A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more microprocessors of a firewall device within a private Internet Protocol (IP) network of an enterprise, cause the one or more microprocessors to perform a method comprising:
- maintaining a log of network traffic observed by the firewall device by storing, for each network traffic flow, information regarding one or more of traffic volume, a source interface, a destination interface, a source IP address, a destination IP address, an application name, an application type, port information, one or more timestamps and a username associated with the network traffic flow;
- receiving a request from a network administrator for a report to be generated based on the log, the request containing information indicative of report parameters including (i) a specified time frame, (ii) user information indicative of an identity of one or more users within the enterprise;
- and (iii) application information indicative of one or more particular applications or one or more types of applications associated with the logged network traffic;
- extracting information regarding network traffic flows from the log satisfying the report parameters;
- presenting a customized and interactive hierarchical report to the network administrator via a graphical user interface (GUI) of the firewall device, the customized and interactive hierarchical report including (i) a plurality of aggregated network traffic items;
- and (ii) a plurality of action objects each corresponding to one of the plurality of aggregated network traffic items, wherein information associated with the plurality of aggregated network traffic items is determined by individually aggregating each of a plurality of traffic aggregation parameters for each observed value of a primary report parameter within the extracted information, wherein the plurality of traffic aggregation parameters, include one or more traffic volume and percentage of traffic volume;
- responsive to interaction by the network administrator with a particular action object of the plurality of action objects:
- receiving a request to define an appropriate firewall policy for the corresponding aggregated network traffic item of the plurality of aggregated network traffic items;
- and
- presenting to the network administrator via the GUI a plurality of options regarding actions to be taken on matching network traffic that is subsequently observed by the firewall device traffic, wherein the plurality of options include one or more of blocking the matching network traffic, allowing the matching network traffic in accordance with a particular schedule and enforcing a bandwidth limitation on the matching network traffic;
- and
- responsive to receiving an indication from the network administrator regarding one or more selected options of the plurality of options, defining and establishing the appropriate firewall policy, wherein the appropriate firewall policy comprises one or more rules to identify the matching network traffic and one or more corresponding actions to be taken on the matching network traffic based on the one or more selected options.