Technical Tip: Tracking exception changes in FortiEDR manager

Description

This article describes how to review FortiEDR audit logs to identify which user created, modified, or deleted an exception in the FortiEDR manager.

Scope

FortiEDR.

Solution

1. Generate and collect the Audit Logs for the date range or time period during which the exception was created, modified, or deleted, to identify and audit the corresponding user action.

2. Audit Logs can be filtered using specific patterns or keywords, such as remove, create, admin user, Exception ID, or Event ID, to facilitate tracking and auditing of the corresponding modifications.

Note: Use Ctrl + F (open the search dialog in Excel if keyboard is set to English). The most important field in the Audit Logs is the Value column. Search for the desired pattern and use the Find All option, which lists all events associated with the specified keyword or pattern, enabling easier tracking and correlation of related actions.