fortianalyzer simple select
Dear All,
I have missing information about creating datasets, so I have a hard struggle with select query.
I have a fortigate with vdoms, and I would like to try creating a simple custom dataset (in reports / report definitions / create dataset). In the gui I select the device, time period, log_type selection is intrusion_prevention and the query as follows:
select * from attack_log limit 5
The validates shows:
ERROR: relation "attack_log" does not exist
LINE 1: select * from (select * from attack_log limit 5) t limit 0
In "FortiAnalyzer and FortiGate Version 4.0 MR2 SQL Log Database Query Technical Note" there is a lot of example which uses these table names:
Table 8: Log types and table names
Log Type | SQL table | name Description
...
Attack log | attack_log | The attack log records attacks that are detected and prevented
by the FortiGate unit.
...
and a cli example from the doc:
config report datatset
edit "attack.Top10.last24h"
set query "select attack_id, count(*) as totalnum from attack_log where timestamp >= F_TIMESTAMP('now','hour','-23') and attack_id is not null group by attack_id order by
totalnum desc limit 10"
next
so I can not understand how can I use these table names....
Thank you