FortiView
The FortiView tab allows you to access both FortiView drill down and Log view menus. FortiView in FortiAnalyzer collects data from FortiView in FortiGate. In order for information to appear in the FortiView dashboards in FortiGate, disk logging must be selected for the FortiGate unit. Select the FortiView tab and select the ADOM from the drop-down list.
FortiView
Use FortiView to drill down real-time and historical traffic from log devices by sources, applications, destinations, web sites, threats, and cloud applications. Each FortiView can be filtered by a variety of attributes, as well as by device and time period. These attributes can be selected using the right-click context menu. Results can also be filtered using the various columns.
The following FortiViews are available:
- Top sources
- Top applications
- Top destinations
- Top web sites
- Top threats
- Top cloud applications
Top sources
The Top Sources dashboard displays information about the sources of traffic on your unit. You can drill down the displayed information, and also select the device and time period, and apply search filters.
Figure 88:Top sources
The following information is displayed:
| Source | Displays the source IP address and/or user name, if applicable. Select the column header to sort entries by source. You can apply a search filter to the source (srcip) column. |
| Device | Displays the device IP address or FQDN. Select the column header to sort entries by device. You can apply a search filter to the device (dev_src) column. |
| Threat Weight | Displays the threat weight value. Select the column header to sort entries by threat weight. |
| Sessions | Displays the number of sessions. Select the column header to sort entries by sessions. |
| Bandwidth
(Sent/Received) |
Displays the bandwidth value for sent and received packets. Select the column header to sort entries by bandwidth. |
The following options are available:
| Refresh | Refresh the displayed information. |
| Search | Click the search field to add a search filter for user (user), source IP (srcip), source device (dev_src), source interface (srcintf), destination interface (dstintf), policy ID (policyid), security action (utmaction), or virtual domain (vd). Select the GO button to apply the search filter. Alternatively, you can right-click the column entry to add the search filter. Select the clear icon, , to remove the search filter. |
| Devices | Select the device from the drop-down list or select All Devices. Select the GO button to apply the device filter. |
| Time Period | Select the time period from the drop-down list. Select Custom from the list to specify the start and end date and time. Select the GO button to apply the time period filter. |
| N | When selecting a time period with last N in the entry, you can enter the value for N in this text field. |
| Custom | When Custom is selected the custom icon will be displayed. Select the icon to change the custom time period. |
| Go | Select the GO button to apply the filter. |
| Pagination | Select the number of entries to display per page and browse pages. |
| Right-click menu |
| Application | Select to drill down by application to view application related information including the application, number of sessions, and bandwidth (sent/received).
You can select to sort entries displayed by selecting the column header. You can apply a search filter in the application (app) column to further filter the information displayed. Select the GO button to apply the search filter. Select the return icon, , to return to the Top Sources page. |
| Destination | Select to drill down by destination to view destination related information including the destination IP address and geographic region, the threat weight value, number of sessions, and bandwidth (sent/received).
You can select to sort entries displayed by selecting the column header. You can apply a search filter in the destination (dstip) column to further filter the information displayed. Select the GO button to apply the search filter. Select the return icon, , to return to the Top Sources page. |
| Threat | Select to drill down by threat to view threat related information including the threat type, category, threat level, threat weight, and number of incidents.
You can select to sort entries displayed by selecting the column header. You can apply a search filter in the threat (threat) or category (threattype) columns to further filter the information displayed. Select the GO button to apply the search filter. Select the return icon, , to return to the Top Sources page. |
| Domain | Select to drill down by domain to view domain related information including domain, category, browsing time, threat weight, number of sessions, and bandwidth (sent/received).
You can select to sort entries displayed by selecting the column header. Select the GO button to apply the search filter. Select the return icon, , to return to the Top Sources page. |
| Category | Select to drill down by category to view category related information including category, browsing time, threat weight, number of sessions, and bandwidth (sent/received).
You can select to sort entries displayed by selecting the column header. Select the GO button to apply the search filter. Select the return icon, , to return to the Top Sources page. |
| Sessions | Select to drill down by sessions to view session related information including date/time, source/device, destination IP address and geographic region, service, bandwidth (sent/received), user, application, and security action.
You can select to sort entries displayed by selecting the column header. You can apply a search filter in the destination (dstip), service (service), user (user), or application (app) columns to further filter the information displayed. Select the GO button to apply the search filter. Select the return icon, , to return to the Top Sources page. |
| Search | Add a search filter by source IP (srcip) or source device (dev_src). Select the GO button to apply the filter. Select the clear icon, , to remove the search filter. |
Top applications
The Top Applications dashboard shows information about the applications being used on your network, including the application name, category, and risk level. You can drill down the displayed information, also select the device and time period, and apply search filters.
Figure 89:Top applications
The following information is displayed:
| Application | Displays the application port and service. Select the column header to sort entries by application. You can apply a search filter to the application (app) column. |
| Category | Displays the application category. Select the column header to sort entries by category. You can apply a search filter to the category (appcat) column. |
| Risk | Displays the application risk level. Hover the mouse cursor over the entry in the column for additional information. Select the column header to sort entries by category. Risk uses a new 5-point risk rating. The rating system is as follows:
• Critical: Applications that are used to conceal activity to evade detection. • High: Applications that can cause data leakage, are prone to vulnerabilities, or downloading malware. • Medium: Applications that can be misused. • Elevated: Applications that are used for personal communications or can lower productivity. • Low: Business related applications or other harmless applications. |
| Sessions | Displays the number of sessions. Select the column header to sort entries by sessions. |
| Bandwidth
(Sent/Received) |
Displays the bandwidth value for sent and received packets. Select the column header to sort entries by bandwidth. |
The following options are available:
| Refresh | Refresh the displayed information. |
| Search | Click the search field to add a search filter by application (app), source interface (srcintf), destination interface (dstintf), policy ID
(policyid), security action (utmaction), or virtual domain (vd). Select the GO button to apply the search filter. Alternatively, you can right-click the column entry to add the search filter. Select the clear icon, , to remove the search filter. |
| Devices | Select the device from the drop-down list or select All Devices. Select the GO button to apply the device filter. |
| Time Period | Select the time period from the drop-down list. Select Custom from the list to specify the start and end date and time. Select the GO button to apply the time period filter. |
| N | When selecting a time period with last N in the entry, you can enter the value for N in this text field. |
| Custom | When Custom is selected the custom icon will be displayed. Select the icon to change the custom time period. |
| Go | Select the GO button to apply the filter. |
| Pagination | Select the number of entries to display per page and browse pages. |
| Right-click menu |
| Source | Select to drill down by source to view source related information including the source IP address, device MAC address or FQDN, threat weight, number of sessions, and bandwidth (sent/received).
You can select to sort entries displayed by selecting the column header. You can apply a search filter in the source (srcip) and device (dev_src) columns to further filter the information displayed. Select the GO button to apply the search filter. Select the return icon, , to return to the Top Applications page. |
| Destination | Select to drill down by destination to view destination related information including the destination IP address and geographic region, the threat weight value, number of sessions, and bandwidth (sent/received).
You can select to sort entries displayed by selecting the column header. You can apply a search filter in the destination (dstip) column to further filter the information displayed. Select the GO button to apply the search filter. Select the return icon, , to return to the Top Applications page. |
| Threat | Select to drill down by threat to view threat related information including the threat type, category, threat level, threat weight, and number of incidents.
You can select to sort entries displayed by selecting the column header. You can apply a search filter in the threat (threat) or category (threattype) columns to further filter the information displayed. Select the GO button to apply the search filter. Select the return icon, , to return to the Top Applications page. |
| Sessions | Select to drill down by sessions to view session related information including date/time, source/device, destination IP address and geographic region, service, bandwidth (sent/received), user, application, and security action.
You can select to sort entries displayed by selecting the column header. You can apply a search filter in the destination (dstip), service (service), user (user), or application (app) columns to further filter the information displayed. Select the GO button to apply the search filter. Select the return icon, , to return to the Top Applications page. |
| Search | Add a search filter by application or category. Select the GO button to apply the filter. Select the clear icon, , to remove the search filter. |