Viewing Reports in Micro Edge

Overview

Micro Edge's reports provide in-depth details about the traffic passing through it as well as the actions Micro Edge took with that traffic.

Pagination

Grid-type Reports can be very large, so each is broken down by pages to improve loading times. Page controls are found at the bottom right-hand side of each Report.

Additional column options

Some Reports display a pre-selected "default" selection of columns, intended to provide the most immediate or relevant information. However, there are often more columns which you can add as necessary: just hover over any given column header to reveal the three vertical lines icon (or "hamburger menu"). Click that icon to open the Report configuration menu, then hover over the Columns item to reveal the additional options.

Date selector

Each Report has a date selector which can be used to narrow the range of data shown.

Bandwidth

Reports in this category deal with bandwidth usage over time and are broken down into three views:

Clients

Bandwidth usage on a per-host (i.e., per IP address or per device) basis.

This report can help to determine if a particular device is generating an unusual amount of traffic, perhaps to determine if it is misconfigured or has been infected with malware.

Server Ports

Destination ports which have received the most bandwidth-intensive usage.

This report can help you determine if a particular port or service is using a large amount of bandwidth. For example, in most environments, HTTPS traffic (server port 443) will be near the top of the list.

Applications

Application signatures using the most bandwidth.

This report is helpful when you need to determine if a particular application is using a large amount of bandwidth. This report uses the 'matched' condition, rather than 'inferred': application signatures are only recorded when Micro Edge is certain it has identified the application correctly.

WAN Performance

Reports in this section detail the usage & performance of any WAN interfaces. Each category is split up by WAN interfaces, if you have more than one. You can click on the name of any WAN under the chart to hide that WAN from the display.

Interface Usage	Average throughput for the WAN.
Packet Loss	Packets lost in transmission.
Latency	Average latency (or "lag") of the WAN. Lower numbers are preferable, indicating a lower travel time between nodes.
Jitter	Variability in latency. For example, if the latency is between 10-30 ms for a given period, the jitter is 20 ms. Lower numbers are preferable, as they indicate a more stable connection.

Sessions

Where Micro Edge's Sessions viewer provides a live "snapshot" of traffic at that moment, this Report provides a historical view of sessions processed through Micro Edge.

All Sessions	Contains all the information Micro Edge has concerning each session: source and destination IPs & ports, interfaces used, DNS resolution results for web traffic, &c.
WAN Routing	Contains details about which WAN was used for the session, according to which WAN Rule & WAN Policy. Useful for determining whether traffic is being routed through the appropriate WAN(s).
Access Blocked Sessions	Displays sessions which were blocked by an Access Rule. These are typically sessions destined to Micro Edge itself: attempts to connect to its Web GUI, for example.
Filter Blocked Sessions	Displays sessions which were blocked by a Filter Rule. These are typically sessions passing through Micro Edge.

Threat Prevention

These Reports provide details about sessions blocked by Threat Prevention for exceeding the reputation threshold.

Blocked Summary	Counts connections blocked to particular IP addresses.
Blocked Addresses	Details about any session blocked by Threat Prevention: the IP address the session originated from; the IP it was destined to; and Trustworthiness Score of the session (i.e., the reason the session was blocked).

Dynamic Blocklist

These Reports provide details about sessions blocked by the Dynamic Blocklist.

Blocked Summary	Counts blocked connections to particular IP addresses or domains.
Blocked Addresses	Details about any session blocked by Dynamic Blocklist: the IP address the session originated from; the IP it was destined to; and so on.

Web Filter

These Reports provide details about sessions blocked by the Web Filter.

Summary	Details of web traffic sessions on ports 80 & 443.
Visited Sites	Details about all websites visited.

Geo-IP Filter

These Reports provide details about sessions blocked by the Geo-IP Filter.

Outbound Blocked Sessions	Details sessions traversing Micro Edge out to the greater internet.
Inbound Blocked Sessions	Details sessions inbound to devices within your network.
Outbound Blocked Countries	Details outbound connections to countries blocked by Geo-IP Filter.
Inbound Blocked Countries	Details inbound connections from countries blocked by Geo-IP Filter.
Distribution Map	Displays the locations of various connections upon a map.

Application Control

These Reports provide details about sessions categorized by Application Control.

Applications

Details of sessions associated with specific applications.

Captive Portal

These Reports provide details about sessions intercepted by Captive Portal.

Captive Portal Summary	Details of web sessions scanned by Captive Portal.
Events	Details of web sessions captured by Captive Portal.

Policy Manager

These Reports provide details about Policy Manager events.

Events

Details actions taken by Policy Manager: sync events, Policy application, and so on.

Denial of Service

These Reports provide details about sessions blocked by the Denial of Service engine.

Events

Details all sessions blocked by the DoS prevention service.

DNS Filter

These Reports provide details about sessions blocked by the Web Filter.

Summary	Details of web traffic sessions scanned by the DNS Filter.
Visited Domains	Details about all domains visited.

Comments