{"id":97707,"date":"2020-10-21T02:42:34","date_gmt":"2020-10-21T00:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/4-fortianalyzer-getting-started-v6-4-rabota-s-otchetami"},"modified":"2020-10-21T02:42:34","modified_gmt":"2020-10-21T00:42:34","slug":"4-fortianalyzer-getting-started-v6-4-rabota-s-otchetami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/4-fortianalyzer-getting-started-v6-4-rabota-s-otchetami","title":{"rendered":"4. FortiAnalyzer Getting Started v6.4. Working with Reports","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"4.
\n
\nHello, friends! In the previous lesson<\/a><\/noindex> we explored the basics of working with logs on FortiAnalyzer. Today we will go further and look at the key aspects of working with reports: what reports are, what they consist of, and how to edit existing reports and create new ones. As usual, we'll start with a bit of theory, followed by practical work with reports. Below is the theoretical part of the lesson, as well as a video tutorial that includes both theory and practice. <\/a><\/noindex><\/p>\n

The main purpose of reports is to consolidate large amounts of data contained in logs and present all the gathered information in a readable format: through graphs, tables, and charts. The picture below shows a list of pre-installed reports for FortiGate devices (not all reports are included, but I think it's already clear from this list that even 'out of the box' many interesting and useful reports can be generated). <\/p>\n

\"4.
\n
\nHowever, reports only present the requested information in a readable format \u2014 they do not contain any recommendations for further action regarding identified issues. <\/p>\n

The main components of reports are charts. Each report consists of one or more charts. Charts determine what information needs to be extracted from the logs and in what format it should be presented. Datasets are responsible for extracting the information \u2014 SELECT queries to the database. It is in the datasets that it is precisely defined from where and what information needs to be extracted. Once the necessary data appears as a result of the query, formatting (or display) settings are applied to it. As a result, the obtained data is formatted into tables, graphs, or different types of charts. <\/p>\n

The SELECT query uses various commands that specify conditions for the information being extracted. The most important thing to keep in mind is that these commands must be applied in a specific order, and they are presented in that order below:
\nFROM \u2014 the only command that is mandatory in a SELECT query. It specifies the type of logs from which information needs to be extracted;
\nWHERE \u2014 this command sets conditions on the logs (for example, a specific application\/attack\/virus name);
\nGROUP BY \u2014 this command allows you to group information by one or more specified columns;
\nORDER BY \u2014 this command can be used to sort the output information by rows;
\nLIMIT \u2014 Limits the number of records returned by the query. <\/p>\n

FortiAnalyzer includes predefined templates for reports. The templates serve as what is known as a report layout \u2014 they contain the report text, its charts, and macros. With these templates, new reports can be created if minimal changes are required in the predefined ones. However, the predefined reports cannot be edited or deleted \u2014 they can be cloned, and necessary changes can be made to the copy. There is also the option to create custom report templates. <\/p>\n

\"4.
\n
\nSometimes you may encounter the following situation: a predefined report fits the task but not completely. You might need to add some information or, conversely, remove it. In this case, there are two options: clone and modify the template or the report itself. Here, several factors should be considered.<\/p>\n

Templates serve as a layout for the report, containing charts and the report text, no more than that. The reports themselves, in turn, besides the so-called 'layout,' include various report parameters: language, font, text color, generation period, data filtering, and so on. Therefore, if changes are needed only in the report layout, templates can be used. If additional report configuration is necessary, the report itself (or rather, its copy) can be edited. <\/p>\n

Based on templates, multiple similar reports can be created, so if many similar reports need to be made, it is preferable to use templates.
\nIf the predefined templates and reports do not suit you, it is possible to create either a new template or a new report. <\/p>\n

\"4.
\n
\nFortiAnalyzer also offers the ability to set up report forwarding to individual administrators via email or to upload them to external servers. This is done using the Output Profile mechanism. Separate Output Profiles are configured in each administrative domain. The following parameters are defined when configuring the Output Profile:<\/p>\n