{"id":97707,"date":"2020-10-21T02:42:34","date_gmt":"2020-10-21T00:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/4-fortianalyzer-getting-started-v6-4-rabota-s-otchetami"},"modified":"2020-10-21T02:42:34","modified_gmt":"2020-10-21T00:42:34","slug":"4-fortianalyzer-getting-started-v6-4-rabota-s-otchetami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/4-fortianalyzer-getting-started-v6-4-rabota-s-otchetami","title":{"rendered":"4. FortiAnalyzer \u00davod v6.4. Pr\u00e1ce s reporty","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"4.
\n
\nV\u00edt\u00e1m v\u00e1s, p\u0159\u00e1tel\u00e9! Na minul\u00e9m kurzu<\/a><\/noindex> jsme se sezn\u00e1mili se z\u00e1klady pr\u00e1ce s protokoly na FortiAnalyzer. Dnes se posuneme d\u00e1l a prozkoum\u00e1me hlavn\u00ed aspekty pr\u00e1ce s reporty: co reporty obn\u00e1\u0161ej\u00ed, jak\u00e9 maj\u00ed slo\u017een\u00ed, jak\u00fdm zp\u016fsobem je mo\u017en\u00e9 upravovat st\u00e1vaj\u00edc\u00ed a vytv\u00e1\u0159et nov\u00e9 reporty. Jak je obvykl\u00e9, nejprve trochu teorie, a pot\u00e9 se pust\u00edme do pr\u00e1ce s reporty v praxi. Pod t\u00edmto textem naleznete teoretickou \u010d\u00e1st lekce a tak\u00e9 video, kter\u00e9 zahrnuje jak teorii, tak praxi. <\/a><\/noindex><\/p>\n

Hlavn\u00edm c\u00edlem report\u016f je spojit velk\u00e9 objemy dat obsa\u017een\u00fdch v protokolech a na z\u00e1klad\u011b dostupn\u00fdch nastaven\u00ed prezentovat v\u0161echny z\u00edskan\u00e9 informace v \u010diteln\u00e9 podob\u011b: ve form\u011b graf\u016f, tabulek, diagram\u016f. Na obr\u00e1zku n\u00ed\u017ee je uveden seznam p\u0159ednastaven\u00fdch report\u016f pro za\u0159\u00edzen\u00ed FortiGate (nen\u00ed v n\u011bm zahrnuto v\u0161echno, ale mysl\u00edm, \u017ee u\u017e z tohoto seznamu je patrn\u00e9, \u017ee i 'z krabice' lze sestavit \u0159adu zaj\u00edmav\u00fdch a u\u017eite\u010dn\u00fdch report\u016f). <\/p>\n

\"4.
\n
\nReporty pouze prezentuj\u00ed po\u017eadovan\u00e9 informace v \u010diteln\u00e9 podob\u011b \u2014 neobsahuj\u00ed \u017e\u00e1dn\u00e1 doporu\u010den\u00ed pro dal\u0161\u00ed kroky p\u0159i \u0159e\u0161en\u00ed nalezen\u00fdch probl\u00e9m\u016f. <\/p>\n

Hlavn\u00edmi slo\u017ekami report\u016f jsou grafy. Ka\u017ed\u00fd report se skl\u00e1d\u00e1 z jednoho nebo n\u011bkolika graf\u016f. Grafy ur\u010duj\u00ed, jak\u00e9 informace je t\u0159eba extrahovat z protokol\u016f a v jak\u00e9m form\u00e1tu je prezentovat. Za extrakci informac\u00ed odpov\u00eddaj\u00ed datov\u00e9 sady \u2014 SELECT dotazy do datab\u00e1ze. Pr\u00e1v\u011b v datov\u00fdch sad\u00e1ch je p\u0159esn\u011b ur\u010deno, odkud a jak\u00e9 informace je t\u0159eba extrahovat. Po vygenerov\u00e1n\u00ed po\u017eadovan\u00fdch dat dotazem se aplikuj\u00ed form\u00e1tovac\u00ed (nebo zobrazen\u00ed) nastaven\u00ed. V d\u016fsledku toho jsou z\u00edskan\u00e1 data uspo\u0159\u00e1d\u00e1na do tabulek, graf\u016f nebo r\u016fzn\u00fdch typ\u016f diagram\u016f. <\/p>\n

V SELECT dotazu se pou\u017e\u00edvaj\u00ed r\u016fzn\u00e9 p\u0159\u00edkazy, jimi\u017e se specifikuj\u00ed podm\u00ednky pro extrahovan\u00e9 informace. Nejz\u00e1sadn\u011bj\u0161\u00ed, co je t\u0159eba m\u00edt na pam\u011bti \u2014 tyto p\u0159\u00edkazy mus\u00ed b\u00fdt aplikov\u00e1ny v ur\u010dit\u00e9m po\u0159ad\u00ed, p\u0159esn\u011b tak, jak jsou uvedeny d\u00e1le:
\nFROM \u2014 jedin\u00fd p\u0159\u00edkaz, kter\u00fd je v SELECT dotazu povinn\u00fd. Ukazuje na typ protokol\u016f, ze kter\u00fdch je t\u0159eba extrahovat informace;
\nWHERE \u2014 pomoc\u00ed tohoto p\u0159\u00edkazu se stanovuj\u00ed podm\u00ednky pro protokoly (nap\u0159\u00edklad konkr\u00e9tn\u00ed n\u00e1zev aplikace\/\u00fatoku\/viru);
\nGROUP BY \u2014 tento p\u0159\u00edkaz umo\u017e\u0148uje seskupit informace podle jednoho nebo n\u011bkolika vybran\u00fdch sloupc\u016f;
\nORDER BY \u2014 pomoc\u00ed tohoto p\u0159\u00edkazu lze uspo\u0159\u00e1dat v\u00fdstup informac\u00ed podle \u0159\u00e1dk\u016f;
\nLIMIT \u2014 omezuje po\u010det z\u00e1znam\u016f vr\u00e1cen\u00fdch dotazem. <\/p>\n

FortiAnalyzer obsahuje p\u0159ednastaven\u00e9 \u0161ablony pro reporty. \u0160ablony p\u0159edstavuj\u00ed jak\u00fdsi n\u00e1vrh reportu \u2014 obsahuj\u00ed text reportu, jeho grafy a makra. Pomoc\u00ed \u0161ablon je mo\u017en\u00e9 vytv\u00e1\u0159et nov\u00e9 reporty, pokud v p\u0159ednastaven\u00fdch \u0161ablon\u00e1ch pot\u0159ebujete minim\u00e1ln\u00ed \u00fapravy. Nicm\u00e9n\u011b p\u0159ednastaven\u00e9 reporty nen\u00ed mo\u017en\u00e9 upravovat ani mazat \u2014 lze je pouze zkop\u00edrovat a prov\u00e1d\u011bt pot\u0159ebn\u00e9 \u00fapravy na kopii. Tak\u00e9 existuje mo\u017enost vytv\u00e1\u0159et vlastn\u00ed \u0161ablony pro reporty. <\/p>\n

\"4.
\n
\nN\u011bkdy se m\u016f\u017eete setkat s n\u00e1sleduj\u00edc\u00ed situac\u00ed: p\u0159ednastaven\u00fd report odpov\u00edd\u00e1 \u00fakolu, ale ne zcela. Mo\u017en\u00e1 je t\u0159eba do n\u011bj p\u0159idat n\u011bjak\u00e9 informace, nebo naopak \u2014 odstranit. V takov\u00e9m p\u0159\u00edpad\u011b existuj\u00ed dv\u011b varianty: zkop\u00edrovat a upravit \u0161ablonu, nebo samotn\u00fd report. Je t\u0159eba se op\u00edrat o n\u011bkolik faktor\u016f.<\/p>\n

\u0160ablony jsou n\u00e1vrhem pro report, obsahuj\u00ed grafy a text reportu, nic v\u00edc. Samotn\u00e9 reporty, na druh\u00e9 stran\u011b, krom\u011b jak\u00e9hosi \"n\u00e1vrhu\" obsahuj\u00ed r\u016fzn\u00e9 parametry reportu: jazyk, p\u00edsmo, barvu textu, obdob\u00ed generov\u00e1n\u00ed, filtrov\u00e1n\u00ed informac\u00ed a tak d\u00e1le. Proto, pokud je t\u0159eba prov\u00e9st zm\u011bny pouze v n\u00e1vrhu reportu, lze pou\u017e\u00edt \u0161ablony. Pokud je nutn\u00e1 dal\u0161\u00ed konfigurace reportu, m\u016f\u017eete upravit samotn\u00fd report (p\u0159esn\u011bji jeho kopii). <\/p>\n

Na z\u00e1klad\u011b \u0161ablon lze vytv\u00e1\u0159et n\u011bkolik podobn\u00fdch report\u016f, proto pokud m\u00e1te p\u0159ed sebou mnoh\u00e9 podobn\u00e9 reporty, je lep\u0161\u00ed pou\u017e\u00edt \u0161ablony.
\nPokud v\u00e1m p\u0159ednastaven\u00e9 \u0161ablony a reporty nevyhovuj\u00ed, m\u016f\u017eete vytvo\u0159it jak novou \u0161ablonu, tak nov\u00fd report. <\/p>\n

\"4.
\n
\nNa FortiAnalyzer je tak\u00e9 mo\u017enost nastavit p\u0159esm\u011brov\u00e1n\u00ed report\u016f jednotliv\u00fdm spr\u00e1vc\u016fm na e-mail nebo jejich export na extern\u00ed servery. To se prov\u00e1d\u00ed pomoc\u00ed mechanismu Output Profile. V ka\u017ed\u00e9 administrativn\u00ed dom\u00e9n\u011b se nastavuj\u00ed jednotliv\u00e9 Output Profiles. P\u0159i konfiguraci Output Profile se ur\u010duj\u00ed n\u00e1sleduj\u00edc\u00ed parametry:<\/p>\n