report_groups = { traffic_group = { date_time = true days = true day_of_week = true hour_of_day = true } content_group = { page = true cs_uri_stem = true cs_uri_query = true file_type = true url = true s_content_path = true cs_media_name = true cs_media_role = true audiocodec = true videocodec = true } filtering_group = { sc_filter_result = true sc_filter_category = true x_virus_id = true } # Visitor demographics is not appropriate for firewall logs, so we check here if this is a firewall log before # adding these views. If it is, they will go into the "users" category. visitor_demographics_group = { hostname = { include_if = "(!node_exists(\"profiles.$(volatile.new_profile_name).log.format.server_type\") or ($\"profiles.$(volatile.new_profile_name).log.format.server_type\") ne \"firewall\"));" } c_ip = { include_if = "(!node_exists(\"profiles.$(volatile.new_profile_name).log.format.server_type\") or ($\"profiles.$(volatile.new_profile_name).log.format.server_type\") ne \"firewall\"));" } domain_description = { include_if = "(!node_exists(\"profiles.$(volatile.new_profile_name).log.format.server_type\") or ($\"profiles.$(volatile.new_profile_name).log.format.server_type\") ne \"firewall\"));" } location = { include_if = "(!node_exists(\"profiles.$(volatile.new_profile_name).log.format.server_type\") or ($\"profiles.$(volatile.new_profile_name).log.format.server_type\") ne \"firewall\"));" } req__vars_auth_user = true } # visitor_demographics # Views about users (mostly for firewalls-- see visitor_demographics above). users_group = { hostname = { include_if = "(node_exists(\"profiles.$(volatile.new_profile_name).log.format.server_type\") and ($\"profiles.$(volatile.new_profile_name).log.format.server_type\") eq \"firewall\"));" } c_ip = { include_if = "(node_exists(\"profiles.$(volatile.new_profile_name).log.format.server_type\") and ($\"profiles.$(volatile.new_profile_name).log.format.server_type\") eq \"firewall\"));" } domain_description = { include_if = "(node_exists(\"profiles.$(volatile.new_profile_name).log.format.server_type\") and ($\"profiles.$(volatile.new_profile_name).log.format.server_type\") eq \"firewall\"));" } location = { include_if = "(node_exists(\"profiles.$(volatile.new_profile_name).log.format.server_type\") and ($\"profiles.$(volatile.new_profile_name).log.format.server_type\") eq \"firewall\"));" } } # users referrer_group = { referrer = true referrer_description = true search_engine = true search_phrase = true search_phrases_by_search_engine = true } visitor_systems_group = { screen_dimensions = true screen_depth = true web_browser = true operating_system = true } sessions_group = { sessions_overview = true session_paths = true session_page_paths = true entry_pages = true exit_pages = true page_paths = true session_pages = true session_users = true individual_sessions = true } technical_group = { worm = true spider = true authenticated_user = true cs_username = true cs_user_name = true cs_method = true cs_version = true cs_cookie = true cs_cookie = true cs_uri_scheme = true cs_content_type = true action = true operation = true mime_type = true timestamp = true c_status = true protocol = true transport = true channelurl = true cs_url = true s_session_id = true s_proxied = true c_starttime = true req__reqpb_query = true req__reqpb_uri = true req__reqpb_method = true req__reqpb_protocol = true vsid = true ses__client_ip = true } player_group = { c_playerid = true c_playerversion = true c_playerlanguage = true c_hostexever = true c_hostexe = true c_os = true c_osversion = true c_cpu = true } server_group = { server_domain = true s_sitename = true s_computername = true s_ip = true s_dns = true s_port = true server_response = true status = true sc_status = true sc_win32_status = true cs_host = true s_supplier_name = true req__srvhdrs_clf_status = true } accounting_group = { s_event = true s_process_type = true s_user_time = true s_kernel_time = true s_page_faults = true s_total_procs = true s_active_procs = true s_stopped_procs = true s_total_procs = true s_total_procs = true } caching_group = { s_action = true s_hierarchy = true hierarchy = true } } # report_groups