Running Secure Web Gateway reports

Monitoring Secure Web Gateway data

about-monitoring-swg-summary-data

Running Secure Web Gateway summary reports

Before BIG-IQ can display Access report data for a managed BIG-IP device, you must first complete the following tasks:

• Add the managed BIG-IP device to the BIG-IQ Centralized Management inventory
• Discover and import the managed BIG-IP device
• Have a BIG-IQ user enable Access remote logging configuration on the managed BIG-IP device

To discover and import a configuration and deploy configurations to a managed BIG-IP device, users must belong to one of the following RBAC roles:

• Admin
• Access Manager
• Access Deployer

Only a device with SWG provisioned on it can provide data for Secure Web Gateway reports.

You can create SWG reports for Access groups, clusters (in Access groups), or devices that you select from the Access groups and clusters (in Access groups) on the BIG-IQ system.

1. At the top of the screen, click Monitoring.

2. Monitoring > DASHBOARDS > Access > Secure Web Gateway > Secure Web Gateway Summary.

   A Summary report (for all devices and a default timeframe) starts to generate and display.

3. From the left, select any report that you want to run.

4. From the ACCESS GROUP/DEVICE list at upper left, select Managed Devices or select one or more of these options:

   • <Access group name> Select to include all devices in the Access group.
   • <Cluster display name> Select to include the devices in the cluster.
   • <Device name> Select to include the device. You can select any device from Managed Devices, <Access group name>, or <Cluster display name>.

5. From the TIMEFRAME menu, specify a time frame:

   • Select a predefined time period. These range from Last hour to Last 3 months.
   • Set a custom time period. Select Between, After, or Before, and click the additional fields that display the set dates and times that support your selection.

6. To save report data in a comma-separated values (CSV) file, click the CSV Report button.

   The CSV file downloads.

data-swg-summary-dashboard

In the short description, briefly describe the purpose and intent of the information contained in this topic. This element is an F5 requirement.

about-monitoring-swg-application-data

view-and-configure-swg-application-data

1. On the Main tab, click Navigation object 1 > Navigation object 2 > Navigation object 3.

data-swg-application-data-ref

In the short description, briefly describe the purpose and intent of the information contained in this topic. This element is an F5 requirement.

about-monitoring-swg-application-families

view-and-configure-swg-application-families

1. On the Main tab, click Navigation object 1 > Navigation object 2 > Navigation object 3.

data-swg-application-families-ref

In the short description, briefly describe the purpose and intent of the information contained in this topic. This element is an F5 requirement.

about-monitoring-swg-url-categories

view-and-configure-swg-url-categories

1. On the Main tab, click Navigation object 1 > Navigation object 2 > Navigation object 3.

data-swg-url-categories-ref

In the short description, briefly describe the purpose and intent of the information contained in this topic. This element is an F5 requirement.

about-monitoring-swg-client-ip-addresses

view-and-configure-swg-client-ips

1. On the Main tab, click Navigation object 1 > Navigation object 2 > Navigation object 3.

data-monitoring-swg-client-ips

In the short description, briefly describe the purpose and intent of the information contained in this topic. This element is an F5 requirement.

about-monitoring-swg-hostnames

view-and-configure-swg-hostnames

1. On the Main tab, click Navigation object 1 > Navigation object 2 > Navigation object 3.

data-monitoring-swg-hostnames

In the short description, briefly describe the purpose and intent of the information contained in this topic. This element is an F5 requirement.

about-monitoring-bypassed-ssl-requests

view-and-configure-bypassed-ssl-requests-reports

1. On the Main tab, click Navigation object 1 > Navigation object 2 > Navigation object 3.

data-bypassed-ssl-requests

In the short description, briefly describe the purpose and intent of the information contained in this topic. This element is an F5 requirement.

about-monitoring-swg-url-filters

view-and-configure-swg-url-filters

1. On the Main tab, click Navigation object 1 > Navigation object 2 > Navigation object 3.

data-swg-url-filters

In the short description, briefly describe the purpose and intent of the information contained in this topic. This element is an F5 requirement.

about-monitoring-swg-url-requests-by-url

view-and-configure-swg-url-data

1. On the Main tab, click Navigation object 1 > Navigation object 2 > Navigation object 3.

data-swg-url-reports

In the short description, briefly describe the purpose and intent of the information contained in this topic. This element is an F5 requirement.

about-monitoring-url-requests-by-user

view-and-configure-reports-of-url-requests-by-user

In the short description, briefly describe the purpose and intent of the information contained in this topic. This element is an F5 requirement.

data-url-requests-by-user-swg-reports

In the short description, briefly describe the purpose and intent of the information contained in this topic. This element is an F5 requirement.

View SWG statistics for all managed devices

Before you can display statistics in the SWG analytics screen, you must have the following configured:

• A BIG-IQ data collection device configured for the BIG-IQ device

• The BIG-IP device located in your network and running a compatible software version

• To view the SWG Dashboard, statistics collection on the BIG-IP device should be enabled.

  Note: For BIG-IP devices running versions 13.1.0.5 or later, enabling the BIG-IP device’s statistics collection may affect the information that appears in the Secure Web Gateway Summary screen (Monitoring > DASHBOARDS > Access > Secure Web Gateway > Secure Web Gateway Summary).

• For BIG-IP devices running versions 13.1.0.5, or later, you must have AVR provisioned on your BIG-IP device.

View statistics for all traffic managed with Secure Web Gateway (SWG) to ensure that your configured access profile properly secures the users within your network.

1. Click Monitoring > DASHBOARDS > Access > SWG.

   The screen displays the SWG analytics screen. By default, the screen displays statistics from the past hour. You can adjust the time settings using the controls found at the top of the screen.

2. To display events that correspond with the chart timeline, click Events.

   Events that occurred within the selected time period are displayed in the chart. You can select the event icons within the chart to display event details.

3. Expand the dimensions found at the far right of the screen to view additional data.

4. Filter displayed data by dimension objects:

   1. To filter data by one or more BIG-IP devices, expand BIG-IP Host Names or BIG-IP Blade Numbers and select one or more dimension objects.

   2. To filter data by traffic or security settings (e.g. a URL category and a corresponding action) expand the remaining dimensions and select one or more dimension objects.

      Note: You can select objects from multiple dimensions. Once you select an object, only dimensions with corresponding data are displayed in the charts and dimensions

Briefly explain the outcome of having completed this task. This element is optional, but recommended.

To edit your SWG settings go to Configuration > ACCESS > Access Groups and select the Access group name. For more information about Access group configuration, refer to the BIG-IQ Centralized Management: Access on support.f5.com for configuration information.

Getting the details that underlie an SWG report

Before BIG-IQ can display Access report data for a managed BIG-IP device, you must first complete the following tasks:

• Add the managed BIG-IP device to the BIG-IQ Centralized Management inventory
• Discover and import the managed BIG-IP device
• Have a BIG-IQ user enable Access remote logging configuration on the managed BIG-IP device

To discover and import a configuration and deploy configurations to a managed BIG-IP device, users must belong to one of the following RBAC roles:

• Admin
• Access Manager
• Access Deployer

Only a device with SWG provisioned on it can provide data for SWG reports.

From the Summary report, the initial display includes graphs that summarize the report data. You can get more detailed information by clicking a bar or a point on a graph to see additional graphs and tables with supporting entries.

1. At the top of the screen, click Monitoring.

2. On the left, select DASHBOARDS > Access > Secure Web Gateway.

   The Summary starts to generate and display. A timeline and some summaries display across the top of the screen. Graphs display under the summaries. Each graph provide different views of the data.

3. Click any bar in a graph on the display to get more information.

   Additional graphs provide different views of the data, and supporting data displays in a table at the bottom of the screen.

4. If more details are available, click the bars in the graphs to display them.

5. Scroll down to the table to view the supporting data.