Skip to main content
stanley783
New Member
July 23, 2019
Question

Raw logs and Users in report FortiSIEM 4.10

  • July 23, 2019
  • 1 reply
  • 3581 views

Hi,

 

we are using fortisiem of 4.10 version. I have Full-admin role. Now there are two issues. First, after running Real-time search and inspecting Event details i see raw log and user within, i see user is parsed correctly because in lines below there is that user, but when i check display bar there, user column is empty. Logs comes from various devices. Is it somehow possible to see this correctly parsed users display in incident, reports, columns?

 

Second, when i create and run Report, Users column and Raw message are empty. For Raw message in reports i read this is possible if Data Obfuscation si disabled for user/role but this option is not avilable in 4.10 version, or at least i didnt find it nor in guide nor in place where it is in 5.2.1. Is there some workaround or only solution is upgrading? 

 

Thanks.

1 reply

FSM_FTNT
Staff
Staff
July 30, 2019

Hi,

 

If the User is parsed from the raw event and when looking at the event (Raw log + Attributes) you see the User then you should definitely see the User in the Analytics view. 

 

Data Obfuscation is not in 4.10, so that would not be the issue.

 

Are you able to provide any screenshots of the Analytics settings... the display columns and the filter conditions?

 

I would suggest opening a support case or consider upgrading to 5.2.1.

 

Thanks

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!