Creating reports – FortiAnalyzer – FortiOS 6.2.3

Creating reports

You can create reports from report templates, by cloning and editing predefined/existing reports, or start from scratch.

Creating reports from report templates

You can create a new report from a template. The template populates the Layout tab of the report. The template specifies what text, charts, and macros to use in the report and the layout of the content. Report templates do not contain any data. Data is added to the report when you generate the report.

To create a new report from a template:

  1. If using ADOMs, ensure that you are in the correct ADOM.
  2. Go to Reports > Report Definitions > All Reports.
  3. In the toolbar, click Create New. The Create Report dialog box opens.
  4. In the Name box, type a name for the new report. The following characters are NOT supported in report names: \ / ” ‘ < > & , | # ? % $ +
  5. Select From Template for the Create from setting, then select a template from the dropdown list. The template populates the Layout tab of the report.
  6. Select the folder that the new report will be saved to from the dropdown list. See Organizing reports into folders on page 125 for information about folders.
  7. Select OK to create the new report.
  8. On the Settings tab, configure the settings as required. For a description of the fields, see Reports Settings tab on page 117.
  9. Optionally, go to the Layout tab to customize the report layout and content. For a description of the fields, see Reports Layout tab on page 120.
  10. Click Apply to save your changes.

Creating reports by cloning and editing

You can create reports by cloning and editing predefined and/or existing reports.

To create a report by cloning and editing:

  1. If using ADOMs, ensure that you are in the correct ADOM.
  2. Go to Reports > Report Definitions > All Reports.
  3. In the content pane, select the report from the list, then click Clone in the toolbar.
  4. In the Clone Report dialog box, type a name for the cloned report. The following characters are NOT supported in report names: \ / ” ‘ < > & , | # ? % $ +
  5. Select the folder that the new report will be saved to from the dropdown list. See Organizing reports into folders on page 125 for information about folders.
  6. Select OK to create the new report.
  7. On the Settings tab, configure the settings as required. For a description of the fields, see Reports Settings tab on page 117.
  8. Optionally, go to the Layout tab to customize the report layout and content. For a description of the fields, see Reports Layout tab on page 120.
  9. Click Apply to save your changes.

Creating reports without using a template

To create a report without using a template:

  1. If using ADOMs, ensure that you are in the correct ADOM.
  2. Go to Reports > Report Definitions > All Reports.
  3. In the toolbar, click Create New. The Create New Report dialog box opens.
  4. In the Name box, type a name for the new report. The following characters are NOT supported in report names: \ / ” ‘ < > & , | # ? % $ +
  5. Select the Blank option for the Create from
  6. Select the folder that the new report will be saved to from the dropdown list. See Organizing reports into folders on page 125 for information about folders.
  7. Select OK to create the new report.
  8. On the Settings tab, you can specify a time period for the report, what device logs to include in the report, and so on. You can also add filters to the report, add a cover page to the report, and so on. For a description of the fields, see Reports Settings tab on page 117.
  9. On the Layout tab, you can specify the charts and macros to include in the report, as well as report content and layout.

For a description of the fields, see Reports Layout tab on page 120.

For information about creating charts and macros, see Creating charts on page 130 and Creating macros on page 134.

  1. Click Apply to save your changes.

Reports Settings tab

The following options are available in the Settings tab:

Field   Description
Time Period   The time period the report covers. Select a time period or select Custom to manually specify the start and end date and time.
Devices   The devices to include in the report. Select either All Devices or Specify to add specific devices. Select the add icon to select devices.
Type   Select either Single Report (Group Report) or Multiple Reports (Per-Device).

This option is only available if multiple devices are selected.

Enable Schedule   Select to enable report template schedules.
Field Description
Enable Auto-Cache Select to assemble datasets before generating the report and as the data is available. This process uses system resources and is recommended only for reports that require days to assemble datasets. Disable this option for unused reports and for reports that require little time to assemble datasets.
Generate PDF Report Every Select when the report is generated.

Enter a number for the frequency of the report based on the time period selected from the dropdown list.

Start time Enter a starting date and time for the file generation.
End time Enter an ending date and time for the file generation, or set it to never ending.
Enable Notification Select to enable report notification.
Output Profile Select the output profile from the dropdown list, or click Create New to create a new output profile. See Output profiles on page 138.

Filters section of Reports Settings tab

See Filtering report output on page 124.

Advanced Settings section of Reports Settings tab

The following options are available in the Advanced Settings section of the Settings tab.

Field Description
Language Select the report language.
Bundle rest into “Others” Select to bundle the uncategorized results into an Others category.
Print Orientation Set the print orientation to portrait or landscape.
Chart Heading Level Set the heading level for the chart heading.
Default Font Set the default font.
Hide # Column Select to hide the column numbers.
Layout Header Enter header text and select the header image. Accept the default Fortinet image or click Browse to select a different image.
Layout Footer Select either the default footer or click Custom to enter custom footer text in the text field.
Print Cover Page Select to print the report cover page. Click Customize to customize the cover page. See Customizing report cover pages on page 119.
Print Table of Contents Select to include a table of contents.
Field Description
Print Device List Select to print the device list. Select Compact, Count, or Detailed from the dropdown list.
Print Report Filters Select to print the filters applied to the report.
Obfuscate User Select to hide user information in the report.
Resolve Hostname Select to resolve hostnames in the report.
Allow Save Maximum Select a value between 1-10000 for the maximum number of reports to save.
Color Code The color used to identify the report on the calendar. Select a color code from the dropdown list to apply to the report schedule. Color options include: Bold Blue, Blue, Turquoise, Green, Bold Green, Yellow, Orange, Red, Bold Red, Purple, and Gray.

Customizing report cover pages

A report cover page is only included in the report when enabled on the Settings tab in the Advanced Settings section.

When enabled, the cover page can be customized to contain the desired information and imagery.

To customize a report cover page:

  1. If using ADOMs, ensure that you are in the correct ADOM.
  2. Go to Reports > Report Definitions > All Reports.
  3. In the content pane, select the report from the list, and click Edit in the toolbar.
  4. Select the Settings tab and then click Advanced Settings.
  5. Select the Print CoverPage checkbox, then click Customize next to the checkbox. The Edit CoverPage pane opens.
  6. Configure the following settings:
Background Image Click Browse to open the Choose an Image dialog box.

Select an image or click Upload File to find an image on the management computer, then click OK to add the image as the background image of the cover page.

Top Image Click Browse to open the Choose an Image dialog box.

Select an image or click Upload File to find an image on the management computer, then click OK to add the image at the top of the cover page.

Top Image Position Select the top image position from the dropdown menu. Select one of the following: Left, Center, Right.
Text Color Select a text color from the dropdown list.
Show Creation Time Select to print the report date on the cover page.
Show Data Range Select to print the data range on the cover page.
Report Title Accept the default title or type another title in the Report Title field.
Custom Text 1 If you want, enter custom text for the Custom Text 1 field.
Custom Text 2 If you want, enter custom text for the Custom Text 2 field.
Bottom Image Click Browse to open the Choose an Image dialog box.

Select an image or click Upload File to find an image on the management computer, then click OK to add the image to the bottom of the cover page.

Footer Left Text If you want, enter custom text to be printed in the left footer of the cover page.
Footer Right Text If you want, enter custom text to be printed in the right footer of the cover page.
Footer Background Color Select the cover page footer background color from the dropdown list.
Reset to Default Select to reset the cover page settings to their default settings.
  1. Click OK to save the configurations and return to the Settings

Reports Layout tab

Because the cut, copy, and paste functions need access to the clipboard of your operating system, some Internet browsers either block it when called from the layout editor toolbar, or ask you to explicitly agree to it. If you’re blocked from accessing the clipboard by clicking the respective cut, copy and paste buttons from the toolbar or context menu, you can always use keyboard shortcuts.

The following options are available in the Layout tab (layout editor):

Field Description
Insert Chart or Edit Chart Click to insert a FortiAnalyzer chart. Charts are associated with datasets that extract data from logs for the report.

In the Insert Chart or Chart Properties dialog box, you can specify a custom title, width, and filters for the chart. For information on setting filters, see Filtering report output on page 124.

You can edit a chart by right clicking the chart in the layout editor and selecting

Chart Properties or by clicking the chart to select it and then clicking Edit Chart.

Insert Macro Click to insert a FortiAnalyzer macro. Macros are associated with datasets that extract data from logs for the report.
Image Click the Image button in the toolbar to insert an image into the report layout. Right-click an existing image to edit image properties.
Table Click the Table button in the toolbar to insert a table into the report layout. Rightclick an existing table to edit a cell, row, column, table properties, or delete the table.
Insert Horizontal Line Click to insert a horizontal line.
Insert Page Break for Printing Click to insert a page break for printing.
Link Click the Link button in the toolbar to open the Link dialog box. You can select to insert a URL, a link to an anchor in the text, or an email address. Alternatively, use the CTRL+L keyboard shortcut to open the Link dialog box.
Anchor Click the Anchor button in the toolbar to insert an anchor in the report layout.
Cut To cut a text fragment, start with selecting it. When the text is selected, you can cut it using one of the following methods: l Click the cut button in the toolbar l Right-click and select cut in the menu l Use the CTRL+X shortcut on your keyboard.
Copy To cut a text fragment, start with selecting it. When the text is selected, you can cut it using one of the following methods: l Click the cut button in the toolbar l Right-click and select cut in the menu l Use the CTRL+C shortcut on your keyboard.
Paste To paste text, start with cutting or copying from another source. Depending on the security settings of your browser, you may either paste directly from the clipboard or use the Paste dialog box.
Paste as plain text Click Paste as plain text to paste formatted text without the formatting. If the browser blocks the editor toolbar’s access to clipboard, a Paste as Plain Text dialog box appears and you can paste the fragment into the text box using the CTRL+V keyboard shortcut.

 

Field Description
Paste from Word You can preserve basic formatting when you paste a text fragment from Microsoft Word. To achieve this, copy the text in a Word document and paste it using one of the following methods:

l Click the Paste from Word button in the toolbar l Use the CTRL+V shortcut on your keyboard.

Undo Click to undo the last action. Alternatively, use the CTRL+Z keyboard shortcut to perform the undo operation.
Redo Click to redo the last action. Alternatively, use the CTRL+Y keyboard shortcut to perform the redo operation.
Find Click to find text in the report layout editor. This dialog box includes the following elements: l Find what: Is the text field where you enter the word or phrase you want to find.

Match case: Checking this option limits the search operation to words whose case matches the spelling (uppercase and lowercase letters) given in the search field. This means the search becomes case-sensitive.

Match whole word: Checking this option limits the search operation to whole words.

Match cyclic: Checking this option means that after the editor reaches the end of the document, the search continues from the beginning of the text.

This option is checked by default.

Replace Click to replace text in the report layout editor. This dialog box includes consists of the following elements:

Find what: Is the text field where you enter the word or phrase you want to find.

Replace with: Is the text field where you enter the word or phrase that will replace the search term in the document.

Match case: Checking this option limits the search operation to words whose case matches the spelling (uppercase and lowercase letters) given in the search field. This means the search becomes case-sensitive.

Match whole word: Checking this option limits the search operation to whole words.

Match cyclic: Checking this option means that after the editor reaches the end of the document, the search continues from the beginning of the text.

This option is checked by default.

Save as Template Click to save the layout as a template.
Paragraph Format Select the paragraph format from the dropdown list. Select one of the following: Normal, Heading 1, Heading 2, Heading 3, Heading 4, Heading 5, Heading 6, Formatted, Address, or Normal (DIV).
Font Name Select the font from the dropdown list.
Font Size Select the font size from the dropdown list. Select a size ranging from 8 to 72.

 

Field Description
Bold Select the text fragment and then click the Bold button in the toolbar.

Alternatively, use the CTRL+B keyboard shortcut to apply bold formatting to a text fragment.

Italic Select the text fragment and then click the Italic button in the toolbar.

Alternatively, use the CTRL+I keyboard shortcut to apply italics formatting to a text fragment.

Underline Select the text fragment and then click the Underline button in the toolbar. Alternatively, use the CTRL+U keyboard shortcut to apply underline formatting to a text fragment.
Strike Through Select the text fragment and then click the Strike Through button in the toolbar.
Subscript Select the text fragment and then click the Subscript button in the toolbar.
Superscript Select the text fragment and then click the Superscript button in the toolbar.
Text Color You can change the color of text in the report by using a color palette. To choose a color, select a text fragment, click the Text Color button in the toolbar, and select a color.
Background Color You can also change the color of the text background.
Insert/Remove Numbered List Click to insert or remove a numbered list.
Insert/Remove Bulleted List Click to insert or remove a bulleted list.
Decrease Indent To decrease the indentation of the element, click the Decrease Indent toolbar button. The indentation of a block-level element containing the cursor will decrease by one tabulator length.
Increase Indent To increase the indentation of the element, click the Increase Indent toolbar button. The block-level element containing the cursor will be indented with one tabulator length.
Block Quote Block quote is used for longer quotations that are distinguished from the main text by left and right indentation. It is recommended to use this type of formatting when the quoted text consists of several lines or at least 100 words.
Align Left When you align your text left, the paragraph is aligned with the left margin and the text is ragged on the right side. This is usually the default text alignment setting for the languages with left to right direction.
Center When you center your text, the paragraph is aligned symmetrically along the vertical axis and the text is ragged on the both sides. This setting is often used in titles or table cells.
Align Right When you align your text right, the paragraph is aligned with the right margin and the text is ragged on the left side. This is usually the default text alignment setting for the languages with right to left direction.
Justify When you justify your text, the paragraph is aligned to both the left and right margins and the text is not ragged on either side..
Field Description
Remove Format Click to remove formatting.

Filtering report output

You can apply log message filters to reports and charts.

To filter output in a report:

Click the Settings tab and scroll to the Filters section.

To filter output in a chart:

  1. Click the Layout
  2. Filter a new or existing chart:
    • Click Insert Chart and scroll to the Filters
    • Right-click a chart in the layout and select Chart Properties. Scroll to the Filters

In the Filters section, the following options are available.

Field Description
Log messages that match Available in the Settings tab only.

Select All to filter log messages based on all of the added conditions, or select Any of the Following Conditions to filter log messages based on any one of the conditions.

Add Filter Click to add filters. For each filter, select the field, and operator from the dropdown lists, then enter or select the values as applicable. Filters vary based on device type.

When adding a filter, keep the following considerations in mind:

l The Settings and Layout tabs use the same Log Field list to filter output; however, some log fields are not used in charts. The Log Field you use to filter a report may not apply to the log fields in a chart. l The Value field is case sensitive.

LDAP Query Available in the Settings tab only.

Click to add an LDAP query, then select the LDAP Server and the Case Change value from the dropdown lists.

Use this option to query an LDAP server for group membership. The results of this query is used to filter the report to only match logs for users belonging to that group.

You must specify the group name in the filter definition.

Field Description
  If you enable LDAP Query, the group name is not used to match the group field in logs. The group name is only used for the LDAP query to determine group membership.

The query will not retrieve the userPrincicpalName if the Distinguished Name in the System Settings does not contain an organization unit (ou). To retrieve the UPN, add the Distinguished Name as it appears in the System Settings to your query.

This entry was posted in Administration Guides, FortiAnalyzer on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.