Address Group to Filter Reports

[davidsteelerose]

I have a report that I want to filter to specific networks that have been identified using the Address Group feature. I used filters Log messages that match any of the conditions - Log Field: Address Group (adgroup) equal to Business Networks

I expected this to be as simple as that, but my reports still show IP addresses that are not in the Business Networks address group.

What am I missing?

Device is FortiGate-200E

FortiAnalyzer is the latest version

[chall_FTNT · Accepted solution]

Report filtering lists all possible fields that can be filtered on but many of them are relevant only to certain log types.  In this case, address group is only a relevant field for system event logs.

[davidsteelerose]

If I wanted to group networks to be used in report filtering, is there another approach? Currently each network that is in our core Business Networks are given Address Group = Business Networks. 

Is there another tagging method so that I can separate these networks from less important networks so that I can focus my reporting on Business Networks? Ideas?

[davidsteelerose]

If I wanted to group networks to be used in report filtering, is there another approach? Currently each network that is in our core Business Networks are given Address Group = Business Networks. 

Is there another tagging method so that I can separate these networks from less important networks so that I can focus my reporting on Business Networks? Ideas?