack, sum(attack_count) as attack_count from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, attack, count(*) as attack_count from $log where $filter and nullifna(attack) is not null group by user_src, attack order by attack_count desc)### t where $filter-drilldown group by attack order by attack_count desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Top-Vulnerability |
UTM drilldown top vulnerability by name |
netscan |
select vuln, sum(totalnum) as totalnum from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, vuln, count(*) as totalnum from $log where $filter and action='vuln-detection' and vuln is not null group by user_src, vuln order by totalnum desc)### t where $filter-drilldown group by vuln order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Top-App-By-Bandwidth |
UTM drilldown top applications by bandwidth usage |
traffic |
select appid, app, sum(bandwidth) as bandwidth from ###(select user_src, appid, app, appcat, apprisk, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by user_src, appid, app, appcat, apprisk /*SkipSTART*/order by sessions desc, bandwidth desc/*SkipEND*/)### t where $filter-drilldown group by appid, app having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
utm-drilldown-Top-App-By-Sessions |
UTM drilldown top applications by session count |
traffic |
select appid, app, sum(sessions) as sessions from ###(select user_src, appid, app, appcat, apprisk, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by user_src, appid, app, appcat, apprisk /*SkipSTART*/order by sessions desc, bandwidth desc/*SkipEND*/)### t where $filter-drilldown group by appid, app order by sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top5-Users-By-Bandwidth |
UTM drilldown top users by bandwidth usage |
traffic |
select
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as dldn_user,
count(*) as session,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth,
sum(
coalesce(sentbyte, 0)
) as traffic_out,
sum(
coalesce(rcvdbyte, 0)
) as traffic_in
from
$log
where
$filter
and (
logflag&1>0
)
group by
dldn_user
having
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
)> 0
order by
bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Top-App-By-Bandwidth-Sessions |
Top applications by bandwidth usage |
traffic |
select app_group_name(app) as app_group, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(sessions) as sessions from ###(select appid, app, appcat, apprisk, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by appid, app, appcat, apprisk /*SkipSTART*/order by sessions desc, bandwidth desc/*SkipEND*/)### t group by app_group having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Category-By-Bandwidth |
Application Risk Application Usage by Category |
traffic |
select appcat, sum(bandwidth) as bandwidth from ###(select app, appcat, user_src, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by app, appcat, user_src /*SkipSTART*/order by bandwidth desc, sessions desc/*SkipEND*/)### t group by appcat order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Top-Users-By-Bandwidth-Sessions |
Bandwidth application top users by bandwidth usage |
traffic |
select user_src, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(sessions) as sessions from ###(select user_src, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by user_src order by sessions desc, bandwidth desc)### t group by user_src having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Traffic-By-Active-User-Number |
Bandwidth application traffic by active user number |
traffic |
select $flex_timescale(timestamp) as hodex, count(distinct user_src) as total_user from ###(select $flex_timestamp as timestamp, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) AS sessions from $log where $filter and (logflag&(1|32)>0) group by timestamp, user_src order by sessions desc)### t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Top-Dest-By-Bandwidth-Sessions |
Bandwidth application top dest by bandwidth usage sessions |
traffic |
select
coalesce(
nullifna(
root_domain(hostname)
),
ipstr(`dstip`)
) as dst,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out,
sum(bandwidth) as bandwidth,
sum(sessions) as sessions
from
###(select hostname, dstip, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by hostname, dstip order by sessions desc, bandwidth desc)### t group by dst order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Top-Policies-By-Bandwidth-Sessions |
Top policies by bandwidth and sessions |
traffic |
select
coalesce(
pol.name,
cast(policyid as text)
) as polid,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out,
sum(sessions) as sessions
from
###(select policyid, poluuid, sum(coalesce(rcvddelta, rcvdbyte, 0) + coalesce(sentdelta, sentbyte, 0)) as bandwidth, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log where $filter and (logflag&(1|32)>0) group by policyid, poluuid order by bandwidth desc)### t1 left join $ADOMTBL_PLHD_POLINFO pol on t1.poluuid=pol.uuid group by polid order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Traffic-Statistics |
Bandwidth application traffic statistics |
traffic |
drop
table if exists rpt_tmptbl_1; create temporary table rpt_tmptbl_1(
total_sessions varchar(255),
total_bandwidth varchar(255),
ave_session varchar(255),
ave_bandwidth varchar(255),
active_date varchar(255),
total_users varchar(255),
total_app varchar(255),
total_dest varchar(255)
); insert into rpt_tmptbl_1 (
total_sessions, total_bandwidth,
ave_session, ave_bandwidth
)
select
format_numeric_no_decimal(
sum(sessions)
) as total_sessions,
bandwidth_unit(
sum(bandwidth)
) as total_bandwidth,
format_numeric_no_decimal(
cast(
sum(sessions)/ $days_num as decimal(18, 0)
)
) as ave_session,
bandwidth_unit(
cast(
sum(bandwidth)/ $days_num as decimal(18, 0)
)
) as ave_bandwidth
from
###(select appid, app, appcat, apprisk, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by appid, app, appcat, apprisk /*SkipSTART*/order by sessions desc, bandwidth desc/*SkipEND*/)### t; update rpt_tmptbl_1 set active_date=t1.dom from (select dom, sum(sessions) as sessions from ###(select $DAY_OF_MONTH as dom, count(*) as sessions from $log where $filter and (logflag&(1|32)>0) group by dom order by sessions desc)### t group by dom order by sessions desc limit 1) as t1; update rpt_tmptbl_1 set total_users=t2.totalnum from (select format_numeric_no_decimal(count(distinct(user_src))) as totalnum from ###(select user_src, sum(sessions) as count from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by user_src order by count desc)### t) as t2; update rpt_tmptbl_1 set total_app=t3.totalnum from (select format_numeric_no_decimal(count(distinct(app_grp))) as totalnum from ###(select app_group_name(app) as app_grp, sum(sessions) as count from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by app_grp order by count desc)### t) as t3; update rpt_tmptbl_1 set total_dest=t4.totalnum from (select format_numeric_no_decimal(count(distinct(dstip))) as totalnum from ###(select dstip, sum(sessions) as count from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t where dstip is not null group by dstip order by count desc)### t ) as t4; select 'Total Sessions' as summary, total_sessions as stats from rpt_tmptbl_1 union all select 'Total Bytes Transferred' as summary, total_bandwidth as stats from rpt_tmptbl_1 union all select 'Most Active Date By Sessions' as summary, active_date as stats from rpt_tmptbl_1 union all select 'Total Users' as summary, total_users as stats from rpt_tmptbl_1 union all select 'Total Applications' as summary, total_app as stats from rpt_tmptbl_1 union all select 'Total Destinations' as summary, total_dest as stats from rpt_tmptbl_1 union all select 'Average Sessions Per Day' as summary, ave_session as stats from rpt_tmptbl_1 union all select 'Average Bytes Per Day' as summary, ave_bandwidth as stats from rpt_tmptbl_1
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Bandwidth-Usage-Summary |
Application Traffic Usage Timeline |
traffic |
select $flex_timescale(timestamp) as hodex, sum(traffic_out) as traffic_out, sum(traffic_in) as traffic_in from ###(select $flex_timestamp as timestamp, appid, app, appcat, apprisk, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, appid, app, appcat, apprisk /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t where $filter-drilldown group by hodex having sum(bandwidth)>0 order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Sessions-Summary |
Number of session timeline |
traffic |
select $flex_timescale(timestamp) as hodex, sum(sessions) as sessions from ###(select timestamp, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_bndwdth_sess*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, appcat, apprisk, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, count(*) as sessions, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in from $log-traffic where $filter and (logflag&(1|32)>0) group by timestamp, dvid, srcip, dstip, epid, euid, appcat, apprisk, user_src, service /*SkipSTART*/order by timestamp desc/*SkipEND*/)base### base_query group by timestamp order by sessions desc)### t where $filter-drilldown group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Top-App-Bandwidth-Usage |
Top Application by Bandwidth |
traffic |
select app, appcat, count(distinct user_src) as num_user, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###(select app, appcat, user_src, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by app, appcat, user_src /*SkipSTART*/order by bandwidth desc, sessions desc/*SkipEND*/)### t where $filter-drilldown group by app, appcat having sum(bandwidth) > 0 order by bandwidth desc, sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Top-App-Category-By-Bandwidth |
Application Risk Application Usage by App and Category |
traffic |
select appcat, app, sum(bandwidth) as bandwidth from ###(select app, appcat, user_src, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by app, appcat, user_src /*SkipSTART*/order by bandwidth desc, sessions desc/*SkipEND*/)### t group by appcat, app order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Active-User-Count-Timeline |
Bandwidth application traffic by active user number |
traffic |
select $flex_timescale(timestamp) as hodex, count(distinct user_src) as total_user from ###(select $flex_timestamp as timestamp, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) AS sessions from $log where $filter and (logflag&(1|32)>0) group by timestamp, user_src order by sessions desc)### t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Top-Dest-By-Bandwidth |
Bandwidth application top dest by bandwidth usage sessions |
traffic |
select
coalesce(
nullifna(
root_domain(hostname)
),
ipstr(`dstip`)
) as dst,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out,
sum(bandwidth) as bandwidth,
sum(sessions) as sessions
from
###(select hostname, dstip, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by hostname, dstip order by sessions desc, bandwidth desc)### t group by dst order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Top-Dest-By-Session |
Bandwidth application top dest by bandwidth usage sessions |
traffic |
select
coalesce(
nullifna(
root_domain(hostname)
),
ipstr(`dstip`)
) as dst,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out,
sum(bandwidth) as bandwidth,
sum(sessions) as sessions
from
###(select hostname, dstip, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by hostname, dstip order by sessions desc, bandwidth desc)### t group by dst order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Top-Bandwidth-Users |
Bandwidth application top users by bandwidth usage |
traffic |
select user_src, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(sessions) as sessions from ###(select user_src, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by user_src order by sessions desc, bandwidth desc)### t group by user_src having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
bandwidth-app-Top-Session-Users |
Bandwidth application top users by bandwidth usage |
traffic |
select user_src, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(sessions) as sessions from ###(select user_src, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by user_src order by sessions desc, bandwidth desc)### t group by user_src having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Score-Summary-For-All-Users-Devices |
Reputation score summary for all users devices |
traffic |
select $flex_timescale(timestamp) as hodex, sum(scores) as scores from ###(select $flex_timestamp as timestamp, sum(crscore%65536) as scores, count(*) as totalnum from $log where $filter and (logflag&1>0) and crscore is not null group by timestamp having sum(crscore%65536)>0 order by timestamp desc)### t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Number-Of-Incidents-For-All-Users-Devices |
Reputation number of incidents for all users devices |
traffic |
select $flex_timescale(timestamp) as hodex, sum(scores) as scores, sum(totalnum) as totalnum from ###(select $flex_timestamp as timestamp, sum(crscore%65536) as scores, count(*) as totalnum from $log where $filter and (logflag&1>0) and crscore is not null group by timestamp having sum(crscore%65536)>0 order by timestamp desc)### t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Users-By-Reputation-Scores |
Reputation top users by scores |
traffic |
select
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
sum(crscore % 65536) as scores
from
$log
where
$filter
and (
logflag&1>0
)
and crscore is not null
group by
user_src
having
sum(crscore % 65536)> 0
order by
scores desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Devices-By-Reputation-Scores |
Reputation top devices by scores |
traffic |
select
max(
get_devtype(srcswversion, osname, devtype)
) as devtype_new,
coalesce(
nullifna(`srcname`),
nullifna(`srcmac`),
ipstr(`srcip`)
) as dev_src,
sum(crscore % 65536) as scores
from
$log
where
$filter
and (
logflag&1>0
)
and crscore is not null
group by
dev_src
having
sum(crscore % 65536)> 0
order by
scores desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Users-With-Increased-Scores |
Reputation top users with increased scores |
traffic |
drop table if exists rpt_tmptbl_1; drop table if exists rpt_tmptbl_2; create temporary table rpt_tmptbl_1 as select f_user, sum(sum_rp_score) as sum_rp_score from ###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as f_user, sum(crscore%65536) as sum_rp_score from $log where $pre_period $filter and (logflag&1>0) and crscore is not null group by f_user having sum(crscore%65536)>0 order by sum_rp_score desc)### t group by f_user; create temporary table rpt_tmptbl_2 as select f_user, sum(sum_rp_score) as sum_rp_score from ###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as f_user, sum(crscore%65536) as sum_rp_score from $log where $filter and (logflag&1>0) and crscore is not null group by f_user having sum(crscore%65536)>0 order by sum_rp_score desc)### t group by f_user; select t1.f_user, sum(t1.sum_rp_score) as t1_sum_score, sum(t2.sum_rp_score) as t2_sum_score, (sum(t2.sum_rp_score)-sum(t1.sum_rp_score)) as delta from rpt_tmptbl_1 as t1 inner join rpt_tmptbl_2 as t2 on t1.f_user=t2.f_user where t2.sum_rp_score > t1.sum_rp_score group by t1.f_user order by delta desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Devices-With-Increased-Scores |
Reputation top devices with increased scores |
traffic |
drop table if exists rpt_tmptbl_1; drop table if exists rpt_tmptbl_2; create temporary table rpt_tmptbl_1 as select f_device, devtype_new, sum(sum_rp_score) as sum_rp_score from ###(select coalesce(nullifna(`srcname`),nullifna(`srcmac`), ipstr(`srcip`)) as f_device, get_devtype(srcswversion, osname, devtype) as devtype_new, sum(crscore%65536) as sum_rp_score from $log where $pre_period $filter and (logflag&1>0) and crscore is not null group by f_device, devtype_new having sum(crscore%65536)>0 order by sum_rp_score desc)### t group by f_device, devtype_new; create temporary table rpt_tmptbl_2 as select f_device, devtype_new, sum(sum_rp_score) as sum_rp_score from ###(select coalesce(nullifna(`srcname`),nullifna(`srcmac`), ipstr(`srcip`)) as f_device, get_devtype(srcswversion, osname, devtype) as devtype_new, sum(crscore%65536) as sum_rp_score from $log where $filter and (logflag&1>0) and crscore is not null group by f_device, devtype_new having sum(crscore%65536)>0 order by sum_rp_score desc)### t group by f_device, devtype_new; select t1.f_device, t1.devtype_new , sum(t1.sum_rp_score) as t1_sum_score, sum(t2.sum_rp_score) as t2_sum_score, (sum(t2.sum_rp_score)-sum(t1.sum_rp_score)) as delta from rpt_tmptbl_1 as t1 inner join rpt_tmptbl_2 as t2 on t1.f_device=t2.f_device and t1.devtype_new=t2.devtype_new where t2.sum_rp_score > t1.sum_rp_score group by t1.f_device, t1.devtype_new order by delta desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Attacks-By-Severity |
Threat attacks by severity |
attack |
select
(
case when severity =& #039;critical' then 'Critical' when severity='high' then 'High' when severity='medium' then 'Medium' when severity='low' then 'Low' when severity='info' then 'Info' end) as severity, count(*) as totalnum from $log where $filter group by severity order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Attacks-Detected |
Threat top attacks detected |
attack |
select attack, attackid, cve, severity, sum(attack_count) as attack_count from ###(select attack, attackid, t1.severity, cve, (case when t1.severity = 'critical' then 1 when t1.severity = 'high' then 2 when t1.severity = 'medium' then 3 when t1.severity = 'low' then 4 else 5 end) as severity_level, count(*) as attack_count from $log t1 left join (select name, cve, vuln_type from ips_mdata) t2 on t1.attack=t2.name where $filter and nullifna(attack) is not null group by attack, attackid, t1.severity, severity_level, cve /*SkipSTART*/order by severity_level, attack_count desc/*SkipEND*/)### t group by attack, attackid, severity, severity_level, cve order by severity_level, attack_count desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Attacks-Blocked |
Threat top attacks blocked |
attack |
select
attack,
count(*) as attack_count
from
$log
where
$filter
and nullifna(attack) is not null
and action not in (
& #039;detected', 'pass_session') group by attack order by attack_count desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Virus-Source |
Threat top virus source |
virus |
select source, hostname, sum(totalnum) as totalnum from ###(select source, ipstr(`victim`) as hostname, sum(totalnum) as totalnum from ( select (CASE WHEN direction='incoming' THEN dstip ELSE srcip END) as source, (CASE WHEN direction='incoming' THEN srcip ELSE dstip END) as victim, count(*) as totalnum from $log where $filter and nullifna(virus) is not null group by source, victim ) t group by source, hostname /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t group by source, hostname order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Intrusion-in-Last-7-Days |
Threat intrusion timeline |
attack |
select $flex_timescale(timestamp) as hodex, sum(totalnum) as totalnum from ###(select $flex_timestamp as timestamp, count(*) as totalnum from $log where $filter group by timestamp /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Virus-Time-Line |
Threat virus timeline |
virus |
select $flex_datetime(timestamp) as hodex, sum(totalnum) as totalnum from ###(select $flex_timestamp as timestamp, count(*) as totalnum from $log where $filter and nullifna(virus) is not null group by timestamp /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Spyware-Victims |
Threat top spyware victims |
virus |
select user_src, sum(totalnum) as totalnum from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, virus, count(*) as totalnum from $log where $filter group by user_src, virus /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t where virus like 'Riskware%' group by user_src order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Spyware-by-Name |
Threat top spyware by name |
virus |
select virus, max(virusid_s) as virusid, sum(totalnum) as totalnum from ###(select filename, analyticscksum, service, fsaverdict, dtype, coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, virus, virusid_to_str(virusid, eventtype) as virusid_s, count(*) as totalnum from $log where $filter group by filename, analyticscksum, service, fsaverdict, dtype, user_src, virus, virusid_s /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t where virus like 'Riskware%' group by virus order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Spyware-Source |
Threat top spyware source |
traffic |
select srcip, hostname, sum(totalnum) as totalnum from ###(select srcip, hostname, virus, count(*) as totalnum from $log where $filter and (logflag&1>0) group by srcip, hostname, virus order by totalnum desc)### t where virus like 'Riskware%' group by srcip, hostname order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Spyware-Time-Line |
Threat spyware timeline |
virus |
select $flex_timescale(timestamp) as hodex, sum(totalnum) as totalnum from ###(select $flex_timestamp as timestamp, virus, count(*) as totalnum from $log where $filter group by timestamp, virus /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t where virus like 'Riskware%' group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Adware-Victims |
Threat top adware victims |
virus |
select user_src, sum(totalnum) as totalnum from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, virus, count(*) as totalnum from $log where $filter group by user_src, virus /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t where virus like 'Adware%' group by user_src order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Adware-by-Name |
Threat top adware by name |
virus |
select virus, max(virusid_s) as virusid, sum(totalnum) as totalnum from ###(select filename, analyticscksum, service, fsaverdict, dtype, coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, virus, virusid_to_str(virusid, eventtype) as virusid_s, count(*) as totalnum from $log where $filter group by filename, analyticscksum, service, fsaverdict, dtype, user_src, virus, virusid_s /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t where virus like 'Adware%' group by virus order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Adware-Source |
Threat top adware source |
traffic |
select srcip, hostname, sum(totalnum) as totalnum from ###(select srcip, hostname, virus, count(*) as totalnum from $log where $filter and (logflag&1>0) group by srcip, hostname, virus order by totalnum desc)### t where virus like 'Adware%' group by srcip, hostname order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Adware-Time-Line |
Threat adware timeline |
virus |
select $flex_timescale(timestamp) as hodex, sum(totalnum) as totalnum from ###(select $flex_timestamp as timestamp, virus, count(*) as totalnum from $log where $filter group by timestamp, virus /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t where virus like 'Adware%' group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Intrusions-Timeline-By-Severity |
Threat intrusions timeline by severity |
attack |
select
$flex_timescale(timestamp) as timescale,
sum(critical) as critical,
sum(high) as high,
sum(medium) as medium,
sum(low) as low,
sum(info) as info
from
###(select $flex_timestamp as timestamp, sum(case when severity = 'critical' then 1 else 0 end) as critical, sum(case when severity = 'high' then 1 else 0 end) as high, sum(case when severity = 'medium' then 1 else 0 end) as medium, sum(case when severity in ('notice', 'low') then 1 else 0 end) as low, sum(case when severity = 'info' or severity = 'debug' then 1 else 0 end) as info from $log where $filter group by timestamp /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t group by timescale order by timescale
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Important-Intrusions-Timeline-By-Severity |
Threat intrusions timeline by severity |
attack |
select
$flex_timescale(timestamp) as timescale,
sum(critical) as critical,
sum(high) as high,
sum(medium) as medium,
sum(low) as low,
sum(info) as info
from
###(select $flex_timestamp as timestamp, sum(case when severity = 'critical' then 1 else 0 end) as critical, sum(case when severity = 'high' then 1 else 0 end) as high, sum(case when severity = 'medium' then 1 else 0 end) as medium, sum(case when severity in ('notice', 'low') then 1 else 0 end) as low, sum(case when severity = 'info' or severity = 'debug' then 1 else 0 end) as info from $log where $filter group by timestamp /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t group by timescale order by timescale
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Intrusions-By-Types |
Threat top intrusions by types |
attack |
select
vuln_type,
count(*) as totalnum
from
$log t1
left join (
select
name,
cve,
vuln_type
from
ips_mdata
) t2 on t1.attack = t2.name
where
$filter
and vuln_type is not null
group by
vuln_type
order by
totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Critical-Severity-Intrusions |
Threat critical severity intrusions |
attack |
select
attack,
attackid,
cve,
vuln_type,
count(*) as totalnum
from
$log t1
left join (
select
name,
cve,
vuln_type
from
ips_mdata
) t2 on t1.attack = t2.name
where
$filter
and t1.severity = & #039;critical' and nullifna(attack) is not null group by attack, attackid, cve, vuln_type order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
High-Severity-Intrusions |
Threat high severity intrusions |
attack |
select
attack,
attackid,
vuln_type,
cve,
count(*) as totalnum
from
$log t1
left join (
select
name,
cve,
vuln_type
from
ips_mdata
) t2 on t1.attack = t2.name
where
$filter
and t1.severity =& #039;high' and nullifna(attack) is not null group by attack, attackid, vuln_type, cve order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Medium-Severity-Intrusions |
Threat medium severity intrusions |
attack |
select
attack,
vuln_type,
cve,
count(*) as totalnum
from
$log t1
left join (
select
name,
cve,
vuln_type
from
ips_mdata
) t2 on t1.attack = t2.name
where
$filter
and t1.severity =& #039;medium' and nullifna(attack) is not null group by attack, vuln_type, cve order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Intrusion-Victims |
Threat top intrusion victims |
attack |
select
victim,
sum(cri_num) as critical,
sum(high_num) as high,
sum(med_num) as medium,
sum(cri_num + high_num + med_num) as totalnum
from
###(select (CASE WHEN direction='incoming' THEN srcip ELSE dstip END) as victim, sum((case when severity='critical' then 1 else 0 end)) as cri_num, sum(case when severity='high' then 1 else 0 end) as high_num, sum(case when severity='medium' then 1 else 0 end) as med_num from $log where $filter and severity in ('critical', 'high', 'medium') group by victim)### t group by victim order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Intrusion-Sources |
Threat top intrusion sources |
attack |
select
source,
sum(cri_num) as critical,
sum(high_num) as high,
sum(med_num) as medium,
sum(cri_num + high_num + med_num) as totalnum
from
###(select (CASE WHEN direction='incoming' THEN dstip ELSE srcip END) as source, sum(case when severity='critical' then 1 else 0 end) as cri_num, sum(case when severity='high' then 1 else 0 end) as high_num, sum(case when severity='medium' then 1 else 0 end) as med_num from $log where $filter and severity in ('critical', 'high', 'medium') group by source)### t group by source order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Blocked-Intrusions |
Threat top blocked intrusions |
attack |
select
attack,
attackid,
(
case when severity =& #039;critical' then 'Critical' when severity='high' then 'High' when severity='medium' then 'Medium' when severity='low' then 'Low' when severity='info' then 'Info' end) as severity_name, sum(totalnum) as totalnum, vuln_type, (case when severity='critical' then 0 when severity='high' then 1 when severity='medium' then 2 when severity='low' then 3 when severity='info' then 4 else 5 end) as severity_number from ###(select attack, attackid, t1.severity, count(*) as totalnum, vuln_type, action from $log t1 left join (select name, cve, vuln_type from ips_mdata) t2 on t1.attack=t2.name where $filter and nullifna(attack) is not null group by attack, attackid, t1.severity, vuln_type, action order by totalnum desc)### t where action not in ('detected', 'pass_session') group by attack, attackid, severity, vuln_type order by severity_number, totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Monitored-Intrusions |
Threat top monitored intrusions |
attack |
select
attack,
attackid,
(
case when severity =& #039;critical' then 'Critical' when severity='high' then 'High' when severity='medium' then 'Medium' when severity='low' then 'Low' when severity='info' then 'Info' end) as severity_name, sum(totalnum) as totalnum, vuln_type, (case when severity='critical' then 0 when severity='high' then 1 when severity='medium' then 2 when severity='low' then 3 when severity='info' then 4 else 5 end) as severity_number from ###(select attack, attackid, t1.severity, count(*) as totalnum, vuln_type, action from $log t1 left join (select name, cve, vuln_type from ips_mdata) t2 on t1.attack=t2.name where $filter and nullifna(attack) is not null group by attack, attackid, t1.severity, vuln_type, action order by totalnum desc)### t where action in ('detected', 'pass_session') group by attack, attackid, severity, vuln_type order by severity_number, totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Attacks-Over-HTTP-HTTPs |
Threat attacks over HTTP HTTPs |
attack |
select
attack,
attackid,
(
case when severity =& #039;critical' then 'Critical' when severity='high' then 'High' when severity='medium' then 'Medium' when severity='low' then 'Low' when severity='info' then 'Info' end) as severity, count(*) as totalnum, (case when severity='critical' then 0 when severity='high' then 1 when severity='medium' then 2 when severity='low' then 3 when severity='info' then 4 else 5 end) as severity_number from $log where $filter and severity in ('critical', 'high', 'medium') and upper(service) in ('HTTP', 'HTTPS') group by attack, attackid, severity, severity_number order by severity_number, totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
default-AP-Detection-Summary-by-Status-OffWire |
Default access point detection summary by status off-wire |
event |
select
(
case apstatus when 1 then & #039;rogue' when 2 then 'accepted' when 3 then 'suppressed' else 'others' end) as ap_full_status, count(*) as totalnum from (select apstatus, bssid, ssid from ###(select apstatus, bssid, ssid, onwire, count(*) as subtotal from $log where $filter and apstatus is not null and apstatus!=0 and bssid is not null and logid_to_int(logid) in (43527, 43521, 43525, 43563, 43564, 43565, 43566, 43569, 43570, 43571, 43582, 43583, 43584, 43585) group by apstatus, bssid, ssid, onwire order by subtotal desc)### t where onwire='no' group by apstatus, bssid, ssid) t group by ap_full_status order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
default-AP-Detection-Summary-by-Status-OffWire_table |
Default access point detection summary by status off-wire |
event |
select
(
case apstatus when 1 then & #039;rogue' when 2 then 'accepted' when 3 then 'suppressed' else 'others' end) as ap_full_status, count(*) as totalnum from (select apstatus, bssid, ssid from ###(select apstatus, bssid, ssid, onwire, count(*) as subtotal from $log where $filter and apstatus is not null and apstatus!=0 and bssid is not null and logid_to_int(logid) in (43527, 43521, 43525, 43563, 43564, 43565, 43566, 43569, 43570, 43571, 43582, 43583, 43584, 43585) group by apstatus, bssid, ssid, onwire order by subtotal desc)### t where onwire='no' group by apstatus, bssid, ssid) t group by ap_full_status order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
default-AP-Detection-Summary-by-Status-OnWire |
Default access point detection summary by status on-wire |
event |
select
(
case apstatus when 1 then & #039;rogue' when 2 then 'accepted' when 3 then 'suppressed' else 'others' end) as ap_full_status, count(*) as totalnum from (select apstatus, bssid, ssid from ###(select apstatus, bssid, ssid, onwire, count(*) as subtotal from $log where $filter and apstatus is not null and apstatus!=0 and bssid is not null and logid_to_int(logid) in (43527, 43521, 43525, 43563, 43564, 43565, 43566, 43569, 43570, 43571, 43582, 43583, 43584, 43585) group by apstatus, bssid, ssid, onwire order by subtotal desc)### t where onwire='yes' group by apstatus, bssid, ssid) t group by ap_full_status order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
default-AP-Detection-Summary-by-Status-OnWire_table |
Default access point detection summary by status on-wire |
event |
select
(
case apstatus when 1 then & #039;rogue' when 2 then 'accepted' when 3 then 'suppressed' else 'others' end) as ap_full_status, count(*) as totalnum from (select apstatus, bssid, ssid from ###(select apstatus, bssid, ssid, onwire, count(*) as subtotal from $log where $filter and apstatus is not null and apstatus!=0 and bssid is not null and logid_to_int(logid) in (43527, 43521, 43525, 43563, 43564, 43565, 43566, 43569, 43570, 43571, 43582, 43583, 43584, 43585) group by apstatus, bssid, ssid, onwire order by subtotal desc)### t where onwire='yes' group by apstatus, bssid, ssid) t group by ap_full_status order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
default-Managed-AP-Summary |
Default managed access point summary |
event |
select
(
case when (
action like & #039;%join%' and logid_to_int(logid) in (43522, 43551)) then 'Authorized' else 'Unauthorized' end) as ap_status, count(*) as totalnum from $log where $filter and logid_to_int(logid) in (43522, 43551) group by ap_status order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
default-Managed-AP-Summary_table |
Default managed access point summary |
event |
select
(
case when (
action like & #039;%join%' and logid_to_int(logid) in (43522, 43551)) then 'Authorized' else 'Unauthorized' end) as ap_status, count(*) as totalnum from $log where $filter and logid_to_int(logid) in (43522, 43551) group by ap_status order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
default-Unclassified-AP-Summary |
Default unclassified access point summary |
event |
select
(
case onwire when & #039;no' then 'off-wire' when 'yes' then 'on-wire' else 'others' end) as ap_status, count(*) as totalnum from ###(select onwire, ssid, bssid, count(*) as subtotal from $log where $filter and apstatus=0 and bssid is not null and logid_to_int(logid) in (43521, 43525, 43527, 43563, 43564, 43565, 43566, 43569, 43570, 43571, 43582, 43583, 43584, 43585) group by onwire, ssid, bssid order by subtotal desc)### t group by ap_status order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
default-Unclassified-AP-Summary_table |
Default unclassified access point summary |
event |
select
(
case onwire when & #039;no' then 'off-wire' when 'yes' then 'on-wire' else 'others' end) as ap_status, count(*) as totalnum from ###(select onwire, ssid, bssid, count(*) as subtotal from $log where $filter and apstatus=0 and bssid is not null and logid_to_int(logid) in (43521, 43525, 43527, 43563, 43564, 43565, 43566, 43569, 43570, 43571, 43582, 43583, 43584, 43585) group by onwire, ssid, bssid order by subtotal desc)### t group by ap_status order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
default-selected-AP-Details-OffWire |
Default selected access point details off-wire |
event |
select
(
case apstatus when 0 then & #039;unclassified' when 1 then 'rogue' when 2 then 'accepted' when 3 then 'suppressed' else 'others' end) as ap_full_status, devid, vd, ssid, bssid, manuf, rssi, channel, radioband, from_dtime(min(first_seen)) as first_seen, from_dtime(max(last_seen)) as last_seen, detectionmethod, itime, onwire as on_wire from ###(select apstatus, devid, vd, ssid, bssid, manuf, rssi, channel, radioband, min(dtime) as first_seen, max(dtime) as last_seen, detectionmethod, itime, onwire from $log where $filter and apstatus is not null and bssid is not null and logid_to_int(logid) in (43521, 43563, 43564, 43565, 43566, 43569, 43570, 43571) group by apstatus, devid, vd, ssid, bssid, manuf, rssi, channel, radioband, detectionmethod, itime, onwire order by itime desc)### t where onwire='no' group by ap_full_status, devid, vd, ssid, bssid, manuf, rssi, channel, radioband, detectionmethod, itime, onwire, apstatus order by itime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
default-selected-AP-Details-OnWire |
Default selected access point details on-wire |
event |
select
(
case apstatus when 0 then & #039;unclassified' when 1 then 'rogue' when 2 then 'accepted' when 3 then 'suppressed' else 'others' end) as ap_full_status, devid, vd, ssid, bssid, manuf, rssi, channel, radioband, from_dtime(min(first_seen)) as first_seen, from_dtime(max(last_seen)) as last_seen, detectionmethod, itime, onwire as on_wire from ###(select apstatus, devid, vd, ssid, bssid, manuf, rssi, channel, radioband, min(dtime) as first_seen, max(dtime) as last_seen, detectionmethod, itime, onwire from $log where $filter and apstatus is not null and bssid is not null and logid_to_int(logid) in (43521, 43563, 43564, 43565, 43566, 43569, 43570, 43571) group by apstatus, devid, vd, ssid, bssid, manuf, rssi, channel, radioband, detectionmethod, itime, onwire order by itime desc)### t where onwire='yes' group by ap_full_status, devid, vd, ssid, bssid, manuf, rssi, channel, radioband, detectionmethod, itime, onwire, apstatus order by itime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Wireless-Client-Details |
Event wireless client details |
event |
drop table if exists rpt_tmptbl_1; create temporary table rpt_tmptbl_1 as select ip, lmac, sn, ssid, channel, radioband, min(first) as first, max(last) as last from ###(select ip, lower(mac) as lmac, sn, ssid, channel, radioband, min(dtime) as first, max(dtime) as last from $log-event where $filter and ip is not null and mac is not null and sn is not null and ssid is not null group by ip, lmac, sn, ssid, channel, radioband order by ip)### t group by ip, lmac, sn, ssid, channel, radioband; select user_src, ip, lmac, sn, ssid, channel, radioband, from_dtime(first) as first_seen, from_dtime(last) as last_seen, cast(volume as decimal(18,2)) as bandwidth from (select * from rpt_tmptbl_1 inner join (select user_src, srcip, sum(volume) as volume from ###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, srcip, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as volume from $log-traffic where $filter-time and (logflag&1>0) and srcip is not null group by user_src, srcip having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by volume desc)### t group by user_src, srcip order by user_src, srcip) t on rpt_tmptbl_1.ip = t.srcip) t order by volume desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Wireless-Accepted-Offwire |
Event wireless accepted off-wire |
event |
select & #039;accepted' as ap_full_status, devid, vd, ssid, bssid, manuf, channel, radioband, from_dtime(max(last_seen)) as last_seen, detectionmethod, snclosest, 'no' as on_wire from ###(select devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, logid, apstatus, max(dtime) as last_seen from $log where $filter and bssid is not null and logid_to_int(logid) in (43521, 43525, 43563, 43564, 43565, 43566, 43569, 43570, 43571) group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, logid, apstatus order by last_seen desc)### t where apstatus=2 and onwire='no' group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest order by last_seen desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Wireless-Accepted-Onwire |
Event wireless accepted on-wire |
event |
select & #039;accepted' as ap_full_status, devid, vd, ssid, bssid, manuf, channel, radioband, from_dtime(max(last_seen)) as last_seen, detectionmethod, snclosest, 'yes' as on_wire from ###(select devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, apstatus, signal, max(dtime) as last_seen from $log where $filter and bssid is not null and logid_to_int(logid) in (43521, 43525, 43563, 43564, 43565, 43566, 43569, 43570, 43571) group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, apstatus, signal order by last_seen desc)### t where apstatus=2 and onwire='yes' group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest order by last_seen desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Wireless-Rogue-Offwire |
Event wireless rogue off-wire |
event |
select & #039;rogue' as ap_full_status, devid, vd, ssid, bssid, manuf, channel, radioband, from_dtime(max(last_seen)) as last_seen, detectionmethod, snclosest, 'no' as on_wire from ###(select devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, logid, apstatus, max(dtime) as last_seen from $log where $filter and bssid is not null and logid_to_int(logid) in (43521, 43525, 43563, 43564, 43565, 43566, 43569, 43570, 43571) group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, logid, apstatus order by last_seen desc)### t where apstatus=1 and onwire='no' group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest order by last_seen desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Wireless-Rogue-Onwire |
Event wireless rogue on-wire |
event |
select & #039;rogue' as ap_full_status, devid, vd, ssid, bssid, manuf, channel, radioband, from_dtime(max(last_seen)) as last_seen, detectionmethod, snclosest, 'yes' as on_wire from ###(select devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, apstatus, signal, max(dtime) as last_seen from $log where $filter and bssid is not null and logid_to_int(logid) in (43521, 43525, 43563, 43564, 43565, 43566, 43569, 43570, 43571) group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, apstatus, signal order by last_seen desc)### t where apstatus=1 and onwire='yes' group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest order by last_seen desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Wireless-Suppressed-Offwire |
Event wireless suppressed off-wire |
event |
select & #039;suppressed' as ap_full_status, devid, vd, ssid, bssid, manuf, channel, radioband, from_dtime(max(last_seen)) as last_seen, detectionmethod, snclosest, 'no' as on_wire from ###(select devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, logid, apstatus, max(dtime) as last_seen from $log where $filter and bssid is not null and logid_to_int(logid) in (43521, 43525, 43563, 43564, 43565, 43566, 43569, 43570, 43571) group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, logid, apstatus order by last_seen desc)### t where apstatus=3 and onwire='no' group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest order by last_seen desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Wireless-Suppressed-Onwire |
Event wireless suppressed on-wire |
event |
select & #039;suppressed' as ap_full_status, devid, vd, ssid, bssid, manuf, channel, radioband, from_dtime(max(last_seen)) as last_seen, detectionmethod, snclosest, 'yes' as on_wire from ###(select devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, apstatus, signal, max(dtime) as last_seen from $log where $filter and bssid is not null and logid_to_int(logid) in (43521, 43525, 43563, 43564, 43565, 43566, 43569, 43570, 43571) group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, apstatus, signal order by last_seen desc)### t where apstatus=3 and onwire='yes' group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest order by last_seen desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Wireless-Unclassified-Offwire |
Event wireless unclassified off-wire |
event |
select & #039;unclassified' as ap_full_status, devid, vd, ssid, bssid, manuf, channel, radioband, from_dtime(max(last_seen)) as last_seen, detectionmethod, snclosest, 'no' as on_wire from ###(select devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, logid, apstatus, max(dtime) as last_seen from $log where $filter and bssid is not null and logid_to_int(logid) in (43521, 43525, 43563, 43564, 43565, 43566, 43569, 43570, 43571) group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, logid, apstatus order by last_seen desc)### t where apstatus=0 and onwire='no' group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest order by last_seen desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Wireless-Unclassified-Onwire |
Event wireless unclassified on-wire |
event |
select & #039;unclassified' as ap_full_status, devid, vd, ssid, bssid, manuf, channel, radioband, from_dtime(max(last_seen)) as last_seen, detectionmethod, snclosest, 'yes' as on_wire from ###(select devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, apstatus, signal, max(dtime) as last_seen from $log where $filter and bssid is not null and logid_to_int(logid) in (43521, 43525, 43563, 43564, 43565, 43566, 43569, 43570, 43571) group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest, onwire, apstatus, signal order by last_seen desc)### t where apstatus=0 and onwire='yes' group by devid, vd, ssid, bssid, manuf, channel, radioband, detectionmethod, snclosest order by last_seen desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
default-Top-IPSEC-Vpn-Dial-Up-User-By-Bandwidth |
Default top IPsec VPN dial up user by bandwidth usage |
event |
select
coalesce(
xauthuser_agg,
user_agg,
ipstr(`remip`)
) as user_src,
from_dtime(
min(s_time)
) as start_time,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
(
select
devid,
vd,
string_agg(
distinct xauthuser_agg,
& #039; ') as xauthuser_agg, string_agg(distinct user_agg, ' ') as user_agg, remip, tunnelid, min(s_time) as s_time, max(e_time) as e_time, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from ###(select devid, vd, remip, nullifna(`xauthuser`) as xauthuser_agg, nullifna(`user`) as user_agg, tunnelid, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ipsec%' and not (tunnelip is null or tunnelip='0.0.0.0') and tunnelid!=0 group by devid, vd, remip, xauthuser_agg, user_agg, tunnelid order by bandwidth desc)### t group by devid, vd, remip, tunnelid) tt group by user_src having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
default-Top-Sources-Of-SSL-VPN-Tunnels-By-Bandwidth |
Default top sources of SSL VPN tunnels by bandwidth usage |
event |
select
remip as remote_ip,
sum(bandwidth) as bandwidth
from
###(select $flex_timestamp as timestamp, devid, vd, remip, tunnelid, (case when tunneltype like 'ipsec%' then 'ipsec' else tunneltype end) as t_type, (case when action='tunnel-up' then 1 else 0 end) as tunnelup, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(nullifna(`xauthuser`), nullifna(`user`), ipstr(`remip`)) as f_user, tunneltype, action, count(*) as total_num from (select itime, dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and tunnelid is not null) t where (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') group by timestamp, devid, vd, remip, t_type, tunnelid, action, f_user, tunneltype /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t where t_type like 'ssl%' and action in ('tunnel-up','tunnel-stats', 'tunnel-down') and tunnelid is not null and tunnelid!=0 group by remote_ip having sum(traffic_in+traffic_out)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Login-Connection-Count-by-Type |
VPN authenticated logins |
event |
select
coalesce(
xauthuser_agg,
user_agg,
ipstr(`remip`)
) as f_user,
t_type as tunneltype,
from_dtime(
min(s_time)
) as start_time,
count(distinct tunnelid) as total_num,
sum(duration) as duration
from
(
select
string_agg(
distinct xauthuser_agg,
& #039; ') as xauthuser_agg, string_agg(distinct user_agg, ' ') as user_agg, t_type, devid, vd, remip, tunnelid, min(s_time) as s_time, max(e_time) as e_time, (case when min(s_time)=max(e_time) then NULL else max(max_duration)-min(min_duration) end) as duration, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, count(distinct tunnelid) as total_num from ###(select devid, vd, remip, nullifna(`xauthuser`) as xauthuser_agg, nullifna(`user`) as user_agg, (case when tunneltype like 'ipsec%' then 'ipsec' else tunneltype end) as t_type, tunnelid, tunnelip, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth, sum((case when action='tunnel-up' then 1 else 0 end)) as tunnelup from (select dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and tunnelid!=0 group by xauthuser_agg, user_agg, devid, vd, remip, t_type, tunnelid, tunnelip order by bandwidth desc)### t group by t_type, devid, vd, remip, tunnelid) tt where bandwidth>0 group by f_user, tunneltype order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Login-User-Count-by-Type |
VPN Login User Count by VPN Type |
event |
select
type_agg,
count(distinct f_user) as num_user
from
(
select
coalesce(
xauthuser_agg,
user_agg,
ipstr(`remip`)
) as f_user,
string_agg(
distinct t_type,
& #039; ') as type_agg from (select string_agg(distinct xauthuser_agg, ' ') as xauthuser_agg, string_agg(distinct user_agg, ' ') as user_agg, t_type, devid, vd, remip, tunnelid, sum(bandwidth) as bandwidth from ###(select devid, vd, remip, nullifna(`xauthuser`) as xauthuser_agg, nullifna(`user`) as user_agg, (case when tunneltype like 'ipsec%' then 'ipsec' else tunneltype end) as t_type, tunnelid, tunnelip, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth, sum((case when action='tunnel-up' then 1 else 0 end)) as tunnelup from (select dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and tunnelid!=0 group by xauthuser_agg, user_agg, devid, vd, remip, t_type, tunnelid, tunnelip order by bandwidth desc)### t group by t_type, devid, vd, remip, tunnelid) tt where bandwidth>0 group by f_user) ttt group by type_agg order by num_user desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Login-Total-Bandwidth-by-Type |
VPN Login Total Bandwidth by VPN Type |
event |
select
t_type,
sum(bandwidth) as total_bandwidth
from
###(select devid, vd, remip, nullifna(`xauthuser`) as xauthuser_agg, nullifna(`user`) as user_agg, (case when tunneltype like 'ipsec%' then 'ipsec' else tunneltype end) as t_type, tunnelid, tunnelip, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth, sum((case when action='tunnel-up' then 1 else 0 end)) as tunnelup from (select dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and tunnelid!=0 group by xauthuser_agg, user_agg, devid, vd, remip, t_type, tunnelid, tunnelip order by bandwidth desc)### t where bandwidth>0 group by t_type order by total_bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Login-Attempt-by-Type |
VPN Login Attempts by VPN Type |
event |
select
(
case when action like & #039;%fail' then 'Failed' else 'Success' end) as type, sum(total_num) as total_num from ###(select coalesce(nullifna(`xauthuser`), nullifna(`user`), ipstr(`remip`)) as f_user, tunneltype, action, count(*) as total_num from $log where $filter and subtype='vpn' and (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and action in ('ssl-login-fail', 'ipsec-login-fail', 'tunnel-up', 'tunnel-stats', 'tunnel-down') group by f_user, tunneltype, action order by total_num desc)### t group by type order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Traffic-Usage-Trend |
VPN traffic usage trend |
event |
select
hodex,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out,
sum(ssl_traffic_bandwidth) as ssl_bandwidth,
sum(ipsec_traffic_bandwidth) as ipsec_bandwidth
from
(
select
$flex_timescale(timestamp) as hodex,
devid,
vd,
remip,
tunnelid,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out,
(
case when t_type like & #039;ssl%' then sum(bandwidth) else 0 end) as ssl_traffic_bandwidth, (case when t_type like 'ipsec%' then sum(bandwidth) else 0 end) as ipsec_traffic_bandwidth, min(s_time) as s_time, max(e_time) as e_time from ###(select $flex_timestamp as timestamp, devid, vd, remip, tunnelid, (case when tunneltype like 'ipsec%' then 'ipsec' else tunneltype end) as t_type, (case when action='tunnel-up' then 1 else 0 end) as tunnelup, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(nullifna(`xauthuser`), nullifna(`user`), ipstr(`remip`)) as f_user, tunneltype, action, count(*) as total_num from (select itime, dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and tunnelid is not null) t where (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') group by timestamp, devid, vd, remip, t_type, tunnelid, action, f_user, tunneltype /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t where action in ('tunnel-up','tunnel-stats', 'tunnel-down') and tunnelid is not null and tunnelid!=0 group by hodex, devid, t_type, vd, remip, tunnelid) tt group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Authenticated-Logins |
VPN authenticated logins |
event |
select
coalesce(
xauthuser_agg,
user_agg,
ipstr(`remip`)
) as f_user,
t_type as tunneltype,
from_dtime(
min(s_time)
) as start_time,
count(distinct tunnelid) as total_num,
sum(duration) as duration
from
(
select
string_agg(
distinct xauthuser_agg,
& #039; ') as xauthuser_agg, string_agg(distinct user_agg, ' ') as user_agg, t_type, devid, vd, remip, tunnelid, min(s_time) as s_time, max(e_time) as e_time, (case when min(s_time)=max(e_time) then NULL else max(max_duration)-min(min_duration) end) as duration, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, count(distinct tunnelid) as total_num from ###(select devid, vd, remip, nullifna(`xauthuser`) as xauthuser_agg, nullifna(`user`) as user_agg, (case when tunneltype like 'ipsec%' then 'ipsec' else tunneltype end) as t_type, tunnelid, tunnelip, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth, sum((case when action='tunnel-up' then 1 else 0 end)) as tunnelup from (select dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and tunnelid!=0 group by xauthuser_agg, user_agg, devid, vd, remip, t_type, tunnelid, tunnelip order by bandwidth desc)### t group by t_type, devid, vd, remip, tunnelid) tt where bandwidth>0 group by f_user, tunneltype order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Failed-Login-Attempt-by-User |
VPN failed logins |
event |
select
f_user,
tunneltype,
sum(total_num) as total_num
from
###(select coalesce(nullifna(`xauthuser`), `user`) as f_user, tunneltype, count(*) as total_num from $log where $filter and subtype='vpn' and (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and action in ('ssl-login-fail', 'ipsec-login-fail') and coalesce(nullifna(`xauthuser`), nullifna(`user`)) is not null group by f_user, tunneltype)### t group by f_user, tunneltype order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Failed-Login-Timeline |
VPN Failed Login Timeline |
event |
select
$flex_timescale(timestamp) as hodex,
sum(total_num) as total_num
from
###(select $flex_timestamp as timestamp, devid, vd, remip, tunnelid, (case when tunneltype like 'ipsec%' then 'ipsec' else tunneltype end) as t_type, (case when action='tunnel-up' then 1 else 0 end) as tunnelup, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(nullifna(`xauthuser`), nullifna(`user`), ipstr(`remip`)) as f_user, tunneltype, action, count(*) as total_num from (select itime, dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and tunnelid is not null) t where (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') group by timestamp, devid, vd, remip, t_type, tunnelid, action, f_user, tunneltype /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t where action in ('ssl-login-fail', 'ipsec-login-fail') and f_user is not null group by hodex order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Top-Dial-Up-VPN-Users-By-Duration |
Top dial up VPN users by duration |
event |
select
coalesce(
xauthuser_agg,
user_agg,
ipstr(`remip`)
) as user_src,
t_type as tunneltype,
from_dtime(
min(s_time)
) as start_time,
sum(duration) as duration,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
(
select
devid,
vd,
remip,
string_agg(
distinct xauthuser_agg,
& #039; ') as xauthuser_agg, string_agg(distinct user_agg, ' ') as user_agg, t_type, tunnelid, min(s_time) as s_time, max(e_time) as e_time, (case when min(s_time)=max(e_time) then max(max_duration) else max(max_duration)-min(min_duration) end) as duration, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from ###(select devid, vd, remip, nullifna(`xauthuser`) as xauthuser_agg, nullifna(`user`) as user_agg, (case when tunneltype like 'ipsec%' then 'ipsec' else tunneltype end) as t_type, tunnelid, tunnelip, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth, sum((case when action='tunnel-up' then 1 else 0 end)) as tunnelup from (select dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where (tunneltype like 'ipsec%' or tunneltype like 'ssl%') and tunnelid!=0 group by xauthuser_agg, user_agg, devid, vd, remip, t_type, tunnelid, tunnelip order by bandwidth desc)### t where (t_type like 'ssl%' or (t_type like 'ipsec%' and not (tunnelip is null or tunnelip='0.0.0.0'))) group by devid, vd, remip, t_type, tunnelid) tt where bandwidth>0 group by user_src, tunneltype order by duration desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Top-SSL-VPN-Tunnel-Duration-By-Users |
Top SSL VPN Tunnel Duration by Users |
event |
select
user_src,
sum(duration) as duration,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
(
select
devid,
vd,
remip,
user_src,
tunnelid,
(
case when min(s_time)= max(e_time) then max(max_duration) else max(max_duration)- min(min_duration) end
) as duration,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out,
sum(bandwidth) as bandwidth
from
###(select devid, vd, remip, coalesce(nullifna(`user`), ipstr(`remip`)) as user_src, tunnelid, tunneltype, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `user`, duration, tunnelid, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ssl%' and coalesce(nullifna(`user`), ipstr(`remip`)) is not null group by devid, vd, user_src, remip, tunnelid, tunneltype order by bandwidth desc)### t where tunneltype='ssl-tunnel' group by devid, vd, remip, user_src, tunnelid) tt where bandwidth>0 group by user_src order by duration desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Top-SSL-VPN-Tunnel-Users-By-Traffic-Directions |
Top SSL VPN Tunnel Users by Traffic Directions |
event |
select
user_src,
unnest(traffic_direction) as direction,
unnest(traffic) as traffic
from
(
select
user_src,
sum(bandwidth) as bandwidth,
array[ & #039;Received', 'Sent'] as traffic_direction, array[sum(traffic_in), sum(traffic_out)] as traffic from ###(select devid, vd, remip, coalesce(nullifna(`user`), ipstr(`remip`)) as user_src, tunnelid, tunneltype, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `user`, duration, tunnelid, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ssl%' and coalesce(nullifna(`user`), ipstr(`remip`)) is not null group by devid, vd, user_src, remip, tunnelid, tunneltype order by bandwidth desc)### t where tunneltype='ssl-tunnel' and bandwidth>0 group by user_src) ttt order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Top-SSL-VPN-Web-Mode-Users-By-Duration |
Top SSL VPN web mode users by duration |
event |
select
user_src,
remip as remote_ip,
from_dtime(
min(s_time)
) as start_time,
sum(duration) as duration
from
(
select
devid,
vd,
user_src,
remip,
tunnelid,
min(s_time) as s_time,
(
case when min(s_time)= max(e_time) then max(max_duration) else max(max_duration)- min(min_duration) end
) as duration
from
###(select devid, vd, remip, coalesce(nullifna(`user`), ipstr(`remip`)) as user_src, tunnelid, tunneltype, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `user`, duration, tunnelid, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ssl%' and coalesce(nullifna(`user`), ipstr(`remip`)) is not null group by devid, vd, user_src, remip, tunnelid, tunneltype order by bandwidth desc)### t where tunneltype='ssl-web' group by devid, vd, user_src, remip, tunnelid) tt group by user_src, remote_ip order by duration desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Top-SSL-VPN-Web-Mode-Users-By-Traffic-Directions |
Top SSL VPN Web Mode Users by Traffic Directions |
event |
select
user_src,
unnest(traffic_direction) as direction,
unnest(traffic) as traffic
from
(
select
user_src,
sum(bandwidth) as bandwidth,
array[ & #039;Received', 'Sent'] as traffic_direction, array[sum(traffic_in), sum(traffic_out)] as traffic from ###(select devid, vd, remip, coalesce(nullifna(`user`), ipstr(`remip`)) as user_src, tunnelid, tunneltype, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `user`, duration, tunnelid, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ssl%' and coalesce(nullifna(`user`), ipstr(`remip`)) is not null group by devid, vd, user_src, remip, tunnelid, tunneltype order by bandwidth desc)### t where tunneltype='ssl-web' and bandwidth>0 group by user_src) ttt order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Top-IPsec-Vpn-Dial-Up-User-By-Bandwidth |
Default top IPsec VPN dial up user by bandwidth usage |
event |
select
coalesce(
xauthuser_agg,
user_agg,
ipstr(`remip`)
) as user_src,
from_dtime(
min(s_time)
) as start_time,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
(
select
devid,
vd,
string_agg(
distinct xauthuser_agg,
& #039; ') as xauthuser_agg, string_agg(distinct user_agg, ' ') as user_agg, remip, tunnelid, min(s_time) as s_time, max(e_time) as e_time, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from ###(select devid, vd, remip, nullifna(`xauthuser`) as xauthuser_agg, nullifna(`user`) as user_agg, tunnelid, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ipsec%' and not (tunnelip is null or tunnelip='0.0.0.0') and tunnelid!=0 group by devid, vd, remip, xauthuser_agg, user_agg, tunnelid order by bandwidth desc)### t group by devid, vd, remip, tunnelid) tt group by user_src having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Top-Static-IPsec-Tunnels-By-Traffic-Directions |
Top Static IPsec Tunnels by Traffic Directions |
event |
select
vpn_name,
unnest(traffic_direction) as direction,
unnest(traffic) as traffic
from
(
select
vpn_name,
sum(bandwidth) as bandwidth,
array[ & #039;Received', 'Sent'] as traffic_direction, array[sum(traffic_in), sum(traffic_out)] as traffic from ###(select devid, vd, remip, vpn_trim(vpntunnel) as vpn_name, tunnelid, tunnelip, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select devid, vd, remip, tunnelid, tunnelip,vpntunnel, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ipsec%' and nullifna(vpntunnel) is not null and tunnelid!=0 group by devid, vd, remip, vpn_name, tunnelid, tunnelip order by bandwidth desc)### t where (tunnelip is null or tunnelip='0.0.0.0') group by vpn_name having sum(traffic_in+traffic_out)>0) ttt order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Top-Dial-Up-IPsec-Users-By-Duration |
Top dial up IPsec users by duration |
event |
select
coalesce(
xauthuser_agg,
user_agg,
ipstr(`remip`)
) as user_src,
from_dtime(
min(s_time)
) as start_time,
sum(duration) as duration,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
(
select
devid,
vd,
remip,
string_agg(
distinct xauthuser_agg,
& #039; ') as xauthuser_agg, string_agg(distinct user_agg, ' ') as user_agg, tunnelid, min(s_time) as s_time, max(e_time) as e_time, (case when min(s_time)=max(e_time) then max(max_duration) else max(max_duration)-min(min_duration) end) as duration, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from ###(select devid, vd, remip, nullifna(`xauthuser`) as xauthuser_agg, nullifna(`user`) as user_agg, tunnelid, max(coalesce(duration,0)) as max_duration, min(coalesce(duration,0)) as min_duration, min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select dtime, devid, vd, remip, `xauthuser`, `user`, duration, tunnelid, tunnelip, tunneltype, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ipsec%' and not (tunnelip is null or tunnelip='0.0.0.0') and tunnelid!=0 group by devid, vd, remip, xauthuser_agg, user_agg, tunnelid order by bandwidth desc)### t group by devid, vd, remip, tunnelid) tt where bandwidth>0 group by user_src order by duration desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
vpn-Top-Dial-Up-IPsec-Tunnels-By-Traffic-Directions |
Top Dial Up IPsec Tunnels by Traffic Directions |
event |
select
vpn_name,
unnest(traffic_direction) as direction,
unnest(traffic) as traffic
from
(
select
vpn_name,
sum(bandwidth) as bandwidth,
array[ & #039;Received', 'Sent'] as traffic_direction, array[sum(traffic_in), sum(traffic_out)] as traffic from ###(select devid, vd, remip, vpn_trim(vpntunnel) as vpn_name, tunnelid, tunnelip, coalesce(sum(case when sentdelta>0 then sentdelta else 0 end), 0) AS traffic_out, coalesce(sum(case when rcvddelta>0 then rcvddelta else 0 end), 0) AS traffic_in, coalesce(sum(case when rcvddelta>0 and sentdelta>0 then rcvddelta+sentdelta when rcvddelta>0 then rcvddelta when sentdelta>0 then sentdelta else 0 end), 0) AS bandwidth from (select devid, vd, remip, tunnelid, tunnelip,vpntunnel, tunneltype, action, sentbyte-lag(coalesce(sentbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) OVER (PARTITION BY dvid, tunnelid ORDER BY eventtime) AS rcvddelta from $log where $filter and subtype='vpn' and action in ('tunnel-up','tunnel-stats', 'tunnel-down', 'ssl-login-fail', 'ipsec-login-fail') and tunnelid is not null) t where tunneltype like 'ipsec%' and nullifna(vpntunnel) is not null and tunnelid!=0 group by devid, vd, remip, vpn_name, tunnelid, tunnelip order by bandwidth desc)### t where not (tunnelip is null or tunnelip='0.0.0.0') group by vpn_name having sum(bandwidth)>0) ttt order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
webfilter-Web-Activity-Summary-By-Requests |
Webfilter web activity summary by requests |
webfilter |
select $flex_timescale(timestamp) as hodex, sum(allowed_request) as allowed_request, sum(blocked_request) as blocked_request from ###(select $flex_timestamp as timestamp, sum(case when action!='blocked' then 1 else 0 end) as allowed_request, sum(case when action='blocked' then 1 else 0 end) as blocked_request from $log where $filter group by timestamp /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
traffic-Browsing-Time-Summary |
Traffic browsing time summary |
traffic |
select
$flex_timescale(timestamp) as hodex,
cast(
ebtr_value(
ebtr_agg_flat(browsetime),
null,
$timespan
)/ 60.0 as decimal(18, 2)
) as browsetime
from
###(select $flex_timestamp as timestamp, ebtr_agg_flat($browse_time) as browsetime from $log where $filter and (logflag&1>0) and $browse_time is not null group by timestamp /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
webfilter-Top-Web-Users-By-Blocked-Requests |
Webfilter top web users by blocked requests |
webfilter |
select
coalesce(
f_user,
euname,
ipstr(`srcip`)
) as user_src,
coalesce(
epname,
ipstr(`srcip`)
) as ep_src,
sum(requests) as requests
from
(
select
dvid,
f_user,
srcip,
ep_id,
eu_id,
sum(requests) as requests
from
###(select dvid, coalesce(nullifna(`user`), nullifna(`unauthuser`)) as f_user, srcip, (case when epid<1024 then null else epid end) as ep_id, (case when euid<1024 then null else euid end) as eu_id, action, count(*) as requests from $log where $filter and coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) is not null group by dvid, f_user, srcip, ep_id, eu_id, action /*SkipSTART*/order by requests desc/*SkipEND*/)### t where action='blocked' group by dvid, f_user, srcip, ep_id, eu_id order by requests desc) t1 left join (select epid, euid, srcmac as epmac, dvid from $ADOM_EPEU_DEVMAP dm inner join devtable dt ON dm.devid=dt.devid and dm.vd=dt.vd) t2 on t1.ep_id=t2.epid and t1.eu_id=t2.euid and t1.dvid=t2.dvid left join $ADOM_ENDPOINT t3 on t1.ep_id=t3.epid and t2.epmac=t3.mac left join $ADOM_ENDUSER t4 on t1.eu_id=t4.euid group by user_src, ep_src order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
webfilter-Top-Web-Users-By-Allowed-Requests |
Webfilter top web users by allowed requests |
webfilter |
select
coalesce(
f_user,
euname,
ipstr(`srcip`)
) as user_src,
coalesce(
epname,
ipstr(`srcip`)
) as ep_src,
sum(requests) as requests
from
(
select
dvid,
f_user,
srcip,
ep_id,
eu_id,
sum(requests) as requests
from
###(select dvid, coalesce(nullifna(`user`), nullifna(`unauthuser`)) as f_user, srcip, (case when epid<1024 then null else epid end) as ep_id, (case when euid<1024 then null else euid end) as eu_id, action, count(*) as requests from $log where $filter and coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) is not null group by dvid, f_user, srcip, ep_id, eu_id, action /*SkipSTART*/order by requests desc/*SkipEND*/)### t where action!='blocked' group by dvid, f_user, srcip, ep_id, eu_id order by requests desc) t1 left join (select epid, euid, srcmac as epmac, dvid from $ADOM_EPEU_DEVMAP dm inner join devtable dt ON dm.devid=dt.devid and dm.vd=dt.vd) t2 on t1.ep_id=t2.epid and t1.eu_id=t2.euid and t1.dvid=t2.dvid left join $ADOM_ENDPOINT t3 on t1.ep_id=t3.epid and t2.epmac=t3.mac left join $ADOM_ENDUSER t4 on t1.eu_id=t4.euid group by user_src, ep_src order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
traffic-Top-Web-Users-By-Browsing-Time |
Traffic top web users by browsing time |
traffic |
select
user_src,
ebtr_value(
ebtr_agg_flat(browsetime),
null,
$timespan
) as browsetime,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
###(select user_src, ebtr_agg_flat(browsetime) as browsetime, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from (select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, ebtr_agg_flat($browse_time) as browsetime, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out from $log where $filter and $browse_time is not null group by user_src) t group by user_src /*SkipSTART*/order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc/*SkipEND*/)### t group by user_src order by browsetime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
webfilter-Top-Blocked-Web-Sites-By-Requests |
Webfilter top blocked web sites by requests |
webfilter |
select domain, catdesc, sum(requests) as requests from ###(select hostname as domain, catdesc, action, count(*) as requests from $log where $filter and hostname is not null and catdesc is not null group by domain, catdesc, action /*SkipSTART*/order by requests desc/*SkipEND*/)### t where action='blocked' group by domain, catdesc order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
webfilter-Top-Allowed-Web-Sites-By-Requests |
Webfilter top allowed web sites by requests |
webfilter |
select
domain,
string_agg(
distinct catdesc,
& #039;, ') as agg_catdesc, sum(requests) as requests from ###(select hostname as domain, catdesc, action, count(*) as requests from $log where $filter and hostname is not null and catdesc is not null group by domain, catdesc, action /*SkipSTART*/order by requests desc/*SkipEND*/)### t where action!='blocked' group by domain order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
webfilter-Top-Video-Streaming-Websites-By-Bandwidth |
Webfilter top video streaming websites by bandwidth usage |
webfilter |
select
domain,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
###(select coalesce(nullifna(root_domain(hostname)), 'other') as domain, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out from $log-traffic where $filter and (logflag&1>0) and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) and catdesc in ('Streaming Media and Download') group by domain having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t group by domain order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
webfilter-Top-Blocked-Web-Categories |
Webfilter top blocked web categories |
webfilter |
select catdesc, sum(requests) as requests from ###(select catdesc, action, count(*) as requests from $log-webfilter where $filter and catdesc is not null group by catdesc, action /*SkipSTART*/order by requests desc/*SkipEND*/)### t where action='blocked' group by catdesc order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
webfilter-Top-Allowed-Web-Categories |
Webfilter top allowed web categories |
webfilter |
select catdesc, sum(requests) as requests from ###(select catdesc, action, count(*) as requests from $log-webfilter where $filter and catdesc is not null group by catdesc, action /*SkipSTART*/order by requests desc/*SkipEND*/)### t where action!='blocked' group by catdesc order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
traffic-Top-50-Sites-By-Browsing-Time |
Traffic top sites by browsing time |
traffic |
select
hostname,
string_agg(
distinct catdesc,
& #039;, ') as agg_catdesc, ebtr_value(ebtr_agg_flat(browsetime), null, $timespan) as browsetime, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from ###(select hostname, catdesc, ebtr_agg_flat(browsetime) as browsetime, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from (select hostname, catdesc, ebtr_agg_flat($browse_time) as browsetime, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out from $log where $filter and (logflag&1>0) and hostname is not null and $browse_time is not null group by hostname, catdesc) t group by hostname, catdesc /*SkipSTART*/order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc/*SkipEND*/)### t group by hostname order by browsetime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
traffic-Top-10-Categories-By-Browsing-Time |
Traffic top category by browsing time |
traffic |
select
catdesc,
ebtr_value(
ebtr_agg_flat(browsetime),
null,
$timespan
) as browsetime,
sum(bandwidth) as bandwidth
from
###(select catdesc, ebtr_agg_flat(browsetime) as browsetime, sum(bandwidth) as bandwidth from (select catdesc, ebtr_agg_flat($browse_time) as browsetime, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter and (logflag&1>0) and catdesc is not null and $browse_time is not null group by catdesc) t group by catdesc /*SkipSTART*/order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc/*SkipEND*/)### t group by catdesc order by browsetime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
traffic-Top-Destination-Countries-By-Browsing-Time |
Traffic top destination countries by browsing time |
traffic |
select
dstcountry,
ebtr_value(
ebtr_agg_flat(browsetime),
null,
$timespan
) as browsetime,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
###(select dstcountry, ebtr_agg_flat(browsetime) as browsetime, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from (select dstcountry, ebtr_agg_flat($browse_time) as browsetime, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out from $log where $filter and (logflag&1>0) and $browse_time is not null group by dstcountry) t group by dstcountry /*SkipSTART*/order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc/*SkipEND*/)### t group by dstcountry order by browsetime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
webfilter-Top-Search-Phrases |
Webfilter top search phrases |
webfilter |
select keyword, count(*) as requests from $log where $filter and keyword is not null group by keyword order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-10-Users-Browsing-Time |
Estimated browsing time |
traffic |
select
coalesce(
f_user,
euname,
ipstr(`srcip`)
) as user_src,
coalesce(
epname,
ipstr(`srcip`)
) as ep_src,
ebtr_value(
ebtr_agg_flat(browsetime),
null,
$timespan
) as browsetime
from
(
select
dvid,
f_user,
srcip,
ep_id,
eu_id,
ebtr_agg_flat(browsetime) as browsetime
from
###(select dvid, f_user, srcip, ep_id, eu_id, ebtr_agg_flat(browsetime) as browsetime from (select dvid, coalesce(nullifna(`user`), nullifna(`unauthuser`)) as f_user, srcip, (case when epid<1024 then null else epid end) as ep_id, (case when euid<1024 then null else euid end) as eu_id, ebtr_agg_flat($browse_time) as browsetime from $log where $filter and (logflag&1>0) and $browse_time is not null group by dvid, f_user, srcip, ep_id, eu_id) t group by dvid, f_user, srcip, ep_id, eu_id order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc)### t group by dvid, f_user, srcip, ep_id, eu_id order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc) t1 left join (select epid, euid, srcmac as epmac, dvid from $ADOM_EPEU_DEVMAP dm inner join devtable dt ON dm.devid=dt.devid and dm.vd=dt.vd) t2 on t1.ep_id=t2.epid and t1.eu_id=t2.euid and t1.dvid=t2.dvid left join $ADOM_ENDPOINT t3 on t1.ep_id=t3.epid and t2.epmac=t3.mac left join $ADOM_ENDUSER t4 on t1.eu_id=t4.euid group by user_src, ep_src order by browsetime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Estimated-Browsing-Time |
Estimated browsing time |
traffic |
select
coalesce(
f_user,
euname,
ipstr(`srcip`)
) as user_src,
coalesce(
epname,
ipstr(`srcip`)
) as ep_src,
ebtr_value(
ebtr_agg_flat(browsetime),
null,
$timespan
) as browsetime
from
(
select
dvid,
f_user,
srcip,
ep_id,
eu_id,
ebtr_agg_flat(browsetime) as browsetime
from
###(select dvid, f_user, srcip, ep_id, eu_id, ebtr_agg_flat(browsetime) as browsetime from (select dvid, coalesce(nullifna(`user`), nullifna(`unauthuser`)) as f_user, srcip, (case when epid<1024 then null else epid end) as ep_id, (case when euid<1024 then null else euid end) as eu_id, ebtr_agg_flat($browse_time) as browsetime from $log where $filter and (logflag&1>0) and $browse_time is not null group by dvid, f_user, srcip, ep_id, eu_id) t group by dvid, f_user, srcip, ep_id, eu_id order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc)### t group by dvid, f_user, srcip, ep_id, eu_id order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc) t1 left join (select epid, euid, srcmac as epmac, dvid from $ADOM_EPEU_DEVMAP dm inner join devtable dt ON dm.devid=dt.devid and dm.vd=dt.vd) t2 on t1.ep_id=t2.epid and t1.eu_id=t2.euid and t1.dvid=t2.dvid left join $ADOM_ENDPOINT t3 on t1.ep_id=t3.epid and t2.epmac=t3.mac left join $ADOM_ENDUSER t4 on t1.eu_id=t4.euid group by user_src, ep_src order by browsetime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-Top-AP-By-Bandwidth |
Top access point by bandwidth usage |
traffic |
select
ap_srcintf,
sum(bandwidth) as bandwidth
from
(
select
coalesce(ap, srcintf) as ap_srcintf,
sum(bandwidth) as bandwidth
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, ap, srcintf, srcssid, srcssid as ssid, srcmac, srcmac as stamac, coalesce(nullifna(`srcname`), `srcmac`) as hostname_mac, max(srcswversion) as srcswversion, max(osname) as osname, max(osversion) as osversion, max(devtype) as devtype, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as subtotal from $log-traffic where $filter and (logflag&1>0) and (srcssid is not null or dstssid is not null) group by user_src, ap, srcintf, srcssid, srcmac, hostname_mac /*SkipSTART*/order by bandwidth desc, subtotal desc/*SkipEND*/)### t group by ap_srcintf having sum(bandwidth)>0 union all select ap as ap_srcintf, sum(bandwidth) as bandwidth from ###(select $flex_timestamp as timestamp, stamac, stamac as srcmac, ap, ssid, ssid as srcssid, user_src, sum(coalesce(sentdelta, 0)) as sentdelta, sum(coalesce(rcvddelta, 0)) as rcvddelta, sum(coalesce(sentdelta, 0)+coalesce(rcvddelta, 0)) as bandwidth from (select itime, stamac, ap, ssid, coalesce(`user`, ipstr(`srcip`)) as user_src, sentbyte-lag(coalesce(sentbyte, 0)) over (partition by stamac order by itime) as sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) over (partition by stamac order by itime) as rcvddelta from $log-event where $filter and subtype='wireless' and stamac is not null and ssid is not null and action in ('sta-wl-bridge-traffic-stats', 'reassoc-req', 'assoc-req')) as t group by timestamp, stamac, ap, ssid, user_src /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t group by ap having sum(bandwidth)>0) t group by ap_srcintf order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-Top-AP-By-Client |
Top access point by client |
traffic |
select
ap_srcintf as srcintf,
count(distinct srcmac) as totalnum
from
(
select
coalesce(ap, srcintf) as ap_srcintf,
srcmac
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, ap, srcintf, srcssid, srcssid as ssid, srcmac, srcmac as stamac, coalesce(nullifna(`srcname`), `srcmac`) as hostname_mac, max(srcswversion) as srcswversion, max(osname) as osname, max(osversion) as osversion, max(devtype) as devtype, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as subtotal from $log-traffic where $filter and (logflag&1>0) and (srcssid is not null or dstssid is not null) group by user_src, ap, srcintf, srcssid, srcmac, hostname_mac /*SkipSTART*/order by bandwidth desc, subtotal desc/*SkipEND*/)### t where srcmac is not null group by ap_srcintf, srcmac union all (select ap as ap_srcintf, stamac as srcmac from ###(select $flex_timestamp as timestamp, stamac, stamac as srcmac, ap, ssid, ssid as srcssid, user_src, sum(coalesce(sentdelta, 0)) as sentdelta, sum(coalesce(rcvddelta, 0)) as rcvddelta, sum(coalesce(sentdelta, 0)+coalesce(rcvddelta, 0)) as bandwidth from (select itime, stamac, ap, ssid, coalesce(`user`, ipstr(`srcip`)) as user_src, sentbyte-lag(coalesce(sentbyte, 0)) over (partition by stamac order by itime) as sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) over (partition by stamac order by itime) as rcvddelta from $log-event where $filter and subtype='wireless' and stamac is not null and ssid is not null and action in ('sta-wl-bridge-traffic-stats', 'reassoc-req', 'assoc-req')) as t group by timestamp, stamac, ap, ssid, user_src /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t where stamac is not null group by ap, stamac)) t group by srcintf order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-Top-SSID-By-Bandwidth |
Top SSIDs by bandwidth usage |
traffic |
select
srcssid,
sum(bandwidth) as bandwidth
from
(
select
srcssid,
sum(bandwidth) as bandwidth
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, ap, srcintf, srcssid, srcssid as ssid, srcmac, srcmac as stamac, coalesce(nullifna(`srcname`), `srcmac`) as hostname_mac, max(srcswversion) as srcswversion, max(osname) as osname, max(osversion) as osversion, max(devtype) as devtype, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as subtotal from $log-traffic where $filter and (logflag&1>0) and (srcssid is not null or dstssid is not null) group by user_src, ap, srcintf, srcssid, srcmac, hostname_mac /*SkipSTART*/order by bandwidth desc, subtotal desc/*SkipEND*/)### t where srcssid is not null group by srcssid having sum(bandwidth)>0 union all select ssid as srcssid, sum(bandwidth) as bandwidth from ###(select $flex_timestamp as timestamp, stamac, stamac as srcmac, ap, ssid, ssid as srcssid, user_src, sum(coalesce(sentdelta, 0)) as sentdelta, sum(coalesce(rcvddelta, 0)) as rcvddelta, sum(coalesce(sentdelta, 0)+coalesce(rcvddelta, 0)) as bandwidth from (select itime, stamac, ap, ssid, coalesce(`user`, ipstr(`srcip`)) as user_src, sentbyte-lag(coalesce(sentbyte, 0)) over (partition by stamac order by itime) as sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) over (partition by stamac order by itime) as rcvddelta from $log-event where $filter and subtype='wireless' and stamac is not null and ssid is not null and action in ('sta-wl-bridge-traffic-stats', 'reassoc-req', 'assoc-req')) as t group by timestamp, stamac, ap, ssid, user_src /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t group by ssid having sum(bandwidth)>0) t group by srcssid order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-Top-SSID-By-Client |
Top SSIDs by client |
traffic |
select
srcssid,
count(distinct srcmac) as totalnum
from
(
select
srcssid,
srcmac
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, ap, srcintf, srcssid, srcssid as ssid, srcmac, srcmac as stamac, coalesce(nullifna(`srcname`), `srcmac`) as hostname_mac, max(srcswversion) as srcswversion, max(osname) as osname, max(osversion) as osversion, max(devtype) as devtype, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as subtotal from $log-traffic where $filter and (logflag&1>0) and (srcssid is not null or dstssid is not null) group by user_src, ap, srcintf, srcssid, srcmac, hostname_mac /*SkipSTART*/order by bandwidth desc, subtotal desc/*SkipEND*/)### t where srcmac is not null group by srcssid, srcmac union all select ssid as srcssid, stamac as srcmac from ###(select $flex_timestamp as timestamp, stamac, stamac as srcmac, ap, ssid, ssid as srcssid, user_src, sum(coalesce(sentdelta, 0)) as sentdelta, sum(coalesce(rcvddelta, 0)) as rcvddelta, sum(coalesce(sentdelta, 0)+coalesce(rcvddelta, 0)) as bandwidth from (select itime, stamac, ap, ssid, coalesce(`user`, ipstr(`srcip`)) as user_src, sentbyte-lag(coalesce(sentbyte, 0)) over (partition by stamac order by itime) as sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) over (partition by stamac order by itime) as rcvddelta from $log-event where $filter and subtype='wireless' and stamac is not null and ssid is not null and action in ('sta-wl-bridge-traffic-stats', 'reassoc-req', 'assoc-req')) as t group by timestamp, stamac, ap, ssid, user_src /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t where stamac is not null group by ssid, stamac) t where srcssid is not null group by srcssid order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-Top-App-By-Bandwidth |
Top WiFi applications by bandwidth usage |
traffic |
select
appid,
app,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth
from
$log
where
$filter
and (
logflag&1>0
)
and (
srcssid is not null
or dstssid is not null
)
and nullifna(app) is not null
group by
appid,
app
having
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
)> 0
order by
bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-Top-Client-By-Bandwidth |
Top WiFi client by bandwidth usage |
traffic |
select
client,
sum(bandwidth) as bandwidth
from
(
select
(
coalesce(
hostname_mac,
& #039;unknown') || ' (' || get_devtype(srcswversion, osname, devtype) || ', ' || coalesce(osname, '') || (case when srcswversion is null then '' else ' ' || srcswversion end) || ')') as client, sum(bandwidth) as bandwidth from ###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, ap, srcintf, srcssid, srcssid as ssid, srcmac, srcmac as stamac, coalesce(nullifna(`srcname`), `srcmac`) as hostname_mac, max(srcswversion) as srcswversion, max(osname) as osname, max(osversion) as osversion, max(devtype) as devtype, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as subtotal from $log-traffic where $filter and (logflag&1>0) and (srcssid is not null or dstssid is not null) group by user_src, ap, srcintf, srcssid, srcmac, hostname_mac /*SkipSTART*/order by bandwidth desc, subtotal desc/*SkipEND*/)### t group by client having sum(bandwidth)>0 union all select (coalesce(stamac, 'unknown')) as client, sum(bandwidth) as bandwidth from ###(select $flex_timestamp as timestamp, stamac, stamac as srcmac, ap, ssid, ssid as srcssid, user_src, sum(coalesce(sentdelta, 0)) as sentdelta, sum(coalesce(rcvddelta, 0)) as rcvddelta, sum(coalesce(sentdelta, 0)+coalesce(rcvddelta, 0)) as bandwidth from (select itime, stamac, ap, ssid, coalesce(`user`, ipstr(`srcip`)) as user_src, sentbyte-lag(coalesce(sentbyte, 0)) over (partition by stamac order by itime) as sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) over (partition by stamac order by itime) as rcvddelta from $log-event where $filter and subtype='wireless' and stamac is not null and ssid is not null and action in ('sta-wl-bridge-traffic-stats', 'reassoc-req', 'assoc-req')) as t group by timestamp, stamac, ap, ssid, user_src /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t group by client having sum(bandwidth) > 0) t where client is not null group by client order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-Top-OS-By-Bandwidth |
Top WiFi os by bandwidth usage |
traffic |
select
(
coalesce(
osname,
& #039;unknown') || ' ' || coalesce(srcswversion, '')) as os, sum(bandwidth) as bandwidth from ###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, ap, srcintf, srcssid, srcssid as ssid, srcmac, srcmac as stamac, coalesce(nullifna(`srcname`), `srcmac`) as hostname_mac, max(srcswversion) as srcswversion, max(osname) as osname, max(osversion) as osversion, max(devtype) as devtype, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as subtotal from $log-traffic where $filter and (logflag&1>0) and (srcssid is not null or dstssid is not null) group by user_src, ap, srcintf, srcssid, srcmac, hostname_mac /*SkipSTART*/order by bandwidth desc, subtotal desc/*SkipEND*/)### t group by os having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-Top-OS-By-WiFi-Client |
Top WiFi os by WiFi client |
traffic |
select
(
coalesce(
osname,
& #039;unknown') || ' ' || coalesce(osversion, '')) as os, count(distinct srcmac) as totalnum from ###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, ap, srcintf, srcssid, srcssid as ssid, srcmac, srcmac as stamac, coalesce(nullifna(`srcname`), `srcmac`) as hostname_mac, max(srcswversion) as srcswversion, max(osname) as osname, max(osversion) as osversion, max(devtype) as devtype, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as subtotal from $log-traffic where $filter and (logflag&1>0) and (srcssid is not null or dstssid is not null) group by user_src, ap, srcintf, srcssid, srcmac, hostname_mac /*SkipSTART*/order by bandwidth desc, subtotal desc/*SkipEND*/)### t where srcmac is not null group by os order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-Top-Device-By-Bandwidth |
Top WiFi device by bandwidth usage |
traffic |
select get_devtype(srcswversion, osname, devtype) as devtype_new, sum(bandwidth) as bandwidth from ###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, ap, srcintf, srcssid, srcssid as ssid, srcmac, srcmac as stamac, coalesce(nullifna(`srcname`), `srcmac`) as hostname_mac, max(srcswversion) as srcswversion, max(osname) as osname, max(osversion) as osversion, max(devtype) as devtype, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as subtotal from $log-traffic where $filter and (logflag&1>0) and (srcssid is not null or dstssid is not null) group by user_src, ap, srcintf, srcssid, srcmac, hostname_mac /*SkipSTART*/order by bandwidth desc, subtotal desc/*SkipEND*/)### t where devtype is not null group by devtype_new having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-Top-Device-By-Client |
Top WiFi device by client |
traffic |
select
devtype_new,
count(distinct srcmac) as totalnum
from
(
select
get_devtype(srcswversion, osname, devtype) as devtype_new,
srcmac
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, ap, srcintf, srcssid, srcssid as ssid, srcmac, srcmac as stamac, coalesce(nullifna(`srcname`), `srcmac`) as hostname_mac, max(srcswversion) as srcswversion, max(osname) as osname, max(osversion) as osversion, max(devtype) as devtype, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as subtotal from $log-traffic where $filter and (logflag&1>0) and (srcssid is not null or dstssid is not null) group by user_src, ap, srcintf, srcssid, srcmac, hostname_mac /*SkipSTART*/order by bandwidth desc, subtotal desc/*SkipEND*/)### t where srcmac is not null) t where devtype_new is not null group by devtype_new order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-Overall-Traffic |
WiFi overall traffic |
traffic |
select
sum(bandwidth) as bandwidth
from
(
select
sum(bandwidth) as bandwidth
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, ap, srcintf, srcssid, srcssid as ssid, srcmac, srcmac as stamac, coalesce(nullifna(`srcname`), `srcmac`) as hostname_mac, max(srcswversion) as srcswversion, max(osname) as osname, max(osversion) as osversion, max(devtype) as devtype, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as subtotal from $log-traffic where $filter and (logflag&1>0) and (srcssid is not null or dstssid is not null) group by user_src, ap, srcintf, srcssid, srcmac, hostname_mac /*SkipSTART*/order by bandwidth desc, subtotal desc/*SkipEND*/)### t group by srcssid union all select sum(bandwidth) as bandwidth from ###(select $flex_timestamp as timestamp, stamac, stamac as srcmac, ap, ssid, ssid as srcssid, user_src, sum(coalesce(sentdelta, 0)) as sentdelta, sum(coalesce(rcvddelta, 0)) as rcvddelta, sum(coalesce(sentdelta, 0)+coalesce(rcvddelta, 0)) as bandwidth from (select itime, stamac, ap, ssid, coalesce(`user`, ipstr(`srcip`)) as user_src, sentbyte-lag(coalesce(sentbyte, 0)) over (partition by stamac order by itime) as sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) over (partition by stamac order by itime) as rcvddelta from $log-event where $filter and subtype='wireless' and stamac is not null and ssid is not null and action in ('sta-wl-bridge-traffic-stats', 'reassoc-req', 'assoc-req')) as t group by timestamp, stamac, ap, ssid, user_src /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t) t
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-Num-Distinct-Client |
WiFi num distinct client |
traffic |
select
count(distinct srcmac) as totalnum
from
(
select
srcmac
from
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, ap, srcintf, srcssid, srcssid as ssid, srcmac, srcmac as stamac, coalesce(nullifna(`srcname`), `srcmac`) as hostname_mac, max(srcswversion) as srcswversion, max(osname) as osname, max(osversion) as osversion, max(devtype) as devtype, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as subtotal from $log-traffic where $filter and (logflag&1>0) and (srcssid is not null or dstssid is not null) group by user_src, ap, srcintf, srcssid, srcmac, hostname_mac /*SkipSTART*/order by bandwidth desc, subtotal desc/*SkipEND*/)### t where srcmac is not null group by srcmac union all select stamac as srcmac from ###(select $flex_timestamp as timestamp, stamac, stamac as srcmac, ap, ssid, ssid as srcssid, user_src, sum(coalesce(sentdelta, 0)) as sentdelta, sum(coalesce(rcvddelta, 0)) as rcvddelta, sum(coalesce(sentdelta, 0)+coalesce(rcvddelta, 0)) as bandwidth from (select itime, stamac, ap, ssid, coalesce(`user`, ipstr(`srcip`)) as user_src, sentbyte-lag(coalesce(sentbyte, 0)) over (partition by stamac order by itime) as sentdelta, rcvdbyte-lag(coalesce(rcvdbyte, 0)) over (partition by stamac order by itime) as rcvddelta from $log-event where $filter and subtype='wireless' and stamac is not null and ssid is not null and action in ('sta-wl-bridge-traffic-stats', 'reassoc-req', 'assoc-req')) as t group by timestamp, stamac, ap, ssid, user_src /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t where stamac is not null group by stamac) t
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top30-Subnets-by-Bandwidth-and-Sessions |
Top subnets by application bandwidth |
traffic |
select
ip_subnet(`srcip`) as subnet,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth,
sum(
coalesce(rcvdbyte, 0)
) as traffic_in,
sum(
coalesce(sentbyte, 0)
) as traffic_out,
count(*) as sessions
from
$log
where
$filter
and (
logflag&1>0
)
group by
subnet
having
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
)> 0
order by
bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top30-Subnets-by-Application-Bandwidth |
Top applications by bandwidth |
traffic |
select
ip_subnet(`srcip`) as subnet,
app_group_name(app) as app_group,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth
from
$log
where
$filter
and (
logflag&1>0
)
and nullifna(app) is not null
group by
subnet,
app_group
having
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
)> 0
order by
bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top30-Subnets-by-Application-Sessions |
Top applications by sessions |
traffic |
select
ip_subnet(`srcip`) as subnet,
app_group_name(app) as app_group,
count(*) as sessions
from
$log
where
$filter
and (
logflag&1>0
)
and nullifna(app) is not null
group by
subnet,
app_group
order by
sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top30-Subnets-by-Website-Bandwidth |
Top websites and web category by bandwidth |
traffic |
select
subnet,
website,
sum(bandwidth) as bandwidth
from
###(select ip_subnet(`srcip`) as subnet, hostname as website, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and hostname is not null and (logflag&1>0) and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) group by subnet, website order by bandwidth desc)### t group by subnet, website order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top30-Subnets-by-Website-Hits |
Top websites and web category by sessions |
webfilter |
select subnet, website, sum(hits) as hits from ###(select ip_subnet(`srcip`) as subnet, hostname as website, count(*) as hits from $log where $filter and hostname is not null group by subnet, website order by hits desc)### t group by subnet, website order by hits desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top30-Subnets-with-Top10-User-by-Bandwidth |
Top users by bandwidth |
traffic |
select
ip_subnet(`srcip`) as subnet,
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth
from
$log
where
$filter
and (
logflag&1>0
)
and srcip is not null
group by
subnet,
user_src
having
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
)> 0
order by
bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top30-Subnets-with-Top10-User-by-Sessions |
Top users by sessions |
traffic |
select
ip_subnet(`srcip`) as subnet,
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
count(*) as sessions
from
$log
where
$filter
and (
logflag&1>0
)
group by
subnet,
user_src
order by
sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
app-Top-20-Category-and-Applications-by-Bandwidth |
Top category and applications by bandwidth usage |
traffic |
select
appcat,
app,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth
from
$log
where
$filter
and (
logflag&1>0
)
group by
appcat,
app
having
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
)> 0
order by
bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
app-Top-20-Category-and-Applications-by-Session |
Top category and applications by session |
traffic |
select
appcat,
app,
count(*) as sessions
from
$log
where
$filter
and (
logflag&1>0
)
group by
appcat,
app
order by
sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
app-Top-500-Allowed-Applications-by-Bandwidth |
Top allowed applications by bandwidth usage |
traffic |
select
from_itime(itime) as timestamp,
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
appcat,
app,
coalesce(
root_domain(hostname),
ipstr(dstip)
) as destination,
sum(
coalesce(`sentbyte`, 0)+ coalesce(`rcvdbyte`, 0)
) as bandwidth
from
$log
where
$filter
and (
logflag&1>0
)
and action in (
& #039;accept', 'close', 'timeout') group by timestamp, user_src, appcat, app, destination order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
app-Top-500-Blocked-Applications-by-Session |
Top blocked applications by session |
traffic |
select
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
appcat,
app,
count(*) as sessions
from
$log
where
$filter
and (
logflag&1>0
)
and action in (
& #039;deny', 'blocked', 'reset', 'dropped') group by user_src, appcat, app order by sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
web-Detailed-Website-Browsing-Log |
Web detailed website browsing log |
traffic |
select
from_dtime(dtime) as timestamp,
catdesc,
hostname as website,
status,
sum(bandwidth) as bandwidth
from
###(select dtime, catdesc, hostname, cast(utmaction as text) as status, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and hostname is not null and (logflag&1>0) and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) group by dtime, catdesc, hostname, utmaction order by dtime desc)### t group by dtime, catdesc, website, status order by dtime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
web-Hourly-Category-and-Website-Hits-Action |
Web hourly category and website hits action |
webfilter |
select
hod,
website,
sum(hits) as hits
from
###(select $hour_of_day as hod, (hostname || ' (' || coalesce(`catdesc`, 'Unknown') || ')') as website , count(*) as hits from $log where $filter and hostname is not null group by hod, website order by hod, hits desc)### t group by hod, website order by hod, hits desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
web-Top-20-Category-and-Websites-by-Bandwidth |
Web top category and websites by bandwidth usage |
traffic |
select
website,
catdesc,
sum(bandwidth) as bandwidth
from
###(select hostname as website, catdesc, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and hostname is not null and (logflag&1>0) and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) group by website, catdesc order by bandwidth desc)### t group by website, catdesc order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
web-Top-20-Category-and-Websites-by-Session |
Web top category and websites by session |
webfilter |
select website, catdesc, sum(sessions) as hits from ###(select hostname as website, catdesc, count(*) as sessions from $log where $filter and hostname is not null group by hostname, catdesc order by sessions desc)### t group by website, catdesc order by hits desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
web-Top-500-Website-Sessions-by-Bandwidth |
Web top website sessions by bandwidth usage |
traffic |
select
from_dtime(dtime) as timestamp,
user_src,
website,
catdesc,
cast(
sum(dura)/ 60 as decimal(18, 2)
) as dura,
sum(bandwidth) as bandwidth
from
###(select dtime, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, hostname as website, catdesc, sum(coalesce(duration, 0)) as dura, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter and hostname is not null and (logflag&1>0) and action in ('accept','close','timeout') group by dtime, user_src, website, catdesc having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)### t group by dtime, user_src, website, catdesc order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
web-Top-500-User-Visted-Websites-by-Bandwidth |
Web top user visted websites by bandwidth usage |
traffic |
select
website,
catdesc,
sum(bandwidth) as bandwidth
from
###(select hostname as website, catdesc, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and hostname is not null and (logflag&1>0) and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) group by hostname, catdesc having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)### t group by website, catdesc order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
web-Top-500-User-Visted-Websites-by-Session |
Web top user visted websites by session |
webfilter |
select website, catdesc, sum(sessions) as sessions from ###(select hostname as website, catdesc, count(*) as sessions from $log where $filter and hostname is not null group by hostname, catdesc order by sessions desc)### t where catdesc is not null group by website, catdesc order by sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Installed-Feature-Summary |
Installed Feature Summary |
fct-event |
select subtype, count(distinct fctuid) as totalnum from ###(select uid as fctuid, regexp_replace(os, '\\(build.*', '') as os_short, fctver, subtype, fgtserial, max(case when msg like 'Compliance rules%applied' then 1 else 0 end) as compliance_flag from $log where $filter and subtype != 'admin' group by uid, os_short, fctver, subtype, fgtserial order by compliance_flag desc)### t where subtype is not null group by subtype order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Device-by-Operating-System |
Device by OS |
fct-event |
select os_short as os, count(distinct fctuid) as totalnum from ###(select uid as fctuid, regexp_replace(os, '\\(build.*', '') as os_short, fctver, subtype, fgtserial, max(case when msg like 'Compliance rules%applied' then 1 else 0 end) as compliance_flag from $log where $filter and subtype != 'admin' group by uid, os_short, fctver, subtype, fgtserial order by compliance_flag desc)### t where os_short is not null group by os order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Installed-FortiClient-Version |
FortiClient Version |
fct-event |
select fctver as fctver_short, count(distinct fctuid) as totalnum from ###(select uid as fctuid, regexp_replace(os, '\\(build.*', '') as os_short, fctver, subtype, fgtserial, max(case when msg like 'Compliance rules%applied' then 1 else 0 end) as compliance_flag from $log where $filter and subtype != 'admin' group by uid, os_short, fctver, subtype, fgtserial order by compliance_flag desc)### t where fctver is not null group by fctver order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Endpoint-Profile-Deployment |
Endpoint Profile Deployment |
fct-event |
select profile, count(distinct fctuid) as totalnum from ###(select uid as fctuid, coalesce(nullifna(usingpolicy), 'No Profile') as profile from $log where $filter group by uid, profile)### t group by profile order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Client-Summary |
Client Summary |
fct-event |
select
hostname,
deviceip,
os_short as os,
profile,
fctver,
from_itime(
max(itime)
) as last_seen
from
###(select hostname, deviceip, regexp_replace(os, '\\(build.*', '') as os_short, nullifna(usingpolicy) as profile, fctver, max(itime) as itime from $log where $filter and os is not null group by hostname, deviceip, os_short, profile, fctver order by itime desc)### t group by hostname, deviceip, os, profile, fctver order by last_seen desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Total-Threats-Found |
Total Threats Found |
fct-traffic |
select utmevent_s as utmevent, count(distinct threat) as totalnum from ###(select coalesce(nullifna(lower(utmevent)), 'unknown') as utmevent_s, threat from $log where $filter and threat is not null and utmaction='blocked' group by utmevent_s, threat)### t group by utmevent order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Top10-AV-Threats-Detected |
Top AV Threats Detected |
fct-traffic |
select
threat,
sum(totalnum) as totalnum
from
(
(
select
threat,
sum(totalnum) as totalnum
from
###(select threat, count(*) as totalnum from $log-fct-traffic where $filter and threat is not null and lower(utmevent)='antivirus' group by threat order by totalnum desc)### t group by threat) union all (select threat, sum(totalnum) as totalnum from ###(select virus as threat, count(*) as totalnum from $log-fct-event where $filter and virus is not null group by threat order by totalnum desc)### t group by threat)) t group by threat order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Top10-Infected-Devices-with-Botnet |
Top Infected Devices with Botnet |
fct-traffic |
select
hostname,
count(*) as totalnum
from
$log
where
$filter
and hostname is not null
and lower(utmevent) in (
& #039;webfilter', 'appfirewall') and lower(threat) like '%botnet%' group by hostname order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Top10-Infected-Devices-with-Virus-Malware |
Top Infected Devices with Virus Malware |
fct-traffic |
select
hostname,
sum(totalnum) as totalnum
from
(
(
select
hostname,
sum(totalnum) as totalnum
from
###(select hostname, count(*) as totalnum from $log-fct-traffic where $filter and hostname is not null and lower(utmevent) in ('antivirus', 'antimalware') group by hostname order by totalnum desc)### t group by hostname) union all (select hostname, sum(totalnum) as totalnum from ###(select hostname, count(*) as totalnum from $log-fct-event where $filter and hostname is not null and virus is not null group by hostname order by totalnum desc)### t group by hostname)) t group by hostname order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-All-Antivirus-Antimalware-Detections |
All Antivirus and Antimalware Detections |
fct-traffic |
select
threat,
hostname,
hostuser,
utmaction,
from_dtime(
max(dtime)
) as last_seen
from
(
(
select
threat,
hostname,
hostuser,
utmaction,
max(dtime) as dtime
from
###(select threat, hostname, coalesce(nullifna(`user`), 'Unknown') as hostuser, utmaction, max(dtime) as dtime from $log-fct-traffic where $filter and lower(utmevent) in ('antivirus', 'antimalware') group by threat, hostname, hostuser, utmaction order by threat)### t group by threat, hostname, hostuser, utmaction) union all (select threat, hostname, hostuser, utmaction, max(dtime) as dtime from ###(select virus as threat, hostname, coalesce(nullifna(`user`), 'Unknown') as hostuser, action as utmaction, max(dtime) as dtime from $log-fct-event where $filter and (logflag is null or logflag&8=0) and virus is not null group by threat, hostname, hostuser, utmaction order by threat)### t group by threat, hostname, hostuser, utmaction)) t group by threat, hostname, hostuser, utmaction order by threat
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Web-Filter-Violations |
Web Filter Violations |
fct-traffic |
select
hostuser,
hostname,
string_agg(
distinct remotename,
& #039;,') as remotename, utmaction, sum(total) as totalnum, from_dtime(max(dtime)) as last_seen from ###(select remotename, hostname, coalesce(nullifna(`user`), 'Unknown') as hostuser, utmaction, count(*) as total, max(dtime) as dtime from $log where $filter and lower(utmevent)='webfilter' and utmaction='blocked' group by remotename, hostname, hostuser, utmaction order by total desc)### t group by hostuser, hostname, utmaction order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Application-Firewall |
Application Firewall |
fct-traffic |
select
threat,
hostname,
hostuser,
utmaction,
from_dtime(
max(dtime)
) as last_seen
from
###(select threat, hostname, coalesce(nullifna(`user`), 'Unknown') as hostuser, utmaction, max(dtime) as dtime from $log where $filter and lower(utmevent)='appfirewall' and utmaction='blocked' group by threat, hostname, hostuser, utmaction order by dtime desc)### t1 left join app_mdata t2 on t1.threat=t2.name group by threat, risk, hostname, hostuser, utmaction order by risk desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Errors-and-Alerts |
Errors and Alerts |
fct-event |
select
msg,
hostname,
hostuser,
from_dtime(
max(dtime)
) as last_seen
from
###(select msg, hostname, coalesce(nullifna(`user`), 'Unknown') as hostuser, max(dtime) as dtime from $log where $filter and level in ('error', 'alert') group by msg, hostname, hostuser order by dtime desc)### t group by msg, hostname, hostuser order by last_seen desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Threats-by-Top-Devices |
Threats by Top Devices |
fct-traffic |
select hostname, count(*) as totalnum from $log where $filter and hostname is not null and utmevent is not null and utmaction =& #039;blocked' group by hostname order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-vuln-Device-Vulnerabilities |
Vulnerabilities Detected by User/Device |
fct-netscan |
select
vulnseverity,
(
CASE vulnseverity WHEN & #039;Critical' THEN 5 WHEN 'High' THEN 4 WHEN 'Medium' THEN 3 WHEN 'Info' THEN 2 WHEN 'Low' THEN 1 ELSE 0 END) as severity_number, count(distinct vulnname) as vuln_num from ###(select vulnseverity, devid, vulnname from $log where $filter and nullifna(vulnseverity) is not null and nullifna(vulnname) is not null group by vulnseverity, vulnname, devid)### t group by vulnseverity order by severity_number desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-vuln-Category-Type-Vulnerabilities |
Vulnerabilities Detected by Category Type |
fct-netscan |
select vulncat, count(distinct vulnname) as totalnum from ###(select vulncat, vulnname from $log where $filter and nullifna(vulncat) is not null and nullifna(vulnname) is not null group by vulncat, vulnname)### t group by vulncat order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-vuln-Vulnerabilities-by-OS |
Forticlient Vulnerabilities by OS |
fct-netscan |
select os, count(distinct vulnname) as totalnum from ###(select os, vulnname from $log where $filter and nullifna(os) is not null and nullifna(vulnname) is not null group by os, vulnname)### t group by os order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-vuln-Vulnerabilities-by-Risk-Level |
Number Vulnerability by Device and Risk Level |
fct-netscan |
select
vulnseverity,
(
case when vulnseverity =& #039;Critical' then 5 when vulnseverity='High' then 4 when vulnseverity='Medium' then 3 when vulnseverity='Low' then 2 when vulnseverity='Info' then 1 else 0 end) as severity_number, count(distinct vulnname) as vuln_num, count(distinct devid) as dev_num from ###(select vulnseverity, devid, vulnname from $log where $filter and nullifna(vulnseverity) is not null and nullifna(vulnname) is not null group by vulnseverity, vulnname, devid)### t where nullifna(devid) is not null group by vulnseverity order by dev_num desc, severity_number desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-vuln-Device-by-Risk-Level |
Number Vulnerability by Device and Risk Level |
fct-netscan |
select
vulnseverity,
(
case when vulnseverity =& #039;Critical' then 5 when vulnseverity='High' then 4 when vulnseverity='Medium' then 3 when vulnseverity='Low' then 2 when vulnseverity='Info' then 1 else 0 end) as severity_number, count(distinct vulnname) as vuln_num, count(distinct devid) as dev_num from ###(select vulnseverity, devid, vulnname from $log where $filter and nullifna(vulnseverity) is not null and nullifna(vulnname) is not null group by vulnseverity, vulnname, devid)### t where nullifna(devid) is not null group by vulnseverity order by dev_num desc, severity_number desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-vuln-Vulnerability-Trend |
Vulnerability Trend |
fct-netscan |
select $flex_timescale(timestamp) as hodex, count(distinct vulnname) as total_num from ###(select $flex_timestamp as timestamp, vulnname from $log where $filter and nullifna(vulnname) is not null group by timestamp, vulnname order by timestamp desc)### t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-vuln-Details-by-Risk-Level-Device |
Vulnerability Details for Each Risk Level by Device |
fct-netscan |
select hostname, os, vulnseverity, count(distinct vulnname) as vuln_num, count(distinct products) as products, count(distinct cve_id) as cve_count from ###(select hostname, os, vulnname, vulnseverity, vulnid from $log where $filter and vulnname is not null and vulnseverity is not null and hostname is not null group by hostname, os, vulnname, vulnseverity, vulnid)### t1 left join fct_mdata t2 on t1.vulnid=t2.vid::int group by hostname, os, vulnseverity order by vuln_num desc, hostname
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-vuln-Details-by-Device-User |
Vulnerability Details by Device User |
fct-netscan |
select
hostname,
(
& #039;<div>' || vulnname || '</div>') as vulnname, vulnseverity, vulncat, string_agg(distinct products, ',') as products, string_agg(distinct cve_id, ',') as cve_list, ('<a href=' || String_agg(DISTINCT vendor_link, ',') || '>Remediation Info</a>') as vendor_link from ###(select hostname, vulnname, vulnseverity, vulncat, vulnid from $log where $filter and vulnname is not null and hostname is not null group by hostname, vulnname, vulnseverity, vulncat, vulnid)### t1 inner join fct_mdata t2 on t1.vulnid=t2.vid::int group by hostname, vulnname, vulnseverity, vulncat order by hostname
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-vuln-Remediation-by-Device |
Remediate The Vulnerability Found on Device |
fct-netscan |
select
hostname,
(
& #039;<div>' || vulnname || '</div>') as vulnname, vulnseverity, string_agg(distinct vendor_link, ',') as vendor_link from ###(select hostname, vulnname, vulnseverity, vulnid from $log where $filter and vulnname is not null and hostname is not null group by hostname, vulnname, vulnseverity, vulnid)### t1 inner join fct_mdata t2 on t1.vulnid=t2.vid::int group by hostname, vulnname, vulnseverity order by vulnseverity, hostname
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-vuln-Remediation-by-Vulnerability |
Remediation by Vulnerability |
fct-netscan |
select
(
& #039;<b>' || vulnname || '</b><br/><br/>' || 'Description<br/><div style=word-break:normal>' || description || '</div><br/><br/>' || 'Affected Products<br/>' || products || '<br/><br/>' || 'Impact<br/>' || impact || '<br/><br/>' || 'Recommended Actions<br/>' || vendor_link || '<br/><br/><br/>') as remediation from ###(select devid, vulnname, vulnseverity, (case vulnseverity when 'low' then 1 when 'info' then 2 when 'medium' then 3 when 'high' then 4 when 'critical' then 5 else 0 end) as severity_level, vulnid from $log where $filter and vulnname is not null group by devid, vulnname, vulnseverity, severity_level, vulnid order by severity_level)### t1 inner join fct_mdata t2 on t1.vulnid=t2.vid::int group by remediation order by remediation
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-vuln-Top-30-Targeted-High-Risk-Vulnerabilities |
Top 30 Targeted High Risk Vulnerabilities |
fct-netscan |
select
t3.cve_id,
score,
string_agg(
distinct products,
& #039;,') as products, ('<a href=' || String_agg(vendor_link, ',') || '>Mitigation Infomation</a>') as vendor_link from ###(select vulnid from $log where $filter group by vulnid)### t1 inner join fct_mdata t2 on t2.vid=t1.vulnid::text inner join fct_cve_score t3 on strpos(t2.cve_id, t3.cve_id) > 0 group by t3.cve_id, score order by score desc, t3.cve_id
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Endpoints-by-FortiGate |
Endpoints by FortiGate |
fct-event |
select fgtserial, count(distinct fctuid) as totalnum from ###(select uid as fctuid, regexp_replace(os, '\\(build.*', '') as os_short, fctver, subtype, fgtserial, max(case when msg like 'Compliance rules%applied' then 1 else 0 end) as compliance_flag from $log where $filter and subtype != 'admin' group by uid, os_short, fctver, subtype, fgtserial order by compliance_flag desc)### t where fgtserial is not null group by fgtserial order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Top-Malware-Detections |
Top Infected Devices with Malware |
fct-traffic |
select
hostname,
fctuid,
sum(totalnum) as totalnum
from
(
(
select
hostname,
fctuid,
sum(totalnum) as totalnum
from
###(select threat, hostname, coalesce(nullifna(`user`), 'Unknown') as hostuser, utmaction, max(dtime) as dtime, uid as fctuid, count(*) as totalnum from $log-fct-traffic where $filter and lower(utmevent) in ('antivirus', 'antimalware') group by threat, hostname, hostuser, utmaction, uid order by threat)### t group by hostname, fctuid) union all (select hostname, fctuid, sum(totalnum) as totalnum from ###(select virus as threat, hostname, coalesce(nullifna(`user`), 'Unknown') as hostuser, action as utmaction, max(dtime) as dtime, uid as fctuid, count(*) as totalnum from $log-fct-event where $filter and (logflag is null or logflag&8=0) and virus is not null group by threat, hostname, hostuser, utmaction, uid order by threat)### t group by hostname, fctuid)) t group by hostname, fctuid order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Top10-Malware-Detections |
Top 10 Infected Devices with Malware |
fct-traffic |
select
threat,
hostname,
hostuser,
utmaction,
fctuid,
sum(totalnum) as totalnum
from
(
(
select
threat,
hostname,
hostuser,
utmaction,
fctuid,
sum(totalnum) as totalnum
from
###(select threat, hostname, coalesce(nullifna(`user`), 'Unknown') as hostuser, utmaction, max(dtime) as dtime, uid as fctuid, count(*) as totalnum from $log-fct-traffic where $filter and lower(utmevent) in ('antivirus', 'antimalware') group by threat, hostname, hostuser, utmaction, uid order by threat)### t group by threat, hostname, hostuser, utmaction, fctuid) union all (select threat, hostname, hostuser, utmaction, fctuid, sum(totalnum) as totalnum from ###(select virus as threat, hostname, coalesce(nullifna(`user`), 'Unknown') as hostuser, action as utmaction, max(dtime) as dtime, uid as fctuid, count(*) as totalnum from $log-fct-event where $filter and (logflag is null or logflag&8=0) and virus is not null group by threat, hostname, hostuser, utmaction, uid order by threat)### t group by threat, hostname, hostuser, utmaction, fctuid)) t where utmaction != 'pass' group by threat, hostname, hostuser, utmaction, fctuid order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Devices-with-Botnet |
Infected Devices with Botnet |
fct-traffic |
select
threat,
hostname,
coalesce(
nullifna(`user`),
& #039;Unknown') as hostuser, utmaction, uid as fctuid, count(*) as totalnum from $log where $filter and hostname is not null and lower(utmevent) in ('webfilter', 'appfirewall') and lower(threat) like '%botnet%' group by threat, hostname, hostuser, utmaction, fctuid order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-vuln-Vulnerability-by-Hostname |
Vulnerability Details for Each Risk Level by Device |
fct-netscan |
select hostname, os, vulnseverity, count(distinct vulnname) as vuln_num, count(distinct products) as products, count(distinct cve_id) as cve_count from ###(select hostname, os, vulnname, vulnseverity, vulnid from $log where $filter and vulnname is not null and vulnseverity is not null and hostname is not null group by hostname, os, vulnname, vulnseverity, vulnid)### t1 left join fct_mdata t2 on t1.vulnid=t2.vid::int group by hostname, os, vulnseverity order by vuln_num desc, hostname
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Users-With-Web-Violations |
Web Filter Violations |
fct-traffic |
select
hostuser,
hostname,
string_agg(
distinct remotename,
& #039;,') as remotename, utmaction, sum(total) as totalnum, from_dtime(max(dtime)) as last_seen from ###(select remotename, hostname, coalesce(nullifna(`user`), 'Unknown') as hostuser, utmaction, count(*) as total, max(dtime) as dtime from $log where $filter and lower(utmevent)='webfilter' and utmaction='blocked' group by remotename, hostname, hostuser, utmaction order by total desc)### t group by hostuser, hostname, utmaction order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Compliance-by-FortiGate |
FortiClinet Compliance by FortiGate Enforcing |
fct-event |
select
fgtserial,
count(distinct fctuid) as totalnum
from
(
select
fgtserial,
fctuid,
max(compliance_flag) as compliance_flag
from
###(select uid as fctuid, regexp_replace(os, '\\(build.*', '') as os_short, fctver, subtype, fgtserial, max(case when msg like 'Compliance rules%applied' then 1 else 0 end) as compliance_flag from $log where $filter and subtype != 'admin' group by uid, os_short, fctver, subtype, fgtserial order by compliance_flag desc)### tt group by fgtserial, fctuid) t where compliance_flag = 1 group by fgtserial order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Compliance-Status |
Number of FortiClinets by Compliance Status |
fct-event |
select
(
case compliance_flag when 1 then & #039;Compliant' else 'Non-Compliant' end) as compliance, count(distinct fctuid) as totalnum from (select fctuid, max(compliance_flag) as compliance_flag from ###(select uid as fctuid, regexp_replace(os, '\\(build.*', '') as os_short, fctver, subtype, fgtserial, max(case when msg like 'Compliance rules%applied' then 1 else 0 end) as compliance_flag from $log where $filter and subtype != 'admin' group by uid, os_short, fctver, subtype, fgtserial order by compliance_flag desc)### tt group by fctuid) t group by compliance order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Non-Compliant-Endpoints |
Non-compliant Endpoints |
fct-event |
select t1.fgtserial, t3.srcintf, t2.epname as hostname, t2.mac, & #039;Non-Compliant' as status from (select fgtserial, fctuid, max(compliance_flag) as compliance_flag from ###(select uid as fctuid, regexp_replace(os, '\\(build.*', '') as os_short, fctver, subtype, fgtserial, max(case when msg like 'Compliance rules%applied' then 1 else 0 end) as compliance_flag from $log where $filter and subtype != 'admin' group by uid, os_short, fctver, subtype, fgtserial order by compliance_flag desc)### tt group by fgtserial, fctuid) t1 left join $ADOM_ENDPOINT t2 on t1.fctuid = t2.fctuid left join $ADOM_EPEU_DEVMAP t3 on t2.epid = t3.epid where compliance_flag = 0 group by t1.fctuid, t1.fgtserial, t3.srcintf, t2.epname, t2.mac
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Traffic-Web-Hits |
Web Traffic Trend |
fct-traffic |
select $flex_timescale(timestamp) as hodex, sum(requests) as requests from ###(select $flex_timestamp as timestamp, count(*) as requests from $log where $filter and lower(utmevent)='webfilter' group by timestamp order by timestamp desc)### t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Traffic-Top-Allowed-Web-Cat |
Top Visited Web Categories |
fct-traffic |
select category, sum(requests) as requests from ###(select fct_webcat(threat) as category, remotename as website, direction, utmaction, count(*) as requests from $log where $filter and threat is not null and lower(utmevent)='webfilter' group by category, website, direction, utmaction order by requests desc)### t where direction='outbound' and utmaction='passthrough' group by category order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Traffic-Top-Allowed-Website |
Top Visited Websites |
fct-traffic |
select
website,
string_agg(
distinct category,
& #039;, ') as agg_category, sum(requests) as requests from ###(select fct_webcat(threat) as category, remotename as website, direction, utmaction, count(*) as requests from $log where $filter and threat is not null and lower(utmevent)='webfilter' group by category, website, direction, utmaction order by requests desc)### t where direction='outbound' and utmaction='passthrough' and website is not null group by website order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Traffic-Top-Category-By-Website-Session |
Top Web Categories by Website Session |
fct-traffic |
select category, website, sum(requests) as requests from ###(select fct_webcat(threat) as category, remotename as website, direction, utmaction, count(*) as requests from $log where $filter and threat is not null and lower(utmevent)='webfilter' group by category, website, direction, utmaction order by requests desc)### t where nullifna(category) is not null group by category, website order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
fct-Traffic-Top-Web-Users-By-Website |
Top Web Users by Website |
fct-traffic |
select
coalesce(
nullifna(`user`),
ipstr(`srcip`)
) as user_src,
remotename as website,
count(*) as requests
from
$log
where
$filter
and direction =& #039;outbound' and remotename is not null and utmaction='passthrough' and lower(utmevent)='webfilter' group by user_src, website order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
os-Detect-OS-Count |
Detected operation system count |
traffic |
select
(
coalesce(
osname,
& #039;Unknown')) as os, count(*) as totalnum from $log where $filter and (logflag&1>0) group by os order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-App-By-Sessions-Table |
Drilldown top applications by session count |
traffic |
select appid, app, sum(sessions) as sessions from ###(select appid, app, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, dstip, srcintf, dstintf, policyid, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) group by appid, app, user_src, dstip, srcintf, dstintf, policyid order by sessions desc)### t where $filter-drilldown and nullifna(app) is not null group by appid, app order by sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-App-By-Sessions-Bar |
Drilldown top applications by session count |
traffic |
select appid, app, sum(sessions) as sessions from ###(select appid, app, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, dstip, srcintf, dstintf, policyid, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) group by appid, app, user_src, dstip, srcintf, dstintf, policyid order by sessions desc)### t where $filter-drilldown and nullifna(app) is not null group by appid, app order by sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-App-By-Bandwidth-Table |
Drilldown top applications by bandwidth usage |
traffic |
select appid, app, sum(bandwidth) as bandwidth from ###(select appid, app, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, dstip, srcintf, dstintf, policyid, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) group by appid, app, user_src, dstip, srcintf, dstintf, policyid order by sessions desc)### t where $filter-drilldown and nullifna(app) is not null group by appid, app having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-App-By-Bandwidth-Bar |
Drilldown top applications by bandwidth usage |
traffic |
select appid, app, sum(bandwidth) as bandwidth from ###(select appid, app, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, dstip, srcintf, dstintf, policyid, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) group by appid, app, user_src, dstip, srcintf, dstintf, policyid order by sessions desc)### t where $filter-drilldown and nullifna(app) is not null group by appid, app having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Destination-By-Sessions-Table |
Drilldown top destination by session count |
traffic |
select dstip, sum(sessions) as sessions from ###(select appid, app, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, dstip, srcintf, dstintf, policyid, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) group by appid, app, user_src, dstip, srcintf, dstintf, policyid order by sessions desc)### t where $filter-drilldown and dstip is not null group by dstip order by sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Destination-By-Bandwidth-Table |
Drilldown top destination by bandwidth usage |
traffic |
select dstip, sum(bandwidth) as bandwidth from ###(select appid, app, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, dstip, srcintf, dstintf, policyid, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) group by appid, app, user_src, dstip, srcintf, dstintf, policyid order by sessions desc)### t where $filter-drilldown and dstip is not null group by dstip having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-User-By-Sessions-Table |
Drilldown top user by session count |
traffic |
select user_src, sum(sessions) as sessions from ###(select appid, app, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, dstip, srcintf, dstintf, policyid, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) group by appid, app, user_src, dstip, srcintf, dstintf, policyid order by sessions desc)### t where $filter-drilldown and user_src is not null group by user_src order by sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-User-By-Sessions-Bar |
Drilldown top user by session count |
traffic |
select user_src, sum(sessions) as sessions from ###(select appid, app, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, dstip, srcintf, dstintf, policyid, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) group by appid, app, user_src, dstip, srcintf, dstintf, policyid order by sessions desc)### t where $filter-drilldown and user_src is not null group by user_src order by sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-User-By-Bandwidth-Table |
Drilldown top user by bandwidth usage |
traffic |
select user_src, sum(bandwidth) as bandwidth from ###(select appid, app, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, dstip, srcintf, dstintf, policyid, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) group by appid, app, user_src, dstip, srcintf, dstintf, policyid order by sessions desc)### t where $filter-drilldown and user_src is not null group by user_src having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-User-By-Bandwidth-Bar |
Drilldown top user by bandwidth usage |
traffic |
select user_src, sum(bandwidth) as bandwidth from ###(select appid, app, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, dstip, srcintf, dstintf, policyid, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) group by appid, app, user_src, dstip, srcintf, dstintf, policyid order by sessions desc)### t where $filter-drilldown and user_src is not null group by user_src having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Web-User-By-Visit-Table |
Drilldown top web user by visit |
traffic |
select
user_src,
sum(requests) as visits
from
(
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, hostname, count(*) as requests from $log-traffic where $filter-exclude-var and (logflag&1>0) and utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter') and hostname is not null group by user_src, hostname order by requests desc)### union all ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, hostname, count(*) as requests from $log-webfilter where $filter-exclude-var and hostname is not null group by user_src, hostname order by requests desc)###) t where $filter-drilldown and user_src is not null group by user_src order by visits desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Web-User-By-Visit-Bar |
Drilldown top web user by visit |
traffic |
select
user_src,
sum(requests) as visits
from
(
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, hostname, count(*) as requests from $log-traffic where $filter-exclude-var and (logflag&1>0) and utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter') and hostname is not null group by user_src, hostname order by requests desc)### union all ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, hostname, count(*) as requests from $log-webfilter where $filter-exclude-var and hostname is not null group by user_src, hostname order by requests desc)###) t where $filter-drilldown and user_src is not null group by user_src order by visits desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Website-By-Request-Table |
Drilldown top website by request |
traffic |
select
hostname,
sum(requests) as visits
from
(
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, hostname, count(*) as requests from $log-traffic where $filter-exclude-var and (logflag&1>0) and utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter') and hostname is not null group by user_src, hostname order by requests desc)### union all ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, hostname, count(*) as requests from $log-webfilter where $filter-exclude-var and hostname is not null group by user_src, hostname order by requests desc)###) t where $filter-drilldown and hostname is not null group by hostname order by visits desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Website-By-Request-Bar |
Drilldown top website by request |
traffic |
select
hostname,
sum(requests) as visits
from
(
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, hostname, count(*) as requests from $log-traffic where $filter-exclude-var and (logflag&1>0) and utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter') and hostname is not null group by user_src, hostname order by requests desc)### union all ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, hostname, count(*) as requests from $log-webfilter where $filter-exclude-var and hostname is not null group by user_src, hostname order by requests desc)###) t where $filter-drilldown and hostname is not null group by hostname order by visits desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Email-Sender-By-Volume |
Drilldown top email sender by volume |
traffic |
select
sender,
sum(bandwidth) as volume
from
(
###(select sender, recipient, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter-exclude-var and (logflag&1>0) and service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') and utmevent in ('general-email-log', 'spamfilter') group by sender, recipient order by requests desc)### union all ###(select `from` as sender, `to` as recipient, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-emailfilter where $filter-exclude-var and service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') and eventtype is null group by `from`, `to` order by requests desc)###) t where $filter-drilldown and sender is not null group by sender having sum(bandwidth)>0 order by volume desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Email-Send-Recipient-By-Volume |
Drilldown top email send recipient by volume |
traffic |
select
recipient,
sum(bandwidth) as volume
from
(
###(select sender, recipient, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter-exclude-var and (logflag&1>0) and service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') and utmevent in ('general-email-log', 'spamfilter') group by sender, recipient order by requests desc)### union all ###(select `from` as sender, `to` as recipient, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-emailfilter where $filter-exclude-var and service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') and eventtype is null group by `from`, `to` order by requests desc)###) t where $filter-drilldown and recipient is not null group by recipient having sum(bandwidth)>0 order by volume desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Email-Sender-By-Count |
Drilldown top email sender by count |
traffic |
select
sender,
sum(requests) as requests
from
(
###(select sender, recipient, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter-exclude-var and (logflag&1>0) and service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') and utmevent in ('general-email-log', 'spamfilter') group by sender, recipient order by requests desc)### union all ###(select `from` as sender, `to` as recipient, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-emailfilter where $filter-exclude-var and service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') and eventtype is null group by `from`, `to` order by requests desc)###) t where $filter-drilldown and sender is not null group by sender order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Email-Send-Recipient-By-Count |
Drilldown top email send recipient by count |
traffic |
select
recipient,
sum(requests) as requests
from
(
###(select sender, recipient, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter-exclude-var and (logflag&1>0) and service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') and utmevent in ('general-email-log', 'spamfilter') group by sender, recipient order by requests desc)### union all ###(select `from` as sender, `to` as recipient, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-emailfilter where $filter-exclude-var and service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') and eventtype is null group by `from`, `to` order by requests desc)###) t where $filter-drilldown and recipient is not null group by recipient order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Email-Recipient-By-Volume |
Drilldown top email receiver by volume |
traffic |
select
recipient,
sum(bandwidth) as volume
from
(
###(select recipient, sender, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) and service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp') and utmevent in ('general-email-log', 'spamfilter') group by recipient, sender order by requests desc)### union all ###(select `to` as recipient, `from` as sender, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-emailfilter where $filter-exclude-var and service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp') and eventtype is null group by `to`, `from` order by requests desc)###) t where $filter-drilldown and recipient is not null group by recipient having sum(bandwidth)>0 order by volume desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Email-Receive-Sender-By-Volume |
Drilldown top email receive sender by volume |
traffic |
select
sender,
sum(bandwidth) as volume
from
(
###(select recipient, sender, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) and service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp') and utmevent in ('general-email-log', 'spamfilter') group by recipient, sender order by requests desc)### union all ###(select `to` as recipient, `from` as sender, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-emailfilter where $filter-exclude-var and service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp') and eventtype is null group by `to`, `from` order by requests desc)###) t where $filter-drilldown and sender is not null group by sender having sum(bandwidth)>0 order by volume desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Email-Recipient-By-Count |
Drilldown top email receiver by count |
traffic |
select
recipient,
sum(requests) as requests
from
(
###(select recipient, sender, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) and service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp') and utmevent in ('general-email-log', 'spamfilter') group by recipient, sender order by requests desc)### union all ###(select `to` as recipient, `from` as sender, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-emailfilter where $filter-exclude-var and service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp') and eventtype is null group by `to`, `from` order by requests desc)###) t where $filter-drilldown and recipient is not null group by recipient order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Email-Receive-Sender-By-Count |
Drilldown top email receive sender by count |
traffic |
select
sender,
sum(requests) as requests
from
(
###(select recipient, sender, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter-exclude-var and (logflag&1>0) and service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp') and utmevent in ('general-email-log', 'spamfilter') group by recipient, sender order by requests desc)### union all ###(select `to` as recipient, `from` as sender, count(*) as requests, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-emailfilter where $filter-exclude-var and service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp') and eventtype is null group by `to`, `from` order by requests desc)###) t where $filter-drilldown and sender is not null group by sender order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Attack-Destination |
Drilldown top attack dest |
attack |
select victim, sum(totalnum) as totalnum from ###(select (CASE WHEN direction='incoming' THEN dstip ELSE srcip END) as source, (CASE WHEN direction='incoming' THEN srcip ELSE dstip END) as victim, count(*) as totalnum from $log where $filter-exclude-var group by source, victim order by totalnum desc)### t where $filter-drilldown and victim is not null group by victim order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Attack-Source |
Drilldown top attack source |
attack |
select source, sum(totalnum) as totalnum from ###(select (CASE WHEN direction='incoming' THEN dstip ELSE srcip END) as source, (CASE WHEN direction='incoming' THEN srcip ELSE dstip END) as victim, count(*) as totalnum from $log where $filter-exclude-var group by source, victim order by totalnum desc)### t where $filter-drilldown and source is not null group by source order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Attack-List |
Drilldown top attack list |
attack |
select from_itime(itime) as timestamp, attack, source, victim from ###(select itime, attack, (CASE WHEN direction='incoming' THEN dstip ELSE srcip END) as source, (CASE WHEN direction='incoming' THEN srcip ELSE dstip END) as victim from $log where $filter-exclude-var order by itime desc)### t where $filter-drilldown order by timestamp desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Top-Virus |
UTM top virus |
virus |
select
virus,
max(virusid_s) as virusid,
(
case when virus like & #039;Riskware%' then 'Spyware' when virus like 'Adware%' then 'Adware' else 'Virus' end) as malware_type, sum(totalnum) as totalnum from ###(select virus, virusid_to_str(virusid, eventtype) as virusid_s, count(*) as totalnum from $log where $filter and nullifna(virus) is not null group by virus, virusid_s /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t group by virus, malware_type order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
drilldown-Virus-Detail |
Drilldown virus detail |
virus |
select
from_itime(itime) as timestamp,
virus,
user_src,
victim,
hostname,
recipient
from
###(select itime, virus, coalesce(nullifna(`user`), ipstr((CASE WHEN direction='incoming' THEN dstip ELSE srcip END))) as user_src, (CASE WHEN direction='incoming' THEN srcip ELSE dstip END) as victim, cast(' ' as char) as hostname, cast(' ' as char) as recipient from $log where $filter and nullifna(virus) is not null order by itime desc)### t where $filter-drilldown order by timestamp desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
user-drilldown-Top-Blocked-Web-Sites-By-Requests |
User drilldown top blocked web sites by requests |
webfilter |
select hostname, sum(requests) as requests from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as usersrc, euid, hostname, catdesc, action, count(*) as requests from $log where $filter group by usersrc, euid, hostname, catdesc, action order by requests desc)### t where $filter-drilldown and action='blocked' and hostname is not null group by hostname order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
user-drilldown-Top-Allowed-Web-Sites-By-Requests |
User drilldown top allowed web sites by requests |
webfilter |
select hostname, sum(requests) as requests from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as usersrc, euid, hostname, catdesc, action, count(*) as requests from $log where $filter group by usersrc, euid, hostname, catdesc, action order by requests desc)### t where $filter-drilldown and action!='blocked' and hostname is not null group by hostname order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
user-drilldown-Top-Blocked-Web-Categories |
User drilldown top blocked web categories |
webfilter |
select catdesc, sum(requests) as requests from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, catdesc, action, count(*) as requests from $log where $filter and catdesc is not null group by user_src, catdesc, action order by requests desc)### t where $filter-drilldown and action='blocked' group by catdesc order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
user-drilldown-Top-Allowed-Web-Categories |
User drilldown top allowed web categories |
webfilter |
select catdesc, sum(requests) as requests from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, catdesc, action, count(*) as requests from $log where $filter and catdesc is not null group by user_src, catdesc, action order by requests desc)### t where $filter-drilldown and action!='blocked' group by catdesc order by requests desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
user-drilldown-Top-Attacks |
User drilldown top attacks by name |
attack |
select
attack,
sum(attack_count) as attack_count
from
###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, attack, (case when severity in ('critical', 'high') then 1 else 0 end) as high_severity, count(*) as attack_count from $log where $filter and nullifna(attack) is not null group by user_src, attack, high_severity order by attack_count desc)### t where $filter-drilldown group by attack order by attack_count desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
user-drilldown-Top-Attacks-High-Severity |
User drilldown top attacks high severity |
attack |
select
attack,
sum(attack_count) as attack_count
from
###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, attack, (case when severity in ('critical', 'high') then 1 else 0 end) as high_severity, count(*) as attack_count from $log where $filter and nullifna(attack) is not null group by user_src, attack, high_severity order by attack_count desc)### t where $filter-drilldown and high_severity=1 group by attack order by attack_count desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
user-drilldown-Top-Virus-By-Name |
User drilldown top virus |
virus |
select virus, max(virusid_s) as virusid, sum(totalnum) as totalnum from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, virus, virusid_to_str(virusid, eventtype) as virusid_s, count(*) as totalnum from $log where $filter and nullifna(virus) is not null group by user_src, virus, virusid_s order by totalnum desc)### t where $filter-drilldown group by virus order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
user-drilldown-Top-Virus-Receivers-Over-Email |
User drilldown top virus receivers over email |
virus |
select
receiver,
sum(totalnum) as totalnum
from
###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, `to` as receiver, count(*) as totalnum from $log where $filter and subtype='infected' and (service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') or service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp')) and nullifna(virus) is not null group by user_src, receiver order by totalnum desc)### t where $filter-drilldown group by receiver order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
user-drilldown-Count-Spam-Activity-by-Hour-of-Day |
User drilldown count spam activity by hour of day |
emailfilter |
select
$hour_of_day(timestamp) as hourstamp,
sum(totalnum) as totalnum
from
###(select $flex_timestamp as timestamp, coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, `from` as mf_sender, `to` as mf_receiver, action, eventtype, count(*) as totalnum from $log where $filter group by timestamp, user_src, mf_sender, mf_receiver, action, eventtype /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t where $filter-drilldown and mf_receiver is not null and action in ('detected', 'blocked') group by hourstamp order by hourstamp
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
user-drilldown-Top-Spam-Sources |
User drilldown top spam sources |
emailfilter |
select
mf_sender,
sum(totalnum) as totalnum
from
###(select $flex_timestamp as timestamp, coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, `from` as mf_sender, `to` as mf_receiver, action, eventtype, count(*) as totalnum from $log where $filter group by timestamp, user_src, mf_sender, mf_receiver, action, eventtype /*SkipSTART*/order by timestamp desc/*SkipEND*/)### t where $filter-drilldown and mf_sender is not null and action in ('detected', 'blocked') group by mf_sender order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Usage-CPU |
Event usage CPU |
event |
select
$hour_of_day(timestamp) as hourstamp,
cast(
sum(total_cpu)/ sum(count) as decimal(6, 2)
) as cpu_avg_usage
from
###(select $flex_timestamp as timestamp, devid, slot, sum(coalesce(trate, 0)) as total_trate, sum(coalesce(erate, 0)) as total_erate, sum(coalesce(orate, 0)) as total_orate, min(itime) as first_seen, max(itime) as last_seen, sum(coalesce(mem, 0)) as total_mem, max(coalesce(mem, 0)) as mem_peak, sum(coalesce(disk, 0)) as total_disk, max(coalesce(disk, 0)) as disk_peak, sum(coalesce(cpu, 0)) as total_cpu, max(coalesce(cpu, 0)) as cpu_peak, max(coalesce(trate, 0)+coalesce(erate, 0)+coalesce(orate, 0)) as lograte_peak, sum(coalesce(totalsession, 0)) as totalsession, max(coalesce(totalsession, 0)) as session_peak, sum(cast(coalesce(split_part(bandwidth, '/', 1), '0') as integer)) as sent, sum(cast(coalesce(split_part(bandwidth, '/', 2), '0') as integer)) as recv, max(cast(coalesce(split_part(bandwidth, '/', 1), '0') as integer)+cast(coalesce(split_part(bandwidth, '/', 2), '0') as integer)) as transmit_peak, sum(coalesce(setuprate, 0)) as cps, max(coalesce(setuprate, 0)) as cps_peak, count(*) as count from $log where $filter and subtype='system' and action='perf-stats' group by timestamp, devid, slot order by total_mem desc)### t group by hourstamp order by hourstamp
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Usage-Memory |
Event usage memory |
event |
select
$hour_of_day(timestamp) as hourstamp,
cast(
sum(total_mem)/ sum(count) as decimal(6, 2)
) as mem_avg_usage
from
###(select $flex_timestamp as timestamp, devid, slot, sum(coalesce(trate, 0)) as total_trate, sum(coalesce(erate, 0)) as total_erate, sum(coalesce(orate, 0)) as total_orate, min(itime) as first_seen, max(itime) as last_seen, sum(coalesce(mem, 0)) as total_mem, max(coalesce(mem, 0)) as mem_peak, sum(coalesce(disk, 0)) as total_disk, max(coalesce(disk, 0)) as disk_peak, sum(coalesce(cpu, 0)) as total_cpu, max(coalesce(cpu, 0)) as cpu_peak, max(coalesce(trate, 0)+coalesce(erate, 0)+coalesce(orate, 0)) as lograte_peak, sum(coalesce(totalsession, 0)) as totalsession, max(coalesce(totalsession, 0)) as session_peak, sum(cast(coalesce(split_part(bandwidth, '/', 1), '0') as integer)) as sent, sum(cast(coalesce(split_part(bandwidth, '/', 2), '0') as integer)) as recv, max(cast(coalesce(split_part(bandwidth, '/', 1), '0') as integer)+cast(coalesce(split_part(bandwidth, '/', 2), '0') as integer)) as transmit_peak, sum(coalesce(setuprate, 0)) as cps, max(coalesce(setuprate, 0)) as cps_peak, count(*) as count from $log where $filter and subtype='system' and action='perf-stats' group by timestamp, devid, slot order by total_mem desc)### t group by hourstamp order by hourstamp
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Usage-Sessions |
Event usage sessions |
event |
select
$hour_of_day(timestamp) as hourstamp,
cast(
sum(totalsession)/ sum(count) as decimal(10, 2)
) as sess_avg_usage
from
###(select $flex_timestamp as timestamp, devid, slot, sum(coalesce(trate, 0)) as total_trate, sum(coalesce(erate, 0)) as total_erate, sum(coalesce(orate, 0)) as total_orate, min(itime) as first_seen, max(itime) as last_seen, sum(coalesce(mem, 0)) as total_mem, max(coalesce(mem, 0)) as mem_peak, sum(coalesce(disk, 0)) as total_disk, max(coalesce(disk, 0)) as disk_peak, sum(coalesce(cpu, 0)) as total_cpu, max(coalesce(cpu, 0)) as cpu_peak, max(coalesce(trate, 0)+coalesce(erate, 0)+coalesce(orate, 0)) as lograte_peak, sum(coalesce(totalsession, 0)) as totalsession, max(coalesce(totalsession, 0)) as session_peak, sum(cast(coalesce(split_part(bandwidth, '/', 1), '0') as integer)) as sent, sum(cast(coalesce(split_part(bandwidth, '/', 2), '0') as integer)) as recv, max(cast(coalesce(split_part(bandwidth, '/', 1), '0') as integer)+cast(coalesce(split_part(bandwidth, '/', 2), '0') as integer)) as transmit_peak, sum(coalesce(setuprate, 0)) as cps, max(coalesce(setuprate, 0)) as cps_peak, count(*) as count from $log where $filter and subtype='system' and action='perf-stats' group by timestamp, devid, slot order by total_mem desc)### t group by hourstamp order by hourstamp
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
event-Usage-CPU-Sessions |
Event usage CPU sessions |
event |
select
$hour_of_day(timestamp) as hourstamp,
cast(
sum(totalsession)/ sum(count) as decimal(10, 2)
) as sess_avg_usage,
cast(
sum(total_cpu)/ sum(count) as decimal(6, 2)
) as cpu_avg_usage
from
###(select $flex_timestamp as timestamp, devid, slot, sum(coalesce(trate, 0)) as total_trate, sum(coalesce(erate, 0)) as total_erate, sum(coalesce(orate, 0)) as total_orate, min(itime) as first_seen, max(itime) as last_seen, sum(coalesce(mem, 0)) as total_mem, max(coalesce(mem, 0)) as mem_peak, sum(coalesce(disk, 0)) as total_disk, max(coalesce(disk, 0)) as disk_peak, sum(coalesce(cpu, 0)) as total_cpu, max(coalesce(cpu, 0)) as cpu_peak, max(coalesce(trate, 0)+coalesce(erate, 0)+coalesce(orate, 0)) as lograte_peak, sum(coalesce(totalsession, 0)) as totalsession, max(coalesce(totalsession, 0)) as session_peak, sum(cast(coalesce(split_part(bandwidth, '/', 1), '0') as integer)) as sent, sum(cast(coalesce(split_part(bandwidth, '/', 2), '0') as integer)) as recv, max(cast(coalesce(split_part(bandwidth, '/', 1), '0') as integer)+cast(coalesce(split_part(bandwidth, '/', 2), '0') as integer)) as transmit_peak, sum(coalesce(setuprate, 0)) as cps, max(coalesce(setuprate, 0)) as cps_peak, count(*) as count from $log where $filter and subtype='system' and action='perf-stats' group by timestamp, devid, slot order by total_mem desc)### t group by hourstamp order by hourstamp
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-Users-By-Bandwidth |
Top users by bandwidth usage |
traffic |
select
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
srcip,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth,
sum(
coalesce(rcvdbyte, 0)
) as traffic_in,
sum(
coalesce(sentbyte, 0)
) as traffic_out
from
$log
where
$filter
and (
logflag&1>0
)
and srcip is not null
group by
user_src,
srcip
having
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
)> 0
order by
bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-User-Source-By-Sessions |
Application risk top user source by session count |
traffic |
select
srcip,
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
count(*) as sessions
from
$log
where
$filter
and (
logflag&1>0
)
and srcip is not null
group by
srcip,
user_src
order by
sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-Users-By-Reputation-Scores-Bar |
Application risk reputation top users by scores |
traffic |
select
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
sum(crscore % 65536) as scores
from
$log
where
$filter
and (
logflag&1>0
)
and crscore is not null
group by
user_src
having
sum(crscore % 65536)> 0
order by
scores desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-Devices-By-Reputation-Scores |
Application risk reputation top devices by scores |
traffic |
select
max(
get_devtype(srcswversion, osname, devtype)
) as devtype_new,
coalesce(
nullifna(`srcname`),
nullifna(`srcmac`),
ipstr(`srcip`)
) as dev_src,
sum(crscore % 65536) as scores
from
$log
where
$filter
and (
logflag&1>0
)
and crscore is not null
group by
dev_src
having
sum(crscore % 65536)> 0
order by
scores desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Application-Usage-By-Category-With-Pie |
Application Risk Application Usage by Category |
traffic |
select appcat, sum(bandwidth) as bandwidth from ###(select app, appcat, user_src, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by app, appcat, user_src /*SkipSTART*/order by bandwidth desc, sessions desc/*SkipEND*/)### t group by appcat order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-App-Usage-by-Category |
Application Risk Application Usage by Category |
traffic |
select appcat, sum(bandwidth) as bandwidth from ###(select app, appcat, user_src, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by app, appcat, user_src /*SkipSTART*/order by bandwidth desc, sessions desc/*SkipEND*/)### t group by appcat order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-20-Categories-By-Bandwidth |
Webfilter categories by bandwidth usage |
traffic |
select
catdesc,
sum(bandwidth) as bandwidth
from
###(select catdesc, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter and (logflag&1>0) and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) and catdesc is not null group by catdesc /*SkipSTART*/order by bandwidth desc/*SkipEND*/)### t group by catdesc order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Key-Applications-Crossing-The-Network |
Application risk application activity |
traffic |
select app_group, appcat, sum(bandwidth) as bandwidth, sum(sessions) as num_session from ###(select app_group_name(app) as app_group, appcat, service, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by app_group, appcat, service order by bandwidth desc)### t group by app_group, appcat order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Applications-Running-Over-HTTP |
Application risk applications running over HTTP |
traffic |
select
app_group,
service,
sum(sessions) as sessions,
sum(bandwidth) as bandwidth
from
###(select app_group_name(app) as app_group, appcat, service, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by app_group, appcat, service order by bandwidth desc)### t where service in ('80/tcp', '443/tcp', 'HTTP', 'HTTPS', 'http', 'https') group by app_group, service having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-Web-Sites-Visited-By-Network-Users-Pie-Cha |
Application risk web browsing summary category |
traffic |
select
catdesc,
sum(num_sess) as num_sess,
sum(bandwidth) as bandwidth
from
###(select catdesc, count(*) as num_sess, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and (logflag&1>0) and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) and catdesc is not null group by catdesc order by num_sess desc)### t group by catdesc order by num_sess desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-Web-Sites-Visited-By-Network-Users |
Application risk web browsing summary category |
traffic |
select
catdesc,
sum(num_sess) as num_sess,
sum(bandwidth) as bandwidth
from
###(select catdesc, count(*) as num_sess, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and (logflag&1>0) and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) and catdesc is not null group by catdesc order by num_sess desc)### t group by catdesc order by num_sess desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Web-Browsing-Hostname-Category |
Application risk web browsing activity hostname category |
webfilter |
select domain, catdesc, sum(visits) as visits from ###(select coalesce(nullifna(hostname), ipstr(`dstip`)) as domain, catdesc, count(*) as visits from $log where $filter and catdesc is not null group by domain, catdesc order by visits desc)### t group by domain, catdesc order by visits desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Top-Destination-Countries-By-Browsing-Time |
Traffic top destination countries by browsing time |
traffic |
select
dstcountry,
ebtr_value(
ebtr_agg_flat(browsetime),
null,
$timespan
) as browsetime,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
###(select dstcountry, ebtr_agg_flat(browsetime) as browsetime, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from (select dstcountry, ebtr_agg_flat($browse_time) as browsetime, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out from $log where $filter and (logflag&1>0) and $browse_time is not null group by dstcountry) t group by dstcountry /*SkipSTART*/order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc/*SkipEND*/)### t group by dstcountry order by browsetime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Traffic-Top-Hostnames-By-Browsing-Time |
Traffic top domains by browsing time |
traffic |
select
hostname,
ebtr_value(
ebtr_agg_flat(browsetime),
null,
$timespan
) as browsetime,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out
from
###(select hostname, ebtr_agg_flat(browsetime) as browsetime, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from (select hostname, ebtr_agg_flat($browse_time) as browsetime, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out from $log where $filter and (logflag&1>0) and hostname is not null and $browse_time is not null group by hostname) t group by hostname /*SkipSTART*/order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc/*SkipEND*/)### t group by hostname order by browsetime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-Threat-Vectors-Crossing-The-Network |
Application risk top threat vectors |
attack |
select severity, sum(totalnum) as totalnum from ###(select attack, severity, ref, count(*) as totalnum from $log where $filter and nullifna(attack) is not null group by attack, severity, ref order by totalnum desc)### t group by severity order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-Critical-Threat-Vectors-Crossing-The-Network |
Application risk top critical threat vectors |
attack |
select attack, severity, ref, sum(totalnum) as totalnum from ###(select attack, severity, ref, count(*) as totalnum from $log where $filter and nullifna(attack) is not null group by attack, severity, ref order by totalnum desc)### t where severity='critical' group by attack, severity, ref order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-High-Threat-Vectors-Crossing-The-Network |
Application risk top high threat vectors |
attack |
select attack, severity, ref, sum(totalnum) as totalnum from ###(select attack, severity, ref, count(*) as totalnum from $log where $filter and nullifna(attack) is not null group by attack, severity, ref order by totalnum desc)### t where severity='high' group by attack, severity, ref order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-Medium-Threat-Vectors-Crossing-The-Network |
Application risk top medium threat vectors |
attack |
select attack, severity, ref, sum(totalnum) as totalnum from ###(select attack, severity, ref, count(*) as totalnum from $log where $filter and nullifna(attack) is not null group by attack, severity, ref order by totalnum desc)### t where severity='medium' group by attack, severity, ref order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-Low-Threat-Vectors-Crossing-The-Network |
Application risk top low threat vectors |
attack |
select attack, severity, ref, sum(totalnum) as totalnum from ###(select attack, severity, ref, count(*) as totalnum from $log where $filter and nullifna(attack) is not null group by attack, severity, ref order by totalnum desc)### t where severity='low' group by attack, severity, ref order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-Info-Threat-Vectors-Crossing-The-Network |
Application risk top info threat vectors |
attack |
select attack, severity, ref, sum(totalnum) as totalnum from ###(select attack, severity, ref, count(*) as totalnum from $log where $filter and nullifna(attack) is not null group by attack, severity, ref order by totalnum desc)### t where severity='info' group by attack, severity, ref order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-Virus-By-Name |
UTM top virus |
virus |
select
virus,
max(virusid_s) as virusid,
(
case when virus like & #039;Riskware%' then 'Spyware' when virus like 'Adware%' then 'Adware' else 'Virus' end) as malware_type, sum(totalnum) as totalnum from ###(select virus, virusid_to_str(virusid, eventtype) as virusid_s, count(*) as totalnum from $log where $filter and nullifna(virus) is not null group by virus, virusid_s /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t group by virus, malware_type order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Top-Virus-Victim |
UTM top virus user |
virus |
select user_src, sum(totalnum) as totalnum from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, eventtype, logver, virus, count(*) as totalnum from $log where $filter group by user_src, eventtype, logver, virus /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t where nullifna(virus) is not null group by user_src order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Data-Loss-Prevention-Type-Events |
Application risk DLP UTM event |
dlp |
select subtype : :text as utmsubtype, count(*) as number from ###(select itime, hostname,`from` as sender, `to` as receiver, profile, action, service, subtype, srcip, dstip, severity, filename, direction, filesize, (case when severity='critical' then 'Critical Data Exfiltration' else (case when coalesce(nullifna(`user`), ipstr(`srcip`)) is not null then 'User Associated Data Loss' else NULL end) end) as data_loss from $log where $filter /*SkipSTART*/order by itime desc/*SkipEND*/)### t where $filter-drilldown and subtype is not null group by subtype order by number desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Vulnerability-Discovered |
Application risk vulnerability discovered |
netscan |
select vuln, vulnref as ref, vulncat, severity, count(*) as totalnum from $log where $filter and vuln is not null group by vuln, vulnref, vulncat, severity order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Malware-Discovered |
Application risk virus discovered |
virus |
select dom, sum(totalnum) as totalnum from ###(select $DAY_OF_MONTH as dom, count(*) as totalnum from $log where $filter and nullifna(virus) is not null group by dom order by totalnum desc)### t group by dom order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Breakdown-Of-Risk-Applications |
Application risk breakdown of risk applications |
traffic |
select
unnest(
string_to_array(
behavior,
& #039;,')) as d_behavior, count(*) as number from $log t1 inner join app_mdata t2 on t1.appid=t2.id where $filter and (logflag&1>0) group by d_behavior order by number desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-Number-Of-Applications-By-Risk-Behavior |
Application risk number of applications by risk behavior |
traffic |
select
risk as d_risk,
unnest(
string_to_array(
behavior,
& #039;,')) as f_behavior, count(*) as number from $log t1 inner join app_mdata t2 on t1.appid=t2.id where $filter and (logflag&1>0) group by risk, f_behavior order by risk desc, number desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
App-Risk-High-Risk-Application |
Application risk high risk application |
traffic |
select
risk as d_risk,
behavior as d_behavior,
t2.id,
t2.name,
t2.app_cat,
t2.technology,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth,
count(*) as sessions
from
$log t1
inner join app_mdata t2 on t1.appid = t2.id
where
$filter
and (
logflag&1>0
)
and behavior is not null
group by
t2.id
order by
risk desc,
sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Apprisk-Ctrl-Breakdown-Of-High-Risk-Application |
Severe and high risk applications |
traffic |
select
appcat,
count(distinct app) as total_num
from
###(select appid, app, appcat, apprisk, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by appid, app, appcat, apprisk /*SkipSTART*/order by sessions desc, bandwidth desc/*SkipEND*/)### t where $filter-drilldown and nullifna(appcat) is not null and apprisk in ('critical', 'high') group by appcat order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Apprisk-Ctrl-High-Risk-Application-Behavioral |
Application Behavioral Characteristics |
traffic |
select
behavior,
round(
sum(total_num)* 100 / sum(
sum(total_num)
) over (),
2
) as percentage
from
(
###(select timestamp, (case when lower(appcat)='botnet' then 'malicious' when lower(appcat)='remote.access' then 'tunneling' when lower(appcat) in ('storage.backup', 'video/audio') then 'bandwidth-consuming' when lower(appcat)='p2p' then 'peer-to-peer' when lower(appcat)='proxy' then 'proxy' end) as behavior, sum(sessions) as total_num from ###base(/*tag:rpt_base_t_bndwdth_sess*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, appcat, apprisk, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, count(*) as sessions, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in from $log-traffic where $filter and (logflag&(1|32)>0) group by timestamp, dvid, srcip, dstip, epid, euid, appcat, apprisk, user_src, service /*SkipSTART*/order by timestamp desc/*SkipEND*/)base### t where lower(appcat) in ('botnet', 'remote.access', 'storage.backup', 'video/audio', 'p2p', 'proxy') and apprisk in ('critical', 'high') group by timestamp, behavior order by total_num desc)### union all ###(select $flex_timestamp as timestamp, 'malicious' as behavior, count(*) as total_num from $log-attack where $filter and (logflag&16>0) and severity in ('critical', 'high') group by timestamp, behavior order by total_num desc)###) t where $filter-drilldown group by behavior order by percentage desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Apprisk-Ctrl-Key-Application-Crossing-The-Network |
Key Application Crossing The Network |
traffic |
select risk as d_risk, count(distinct user_src) as users, id, name, app_cat, technology, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###(select app, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as sessions from $log where $filter and (logflag&1>0) group by app, user_src order by bandwidth desc)### t1 inner join app_mdata t2 on t1.app=t2.name group by id, app, app_cat, technology, risk order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Apprisk-Ctrl-Risk-Application-Usage-By-Category-With-Pie |
Application Risk Application Usage by Category |
traffic |
select appcat, sum(bandwidth) as bandwidth from ###(select app, appcat, user_src, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by app, appcat, user_src /*SkipSTART*/order by bandwidth desc, sessions desc/*SkipEND*/)### t group by appcat order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Apprisk-Ctrl-Category-Breakdown-By-Bandwidth |
Category breakdown of all applications, sorted by bandwidth |
traffic |
select
appcat,
count(distinct app) as app_num,
count(distinct user_src) as user_num,
sum(bandwidth) as bandwidth,
sum(sessions) as num_session
from
###(select app, appcat, user_src, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t where nullifna(appcat) is not null and appcat not in ('Not.Scanned', 'unscanned', 'unknown') group by app, appcat, user_src order by bandwidth desc)### t where $filter-drilldown group by appcat order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Apprisk-Ctrl-Common-Virus-Botnet-Spyware |
Common virus disvocered, the botnet communictions and the spyware/adware |
traffic |
select
virus_s as virus,
(
case when lower(appcat)=& #039;botnet' then 'Botnet C&C' else (case when virus_s like 'Riskware%' then 'Spyware' when virus_s like 'Adware%' then 'Adware' else 'Virus' end) end) as malware_type, appid, app, count(distinct dstip) as victims, count(distinct srcip) as source, sum(total_num) as total_num from (###(select app as virus_s, appcat, appid, app, dstip, srcip, count(*) as total_num from $log-traffic where $filter and (logflag&1>0) and lower(appcat)='botnet' group by virus_s, appcat, appid, dstip, srcip, app order by total_num desc)### union all ###(select unnest(string_to_array(virus, ',')) as virus_s, appcat, appid, app, dstip, srcip, count(*) as total_num from $log-traffic where $filter and (logflag&1>0) and virus is not null group by virus_s, appcat, appid, dstip, srcip, app order by total_num desc)### union all ###(select attack as virus_s, 'botnet' as appcat, 0 as appid, attack as app, dstip, srcip, count(*) as total_num from $log-attack where $filter and (logflag&16>0) group by virus_s, appcat, appid, dstip, srcip, app order by total_num desc)###) t group by virus, appid, app, malware_type order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Apprisk-Ctrl-Zero-Day-Detected-On-Network |
Zero-day malware detected on the network |
traffic |
select virus_s, appid, app, count(distinct dstip) as victims, count(distinct srcip) as source, sum(total_num) as total_num from ###(select unnest(string_to_array(virus, ',')) as virus_s, appid, app, dstip, srcip, count(*) as total_num from $log where $filter and (logflag&1>0) and virus like '%PossibleThreat.SB%' group by virus_s, dstip, srcip, appid, app order by total_num desc)### t where virus_s like '%PossibleThreat.SB%' group by virus_s, appid, app order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Apprisk-Ctrl-Files-Analyzed-By-FortiCloud-Sandbox |
Files analyzed by FortiCloud Sandbox |
virus |
select $DAY_OF_MONTH as dom, count(*) as total_num from $log where $filter and nullifna(filename) is not null and logid_to_int(logid)= 9233 group by dom order by dom
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Apprisk-Ctrl-File-Transferred-By-Application |
File transferred by applications on the network |
app-ctrl |
select appid, app, filename, cloudaction, max(filesize) as filesize from $log where $filter and filesize is not null and clouduser is not null and filename is not null group by cloudaction, appid, app, filename order by filesize desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
appctrl-Top-Blocked-SCCP-Callers |
Appctrl top blocked SCCP callers |
app-ctrl |
select caller, sum(totalnum) as totalnum from ###(select srcname as caller, app, count(*) as totalnum from $log where $filter and srcname is not null and lower(appcat)='voip' and action='block' group by caller, app order by totalnum desc)### t where app='sccp' group by caller order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
appctrl-Top-Blocked-SIP-Callers |
Appctrl top blocked SIP callers |
app-ctrl |
select caller, sum(totalnum) as totalnum from ###(select srcname as caller, app, count(*) as totalnum from $log where $filter and srcname is not null and lower(appcat)='voip' and action='block' group by caller, app order by totalnum desc)### t where app='sip' group by caller order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
360-degree-security-Application-Visiblity-and-Control-Summary |
Application Visibolity and Control Summary |
app-ctrl |
select appcat, count(distinct app) as total_num from ###(select appcat, app from $log where $filter and app is not null and appcat is not null group by appcat, app)### t group by appcat order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
360-degree-security-Threats-Detection-and-Prevention-Summary |
Threat Prevention |
app-ctrl |
select
threat_name,
count(distinct threats) as total_num
from
(
###(select cast('Malware & Botnet C&C' as char(32)) as threat_name, app as threats, count(*) as total_num from $log-app-ctrl where $filter and lower(appcat)='botnet' group by app order by total_num desc)### union all ###(select cast('Malware & Botnet C&C' as char(32)) as threat_name, virus as threats, count(*) as total_num from $log-virus where $filter and nullifna(virus) is not null group by virus order by total_num desc)### union all ###(select cast('Malicious & Phishing Sites' as char(32)) as threat_name, hostname as threats, count(*) as total_num from $log-webfilter where $filter and cat in (26, 61) group by hostname order by total_num desc)### union all ###(select cast('Critical & High Intrusion Attacks' as char(32)) as threat_name, attack as threats, count(*) as total_num from $log-attack where $filter and severity in ('critical', 'high') group by attack order by total_num desc)###) t group by threat_name order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
360-degree-security-Data-Exfiltration-Detection-and-Prevention-Summary |
Data Exfiltration Summary |
dlp |
select data_loss, count(*) as total_num from ###(select itime, hostname,`from` as sender, `to` as receiver, profile, action, service, subtype, srcip, dstip, severity, filename, direction, filesize, (case when severity='critical' then 'Critical Data Exfiltration' else (case when coalesce(nullifna(`user`), ipstr(`srcip`)) is not null then 'User Associated Data Loss' else NULL end) end) as data_loss from $log where $filter /*SkipSTART*/order by itime desc/*SkipEND*/)### t where $filter-drilldown and data_loss is not null group by data_loss order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
360-degree-security-Endpoint-Protection-Summary |
Endpoint Protection |
fct-traffic |
select
blocked_event,
count(*) as total_num
from
(
select
(
case utmevent when & #039;antivirus' then 'Malware Deteced and Blocked' when 'appfirewall' then 'Risk Application Blocked' when 'webfilter' then (case when coalesce(nullifna(`user`), ipstr(`srcip`)) is not null then 'Web Sites Violation Blocked' else 'Non User Initiated Web Visits' end) else NULL end) as blocked_event from $log where $filter and utmaction in ('blocked', 'quarantined')) t where blocked_event is not null group by blocked_event order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top20-High-Risk-Application-In-Use |
High risk application in use |
traffic |
select d_risk, count(distinct f_user) as users, name, app_cat, technology, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###(select risk as d_risk, coalesce(nullifna(t1.`user`), nullifna(t1.`unauthuser`), ipstr(t1.`srcip`)) as f_user, t2.name, t2.app_cat, t2.technology, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as sessions from $log t1 inner join app_mdata t2 on t1.appid=t2.id where $filter and risk>='4' and (logflag&1>0) group by f_user, t2.name, t2.app_cat, t2.technology, risk)### t group by d_risk, name, app_cat, technology order by d_risk desc, sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-High-Risk-Application-By-Category |
High risk application by category |
traffic |
select app_cat, count(distinct app) as total_num from ###(select app_cat, app from $log t1 inner join app_mdata t2 on t1.appid=t2.id where $filter and risk>='4' and (logflag&1>0) group by app_cat, app)### t group by app_cat order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top10-Application-Categories-By-Bandwidth |
Application Risk Application Usage by Category |
traffic |
select appcat, sum(bandwidth) as bandwidth from ###(select app, appcat, user_src, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t group by app, appcat, user_src /*SkipSTART*/order by bandwidth desc, sessions desc/*SkipEND*/)### t group by appcat order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Security-Category-Breakdown-By-Bandwidth |
Category breakdown of all applications, sorted by bandwidth |
traffic |
select
appcat,
count(distinct app) as app_num,
count(distinct user_src) as user_num,
sum(bandwidth) as bandwidth,
sum(sessions) as num_session
from
###(select app, appcat, user_src, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###base(/*tag:rpt_base_t_top_app*/select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, appid, app, appcat, apprisk, hostname, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(CASE WHEN (logflag&1>0) THEN 1 ELSE 0 END) as sessions from $log-traffic where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service, appid, app, appcat, apprisk, hostname order by sessions desc, bandwidth desc)base### t where nullifna(appcat) is not null and appcat not in ('Not.Scanned', 'unscanned', 'unknown') group by app, appcat, user_src order by bandwidth desc)### t where $filter-drilldown group by appcat order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top25-Web-Applications-By-Bandwidth |
Top Web Applications by Bandwidth |
traffic |
select
risk as d_risk,
t2.name,
t2.app_cat,
t2.technology,
count(distinct f_user) as users,
sum(bandwidth) as bandwidth,
sum(num_session) as sessions
from
###(select appid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as f_user, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as num_session from $log where $filter and (logflag&1>0) and nullifna(app) is not null and service in ('80/tcp', '443/tcp', 'HTTP', 'HTTPS', 'http', 'https') group by appid, f_user order by bandwidth desc)### t1 inner join app_mdata t2 on t1.appid=t2.id group by d_risk, t2.name, t2.app_cat, t2.technology order by d_risk desc, bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Security-Top25-Web-Categories-Visited |
Top 25 Web Categories Visited |
traffic |
select
catdesc,
count(distinct f_user) as user_num,
sum(sessions) as sessions,
sum(bandwidth) as bandwidth
from
###(select catdesc, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as f_user, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and catdesc is not null and (logflag&1>0) and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) group by f_user, catdesc order by sessions desc)### t group by catdesc order by sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top25-Malware-Virus-Botnet-Spyware |
Malware: viruses, Bots, Spyware/Adware |
traffic |
select
virus_s as virus,
(
case when lower(appcat)=& #039;botnet' then 'Botnet C&C' else (case when virus_s like 'Riskware%' then 'Spyware' when virus_s like 'Adware%' then 'Adware' else 'Virus' end) end) as malware_type, count(distinct dstip) as victims, count(distinct srcip) as source, sum(total_num) as total_num from (###(select app as virus_s, appcat, dstip, srcip, count(*) as total_num from $log-traffic where $filter and (logflag&1>0) and lower(appcat)='botnet' group by virus_s, appcat, dstip, srcip order by total_num desc)### union all ###(select unnest(string_to_array(virus, ',')) as virus_s, appcat, dstip, srcip, count(*) as total_num from $log-traffic where $filter and (logflag&1>0) and virus is not null group by virus_s, appcat, dstip, srcip order by total_num desc)### union all ###(select attack as virus_s, 'null' as appcat, dstip, srcip, count(*) as total_num from $log-attack where $filter and (logflag&16>0) group by virus_s, appcat, dstip, srcip order by total_num desc)###) t group by virus, malware_type order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top10-Malware-Virus-Spyware |
Malware: viruses, Spyware/Adware |
virus |
select virus, max(virusid_s) as virusid, malware_type, count(distinct victim) as victims, count(distinct source) as source, sum(total_num) as total_num from ###(select virus, virusid_to_str(virusid, eventtype) as virusid_s, (CASE WHEN direction='incoming' THEN dstip ELSE srcip END) as source, (CASE WHEN direction='incoming' THEN srcip ELSE dstip END) as victim, (case when virus like 'Riskware%' then 'Spyware' when virus like 'Adware%' then 'Adware' else 'Virus' end) as malware_type, count(*) as total_num from $log where $filter and nullifna(virus) is not null group by virus, virusid_s, source, victim order by total_num desc)### t group by virus, malware_type order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top10-Malware-Botnet |
Malware: Botnet |
appctrl |
select
app,
appid,
malware_type,
count(distinct victim) as victims,
count(distinct source) as source,
sum(total_num) as total_num
from
(
###(select app, appid, cast('Botnet C&C' as char(32)) as malware_type,(CASE WHEN direction='incoming' THEN dstip ELSE srcip END) as source, (CASE WHEN direction='incoming' THEN srcip ELSE dstip END) as victim, count(*) as total_num from $log-app-ctrl where $filter and lower(appcat)='botnet' and nullifna(app) is not null group by app, appid, malware_type, source, victim order by total_num desc)### union all ###(select attack, 0 as appid, cast('Botnet C&C' as char(32)) as malware_type, (CASE WHEN direction='incoming' THEN dstip ELSE srcip END) as source, (CASE WHEN direction='incoming' THEN srcip ELSE dstip END) as victim, count(*) as total_num from $log-attack where $filter and (logflag&16>0) group by attack, appid, malware_type, source, victim order by total_num desc)###) t group by app, appid, malware_type order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top10-Victims-of-Malware |
Victims of Malware |
virus |
select
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
virus as malware,
count(*) as total_num
from
$log
where
$filter
and virus is not null
group by
user_src,
malware
order by
total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top10-Victims-of-Phishing-Site |
Victims of Phishing Site |
webfilter |
select
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
url as phishing_site,
count(*) as total_num
from
$log
where
$filter
and cat in (26, 61)
group by
user_src,
phishing_site
order by
total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top25-Malicious-Phishing-Sites |
Malicious Phishing Site |
webfilter |
select phishing_site, count(distinct dstip) as victims, count(distinct srcip) as source, sum(total) as total_num from ###(select url as phishing_site, dstip, srcip, count(*) as total from $log where $filter and cat in (26, 61) group by phishing_site, dstip, srcip order by total desc)### t group by phishing_site order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Application-Vulnerability |
Application vulnerabilities discovered |
attack |
select
attack,
attackid,
vuln_type,
cve,
severity_number,
count(
distinct (
CASE WHEN direction =& #039;incoming' THEN srcip ELSE dstip END)) as victims, count(distinct (CASE WHEN direction='incoming' THEN dstip ELSE srcip END)) as sources, sum(totalnum) as totalnum from ###(select attack, attackid, (case when severity='critical' then 5 when severity='high' then 4 when severity='medium' then 3 when severity='low' then 2 when severity='info' then 1 else 0 end) as severity_number, direction, dstip, srcip, count(*) as totalnum from $log where $filter and nullifna(attack) is not null and severity is not null group by attack, attackid, severity, direction, dstip, srcip order by totalnum desc)### t1 left join (select name, cve, vuln_type from ips_mdata) t2 on t1.attack=t2.name group by attack, attackid, vuln_type, severity_number, cve order by severity_number desc, totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Files-Analyzed-By-FortiCloud-Sandbox |
Files analyzed by FortiCloud Sandbox |
virus |
select $day_of_week as dow, count(*) as total_num from $log where $filter and nullifna(filename) is not null and logid_to_int(logid)= 9233 group by dow order by dow
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Security-Zero-Day-Detected-On-Network |
Zero-day malware detected on the network |
traffic |
select virus_s, app, count(distinct dstip) as victims, count(distinct srcip) as source, sum(total_num) as total_num from ###(select unnest(string_to_array(virus, ',')) as virus_s, app, dstip, srcip, count(*) as total_num from $log where $filter and (logflag&1>0) and virus like '%PossibleThreat.SB%' group by virus_s, dstip, srcip, app)### t group by virus_s, app order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Data-Loss-Incidents-By-Severity |
Data loss incidents summary by severity |
dlp |
select initcap(severity : :text) as s_severity, count(*) as total_num from ###(select itime, hostname,`from` as sender, `to` as receiver, profile, action, service, subtype, srcip, dstip, severity, filename, direction, filesize, (case when severity='critical' then 'Critical Data Exfiltration' else (case when coalesce(nullifna(`user`), ipstr(`srcip`)) is not null then 'User Associated Data Loss' else NULL end) end) as data_loss from $log where $filter /*SkipSTART*/order by itime desc/*SkipEND*/)### t where $filter-drilldown and severity is not null group by s_severity order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Data-Loss-Files-By-Service |
Data Lass Files By Service |
dlp |
select
filename,
(
case direction when & #039;incoming' then 'Download' when 'outgoing' then 'Upload' end) as action, max(filesize) as filesize, service from ###(select itime, hostname,`from` as sender, `to` as receiver, profile, action, service, subtype, srcip, dstip, severity, filename, direction, filesize, (case when severity='critical' then 'Critical Data Exfiltration' else (case when coalesce(nullifna(`user`), ipstr(`srcip`)) is not null then 'User Associated Data Loss' else NULL end) end) as data_loss from $log where $filter /*SkipSTART*/order by itime desc/*SkipEND*/)### t where $filter-drilldown and filesize is not null group by filename, direction, service order by filesize desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Endpoint-Security-Events-Summary |
Endpoint Security Events summary |
fct-traffic |
select
(
case utmevent when & #039;antivirus' then 'Malware incidents' when 'webfilter' then 'Malicious/phishing websites' when 'appfirewall' then 'Risk applications' when 'dlp' then 'Data loss incidents' when 'netscan' then 'Vulnerability detected' else 'Others' end) as events, count(*) as total_num from $log where $filter and utmevent is not null group by events order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top-Endpoing-Running-High-Risk-Application |
Endpoints Running High Risk Application |
fct-traffic |
select
coalesce(
nullifna(`user`),
ipstr(`srcip`),
& #039;Unknown') as f_user, coalesce(nullifna(hostname), 'Unknown') as host_name, threat as app, t2.app_cat as appcat, risk as d_risk from $log t1 inner join app_mdata t2 on t1.threat=t2.name where $filter and utmevent='appfirewall' and risk>='4' group by f_user, host_name, t1.threat, t2.app_cat, t2.risk order by risk desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top-Endpoints-Infected-With-Malware |
Endpoints Infected With Malware |
fct-event |
select
coalesce(
nullifna(`user`),
ipstr(`deviceip`),
& #039;Unknown') as f_user, coalesce(nullifna(hostname), 'Unknown') as host_name, virus, file from $log where $filter and subtype='av' and virus is not null group by f_user, host_name, virus, file
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top-Endpoints-With-Web-Violateions |
Endpoints With Web Violations |
fct-traffic |
select f_user, host_name, remotename, sum(total_num) as total_num from ###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as f_user, coalesce(nullifna(hostname), 'Unknown') as host_name, remotename, count(*) as total_num from $log where $filter and utmevent='webfilter' and remotename is not null and utmaction='blocked' group by f_user, host_name, remotename order by total_num desc)### t group by f_user, host_name, remotename order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
security-Top-Endpoints-With-Data-Loss-Incidents |
Endpoints With Data Loss Incidents |
fct-event |
select f_user, host_name, msg, sum(total_num) as total_num from ###(select coalesce(nullifna(`user`), ipstr(`deviceip`), 'Unknown') as f_user, coalesce(nullifna(hostname), 'Unknown') as host_name, msg, count(*) as total_num from $log where $filter and subtype='dlp' group by f_user, host_name, msg order by total_num desc)### t group by f_user, host_name, msg order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
content-Count-Total-SCCP-Call-Registrations-by-Hour-of-Day |
Content count total SCCP call registrations by hour of day |
content |
select hourstamp, count(totalnum) as totalnum from ###(select $hour_of_day as hourstamp, proto, kind, status, sum(duration) as sccp_usage, count(*) as totalnum from $log-content where $filter group by hourstamp, proto, kind, status order by totalnum desc)### t where proto='sccp' and kind='register' group by hourstamp order by hourstamp
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
content-Count-Total-SCCP-Calls-Duration-by-Hour-of-Day |
Content count total SCCP calls duration by hour of day |
content |
select hourstamp, sum(sccp_usage) as sccp_usage from ###(select $hour_of_day as hourstamp, proto, kind, status, sum(duration) as sccp_usage, count(*) as totalnum from $log-content where $filter group by hourstamp, proto, kind, status order by totalnum desc)### t where proto='sccp' and kind='call-info' and status='end' group by hourstamp order by hourstamp
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
content-Count-Total-SCCP-Calls-per-Status |
Content count total SCCP calls per status |
content |
select status, count(totalnum) as totalnum from ###(select $hour_of_day as hourstamp, proto, kind, status, sum(duration) as sccp_usage, count(*) as totalnum from $log-content where $filter group by hourstamp, proto, kind, status order by totalnum desc)### t where proto='sccp' and kind='call-info' group by status order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
content-Count-Total-SIP-Call-Registrations-by-Hour-of-Day |
Content count total SIP call registrations by hour of day |
content |
select hourstamp, count(totalnum) as totalnum from ###(select $hour_of_day as hourstamp, proto, kind, status, sum(duration) as sccp_usage, count(*) as totalnum from $log-content where $filter group by hourstamp, proto, kind, status order by totalnum desc)### t where proto='sip' and kind='register' group by hourstamp order by hourstamp
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
content-Count-Total-SIP-Calls-per-Status |
Content count total SIP calls per status |
content |
select status, count(totalnum) as totalnum from ###(select $hour_of_day as hourstamp, proto, kind, status, sum(duration) as sccp_usage, count(*) as totalnum from $log-content where $filter group by hourstamp, proto, kind, status order by totalnum desc)### t where proto='sip' and kind='call' group by status order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
content-Dist-Total-SIP-Calls-by-Duration |
Content dist total SIP calls by duration |
content |
select
(
case when duration<60 then & #039;LESS_ONE_MIN' when duration < 600 then 'LESS_TEN_MIN' when duration < 3600 then 'LESS_ONE_HOUR' when duration >= 3600 then 'MORE_ONE_HOUR' else 'unknown' end) as f_duration, count(*) as totalnum from $log where $filter and proto='sip' and kind='call' and status='end' group by f_duration order by totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Botnet-Activity-By-Sources |
Botnet activity by sources |
traffic |
select
app,
user_src,
sum(events) as events
from
(
(
select
app,
user_src,
sum(totalnum) as events
from
###(select app, appcat, apprisk, srcip, dstip, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, count(*) as totalnum from $log-traffic where $filter and (logflag&1>0) and appcat='Botnet' and nullifna(app) is not null group by app, appcat, apprisk, srcip, dstip, user_src order by totalnum desc)### t group by app, user_src order by events desc) union all (select attack, user_src, sum(totalnum) as events from ###(select attack, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, $flex_timestamp as timestamp, hostname, severity, crlevel, eventtype, service, dstip, srcip, count(*) as totalnum from $log-attack where $filter and (logflag&16>0) group by attack, user_src, timestamp, hostname, severity, crlevel, eventtype, service, dstip, srcip order by timestamp desc)### t group by attack, user_src order by events desc)) t group by app, user_src order by events desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Botnet-Infected-Hosts |
Botnet infected hosts |
traffic |
select
user_src,
devtype_new,
host_mac,
sum(events) as events
from
(
###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, get_devtype(srcswversion, osname, devtype) as devtype_new, coalesce(srcname, srcmac) as host_mac, count(*) as events from $log-traffic where $filter and (logflag&1>0) and appcat='Botnet' group by user_src, devtype_new, host_mac order by events desc)### union all ###(select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, 'Unknown' as devtype_new, hostname as host_mac, count(*) as events from $log-attack where $filter and (logflag&16>0) group by user_src, devtype_new, host_mac order by events desc)###) t group by user_src, devtype_new, host_mac order by events desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Detected-Botnet |
Detected botnet |
traffic |
select
app,
sum(events) as events
from
(
(
select
app,
sum(totalnum) as events
from
###(select app, appcat, apprisk, srcip, dstip, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, count(*) as totalnum from $log-traffic where $filter and (logflag&1>0) and appcat='Botnet' and nullifna(app) is not null group by app, appcat, apprisk, srcip, dstip, user_src order by totalnum desc)### t group by app order by events desc) union all (select attack, sum(totalnum) as events from ###(select attack, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, $flex_timestamp as timestamp, hostname, severity, crlevel, eventtype, service, dstip, srcip, count(*) as totalnum from $log-attack where $filter and (logflag&16>0) group by attack, user_src, timestamp, hostname, severity, crlevel, eventtype, service, dstip, srcip order by timestamp desc)### t group by attack order by events desc)) t group by app order by events desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Botnet-Sources |
Botnet sources |
traffic |
select
dstip,
domain,
sum(events) as events
from
(
(
select
dstip,
domain,
sum(events) as events
from
###(select dstip, root_domain(hostname) as domain, count(*) as events from $log-traffic where $filter and (logflag&1>0) and appcat='Botnet' and dstip is not null group by dstip, domain order by events desc)### t group by dstip, domain) union all (select dstip, root_domain(hostname) as domain, sum(totalnum) as events from ###(select attack, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, $flex_timestamp as timestamp, hostname, severity, crlevel, eventtype, service, dstip, srcip, count(*) as totalnum from $log-attack where $filter and (logflag&16>0) group by attack, user_src, timestamp, hostname, severity, crlevel, eventtype, service, dstip, srcip order by timestamp desc)### t group by dstip, domain)) t group by dstip, domain order by events desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Botnet-Victims |
Botnet victims |
traffic |
select
user_src,
sum(events) as events
from
(
(
select
user_src,
sum(totalnum) as events
from
###(select app, appcat, apprisk, srcip, dstip, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, count(*) as totalnum from $log-traffic where $filter and (logflag&1>0) and appcat='Botnet' and nullifna(app) is not null group by app, appcat, apprisk, srcip, dstip, user_src order by totalnum desc)### t group by user_src) union all (select user_src, sum(totalnum) as events from ###(select attack, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, $flex_timestamp as timestamp, hostname, severity, crlevel, eventtype, service, dstip, srcip, count(*) as totalnum from $log-attack where $filter and (logflag&16>0) group by attack, user_src, timestamp, hostname, severity, crlevel, eventtype, service, dstip, srcip order by timestamp desc)### t group by user_src)) t group by user_src order by events desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Botnet-Timeline |
Botnet timeline |
traffic |
select
$flex_datetime(timestamp) as hodex,
sum(events) as events
from
(
###(select $flex_timestamp as timestamp, count(*) as events from $log-traffic where $filter and (logflag&1>0) and appcat='Botnet' group by timestamp order by timestamp desc)### union all ###(select $flex_timestamp as timestamp, count(*) as events from $log-dns where $filter and (botnetdomain is not null or botnetip is not null) group by timestamp order by timestamp)### union all ###(select $flex_timestamp as timestamp, count(*) as events from $log-attack where $filter and (logflag&16>0) group by timestamp order by timestamp)###) t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Application-Session-History |
Application session history |
traffic |
select $flex_timescale(timestamp) as hodex, sum(counter) as counter from ###(select $flex_timestamp as timestamp, count(*) as counter from $log where $filter and (logflag&1>0) group by timestamp order by timestamp desc)### t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Application-Usage-List |
Detailed application usage |
traffic |
select
appid,
app,
appcat,
(
case when (
utmaction in (
& #039;block', 'blocked') or action='deny') then 'Blocked' else 'Allowed' end) as custaction, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth,count(*) as num_session from $log where $filter and (logflag&1>0) and nullifna(app) is not null and policyid != 0 group by appid,app, appcat,custaction order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
PCI-DSS-Compliance-Summary |
PCI DSS Compliance Summary |
event |
select
status,
num_reason as requirements,
cast(
num_reason * 100.0 /(
sum(num_reason) over()
) as decimal(18, 2)
) as percent
from
(
select
(
case when fail_count>0 then & #039;Non-Compliant' else 'Compliant' end) as status, count(distinct reason) as num_reason from (select ftnt_pci_id, (sum(fail_count) over (partition by ftnt_pci_id)) as fail_count, reason from ###(select ftnt_pci_id, (case when result='fail' then 1 else 0 end) as fail_count, reason from $log t1 inner join pci_dss_mdata t2 on t1.reason=t2.ftnt_id where $filter and subtype='compliance-check' group by ftnt_pci_id, result, reason)### t) t group by status) t order by status
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
PCI-DSS-Non-Compliant-Requirements-By-Severity |
PCI DSS Non-Compliant Requirements by Severity |
event |
with query as (
select
*
from
(
select
ftnt_pci_id,
severity,
(
sum(fail_count) over (partition by ftnt_pci_id)
) as fail_count,
reason
from
###(select ftnt_pci_id, t2.severity, (case when result='fail' then 1 else 0 end) as fail_count, reason from $log t1 inner join pci_dss_mdata t2 on t1.reason=t2.ftnt_id where $filter and subtype='compliance-check' group by ftnt_pci_id, t2.severity, result, reason order by fail_count desc)### t) t where fail_count>0) select t.severity, count(distinct t.reason) as requirements from (select distinct on (1) reason, severity from query order by reason, (case lower(severity) when 'high' then 4 when 'critical' then 3 when 'medium' then 2 when 'low' then 1 else 0 end) desc) t group by t.severity order by requirements desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
PCI-DSS-Compliant-Requirements-By-Severity |
PCI DSS Compliant Requirements by Severity |
event |
with query as (
select
*
from
(
select
ftnt_pci_id,
severity,
(
sum(fail_count) over (partition by ftnt_pci_id)
) as fail_count,
reason
from
###(select ftnt_pci_id, t2.severity, (case when result='fail' then 1 else 0 end) as fail_count, reason from $log t1 inner join pci_dss_mdata t2 on t1.reason=t2.ftnt_id where $filter and subtype='compliance-check' group by ftnt_pci_id, t2.severity, result, reason order by fail_count desc)### t) t where fail_count=0) select t.severity, count(distinct t.reason) as requirements from (select distinct on (1) reason, severity from query order by reason, (case lower(severity) when 'high' then 4 when 'critical' then 3 when 'medium' then 2 when 'low' then 1 else 0 end) desc) t group by t.severity order by requirements desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
PCI-DSS-Fortinet-Security-Best-Practice-Summary |
PCI DSS Fortinet Security Best Practice Summary |
event |
select
status,
num_reason as practices,
cast(
num_reason * 100.0 /(
sum(num_reason) over()
) as decimal(18, 2)
) as percent
from
(
select
(
case when result =& #039;fail' then 'Failed' else 'Passed' end) as status, count(distinct reason) as num_reason from ###(select result, reason from $log where $filter and subtype='compliance-check' and result in ('fail','pass') group by result, reason)### t group by status) t order by status desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
PCI-DSS-Failed-Fortinet-Security-Best-Practices-By-Severity |
PCI DSS Failed Fortinet Security Best Practices by Severity |
event |
select
status,
num_reason as practices,
cast(
num_reason * 100.0 /(
sum(num_reason) over()
) as decimal(18, 2)
) as percent
from
(
select
initcap(status) as status,
count(distinct reason) as num_reason
from
###(select status, reason, result from $log where $filter and subtype='compliance-check' group by status, reason, result)### t where result='fail' group by status) t order by status
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
PCI-DSS-Passed-Fortinet-Security-Best-Practices-By-Severity |
PCI DSS Passed Fortinet Security Best Practices by Severity |
event |
select
status,
num_reason as practices,
cast(
num_reason * 100.0 /(
sum(num_reason) over()
) as decimal(18, 2)
) as percent
from
(
select
initcap(status) as status,
count(distinct reason) as num_reason
from
###(select status, reason, result from $log where $filter and subtype='compliance-check' group by status, reason, result)### t where result='pass' group by status) t order by status
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
PCI-DSS-Requirements-Compliance-Details |
PCI DSS Requirements Compliance Details |
event |
select
ftnt_pci_id,
left(
string_agg(
distinct ftnt_id,
& #039;,'), 120) as practice, (case when sum(fail_count)>0 then 'Non-Compliant' else 'Compliant' end) as compliance, pci_requirement from ###(select ftnt_pci_id, ftnt_id, (case when result='fail' then 1 else 0 end) as fail_count, pci_requirement from $log t1 inner join pci_dss_mdata t2 on t1.reason=t2.ftnt_id where $filter and subtype='compliance-check' group by ftnt_pci_id, ftnt_id, result, pci_requirement)### t group by ftnt_pci_id, pci_requirement order by ftnt_pci_id
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
PCI-DSS-Fortinet-Security-Best-Practice-Details |
PCI DSS Fortinet Security Best Practice Details |
event |
select reason as ftnt_id, msg, initcap(status) as status, module from $log where $filter and subtype =& #039;compliance-check' group by reason, status, module, msg order by ftnt_id
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
DLP-Email-Activity-Details |
Email DLP Violations Summary |
dlp |
select
from_itime(itime) as timestamp,
sender,
receiver,
regexp_replace(
filename,
& #039;.*/', '') as filename, filesize, profile, action, direction from ###(select itime, hostname,`from` as sender, `to` as receiver, profile, action, service, subtype, srcip, dstip, severity, filename, direction, filesize, (case when severity='critical' then 'Critical Data Exfiltration' else (case when coalesce(nullifna(`user`), ipstr(`srcip`)) is not null then 'User Associated Data Loss' else NULL end) end) as data_loss from $log where $filter /*SkipSTART*/order by itime desc/*SkipEND*/)### t where $filter-drilldown and (service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') or service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp')) order by timestamp desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Email-DLP-Chart |
Email DLP Activity Summary |
dlp |
select
profile,
count(*) as total_num
from
###(select itime, hostname,`from` as sender, `to` as receiver, profile, action, service, subtype, srcip, dstip, severity, filename, direction, filesize, (case when severity='critical' then 'Critical Data Exfiltration' else (case when coalesce(nullifna(`user`), ipstr(`srcip`)) is not null then 'User Associated Data Loss' else NULL end) end) as data_loss from $log where $filter /*SkipSTART*/order by itime desc/*SkipEND*/)### t where $filter-drilldown and (service in ('smtp', 'SMTP', '25/tcp', '587/tcp', 'smtps', 'SMTPS', '465/tcp') or service in ('pop3', 'POP3', '110/tcp', 'imap', 'IMAP', '143/tcp', 'imaps', 'IMAPS', '993/tcp', 'pop3s', 'POP3S', '995/tcp')) group by profile order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
DLP-Web-Activity-Details |
Web DLP Violations Summary |
dlp |
select
from_itime(itime) as timestamp,
srcip,
dstip,
hostname,
profile,
filename,
filesize,
action,
direction
from
###(select itime, hostname,`from` as sender, `to` as receiver, profile, action, service, subtype, srcip, dstip, severity, filename, direction, filesize, (case when severity='critical' then 'Critical Data Exfiltration' else (case when coalesce(nullifna(`user`), ipstr(`srcip`)) is not null then 'User Associated Data Loss' else NULL end) end) as data_loss from $log where $filter /*SkipSTART*/order by itime desc/*SkipEND*/)### t where $filter-drilldown and lower(service) in ('http', 'https') order by timestamp desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
Web-DLP-Chart |
Web DLP Activity Summary |
dlp |
select
profile,
count(*) as total_num
from
###(select itime, hostname,`from` as sender, `to` as receiver, profile, action, service, subtype, srcip, dstip, severity, filename, direction, filesize, (case when severity='critical' then 'Critical Data Exfiltration' else (case when coalesce(nullifna(`user`), ipstr(`srcip`)) is not null then 'User Associated Data Loss' else NULL end) end) as data_loss from $log where $filter /*SkipSTART*/order by itime desc/*SkipEND*/)### t where $filter-drilldown and lower(service) in ('http', 'https') group by profile order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
DLP-FTP-Activity-Details |
Web DLP Violations Summary |
dlp |
select
from_itime(itime) as timestamp,
srcip,
dstip,
filename,
profile,
filesize,
action,
direction
from
###(select itime, hostname,`from` as sender, `to` as receiver, profile, action, service, subtype, srcip, dstip, severity, filename, direction, filesize, (case when severity='critical' then 'Critical Data Exfiltration' else (case when coalesce(nullifna(`user`), ipstr(`srcip`)) is not null then 'User Associated Data Loss' else NULL end) end) as data_loss from $log where $filter /*SkipSTART*/order by itime desc/*SkipEND*/)### t where $filter-drilldown and lower(service) in ('ftp', 'ftps') order by timestamp desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
FTP-DLP-Chart |
FTP DLP Activity Summary |
dlp |
select
profile,
count(*) as total_num
from
###(select itime, hostname,`from` as sender, `to` as receiver, profile, action, service, subtype, srcip, dstip, severity, filename, direction, filesize, (case when severity='critical' then 'Critical Data Exfiltration' else (case when coalesce(nullifna(`user`), ipstr(`srcip`)) is not null then 'User Associated Data Loss' else NULL end) end) as data_loss from $log where $filter /*SkipSTART*/order by itime desc/*SkipEND*/)### t where $filter-drilldown and lower(service) in ('ftp', 'ftps') group by profile order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
top-users-by-browsetime |
Top Users by website browsetime |
traffic |
select
user_src,
domain,
ebtr_value(
ebtr_agg_flat(browsetime),
null,
$timespan
) as browsetime
from
###(select user_src, domain, ebtr_agg_flat(browsetime) as browsetime from (select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, coalesce(nullifna(hostname), ipstr(`dstip`)) as domain, ebtr_agg_flat($browse_time) as browsetime from $log where $filter and $browse_time is not null group by user_src, domain) t group by user_src, domain order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc)### t group by user_src, domain order by browsetime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-usage-by-hour-authenticated |
Wifi Usage by Hour - Authenticated |
event |
select hod, count(distinct stamac) as totalnum from ###(select $HOUR_OF_DAY as hod, stamac from $log where $filter and subtype='wireless' and action='client-authentication' group by hod, stamac)### t group by hod order by hod
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
wifi-usage-authenticated-timeline |
Wifi Usage Timeline - Authenticated |
event |
select $flex_timescale(timestamp) as hodex, count(distinct stamac) as totalnum from ###(select $flex_timestamp as timestamp, stamac from $log where $filter and subtype='wireless' and action='client-authentication' group by timestamp, stamac order by timestamp desc)### t group by hodex order by hodex
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
app-top-user-by-bandwidth |
Top 10 Applications Bandwidth by User Drilldown |
traffic |
select
app,
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
sum(
coalesce(`sentbyte`, 0)+ coalesce(`rcvdbyte`, 0)
) as bandwidth
from
$log
where
$filter
and (
logflag&1>0
)
and nullifna(app) is not null
group by
app,
user_src
order by
bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
app-top-user-by-session |
Top 10 Application Sessions by User Drilldown |
traffic |
select
app,
coalesce(
nullifna(`user`),
nullifna(`unauthuser`),
ipstr(`srcip`)
) as user_src,
count(*) as sessions
from
$log
where
$filter
and (
logflag&1>0
)
and nullifna(app) is not null
group by
app,
user_src
order by
sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
traffic-Interface-Bandwidth-Usage |
Interface Bandwidth Usage |
traffic |
with qry as (
select
dom as dom_s,
devid as devid_s,
vd as vd_s,
srcintf,
dstintf,
total_sent,
total_rcvd
from
###(select $DAY_OF_MONTH as dom, devid, vd, srcintf, dstintf, sum(coalesce(sentbyte, 0)) as total_sent, sum(coalesce(rcvdbyte, 0)) as total_rcvd, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as total from $log where $filter and (logflag&1>0) and nullifna(srcintf) is not null and nullifna(dstintf) is not null group by dom, devid, vd, srcintf, dstintf having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by total desc)### t) select dom, unnest(array['download', 'upload']) as type, unnest(array[sum(download), sum(upload)]) as bandwidth from (select coalesce(t1.dom_s, t2.dom_s) as dom, coalesce(t1.devid_s, t2.devid_s) as devid, coalesce(t1.vd_s, t2.vd_s) as vd, coalesce(t1.srcintf, t2.dstintf) as intf, sum(coalesce(t1.total_sent, 0)+coalesce(t2.total_rcvd, 0)) as download, sum(coalesce(t2.total_sent, 0)+coalesce(t1.total_rcvd, 0)) as upload from qry t1 full join qry t2 on t1.dom_s=t2.dom_s and t1.srcintf=t2.dstintf group by dom, devid, vd, intf) t where $filter-drilldown group by dom order by dom
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-SB-Files-Needing-Inspection-vs-Others |
Files Needing Inspection vs Others |
virus |
select
(
case when suffix in (
& #039;bat','cmd','exe','jar','msi','vbs','7z','zip','gzip','lzw','tar','rar','cab','doc','docx','xls','xlsx','ppt','pptx','pdf','swf','lnk','js') then 'Higher Risk File Types' else 'Excluded Files' end) as files, sum(total_num) as total_num from ###(select file_name_ext(filename) as suffix, count(*) as total_num from $log where $filter and dtype='fortisandbox' and nullifna(filename) is not null group by suffix order by total_num desc)### t group by files order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-SB-Breakdown-of-File-Types |
Breakdown of File Types |
virus |
select
(
case when suffix in (
& #039;exe','msi','upx','vbs','bat','cmd','dll','ps1','jar') then 'Executable Files' when suffix in ('pdf') then 'Adobe PDF' when suffix in ('swf') then 'Adobe Flash' when suffix in ('doc','docx','rtf','dotx','docm','dotm','dot') then 'Microsoft Word' when suffix in ('xls','xlsx','xltx','xlsm','xlsb','xlam','xlt') then 'Microsoft Excel' when suffix in ('ppsx','ppt','pptx','potx','sldx','pptm','ppsm','potm','ppam','sldm','pps','pot') then 'Microsoft PowerPoint' when suffix in ('msg') then 'Microsoft Outlook' when suffix in ('htm','js','url','lnk') then 'Web Files' when suffix in ('cab','tgz','z','7z','tar','lzh','kgb','rar','zip','gz','xz','bz2') then 'Archive Files' when suffix in ('apk') then 'Android Files' else 'Others' end) as filetype, sum(total_num) as total_num from ###(select file_name_ext(filename) as suffix, count(*) as total_num from $log where $filter and dtype='fortisandbox' and nullifna(filename) is not null group by suffix order by total_num desc)### t group by filetype order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-SB-Top-Sandbox-Malicious-Exes |
virus |
select
(
case fsaverdict when & #039;malicious' then 5 when 'high risk' then 4 when 'medium risk' then 3 when 'low risk' then 2 else 1 end) as risk, filename, service, count(*) as total_num from $log where $filter and dtype='fortisandbox' and file_name_ext(filename)='exe' and fsaverdict not in ('clean','submission failed') group by filename, risk, service order by risk desc, total_num desc, filename
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-SB-Sources-of-Sandbox-Discovered-Malware |
Sources of Sandbox Discovered Malware |
virus |
select
source,
sum(total_num) as total_num
from
(
select
(
CASE WHEN direction =& #039;incoming' THEN dstip ELSE srcip END) as source, count(*) as total_num from $log where $filter and dtype='fortisandbox' and nullifna(filename) is not null and fsaverdict not in ('clean','submission failed') group by source) t group by source order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-apprisk-ctrl-High-Risk-Application |
Application risk high risk application |
traffic |
select risk as d_risk, count(distinct user_src) as users, id, name, app_cat, technology, sum(bandwidth) as bandwidth, sum(sessions) as sessions from ###(select app, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, action, utmaction, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, count(*) as sessions from $log where $filter and (logflag&1>0) group by app, user_src, action, utmaction order by bandwidth desc)### t1 inner join app_mdata t2 on t1.app=t2.name where risk>='4' group by id, name, app_cat, technology, risk order by d_risk desc, sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-apprisk-ctrl-Application-Vulnerability |
Application vulnerabilities discovered |
attack |
select
attack,
attackid,
vuln_type,
cve,
severity_number,
count(
distinct (
CASE WHEN direction =& #039;incoming' THEN srcip ELSE dstip END)) as victims, count(distinct (CASE WHEN direction='incoming' THEN dstip ELSE srcip END)) as sources, sum(totalnum) as totalnum from ###(select attack, attackid, (case when severity='critical' then 5 when severity='high' then 4 when severity='medium' then 3 when severity='low' then 2 when severity='info' then 1 else 0 end) as severity_number, direction, dstip, srcip, count(*) as totalnum from $log where $filter and nullifna(attack) is not null and severity is not null group by attack, attackid, severity, direction, dstip, srcip order by totalnum desc)### t1 left join (select name, cve, vuln_type from ips_mdata) t2 on t1.attack=t2.name group by attack, attackid, vuln_type, severity_number, cve order by severity_number desc, totalnum desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-apprisk-ctrl-Common-Virus-Botnet-Spyware |
Common Virus Botnet Spyware |
app-ctrl |
select
malware as virus,
(
case when lower(appcat)=& #039;botnet' then 'Botnet C&C' else (case when malware like 'Riskware%' then 'Spyware' when malware like 'Adware%' then 'Adware' else 'Virus' end) end) as malware_type, appid, app, count(distinct victim) as victims, count(distinct source) as source, sum(total_num) as total_num from (###(select app as malware, appcat, appid, app, (CASE WHEN direction='incoming' THEN dstip ELSE srcip END) as source, (CASE WHEN direction='incoming' THEN srcip ELSE dstip END) as victim, count(*) as total_num from $log-app-ctrl where $filter and lower(appcat)='botnet' group by malware, appcat, appid, app, victim, source, app order by total_num desc)### union all ###(select virus as malware, 'null' as appcat, 0 as appid, service as app, (CASE WHEN direction='incoming' THEN dstip ELSE srcip END) as source, (CASE WHEN direction='incoming' THEN srcip ELSE dstip END) as victim, count(*) as total_num from $log-virus where $filter and virus is not null group by malware, appcat, app, appid, victim, source order by total_num desc)### union all ###(select attack as malware, 'null' as appcat, 0 as appid, service as app, (CASE WHEN direction='incoming' THEN dstip ELSE srcip END) as source, (CASE WHEN direction='incoming' THEN srcip ELSE dstip END) as victim, count(*) as total_num from $log-attack where $filter and (logflag&16>0) group by malware, appcat, app, appid, victim, source order by total_num desc)###) t group by malware, malware_type, app, appid order by total_num desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-App-Risk-Reputation-Top-Devices-By-Scores |
Reputation Top Devices By-Scores |
traffic |
select
coalesce(
nullifna(`srcname`),
ipstr(`srcip`),
nullifna(`srcmac`)
) as dev_src,
sum(crscore % 65536) as scores
from
$log
where
$filter
and (
logflag&1>0
)
and crscore is not null
group by
dev_src
having
sum(crscore % 65536)> 0
order by
scores desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-HTTP-SSL-Traffic-Ratio |
HTTP SSL Traffic Ratio |
traffic |
select
(
case when service in (
& #039;80/tcp', 'HTTP', 'http') then 'HTTP' else 'HTTPS' end) as service, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter and (logflag&1>0) and nullifna(app) is not null and service in ('80/tcp', '443/tcp', 'HTTP', 'HTTPS', 'http', 'https') group by service having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-Top-Source-Countries |
Top Source Countries |
traffic |
select
srccountry,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth
from
$log
where
$filter
and (
logflag&1>0
)
and nullifna(srccountry) is not null
and srccountry <> & #039;Reserved' group by srccountry having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc, srccountry
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-SaaS-Apps |
CTAP SaaS Apps |
traffic |
select app_group, sum(bandwidth) as bandwidth from ###(select app_group_name(app) as app_group, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&1>0) and nullifna(app) is not null group by app_group having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)### t1 inner join app_mdata t2 on lower(t1.app_group)=lower(t2.name) where behavior like '%Cloud%' group by app_group order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-IaaS-Apps |
CTAP IaaS Apps |
traffic |
select app_group, sum(bandwidth) as bandwidth from ###(select app_group_name(app) as app_group, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&1>0) and nullifna(app) is not null group by app_group having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)### t1 inner join app_mdata t2 on lower(t1.app_group)=lower(t2.name) where app_cat='Cloud.IT' group by app_group order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-RAS-Apps |
CTAP RAS Apps |
traffic |
select name as app_group, sum(bandwidth) as bandwidth from ###(select app_group_name(app) as app_group, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&1>0) and nullifna(app) is not null group by app_group having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)### t1 inner join app_mdata t2 on lower(t1.app_group)=lower(t2.name) where app_cat='Remote.Access' group by name order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-Proxy-Apps |
CTAP Proxy Apps |
traffic |
select name as app_group, sum(bandwidth) as bandwidth from ###(select app_group_name(app) as app_group, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&1>0) and nullifna(app) is not null group by app_group having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)### t1 inner join app_mdata t2 on lower(t1.app_group)=lower(t2.name) where app_cat='Proxy' group by name order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-Top-SocialMedia-App-By-Bandwidth |
Top SocialMedia Applications by Bandwidth Usage |
traffic |
select app_group, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(sessions) as sessions from ###(select app_group_name(app) as app_group, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&1>0) and nullifna(app) is not null group by app_group having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)### t1 inner join app_mdata t2 on lower(t1.app_group)=lower(t2.name) where app_cat='Social.Media' group by app_group order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-Top-Streaming-App-By-Bandwidth |
Top Streaming applications by bandwidth usage |
traffic |
select app_group, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(sessions) as sessions from ###(select app_group_name(app) as app_group, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&1>0) and nullifna(app) is not null group by app_group having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)### t1 inner join app_mdata t2 on lower(t1.app_group)=lower(t2.name) where app_cat='Video/Audio' group by app_group order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-Top-Game-App-By-Bandwidth |
Top Game applications by bandwidth usage |
traffic |
select app_group, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(sessions) as sessions from ###(select app_group_name(app) as app_group, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&1>0) and nullifna(app) is not null group by app_group having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)### t1 inner join app_mdata t2 on lower(t1.app_group)=lower(t2.name) where app_cat='Game' group by app_group order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-Top-P2P-App-By-Bandwidth |
Top P2P applications by bandwidth usage |
traffic |
select app_group, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out, sum(sessions) as sessions from ###(select app_group_name(app) as app_group, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&1>0) and nullifna(app) is not null group by app_group having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)### t1 inner join app_mdata t2 on lower(t1.app_group)=lower(t2.name) where app_cat='P2P' group by app_group order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-apprisk-ctrl-Top-Web-Categories-Visited |
Top 25 Web Categories Visited |
traffic |
select
catdesc,
count(distinct f_user) as user_num,
sum(sessions) as sessions,
sum(bandwidth) as bandwidth
from
###(select catdesc, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as f_user, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and catdesc is not null and (logflag&1>0) and (countweb>0 or ((logver is null or logver<502000000) and (hostname is not null or utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter')))) group by f_user, catdesc order by sessions desc)### t group by catdesc order by sessions desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-App-Risk-Applications-Running-Over-HTTP |
Application risk applications running over HTTP |
traffic |
select
app_group,
service,
sum(sessions) as sessions,
sum(bandwidth) as bandwidth
from
###(select app_group_name(app) as app_group, appcat, service, sum(coalesce(sentdelta, sentbyte, 0)+coalesce(rcvddelta, rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvddelta, rcvdbyte, 0)) as traffic_in, sum(coalesce(sentdelta, sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&(1|32)>0) and nullifna(app) is not null group by app_group, appcat, service order by bandwidth desc)### t where service in ('80/tcp', '443/tcp', 'HTTP', 'HTTPS', 'http', 'https') group by app_group, service having sum(bandwidth)>0 order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-App-Risk-Web-Browsing-Activity-Hostname-Category |
Application risk web browsing activity hostname category |
webfilter |
select domain, catdesc, sum(visits) as visits from ###(select coalesce(nullifna(hostname), ipstr(`dstip`)) as domain, catdesc, count(*) as visits from $log where $filter and catdesc is not null group by domain, catdesc order by visits desc)### t group by domain, catdesc order by visits desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-Top-Sites-By-Browsing-Time |
Traffic top sites by browsing time |
traffic |
select
hostname,
string_agg(
distinct catdesc,
& #039;, ') as agg_catdesc, ebtr_value(ebtr_agg_flat(browsetime), null, $timespan) as browsetime, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from ###(select hostname, catdesc, ebtr_agg_flat(browsetime) as browsetime, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from (select hostname, catdesc, ebtr_agg_flat($browse_time) as browsetime, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out from $log where $filter and (logflag&1>0) and hostname is not null and $browse_time is not null group by hostname, catdesc) t group by hostname, catdesc /*SkipSTART*/order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc/*SkipEND*/)### t group by hostname order by browsetime desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-Average-Bandwidth-Hour |
Average Bandwidth Hour |
traffic |
select hourstamp, sum(bandwidth)/ count(distinct daystamp) as bandwidth from ###(select to_char(from_dtime(dtime), 'HH24:00') as hourstamp, to_char(from_dtime(dtime), 'DD Mon') as daystamp, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log where $filter and (logflag&1>0) group by hourstamp, daystamp having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by hourstamp)### t group by hourstamp order by hourstamp
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
ctap-Top-Bandwidth-Hosts |
Top Bandwidth Hosts |
traffic |
select
hostname,
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
) as bandwidth
from
$log - traffic
where
$filter
and hostname is not null
and (
logflag&1>0
)
group by
hostname
having
sum(
coalesce(sentbyte, 0)+ coalesce(rcvdbyte, 0)
)>0
order by
bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
saas-Application-Discovered |
All Applications Discovered on the Network |
traffic |
select
(
case is_saas when 1 then & #039;SaaS Apps' else 'Other Apps' end) as app_type, count(distinct app_s) as total_num from ###(select app_s, (case when saas_s>=10 then 1 else 0 end) as is_saas from (select unnest(apps) as app_s, unnest(saasinfo) as saas_s from $log where $filter and apps is not null) t group by app_s, is_saas order by is_saas desc)### t group by is_saas order by is_saas
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
saas-SaaS-Application-by-Category |
Number of SaaS Applications by Category |
traffic |
select
(
case saas_cat when 0 then & #039;Sanctioned' else 'Unsanctioned' end) as saas_cat_str, count(distinct app_s) as num_saas_app from ###(select app_s, saas_s%10 as saas_cat, sum(sentbyte+rcvdbyte) as bandwidth, count(*) as total_app from (select unnest(apps) as app_s, unnest(saasinfo) as saas_s, coalesce(sentbyte, 0) as sentbyte, coalesce(rcvdbyte, 0) as rcvdbyte from $log where $filter and apps is not null) t where saas_s>=10 group by app_s, saas_cat order by bandwidth desc)### t where saas_cat in (0, 1) group by saas_cat order by saas_cat
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
saas-SaaS-Application-by-Bandwidth |
Number of SaaS Applications by Bandwidth |
traffic |
select
(
case saas_cat when 0 then & #039;Sanctioned' else 'Tolerated' end) as saas_cat_str, sum(bandwidth) as bandwidth from ###(select app_s, saas_s%10 as saas_cat, sum(sentbyte+rcvdbyte) as bandwidth, count(*) as total_app from (select unnest(apps) as app_s, unnest(saasinfo) as saas_s, coalesce(sentbyte, 0) as sentbyte, coalesce(rcvdbyte, 0) as rcvdbyte from $log where $filter and apps is not null) t where saas_s>=10 group by app_s, saas_cat order by bandwidth desc)### t where saas_cat in (0, 2) group by saas_cat order by saas_cat
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
saas-SaaS-Application-by-Session |
Number of SaaS Applications by Session |
traffic |
select
(
case saas_cat when 0 then & #039;Sanctioned' else 'Tolerated' end) as saas_cat_str, sum(total_app) as total_app from ###(select app_s, saas_s%10 as saas_cat, sum(sentbyte+rcvdbyte) as bandwidth, count(*) as total_app from (select unnest(apps) as app_s, unnest(saasinfo) as saas_s, coalesce(sentbyte, 0) as sentbyte, coalesce(rcvdbyte, 0) as rcvdbyte from $log where $filter and apps is not null) t where saas_s>=10 group by app_s, saas_cat order by bandwidth desc)### t where saas_cat in (0, 2) group by saas_cat order by saas_cat
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
saas-SaaS-App-Users-vs-Others |
Number of Users of SaaS Apps vs Others |
traffic |
select
(
case is_saas when 0 then & #039;Other Apps' else 'SaaS Apps' end) as app_type, count(distinct saasuser) as total_user from ###(select saasuser, saas_s/10 as is_saas from (select coalesce(nullifna(`user`), nullifna(`clouduser`), nullifna(`unauthuser`), srcname, ipstr(`srcip`)) as saasuser, unnest(saasinfo) as saas_s from $log where $filter and apps is not null) t group by saasuser, is_saas)### t group by app_type
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
saas-SaaS-App-Users |
Number of Users of SaaS Apps |
traffic |
select
(
case saas_cat when 0 then & #039;Sanctioned' when 1 then 'Unsanctioned' else 'Others' end) as app_type, count(distinct saasuser) as total_user from ###(select saasuser, saas_s%10 as saas_cat from (select coalesce(nullifna(`user`), nullifna(`clouduser`), nullifna(`unauthuser`), srcname, ipstr(`srcip`)) as saasuser, unnest(saasinfo) as saas_s from $log where $filter and apps is not null) t where saas_s>=10 group by saasuser, saas_cat)### t group by saas_cat order by saas_cat
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
saas-Top-SaaS-User-by-Bandwidth-Session |
Top SaaS Users by Bandwidth and Session |
traffic |
select
saasuser,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out,
sum(sessions) as sessions,
sum(session_block) as session_block,
(
sum(sessions)- sum(session_block)
) as session_pass,
count(distinct app_s) as total_app
from
###(select saasuser, app_s, sum(sentbyte+rcvdbyte) as bandwidth, sum(rcvdbyte) as traffic_in, sum(sentbyte) as traffic_out, count(*) as sessions, sum(is_blocked) as session_block from (select coalesce(nullifna(`user`), nullifna(`clouduser`), nullifna(`unauthuser`), srcname, ipstr(`srcip`)) as saasuser, unnest(apps) as app_s, unnest(saasinfo) as saas_s, coalesce(sentbyte, 0) as sentbyte, coalesce(rcvdbyte, 0) as rcvdbyte, (CASE WHEN (logflag&2>0) THEN 1 ELSE 0 END) as is_blocked from $log where $filter and apps is not null) t where saas_s>=10 group by saasuser, app_s order by bandwidth desc)### t group by saasuser order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
saas-Top-Category-by-SaaS-Application-Usage |
Top Categories by SaaS Application Usage |
traffic |
select
app_cat,
(
case saas_cat when 0 then & #039;Sanctioned' else 'Unsactioned' end) as saas_cat_str, count(distinct app_s) as total_app from ###(select app_s, saas_s%10 as saas_cat from (select unnest(apps) as app_s, unnest(saasinfo) as saas_s from $log where $filter and apps is not null) t where saas_s>=10 group by app_s, saas_cat)### t1 inner join app_mdata t2 on t1.app_s=t2.name where saas_cat in (0, 1) group by app_cat, saas_cat order by total_app desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
saas-Top-SaaS-Category-by-Number-of-User |
Top SaaS Categories by Number of Users |
traffic |
select
app_cat,
(
case saas_cat when 0 then & #039;Sanctioned' else 'Unsactioned' end) as saas_cat_str, count(distinct saasuser) as total_user from ###(select app_s, saas_s%10 as saas_cat, saasuser from (select unnest(apps) as app_s, unnest(saasinfo) as saas_s, coalesce(nullifna(`user`), nullifna(`clouduser`), nullifna(`unauthuser`), srcname, ipstr(`srcip`)) as saasuser from $log where $filter and apps is not null) t where saas_s>=10 group by app_s, saas_cat, saasuser order by saas_cat desc)### t1 inner join app_mdata t2 on t1.app_s=t2.name where saas_cat in (0, 1) group by app_cat, saas_cat order by total_user desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
saas-Top-User-by-Number-of-SaaS-Application |
Top Users by Number of SaaS Applications |
traffic |
select
saasuser,
(
case saas_cat when 0 then & #039;Sanctioned' else 'Unsactioned' end) as saas_cat_str, count(distinct app_s) as total_app from ###(select app_s, saas_s%10 as saas_cat, saasuser from (select unnest(apps) as app_s, unnest(saasinfo) as saas_s, coalesce(nullifna(`user`), nullifna(`clouduser`), nullifna(`unauthuser`), srcname, ipstr(`srcip`)) as saasuser from $log where $filter and apps is not null) t where saas_s>=10 group by app_s, saas_cat, saasuser order by saas_cat desc)### t where saas_cat in (0, 1) group by saasuser, saas_cat order by total_app desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
saas-Top-SaaS-Application-by-Bandwidth-Session |
Top SaaS Applications by Sessions and Bandwidth |
traffic |
select
t2.id as app_id,
app_s,
app_cat,
sum(bandwidth) as bandwidth,
sum(traffic_in) as traffic_in,
sum(traffic_out) as traffic_out,
sum(sessions) as sessions,
sum(session_block) as session_block,
(
sum(sessions)- sum(session_block)
) as session_pass
from
###(select app_s, sum(sentbyte+rcvdbyte) as bandwidth, sum(rcvdbyte) as traffic_in, sum(sentbyte) as traffic_out, count(*) as sessions, sum(is_blocked) as session_block from (select unnest(apps) as app_s, unnest(saasinfo) as saas_s, coalesce(sentbyte, 0) as sentbyte, coalesce(rcvdbyte, 0) as rcvdbyte, (CASE WHEN (logflag&2>0) THEN 1 ELSE 0 END) as is_blocked from $log where $filter and apps is not null) t where saas_s>=10 group by app_s)### t1 inner join app_mdata t2 on t1.app_s=t2.name group by app_id, app_s, app_cat order by bandwidth desc
|
Dataset Name |
Description |
Log Category |
|---|---|---|
|
saas-Top-Tolerated-SaaS-Application-by-Bandwidth |
Top Tolerated SaaS Applications by Bandwidth |
traffic |
select
app_s,
sum(sentbyte + rcvdbyte) as bandwidth
from
(
select
unnest(apps) as app_s,
unnest(saasinfo) as saas_s,
coalesce(sentbyte, 0) as sentbyte,
coalesce(rcvdbyte, 0) as rcvdbyte
from
$log
where
$filter
and apps is not null
) t
where
saas_s = 12
group by
app_s
order by
bandwidth desc