Fortimanager/Fortianalyzer Alert on Data upload

[FreddyFred]

Dear All

I have a Fortigate with around 20 interfaces. I would like to set up a live alert if more than 1GB of traffic is sent from an interface to the WAN within one hour, e.g., FTP upload, SharePoint upload, or similar. This is to detect when data is being extracted/uploaded.

I have the firewall managed in Fortimanager/Fortianalyzer. However, I cannot find a suitable alert/configuration to achieve this. Does anyone have a guide or a tip?

Greetings

[smkml]

Hi FreddyFred,

Below KB's are some example you may follow to configure the event handler, you may need to play-around with the filter/generic text filter to achieve your requirements:
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-create-Event-Handler-for-FortiA...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-configure-Event-Handler-Alerts-...
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Creating-alerts-when-FortiAnalyzer-sto...