Skip to main content
chall_FTNT
Staff
chall_FTNT
Staff
May 20, 2020

Technical Tip: How to Apply a User Filter to a Report for Forensic Analysis

  • May 20, 2020
  • 0 replies
  • 9398 views

Description

 
This article describes necessary steps to gather data and generate reports for specific users for forensic analysis, .

 

Scope

 

FortiAnalyzer


Solution

 

This article uses 'Bandwidth and Application Report' as an example. Before applying a user filter, a sample 'Bandwidth and Application Report' shows many users.
 
chall_faz64-gen-report-no-userfilter.PNG
 
And the top destinations for all users:

chall_faz64-gen-report-appendix-userfilter-destinations-chart.PNG

 

Steps to Apply a User Filter

Go to Logview.  Select Traffic for log type under FortiGate and add a filter to confirm that logs exist for a specific user (in this case 'USER25').
 
chall_faz64-logview-adding-userfilter.PNG
 
chall_faz64-logview-userfilter.PNG
 
Go to Reports -> All Reports, 'right-click' on 'Bandwidth and Application Report', select Edit, select the Settings Tab. Expand the Filters option and add a Log Field of User (user) with value matching the user name from step 2 (in this case, 'USER25').
 
chall_faz64-report-setting-userfilter-original.PNG
 
Run the Report 'Bandwidth and Application Report' and select 'HTML' to view the generated report.
 
chall_faz64-gen-report-with-userfilter.PNG
 
chall_faz64-gen-report-with-userfilter.PNG
 
  • The chart 'Top 30 Users by Bandwidth and Sessions' only shows the matched user USER25.
  • The chart 'Destinations' only shows Destinations for traffic generated by USER25
 
chall_faz64-gen-report-appendix-userfilter.PNG
 
  • The appendix of the report shows for which user reports are generated
 
Related article:
Terms & ConditionsAccessibility statement