Skip to main content

Report Views

Overview#

Sensei has rich report views which allow you to analyze both the big picture and the detailed per-connection events. The reports may be filtered to display only the data you wish to view.

Summarized traffic data and threat activity sessions in your network may be viewed at different time intervals. With the help of Sensei’s reporting capabilities, you can quickly identify network security threats across your network(s).

To view the reports of a node:

  • Select the Node
  • Click Reports on the left sidebar menu

Viewing Sensei Reports on Cloud Portal

Figure 1. Viewing Sensei Reports

Report Views#

There are six types of predefined Sensei report views. Each one is displayed in a different tab on the Reports page. You can easily navigate between the report views by clicking the tabs on this page.

1. Connections Report View#

Connections report view shows both internal and external connections made by various applications in your network. These connections may not only be HTTP/HTTPS traffic but also any type of protocol.

Connections Report View on Cloud Portal

Figure 2. Connections report view

This report view includes:

  • The protocols used for the connections
  • The application name and categories
  • The duration of the connection and many other details.

There are 15 types of charts in the Connections report view:

  • App Categories Breakdown

  • Apps Breakdown

  • Egress New Connections by App Over Time

  • Egress New Connections by Source Over Time

  • Egress New Connections Heatmap

  • Table of Remote Hosts

  • Top Egress Users

  • Top Ingress Users

  • Top Local Hosts

  • Top Remote Hosts

  • Top Remote Ports

  • Top Locale Serving Ports

  • Unique Local Hosts

  • New Connections & Unique Remote Hosts

  • Interfaces & Vlans

  • Policies

2. Threats Report View#

If the packet engine detects suspicious activity on your network such as a spam site connection, malware activity, or a phishing server connection, you may view these security violations in the Threats tab. Any threat that has been identified by the engine based on the selected options in the Advanced Security and Essential Security panes on the Policies page will be displayed in this report view.

Threats Report View on Cloud Portal

Figure 3. Threats report view

There are 10 types of charts in the Threats report view:

  • Threats Detected and Allowed

  • Top Detected Threats

  • Top Detected Users

  • Top Detected Hosts

  • Top Threat Destinations

  • Top Blocked Threats

  • Top Blocked Hosts

  • Top Blocked Users

  • Interfaces & Vlans

  • Policies

3. Blocks Report View#

The Blocks report view displays information about the blocked sessions based on your web filtering and application control policies. If the packet engine blocks any connection according to your defined policy rules, you can find the details about these blocked connections in this view.

Blocks Report View

Figure 4. Blocks report view

There are eight types of charts in the Blocks report view:

  • Top Blocks

  • Top Egress Users

  • Top Ingress Users

  • Blocked Local Hosts and Reasons

  • Blocked Conversations Heatmap

  • Blocked Local Hosts Over Time

  • Interfaces & Vlans

  • Policies

4. Web Report View#

The Web report view shows web-based traffic generated by browsing websites or API calls. This tab provides detailed information about top talker hosts, users, the request methods (GET, POST, etc.), the website category, and other information useful to monitor your network’s web activities.

Web Report View on Cloud Portal

Figure 5. Web report view

There are 12 types of charts in the Web report view:

  • HTTP Transactions by Source Over Time

  • Top HTTP Versions

  • Top HTTP Response Codes

  • Top Web Ports

  • Top Talkers Heatmap

  • Top Categories

  • Top OS

  • Top User Agents

  • Top Request Methods

  • Top Devices

  • Policies

  • Interface & Vlans

5. DNS Report View#

You can view all information about the most frequent DNS requests and other DNS-related information on the DNS report view.

DNS Report View on Cloud Portal

Figure 6. DNS report view

There are six types of charts in the DNS report view:

  • DNS Query Types Tag Cloud

  • DNS Response Codes Tag Cloud

  • DNS Queries Distribution

  • DNS Transactions Heatmap

  • Policies

  • Interface & Vlans

6. TLS Report View#

You can view the TLS session information such as the IP/hostname, categories of the sessions, the ports used, and other metrics in the TLS report view.

TLS Report View on Cloud Portal

Figure 7. TLS report view

There are six types of charts in the TLS report view:

  • Destination Ports

  • Top TLS Session Creators Over Time

  • Top TLS Servers Over Time

  • Top Talkers Heatmap

  • Web Categories Breakdown

  • Policies

  • Interface & Vlans