Webfilter Activity, 189 | Fortinet 3.0 MR7 instruction


Appendix: FortiAnalyzer reports in 3.0 MR7	FortiGate reports

Table 11: Antivirus Activity reports

Top Virus Sources over SMTP by	Top Virus Sources over SMTP
Month

Top Virus Destinations over SMTP by	Top Virus Destinations over SMTP
Hour of Day

Top Virus Destinations over SMTP by	Top Virus Destinations over SMTP
Date

Top Virus Destinations over SMTP by	Top Virus Destinations over SMTP
Month

Top Virus Senders by Virus Name	Top Viruses for Most Common Sources
	(Email or IP)

Top Virus Protocols by Date	Top Virus Protocols

The following reports were removed:

•Top Virus Agents by Virus Name

•Top Virus Receivers over HTTP

The following reports are unchanged:

•Top Viruses

•Top Infected Files

Webfilter Activity

The following table explains what WebFilter Activity reports have changed and what they were changed to in FortiAnalyzer 3.0 MR7.

Table 12: WebFilter Activity reports

MR6 reports	MR7 reports

Web Hits by Status	Total Hits per Status (allowed/blocked/etc)

Blocked Web Hits by Date	Blocked Web Activity over Time Period

Blocked Web Hits by Month	Blocked Web Activity over Time Period

Blocked Web Hits by Day of Week	Blocked Web Activity over Time Period

Blocked Web Hits by Hour of Day	Blocked Web Activity over Time Period

Top Web Request Destinations by	Top Requested Web Domains
Date

Top Web Request Destinations by	Top Requested Web Domains
Month

Top Web Request Destinations by	Top Requested Web Domains
Day of Week

Top Web Request Destinations by	Top Requested Web Domains
Hour of Day

Top Requested Web Pages by Date	Top Requested Web Pages
(Hits)

Top Requested Web Pages by Month	Top Requested Web Pages
(Hits)

Top Requested Web Pages by Day	Top Requested Web Pages
of Week (Hits)
Top Requested Web Pages by Hour	Top Requested Web Pages
of Day (Hits)
Web Hits for each Status by Date	Total Hits per Status (allowed/blocked/etc)

Web Hits for each Status by Month	Total Hits per Status (allowed/blocked/etc)

FortiAnalyzer Version 3.0 MR7 Administration Guide
005-30007-0082-20080908	189

Image 201

Fortinet 3.0 MR7 manual Webfilter Activity, WebFilter Activity reports MR6 reports MR7 reports, 189

Contents

M I N I S T R a T I O N G U I D E Trademarks Regulatory complianceFCC Class a Part 15 CSA/CUS Contents Viewing session information Filtering session information Radius Server Administrator SettingsLog Receive Monitor Intrusion Activity Adding a route Content Archive 107 DeviceLog Quarantine 131 Reports 113Alert 133 Network Analyzer 141 Managing firmware versions 169 Tools 157 Index 213 Appendix FortiAnalyzer reports in 3.0 MR7 185 About this document Introduction Fortinet documentation Describes how to install and set up the FortiAnalyzer unit Fortinet Tools and Documentation CD Customer service and technical supportFortinet Knowledge Center Comments on Fortinet technical documentation Customer service and technical support High-end FortiAnalyzer units support additional What’s new for 3.0 MR7 FortiAnalyzerVersion 3.0 MR7 Administration Guide Power supply monitoring for FortiAnlayzer-2000A and 4000A MR7 new features and changesRegistered devices’ hard limits CLI displays the tasks in the upload queue Config log settings Set custom-field1-5 Report configuration enhancementsCustom fields for log messages Reports VoIP reports All other reports, for exampleReportHeadquarters-2008-05-26-1030 Alert email configuration changes About administrative domains ADOMs Administrative Domains ADOMs About administrative domains ADOMs FortiAnalyzer Model Number of Administrative Domains To enable ADOMs Configuring ADOMsGo to System Admin Settings Enable Admin Domain Configuration Select OK Message appears Go to Global Configuration System Admin Settings To disable ADOMsTo add or edit an Adom Select OK FortiAnalyzer unit logs you out Assigning administrators to an Adom Accessing ADOMs as the admin administratorTo access an Adom To assign an administrator to an Adom System DashboardSystem Information To refresh a Dashboard widget Go to System Dashboard To rearrange a Dashboard widget Go to System Dashboard To include a Dashboard widget Go to System Dashboard TabsTo omit a Dashboard widget Go to System Dashboard To add a tab Go to System Dashboard RAID Monitor Double-click on the name of the tab and select the X symbolEnter a new name and press Enter To delete a tab Go to System Dashboard Rebuilding icon System Information 05-30007-0082-20080908 Setting the time Changing the firmware Changing the host nameLicense Information To change the host name Go to System Dashboard Viewing operational history System ResourcesRVS Plug-ins Device License Memory Usage Formatting the log disks System OperationTo format the log disks Go to System Dashboard Systems Operations area, select Format Log Disks Select OK Alert Message Console Resetting to the default configurationViewing alert console messages To view alert console messages Go to System Dashboard Viewing session information StatisticsSelect the delete icon Connections Report Engine Filtering session informationTo view the session information Go to System Dashboard Statistics area, next to Connections, select Details Type Log Receive MonitorTop N Period Intrusion Activity Virus ActivityDisplay by Virus Activity widget Top FTP Traffic Top Email Traffic, select Edit Top Email Traffic Top IM/P2P Traffic, select Edit in the title bar area Top IM/P2P Traffic Top Traffic To edit information for Top Traffic Go to System DashboardTop Traffic, select Edit in the title bar area Top Web Traffic, select Edit Top Web Traffic Interface Network Administrative Changing interface settingsStatus Modify About Fortinet Discovery Protocol To configure DNS settings Go to System Network DNSRouting Enter an IP address for a primary and secondary DNS server Select Create New Configure the following options AdminAdding a route To add a static route Go to System Network Routing Adding or editing an administrator account Access Profile Changing an administrator’s passwordAccess Profile Admin Domain Auth Group To add a group Go to System Admin Auth GroupNone Read Only To add a Radius server Go to System Admin Radius Server Administrator SettingsSelect Create New Configure the following and select OK Radius Server Monitor Network SharingAdding share users To add a user account Go to System Network Sharing User Configuring Windows shares Adding share groupsTo add a user group Go to System Network Sharing Group Permissions Assigning user permissions Remote Clients Configuring NFS shares Config Default file permissions on NFS sharesAutomatic file deletion and local log settings Log Level Allocated Disk Space MB FortiAnalyzer unit log settings Log Locally Configuring log aggregation FortiAnalyzer-800/800B FortiAnalyzer-400FortiAnalyzer-2000/2000A FortiAnalyzer-4000/4000A Configuring an aggregation server Configuring an aggregation clientConfiguring log forwarding To forward log events Go to System Config Log Forwarding To add an IP alias Go to System Config IP Alias Configuring IP aliasesTo edit an IP alias Go to System Config IP Alias To import the alias file Go to System Config IP Alias Configuring RAID IP alias rangesRAID levels RAID Linear RAID 5 with hot spare Hot swapping hard disks FortiAnalyzer-800/800B disk drive configuration FortiAnalyzer-400 disk drive configuration To swap a hard disk Go to System Config RAID FortiAnalyzer-2000/2000A disk drive configurationFortiAnalyzer-4000 disk drive configuration As well as from System Config RAID Configuring RAID on the FortiAnalyzer-400FortiAnalyzer-800/800B Level 1 Size GB Configuring Ldap connections Select Create New. Complete the following To define an Ldap server query Go to System Config Ldap Maintenance Backup & RestoreBackup Back up the current configuration FortiGuard Center 10.10.1.108889 Scheduled UpdateEvery Daily Maintenance Viewing the device list Device Show Add DeviceUnregistered Device Options Hardware Action Secure Connection Disk Space MB Used/Allocated To delete a device Go to Device All Device Maximum number of devices Unregistered vs. registered devices Configuring unregistered device connection attempt handling Or the following options for unknown device types Manually adding a device Device ID Device NameMode Member IDs Group Membership FortiGate Interface Specification When Allocated Disk Space is All Used Devices Privileges Classifying FortiGate network interfaces For more information, see Manually adding a device on Configure the FortiGate device To enable the FortiAnalyzer unit to reply to FDP packets On the FortiAnalyzer unit, go to Device AllGo to System Network Hardware Model Blocking device connection attempts Configuring device groups To block a device Go to Device All DeviceTo unblock a device Go to Device All Blocked Device To delete a device group Go to Device Group Device Group To configure a device group Go to Device Group Device GroupGroup Name Members Log Viewing log messagesViewing current log messages Viewing historical log messages Column Settings Browsing log files To view historical logs Go to Log Log Viewer HistoricalImport Viewing log file contents To import a log file Go to Log Browse Importing a log file To download a whole log file Go to Log Browse Downloading a log fileTo download a partial log file Go to Log Browse Convert to CSV format Compress with gzip Customizing the log view Select Download Current View Configure the followingDisplaying and arranging log columns To display logs in Raw or Formatted view Filtering logs To display or hide columnsTo change the order of the columns To filter log messages by column contents To disable a filterFiltering tips 101 Searching the logs From Searching the logs Search tips To search the logs Go to Log Search103 192.168.* action=login Printing the search resultsDownloading the search results Rolling and uploading logs To download log search results Go to Log Search105 Not exceeded ExceedServer IP address Username 107 108 Viewing content archives Content Archive View per page Page n of n Column Settings Printable Version Delete associated content archive filesTimeframe 109 Customizing the content archive view Filter icons in the content logs 111 Searching full email content archives 113 Last activity 114 Reports Configuring reports Configuring report layout To configure a report layout Go to Report Config Layout Name Enter a name for the report Description115 Title Page Logo Header LogoCategory 117 Editing charts in a report layout Maximum Entries Top N Time Scale Advanced To edit a chart To edit text Configuring report schedulesTo edit section 119 Schedule Name To configure a report schedule Go to Report ScheduleReport layout Name Schedule Data Filter Log Data FilteringTime Period 121 Data filter templates Configuring data filter templates Filter logic Sources123 Interfaces DestinationsPolicy IDs Day of the Week 125 Configuring report output templates Output template FTP/SFTP/SCP Server Action 127 Nomatch=No matching log data for this report Configuring language Comment is # Localization uses a Latin character set129 Font Languages Language file error messages Error message Description Save the format file131 Browsing reports 133 134 Viewing quarantined files QuarantineQuarantined files for a specific device See Date & Time ServiceChecksum Status Description Alert Alert EventsTriggers To add a new alert event Go to Alert Alert Event Adding an alert event Output Configuring alerts by email serverTo Email Address Add Configuring Snmp traps and alerts Testing the mail server configurationEnable Smtp Server 137 FortiAnalyzer Snmp support Adding an Snmp server Fortinet MIB System Traps Fortinet MIB Administrator AccountsFortinet MIB Logging Traps Fortinet MIB VPN Traps Adding a Syslog server Configuring alerts by Syslog serverRFC-1213 MIB RFC-2665 Ethernet-like MIB 141 Configure the following options, and select OK 142 Network Analyzer Config log settings Set enableanalyzer yes End Example network topology for Network Analyzer use Viewing Network Analyzer log messages Viewing current Network Analyzer log messages143 Viewing historical Network Analyzer log messages Protocol Protocol used when sending the traffic Message Browsing Network Analyzer log files Viewing Network Analyzer log file contents Printable Version Download Current View Resolve Service View n per page Page n of n Column Settings 147 Downloading a Network Analyzer log file Displaying and arranging Network Analyzer log columns Customizing the Network Analyzer log view 149 Filter icons in Network Analyzer 150 Keywords Searching the Network Analyzer logsQuick Search Full Search Other To search the logs Go to Tools Network Analyzer Search 153 172.20.120.127 tcp Select the download options that you want, then select OK Rolling and uploading Network Analyzer logs 155 Log file should be rolled... even if size is not exceeded Select the protocol to use when uploading to the server Tools Preparing for the vulnerability scan job157 Preparing Windows target hosts 159 To enable NetBIOS Go to Start Control Panel Viewing vulnerability scan modules Preparing Unix target hosts161 Vulnerability Scan modules View modules with severity Configuring vulnerability scan jobs Details163 Target Job Name Select Create New Complete the following Remote Authentication User NameScan Targets Quick Scan File output Email AttachmentEmail Body 167 Viewing vulnerability scan reports File Explorer End TimeFormats 169 File Explorer with Storage directory expanded 170 Managing firmware versions Backing up your configuration Backing up your configuration using the CLI Backing up your configuration using the web-based managerTo back up your configuration file using the CLI Execute backup config filename addressip passwd 171 Testing firmware before upgrading Press any key to display configuration menu…To test the firmware image before upgrading Enter Local Address Enter Tftp server addressEnter firmware image file name image.out 173 Upgrading your FortiAnalyzer unit Upgrading using the web-based managerUpgrading to FortiAnalyzer Only To upgrade to FortiAnalyzer 3.0 using the web-based manager Upgrading using the CLITo upgrade to FortiAnalyzer 3.0 using the CLI Execute restore image namestr tftpip4 Get system status Verifying the upgrade Downgrading to FortiLog Reverting to a previous firmware versionSelect OK Following message appears 177 To downgrade using the CLI Downgrading to FortiLog 1.6 using the CLIExecute restore image tftp namestr tftpipv4 Execute restore image tftp image.out 179 Restoring configuration settings on a FortiAnalyzer unit Restoring your configurationTo restore a firmware image to the FortiAnalyzer unit Execute reboot Press any key to display configuration menu When this message appearsEnter File Name image.out 181 To restore configuration settings using the CLI Restoring your configuration settings using the CLIExecute restore config namestr tftpipv4 passwrd Execute restore config confall 192.168.1.168 ghrffdt123 183 184 Appendix FortiAnalyzer reports in 3.0 MR7 FortiGate reports185 Antivirus Activity Intrusion Activity reports MR6 reports MR7 reportsAntivirus Activity reports MR6 reports MR7 reports 187 Antivirus Activity reports Top Virus Destinations over POP3 Webfilter Activity WebFilter Activity reports MR6 reports MR7 reports189 Antispam Activity WebFilter Activity reportsAntispam Activity reports MR6 reports MR7 reports Antispam Activity reports IM ActivityIM reports MR6 reports MR7 reports 191 VoIP reports MR7 reports IM reports Content Activity VoIP reports193 Content Activity reports MR6 reports MR7 reports Network ActivityNetwork Activity reports MR6 reports MR7 reports Web Activity Network Activity reports195 Mail Activity FTP ActivityReport, Top Mail Servers Connections remains unchanged VPN Activity Terminal ActivityFTP Activity reports Terminal Activity reports MR6 reports MR7 reports Event Activity VPN Activity reports MR6 reports MR7 reportsEvent Activity reports MR6 reports MR7 reports Report, Top Event Categories by Status, was removed P2P ActivityEvent Activity reports P2P Activity reports MR6 reports MR7 reports P2P Activity reports Audit Activity 201 Summary Reports Audit Forensic ReportsDetailed Report, Top Client Requests to Permitted Sites, was removed Summary FortiMail ReportsMail High Level 203 Mail High Level reports Mail Sender Mail Sender reports MR6 reports MR7 reports205 Mail Destination IP Mail Recipient ActivityMail Sender reports Mail Recipient Activity reports MR6 reports MR7 reports Mail Destination IP reports MR6 reports MR7 reports Spam SenderSpam Sender reports MR6 reports MR7 reports 207 Spam Recipient Spam Sender reportsSpam Recipient reports MR6 reports MR7 reports Virus Sender Spam Destination IPSpam Recipient reports Spam Destination IP reports MR6 reports MR7 reports Virus Sender reports MR6 reports MR7 reports Virus Sender reports Virus RecipientVirus Recipient reports MR6 reports MR7 reports 211 Virus Destination IP FortiClient Reports 213 Index FDN 215 FTP Mail server 135 Main Menu 20 managing firmware 217 RFC See also protocol test 219 Index FortiAnalyzer Version 3.0 MR7 Administration Guide