Security Controls
On the Security Fabric > Security Rating page, the Security Controls tab displays the results for all security rating checks:
-
A summary chart identifies of how many items passed, failed, or are exempt from security rating checks.
-
Categories against which the security rating tests were run are identified (such as Uncategorized, Audit Logging & Monitoring, Data Protection, and so on) and the assigned grade for each category is displayed (such as A, B, F, and so on).
The letter grade is calculated based on the percent of tests in a category that passed:
-
A = 90% and above
-
B = 77% to <90%
-
C = 60% to <77%
-
D = 50% to <60%
-
F = Less than 50%
For example, if eight out of ten tests in a category passed, then 80% of the tests passed, and the category would be given a B grade.
-
-
A report of details that is organized in the following security rating categories: Fabric Coverage (available for devices in a Security Fabric), Optimization, Security Posture, and Uncategorized. Expand each category to display rows of test details. Click each row to display the Test Details pane.
|
The following licensing options are available for security rating checks:
The base set can be run locally on any FortiGate and on all other devices in the Security Fabric. For a list of base and licensed security rating checks, see FortiGuard Security Rating Service. |
For more information about security ratings, and details about each of the checks that are performed, go to Security Best Practices & Security Rating Feature.
To view security controls:
-
On the root FortiGate, go to Security Fabric > Security Rating. The Security Controls pane opens.
-
For the graded test categories, hover the cursor over a test category to view the calculation breakdown.
-
For the summary chart, click the Passed, Failed, or Exempt words or associated colors in the chart to filter the report results.
For example, click Failed to display only failed tests in the report.
Click Result to remove the filter, or click the X beside the filter in the Search bar
-
Expand each security rating category in the report to view its details.
-
In the report, click each row to view its Test details pane, which includes two tabs: Results and Info & Compliance.
Click Details to hide and display the Test details pane for a selected row in the report.
If a test category failed, the Results section includes a link to the GUI page where you can resolve the problem.
The Info & Compliance tab includes the security controls used for the test and links to specific FSBP, PCI, or CIS compliance policies.
-
Select FSBP, PCI, or CIS to filter the report for the selected compliance policy.
The FortiGate must have a valid Attack Surface Security Rating license to view security ratings grouped by CIS.
-
Click Export to export the report to a CSV or JSON file.
-
Click the gear icon to customize the report table by adding more columns.
|
To exit the current view, click the x beside the search item to return to the summary view. |
Multi-VDOM mode
In multi-VDOM mode, security rating reports can be generated in the Global VDOM for all of the VDOMs on the device. Administrators with read/write access can run the security rating report in the Global VDOM. Administrators with read-only access can only view the report.
On the report scorecards, the Scope column shows the VDOMs that the check was run on.
Global scope:
VDOM scope:
The security rating event log is available on the root VDOM.
Security rating check scheduling
By default, security rating checks are scheduled to run automatically every four hours.
The security rating checks also run automatically in between scheduled checks when relevant configuration changes are made to keep the results current with the latest configuration changes.
To disable automatic security checks using the CLI:
config system global
security-rating-run-on-schedule disable
end
To manually run a report using the CLI:
# diagnose report-runner trigger