Hi all,
I have a number of overly permissive rules using any services. What would be the most effecient way of extracting a report in FAZ, so I can see what services are actually hitting the rule, and design a policy around that?
Thanks.
Hey FortiDave,
you could put together a dataset roughly like this:
select service, count(*) as num_hits
from $log
where $filter and policyid=<policy ID>
group by service
order by num_hits desc
That would list the services and associated number of logs for each service for that policy ID
You would need to map that dataset to a custom chart and add that to a report to display the information, and you might want to do a bit of fine tuning, but this should give you at least a rough overview.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
