FortiAnylzer Bandwidth Alert Event Management

[waleedkhan26]

Hi,

I want notification through email if certain event occur like certain user exceeding ‘y’ amount of bandwidth usage, administrator should get notified over email, I was searching for BW utilization field, but didn’t get in Event Management, is it possible ? Check attach file, it doesn’t show something related to field ‘BW’ and If it matches certain criteria, it should send an alert email notification to define administrator email ID.

[sgao_FTNT]

Hi, 

Event Management filter is based on log filed value, if the field exists in raw log and cannot be found in drop-down filter list, please try using generic text filter.  i.e.  in traffic log, there is a field "sentbyte" to indicate bytes sent of the session, we can add a generic text filter with "sentbyte >10000" to trigger event when 10,000+ bytes sent

Regards, Shawn