Technical Tip: How to create a FortiAnalyzer user forensic analysis report
Description
This article describes how to create a user report in 4.0 in order to report on a specific user's web browsing habits. (This is similar to the forensic style report in 3.0).
Scope
FortiAnalyzer
Solution
- Go to Log -> Browse, then open the log file for the web filter of the desired FortiGate device.
- Select User filter and find the LDAP string of the user name by looking for user name as shown.
- In the log display, highlight and copy the full LDAP user name string.
- Open the report schedule for User_Forensic_Report.
- In the USER field, paste the user name string copied earlier. Put double quotes around the user name string (that is: 'CN=JMEIXNER,OU=IMC,OU=GH,O=GSD').
Change the schedule, time period, and output options as required.
- Finally, run the scheduled report.
Related article:
Technical Tip: How to apply a User Filter to a report for forensic analysis
