Document
Library

Administration Guide

Setting up FortiAnalyzer
- Connecting to the GUI
  - FortiAnalyzer Setup wizard
  - Activating VM licenses
- Security considerations
- GUI overview
- Target audience and access level
- Initial setup
- FortiManager features
- Next steps
- Restarting and shutting down
FortiAnalyzer Key Concepts
- Operation modes
- Administrative domains
- Logs
- Log storage
- FortiView dashboard
Device Manager
- ADOMs
- FortiClient EMS devices
- Unauthorized devices
- Using FortiManager to manage FortiAnalyzer devices
- Adding devices
- Managing devices
- Device groups
  - Adding device groups
  - Managing device groups
FortiView
- FortiView
- Monitor
- Enabling and disabling FortiView
Log View and Log Quota Management
- Types of logs collected for each device
- Log messages
- Log groups
- Log browse
- Log and file storage
Fabric View
- Fabric Connectors
- Subnets
- Identity Center
  - Identity Center dashboard
- Asset Center
  - Asset Center dashboard
- Configuring endpoint and end user data sources
Fortinet Security Fabric
- Adding a Security Fabric group
- Displaying Security Fabric topology
- Security Fabric traffic log to UTM log correlation
- Security Fabric ADOMs
- Enabling SAML authentication in a Security Fabric
Incident and Event Management
- Event handlers
- Events
- Incidents
FortiSoC
- Viewing FortiSoC dashboards
- Configuring playbook automation
- Threat Hunting
- Outbreak Alerts
Reports
- How ADOMs affect reports
- Predefined reports, templates, charts, and macros
- Logs used for reports
- How charts and macros extract data from logs
- How auto-cache works
- Generating reports
- Creating reports
- Managing reports
  - Organizing reports into folders
  - Importing and exporting reports
- Report template library
- Chart library
  - Creating charts
  - Managing charts
- Macro library
  - Creating macros
  - Managing macros
- Datasets
- Output profiles
  - Creating output profiles
  - Managing output profiles
- Report languages
- Report calendar
  - Viewing all scheduled reports
  - Managing report schedules
FortiRecorder
- Configuring cameras in the Camera Manager
- Face Recognition
- Watching live and recorded video in the Monitor
- Enabling and disabling FortiRecorder
System Settings
- Dashboard
- Logging Topology
- Network
- RAID Management
- Administrative Domains (ADOMs)
- Certificates
- Log Forwarding
- Fetcher Management
- Event Log
  - Event log filtering
- Task Monitor
- SNMP
- Mail Server
- Syslog Server
  - Send local logs to syslog server
- Meta Fields
- Device logs
- File Management
- Advanced Settings
- FortiGuard
  - Subscribing FortiAnalyzer to FortiGuard
  - Licensing in an air-gap environment
- Restart, shut down, or reset FortiAnalyzer
Administrators
- Trusted hosts
- Monitoring administrators
- Disconnecting administrators
- Managing administrator accounts
- Administrator profiles
- Authentication
- Global administration settings
- Two-factor authentication
  - Two-factor authentication with FortiAuthenticator
    - Configuring FortiAuthenticator
    - Configuring FortiAnalyzer
  - Two-factor authentication with FortiToken Cloud
High Availability
- Configuring HA options
  - Log synchronization
  - Configuration synchronization
- Monitoring HA status
  - If the primary unit fails
- Load balancing
- Upgrading the FortiAnalyzer firmware for an operating cluster
Collectors and Analyzers
- Configuring the Collector
- Configuring the Analyzer
- Fetching logs from the Collector to the Analyzer
Management Extensions
- FortiSIEM MEA
- FortiSOAR MEA
- Enabling management extension applications
  - CLI for management extensions
- Accessing management extension logs
- Checking for new versions and upgrading
Appendix A - Supported RFC Notes
Appendix B - Log Integrity and Secure Log Transfer
- Maximum TLS/SSL version compatibility
Appendix C - FortiAnalyzer Ansible Collection documentation
Change Log

Home FortiAnalyzer 7.2.3 Administration Guide

7.2.3

Change Log

Change Log

Date	Change Description
2023-06-08	Initial release.
2023-06-29	Updated Licensing in an air-gap environment.
2023-07-10	Updated How ADOMs affect reports.
2023-08-01	Updated Migrating the configuration.
2023-08-21	Updated FortiAnalyzer Fabric.
2023-09-05	Updated: How ADOMs affect reports Importing and exporting reports
2023-09-11	Updated Configuring HA options.
2023-09-15	Updated Indicators of Compromise.
2023-10-23	Updated Enabling and disabling the ADOM feature.
2023-11-16	Updated Device Manager.
2024-01-18	Updated Configuring HA options.
2024-02-09	Updated: Creating a custom event handler Creating a custom correlation handler
2024-03-22	Updated Appendix B - Log Integrity and Secure Log Transfer.

Previous

Next

Change Log

Date	Change Description
2023-06-08	Initial release.
2023-06-29	Updated Licensing in an air-gap environment.
2023-07-10	Updated How ADOMs affect reports.
2023-08-01	Updated Migrating the configuration.
2023-08-21	Updated FortiAnalyzer Fabric.
2023-09-05	Updated: How ADOMs affect reports Importing and exporting reports
2023-09-11	Updated Configuring HA options.
2023-09-15	Updated Indicators of Compromise.
2023-10-23	Updated Enabling and disabling the ADOM feature.
2023-11-16	Updated Device Manager.
2024-01-18	Updated Configuring HA options.
2024-02-09	Updated: Creating a custom event handler Creating a custom correlation handler
2024-03-22	Updated Appendix B - Log Integrity and Secure Log Transfer.

Previous

Next