Viewing the Result of a Predefined Stat-set

The data statistics function is implemented by Stat-set. System provides a series of predefined stat-sets. You can view the statistics result of these stat-sets directly, or customize your own stat-sets to view the statistics results of the specified data types.

Viewing a Predefined Stat-set --- Bandwidth

The predefined stat-set of Bandwidth is designed to gather real-time and history data of the top 10 zones, top 10 interfaces, top 10 applications and top 10 user/IPs.

To view the statistics result of Bandwidth, take the following steps:

1. On the Navigation pane, click Monitor > Predefined > Bandwidth to visit the Overview page. If Bandwidth is disabled, system will ask if you want to enable it. Click Yes on the prompt dialog.
2. The real-time and historic traffic of the top 10 zones, top 10 interfaces, top 10 applications and top 10 user/IPs are displayed in the Overview page. You can select a statistics object (Sent traffic, Received traffic, Total traffic, Total sessions) and period from the drop-down lists on the upper-right. The statistical period is described as follows:
   
   • Real-time: Displays the current traffic statistics. The data is refreshed every 5 seconds.
   • 1 hr: Displays the traffic statistics of the latest 1 hour. The data is refreshed every 30 seconds.
   • 24 hrs: Displays the traffic statistics of the latest 24 hours. The data is refreshed every 10 minutes.
   • 30 days: Displays the traffic statistics of the latest 30 days. The data is refreshed every day.
3. Click the Zone tab to view the traffic statistics of the top 10 zones. The traffic statistics curve/bar chart and pie chart are displayed on the upper. Select a statistics object and period from the drop-down lists on the upper-right to view the corresponding statistics. The names of the top 10 zones and traffic details are displayed in the list below. Click to refresh the real-time data in the list.
4. Click a security zone in the list to view the traffic details of the zone in the Traffic details dialog.
   Statistics: Displays the traffic statistics of the selected zone, including the real-time statistics and statistics for the latest 1 hour, 24 hours and 30 days.
   Application: Displays the applications in the selected zone and the corresponding traffic. Click an application in the list to display its traffic statistics in the curve chart below.
   User/IP: Displays the user/IPs that belong to the selected zone and the corresponding traffic. Click a user/IP in the list to display its traffic statistics in the curve chart below.
   Click to close the dialog.
5. Click the Interface, Application and User/IP tab to view the traffic details of the top 10 interfaces, top 10 applications and top 10 user/IPs respectively.

Viewing a Predefined Stat-set --- Anti-Virus

If system is configured with anti-virus, the predefined stat-set of anti-virus can gather statistics on the top 10 viruses, top 10 attacked applications and top 10 attacked user/IPs.

To view the statistics result of Anti-Virus, take the following steps:

1. On the Navigation pane, click Monitor > Predefined > Anti-Virus to visit the Overview page. If anti-virus is disabled, system will ask if you want to enable it. Click Yes on the prompt dialog.
2. The real-time and historic virus statistics of the top 10 viruses, top 10 attacked applications and top 10 attacked user/IPs are displayed in the Overview page. You can select a statistical period from the drop-down list on the upper-right. The statistical period is described as follows:
   
   • Real-time: Displays the current virus statistics. The data is refreshed every 5 seconds.
   • 1 hr: Displays the virus statistics of the latest 1 hour. The data is refreshed every 30 seconds.
   • 24 hrs: Displays the virus statistics of the latest 24 hours. The data is refreshed every 10 minutes.
   • 30 days: Displays the virus statistics of the latest 30 days. The data is refreshed every day.
3. Click the Virus tab to view the detailed statistics of the top 10 viruses. The virus statistics curve/bar chart and pie chart are displayed on the upper. Select a statistical period from the drop-down lists on the upper-right to view the corresponding statistics. The names of the top 10 viruses and detailed data are displayed in the list below. Click to refresh the real-time data in the list.
4. Click a virus in the list to view its detailed statistics in the AV details dialog.
   Statistics: Displays the statistics of the selected virus, including the real-time statistics and statistics for the latest 1 hour, 24 hours and 30 days.
   User/IP: Displays the top 10 user/IPs that are attacked by the selected virus. Click a user/IP in the list to display the corresponding virus statistics in the curve chart below.

   Click to close the dialog.

5. Click the Application and User/IP tab to view the virus details of the top 10 applications and top 10 user/IPs respectively.

Viewing a Predefined Stat-set --- IPS

If system is configured with IPS, the predefined stat-set of IPS can gather statistics on the top 10 attacks, top 10 attackers and top 10 victims.

To view the statistics result of IPS, take the following steps:

1. On the Navigation pane, click Monitor > Predefined > IPS to visit the Overview page. If IPS is disabled, system will ask if you want to enable it. Click Yes on the prompt dialog.
2. The real-time and historic attack statistics of the top 10 attacks, top 10 attackers and top 10 victims are displayed in the Overview page. You can select a statistical period from the drop-down list on the upper-right. The statistical period is described as follows:
   
   • Real-time: Displays the current intrusion statistics. The data is refreshed every 5 seconds.
   • 1 hr: Displays the intrusion statistics of the latest 1 hour. The data is refreshed every 30 seconds.
   • 24 hrs: Displays the intrusion statistics of the latest 24 hours. The data is refreshed every 10 minutes.
   • 30 days: Displays the intrusion statistics of the latest 30 days. The data is refreshed every day.
3. Click the Attacks tab to view the detailed statistics of the top 10 attacks. The attack statistics curve/bar chart and pie chart are displayed on the upper. Select a statistical period from the drop-down lists on the upper-right to view the corresponding statistics. The names of the top 10 attacks and detailed data are displayed in the list below. Click to refresh the real-time data in the list.
4. Click an attack in the list to view its detailed statistics in the IPS details dialog.
   Statistics: Displays the statistics of the selected attack, including the real-time statistics and statistics for the latest 1 hour, 24 hours and 30 days.
   Attackers: Displays the top 10 attackers of the selected attack. Click an attacker's IP address in the list to display its attack statistics in the curve chart below.
   Victims: Displays the top 10 victims of the selected attack. Click a victim's IP address in the list to display its attack statistics in the curve chart below.
   Details: Displays the details of the selected attack.
   

   Click to close the dialog.

5. Click the Victims and Attackers tab to view the detailed statistics of the top 10 victims and top 10 attackers respectively.

Viewing a Predefined Stat-set --- Attack Defense

If system is configured with Attack Defense, the predefined stat-set of Attack Defense can gather statistics on top 10 attacks, top 10 attackers and top 10 victims.

To view the statistics result of Attack Defense, take the following steps:

1. On the Navigation pane, click Monitor > Predefined > Attack Defense to visit the Overview page. If attack defense is disabled, system will ask if you want to enable it. Click Yes on the prompt dialog.
2. The real-time and historic attack statistics of the top 10 attacks, top 10 attackers and top 10 victims are displayed in the Overview page. You can select a statistical period from the drop-down list on the upper-right. The statistical period is described as follows:
   
   • Real-time: Displays the current attack defense statistics. The data is refreshed every 5 seconds.
   • 1 hr: Displays the attack defense statistics of the latest 1 hour. The data is refreshed every 30 seconds.
   • 24 hrs: Displays the attack defense statistics of the latest 24 hours. The data is refreshed every 10 minutes.
   • 30 days: Displays the attack defense statistics of the latest 30 days. The data is refreshed every day.
3. Click the Attacks tab to view the detailed statistics of the top 10 attacks. The attack statistics curve/bar chart and pie chart are displayed on the upper. Select a statistical period from the drop-down lists on the upper-right to view the corresponding statistics. The names of the top 10 attacks and detailed data are displayed in the list below. Click to refresh the real-time data in the list.
4. Click an attack in the list to view its detailed statistics in the AD detail dialog.
   Statistics: Displays the statistics of the selected attack, including the real-time statistics and statistics for the latest 1 hour, 24 hours and 30 days.
   Attackers: Displays the top 10 attackers of the selected attack. Click an attacker's IP address in the list to display its attack statistics in the curve chart below.
   Victims: Displays the top 10 victims of the selected attack. Click a victim's IP address in the list to display its attack statistics in the curve chart below.
   

   Click to close the dialog.

5. Click the Victims and Attackers tab to view the detailed statistics of the top 10 victims and top 10 attackers respectively.

Viewing a Predefined Stat-set --- ARP Attack

If system is configured with ARP Defense, the predefined stat-set of ARP attack can gather statistics on top 10 ARP attacks.

To view the statistics result of ARP attack, take the following steps:

1. On the Navigation pane, click Monitor > Predefined > ARP Attack to visit the Overview page. If ARP attack is disabled, system will ask if you want to enable it. Click Yes on the prompt dialog.
2. The statistics bar chart, pie chart and list of the top 10 ARP attacks are displayed in the ARP Attack page.
3. To clear an ARP attack in the list, select the attack you want to clear from the list, and then click Clear.

Viewing a Predefined Stat-set --- URL Hit

If system is configured with URL hit, the predefined stat-set of URL Hit can gather statistics on top 10 user/IPs, top 10 URLs and top 10 URL categories.

To view the statistics result of URL Hit, take the following steps:

1. On the Navigation pane, click Monitor > Predefined > URL Hit to visit the Overview page. If URL Hit is disabled, system will ask if you want to enable it. Click Yes on the prompt dialog.
2. The real-time and historic statistics of the top 10 user/IPs, top 10 URLs and top 10 URL categories are displayed in the Overview page. You can select a statistical period from the drop-down list on the upper-right. The statistical period is described as follows:
   
   • Real-time: Displays the current URL Hit statistics. The data is refreshed every 5 seconds.
   • 1 hr: Displays the URL Hit statistics of the latest 1 hour. The data is refreshed every 30 seconds.
   • 24 hrs: Displays the URL Hit statistics of the latest 24 hours. The data is refreshed every 10 minutes.
   • 30 days: Displays the URL Hit statistics of the latest 30 days. The data is refreshed every day.
3. Click the User/IP tab to view the detailed statistics of the top 10 user/IPs. The top 10 user/IPs statistics curve/bar chart and pie chart are displayed on the upper. Select a statistical period from the drop-down lists on the upper-right to view the corresponding statistics. The names of the top 10 user/IPs and detailed hit count are displayed in the list below. Click to refresh the real-time data in the list.
4. Click a user/IP in the list to view its detailed statistics in the URL Filter Details dialog.
   Statistics: Displays the URL hit statistics of the selected user/IP, including the real-time statistics and statistics for the latest 1 hour, 24 hours and 30 days.
   URL: Displays the top 10 URLs that are accessed by the selected user/IP. Click a URL in the list to display its hit count statistics in the curve chart below.
   

   Click to close the dialog.

5. Click the URL and URL Category tab to view the detailed statistics of the top 10 URLs and top 10 URL categories respectively.

Viewing a Predefined Stat-set --- Keyword Block

If system is configured with Keyword Block, the predefined stat-set of Keyword Block can gather statistics on the top 10 hit Web keyword, top 10 hit Web keywords, top 10 hit email keywords, top 10 hit posting keywords and top 10 users/IPs.

To view the statistics result of Keyword Block, take the following steps:

1. On the Navigation pane, click Monitor > Predefined > Keyword Block to visit the Overview page. If Keyword Block is disabled, system will ask if you want to enable it. Click Yes on the prompt dialog.
2. The real-time and historic statistics of the top 10 hit Web keyword, top 10 hit Web keywords, top 10 hit email keywords, top 10 hit posting keywords and top 10 users/IPs are displayed in the Overview page. You can select a statistical period from the drop-down list on the upper-right. The statistical period is described as follows:
   
   • Real-time: Displays the current Keyword Block statistics. The data is refreshed every 5 seconds.
   • 1 hr: Displays the Keyword Block statistics of the latest 1 hour. The data is refreshed every 30 seconds.
   • 24 hrs: Displays the Keyword Block statistics of the latest 24 hours. The data is refreshed every 10 minutes.
   • 30 days: Displays the Keyword Block statistics of the latest 30 days. The data is refreshed every day.
3. Click the Web Content tab to view the detailed statistics of the top 10 hit Web keywords. The top 10 hit Web keywords statistics curve/bar chart and pie chart are displayed on the upper. Select a statistical period from the drop-down lists on the upper-right to view the corresponding statistics. The top 10 hit Web keywords and detailed block count are displayed in the list below. Click to refresh the real-time data in the list.
4. Click a keyword in the list to view its detailed block statistics in the Keyword Block Details dialog.
   Statistics: Displays the statistics of the selected keyword, including the real-time statistics and statistics for the latest 1 hour, 24 hours and 30 days.
   User/IP: Displays the top 10 user/IPs that are blocked by the selected keyword. Click a user/IP in the list to display the corresponding block count statistics in the curve chart below.
   Click to close the dialog.
5. Click the Email Content, Web Posting and User/IP tab to view the detailed statistics of the top 10 hit email keywords, top 10 hit posting keywords and top 10 users/IPs respectively.

Viewing a Predefined Stat-set --- Application Block

If system is configured with Policy, the predefined stat-set of application block can gather statistics on the top 10 applications and top 10 user/IPs.

To view the statistics result of application block, take the following steps:

1. On the Navigation pane, click Monitor > Predefined > Application Block to visit the Overview page. If application block is disabled, system will ask if you want to enable it. Click Yes on the prompt dialog.
2. The real-time and historic statistics of the top 10 applications and top 10 users/IPs are displayed in the Overview page. You can select a statistical period from the drop-down list on the upper-right. The statistical period is described as follows:
   
   • Real-time: Displays the current application block statistics. The data is refreshed every 5 seconds.
   • 1 hr: Displays the application block statistics of the latest 1 hour. The data is refreshed every 30 seconds.
   • 24 hrs: Displays the application block statistics of the latest 24 hours. The data is refreshed every 10 minutes.
   • 30 days: Displays the application block statistics of the latest 30 days. The data is refreshed every day.
3. Click the Application tab to view the detailed statistics of the top 10 applications. The top 10 applications statistics curve/bar chart and pie chart are displayed on the upper. Select a statistical period from the drop-down lists on the upper-right to view the corresponding statistics. The top 10 applications and detailed block count are displayed in the list below. Click to refresh the real-time data in the list.
4. Click an application in the list to view its detailed block statistics in the Application Block Details dialog.
   Statistics: Displays the block count statistics of the selected application, including the real-time statistics and statistics for the latest 1 hour, 24 hours and 30 days.
   User/IP: Displays the top 10 user/IPs that are blocked from the selected application. Click a user/IP in the list to display the corresponding block count statistics in the curve chart below.
   Click to close the dialog.
5. Click the User/IP tab to view the detailed statistics of the top 10 user/IPs.

Viewing a Predefined Stat-set --- Auth User

If system is configured with 802.1X, SSL VPN, Web Auth, Proxy or Static Binding, the predefined stat-set of auth user can gather statistics on the authenticated users.

To view the statistics result of Auth User, take the following steps:

1. On the Navigation pane, click Monitor > Predefined > Auth User to visit the Overview page. If auth user is disabled, system will ask if you want to enable it. Click Yes on the prompt dialog.
2. Information about the logged in users is displayed in the Auth User page. You can filter the users in the list by selecting a condition from the AAA Server or User Type drop-down list, or by typing a keyword into the Auth User box and clicking Search; click to refresh the real-time data in the list; click a user in the list to display the details of the user in the User Details dialog; click Kick Out under the Operation column to kick the user out.