Skip to main content
njira
New Member
August 26, 2025
Question

How to search FortiAnalyzer logs for specific domains or wildcards?

  • August 26, 2025
  • 1 reply
  • 734 views

I’m fairly new to FortiAnalyzer and need to investigate if any users have accessed certain domains over the past several months. I have a list of domains and subdomains (e.g., example.com, sub.example.com, etc.), and in some cases I only have wildcard formats like *.example.com.

I need to find out:

Which user has accessed these domains Or which device/source IP generated the traffic or had any session with those domains.

What’s the best way to search in FortiAnalyzer using just domain names or wildcards?

Should I be looking in Web Filter logs, DNS logs, or Forward Traffic logs?

Thanks in advance.

1 reply

AEK
SuperUser
SuperUser
August 26, 2025

In the log view, try use a filter like dst_domain="*.example.com"

AEK