Sophos Fusion Firewall Reporting Advanced

Central firewall management with reporting

Firewall management and reporting complement each other in the Sophos console. Management brings devices, groups and configurations together; Firewall Reporting analyses the transmitted log data. This reporting licence extends analysis and storage; it is not an additional firewall protection licence.

For useful reports, firewalls must be connected to the console and send the required log types. The data displayed depends on this configuration and the protection features in use.

Firewall Reporting

How is an application’s usage changing? Which connections are blocked? Customisable reports and filters let you investigate the data supplied by your firewalls. Scheduled and group reports simplify regular analysis and visibility across several locations.

Reports provide context for decisions and investigations. They contain the logs actually transmitted; they do not guarantee a complete record of all network activity.

Retain logs for up to 365 days

Without a separate reporting licence, an active firewall subscription provides model-dependent storage for up to seven days. An active Xstream Protection bundle includes limited Reporting Advanced capacity with retention of up to 30 days.

Separately purchased CFR Advanced licences allow up to 365 days. Both allocated capacity and log volume matter: if storage fills earlier, the oldest data is removed first. A 100-GB block therefore does not guarantee a full year of history.

Plan storage for each firewall according to the required retention period. Several blocks can be assigned to one firewall; the same allocation cannot be used simultaneously by multiple firewalls.