Cybersecurity Forum

This forum is for all security enthusiasts to discuss Fortinet's latest & evolving technologies and to connect & network with peers in the cybersecurity hemisphere. Share and learn on a broad range of topics like best practices, use cases, integrations and more. For support specific questions/resources, please visit the Support Forum or the Knowledge Base.

KareBrow
New Contributor

FortiAnalyzer - How to set up a report to list all users who visit a particular website

I'm looking for a way to write a report in FortiAnalyzer that will spit back a list of users who visit a particular website at any given time.  I work at an Educational Institution and we're looking to identify users are visiting two websites that we know can be used to disguise plagiarism.  We don't want to know about ALL plagiarism websites, just the two we have identified.

I haven't been able to find the right Datasets/Charts to fit what I'm after.

Is anyone able to help?

1 REPLY 1
mnantel_FTNT
Staff
Staff

Sure thing Karen!

While I am not sure which version of FAZ you are running, here's a quick dataset that should get you what you need:

select hostname, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, count(*) as webhits from $log where $filter group by hostname, user_src order by webhits desc

In order to use this dataset, ensure the log type is set to "web filter" when you create the dataset.

Then, create a chart referencing the dataset. You can give proper names to the dataset fields in the chart.

And the last step is to configure a report by adding the chart to the report's layout. You can then apply a filter to the report such that the field called "Hostname" receives a filter value of "www.plagiarismwebsite.com".

Happy to help you out with that report if things dont work out with the above instructions - just email me at mnantel@fortinet.com.

--

Mathieu Nantel

Principal Presales Security Expert

-- Mathieu Nantel Systems Engineer / Conseiller Technique - Fortinet Montreal, QC

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.