Creating administrator profiles

To create a new administrator profile, you must be logged in to an account with sufficient privileges, or as a super user administrator.

To create a custom administrator profile:

1. Go to System Settings > Admin > Profile.
2. Click Create New in the toolbar. The New Profile pane is displayed.
3. Configure the following settings:

4. Click OK to create the new administrator profile.

To apply a profile to an administrator:

1. Go to System Settings > Administrators.
2. Create a new administrator or edit an existing administrator. The Edit Administrator pane is displayed.
3. From the Admin Profile list, select a profile.

Privacy Masking

Use Privacy Masking to help protect user privacy by masking or anonymizing user information. You can select which fields to mask. Masked fields show anonymous data. You can unmask and see the original data by entering the Data Mask Key that you specify in the administrator profile.

When Privacy Masking is enabled in an administrator profile, accounts using that profile have a See Original Data button in the banner.

To turn privacy masking on:

1. In System Settings > Profile, create or edit a profile.
2. In the Privacy Masking section, set the toggle to ON
3. In the Masked Data Fields section, select the fields you want to mask.

The fields you select are masked in all modules that display those fields.

4. In the Data Mask Key field, type the key that will allow users to unmask the data.
5. In the Data Unmasked Time field, type the number of days the data is unmasked.

You can enter a number between 0-365. Logs that are older than the number of days appear masked.

To see the original, unmasked data:

1. In any list showing masked data, click See Original Data in the banner and select Screen Picker or Manual Input.
2. If you select Screen Picker, click a masked field, for example, 75.196.35.21.

The Unmask Protected Data dialog box displays with the field you clicked already entered. If you select Manual Input, enter the masked text, for example, 75.196.35.21.

3. Enter the Data Mask Key that was set up in the administrator profile and click OK.

Administrator profiles

Administrator profiles are used to control administrator access privileges to devices or system features. Profiles are assigned to administrator accounts when an administrator is created. The profile controls access to both the FortiAnalyzer GUI and CLI.

There are three predefined system profiles:

These profiles cannot be deleted, but standard and restricted profiles can be edited. New profiles can also be created as required. Only super user administrators can manage administrator profiles.

Go to System Settings > Admin > Profile to view and manage administrator profiles.

The following options are available:

The following information is shown:

Permissions

The below table lists the default permissions for the predefined administrator profiles.

When Read-Write is selected, the user can view and make changes to the FortiAnalyzer system. When Read-Only is selected, the user can only view information. When None is selected, the user can neither view or make changes to the FortiAnalyzer system.

Managing administrator accounts

Go to System Settings > Admin > Administrator to view the list of administrators and manage administrator accounts.

Only administrators with the Super_User profile can see the complete administrators list. If you do not have certain viewing permissions, you will not see the administrator list. When ADOMs are enabled, administrators can only access the ADOMs they have permission to access.

The following options are available:

The following information is shown:

Creating administrators

To create a new administrator account, you must be logged in to an account with sufficient privileges, or as a super user administrator.

You need the following information to create an account:

• Which authentication method the administrator will use to log in to the FortiAnalyzer unit. Local, remote, and Public Key Infrastructure (PKI) authentication methods are supported.
• What administrator profile the account will be assigned, or what system privileges the account requires. l If ADOMs are enabled, which ADOMs the administrator will require access to. l If using trusted hosts, the trusted host addresses and network masks.

To create a new administrator:

1. Go to System Settings > Admin > Administrators.
2. In the toolbar, click Create New to display the New Administrator
3. Configure the following settings, and then click OK to create the new administrator.

Advanced options

Editing administrators

To edit an administrator, you must be logged in as a super user administrator. The administrator’s name cannot be edited. An administrator’s password can be changed using the right-click menu, if the password is not a wildcard.

To edit an administrator:

1. Go to System Settings > Admin > Administrators.
2. Double-click on an administrator, right-click on an administrator and then select Edit from the menu, or select the administrator then click Edit in the toolbar. The Edit Administrator pane opens.
3. Edit the settings as required, and then select OK to apply the changes.

To change an administrator’s password:

1. Go to System Settings > Admin > Administrators.
2. Right-click on an administrator and select Change Password from the menu. The Change Password dialog box opens.
3. If you are editing the admin administrator’s password, enter the old password in the Old Password
4. Enter the new password for the administrator in the New Password and Confirm Password
5. Select OK to change the administrator’s password.

Deleting administrators

To delete an administrator or administrators, you must be logged in as a super user administrator.

1. Go to System Settings > Admin > Administrators.
2. Select the administrator or administrators you need to delete.
3. Click Delete in the toolbar, or right-click and select Delete.
4. Select OK in the confirmation box to delete the administrator or administrators.

To delete an administrator using the CLI:

1. Open a CLI console and enter the following command:

config system admin user delete <username>

end

Disconnecting administrators

Administrators can be disconnected from the FortiAnalyzer unit from the Admin Session List.

To disconnect administrators:

1. Go to System Settings > Dashboard.
2. In the System Information widget, in the Current Administrators field, click the Current Session List The Admin Session List opens in the widget.
3. Select the administrator or administrators you need to disconnect.
4. Click Delete in the toolbar, or right-click and select Delete.

The selected administrators will be automatically disconnected from the FortiAnalyzer device.

Trusted hosts

Setting trusted hosts for all of your administrators increases the security of your network by further restricting administrative permissions. In addition to knowing the password, an administrator must connect only through the subnet or subnets you specify. You can even restrict an administrator to a single IP address if you define only one trusted host IP address with a netmask of 255.255.255.255.

When you set trusted hosts for all administrators, the FortiAnalyzer unit does not respond to administrative access attempts from any other hosts. This provides the highest security. If you leave even one administrator unrestricted, the unit accepts administrative access attempts on any interface that has administrative access enabled, potentially exposing the unit to attempts to gain unauthorized access.

The trusted hosts you define apply to both the GUI and to the CLI when accessed through SSH. CLI access through the console connector is not affected.

Advanced Settings

Go to System Settings > Advanced > Advanced Settings to view and configure advanced settings and download WSDL files.

Configure the following settings and then select Apply:

File Management

FortiAnalyzer allows you to configure automatic deletion of device log files, quarantined files, reports, and content archive files after a set period of time.

Go to System Settings > Advanced > File Management to configure file management settings.

Configure the following settings, and then select Apply:

The time period you select determines how often the item is checked. If you select Months, then the item is checked once per month. If you select Weeks, then the item is checked once per week, and so on. For example, if you specify Device log files olderthan 3 Months, then on July 1, the logs for April, May, and June are kept and the logs for March and older are deleted.