Fortinet and Fortianalyzer

[mattysmith80]

hi there,

 

Over the summer we implemented a central Fortinet with Fortianalyzer across our Multi Academy Trust. I was wanting to touch base with someone in a similar position or someone who is using Fortinet. Id like to speak with them to see how their using Fortianalyzer in particular.

 

Look forward to hearing from you.

 

Thanks

Matthew

[iom100]

At the risk of hi-jacking the thread - we're thinking of buying Fortinet so will follow with interest any feedback...

[abrigham]

Hi guys, I have a lot of experience in using FortiAnalyzer in EDU. In fact I have written custom reports to adhere to prevent and safeguarding. PM for more details.

 

PS. It’s an excellent product for schools.

[elsiegee40]

Hi guys, I have a lot of experience in using FortiAnalyzer in EDU. In fact I have written custom reports to adhere to prevent and safeguarding. PM for more details.

 

PS. It’s an excellent product for schools.

We’d prefer experience was shared publicly so everyone benefits

[mjk]

We've got Fortigate/Analyzer . Found the Analyzer quite hard work but interesting to see some example reports that others have used.

[SchoolsBroadband]

We have over 1,500 schools using carrier grade hosted Fortigate firewalls We find it's an excellent NGFW / UTM device. We also do a hosted FortiAnalzyer service too.

 

FortiAnalyzer has come on a long way from where it was 3-4 years ago as has FortiOS on the firewalls too.

 

The only issue we have with both products is that they can be quite complicated to manage so if you're not an experienced network manager it may not be the product for you which is why we used Lightspeed for content filtering as it's very easy to use for all levels of skills where a head teacher with no IT experience should be easily able to pull of some prevent duty reports.

 

We're a Fortinet Gold MSSP so if you need any advice setting anything up, a quote or management then we'd be happy to help.

 

Thanks

 

Dave

[MattGibson]

Old thread but....Did anyone have any good reports to share?

[PlantHead]

Report showing selected categories and the user that was blocked and the time.

You can change the categories you search against using catdesc

 

selectfrom_dtime(dtime) as timestamp, user_src, catdesc, hostname as website,action as status, sum(bandwidth) as bandwidthfrom###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src,dtime, catdesc, hostname, utmaction as action,sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidthfrom $log-trafficwhere $filter andhostname is not null andlogid_to_int(logid) not in (4, 7, 14) and ((logver>=52 and countweb>0)or((logver is null) and utmevent in ('webfilter', 'banned-word', 'web-content','command-block', 'script-filter'))) and (catdesc='Child Abuse' or catdesc='Extremist Groups' or catdesc='Explicit Violence' or catdesc='Drug Abuse' or catdesc='Discrimination' or catdesc='Hacking' or catdesc='Illegal or Unethical' or catdesc='Abortion' or catdesc='Marijuana' or catdesc='Pornography' or catdesc='Sports Hunting and War Games' or catdesc='Plagiarism' or catdesc='Proxy Avoidance' or catdesc='Weapons (sales)')group by user_src, dtime, catdesc, hostname, utmactionorder by dtime desc)### tgroup by user_src, dtime, catdesc, website, statusorder by dtime desc

 

Happy to see other reports, it is a bit of trial and error trying to get The Analyser to show exactly what you want.

Edited December 3, 2019 by PlantHead