Important Interfaces

This setting allows you to always get interface utilization reports on a set of important network interfaces across all device types.

1. Create a list of all Important interfaces.
2. Go to ADMIN > Settings > Monitoring > Important Interfaces tab.
3. Click Enable.
   This will stop monitoring all interfaces.
4. Click the icon left to search field to select either Show Device Table or Show Interface only.
5. Click Select to add the selected interface to the list. The Critical and Monitor columns will be automatically checked.
6. Check the WAN box if applicable. If checked, the interface utilization events will have the isWAN = "yes" attribute.
   You can use this to run a report for all WAN interfaces.
7. Select the interfaces from the table and click Apply.
   FortiSIEM will start monitoring only the selected interfaces in this tab.
8. If you want to disable this and return to ALL process monitoring, click Disable.

By default, this feature is disabled regardless of whether it is upgraded or newly installed. If this feature is disabled, FortiSIEM monitors all interface util and up/down events. The isHostIntfCritical attribute will be set to false for all interfaces. Only non-critical interface staying down rule may trigger. Critical interface staying down rule will have no chance to trigger. If this feature is enabled, there are two check boxes - monitor and critical. If critical is checked, monitor will be checked automatically. Monitor controls whether we must generate interface util event. We monitor interface utils events for interface whose monitor check box is selected. Critical controls whether we must generate interface up/down events. FortiSIEM monitors interface up/down events for an interface whose critical check box is selected. If one interface is marked as critical, we set the attribute of isHostIntfCritical to true in the generated interface util and up/down events. The Rule "critical interface staying down" will trigger on interfaces whose isHostIntfCritical is true. Non-critical interface staying down rule will have no chance to trigger.