Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Administration Guide

Assets

The Fabric View > Assets pane is the central location for security analysts to view endpoint and user information to make sure they are compliant. Endpoints are important assets in a network as they are the main entry points in a cybersecurity breach.

The Assets pane is useful for the following:

  • Incident response: check assets that are infected or vulnerable as part of your SOC analysis and incident response process.
  • Compliance: identify unknown and non-compliant users and endpoints.

To view relevant asset logs directly from the FortiView, Log View, and Incidents & Events panes, click the user or endpoint log, then click the Topography link in the pop-up that appears.

The Assets pane lists all endpoints and users from relevant logs and correlates them with FortiAnalyzer modules. Sort by the Vulnerabilities column to see which endpoints and users have the highest vulnerabilities.

Column

Description

Endpoint

Endpoint host name or IP address.

Tags

Tags are used to group and identify assets to assist SOC analysts with incident management and prioritization.

Tags are determined based on the Classification Tag assigned in FortiClient EMS. Tags are displayed in FortiAnalyzer Assets when a FortiSoC playbook retrieves information about that endpoint using the Get Endpoints task available with a FortiClient EMS connector. See Connectors.

User

The name of the user. Click the name to view the corresponding user information in the Identity Center pane.

MAC Address

Endpoint MAC address.

IP Address

IP address the endpoint is connected to. A user might be connected to multiple endpoints.

FortiClient UUID

Unique ID of the FortiClient.

Hardware / OS

OS name and version.

Software

Click Details to view information about software installed on an endpoint when available.

Endpoint software information is retrieved when a playbook runs the Get Software Inventory action using the FortiClient EMS connector. See Configuring playbook automation.

Vulnerabilities

The number of vulnerabilities for critical, high, medium, and low vulnerabilities. Click the vulnerability to view the name and category. Right-click the vulnerability to view available on-demand actions using a security fabric connector.

Endpoint vulnerability information is retrieved when a playbook runs the Get Vulnerabilities action using the FortiClient EMS connector. See Configuring playbook automation.

Last Update

The date and time the log was updated.

Use the toolbar to select a Security Fabric, time period, and columns.

If there is no FortiClient in your installation, then endpoint and end user information is limited.

  • Endpoints are detected based on MAC address and displayed by IP address instead of host name.
  • User related information might not be available.
  • Detailed information such as OS version, avatar, and social ID information are not available.
To filter the entries using filters in the toolbar:
  • Specify filters in the Add Filter box.

    • Regular Search: In the selected summary view, click Add Filter and select a filter from the dropdown list, then type a value. Click NOT to negate the filter value. You can add multiple filters and connect them with “and” or “or”.

    • Advanced Search: Click the Switch to Advanced Search icon at the end of the Add Filter box. In Advanced Search mode, enter the search criteria (log field names and values). Click the Switch to Regular Search icon to go back to regular search.

To create a custom view in the toolbar:
  1. In the toolbar, click the column settings icon, and select the columns you want to display.
  2. Click Custom View. The Save as New Custom View dialog is displayed.
  3. In the Name field, enter a name for the custom view, and click OK. The view is saved under Custom View in the tree menu.
To download the entries as a CSV file:
  • Click Tools > Download.

Assets

The Fabric View > Assets pane is the central location for security analysts to view endpoint and user information to make sure they are compliant. Endpoints are important assets in a network as they are the main entry points in a cybersecurity breach.

The Assets pane is useful for the following:

  • Incident response: check assets that are infected or vulnerable as part of your SOC analysis and incident response process.
  • Compliance: identify unknown and non-compliant users and endpoints.

To view relevant asset logs directly from the FortiView, Log View, and Incidents & Events panes, click the user or endpoint log, then click the Topography link in the pop-up that appears.

The Assets pane lists all endpoints and users from relevant logs and correlates them with FortiAnalyzer modules. Sort by the Vulnerabilities column to see which endpoints and users have the highest vulnerabilities.

Column

Description

Endpoint

Endpoint host name or IP address.

Tags

Tags are used to group and identify assets to assist SOC analysts with incident management and prioritization.

Tags are determined based on the Classification Tag assigned in FortiClient EMS. Tags are displayed in FortiAnalyzer Assets when a FortiSoC playbook retrieves information about that endpoint using the Get Endpoints task available with a FortiClient EMS connector. See Connectors.

User

The name of the user. Click the name to view the corresponding user information in the Identity Center pane.

MAC Address

Endpoint MAC address.

IP Address

IP address the endpoint is connected to. A user might be connected to multiple endpoints.

FortiClient UUID

Unique ID of the FortiClient.

Hardware / OS

OS name and version.

Software

Click Details to view information about software installed on an endpoint when available.

Endpoint software information is retrieved when a playbook runs the Get Software Inventory action using the FortiClient EMS connector. See Configuring playbook automation.

Vulnerabilities

The number of vulnerabilities for critical, high, medium, and low vulnerabilities. Click the vulnerability to view the name and category. Right-click the vulnerability to view available on-demand actions using a security fabric connector.

Endpoint vulnerability information is retrieved when a playbook runs the Get Vulnerabilities action using the FortiClient EMS connector. See Configuring playbook automation.

Last Update

The date and time the log was updated.

Use the toolbar to select a Security Fabric, time period, and columns.

If there is no FortiClient in your installation, then endpoint and end user information is limited.

  • Endpoints are detected based on MAC address and displayed by IP address instead of host name.
  • User related information might not be available.
  • Detailed information such as OS version, avatar, and social ID information are not available.
To filter the entries using filters in the toolbar:
  • Specify filters in the Add Filter box.

    • Regular Search: In the selected summary view, click Add Filter and select a filter from the dropdown list, then type a value. Click NOT to negate the filter value. You can add multiple filters and connect them with “and” or “or”.

    • Advanced Search: Click the Switch to Advanced Search icon at the end of the Add Filter box. In Advanced Search mode, enter the search criteria (log field names and values). Click the Switch to Regular Search icon to go back to regular search.

To create a custom view in the toolbar:
  1. In the toolbar, click the column settings icon, and select the columns you want to display.
  2. Click Custom View. The Save as New Custom View dialog is displayed.
  3. In the Name field, enter a name for the custom view, and click OK. The view is saved under Custom View in the tree menu.
To download the entries as a CSV file:
  • Click Tools > Download.