FortiGate Cloud – FortiView

FortiView

The default FortiView page is the summary view, which uses widgets to show a general overview of what is happening with your device. You can add new widgets by selecting Add Widget.

Each widget is a customizable box, showing certain information about the device. You can do the following with widgets:

  • Click a widget title and drag it to move it around. l Delete a widget by selecting the X icon. l Set the refresh rate of widgets by selecting the dropdown list beside the refresh icon.

The following lists all widget types, grouped according to function:

Threats

Widget Description Feature required to be enabled on device
Top Threats Displays which threats trigger the most detection events on the network. At least one of the following: IPS,

AV, AntiSpam, DLP, or Anomaly

Detection.

Top Spam Displays which sources send the most spam email into the network. AntiSpam
Top Viruses Counts the viruses that the device’s AV most frequently finds. AV
Top Applications by Threat Score Compares which applications have the most traffic compared to their threat score, based on the device’s Application Control settings. Application Control
Top Attacks Counts the attacks that the device’s IPS most frequently prevents. IPS
Top DLP By Rules Counts the DLP events that the device detects, sorted by DLP rule. DLP

Traffic Analysis

Widget Description Feature required to be enabled on device
Top Applications Compares which applications are most frequently used, based on the device’s Application Control settings. Application Control
Top Application Categories Compares which application categories are most frequently used, based on the device’s Application Control settings. Application Control
Top Sources Displays which sources have the most traffic from or to the device.  
Top Destinations Displays which destinations have the most traffic from or to the device.  
Widget Description Feature required to be enabled on device
Top Protocols Compares the traffic volume that has passed through a certain interface, based on which protocol it uses (HTTP, HTTPS, DNS, TCP, UDP, other).  
Top Countries Displays which countries have the most traffic from or to the device.  
Traffic History Displays volume of incoming and outgoing traffic over time.  

Websites

Widget Description Feature required to be enabled on device
Top Websites Compares which websites are most frequently visited. You can click a category to see which websites in that category are being visited. Web Filtering
Top Web Categories Compares which web filtering categories are most frequently used, based on the device’s Web Filtering settings. Web Filtering
Top Users/IP by Browsing Time in Seconds Compares which users visit which IP addresses most frequently in the greatest ratio. You can click a user to see which IP addresses they visit. Web Filtering

FortiView offers log information, reformatted into easily navigable charts, in a style similar to FortiView in FortiOS.

You can select a time period to view data for:

  • Last 60 minutes l Last 24 hours l Last 7 days
  • Last 30 days l Specified time period

You can set the chart’s refresh rate by clicking the Refresh icon. By using the Add Filter dropdown list, you can filter the chart by various factors. Individual chart entries may also allow you to filter by that entry’s data by selecting a filter icon on the right, or drill down to see all related log data, such as all log data through that interface.

FortiView charts reference

The following provides descriptions of all FortiView charts.

User Dashboard

The User Dashboard displays the number of users/entities that fit into the following security categories:

l Visited high risk websites l Infected by malware l Targeted by malware l Targeted by spam l Violated data leak rules l Used high-risk applications l Targeted by attacks l Attacked by protocol intrusion

You can click each category to view the list of users/entities affected. You can drill down further to view the list of incidents for each user/entity and the logs for each incident.

FSBP Dashboard

The FSBP Dashboard displays security rating results for the device, in the following categories:

  • Overall Score l Maturity Milestones l Top Achievement
  • Top Todo
  • History Trend

The FSBP Dashboard is only available for devices that support the Security Rating feature.

Threats

Chart Description
Top Threats Lists the top threats to your network.

The following incidents are considered threats:

l Risk applications detected by application control. l Intrusion incidents detected by IPS.

Chart Description
  l  Malicious web sites detected by web filtering.

l  Malware/botnets detected by antivirus.

IPS Lists intrusion incidents detected by IPS.
AntiVirus Lists the malware/botnets detected by AV.
AntiSpam Lists the spam detected by AntiSpam.
DLP & Archives Lists the DLP and archives incidents.
Anomaly Lists network anomalies.

Traffic Analysis

Chart Description
Application Displays the top applications used on the network including the application name, category, bandwidth (sent/received), sessions, and risk level.
Cloud Application Displays the top cloud applications used on the network.
Source Displays the highest network traffic by source IP address and name, bandwidth (sent/received), sessions, and risk level.
User Displays the highest network traffic by user in terms of bandwidth sent/received, sessions, and risk level.
Destination Displays the highest network traffic by destination IP addresses, the applications used to access the destination, bandwith sent/received, sessions, and risk level.
Interface Displays the highest network traffic by interface in terms of bandwidth sent/received, traffic sessions. and risk level. You can view by source or destination interface.
Country Displays the highest network traffic by country in terms of bandwidth sent/received, traffic sessions, and risk level. You can view by source or destination country.
Policy Hits Lists the policy hits by policy, device name, VDOM, number of hits, bytes, and last used time and date.

Website

Chart Description
Website Displays the top allowed and blocked website domains on the network. You can also view by source. You can filter by threat level.
Web Category Displays the top website categories. You can filter by threat level.
Chart Description
Browsing User/IP Displays the top web-browsing users and their IP addresses by total browsing time duration. You can also view by category or domain. You can filter by threat level.

System Events

Chart Description
System Activity Displays events on the managed devices, their severity, and number of incidents. You can filter by user or severity level.
Admin Session Displays the users who logged into managed devices, the number of configuration changes they performed, number of admin sessions, and their total duration of logged-in time. You can also view by login interface. You can filter by severity level.
Failed Login Displays the users who failed to log into managed devices. You can also view by login interface. You can filter by severity level.
Wireless Displays wireless events. You can filter by severity level.

VPN Events

Chart Description
Site to Site Displays the names of VPN tunnels with IPsec that are accessing the network.
SSL and Dialup Displays the users who are accessing the network by using an SSL or IPsec VPN tunnel.
Failed VPN Login Displays the users who failed to log in successfully via VPN.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Ask your questions in the comments below!!! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Don't Forget To Buy Your Fortinet Hardware From The Fortinet GURU