FCP-FAZ-AN-7-6: Fortinet NSE 5 - FortiAnalyzer 7.6 AnalystDemo

The sqlplugind status reports the state of the SQL log-processing plugin, including database log insertion status. Fortinet documents diagnose sql status sqlplugind as displaying the sqlplugind status; SQL process listing and hcache diagnostics use separate commands.

FortiView provides consolidated threat monitoring with time-based filtering and organized threat summaries. Filtered FortiView summaries and drilldowns can be exported to PDF.

FortiAnalyzer identifies compromised hosts by evaluating FortiGate web-filter logs against its FortiGuard-synchronized threat database. Therefore, FortiGate web filtering must be enabled with logs sent to FortiAnalyzer, and FortiAnalyzer must subscribe to FortiGuard to keep its local threat database current.

FortiView displays Analytics logs, whose retention is controlled by the ADOM data policy. A security event can therefore be absent from FortiView after it has been purged from Analytics while still existing in archived log files. Log Browse can inspect both the current active log file and compressed log files, allowing confirmation of whether the event was received and retained outside the Analytics dataset.

A custom view saves the Log View filter settings, device selection, and time period, allowing the same search configuration to be reused.

An enabled playbook configured with the On-Demand trigger can be manually executed from an incident’s Analysis page. Fortinet documents this as an incident-management action available while investigating the incident.

FortiAnalyzer Chart Builder creates a custom chart from Log View data and the active search/filter context, while constructing the underlying query/dataset used by that chart. The saved chart can subsequently be inserted into a report.

FortiAnalyzer uses $log as the placeholder for the selected dataset log type. Filtering the catdesc field for Gambling limits the rows to the gambling web category, while selecting srcip, dstip, and url with the SourceIP and DestIP aliases produces the required columns. The ::ffff: representation is an IPv4-mapped IPv6 value, but the required output aliases remain SourceIP and DestIP.

FortiAnalyzer incident settings support notifications for incident creation, updates, and deletion through selected Fabric Connectors. Additional connectors can be added and configured, allowing notifications to be sent to multiple external platforms.

FortiAnalyzer output profiles define the email recipients for generated reports and are assigned to reports. SMTP mail-server configuration enables delivery, but the output profile determines that a generated report is emailed and where it is sent.

When raw logs do not match any log parser, FortiAnalyzer automatically assigns the Generic SYSLOG parser to the device.

Exporting a report includes its configuration, charts, datasets, images, and report settings, so its associated charts and datasets are imported with it. The target ADOM must support the device type used by the report’s charts and datasets; an import to an incompatible ADOM is rejected. Report conflicts are handled through configured conflict actions rather than automatic date-and-time renaming, and reports can be imported directly without conversion to templates.

FortiAI in FortiAnalyzer supports threat hunting and can interpret security events to identify potential impacts and provide remediation recommendations. SD-WAN-overlay and site-to-site VPN configuration are FortiManager FortiAI workflows rather than FortiAnalyzer functions.

Beginning with FortiAnalyzer 7.6.0, on-premises FortiAnalyzer stores logs in a ClickHouse SQL database rather than a PostgreSQL database.

FortiAnalyzer can directly transfer report definitions and charts between compatible ADOMs. Exported reports include their chart and dataset dependencies, while a chart export can include its required dataset; templates and datasets are not independently exported through this function.

An Unhandled event status means the security event risk has not been mitigated or contained and is considered open. A risk source is isolated only when the status is Contained.

FortiAnalyzer notification profiles can send event-generated alerts through Fabric connectors and as SNMP traps to an SNMP community or user. SMS and FortiGuard-server alerts are not supported notification-profile destinations.

FortiAnalyzer includes a default debugging playbook that can be run to investigate playbook errors. Playbook Monitor provides task-level status and raw logs for troubleshooting. A playbook is marked Failed when one or more tasks fail, while other tasks or actions may still have completed successfully.

With Match Any Condition, an event qualifies when it meets at least one filter: Severity = High, Event Type = Web Filter, or Tag = Malware. One Web Filter event, one High-severity IPS event, and two events with the Malware tag meet those criteria, so four events are attached to the incident.

A report template supplies the report layout and content, such as charts and macros. Advanced report configuration is available on an individual report’s Settings tab, including its Advanced Settings section.