ACC Tabs

• Network Activity—Displays an overview of traffic and user activity on your network. This view focuses on the top most-used applications, the top users who generate traffic with a drill down into the bytes, content, threats, and URLs accessed by the user, and the most used Security policy rules against which traffic matches occur. In addition, you can view network activity by source or destination zone, region, or IP address; by ingress or egress interfaces; and by host information, such as the operating systems of the devices most commonly used on the network.
• Threat Activity—Displays an overview of the threats on the network. It focuses on the top threats—vulnerabilities, spyware, viruses, hosts visiting malicious domains or URLs, top WildFire submissions by file type and application, and applications that use non-standard ports. The Compromised Hosts widget supplements detection with better visualization techniques. It uses the information from the correlated events tab (Monitor > Automated Correlation Engine > Correlated Events) to present an aggregated view of compromised hosts on your network by source users or IP addresses, sorted on severity.
• Blocked Activity—Focuses on traffic that was prevented from coming into the network. The widgets in this tab allow you to view activity denied by application name, username, threat name, content (files and data), and the top security rules with a deny action that blocked traffic.
• Mobile Network Activity—Displays a visual representation of mobile traffic on your network using GTP logs generated from your Security policy rule configuration. This view includes interactive and customizable GTP Events, Mobile Subscriber Activity, and GTP Rejection Cause widgets to which you can apply ACC Filters and drill down to isolate the information you need. When you enable SCTP Security, widgets on this tab display a visual representation and details of SCTP events on the firewall, as well as the number of chunks sent and received per SCTP Association ID.
• Tunnel Activity—Displays the activity of tunnel traffic that the firewall inspected based on your tunnel inspection policies. Information includes tunnel usage based on tunnel ID, monitor tag, user, and tunnel protocols such as Generic Routing Encapsulation (GRE), General Packet Radio Service (GPRS) tunneling protocol for user data (GTP-U), and non-encrypted IPSec.
• GlobalProtect Activity—Displays an overview of user activity in your GlobalProtect deployment. Information includes the number of users and number of times users connected, the gateways to which users connected, the number of connection failures and the failure reason, a summary of authentication methods and GlobalProtect app versions used, and the number of endpoints that are quarantined.
• SSL Activity—Displays the activity of decrypted and undecrypted TLS/SSL traffic based on your Decryption policies and profiles. You can see TLS activity compared to non-TLS activity, the amount of decrypted traffic versus the amount of undecrypted traffic, reasons for decryption failures, and successful TLS version and key exchange activity. Use this information to identify traffic that causes decryption issues and then use the Decryption Log and custom Decryption report templates to drill down into details and gain context about that traffic so that you can diagnose and fix issues accurately.