View the activity of known users for the last seven days.
- Go to FortiRecorder > Face Recognition.
- In the tree menu, go to Face Cluster > Known Faces. All known internal and guest users are displayed.
- A blue icon indicates UEBA users.
- A green icon indicates non-UEBA users.
- A red icon indicates guests.
- (Optional) In the Search field, enter a username to find a specific user. You can also search by UEBA, Non-UEBA, and Guest.
- Click an image to open the user information pane.
The left side of the pane displays user details such as Related Endpoint, Topology, Addresses, and Operating System. Click a link to view drilldown information in Identity Center or Assets.
The Activity in last 7 days tab displays a graph with the number of user events. Hover over a point in the chart to view the event time stamp, and the name of the camera that captured the event. Click a point in the chart to watch a video the event or delete the event.
- Click the All Detections tab to view the event information as a time line.
- Use the scroll wheel to zoom to adjust the time frame.
- Hover over a point in the time line to view when the event was detected and by which camera.
- Click an event to watch a video of the event.
- Click Reset Zoom to reset the time line.