Default event views – FortiAnalyzer – FortiOS 6.2.3
Default event views
FortiAnalyzer event handlers apply one or more tags to events, allowing the events to be grouped into views in the Event Monitor. These views are visible in the left navigation tree. Default views are organized into three view categories, including:
- By Endpoint: Provides security event views from an endpoint perspective.
- By Threat: Provides security event views from a threat perspective. l System Events: Provides event views which cover device system events.
In order for events to be displayed in default views, the corresponding event handler(s) must be enabled. Refer to the chart below for a list of the predefined event handlers that must be enabled to support each default view:
|View category Default view||Required predefined event handler|
|By Endpoint||All Security Events||Displays all events within category with enabled handlers|
|High Risk App Usage||Default-Risky-App-Detection-By-Endpoint|
|Malicious Domain/URL Access||Default-Risky-Destination-Detection-By-Endpoint|
|By Threat||All Security Events||Displays all events within category with enabled handlers|
|C&C Call Backs||Default-Botnet-Communication-Detection-By-Threat
|High Risk App Usage||Default-Risky-App-Detection-By-Threat|
|Malicious Domain/URL Access||Default-Risky-Destination-Detection-By-Threat|
|System Events||All||Displays all events within category with enabled handlers|
|FortiGate||Default FOS System Events|
|Local Device||Local Device Event|
You can see the tags associated with each view by hovering your mouse over the view in Incidents & Events; a pop-up is displayed.
Default views can be hidden or disabled. For more information, see Managing default views.
Admins can copy existing views to create custom views. For more information, see Creating custom views.
Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!
Don't Forget To visit the YouTube Channel for the latest Fortinet Training Videos and Question / Answer sessions!
- FortinetGuru YouTube Channel
- FortiSwitch Training Videos
Cybersecurity Videos and Training Available Via: Office of The CISO Security Training Videos
Leave a Reply