Viewing event details

In an event list, to view event details, double-click an event line to drill down for more details.

The event details page contains information about the event and a list of all individual logs. You can work on events using buttons in the toolbar or by right-clicking an event. l To change what columns to display, click Column Settings or Column Settings > More Columns. l In event details, to view raw logs, click Tools > Display Raw. l To switch back to formatted log view, click Tools > Formatted Log. l To return to the previous page, click the back button.

Acknowledging events

Acknowledging an event removes it from the event list. Click Show Acknowledged to view acknowledged events.

To acknowledge events:

l In the event list, select one or more events, then right-click and select Acknowledge.

Filtering events

You can filter events using the Add Filter box in the toolbar or by right-clicking an entry and selecting a context-sensitive filter.

Filter FortiView summaries using the Add Filter box in the toolbar or by right-clicking an entry and selecting a contextsensitive filter. You can also filter by specific devices or log groups and by time.

To filter events using filters in the toolbar:

• Specify filters in the Add Filter
• Regular Search: In the selected summary view, click Add Filter and select a filter from the dropdown list, then type a value. Click NOT to negate the filter value. You can add multiple filters and connect them with “and” or

“or”.

• Advanced Search: Click the Switch to Advanced Search icon at the end of the Add Filter In Advanced Search mode, enter the search criteria (log field names and values). Click the Switch to RegularSearch icon  to go back to regular search.

To filter events using the right-click menu:

In the event list, right-click an entry and select a filter criterion (Search <filtervalue>).

Depending on the column in which your mouse is placed when you right-click, FortiView uses the column value as the filter criteria. This context-sensitive filter is only available for certain columns.

To launch Search in Logview from an event:

In the event list, right-click an entry and select Search in Logview.

Log View will launch with the filter automatically filled in with the following information:

• Log type of the event
• Time range (the first to the last occurrence of the event) l Event trigger and group by value

Default event views

FortiAnalyzer event handlers apply one or more tags to events, allowing the events to be grouped into views in the Event Monitor. These views are visible in the left navigation tree. Default views are organized into three view categories, including:

• By Endpoint: Provides security event views from an endpoint perspective.
• By Threat: Provides security event views from a threat perspective. l System Events: Provides event views which cover device system events.

In order for events to be displayed in default views, the corresponding event handler(s) must be enabled. Refer to the chart below for a list of the predefined event handlers that must be enabled to support each default view:

You can see the tags associated with each view by hovering your mouse over the view in Incidents & Events; a pop-up is displayed.

Default views can be hidden or disabled. For more information, see Managing default views.

Admins can copy existing views to create custom views. For more information, see Creating custom views.

Events

After event handlers start generating events, view events and event details in Incidents & Events > Event Monitor.

When rebuilding the SQL database, you might not see a complete list of historical events. However, you can always see events in real-time logs. You can view the status of the SQL rebuild by checking the Rebuilding DB status in the Notification Center.

All Events

To view all the events, go to Incidents & Events > Event Monitor> All Events.

Double-click an event line to drill down for more details.

Hover your mouse over an entry to view the asset and identity information for that event.

Managing event handlers

To manage event handlers, go to Incidents & Events > Event Monitor> Event HandlerList.

FortiAnalyzer includes predefined event handlers that you can use to generate events.

This page lists both predefined and custom event handlers with a  icon for enabled event handlers and a  icon for disabled event handlers.

The following options are available:

Enabling event handlers

For both predefined and custom event handlers, you must enable the event handler to generate events. The Event

HandlerList page displays a  icon besides enabled event handlers and a  icon besides disabled event handlers.

If you want to receive alerts for predefined events handlers, edit the predefined event handler to configure notifications.

To enable event handlers:

1. Go to Incidents & Events > Event Monitor> Event HandlerList.
2. Select one or more event handlers and click More > Enable or right-click an event handler and select Enable.

Cloning event handlers

Most predefined event handler attributes cannot be modified, such as the name, description and filter settings. You can clone a predefined event handler and customize its settings, and give it a meaningful name that shows its function.

To clone a predefined event handler:

1. Select a predefined event handler and in the toolbar, click Clone or right-click a predefined event handler and select Clone.
2. Configure the settings as required and click OK. For a description of the fields, see Creating a custom event handler on page 64.
3. Click OK to clone the predefined event handler.

Resetting event handlers to factory defaults

You can change predefined event handlers as needed. If required, you can restore predefined event handlers to factory default settings. The Factory Reset option is only available for predefined event handlers that have been changed.

To reset predefined event handlers:

1. Go to Incidents & Events > Event Monitor> Event HandlerList.
2. In the More menu, ensure Show Predefined is selected.
3. Right-click an event handler and select Factory Reset or select one or more predefined event handlers and click More > Factory Reset.

Using the Generic Text Filter in an event handler

The Generic Text Filter uses the glibc regex library for values with operators (~,!~), using the POSIX standard. Filter string syntax is parsed by FortiAnalyzer, and both upper and lower case characters are supported (for example “and” is the same as “AND”). You must use an escape character when needed. For example, cfgpath=firewall.policy is the wrong syntax because it’s missing an escape character. The correct syntax is cfgpath=firewall\.policy.

To create an event handler using the Generic Text Filter to match raw log data:

1. Go to Log View, and select a log type.
2. In the toolbar, click Tools > Display Raw.

The easiest method is to copy the text string you want from the raw log and paste it into the Generic Text Filter field. Ensure you insert an escape character when necessary, for example, cfgpath=firewall\.policy.

3. Locate and copy the text in the raw log.
4. Go to Incidents & Events > Event Monitor> Event HandlerList and click Create New.
5. In the Generic Text Filter box, paste the text you copied or type the text you want. Ensure you use the raw log field names, for example, mem (not memory) and setuprate (not setup-rate).

For information on text format and operators, hover the cursor over the help icon. The operator ~ means contains and !~ means does not contain.

6. If you want to be notified of events, configure the Notifications
7. Configure other settings as required and click OK.

Incident and Event Management

Use Incidents & Events to generate, monitor, and manage alerts and events from logs. The live monitoring of security events is a powerful and enabling feature for security operations. Incidents can be created from events to track and respond to suspicious or malicious activities.

Incidents & Events displays all events generated by event handlers.

Event handlers

Event handlers determine what events are to be generated from logs. Enable an event handler to start generating events. To see which event handlers are enabled or disabled, see Enabling event handlers.

When ADOMs are enabled, each ADOM has its own event handlers and lists of events. Ensure you are in the correct ADOM when working in Incidents & Events.

You can use predefined event handlers to generate events. There are predefined event handlers for FortiGate,

FortiSandbox, FortiMail, and FortiWeb devices. In a Security Fabric ADOM, all predefined event handlers are displayed.

You can create custom event handlers. An easy way to create a custom event handler is to clone a predefined event handler and customize its settings. See Cloning event handlers.

Configure event handlers to generate events for all devices, a specific device, or for the local FortiAnalyzer unit. You can create event handlers for FortiGate, FortiCarrier, FortiCache, FortiMail, FortiManager, FortiWeb, FortiSandbox devices, and syslog servers. Incidents & Events supports local FortiAnalyzer event logs. To see event handlers, go to Incidents & Events > Event Monitor> Event HandlerList.

Event handlers generate events only from Analytics logs and not Archive logs. For more information, see Analytics and Archive logs.

In an Analyzer–Collector collaboration scenario, the Analyzer evaluates event handlers. For more information, see Analyzer–Collector collaboration.

You can also import and export event handlers, allowing you to develop custom event handlers and deploy them in bulk to other ADOMS or FortiAnalyzer units. For more information, see Importing and exporting event handlers.

Predefined event handlers

FortiAnalyzer includes many predefined event handlers that you can use to generate events. You can easily create a custom event handler by cloning a predefined event handler and customizing its settings. See Cloning event handlers on page 69.

The following are a small sample of FortiAnalyzer predefined event handlers. To see all predefined event handlers, go to Incidents & Events > Event Monitor> Event HandlerList and select Show Predefined.

FortiOS system events

FortiOS predefined system event handlers are consolidated into a single event handler with multiple filters called Default FOS System Events.

Events are organized by device in the Incidents & Events dashboards, which can be expanded to view all related events.

Default FOS System Event filters apply tags to each event, allowing you to identify which Deafult FOS System Event filter triggered the event.

If you are upgrading from a version before FortiAnalyzer 6.2.0, the existing legacy predefined handlers which are enabled or have been modified will be available as custom handlers. In the Event HandlerList, select the More dropdown and choose Show Custom.

FortiGate event handlers

All FortiGates added to FortiAnalyzer use a default event handler on the FortiAnalyzer side to receive high severity events such as Botnet Communication, IPS Attack Pass Through, and Virus Pass Through AntiVirus.

Events triggered from FortiGate Event Handler are not shown in the FortiAnalyzer GUI. The events are pushed to the FortiGate for further processing.

Custom FortiGate event handlers can also be created. See Creating a custom event handler on page 64.

Creating a custom event handler

You can create a custom event handler from scratch or clone a predefined event handler and customize its settings. See Cloning event handlers on page 69.

Configuring an event handler includes defining the following main sections:

To create a new event handler:

1. Go to Incidents & Events > Event Monitor> Event HandlerList.
2. In the toolbar, click Create New.
3. Configure the settings as required and click OK.