SOC TEAM REPORT

Internet Service Provider (UPLINK STATUS)

Access the FortiGate GUI

• Log in to the FortiGate web console using an administrator account.

Navigate to the Dashboard

• Go to Dashboard > Status

SD-WAN Monitoring

• Go to Network > SD-WAN.

• Click the Performance SLAs tab.

IPSec Tunnel

Go to VPN > IPsec Tunnels.

SD-WAN Performance SLA

• Log in to your FortiGate firewall's web-based management interface.

• Navigate to Network > SD-WAN.

• Click on the Performance SLAs tab.

CPU & Memory Utilization

• Log in to your FortiGate firewall's web-based management interface.

• Navigate to Dashboard > Status.

• Look for the System Resources widget (usually in the top left).

• Here, you will see two key gauges:

  • CPU: Displays the percentage of current CPU usage.

  • Memory: Displays the percentage of current memory usage

Top Application Used

1. Open your web browser and navigate to the FortiCloud login page.

2. Enter your credentials to log in to the main FortiCloud portal.

3. On the main dashboard, look for the Services panel or menu.

4. Click on the service that is managing your FortiGate's logs and analytics:

   • FortiGate Cloud: (For devices with a Cloud subscription or logging directly to FortiGate Cloud).

   • FortiAnalyzer Cloud: (For devices using a dedicated log and analytics service).

2. Navigate to Reports or Analytics

Once inside the relevant management portal (FortiGate Cloud or FortiAnalyzer Cloud):

1. Look for the navigation menu on the left side.

2. Click on Analytics or Log & Report.

3. Within this section, you will typically find options for Reports or Monitors. Select Reports.

3. Generate or View the Application Usage Report

The "Top Applications" data is often included in pre-built reports or a specific monitoring view.

1. Locate the Predefined Reports: Look for existing report templates, which often include:

   • Summary Report

   • Application Usage Report

   • 360 Degree Activities Report

Top Website Used

Once inside the management portal:

1. Look for the main navigation menu (usually on the left side).

2. Click on Analytics or Log & Report.

3. Select the Reports section.

3. Generate the Web Activity Report

The "Top Websites" data is typically found in the Web Activity Report or the Summary Report.

1. Locate the Report: Find the preconfigured report templates. Look for:

   • Web Activity Report (Most direct source).

   • Summary Report (Often contains a Web Activities section).

Top Sources

1. In the navigation menu, click on FortiView or Monitors.

2. Select the view named Sources.

Top Destinations

1. In the navigation menu on the left side, click on FortiView or Monitors.

2. Within the monitor list, look for the Traffic category.

3. Select the view named Top Destinations.

Top Threats

1. In the navigation menu on the left side, click on FortiView or Monitors.

2. Select the view named Threats or Top Threats.

Top Attacks

• In the navigation menu on the left side, look for FortiView or Monitors.

• Select the view named Attacks or Top Attacks.

  • Note: In some cases, specific "Attack" views may exist for technologies like FortiDDoS, but the comprehensive FortiGate attacks are under Threats

Top Virus

1. In the navigation menu on the left side, look for FortiView or Monitors.

2. Select the view named Top Virus (sometimes found under the broader Threats section).

Unauthorized Login Attempt

1. Log in to your FortiGate firewall's web-based management interface.

2. In the navigation menu, go to Log & Report.

3. Select Event (sometimes listed as System Events in newer FortiOS versions).

2. Filter for Failed Login Events

The system logs contain many events, so you need to apply a filter to isolate the login attempts.

1. Look for the Filter bar or the filter settings above the log table.

2. Filter the logs using one or more of the following criteria:

   • Log Type/Event Type: Look for User or Administrative events.

   • Message Content: Search for keywords like:

     • "Failed login"

     • "Administrator login failed"

     • "invalid credentials"

SSL VPN Users

1. Log in to your FortiGate firewall's web-based management interface.

2. Navigate to VPN > SSL-VPN > Monitor.

3. The SSL-VPN Monitor table will list every currently connected SSL VPN user, showing:

   • User Name: The authenticated user.

   • Source IP: The public IP address they are connecting from.

   • Virtual IP: The internal IP address assigned to them by the FortiGate (the tunnel IP).

   • Login Time: When the session started.

2. View Active IPsec VPN Users

1. Navigate to Log & Report > Traffic > Forward Traffic.

2. Use the filter bar above the log table to filter the logs specifically by the identified policy:

   • Click + Add Filter.

   • Select Policy ID.

   • Enter the Policy ID number you noted in Step 1.

3. Optional Filters: To focus on a specific user, add another filter:

   • Select User and enter the specific VPN username (e.g., jsmith).

   • Alternatively, filter by the user's assigned Virtual IP (their tunnel IP).

Fortigate Devices Firmware Version

The firmware information is typically located where your devices are registered and managed.

1. Look for the main services menu or panel on the dashboard.

2. Click on Asset Management or Products & Devices.

3. This page lists all the Fortinet products registered under your account.

3. View the Device List

1. On the Products & Devices page, you will see a table listing your registered devices.

2. You may need to filter the list to only show FortiGate devices if you have many different product types.

4. Locate the Firmware Version

In the device table, look for the following columns:

• Product Name (e.g., FortiGate 100F)

• Serial Number

• Firmware Version or OS Version

The column labeled Firmware Version (or similar) will display the current operating system version running on that specific FortiGate (e.g., v7.2.5, v6.4.12).