Skip to main content
tnhafiz
tnhafiz
New Member
July 12, 2016
Question

Generate report by policies

  • July 12, 2016
  • 2 replies
  • 14903 views

Hi guys,

 

Currently my fortigates are connecting to a fortianalyzer. All logs from fortigate will be sent to this fortianalyzer.

What I want to know is how can I analyze or generate a report for a specific policies at a specific date and time?

If possible with a specific user also?

 

Thank you in advance

2 replies

kallbrandt
kallbrandt
New Member
July 12, 2016

You can create pretty much whatever you want to. You'll need to be prepared to write some SQL queries though.

tnhafiz
tnhafizAuthor
New Member
July 13, 2016

So how to write it?

Alby23
Alby23
New Member
July 12, 2016

Hi,

 

try to be more specific telling us what kind of report do you want to create (fields and so on).

tnhafiz
tnhafizAuthor
New Member
July 13, 2016

I want a report that read from a specific policy. In that report I want to know the sources, destinations, time, ports(allow/block), and users of that connections

 

Alby23
Alby23
New Member
July 13, 2016

SELECT     from_dtime(`dtime`) AS "Time",     COALESCE(NULLIFNA(`user`), IPSTR(`srcip`)) AS "User/IP",     srcip AS "Source IP",     dstip AS "Destination IP",     proto AS "Protocol",     dstport AS "Destination Port",     action AS "Action",     policyid AS "Policy ID" FROM     $log WHERE     $filter

Terms & ConditionsAccessibility statement