Viewing users

To view the Users module, follow these steps.

How to view users

1. In the FortiDLP Console, on the left-hand sidebar, click .
2. Optionally, do the following:
   • To view archived users, click and then turn the Hide archived users toggle off.
     
     
   • To modify the aggregations, select different properties from the menus and/or change the Top 10 default. Top menu options show the most common values for a property and Bottom menu options show you the least common values.
     
   • To modify the properties shown at the bottom of the page:
     • Click Columns and select/deselect the relevant checkboxes.
       

       Archived nodes do not display in the user's Nodes column. To view all nodes associated with a given user, use the Nodes module instead, filtering by the user (for example, using the user.uuid property) with the Hide archived nodes toggle off.

     • Change the Items/page default. You can show 10, 25, or 50 users on the page.
       
   • To filter users by a specific property value using the search bar:
     1. Click the search bar.
     2. Select a search property from the menu, or type a text string to search for a property and then select it (the panel displays matching users, labels, and properties as you type). For some properties, you can also use the time selector.

     You can hover over any property in the menu to view a tooltip.

     3. Select or type one of the following operators (the options shown are dependent on what you entered at step B):
        • = (equals).
        • != (does not equal).
        • in (in). For example, entering department in [R&D, "Sales Engineering", Marketing] returns users that are in either the R&D, Sales Engineering, or Marketing department (as per the last directory sync).
        • !in (not in). For example, entering address_office !in [London, Boston, Paris] returns users that do not have a London, Boston, or Paris office address (as per the last directory sync).
     4. Type a search string. The search is case insensitive, but strings containing spaces must be wrapped in double quotes—for example, agent.country != "united states".
     5. Do one of the following:
        • To submit your query, press Enter or click Search now.
        • To add another filter:
          1. Click And and repeat the steps above.
             
          2. Press Enter or click Search now.

             Only AND logic is supported (not OR logic). However, you can use the in or !in operators to apply OR logic in relation to specific properties. For example, to search for users from either the Marketing or the Sales department, enter department in [Marketing, Sales].

   • To filter users by a specific value on the page or view more information about a value, click the value and then click the relevant context box button.

   The following list summarizes the buttons that display: Filters the current page for users with the same value. Filters the current page for users without the value. Copies a value to your clipboard. Filters by a value within the Investigate module. Displays more information about a value. Displays a submenu containing the following options: Filters by a value within the Nodes module (if selected from a user's context box) or takes you to the Node profile page (if selected from a node's context box). Filters by a value within the Admin console.

   • To request a scoped investigation:
     1. At the end of the user's row, click> Request investigation.
     2. In the Investigation name field, type a name to identify the investigation.
     3. Set the time range of the events/incidents you want to investigate:
        • To limit the time range, keep the Limit time range toggle on and either select a time preset or enter a custom time range.
        • To place no limit on the time range, turn the Limit time range toggle off.
     4. In the Reason for investigation field, type the investigation reason.
     5. Click Send request.
   • To edit labels:
     • To assign/unassign labels to/from one user:
       1. At the end of the user's row, click> Edit labels.
       2. In the Edit labels dialog box, select/deselect the relevant labels. You can also click Create new label and create a new label to assign to the user.
       3. Click Assign labels.
     • To assign labels to multiple users:
       1. Filter the users so that only those you want to assign labels to are in view.
       2. At the top of the page, click Assign labels.
       3. In the Assign labels dialog box, select the labels to assign.
       4. Click Assign labels.
     • To unassign labels from multiple users:
       1. Filter the users so that only those you want to unassign labels from are in view.
       2. At the top of the page, click> Unassign labels.
       3. In the Unassign labels dialog box, select the labels to unassign.
       4. Click Unassign labels.
   • To archive a user (if applicable):
     1. At the end of the user's row, click> Archive user.
     2. Provide a reason.
     3. In the confirmation box, click Archive.
   • To unarchive a user (if applicable):
     1. At the end of the user's row, click> Unarchive user.
     2. Provide a reason.
     3. In the confirmation box, click Unarchive.
   • To prevent a user from being auto-archived (if applicable):
     1. At the end of the user's row, click > Prevent auto-archiving for user.
     2. In the confirmation box, click Confirm.
   • To delete a user:
     1. At the end of the user's row, click> Delete user.
     2. Provide a reason.
     3. In the confirmation box, click Delete.
   • To view a user's Agent configuration:
     1. At the end of the user's row, click> Show Agent configuration.
     2. Optionally, to view the configuration for a combination of the user and an associated node, from the Associated nodes list, select a node.
        The node's labels will be added to the user's labels, and the configuration will be recalculated.
   • To a view a user's configured policies:
     1. At the end of the user's row, click> Show configured policies.
        
        
     Configured policies are matched and shown based on a preselected value in the Associated node menu.
     

     Configured policies displayed in this modal reflect the current state of all policies that have been configured in the FortiDLP Console, rather than the state of policies that have been applied by the Agent. Therefore, results could include unpublished changes saved to a policy or policy group. Resulting labels are the labels assigned to a user or user and node combination. If all/any of the resulting labels can be matched to the labels of a policy group, policies belonging to the group will be shown in the table.

     Keep the following in mind: If no nodes are associated with the user, <none> will be preselected, and only the user's labels will be included. If one node is associated with the user, the node will be preselected, and the node's labels will be added to the user's labels. If at least two nodes are associated with the user, the most recently active node will be preselected, and that node's labels will be added to the user's labels.

     2. Optionally, do the following:
        • To view configured policies for a user and node combination, from the Associated node menu, select a node.
        • To view configured policies for the user, from the Associated node menu, select <none>.
        • To modify the table columns:
          1. Click Columns.
          2. Select/deselect relevant checkboxes.
        • To filter the policy results:
          1. Click next to a column title.
          2. Select/deselect relevant checkboxes.
          3. Click Apply (if applicable).
        • To search for configured policies, type into the Configured policies search bar. If the search value matches a policy's name or tag, the policy will remain in the table.
        • To view a policy's detections, at the end of the policy's row, click> View in Investigate.
        • To view a policy's incidents (if applicable), at the end of the policy's row, click> View in Incidents.
        • To view a policy's template, at the end of the policy's row, click> View in Policies.
        • To view a policy's audit logs, at the end of the policy's row, click> View in Audit log.
   • To export users, see Exporting users.