Select the time period from the dropdown list. Select 24 Hours, 7 Days, or 4 Weeks.

Click the Export Data button to create a PDF or CSV snapshot report. You can wait till the report is ready to view, or navigate away and find the report later in Log & Report > Report Center page.

Show or hide the search filter field.

Click the refresh icon to refresh the entries displayed after applying search filters.

Click the Search Filter field to add search filters. Click the Cancel icon to the left of the search filter to remove the specific filter. Click the Clear All Filters icon in the search filter field to clear all filters.

In this page, the threat target host or user name can be the search criteria. You can input a partial value to search all records that contain it.

Search filters can be used to filter the information displayed in the GUI.

Click the View Jobs icon to drill down the entry.

The device and username that is the target of threats.

A duplicate user name or host from a different VDOM is considered a different user.

The device name.

The number of unique malicious files associated with the user for the time period selected. Click the column header to sort the table by this column.

The number of unique suspicious files associated with the user for the time period selected. Click the column header to sort the table by this column.

The number of unique network threats (attacker, botnet, and suspicious URL events) associated with the user for the time period selected. Click the column header to sort the table by this column.

View the Threat Timeline Chart. When you click on any dot in the chart, all events associated will be displayed. When you click on an event, the View Details page will open.

Click Back button to return to the main landing page.

This chart displays the number of threats and types of threats which occurred to the threat target during the period of time. Hover the mouse pointer over the dots in the chart and more detailed threat information will be displayed.

The following fields are displayed: Device, Threat Target, Time Period, Total Files, number of: Malicious Files, Suspicious Files, and Network Events.

Malicious file information including malware name, Threat Source, and number of detection times. The options are:

• Click the View Jobs icon to drill down the entry.
• Click the malware name to view the related FortiGuard Encyclopedia page.

Suspicious file information including file name, file type, rating, the malware hosting address and number of detection times. Click the View Jobs icon to drill down the entry.

Attacker event information including backdoor name, attack origin address and port, attack destination address and port, and number of detection times.

Botnet event information including botnet name, user IP address, user port, destination IP address, destination IP port and number of detection times.

Click the Back button to return to the main landing page.

Click the View Details icon to view file information. The information displayed in the view details page is dependent on the file type and risk level.

Click the icon to rescan the entry. For more information, see Perform Rescan > File Job Search.

Displays the date and time that the file was detected, malware name, source IP address, and destination IP address.

Click the malware name to view the related FortiGuard Encyclopedia page.

Displays the date and time that the file was detected, file type, rating, source IP address, destination IP address and number of detection times, if available.