Hey everyone,
I've been digging into Firepower's reporting capabilities on our 6.7 deployment, and I've hit a wall. We're using classic licensing (no Smart License subscription), and it seems like all the really insightful application and URL reports are locked behind those Smart Licenses. Is that everyone else's experience?
I can get basic connection events and security events, but the high-level, user-friendly "Application Usage" or "Top Websites" reports in the FMC seem to just spin forever or show no data. I'm looking for things like:
* Which departments are using Slack vs. Teams?
* Are there unexpected P2P or streaming apps on the network?
* Basic trends in web traffic categories.
Without Smart Licenses, are we stuck with raw event data? I've tried exporting from the "Events" view and using filters for `application` or `webapp`, but it's a huge dataset to wrangle manually.
Has anyone built a workaround? Maybe directing syslogs to a separate analytics tool (like a Splunk or ELK stack) and parsing the events there? I'm curious what others in a classic license setup are doing for operational visibility, not just threat-based alerting. The built-in reports feel almost useless without the subscription.