Skip to main content
Melon_Molusk
Melon_Molusk
Visitor III
September 26, 2022
Question

In which table in the DB I can find the data that is show in the Analytics section?

  • September 26, 2022
  • 2 replies
  • 1655 views

Hi, Im tring to retrieve some data from the Database, I need to get this events types:

 

PH_SYSTEM_EVENTS_PER_SEC
PH_SYSTEM_STORED_EVENTS_PER_SEC
PH_SYSTEM_SUMM_EVENTS_STORED_EPS
PH_SYSTEM_EVENTS_FWD_STAT
PH_SYSTEM_INTERNAL_EVENTS_PER_SEC
PH_SYSTEM_PERF_EVENTS_PER_SEC
PH_SYSTEM_IP_EVENTS_PER_SEC
PH_SYSTEM_DEVAPP_EVENTS_PER_SEC
PH_SYSTEM_EPS_GLOBAL
PH_SYSTEM_EPS_NODE
PH_SYSTEM_EPS_ORG
PH_PROF_ET_116_EPS

 

This types are listed in the "ph_event_type" table, but I need to get their histogram data like is shown in the GUI of fortisiem.

 

MicrosoftTeams-image.png

2 replies

premchanderr
Staff & Editor
premchanderr
Staff & Editor
September 27, 2022

Hi @Melon_Molusk ,

 

The logs are stored not stored in cmdb, but in eventdb. Which is structured more like linux file system and not sql.  

 

You can run historical search using same condition system event category = 3 and add required filters. 

 

What is that you are looking for in backend that's not available in GUI > Analytics ?

    Melon_Molusk
    Melon_MoluskAuthor
    Visitor III
    September 27, 2022

    Hi @premchanderr , Thanks for you answer, I want to integrate with another plataform, I already get all incidents from the ph_incident table from the database, but now I need those analitycs metrics.

     

    this eventdb is located in the server? (I dont have access yet so I have to ask for them), this are just logs? there is an API to make requests?

     

    Thanks!

    premchanderr
    Staff & Editor
    premchanderr
    Staff & Editor
    September 30, 2022

    Hi @Melon_Molusk ,

     

    For API Integration of Events and Report:

    https://docs.fortinet.com/document/fortisiem/6.6.2/integration-api-guide/451674/events-and-report-integration

     

    Another method to forward syslog received in Fortisiem:

    https://help.fortinet.com/fsiem/6-6-2/Online-Help/HTML5_Help/Event_Handling_Settings.htm?Highlight=event%20forwarding#Event2

     

    You can export event in backend to CSV:

    https://help.fortinet.com/fsiem/6-6-2/Online-Help/HTML5_Help/appendix-exporting_events_to_files.htm?Highlight=event%20forwarding

     

    If you face any issue in these methods I would suggest you to open ticket with Fortinet TAC and an engineer would be glad to assist you. 

    For any general query on these topics you are welcome to discuss here.

     

     

    Terms & ConditionsAccessibility statement