How to check who executed script in fortimanager?

kutty7 · ‎07-19-2023

Hello, is there an option to determine who executed the script knowing the exact date of execution of the script? Someone executed a script that did a lot of damage, I managed to repair it but I don't know if it was sabotage/attack or just an employee error (Fortimanager software from the 6.2.X/6.4.X series)

router login 192.168.l.l

petergray · ‎07-19-2023

FortiManager's Audit Logs feature tracks user activity, including script execution. To check, log in, go to System Settings or Admin section, find Audit Logs, and search for the script execution date and user.

Analyze the logs to verify the user's identity and consider upgrading FortiManager for newer capabilities. Implement security measures to prevent unauthorized access and potential damage. If suspicious, investigate and involve IT security or Fortinet support.

markwarner · ‎07-20-2023

When an admin runs a script there should be an event created in the event log with:
Description: Script install status
Operation: Install script
Also attributes Changes and Message will show more information but are less useful for filtering.