Analysis

The Analysis page displays the list of incidents detected by FortiDeceptor. Use this page to generate the Incidents Report PDF. You can also export the list as a CSV file.

When you expand an incident to the view the details, the incident is marked as read. Newly-detected incidents are in bold to indicate they are unread. To refresh the data click the Refresh button in the toolbar.

You can configure the table settings by clicking the gear icon at the bottom-right of the page or go to System > Table Customization. For more information, see Table Customization.

The Analysis page displays the following information:

Severity	Severity of the event.
Protocol	Network protocol the attacker used to perform the attack.
Last Activity	Date and time of the last activity.
Type	Event Type Triggered By Connection Port scan (SYNConnection). Ping. SYN connection. Access to the service with no other interaction like accessing a web server without entering any credentials. Reconnaissance Port scan (Full TCP Connection). Access the decoy network share and browse files. Access the decoy web application and browse the web application. Access decoy FTP server and browse files. Interaction The attacker accesses the decoy and passes the log in phase. Attacker logs into a decoy and runs commands inside the session like RDP. Infection Attacker copies files to the decoy. Attacker accesses the decoy and downloads files from the internet. The attacker runs an exploit against the decoy and injects a binary file.
Attacker IP	Attacker IP address.
Attacker User	Attacker username.
Victim IP	IP address of the victim.
Victim Port	Port of the victim.
Decoy ID	Unique ID of the Decoy VM.
ID	ID of the incident.
Attacker IP	Attacker IP address and domain name.
Attacker Port	Port where the attack originated.
Tag Key	Unique key string for the incident.
Attacker Password	Password used by the attacker.
Start	Date and time when the attack started.

The infected files captured by the decoy are saved as a password protected .zip file you can download. The password for the file is FortiDeceptor.