I have a Fortianalyzer (6.0.1) and I'm seeking some help on this particular dataset: apprisk-ctrl-File-Transferred-By-Application.
I tried adjusting some of the query but have since reset it to its default:
select appid, app, filename, cloudaction, max(filesize) as filesize from $log where $filter and filesize is not null and clouduser is not null and filename is not null group by cloudaction, appid, app, filename order by filesize desc
My test(s) all come back with No Data.
Any thoughts on where I can begin with this one and how I can adjust this query.
My end goal is to get a log of all files transferred to cloud applications (Google Docs, Box, Dropbox, etc) by user and file size.
Just as a side note, applications like Dropbox that has it own cert store wont normally work with Deep packet inspection and an exception will have to be setup. Meaning you wont see the files transferred in the logs I am guessing.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.