Cisco Cisco Web Security Appliance S670 User Guide
2-5
Cisco Advanced Web Security Reporting 6.0 Installation, Setup, and User Guide
Chapter 2 Filters and Dashboards
Creating A Custom Filter
Creating A Custom Filter
When you configure a custom filter, the Advanced Web Security Reporting searches the “data model”
you have selected, filtering and displaying the model’s data set by “data object(s),” or “attribute(s),”
which you have also selected. Each available data model represents a set of logs of a specific type, while
each data object represents a specific log type, or sometimes a data set, that is a child component of the
current data model.
you have selected, filtering and displaying the model’s data set by “data object(s),” or “attribute(s),”
which you have also selected. Each available data model represents a set of logs of a specific type, while
each data object represents a specific log type, or sometimes a data set, that is a child component of the
current data model.
Follow these steps to filter and display a specific set of log data:
Step 1
Click Custom Filter in the Advanced Web Security Reporting’s menu bar.
Step 2
On the Select a Data Model page, choose the data model to search:
•
AMP Access Model – all available Advanced Malware Protection logs.
•
SOCKS Access Model – all available SOCKS logs.
•
Web Access Model – all other available Web-related logs (for example, user- and domain-related
access logs).
access logs).
Each data model represents the collected logs of the named type.
Step 3
On the Select a Data Object page:
a.
Expand the list of data objects available in the selected Data Model by clicking the right-arrow
preceding the Data Model Event name (for example, “Web Access Event”).
preceding the Data Model Event name (for example, “Web Access Event”).
b.
Click a data object (Event or Attribute) and then choose either Top Values or Top Values by Time.
If you choose Top Values, the chosen Attribute data is displayed in rows; each row presents a second
column displaying the event count for that particular Attribute entry.
column displaying the event count for that particular Attribute entry.
If you choose Top Values by Time,
_time
is the filter for Split Rows, and the chosen Attribute is
the Split Columns filter. That is, each row represents an event time and each column represents a
specific Attribute entry; thus, each table cell presents the number of occurrences of the given
Attribute at a specific time.
specific Attribute entry; thus, each table cell presents the number of occurrences of the given
Attribute at a specific time.
Note
The symbol preceding each Attribute entry indicates its type; for example, an alphanumeric or
numeric value.
numeric value.
Step 4
If you chose Top Values in the previous step, you can additionally filter the displayed data by choosing
another Attribute from the Split Columns menu.
another Attribute from the Split Columns menu.
Step 5
You can further adjust the information presented, and its presentation, on the custom filter dashboard, as
desired. See
desired. See
for more information.
Step 6
To save this custom filter dashboard, choose Save As > Dashboard Panel; it will appear in the Custom
Dashboards menu under the name you provide.
Dashboards menu under the name you provide.
Note
Whenever the current filter’s table or chart is being loaded or refreshed, you can click the Pause or Stop
buttons. You can click Reload at any other time to reload the filtered data.
buttons. You can click Reload at any other time to reload the filtered data.