Technical Tip: How to create a FortiAnalyzer user forensic analysis report

[Pradhumna_FTNT]

Description

This article describes how to create a user report in 4.0 in order to report on a specific user's web browsing habits. (This is similar to the forensic style report in 3.0).

Scope

FortiAnalyzer

Solution

1. Go to Log -> Browse, then open the log file for the web filter of the desired FortiGate device.

2. Select User filter and find the LDAP string of the user name by looking for user name as shown.

3. In the log display, highlight and copy the full LDAP user name string.

4. Open the report schedule for User_Forensic_Report.

5. In the USER field, paste the user name string copied earlier. Put double quotes around the user name string (that is: 'CN=JMEIXNER,OU=IMC,OU=GH,O=GSD').

Change the schedule, time period, and output options as required.

6. Finally, run the scheduled report.

Related article:

Technical Tip: How to apply a User Filter to a report for forensic analysis