Skip to main content
DKell
New Member
February 14, 2017
Question

Daily Category Report

  • February 14, 2017
  • 2 replies
  • 3855 views

Hi Folks,

 

I'm new to fortianalzer and my sql skills are poor to say the least so feel free to reply as if you are talking to a 5 year old!

 

Basically I have been asked to produce a daily report which lists when a user tries to access certain categories.

 

So far I have managed to get it working for one category (Extremist Groups) with the following:

 

select from_dtime(dtime) as timestamp, `user` as usr, catdesc as category, hostname as hostname from $log-traffic where catdesc='Extremist Groups' order by dtime desc

 

This works as I had hoped.

 

However, we would like to be able to add multiple categories.

 

I tried:

select from_dtime(dtime) as timestamp, `user` as usr, catdesc as category, hostname as hostname from $log-traffic where catdesc='Extremist Groups' or

catdesc='Weapons (Sales)' order by dtime desc

 

However this didn't produce any results?!  Ideally I would like to be able to produce the report daily with 4 categories included.

 

If you could point me in the right direction it would be appreciated.

 

Regards

    2 replies

    AtiT
    New Member
    February 14, 2017

    Hi, try:

     

    SELECT from_dtime(`dtime`) AS timestamp, `user` AS usr, `catdesc` AS category, `hostname` AS hostname FROM $log WHERE `catdesc` IN ('Extremist Groups', 'Social Networking', 'News and Media') ORDER BY dtime DESC

     

    Dataset for the Traffic log type.

     

    DKell
    DKellAuthor
    New Member
    February 14, 2017

    Thanks for the quick reply I will have a look in the morning.

     

    Cheers

    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT