User Guide

• Overview
• Getting started
  • FortiNDR Cloud portal
  • Network entity
  • Network events
  • Key terms and concepts
• Dashboard
  • Observation details
  • MITRE ATT&CK
    • Detection indicators
    • Viewing the MITRE ATT&CK Matrix
  • DPI dashboards
    • DPI - Threats
    • DPI - AppCtrl
    • DPI - OT
    • DPI - Gen AI
  • Gen AI dashboard
  • Creating custom dashboards
• Entity Panel
• Detections context
• Detections
  • Triage detections
    • Adding custom filters to detectors
    • Muting
      • Mute all detectors for a device
      • Mute a detector
      • Mute a device
      • Viewing muted devices
    • Excluding devices
    • Disabling detectors
    • Resolving detections
    • Creating a detector
    • Using detectors for investigations
  • Detections table
  • Detections visualizer
  • Detections device timeline
  • Behavioral observations
  • Detections details
  • Managing detectors
  • Response configuration
  • Assigning detections
  • Creating column profiles
  • Risk score calculation
  • Filtering event tables
• Investigations
  • Entity lookup
  • Investigate
    • Starting investigations
    • Viewing investigation details
      • Query Status Icons
      • Viewing results
      • Single event view
      • Chart types
    • Adding queries to an investigation
    • Adding notes to an investigation
    • Watch an investigation
    • Using facets in queries
    • Tagging and commenting events
    • Sharing investigations
  • Packet capture
    • Creating a packet capture
    • Terminating and deleting packet captures
    • BPF resources
    • PCAP encryption
    • Managing encryption keys
    • Encryption key settings
  • Private search
    • Creating IQL queries in Private Search
  • Guided queries
    • Adding a guided query to an investigation
    • Running a guided query of event records
    • Running queries in a detection
  • Threat intelligence
    • Search for intel
    • Example search for intel
• Reports
  • Generating reports
  • FortiNDR Cloud Network Traffic Usage of a Sensor Report
  • FortiNDR Cloud Network Traffic Usage Report
  • FortiNDR Cloud Detections Report
  • FortiNDR Cloud Network Security Posture Report
• Settings
  • Profile settings
    • My profile
    • Authentication
    • API Tokens
      • To create an API token:
      • To revoke an API token:
  • Email notifications
  • Manage annotations
    • Viewing annotations in the portal
    • Automatic critical asset identification
    • Managing annotations
  • Mutes and Excludes
  • Sensors
    • Sensor details
      • Status Tab
      • Device Enrichment Status
      • Telemetry Tab
      • Settings Tab
    • Account telemetry
    • Sensor settings
    • Device view
    • Sensors
      • Sensors toolbar
      • Account telemetry
  • Account management
    • Creating users and assigning roles
    • SAML SSO
    • PCAP encryption keys
    • Multi-factor authentication
    • User activity timeout
    • Disabling an account
    • Sensor email alerts
    • Device enrichment
    • Add or edit subnets
• Sensors deployment
  • Sensor specifications
  • Sensor deployment strategy
  • Sensor data source configuration
  • Collector interface
  • NetFlow
    • Configuring NetFlow for FortiNDR Cloud
  • ERSPAN
  • AWS VPC Flow
  • File Analysis
  • Enabling Suricata payload
  • Zscaler ingestion
    • Zscaler setup
    • Zscaler events
  • Sensor provisioning
    • Generate a registration code
    • Register a sensor
• FortiAI
  • Licensing
  • Enabling FortiAI
  • Using FortiAI
  • FortiAI Data privacy
• FortiNDR Cloud Integrations
  • Fortinet Automation Service
    • FortiNDR Essentials Solution Pack
    • Getting started with the Fortinet Automation Service
    • Provisioning the service
    • Installing the agent
    • Installing and configuring connectors
    • Running playbooks
• FortiNDR Cloud APIs
• IQL reference guide
  • Core IQL concepts
  • Fields and field types
    • Field types
    • Enriched object field types
    • Common fields
      • Exceptions to common fields
    • Event fields
  • IQL operators
  • Advanced Query Concepts
    • Putting it all together
    • Array matching
    • Aggregations
    • De Morgan’s Law
  • Field reference
    • Schema and field references
    • Event-type expansion
    • Field expansion
    • Synthetic fields
  • IQL query examples
    • Insight Query Language Basics
    • DCE-RPC Examples
    • DNS Examples
    • HTTP Examples
    • Flow Examples
    • FTP Examples
    • Kerberos Examples
    • NTLM Examples
    • PE Examples
    • RDP Examples
    • SMB Examples
    • SMTP Examples
    • SSH Examples
    • SSL Examples
    • X509 Examples
• Natural Language queries
  • Supported event types and languages
  • Feature Constraints
  • Running Natural Language queries
  • NL Query guidelines
• Change Log