User Activity Details

FortiCNP monitors and tracks user activities on the cloud platforms. INSIGHTS > Threat > User Activity page keeps track of all user activities on the cloud accounts.

Note: Not all user activities will trigger finding, only user activities that violated enabled FortiCNP security policies will trigger findings.

The User Activity page contains a map displaying (approximate) Geolocation of events and activities list.

Activity Map options

• Activity—Click on an activity indicator on the map to bring up an activity notification from that specific location.

• Move—Move the map by clicking a point and dragging your mouse.
• Zoom—Use the buttons on the bottom-right corner of the map to zoom in and out.
• Refresh—Click the Refresh button to refresh the map.
• Clear—Click the Clear button to clear the map of activity indicators.
• Filter—Customize filtering through account type, users, event, and IP.

Activity Filter Example

1. Click on activity filter drop down menu.



2. Choose the Activity > Login, then choose the cloud account type: "AWS".



3. Click Search to filter through the parameters selected. The result will display only the AWS login activities in last 24 hours.

Daily cloud account activities will be compiled into Activity reports for export, please see Generate User Activity Report.