Reports and analysis
CSP (Central Syslog) sums up the logs of the subscription in two ways:
- the Analysis is a page always up to date, to see at a glance how the devices behave;
- the Reports are documents of a day, a week or a month, made when the period closes and never changed afterwards, to read, print or keep.
The analysis
The Analysis tile counts the logs of the subscription by hour. In Period choose Last 24 hours, Last 7 days, Last 30 days or Last 12 months.
| Section | What it shows |
|---|---|
| Logs by severity | How many logs arrived in each hour, day or week, split into errors (error and worse), warnings and information. An interruption of the reception in the period is written under the chart |
| Devices | The devices that sent the most, with their Errors and the Change compared with the same period before. A click opens the logs of that device in the period |
| Days and hours | When the logs arrive, in your time zone |
| Events | The events recognized by the profiles of the devices (see below) |
The counts are updated every five minutes and stay for 25 months, even after the logs have been deleted.
What to look at
- A device that suddenly sends much more or much less than usual deserves a look: an attack, a fault, a configuration changed.
- In Days and hours activity at night or at the weekend stands out.
- A device marked new had not sent anything in the period before.
The events
The profiles of the devices read the logs and count the events by category: Sign ins, Administration, Accounts, Firewall, VPN, Traffic and others, with their outcome (successful and failed, allowed and blocked). Next to them, the values seen most often: Addresses of the failed sign ins, Users of the failed sign ins, Addresses blocked by the firewall, Destination ports of the traffic.
The events are counted with the hourly summaries, so the last minutes arrive a little later. A device without a profile gives no events: the profile is chosen on its page (see Devices and quarantine).
The reports
The Reports tile is there if the plan of the subscription includes the service. It lists the reports made, with Period, Kind (Daily, Weekly, Monthly), Coverage and number of Logs.
Choosing which reports
In Your choices:
- A report every day, A report every week, on Monday, A report every month, on the first: which periods you want;
- Keep the reports for (months): from 25 months up, to the maximum of the plan. The older reports are deleted.
Then Save. A report is made when its period closes in your time zone, and when it is ready an email arrives (your provider decides who receives it, in the notifications).
What a report holds
| Section | Content |
|---|---|
| Coverage of the monitoring | For how much of the period the reception was active, its interruptions, and the devices that sent nothing |
| Logs by severity | The logs of the period by severity, compared with the period before |
| Devices | The devices and their logs, compared with the period before |
| Errors and worse | The most frequent messages of severity error or worse |
| Events read by the profiles | Sign ins, administration, firewall, VPN and traffic with their outcome, and the most frequent addresses, users and ports |
| Event alerts | The episodes of the period (see Event alerts) |
| Senders not authorized | What arrived in the quarantine |
Reading, printing, keeping
Open a report to read it. Print or save as PDF prints it or saves it as PDF from the browser.
A report, once made, never changes. At the bottom is the SHA-256 fingerprint of its data: a copy saved as PDF can be compared with the one in the panel, to show that it was not changed.
Reports and NIS2
The monthly reports are a good basis to document the monitoring: they say that the logs were collected, for how long the reception was active, which devices were silent and which events were detected. Save them as PDF with the rest of your security documentation.