Raw logs and Users in report FortiSIEM 4.10

[stanley783]

Hi,

we are using fortisiem of 4.10 version. I have Full-admin role. Now there are two issues. First, after running Real-time search and inspecting Event details i see raw log and user within, i see user is parsed correctly because in lines below there is that user, but when i check display bar there, user column is empty. Logs comes from various devices. Is it somehow possible to see this correctly parsed users display in incident, reports, columns?

Second, when i create and run Report, Users column and Raw message are empty. For Raw message in reports i read this is possible if Data Obfuscation si disabled for user/role but this option is not avilable in 4.10 version, or at least i didnt find it nor in guide nor in place where it is in 5.2.1. Is there some workaround or only solution is upgrading? 

Thanks.

[FSM_FTNT]

Hi,

If the User is parsed from the raw event and when looking at the event (Raw log + Attributes) you see the User then you should definitely see the User in the Analytics view. 

Data Obfuscation is not in 4.10, so that would not be the issue.

Are you able to provide any screenshots of the Analytics settings... the display columns and the filter conditions?

I would suggest opening a support case or consider upgrading to 5.2.1.

Thanks