The SOC Monitoring Summary contains information about the following:

• The number of monitored devices, endpoints, and users. Endpoint and user information is obtained through security logs collected by FortiAnalyzer.
  • Monitored Devices: The number of devices onboarding for SOCaaS monitoring.
  • Monitored Endpoints: The number of endpoints detected from FortiGate logs.
  • Monitored Users: The number of users detected from FortiGate logs.
• The number of logs collected and processed, security events detected, alerts generated and triaged, and incidents confirmed and escalated by the Fortinet SOC team.
  • Processed Logs: Number of logs collected and processed from customer's FortiGate(s).
  • Security Event: Security events filtered and triaged by FortiAnalyzer event handlers, based on the detections in FortiGate logs.
  • Triaged Alerts: Alerts in which a preliminary assessment was completed by the SOC team to determine if the Alerts should be escalated to the customer. These can be false positive or other events that do not require escalation.
  • Escalated Alerts: Alerts that are found to be high or critical risk or severity (malicious or high suspicious) and are escalated to the customer for review and action in the Alerts view.

Shows the threat detection trend for Security Events, Triaged Alerts, and Escalated Alerts over a period of time. This chart is updated daily.

The location map is displayed when the location has been specified for at least one managed Fabric device. See My Assets for more information.