Analysis

The Analysis page displays the list of incidents detected by FortiDeceptor. Use this page to generate the Incidents Report PDF. You can also export the list as a CSV file.

When you expand an incident to the view the details, the incident is marked as read. Newly-detected incidents are in bold to indicate they are unread.

The Analysis page displays the following information:

Severity	Severity of the event.
Protocol	Network protocol the attacker used to perform the attack.
Last Activity	Date and time of the last activity.
Type	Event Type Triggered By Connection Port scan (SYNConnection). Ping. SYN connection. Access to the service with no other interaction like accessing a web server without entering any credentials. Reconnaissance Port scan (Full TCP Connection). Access the decoy network share and browse files. Access the decoy web application and browse the web application. Access decoy FTP server and browse files. Interaction The attacker accesses the decoy and passes the log in phase. Attacker logs into a decoy and runs commands inside the session like RDP. Infection Attacker copies files to the decoy. Attacker accesses the decoy and downloads files from the internet. The attacker runs an exploit against the decoy and injects a binary file.
Attacker IP	Attacker IP address.
Attacker User	Attacker username.
Victim IP	IP address of the victim.
Victim Port	Port of the victim.
Decoy ID	Unique ID of the Decoy VM.
ID	ID of the incident.
Attacker IP	Attacker IP address and domain name.
Attacker Port	Port where the attack originated.
Tag Key	Unique key string for the incident.
Attacker Password	Password used by the attacker.
Start	Date and time when the attack started.

The infected files captured by the decoy are saved as a password protected .zip file you can download. The password for the file is FortiDeceptor.

Table settings

Use the Actions menu at the top of the page to export the incidents table and sort the events. The table settings allow you to show or hide columns and set the order of the column headings in the table.

The following options are available in the Actions menu:

Action	Description
Refresh	Click to refresh the data.
PDF Report	Click to download the detailed analysis report in PDF format.
Export to CSV	Click to export the list as a CSV file. Depending on the number of incidents, the file may take some time to generate and export.
Mark all as read	Click to mark all the incidents as read.
Show	Click to display the incident events by type: Interaction Events Only (default), IPS Events Only, Web Filter Events Only, or All.

To generate the Incidents Report PDF:

1. Go to Incident > Analysis.
2. In the Actions menu, click PDF Report. The Generate PDF Report dialog opens.
3. In the From and To fields, specify the time range for the report.
4. (Optional) In the Mail Address (optional) enter an email address to send the report. Separate multiple email addresses with a semi-colon (;).
5. Click Generate.

To configure the table settings:

1. Go to System > Table Customization. The Table Customization dialog opens.
2. In the Incident Columns pane:
   • To show a column: Drag and drop the headers from the Available Column Headers to Customized Column Headers and Orders.
   • To hide a column: Drag and drop the headers from the Customized Column Headers and Orders to Available Column Headers.
   • To change the column order: Drag and drop the position of the headers in Customized Column Headers and Orders.
3. In the Table Settings pane, configure the table size and view.

   Page Size	Enter the number of incidents to display per page when View Type > Pagination is selected.
   View Type	Select Pagination, Infinite Scroll or Both.

   

4. Click Apply.

Viewing the incident details

You can view the incident details in timeline or table view.

To view the incident details:

1. Go to Incident > Analysis.
2. Click the arrow to expand the incident. The Timeline tab opens.

   

3. Click the Table tab to view the incident details as a table.