Fortinet FortiLog-400 Configuring a report query, To set the report queries Go to Reports Config

Reports Creating and generating a report

Per Virtual Domain

For all devices Per device

Resolve Host Names

Select to generate the report based on the virtual domains configured on the FortiGate devices.

Select to generate the report for all devices.

Select to generate a separate report for each device.

Select to display host names by name rather than IP addresses. For details on configuring IP address host names see “Defining IP aliases” on page 55.

Resolve Service

Names

In 'Ranked Reports' show top

5Select Apply.

Select to display network service names rather than port numbers. For example, HTTP rather than port 80.

For some report types, you can set the top ranked items for the report. When setting top ranked items, the report will only include the most active content. For example, report the most active mail clients within the organization rather than all mail clients.

Configuring a report query

Select the specific information you need to generate a more concise report. Each report category includes a refined list of sub-categories that reports specific information. For example, you can generate an extensive intrusion activity report, or only generate intrusion activity by attacks by top types, or by hour of the day.

The default is to run a report for all information in the log files. Select the specific information you want to include in the report. Reports are listed by categories and sub-categories.You can save the report query selections to use in other reports.

Figure 29: Report query options

To set the report queries

1Go to Reports > Config.

2Select a report from the list.

3Select Queries.

FortiLog Administration Guide 05-16000-0082-20050115 59