This help contains the following topics:

·     Introduction

·     Restrictions and guidelines

·     Configure the application analysis center

¡     Configure global settings

¡     Customize the settings for each widget

¡     Application usage

¡     User activity

¡     Source IP activity

¡     Destination IP activity

¡     Source security zones

¡     Destination security zones

¡     Security policy usage

¡     Threat activity

¡     Keyword analysis

¡     WAF activity

Introduction

The application analysis center displays the statistics for the following widgets:

·     Application Usage.

·     User Activity.

·     Source IP Activity.

·     Destination IP Activity.

·     Security Policy Usage.

·     Source Security Zones.

·     Destination Security Zones.

·     Threat Activity.

·     WAF Activity.

Each widget displays the statistics based on the following aspects:

·     Bytes—Displays the traffic distribution by bytes.

·     Sessions—Displays session statistics. You can obtain information about which applications, users, and IP addresses have established or occupied a large number of sessions.

·     Threats—Displays threat statistics.

·     URLs—Displays Web access statistics.

·     Files—Displays file filtering statistics.

·     Data—Displays data filtering statistics.

Restrictions and guidelines

If the device updates to a version that supports the application analysis center feature from one that does not, the device performs application analysis only on the data after update.

Configure the application analysis center

Configure global settings

The Application Analysis Center page provides the following global conditions for statistics collection that take effect for all widgets.

Select a context

To display context-based statistics, select a context from the Context list. To display the statistics for all contexts, select All from the list.

Specify the time range

To display the statistics in a time range, select the time range from the Time range list, or click Custom from the list and customize the time range as required.

Select widgets

To customize the widgets displayed on the page, click Select module and select the desired widgets from the list.

Add global filters

To add a filter to filter the statistics, click Filters in the Global filters field, select a filter type, and configure the filter as required.

To remove a filter, hover the mouse over the filter and click the  icon at the right of the filter. To remove all filters, hover the mouse over the Global filters field, and click the  icon at the right end of the field.

Customize the settings for each widget

You can configure the following settings that take effect only for the specified widget.

View more data

By default, each widget displays only top 10 entries. To view more data, click the  icon in the top-right corner of each section.

Add analyzer filters

To add filters for a widget only, click the  icon in the top-right corner of each section, and then set the filters as required.

Switch between analysis aspects

To obtain the statistics for an analysis aspect, select the analysis aspect on the top of each section. The following aspects are supported in the current software version: Bytes, Session, Threats, URLs, Files, and Data. After you select an analysis aspect, the system ranks the statistics based on the analysis aspect. For example, if you select Bytes for Application Usage, the Application Usage section will rank the applications based on the traffic in graphs and tables.

Display data in graphs and tables

The page supports display data in graphs and tables for each widget.

The types of graphs include treemaps (), area graphs (), line graphs (), and histograms (). Support for types of graphs varies by widget.

To display the statistics in a type of graph, click the graph icon in the top-right corner of each section. Only area graphs support the drill down functionality. Drill down is a capability that enables you to view statistics from a general view to a more specific view by clicking the mouse. For example, for the Application Usage widget, you can click the E-Mail area in the area graph. Then, the area graph will display information only about the Email's subcategories, such as 126 Mail and 163 Mail. To view information about a specific Email subcategory, click the subcategory area, like 126 Mail area.

By default, a table displays only top 10 entries. To view more data, click Miscellaneous and select View more data from the list.

The non-numeric columns allow for more actions, such as adding an application name as a widget-specific filter or adding it as a global filter. To bring up the action menu for an item in a non-numeric column, hover the mouse over the item, click the  icon.

Application usage

The Application Usage section displays application usage statistics based on different aspects. You can customize the settings for applications accordingly.

Area graphs provide visibility to the applications with the top bandwidth usages, and provide the drill down capability to present the detailed application statistics.

User activity

The User Activity section displays user statistics based on different aspects. You can customize the settings for users accordingly.

Source IP activity

The Source IP Activity section displays source IP statistics based on different aspects. You can customize the settings for source IPs accordingly.

Destination IP activity

The Destination IP Activity section displays destination IP statistics based on different aspects. You can customize the settings for destination IPs accordingly.

Source security zones

The Source Security Zones section displays statistics of source security zones based on different aspects. You can customize the settings for source security zones accordingly.

Destination security zones

The Destination Security Zones section displays statistics of destination security zones based on different aspects. You can customize the settings for destination security zones accordingly.

Security policy usage

The Security Policy Usage section displays security policy matching count. You can customize the settings for security policies accordingly.

Threat activity

The Threat Activity section displays statistics of the threat events. You can customize the settings for threat defense accordingly.

Keyword analysis

The Keyword section displays data filtering statistics of file transmission, email sending and receiving, and website access based on keywords. You can customize related strategies to reduce the leakage of confidential information and user sensitive information.

WAF activity

The WAF Activity section displays statistics of the WAF attack events. You can customize the settings for WAF protection accordingly.