{"id":96032,"date":"2020-10-07T01:42:06","date_gmt":"2020-10-06T23:42:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/1-fortianalyzer-getting-started-v6-4-vvedenie"},"modified":"2020-10-07T01:42:06","modified_gmt":"2020-10-06T23:42:06","slug":"1-fortianalyzer-getting-started-v6-4-vvedenie","status":"publish","type":"post","link":"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/1-fortianalyzer-getting-started-v6-4-vvedenie","title":{"rendered":"1. FortiAnalyzer Komme i Gang v6.4. Introduksjon","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"1. FortiAnalyzer Komme i Gang v6.4. Introduksjon\" src=\"\/wp-content\/uploads\/2020\/10\/3602b117969244e72fe34055ad782133.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHei, venner! Vi er glade for \u00e5 \u00f8nske dere velkommen til v\u00e5rt nye kurs, FortiAnalyzer Getting Started. I kurset <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/478498\/\">Fortinet Kom i gang<\/a><\/noindex> har vi allerede sett p\u00e5 funksjonaliteten til FortiAnalyzer, men vi har v\u00e6rt ganske overfladiske. N\u00e5 vil jeg gjerne fortelle mer detaljert om dette produktet, om dets m\u00e5l, oppgaver og muligheter. Dette kurset skal ikke bli s\u00e5 omfattende som det forrige, men jeg h\u00e5per det vil bli interessant og l\u00e6rerikt. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"kD8crmWIyaU\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/kD8crmWIyaU\/hqdefault.jpg\" alt=\"Spill video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\nEttersom leksjonen ble helt teoretisk, har vi besluttet \u00e5 presentere den ogs\u00e5 i artikkelformat for deres bekvemmelighet. <\/p>\n<p>I l\u00f8pet av dette kurset vil vi vurdere f\u00f8lgende punkter:<\/p>\n<ul>\n<li>Generell informasjon om produktet, dets form\u00e5l, oppgaver og n\u00f8kkelfunksjoner<\/li>\n<li>Vi skal lage en mal, der vi i prosessen skal se n\u00e6rmere p\u00e5 den innledende konfigurasjonen av FortiAnalyzer<\/li>\n<li>Vi vil bli kjent med mekanismen for lagring, behandling og filtrering av logger for lettere s\u00f8k, samt se p\u00e5 mekanismen FortiView, som presenterer visuell informasjon om nettverkstilstanden i form av ulike grafer, diagrammer og andre widgets<\/li>\n<li>Vi vil g\u00e5 gjennom prosessen med \u00e5 lage eksisterende rapporter, samt l\u00e6re \u00e5 opprette egne rapporter og redigere eksisterende rapporter<\/li>\n<li>Vi vil ta en gjennomgang av de viktigste sp\u00f8rsm\u00e5lene knyttet til administrasjon av FortiAnalyzer<\/li>\n<li>Vi vil diskutere lisensieringsskjemaet p\u00e5 nytt \u2014 jeg har allerede snakket om det i leksjon 11 i kurset <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/478498\/\">Fortinet Kom i gang<\/a><\/noindex>, men som sagt, repetisjon er l\u00e6ringens mor. <\/li>\n<\/ul>\n<p>\nHovedform\u00e5let med FortiAnalyzer er sentralisert lagring av logger fra ett eller flere Fortinet-enheter, samt behandling og analyse av dem. Dette gj\u00f8r det mulig for sikkerhetsadministratorer \u00e5 overv\u00e5ke ulike nettverks- og sikkerhetshendelser fra ett sted, raskt hente n\u00f8dvendig informasjon fra logger og widgets, samt lage rapporter for alle eller spesifikke enheter. <br \/>\nListen over enheter som FortiAnalyzer kan motta logger fra og analysere dem, er vist i figuren nedenfor. <\/p>\n<p><img decoding=\"async\" alt=\"1. FortiAnalyzer Komme i Gang v6.4. Introduksjon\" src=\"\/wp-content\/uploads\/2020\/10\/4eb4d0fc068a1c4380be38882602f178.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFortiAnalyzer har tre n\u00f8kkelfunksjoner \u2014 rapportering, varsling, arkivering. La oss se n\u00e6rmere p\u00e5 hver av dem. <\/p>\n<p>Rapportering \u2013 rapportene gir en visuell fremstilling av nettverksbegivenheter, sikkerhetsbegivenheter og ulike aktiviteter som skjer p\u00e5 de st\u00f8ttede enhetene. Rapporteringssystemet samler inn n\u00f8dvendige data fra eksisterende logger og presenterer dem i en lettlest og analyserbar form. Med rapportene kan man raskt f\u00e5 n\u00f8dvendig informasjon om enhetenes ytelse, nettverkssikkerhet, de mest bes\u00f8kte ressursene og s\u00e5 videre. Det finnes mange varianter. Rapportene kan ogs\u00e5 brukes til \u00e5 analysere tilstanden til nettverket og de st\u00f8ttede enhetene over en lengre periode. De er ofte uunnv\u00e6rlige i etterforskningen av ulike sikkerhetsrelaterte hendelser. <\/p>\n<p>Varsler gj\u00f8r det mulig \u00e5 raskt reagere p\u00e5 ulike trusler som skjer i nettverket. Systemet genererer varsler n\u00e5r logger dukker opp som oppfyller p\u00e5 forh\u00e5nd konfigurerte betingelser \u2013 oppdagelse av virus, utnyttelse av ulike s\u00e5rbarheter og s\u00e5 videre. Disse varslene kan ses i nettgrensesnittet til FortiAnalyzer, og man kan ogs\u00e5 sette opp sending via SNMP-protokollen, til en syslog-server, samt til bestemte e-postadresser. <\/p>\n<p>Arkivering gj\u00f8r det mulig \u00e5 lagre kopier av ulikt innhold som passerer gjennom nettverket p\u00e5 FortiAnalyzer. Dette brukes vanligvis i forbindelse med DLP-mekanismen for lagring av ulike filer som omfattes av ulike regler for denne mekanismen. Dette kan ogs\u00e5 v\u00e6re nyttig i etterforskningen av ulike sikkerhetshendelser. <\/p>\n<p>En annen interessant funksjon er muligheten for \u00e5 bruke administrative domener. Denne teknologien gj\u00f8r det mulig \u00e5 opprette grupper av enheter basert p\u00e5 ulike kriterier \u2013 enhetstype, geografisk plassering og s\u00e5 videre. M\u00e5let med \u00e5 opprette slike gruppeenheter er:<\/p>\n<ul>\n<li>Gruppering av enheter etter lignende kriterier for lettere overv\u00e5king og administrasjon \u2013 for eksempel kan enhetene v\u00e6re gruppert etter geografisk plassering. Du m\u00e5 finne en viss informasjon i loggene om enhetene som befinner seg i samme gruppe. I stedet for \u00e5 grundig filtrere loggene, ser du bare p\u00e5 loggene for det aktuelle administrative domenet og s\u00f8ker etter den n\u00f8dvendige informasjonen. <\/li>\n<li>For the separation of administrative access \u2014 each administrative domain can have one or more administrators who have access only to that specific administrative domain.<\/li>\n<li>Effective management of disk space and data retention policies from devices \u2014 instead of creating a single data storage configuration for all devices, administrative domains allow for more suitable configurations for individual groups of devices. This can be useful if you have multiple devices, with one group needing to retain data for a year, and another for three years. Accordingly, appropriate disk space can be allocated for each group \u2014 allocating more space for a group generating a large number of logs, and less for another group. <\/li>\n<\/ul>\n<p>\nFortiAnalyzer can operate in two modes \u2014 Analyzer and Collector. The operating mode is chosen based on individual requirements and network topology.<\/p>\n<p>When FortiAnalyzer operates in Analyzer mode, it acts as the primary aggregator of logs from one or more log collectors. Log collectors include both FortiAnalyzer in Collector mode and other devices supported by FortiAnalyzer (their list was presented above in the figure). This operating mode is used by default. <\/p>\n<p>When FortiAnalyzer operates in Collector mode, it gathers logs from other devices and then forwards them to another device, such as FortiAnalyzer in Analyzer mode or Syslog. In Collector mode, FortiAnalyzer cannot use most functions, such as reporting and alerts, as its main purpose is to collect and forward logs. <\/p>\n<p>Using multiple FortiAnalyzer devices in various modes can enhance performance \u2014 FortiAnalyzer in Collector mode collects logs from all devices and forwards them to Analyzer for further analysis, allowing FortiAnalyzer in Analyzer mode to conserve resources spent on receiving logs from numerous devices and fully focus on log processing.<\/p>\n<p><img decoding=\"async\" alt=\"1. FortiAnalyzer Komme i Gang v6.4. Introduksjon\" src=\"\/wp-content\/uploads\/2020\/10\/94da5924225b6f69812dca82bb64f777.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFortiAnalyzer st\u00f8tter et deklarativt SQL-sp\u00f8rringsspr\u00e5k for logging og rapportering. Med dette kan logger presenteres i lesbar form. Dette sp\u00f8rringsspr\u00e5ket brukes ogs\u00e5 til \u00e5 lage ulike rapporter. For noen rapporteringsfunksjoner kreves det spesifikke kunnskaper om SQL og databaser, men ofte lar de innebygde funksjonene i FortiAnalyzer deg klare deg uten disse kunnskapene. Vi vil komme tilbake til dette n\u00e5r vi tar for oss rapporteringsmekanismen. <\/p>\n<p>FortiAnalyzer kan tilbys i flere varianter. Det kan v\u00e6re en separat fysisk enhet, en virtuell maskin \u2014 ulike hypervisorer st\u00f8ttes, og den komplette listen finner du i <noindex><a rel=\"nofollow\" href=\"https:\/\/www.fortinet.com\/content\/dam\/fortinet\/assets\/data-sheets\/fortianalyzer.pdf\">databladet<\/a><\/noindex>. Det kan ogs\u00e5 distribueres i spesialiserte infrastrukturer \u2014 AWS, Azure, Google Cloud og andre. Den siste varianten er FortiAnalyzer Cloud \u2014 en skybasert tjeneste levert av Fortinet. <\/p>\n<p>I neste leksjon vil vi forberede et oppsett for videre praktisk arbeid. For ikke \u00e5 g\u00e5 glipp av det, abonner p\u00e5 v\u00e5r <noindex><a rel=\"nofollow\" href=\"https:\/\/www.youtube.com\/channel\/UCKOESE8nBWQPuQmi994_YMA\">YouTube-kanal<\/a><\/noindex>.<\/p>\n<p>Du kan ogs\u00e5 f\u00f8lge med p\u00e5 oppdateringer p\u00e5 f\u00f8lgende ressurser:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/fortiservice\">Gruppe Vkontakte<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/zen.yandex.ru\/id\/5c7d2162fa818600ae386a52\">Yandex Zen <\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/fortiservice.com\/\">V\u00e5r nettside<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.t.me\/tssolution\">Telegram kanal<\/a><\/noindex><br \/>\n<br \/>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/fortiservice\/blog\/520856\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u0434\u0440\u0443\u0437\u044c\u044f! \u041c\u044b \u0440\u0430\u0434\u044b \u0432\u0430\u0441 \u043f\u0440\u0438\u0432\u0435\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043d\u0430\u0448\u0435\u043c \u043d\u043e\u0432\u043e\u043c \u043a\u0443\u0440\u0441\u0435 FortiAnalyzer Getting Started. \u041d\u0430 \u043a\u0443\u0440\u0441\u0435 Fortinet Getting Started \u043c\u044b \u0443\u0436\u0435 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u043b\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b FortiAnalyzer, \u043d\u043e \u043f\u0440\u043e\u0448\u043b\u0438\u0441\u044c \u043f\u043e \u043d\u0435\u043c\u0443 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u043d\u043e. \u0421\u0435\u0439\u0447\u0430\u0441 \u044f \u0445\u043e\u0447\u0443 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043f\u0440\u043e \u044d\u0442\u043e\u0442 \u043f\u0440\u043e\u0434\u0443\u043a\u0442, \u043f\u0440\u043e \u0435\u0433\u043e \u0446\u0435\u043b\u0438, \u0437\u0430\u0434\u0430\u0447\u0438 \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438. \u0414\u0430\u043d\u043d\u044b\u0439 \u043a\u0443\u0440\u0441 \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c\u0441\u044f \u043d\u0435 \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u044a\u0435\u043c\u043d\u044b\u043c, \u043a\u0430\u043a \u043f\u0440\u043e\u0448\u043b\u044b\u0439, \u043d\u043e \u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":96033,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-96032","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u0434\u0440\u0443\u0437\u044c\u044f!\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/1-fortianalyzer-getting-started-v6-4-vvedenie\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"nn_NO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd471. FortiAnalyzer Getting Started v6.4. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u0434\u0440\u0443\u0437\u044c\u044f!\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/1-fortianalyzer-getting-started-v6-4-vvedenie\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-06T23:42:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-06T23:42:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd471. FortiAnalyzer Komme i gang v6.4. Innf\u00f8ring | ProHoster","description":"Hei, venner!","canonical_url":"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/1-fortianalyzer-getting-started-v6-4-vvedenie","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nn_NO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd471. FortiAnalyzer Getting Started v6.4. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 | ProHoster","og:description":"\u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u0434\u0440\u0443\u0437\u044c\u044f!","og:url":"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/1-fortianalyzer-getting-started-v6-4-vvedenie","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-06T23:42:06+00:00","article:modified_time":"2020-10-06T23:42:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96032","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:53:25","updated":"2022-10-01 01:58:34","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/96032","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/comments?post=96032"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/96032\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media\/96033"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media?parent=96032"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/categories?post=96032"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/tags?post=96032"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}