help! I want to consolidate the 3 datasets below to create 1 report for malware.
Report should look like tihs:
Source IP | destination IP | Count | Virus name
Malware Source
chart - top malware sources [size="2"]dataset - threat-top-virus-source[/size]
Malware Victims chart - Top Virus victims [size="2"]dataset - utm-top-virus-user[/size]
Malware Detected chart - Top Malware [size="2"]dataset - utm-Top-Virus[/size]
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Dear abe_dr,
I don't know if you have found how to create the dataset, if not and you still need it here is the code to put inside the dataset: select virus, max(virusid_s) as virusid, (case when virus like 'Riskware%' then 'Spyware' when virus like 'Adware%' then 'Adware' else 'Virus' end) as malware_type, attacker, victim, sum(totalnum) as totalnum from ###(select virus, virusid_to_str(virusid, eventtype) as virusid_s, srcip as victim, ipstr(`dstip`) as attacker, count(*) as totalnum from $log where $filter and (eventtype is null or logver>=502000000) and nullifna(virus) is not null group by virus, virusid_s, attacker, victim /*SkipSTART*/order by totalnum desc/*SkipEND*/)### t group by virus, malware_type, attacker, victim order by totalnum desc
Result:
virus virusid malware_type attacker victim totalnum
HTML/yyyy xxxxxx Virus xx.xx.xx.xxx xxx.xxx.xxx.xxx x
Bye Aido
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1502 | |
1011 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.