Management and Troubleshooting · Topic 4 of 6
Dashboards and Reporting in the FMC
Learn how FMC dashboards, widgets and report templates work, how to schedule and share reports, and how time ranges and filters shape what you see.
- 4 min
- A dashboard is made of tabs that hold widgets.
- Each widget has a time range that you can change.
- Clicking a widget item lets you drill down to the events behind it.
What it is
Dashboards show live summaries of what the firewalls see, and reports turn the same data into documents.
A dashboard is a page of widgets. Each widget is a small chart or table, such as top applications or top attackers. A report is built from a template and produces a file you can read or send.
Both use the events that the Secure Firewall Management Center (FMC) stores.
How it works
Dashboards help you spot problems quickly, and reports help you share results.
Dashboards
A dashboard has one or more tabs, and each tab holds widgets. The FMC includes preset dashboards, and you can build your own.
Widgets cover many topics. You can show connection data, intrusion data, malware data, users, applications and health. Each widget has a time range, and you can change it to see an hour, a day or a longer period.
You can add, move and resize widgets, and you can set the refresh rate. A custom dashboard lets you place the widgets that matter for your job in one view.
Where the dashboards appear in the menu depends on the release, so check your version.
Drill down
Most widgets let you click an item to see the events behind it. A top attackers chart can lead you to the intrusion events for one source address. This is the usual path from an overview to a detail.
Reports
A report starts from a report template. The template says what sections to include, which data to use and which time window applies.
| Part | What it holds |
|---|---|
| Sections | Tables, charts and text blocks |
| Input parameters | Filters such as device, time range and search |
| Output | The report format, such as PDF, HTML or CSV |
| Schedule | An optional time to run it |
The FMC includes standard templates, and you can make your own. You can also generate a report from the search results you are viewing, which saves effort.
Risk reports
The FMC offers risk oriented reports as standard templates. They give an overview of attacks, malware and network risk in a form that managers can read. Names and sections vary by release, so open the template list to see what you have.
Scheduling and delivery
A report can run once, or on a schedule such as daily or weekly. The FMC can email the result to people, and it can store it for later download.
The email setting must be configured first in the FMC system settings, because a report email needs a mail relay.
Good practice
Keep time ranges sensible, because large ranges take longer to build. Use filters to focus on a device or a network. Name the reports clearly so people can tell them apart.
Remember that reports reflect the stored events. If the logging settings in a rule do not record an event, it will not appear in a dashboard or a report.
What to remember for the exam
Seven facts cover the usual questions.
- A dashboard is made of tabs that hold widgets.
- Each widget has a time range that you can change.
- Clicking a widget item lets you drill down to the events behind it.
- A report is built from a template with sections, parameters and an output format.
- Reports can be scheduled and emailed.
- Email delivery needs a mail relay set in the FMC system settings.
- Data in dashboards and reports depends on what the rules log.
If a question asks how to share a regular summary with managers, think of a scheduled report that is emailed.
Common mistakes
These four mistakes are common with dashboards and reports.
Expecting data that was never logged. A rule with no logging produces no events to show.
Using a huge time range. The widget or report takes long to build.
Forgetting the mail relay. Emailed reports fail without it.
Treating a dashboard as an archive. It shows a window of data, so use reports to keep a record.
Reports can show sensitive details such as users and addresses. Share them only with people who should see them.
Check yourself
Work through these three questions.
What is a widget?
A small chart or table on a dashboard tab, such as top applications, with its own time range.
What does a report template define?
It defines the sections, the input parameters and the output format of a report.
Why might a report miss a block event?
The rule that blocked the traffic may not have logging turned on, so no event was stored.
Topic 4 of 6 in Management and Troubleshooting
Test yourself on Management and Troubleshooting
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.