{"id":96716,"date":"2020-10-14T07:42:21","date_gmt":"2020-10-14T05:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/3-fortianalyzer-getting-started-v6-4-rabota-s-logami"},"modified":"2020-10-14T07:42:21","modified_gmt":"2020-10-14T05:42:21","slug":"3-fortianalyzer-getting-started-v6-4-rabota-s-logami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/3-fortianalyzer-getting-started-v6-4-rabota-s-logami","title":{"rendered":"3. FortiAnalyzer Fillimi v6.4. Punimi me log-et","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"3.
\n
\nMir\u00eb se erdh\u00ebt n\u00eb m\u00ebsimin e tret\u00eb t\u00eb kursit FortiAnalyzer Fillim<\/a><\/noindex>. N\u00eb m\u00ebsimi i kaluar<\/a><\/noindex> ne kemi p\u00ebrgatitur nj\u00eb skic\u00eb t\u00eb nevojshme p\u00ebr kryerjen e laborator\u00ebve. N\u00eb k\u00ebt\u00eb m\u00ebsim do t\u00eb shqyrtojm\u00eb parimet themelore t\u00eb pun\u00ebs me log-et n\u00eb FortiAnalyzer<\/a><\/noindex>, do t\u00eb njohim me p\u00ebrpunuesit e ngjarjeve, si dhe do t\u00eb shqyrtojm\u00eb mekanizmat e mbrojtjes s\u00eb log-eve. Pjesa teorike, si dhe regjistrimi i plot\u00eb i videos s\u00eb m\u00ebsimit, ndodhen n\u00ebn k\u00ebt\u00eb lidhje. <\/a><\/noindex><\/p>\n

P\u00ebr t\u00eb mbledhur log-e nga pajisjet, ato duhet t\u00eb regjistrohen n\u00eb FortiAnalyzer. Ekzistojn\u00eb dy mund\u00ebsi regjistrimi.<\/p>\n

    \n
  1. Mund\u00ebsia e par\u00eb \u2014 n\u00eb pajisjen q\u00eb regjistrohet aktivizohet opsioni \"d\u00ebrgo log-et n\u00eb FortiAnalyzer\" dhe tregohet adresa IP e tij. Pas k\u00ebsaj, nj\u00eb k\u00ebrkes\u00eb p\u00ebr regjistrimin e k\u00ebsaj pajisjeje d\u00ebrgohet n\u00eb FortiAnalyzer. Administratori duhet t\u00eb konfirmoj\u00eb ose refuzoj\u00eb k\u00ebrkes\u00ebn e marr\u00eb. N\u00ebse teknologjia e domain-ve administrativ\u00eb \u00ebsht\u00eb aktivizuar, FortiGate mund t\u00eb shtohet si n\u00eb ADOM-in kryesor (i quajtur root, me t\u00eb cilin punuam n\u00eb m\u00ebsimin e kaluar), ashtu edhe n\u00eb nj\u00eb ADOM t\u00eb krijuar vet\u00eb, i cili \u00ebsht\u00eb p\u00ebr pajisjet FortiGate. <\/li>\n
  2. M\u00ebnyra e dyt\u00eb \u00ebsht\u00eb ajo q\u00eb quhet Wizard-i i Regjistrimit t\u00eb Pajisjeve. Regjistrimi i pajisjes kryhet n\u00eb vet\u00eb FortiAnalyzer. P\u00ebr regjistrim nevojitet informacioni rreth pajisjes q\u00eb po regjistrohet \u2014 numri serial, adresa IP, lloji i pajisjes dhe versioni i sistemit operativ. N\u00ebse verifikimi i t\u00eb dh\u00ebnave kalon me sukses \u2014 pajisja shtohet n\u00eb list\u00ebn e FortiAnalyzer. N\u00ebse teknologjia e domain-it administrativ \u00ebsht\u00eb aktivizuar, pajisja do t\u00eb regjistrohet automatikisht n\u00eb domain-in administrativ p\u00ebrkat\u00ebs. N\u00ebse keni krijuar disa domain-e t\u00eb tilla administrativ\u00eb, n\u00eb k\u00ebt\u00eb rast \u00ebsht\u00eb e nevojshme t\u00eb regjistroni pajisjen nga ai domain administrativ ku d\u00ebshironi ta sillni. <\/li>\n<\/ol>\n

    \n\u00c7do pajisje gjeneron log-e t\u00eb llojeve t\u00eb ndryshme. Llojet kryesore t\u00eb log-eve q\u00eb mund t\u00eb gjenerojn\u00eb pajisjet e kompanis\u00eb Fortinet jan\u00eb paraqitur n\u00eb figur\u00ebn m\u00eb posht\u00eb. <\/p>\n

    \"3.
    \n
    \nKemi folur m\u00eb par\u00eb p\u00ebr p\u00ebrpunimin fillestar t\u00eb log\u00ebve, por mendoj se vlen t\u00eb kujtojm\u00eb. Log\u00ebt q\u00eb arrijn\u00eb n\u00eb FortiAnalyzer kompresohen dhe ruhen n\u00eb nj\u00eb skedar log. Kur ky skedar arrin nj\u00eb madh\u00ebsi t\u00eb caktuar, ai ri-shkruhet dhe arkivohet. T\u00eb till\u00ebt quhen log\u00eb t\u00eb arkivuara. ato konsiderohen log\u00eb offline, pasi nuk mund t\u00eb analizohet n\u00eb koh\u00eb reale. P\u00ebr t'u par\u00eb, ato jan\u00eb t\u00eb disponueshme vet\u00ebm n\u00eb formatin RAW. Politika e ruajtjes s\u00eb t\u00eb dh\u00ebnave n\u00eb domenin administrativ p\u00ebrcakton sa gjat\u00eb do t\u00eb ruhen k\u00ebta log\u00eb n\u00eb kujtes\u00ebn e FortiAnalyzer. <\/p>\n

    N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, log\u00ebt indeksohen n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave SQL p\u00ebr t\u00eb mb\u00ebshtetur analiz\u00ebn. K\u00ebta log\u00eb analizohen n\u00eb FortiAnalyzer n\u00eb koh\u00eb reale p\u00ebrmes mekanizmave Log View, FortiView dhe Reports. Politika e ruajtjes s\u00eb t\u00eb dh\u00ebnave n\u00eb domenin administrativ p\u00ebrcakton sa gjat\u00eb do t\u00eb ruhen k\u00ebta log\u00eb n\u00eb kujtes\u00ebn e FortiAnalyzer. Pasi k\u00ebta log\u00eb t\u00eb fshihen nga memoria e FortiAnalyzer, ata mund t\u00eb mbeten si log\u00eb t\u00eb arkivuara, por kjo varet nga politika e ruajtjes s\u00eb t\u00eb dh\u00ebnave n\u00eb domenin administrativ. <\/p>\n

    Procesi i p\u00ebrpunimit t\u00eb log\u00ebve \u00ebsht\u00eb paraqitur n\u00eb m\u00ebnyr\u00eb schematike n\u00eb figur\u00ebn m\u00eb posht\u00eb. <\/p>\n

    \"3.
    \n
    \nKur logjet mb\u00ebrrijn\u00eb n\u00eb pajisje, ato kontrollohen nga trajtuesit e ngjarjeve. K\u00ebta lejojn\u00eb ndjekjen e ngjarjeve t\u00eb r\u00ebnd\u00ebsishme p\u00ebrmes kushteve t\u00eb parap\u00ebrcaktuara. Kushtet vendosen n\u00eb parametrat q\u00eb p\u00ebrmbahen n\u00eb logjet e formatit RAW. N\u00eb sistem, p\u00ebr secil\u00ebn domene administrative ekziston nj\u00eb grup ngjarjesh t\u00eb parap\u00ebrcaktuara, megjithat\u00eb, n\u00ebse \u00ebsht\u00eb e nevojshme, mund t\u00eb krijoni trajtues t\u00eb rinj ngjarjesh. P\u00ebrdorimi kryesor i trajtuesve t\u00eb ngjarjeve \u00ebsht\u00eb se kur ndodhin ngjarje t\u00eb interesit, sistemi mund t\u00eb d\u00ebrgoj\u00eb njoftime \u2014 n\u00eb email ose n\u00eb serverat syslog, gjithashtu p\u00ebrmes SNMP. Kjo lejon reagimin mjaft t\u00eb shpejt\u00eb ndaj ngjarjeve q\u00eb ndodhin n\u00eb rrjet. <\/p>\n

    \"3.
    \n
    \nTaniy\u00eb flasim p\u00ebr mbrojtjen e log\u00ebve. Duke qen\u00eb se log\u00ebt mbajn\u00eb informacion t\u00eb r\u00ebnd\u00ebsish\u00ebm rreth asaj q\u00eb ndodh n\u00eb rrjet, ata duhet t\u00eb mbrohen si nga humbja e mundshme p\u00ebr shkak t\u00eb ndonj\u00eb d\u00ebshtimi, ashtu edhe nga komprometimi i jasht\u00ebm. Teknologjia e par\u00eb q\u00eb ndihmon p\u00ebr t\u00eb mbrojtur log\u00ebt n\u00eb rast d\u00ebshtimesh \u00ebsht\u00eb RAID. Ajo lejon ndarjen e hap\u00ebsir\u00ebs s\u00eb disqeve t\u00eb disponuesh\u00ebm n\u00eb disa segmente logjike, n\u00eb m\u00ebnyr\u00eb q\u00eb n\u00eb rast se nj\u00eb ose disa disqe d\u00ebshtojn\u00eb (n\u00eb var\u00ebsi t\u00eb tipit t\u00eb RAID-it), t\u00eb dh\u00ebnat t\u00eb mos humbasin. Tipet kryesore t\u00eb RAID-it q\u00eb mund t\u00eb p\u00ebrdoren n\u00eb FortiAnalyzer jan\u00eb paraqitur n\u00eb figur\u00ebn m\u00eb posht\u00eb.<\/p>\n

    \"3.
    \n<\/p>\n