Fortinet has released some free Fortinet training that will enable you to get training free of charge straight from the source. Learn how to utilize the entire infrastructure as best as you can. This covers the entire product field for the most part as you train on the NSE1-8. FortiGate, FortiManager, FortiAnalyzer, FortiSwitch, FortiMail and more! The training is accessible here: https://www.fortinet.com/training/cybersecurity-professionals.html
To create a custom view:
l By Endpoint l By Threat l System Events l Custom View
Once the custom view is created, you can modify it further by removing or adding filters. Modifications can be saved by selecting the custom view icon and choosing Save or Save As to save the changes as a new view.
Default views in the By Endpoint, By Threat, and System Events view categories can be hidden, disabled, or copied as a custom view, allowing you to display only the views that are useful to the user.
To hide default views:
To disable/enable default views:
In an event list, to view event details, double-click an event line to drill down for more details.
The event details page contains information about the event and a list of all individual logs. You can work on events using buttons in the toolbar or by right-clicking an event. l To change what columns to display, click Column Settings or Column Settings > More Columns. l In event details, to view raw logs, click Tools > Display Raw. l To switch back to formatted log view, click Tools > Formatted Log. l To return to the previous page, click the back button.
Acknowledging an event removes it from the event list. Click Show Acknowledged to view acknowledged events.
To acknowledge events:
l In the event list, select one or more events, then right-click and select Acknowledge.
You can filter events using the Add Filter box in the toolbar or by right-clicking an entry and selecting a context-sensitive filter.
Filter FortiView summaries using the Add Filter box in the toolbar or by right-clicking an entry and selecting a contextsensitive filter. You can also filter by specific devices or log groups and by time.
To filter events using filters in the toolbar:
“or”.
To filter events using the right-click menu:
In the event list, right-click an entry and select a filter criterion (Search <filtervalue>).
Depending on the column in which your mouse is placed when you right-click, FortiView uses the column value as the filter criteria. This context-sensitive filter is only available for certain columns.
To launch Search in Logview from an event:
In the event list, right-click an entry and select Search in Logview.
Log View will launch with the filter automatically filled in with the following information:
FortiAnalyzer event handlers apply one or more tags to events, allowing the events to be grouped into views in the Event Monitor. These views are visible in the left navigation tree. Default views are organized into three view categories, including:
In order for events to be displayed in default views, the corresponding event handler(s) must be enabled. Refer to the chart below for a list of the predefined event handlers that must be enabled to support each default view:
| View category Default view | Required predefined event handler | |
| By Endpoint | All Security Events | Displays all events within category with enabled handlers |
| Compromised Hosts | Default-Botnet-Communication-Detection-By-Endpoint
Default-Compromised Host-Detection-IOC-By-Endpoint |
|
| High Risk App Usage | Default-Risky-App-Detection-By-Endpoint | |
| Malicious Domain/URL Access | Default-Risky-Destination-Detection-By-Endpoint | |
| Malware Activity | Default-Sandbox-Detections-By-Endpoint
Default-Malicious-File-Detection-By-Endpoint |
|
| Ongoing Intrusions | Default-Malicious-Code-Detection-By-Endpoint | |
| Sandbox Detections | Default-Sandbox-Detections-By-Endpoint | |
| By Threat | All Security Events | Displays all events within category with enabled handlers |
| C&C Call Backs | Default-Botnet-Communication-Detection-By-Threat
Default-Compromised Host-Detection-IOC-By-Threat |
|
| High Risk App Usage | Default-Risky-App-Detection-By-Threat | |
| Malicious Domain/URL Access | Default-Risky-Destination-Detection-By-Threat | |
| Malware Activity | Default-Sandbox-Detections-By-Threat
Default-Malicious-File-Detection-By-Threat |
|
| Ongoing Intrusions | Default-Malicious-Code-Detection-By-Threat | |
| Sandbox Detections | Default-Sandbox-Detections-By-Threat | |
| System Events | All | Displays all events within category with enabled handlers |
| FortiGate | Default FOS System Events | |
| Local Device | Local Device Event | |
You can see the tags associated with each view by hovering your mouse over the view in Incidents & Events; a pop-up is displayed.
Default views can be hidden or disabled. For more information, see Managing default views.
Admins can copy existing views to create custom views. For more information, see Creating custom views.
Obviously, you can’t buy these devices anymore. If you come across them though, replace them as soon as you can and avoid the drama.
After event handlers start generating events, view events and event details in Incidents & Events > Event Monitor.
When rebuilding the SQL database, you might not see a complete list of historical events. However, you can always see events in real-time logs. You can view the status of the SQL rebuild by checking the Rebuilding DB status in the Notification Center.
To view all the events, go to Incidents & Events > Event Monitor> All Events.
Double-click an event line to drill down for more details.
Hover your mouse over an entry to view the asset and identity information for that event.
| Devices | To view events for specific devices, click the devices dropdown and select a device. |
| Time Period | To change the time period to display, click the time icon and specify a time period. Select Custom to specify a time period not in the dropdown list. |
| Collapse All/Expand All | To view event summaries or details, click Collapse All or Expand All. |
| Show Acknowledged | To include acknowledged events, click Show Acknowledged. See Acknowledging events on page 77. |
| Refresh | To manually refresh the events data, click Refresh.
You can specify a refresh interval of Every 10 Seconds, Every 30 Seconds, Every 1 Minute, or Every 5 Minutes. |
| Export to CSV | Download the events to a CSV file. |
| Custom View | Save the current view including filter settings, device selection, and time period. |
| Column Settings | Select which columns are displayed in the All Events pane. Columns not displayed by default include Acknowledged, Comment, Device ID, Device
Name, Device Type, Event ID, HandlerDescription, Last Occurrence, Tags, and VDOM Name. |