In which table in the DB I can find the data that is show in the Analytics section?

[Melon_Molusk]

Hi, Im tring to retrieve some data from the Database, I need to get this events types:

PH_SYSTEM_EVENTS_PER_SEC
PH_SYSTEM_STORED_EVENTS_PER_SEC
PH_SYSTEM_SUMM_EVENTS_STORED_EPS
PH_SYSTEM_EVENTS_FWD_STAT
PH_SYSTEM_INTERNAL_EVENTS_PER_SEC
PH_SYSTEM_PERF_EVENTS_PER_SEC
PH_SYSTEM_IP_EVENTS_PER_SEC
PH_SYSTEM_DEVAPP_EVENTS_PER_SEC
PH_SYSTEM_EPS_GLOBAL
PH_SYSTEM_EPS_NODE
PH_SYSTEM_EPS_ORG
PH_PROF_ET_116_EPS

This types are listed in the "ph_event_type" table, but I need to get their histogram data like is shown in the GUI of fortisiem.

[premchanderr]

Hi @Melon_Molusk ,

The logs are stored not stored in cmdb, but in eventdb. Which is structured more like linux file system and not sql.  

You can run historical search using same condition system event category = 3 and add required filters. 

What is that you are looking for in backend that's not available in GUI > Analytics ?

[Melon_Molusk]

Hi @premchanderr , Thanks for you answer, I want to integrate with another plataform, I already get all incidents from the ph_incident table from the database, but now I need those analitycs metrics.

this eventdb is located in the server? (I dont have access yet so I have to ask for them), this are just logs? there is an API to make requests?

Thanks!

[premchanderr]

Hi @Melon_Molusk ,

For API Integration of Events and Report:

https://docs.fortinet.com/document/fortisiem/6.6.2/integration-api-guide/451674/events-and-report-in...

Another method to forward syslog received in Fortisiem:

https://help.fortinet.com/fsiem/6-6-2/Online-Help/HTML5_Help/Event_Handling_Settings.htm?Highlight=e...

You can export event in backend to CSV:

https://help.fortinet.com/fsiem/6-6-2/Online-Help/HTML5_Help/appendix-exporting_events_to_files.htm?...

If you face any issue in these methods I would suggest you to open ticket with Fortinet TAC and an engineer would be glad to assist you. 

For any general query on these topics you are welcome to discuss here.