FortiView Threats
Go to Dashboard > FortiView Threats. If it's not available in the Dashboard menu, refer to Monitors for how to add a monitor.
From this window, you can see total threat data that FortiWeb has detected:
Viewing specific threats
There are two ways to view information about a specific type of threat:
- Double-click the threat type from the list of threats
- Click the Add Filter icon and select the threat type
A summary for a particular threat type shows the threat level, total number of threats, accumulated threat score, actions, and service used for that threat type:
From here, you can also view information about the source IP of attacks, countries from which attacks are launched, the client devices that launched attacks, HTTP methods used, and targeted URLs under the Sources, Countries, Client Devices, HTTP Methods, URLs, CVE ID, and OWASP Top10 for the specified threat. You can use either the Add Filter icon to filter for these things, or select the relevant tab and double-click the row of the thing you want to know more about.
You can even filter for a combination of these things, including the amount of a specific type of threat from a particular device in a given country that targeted a specific URL:
For any given type of threat, you can drill down into specific country, source IP, client device ID, HTTP method, URL, CVE ID, and OWASP Top10 entries to learn more information about the threat via the Log Details. Below is an example:
Go to Dashboard > FortiView Threats.
Select a threat.
Select the Sources tab.
|
You can select any tab for a country to view the Log Details of an attack. To view the Log Details of an attack, you simply have to select a specific attack. |
Double-click an IP address.
You will see every attack made from that IP address.
Select a specific attack from the IP address. You will be able to see information about the attack from this IP address. The Log Details will appear along the right side of the window: