FortiView

FortiView is a graphical analysis tool. It displays real-time and historical web traffic data so that you can visualize and drill down into your FortiWeb configuration and its environment, including server/IP configurations, attack and traffic logs, attack maps, and user activity. You can see information about specific types of attacks, where attacks are originating, who carries out attacks, and how policies and settings handle attacks.

FortiView makes it easy to get an actionable picture of your network's web traffic. This information allows you to precisely configure FortiWeb according to your environment and ensure that your configuration is set up to defend against common threats. FortiView has four menus: Topology, Security, Traffic and Sessions.

Topology

FortiView's Topology menu allows you to monitor policy information for:

• A single server
• Server pools
• Content routing settings

You can view the status of each server policy, their server or server pool(s), and the status of each server. You can also view the status of each content routing policy associated with each server policy.

For details, see Topology.

Security

FortiView's Security menu allows you to monitor threats, including:

• Countries originating attacks
• Devices originating attacks
• Server policies filtered attacks
• Specific types of attacks

You can also view a real-time threat map and set up scanner integration to learn more about your environment to tighten security.

For details, see Security.

Traffic

FortiView's Traffic menu allows you to monitor:

• The source of each session
• The originating country of each session

You can also view information such as HTTP/S transactions and versions, HTTP methods, and HTTP response codes of web traffic.

For details, see Traffic.

Sessions

FortiView's Sessions menu allows you to monitor the following information about each session:

• Server policy
• Source IP
• Destination IP

You can also view the source port and destination port of each session, view the established connection time of each session, and end sessions as needed.

For more information, See Sessions.

Interface

This section shows you how to navigate the FortiView interface for the Security, Traffic, and Sessions menus. FortiView's Topology menu uses a unique interface; for details, see Topology.

Navigating FortiView

Example: Filtering web traffic data

You can filter web traffic data to drill down from a high-level overview to a detailed analysis of particular elements of your environment. From the Security, Traffic, and Sessions menus, the process is essentially the same.

Below is an example using the Security menu to illustrate how the filtering and drill down process works.

1. Go to FortiView > Security > Countries.
2. Click Add Filter, select Country, and either enter the name of the country or select the country from the drop-down menu. In this case, we select China.
3. Double-click the country in the list below to view a summary of the country.

You will see the country's Threats, Threat Score, Action (Block/Alert), and Service (HTTP/HTTPS) in the specified time period; you will also be able to select tabs to view specific Threats, Sources, Client Devices, HTTP Methods, URLs, and CVE ID from the country:

4. Double-click the Bad Robot threat category under the Threats tab. Every bad robot attack launched from China within the selected time period will be viewable.
   

This step could be completed for any threat category in the Threats tab, or under any other tab from the country summary page in Double-click the country in the list below to view a summary of the country. . For example, if you select the Sources tab, you will be able to see every source IP address from the selected country, and can drill down into attacks from each source IP address.

5. Optionally, you can further drill down into your environment and set filters for the selected threat category. Click the Add Filter icon and select among the available categories to drill down into:
   

You can set multiple filters to more precisely drill down into the environment.

6. Double-click a specific attack to view its Log Details. The Log Details provide all of the available information about a specific attack:

View Types

Three view types are available below and you can switch among them:

• Table View
• Bubble Chart
• Country Map

Use the Sort By drop-down menu in the top-right corner of the Bubble Chart or Country Map window to view data by:

• Threats
• Threat Score

For the Bubble Chart window, the size of the bubble represents the relative amount of data. Click a bubble to drill down into the element and view more information.