Default event views – FortiAnalyzer – FortiOS 6.2.3

Default event views

FortiAnalyzer event handlers apply one or more tags to events, allowing the events to be grouped into views in the Event Monitor. These views are visible in the left navigation tree. Default views are organized into three view categories, including:

  • By Endpoint: Provides security event views from an endpoint perspective.
  • By Threat: Provides security event views from a threat perspective. l System Events: Provides event views which cover device system events.

In order for events to be displayed in default views, the corresponding event handler(s) must be enabled. Refer to the chart below for a list of the predefined event handlers that must be enabled to support each default view:

View category           Default view Required predefined event handler
By Endpoint All Security Events Displays all events within category with enabled handlers
Compromised Hosts Default-Botnet-Communication-Detection-By-Endpoint

Default-Compromised Host-Detection-IOC-By-Endpoint

High Risk App Usage Default-Risky-App-Detection-By-Endpoint
Malicious Domain/URL Access Default-Risky-Destination-Detection-By-Endpoint
Malware Activity Default-Sandbox-Detections-By-Endpoint


Ongoing Intrusions Default-Malicious-Code-Detection-By-Endpoint
Sandbox Detections Default-Sandbox-Detections-By-Endpoint
By Threat All Security Events Displays all events within category with enabled handlers
C&C Call Backs Default-Botnet-Communication-Detection-By-Threat

Default-Compromised Host-Detection-IOC-By-Threat

High Risk App Usage Default-Risky-App-Detection-By-Threat
Malicious Domain/URL Access Default-Risky-Destination-Detection-By-Threat
Malware Activity Default-Sandbox-Detections-By-Threat


Ongoing Intrusions Default-Malicious-Code-Detection-By-Threat
Sandbox Detections Default-Sandbox-Detections-By-Threat
System Events All Displays all events within category with enabled handlers
FortiGate Default FOS System Events
Local Device Local Device Event

You can see the tags associated with each view by hovering your mouse over the view in Incidents & Events; a pop-up is displayed.

Default views can be hidden or disabled. For more information, see Managing default views.

Admins can copy existing views to create custom views. For more information, see Creating custom views.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Don't Forget To visit the YouTube Channel for the latest Fortinet Training Videos and Question / Answer sessions!
- FortinetGuru YouTube Channel
- FortiSwitch Training Videos

Cybersecurity Videos and Training Available Via: Office of The CISO Security Training Videos