Identifying faces

You can link a face detected by the camera to an existing UEBA profile. You can also use a face to create guest profiles.

To identify faces in a cluster in the GUI:

1. Go to FortiRecorder > Face Recognition.
2. In the tree menu, go to Face Cluster > New Face Detected.
3. In the toolbar, configure the detection settings.
   1. Click the All Cameras dropdown to select a camera.
   2. Click the time period dropdown to select the time period.
   3. Select the detection order.

      Order by time	Displays images by time stamp.
      Order by count	Displays images by the number of times the face was detected by the camera.

      Hover over an image to view its time stamp.

   4. Click Show Unrecognizable to view images the system could not identify as a face or match to a face in a cluster.
4. Select an image or image cluster. The image pane displays the time the face was detected, the camera that captured the image, and the number of images in the video.
   1. Click the image to watch a video of the event.
   2. Click the Images tab to view the images in the video.
   3. (Optional) Click Evict Event from Face Cluster to delete the image.
5. Link a face to a profile.

   Similar Faces	Links the image with a known face. Click an image in the profile pane to open the Merge Clusters window, and then click OK. The selected images is added to Known Faces.
   Link to UEBA	Links the image to a user with a FortiGate endpoint. Select a user name from the dropdown, and then click Link User.
   Link to Non-UEBA Staff	Links the image to a user who does not connect to the internet, such as a site employee. To create a new profile, enter the profile name, and click Save. To merge the face with a profile, click Create New to enable Merge. Select a profile from the dropdown, and then click Save.
   Link to Guest	Links the image to a person a site visitor, such as salesperson. To create a new profile, enter the profile name, and click Save. To merge the face with a profile, click Create Now to enable Merge, then select a profile from the dropdown, and click Save.

6. Click the close icon at the right side of the pane.

An image assigned to a profile will replace an existing user avatar in Log View.

To view face recognition logs in the GUI:

1. Go to Log View > FortiAnalyzer> Event.
2. In the User column, select an entry. Face recognition logs will display the image assigned to the user.

   There are three types of AI logs:

   LOG_EVENT_AID_STATUS

   LOG_EVENT_AID_CONFIG

   LOG_EVENT_AID_UI