FAZ Top Services In a Rule

[FortiDave]

Hi all,

I have a number of overly permissive rules using any services. What would be the most effecient way of extracting a report in FAZ, so I can see what services are actually hitting the rule, and design a policy around that?

Thanks.

[Debbie_FTNT · Accepted solution]

Hey FortiDave,

you could put together a dataset roughly like this:

select service, count(*) as num_hits

from $log

where $filter and policyid=<policy ID>

group by service

order by num_hits desc

That would list the services and associated number of logs for each service for that policy ID

You would need to map that dataset to a custom chart and add that to a report to display the information, and you might want to do a bit of fine tuning, but this should give you at least a rough overview.

[FortiDave]

Thanks Debbie. Im not getting the top 10 services. Woyuld you know how I can expand that to top 50, or all services?

[FortiDave]

Also, If i wanted this report to have details for say 8-10 rules, separete sections, is that possible?

[Debbie_FTNT]

Hey Dave,

to expand to more than 10 results, you need to edit the chart that you linked the dataset to and increase the number of rows (or set to 0, in which case the system default of 10000 is applied).

To run the chart for different policies, you can remove the 'policyid=<>' condition in the dataset, and then filter on a per-chart basis (edit the report, then edit the chart settings in the report itself to apply the filter for a specific policy id)

you could simply include the chart multiple times, each time filtered for a different policy ID

if you want to have multiple policy IDs listed in the same chart, you would have to modify the chart and dataset to include policyid, something like this:

select policyid, service, count(*) as num_hits

from $log

where $filter

group by policyid, service

order by num_hits desc

[FortiDave]

This worked Debbie, thanks. Will just have to run it for each rule individually.