We need to generate a report with a list of unique IPs featuring on all logs for a given time period.
Have tried using Chart builder, this is the query for unique IPs and destination ports grouped by IP Address
select `srcip`, string_agg(distinct (`dstport`)::text, ' ') as dstport__agg_ from ###(select `srcip`, `dstport` from $log where $filter and (logflag&1>0) group by `srcip`, `dstport`)### t group by `srcip`
Is there any way to add the first and last times the IP featured in the logs with this?
I am trying to build a table with the following columns:
S.No.
IP Address
First seen time
Last seen time
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
OK perfect. So yea you should be able to create your own custom query to satisfy it. Basically again you'll be selecting source-ip info from the log data providing a conditional range of times and grouping by sourceip to show the source ips and when they first appeared.
You could also glean this data from your web server logs directly...
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1698 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.