{"id":96716,"date":"2020-10-14T07:42:21","date_gmt":"2020-10-14T05:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/3-fortianalyzer-getting-started-v6-4-rabota-s-logami"},"modified":"2020-10-14T07:42:21","modified_gmt":"2020-10-14T05:42:21","slug":"3-fortianalyzer-getting-started-v6-4-rabota-s-logami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/3-fortianalyzer-getting-started-v6-4-rabota-s-logami","title":{"rendered":"3. FortiAnalyzer Getting Started v6.4. Puna me log-et","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"3.
\n
\nMir\u00eb se vini n\u00eb m\u00ebsimin e tret\u00eb t\u00eb kursit FortiAnalyzer Getting Started<\/a><\/noindex>. N\u00eb m\u00ebsimin e kaluar<\/a><\/noindex> Kemi vendosur mjedisin e nevojsh\u00ebm p\u00ebr kryerjen e pun\u00ebve laboratorike. N\u00eb k\u00ebt\u00eb m\u00ebsim do t\u00eb shqyrtojm\u00eb parimet baz\u00eb t\u00eb pun\u00ebs me log-et n\u00eb FortiAnalyzer<\/a><\/noindex>, do t\u00eb njihemi me p\u00ebrpunuesit e ngjarjeve, si edhe do t\u00eb shohim mekanizmat e mbrojtjes s\u00eb log-eve. Pjesa teorike, si edhe regjistrimi i plot\u00eb i video-m\u00ebsimit, gjenden m\u00eb posht\u00eb. <\/a><\/noindex><\/p>\n

P\u00ebr t\u00eb mbledhur log-e nga pajisjet, ato duhet t\u00eb regjistrohen n\u00eb FortiAnalyzer. Ekzistojn\u00eb dy m\u00ebnyra regjistrimi.<\/p>\n

    \n
  1. M\u00ebnyra e par\u00eb: n\u00eb pajisjen q\u00eb po regjistrohet aktivizohet opsioni \u00abd\u00ebrgo log-et n\u00eb FortiAnalyzer\u00bb dhe specifikohet adresa e tij IP. Pas k\u00ebsaj, n\u00eb FortiAnalyzer d\u00ebrgohet nj\u00eb k\u00ebrkes\u00eb p\u00ebr regjistrimin e k\u00ebsaj pajisjeje. Administratori duhet ta konfirmoj\u00eb ose ta refuzoj\u00eb k\u00ebrkes\u00ebn e marr\u00eb. N\u00ebse teknologjia e domeneve administrative \u00ebsht\u00eb e aktivizuar, FortiGate mund t\u00eb shtohet si n\u00eb ADOM kryesor (i quajtur root, me t\u00eb cilin kemi punuar n\u00eb m\u00ebsimin e kaluar), ashtu edhe n\u00eb nj\u00eb ADOM t\u00eb krijuar posa\u00e7\u00ebrisht, i destinuar p\u00ebr pajisjet FortiGate. <\/li>\n
  2. M\u00ebnyra e dyt\u00eb \u00ebsht\u00eb i ashtuquajturi Device Registration Wizard. Regjistrimi i pajisjes kryhet drejtp\u00ebrdrejt n\u00eb vet\u00eb FortiAnalyzer. P\u00ebr regjistrim nevojiten t\u00eb dh\u00ebnat e pajisjes q\u00eb po regjistrohet: numri serial, adresa IP, lloji i pajisjes dhe versioni i sistemit operativ. N\u00ebse verifikimi i t\u00eb dh\u00ebnave p\u00ebrfundon me sukses, pajisja shtohet n\u00eb list\u00ebn e FortiAnalyzer. N\u00ebse teknologjia e domeneve administrative \u00ebsht\u00eb e aktivizuar, pajisja do t\u00eb regjistrohet automatikisht n\u00eb domenin administrativ p\u00ebrkat\u00ebs. N\u00ebse keni krijuar disa domene t\u00eb tilla administrative, at\u00ebher\u00eb duhet ta regjistroni pajisjen nga ai domen administrativ n\u00eb t\u00eb cilin d\u00ebshironi ta shtoni. <\/li>\n<\/ol>\n

    \n\u00c7do pajisje gjeneron log-e t\u00eb llojeve t\u00eb ndryshme. Llojet kryesore t\u00eb log-eve q\u00eb mund t\u00eb gjenerojn\u00eb pajisjet e kompanis\u00eb Fortinet paraqiten n\u00eb figur\u00ebn m\u00eb posht\u00eb. <\/p>\n

    \"3.
    \n
    \nP\u00ebr p\u00ebrpunimin fillestar t\u00eb logeve kemi folur tashm\u00eb n\u00eb m\u00ebsimin e kaluar, por mendoj se ia vlen ta rifreskojm\u00eb kujtes\u00ebn. Loget q\u00eb mb\u00ebrrijn\u00eb n\u00eb FortiAnalyzer kompresohen dhe ruhen n\u00eb nj\u00eb skedar log. Kur ky skedar arrin nj\u00eb madh\u00ebsi t\u00eb caktuar, ai mbishkruhet dhe arkivohet. K\u00ebto loge quhen loge t\u00eb arkivuara. Ato konsiderohen loge offline, pasi nuk mund t\u00eb analizohen n\u00eb koh\u00eb reale. P\u00ebr shikim, ato jan\u00eb t\u00eb disponueshme vet\u00ebm n\u00eb formatin RAW. Politika e ruajtjes s\u00eb t\u00eb dh\u00ebnave n\u00eb domenin administrativ p\u00ebrcakton sa koh\u00eb k\u00ebto loge do t\u00eb ruhen n\u00eb memorien e FortiAnalyzer. <\/p>\n

    N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, loget indeksohen n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave SQL p\u00ebr t\u00eb mb\u00ebshtetur analitik\u00ebn. K\u00ebto loge analizohen n\u00eb FortiAnalyzer n\u00eb koh\u00eb reale me an\u00eb t\u00eb mekanizmave Log View, FortiView dhe Reports. Politika e ruajtjes s\u00eb t\u00eb dh\u00ebnave n\u00eb domenin administrativ p\u00ebrcakton sa koh\u00eb k\u00ebto loge do t\u00eb ruhen n\u00eb memorien e FortiAnalyzer. Pasi k\u00ebto loge t\u00eb fshihen nga memoria e FortiAnalyzer, ato mund t\u00eb mbeten si loge t\u00eb arkivuara, por kjo varet nga politika e ruajtjes s\u00eb t\u00eb dh\u00ebnave n\u00eb domenin administrativ. <\/p>\n

    Skematikisht, procesi i p\u00ebrpunimit t\u00eb logeve paraqitet n\u00eb figur\u00ebn m\u00eb posht\u00eb. <\/p>\n

    \"3.
    \n
    \nKur loget mb\u00ebrrijn\u00eb n\u00eb pajisje, ato kontrollohen nga p\u00ebrpunuesit e ngjarjeve. K\u00ebta b\u00ebjn\u00eb t\u00eb mundur gjurmimin e ngjarjeve me interes p\u00ebrmes kushteve t\u00eb parakonfiguruara. Kushtet zbatohen mbi parametrat q\u00eb p\u00ebrmbahen n\u00eb loget n\u00eb formatin RAW. N\u00eb sistem, p\u00ebr \u00e7do domen administrativ ekziston nj\u00eb grup ngjarjesh t\u00eb paracaktuara, por sipas nevoj\u00ebs mund t\u00eb krijohen edhe p\u00ebrpunues t\u00eb personalizuar t\u00eb ngjarjeve. P\u00ebrfitimi kryesor i p\u00ebrpunuesve t\u00eb ngjarjeve \u00ebsht\u00eb se, kur ndodhin ngjarje me interes, sistemi mund t\u00eb d\u00ebrgoj\u00eb njoftime me email ose te server\u00ebt syslog, si edhe p\u00ebrmes SNMP. Kjo b\u00ebn t\u00eb mundur reagimin mjaft t\u00eb shpejt\u00eb ndaj ngjarjeve q\u00eb ndodhin n\u00eb rrjet. <\/p>\n

    \"3.
    \n
    \nTani le t\u00eb flasim p\u00ebr mbrojtjen e logeve. Meqen\u00ebse loget ruajn\u00eb informacion t\u00eb r\u00ebnd\u00ebsish\u00ebm p\u00ebr at\u00eb q\u00eb ndodh n\u00eb rrjet, ato duhet t\u00eb mbrohen si nga humbja e mundshme si pasoj\u00eb e d\u00ebshtimeve t\u00eb ndryshme, ashtu edhe nga komprometimi i jasht\u00ebm. Teknologjia e par\u00eb q\u00eb ndihmon n\u00eb mbrojtjen e logeve n\u00eb rast d\u00ebshtimesh t\u00eb ndryshme \u00ebsht\u00eb RAID. Ajo b\u00ebn t\u00eb mundur ndarjen e hap\u00ebsir\u00ebs s\u00eb disqeve t\u00eb disponueshme n\u00eb disa segmente logjike, n\u00eb m\u00ebnyr\u00eb q\u00eb n\u00eb rast se nj\u00eb ose disa disqe dalin jasht\u00eb funksionit (n\u00eb var\u00ebsi t\u00eb llojit t\u00eb RAID), t\u00eb dh\u00ebnat t\u00eb mos humbasin. Llojet kryesore t\u00eb RAID q\u00eb mund t\u00eb p\u00ebrdoren n\u00eb FortiAnalyzer paraqiten n\u00eb figur\u00ebn m\u00eb posht\u00eb.<\/p>\n

    \"3.
    \n<\/p>\n