Administration Guide

Setting up FortiAnalyzer
- Connecting to the GUI
  - FortiAnalyzer Setup wizard
  - Activating VM licenses
- Security considerations
- GUI overview
- Target audience and access level
- Initial setup
- FortiManager features
- Next steps
- Restarting and shutting down
FortiAnalyzer Key Concepts
- Operation modes
- Administrative domains
- Logs
- Log storage
- FortiView dashboard
Device Manager
- ADOMs
- FortiClient EMS devices
- Unauthorized devices
- Using FortiManager to manage FortiAnalyzer devices
- Adding devices
- Managing devices
- Device groups
  - Adding device groups
  - Managing device groups
FortiView
- FortiView
- Monitor
- Enabling and disabling FortiView
Log View and Log Quota Management
- Types of logs collected for each device
- Log messages
- Log groups
- Log browse
- Log and file storage
Fabric View
- Fabric Connectors
- Subnets
- Identity Center
  - Identity Center dashboard
- Asset Center
  - Asset Center dashboard
- Configuring endpoint and end user data sources
Fortinet Security Fabric
- Adding a Security Fabric group
- Displaying Security Fabric topology
- Security Fabric traffic log to UTM log correlation
- Security Fabric ADOMs
- Enabling SAML authentication in a Security Fabric
Incident and Event Management
- Event handlers
- Events
- Incidents
FortiSoC
- Viewing FortiSoC dashboards
- Configuring playbook automation
- Threat Hunting
- Outbreak Alerts
Reports
- How ADOMs affect reports
- Predefined reports, templates, charts, and macros
- Logs used for reports
- How charts and macros extract data from logs
- How auto-cache works
- Generating reports
- Creating reports
- Managing reports
  - Organizing reports into folders
  - Importing and exporting reports
- Report template library
- Chart library
  - Creating charts
  - Managing charts
- Macro library
  - Creating macros
  - Managing macros
- Datasets
- Output profiles
  - Creating output profiles
  - Managing output profiles
- Report languages
  - Exporting and modifying a language
  - Importing a language
- Report calendar
  - Viewing all scheduled reports
  - Managing report schedules
FortiRecorder
- Configuring cameras in the Camera Manager
- Face Recognition
- Watching live and recorded video in the Monitor
- Enabling and disabling FortiRecorder
System Settings
- Dashboard
- Logging Topology
- Network
- RAID Management
- Administrative Domains (ADOMs)
- Certificates
- Log Forwarding
- Fetcher Management
- Event Log
  - Event log filtering
- Task Monitor
- SNMP
- Mail Server
- Syslog Server
  - Send local logs to syslog server
- Meta Fields
- Device logs
- File Management
- Advanced Settings
- FortiGuard
  - Subscribing FortiAnalyzer to FortiGuard
  - Licensing in an air-gap environment
- Restart, shut down, or reset FortiAnalyzer
Administrators
- Trusted hosts
- Monitoring administrators
- Disconnecting administrators
- Managing administrator accounts
- Administrator profiles
- Authentication
- Global administration settings
- Two-factor authentication
  - Two-factor authentication with FortiAuthenticator
    - Configuring FortiAuthenticator
    - Configuring FortiAnalyzer
  - Two-factor authentication with FortiToken Cloud
High Availability
- Configuring HA options
  - Log synchronization
  - Configuration synchronization
- Monitoring HA status
  - If the primary unit fails
- Load balancing
- Upgrading the FortiAnalyzer firmware for an operating cluster
Collectors and Analyzers
- Configuring the Collector
- Configuring the Analyzer
- Fetching logs from the Collector to the Analyzer
Management Extensions
- FortiSIEM MEA
- FortiSOAR MEA
- Enabling management extension applications
  - CLI for management extensions
- Accessing management extension logs
- Checking for new versions and upgrading
Appendix A - Supported RFC Notes
Appendix B - Log Integrity and Secure Log Transfer
- Maximum TLS/SSL version compatibility
Appendix C - FortiAnalyzer Ansible Collection documentation
Change Log

Home FortiAnalyzer 7.2.2 Administration Guide

7.2.2

FortiView Monitor dashboards

FortiView > Monitor includes predefined dashboards.

Both predefined and custom dashboards can be modified with widgets, including: Threats, Compromised Hosts, Traffic, Applications & Websites, VPN, WiFi, Endpoints, Local System Performance, Global Threat Research, Fabric State of Security, FortiClient Software Inventory, and FortiFirewall widgets (Traffic and VPN).

For example, the default Threat Monitor dashboard includes four widgets: Threat Map, Top Threat Destinations, Top Threats, and Top Virus Incidents Over Time. These widgets can be removed, enlarged, reduced, or customized, and new widgets can be added to the dashboard.

For more information, see Customizing a Monitor dashboard.

FortiView Monitors includes the following predefined dashboards:

Threats	Monitor the top security threats to your network.
Traffic	Monitor the traffic on your network.
Applications & Websites	Monitor the application and website traffic on your network.
Compromised Hosts	Monitor compromised and suspicious web use in your network.
Secure SD-WAN Monitor	Monitor secure software-defined networking.
SD-WAN Summary	Monitor SD-WAN operations.
Traffic Shaping Monitor	Monitor traffic shaping information.
ZTNA	Monitor ZTNA metrics.
FortiSandbox Detections	Monitor FortiSandbox detections on your network.
FortiMail	Monitor FortiMail statistics.
Endpoints	Monitor endpoint activity on your network.
Fabric State of Security	Monitor your network's Security Fabric rating, score, and topology. This information for this dashboard is available after you create a Security Fabric group in FortiGate and add it in FortiAnalyzer. The Security Fabric can be selected in the settings options for each widget.
VPN	Monitor VPN activity on your network.
WiFi	Monitor WiFi access points and SSIDs.
FortiClient Software Inventory	Monitor the FortiClient endpoints sending logs to FortiAnalyzer.
IoT	Monitor IoT devices.
Threat (FortiClient)	Monitor threat activity from FortiClient.
Applications & Websites (FortiClient)	Monitor application and website activity from FortiClient.
Endpoints (FortiClient)	Monitor endpoint activity from FortiClient.
Traffic (FortiDDOS)	Monitor FortiDDoS detected traffic activity. This chart requires Intrusion Prevention logs to be enabled.
Traffic (FortiFirewall)	Monitors FortiFirewall traffic.
VPN (FortiFirewall)	Monitors FortiFirewall VPN usage.
Local System Performance	Monitor the local system performance of the FortiAnalyzer unit.
Global Threat Research	Monitor global threat research.
Local Threat Research	Monitor local threat research.
Archive	Includes archived monitors from previous versions.

When upgrading versions prior to FortiAnalyzer 6.2.0, custom dashboards will not be migrated and must be recreated.