Search and filter options

There are several search and filter mechanisms used to locate hosts, adapters, users or applications. These four tabs share a single view and search mechanism. Options include: quick search and custom filters, which can be used once or saved for reuse.

When a search or filter is run, the search data or the name of the filter remains in the search field at the top of the window. If you then click on a different tab, that search is rerun in the context of the new tab.

Wild cards

When searching using a text field in a custom filter or the quick search field you must enter specific search data, such as 192.168.10.5. Wild cards can be used in these fields. Possible wild cards include the following:

Option	Example
*	192.* in the IP address field searches for all IP addresses that begin with 192.
[...]	[192.168.10.10,172.168.5.22,192.168.5.10] Searches for each IP address in the series and returns multiple records. Any search field that starts and ends with square brackets "[]" and has one or more commas "," is treated as a list of values.
!	!192. in the IP address field searches for all IP addresses that do not contain 192.
![...]	![John, Frank, Bob] in the First Name field returns all records that do not contain John, Frank or Bob in the First Name field.
<esc>!	<esc>!John in the First Name field returns records that match !John. The "<esc>" allows you to search for data that contains an exclamation point (!).

Quick search

The quick search field at the top of the window allows you to search based on a single piece of data, such as IP address, and display all matching records. The following fields are included in the quick search: IP address, MAC address, host name, User First Name, User Last Name, Registered User, Logged On User, and user ID. To search by MAC address you must use one of the following formats:

xx:xx:xx:xx:xx:xx

xxxxxxxxxxxx

xx.xx.xx.xx.xx.xx

xx-xx-xx-xx-xx-xx

xxxx.xxxx.xxxx

Wild card searches can also be done. If you are doing a wild card search for a MAC address you must include colons as separators, such as, 00:B6:5*. Without the separators the search option cannot distinguish that it is a MAC address.

If you are searching by IP address, you enter 192.168.5.1* and all records for IP addresses beginning with 192.168.5.1 are returned.

The information displayed varies depending on the tab that is selected. As you click from tab to tab the search in the quick search field is applied automatically.

• Users tab: Displays all users associated with a device that matches the IP range.
• Hosts tab: Displays all hosts with an adapter that matches the IP range.
• Adapters tab: Displays all adapters that match the IP range

To broaden the search, enter less information, such as *11*. This returns any User Name, user ID, IP, MAC, or host name containing 11 depending on the tab you have selected.

To use the quick search option:

1. Select Hosts > Host View.
2. Select either the Adapters, Hosts, or Users tab.
3. Enter a single piece data in the search field and press Enter. Wild card searches can be done.

Custom filter

The custom filter is the equivalent to an advanced search feature. It provides many fields that can be used in combination to narrow the list of Users, Adapters or Hosts displayed. A custom filter can be created and used just once or can be saved under a filter name.

Saved filters display in the drop-down menu and are separated into two sections:

• Private: Only the current user can see them

• Shared: Filter is shared with all administrators

They can be accessed by clicking the arrow on the quick search field at the top of the window. Custom filters can be modified, copied or deleted as needed. You can also export custom filters to a .txt file which allows custom filters to be imported and used by other administrators.

Use your mouse to hover over a saved filter in the drop-down menu and display a tooltip with details about that filter. There is currently only one default custom filter, Online Hosts, that displays a list of hosts that are connected to the network.

Create and save a custom filter

1. Select Hosts > Host View.
2. Select either the Adapters, Hosts, Users, or Applications tab.
3. Click the arrow on the right side of the Quick Search field at the top of the window.
4. From the drop-down menu select New Filter.
5. Enter the name of the new filter.
6. Select the desired filter type (Private or Shared).
7. Click OK.

   Filter names do not support more than 20 characters.

Continue with the topic below to configure the filter.

Configure a custom filter

This window is used in two ways. First if you have selected New Filter from the menu off of the quick search drop-down, you can configure the filter and FortiNAC saves it for future use. Second, if you have selected custom filter from the menu off of the quick search, you can configure this filter and use it just one time.

This dialog box is common to the adapter, host, and user views. Custom filter entries on any of these tabs will persist if you navigate between these views.

1. Once you have the Filter window displayed, enable the fields to be included in the filter by marking them with a check mark.
2. For each enabled field you must provide additional information. For example, if you select the Connected field, you must choose either On Line or Off Line.
3. For text fields, such as the IP address field, you must enter the search data, such as 192.168.10.5. Wild cards can be used in these fields.
4. To erase all selections, click Clear All.
5. If you have opened a saved filter and started to modify it, use Reset to return the filter to its original settings.
6. Click OK to run the configured filter. If this filter was assigned a name, the settings will be saved.
7. Click OK again to save the filter.
8. Immediately after the filter is run, the filter name displays at the top of the view in the quick search field. To modify the filter, click the Edit link to the left of the quick search field. This modifies the filter whether it was saved or just configured and run one time.

Shared Reports

Shared Reports are generated based on shared filter results and can be configured to run on a scheduled basis. Resulting reports are saved as .csv files in the /home/cm/report directory. They can be downloaded using WinSCP or similar program (specify SCP transfer protocol).

Create New Schedule

1. Modify an existing shared filter or create a new one.
2. At the top of the view, click New Schedule.
3. Select the desired columns to be included in the report
4. Click OK
5. Specify the Schedule Type, Repetition Rate and Next Scheduled time
6. Click OK
7. Click OK again to save filter

Scheduled reports are saved as a task under System > Scheduler. They can be run at any time by selecting the task and clicking Run Now.

Edit a custom filter

1. Select Hosts > Host View.
2. Select either the Adapters, Hosts, Users, or Applications tab.
3. Click the arrow on the right side of the Quick Search field at the top of the window.
4. On the drop-down menu locate the custom filter to be edited and click the pencil or edit icon to the right of the filter name.
5. When the Filter window displays, modify the filter as needed.
6. Click OK to save your changes.

Delete a custom filter

1. Select Hosts > Host View.
2. Select either the Adapters, Hosts, Users, or Applications tab.
3. Click the arrow on the right side of the Quick Search field at the top of the window.
4. On the drop-down menu, locate the custom filter to be deleted and click the red X to the right of the filter name.
5. When the confirmation message displays, click Yes.

Export a custom filter

1. Select Hosts > Host View.
2. Select either the Adapters, Hosts, Users, or Applications tab.
3. Click the arrow on the right side of the Quick Search field at the top of the window.
4. On the drop-down menu select Import/Export, and then click Export.
5. In the Export Filters dialog, select the filters you want to export. Use Ctrl or Shift to select multiple filters.
6. Click OK. The filters are downloaded to a .txt file to your default download directory.

Import a custom filter

1. Select Hosts > Host View.
2. Select either the Adapters, Hosts, Users, or Applications tab.
3. Click the arrow on the right side of the Quick Search field at the top of the window.
4. On the drop-down menu select Import/Export, and then click Import.
5. Click Choose File to find and select the .txt file containing the filters.
6. Click OK to import the filters. The filters appears in the list.