Report for all blocked connection

[CyrilFR 0]

Hi

We are migrating 200 PC from endpoint antivirus to endpoint security.

We will enable Firewall, with custom rules  (active directory, vpn, professionnal app...)

We want to generate a repport with all blocked connection ( Like TCP 3389, UDP 137 ...) for all computers for 7 days.
It will help us to check if all rules are OK and if we don't forget any app or network share.

 

I try to enable diagnostics logs by policy but don't work and seem to display a yellow notification on coputer every 5 minutes
I try to enable Log collection on Eset protect computer logs, but it did nothing.

 

Do you have a kb or experience to share ?

 

Thanks

 

 

 

[Marcos 5,074]

Blocked connections are not reported to ESET PROTECT nor logged locally on endpoints by default. Enabling it could result in huge firewall logs that take up a lot of disk space and reporting them to ESET PROTECT could cause the sever unresponsive and the database to grow to terabytes in case of networks with several thousands of endpoints. You can enable diagnostic logging for a specific client for a limited time in client details, however:

[CyrilFR 0]

Thanks for your reply

Blocked connections are logged locally on endpoints by default. (screenshot attached)  60 min is enough

This can't be reported to Protect with policy ?  It's not terabytes of data, just some lines of logs

 

 

[Marcos 5,074]

Unfortunately the list of recently blocked connections is currently available only locally via the firewall troubleshooting wizard. We will consider adding reporting this information to ESET PROTECT, however.

In the mean time I'd recommend using diagnostic logging in client details to get a log of blocked connections from a particular client.