So now that we have all of our data, log and event information sent over to the
40 analyzer,
the next thing we should take a look at is how to actually work with those logs
that are sitting
here at the 40 analyzer. And one of the challenges with 40 analyzers is that
there's more than just
one way to look at and search for logs and events that are happening. So I'm
going to start off with
basic old logs that are being sent from the 40 gates over to the 40 analyzer
and give you some
examples in action of looking for and working with logs. So to start off, I'm WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
examples in action of looking for and working with logs. So to start off, I'm
going to log back
into 40 analyzer and click log in. And also while we're right here at the
initial steps for the 40
analyzer, let me also walk you through how we could change a few settings
should we need to.
So right here, we have this widget for system information. I'll go ahead and
make that bigger.
So there's the host name, the serial number, the platform, the version, and how
long it's been up.
So if we wanted to use administrative domains, what we would do is click right
here, boom,
and enable administrative domains. That way, various firewalls and various Vd
oms could be put into WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
oms could be put into
separate administrative domains. And that way you could have four or five
different administrators
responsible for different parts of the network. And you wouldn't have one giant
blob of aggregated
data you could segment it with administrative domains. So that's how you enable
it right here.
And then when you log on, you'd log on to a specific administrative domain. So
I'm not going to enable
that yet. So I'll click on cancel there. The second thing I want to share with
you that we talked
about in the overview was the operation mode. So if we're in analyzer mode,
which is the default,
that means we can run the reports from here, we can dig into the details of the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that means we can run the reports from here, we can dig into the details of the
logs, do everything.
And that's the basic way we think about a 40 analyzer. However, if you want
this device to be a collector
as an intermediate to collect the login information and to forward them off to
another 40 analyzer,
we click that button right there to tell this 40 analyzer to be in collector
mode. So I'm going
to leave it in analyzer mode. So I'll click on cancel there. But I also want to
share with you
how to do that. So go ahead and restore that to its normal size. And let's just
confirm real quick
with device manager that we have all of our 40 gates reporting, which they are
fantastic.
The branch is by itself. And then as part of our fabric, we have firewall one, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The branch is by itself. And then as part of our fabric, we have firewall one,
two, and three. So
let's start off with log view. Now there's a thing called 40 view as well,
which gives us like a
summarized grouping of information we'll cover that separately later. But let's
start off with
log view. And then let's go to 40. So when click around 40 gate from our
previous video, I had
left this at firewall to so we go ahead and let me go ahead and select all
devices, click on okay.
And then if we want to also we can click on refresh, if we thought there might
be new data is coming
in. So this is all the logs from all of the reporting, 40 gate devices. Now WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in. So this is all the logs from all of the reporting, 40 gate devices. Now
currently we're
looking at traffic logs as identified by this tab being selected. But there's
also logs that we
could look at regarding security. And there's also logs regarding events. So if
we go to security,
there's options for these security logs. And there's also events for these
types of events.
So right now we're just looking at traffic logs because this is selected. Now I
've also noticed
that on various different versions of 40 analyzer, they change the screens a
little bit from time
to time. And that's okay. So I'm gonna give us a little more real estate by
collapsing the left
hand column. So we're under log view, 40 gate, I'll go ahead and collapse that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
hand column. So we're under log view, 40 gate, I'll go ahead and collapse that
and that'll give us a
little more room to work here. Now in a slightly older version of 40 analyzer,
they had a little
icon for a wrench for tools. But now we have an option called more. And that
can give us these
additional options. So if we click on more here, we can go to real time log.
And with real time log,
it's going to push the logs as they come in. So you're gonna see updates as
those computers on the
network are generating traffic and going through the firewall. Now even in real
time view here,
if we want to pause it, we can use this pause icon right here, simply pause it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if we want to pause it, we can use this pause icon right here, simply pause it.
And that would
keep it from scrolling and moving until we clicked on go again. Or if we go to
the more and go to
historical log, that's just going to show us what's there without refreshing
automatically. However,
even here with historical log, if we want to click on refresh, that'll cause
the refresh to
happen. So we can see the latest and greatest information. And then for any of
these logs,
we could double click on it to get more information regarding that specific log
event,
including the firewall that reported it, the source IP address of the device,
where that traffic
came into the firewall on port four, the user ad dash user one, and also where WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
came into the firewall on port four, the user ad dash user one, and also where
they were going
and the activity associated with that in the application recognized with HTTPS.
And a protocol
six, that's the number for TCP has information on the duration and number of
packets and so forth.
And as we continue to scroll down, additional information on the authentication
server used
to identify that user, which is right there. Also the centralized source net
rule that it went
through and the actual name of the policy that permitted that traffic to go
through. So I'll go
ahead and close that now. Another option that we have is that we can actually WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ahead and close that now. Another option that we have is that we can actually
look at these logs
in a raw format, not formatted. So to do that, we click on more. And then from
the dropdown,
we can go ahead and select raw log, or if you want to see the formatted logs
again,
we could go back to more and select formatted log. Now also, as we look at this
traffic log,
we're currently looking at all devices. And it's also showing us for any time,
we're not putting a
date range, for example, we could say we want to look for traffic logs within
the last, for example,
seven days, or we could do a custom look up, we say, you know what, I want it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
seven days, or we could do a custom look up, we say, you know what, I want it
between start time of
January 1st, 1970, all the way to July 20th, 2025, click on Okay. And then it
would only show us the
logs in that range, which based on the state, that's everything going way, way
back. So we asked
for traffic, for example, in the last five minutes, we could select that. And
that would show us only
the last five minutes, in this case, of traffic logs, and it was here, there's
only four pages,
where if we said, you know what, let's take a look at the last seven days, then
we have a lot more
pages to deal with. All right, I'm gonna go to page one, I'm gonna go ahead and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
pages to deal with. All right, I'm gonna go to page one, I'm gonna go ahead and
specify for this
anytime, again, showing the logs for all devices for all time. Now, in addition
to looking at the
traffic logs, we can also look at these security logs. So we have quite a few
options. Now, one
thing you'll discover on a new 40 analyzer is that if it hasn't seen, for
example, security
information security logs regarding antivirus or IPS or application control,
etc, they mean
that show up here. So it doesn't mean it's broken or you're lacking a license.
It simply means that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It simply means that
it doesn't have any in the logs yet that can show you. So if we go to summary,
this is going to show
us the widgets for antivirus web filter SSL, DNS queries, and also take a look
at the time it set
is for the last hour. So if we said, you know what, let's go ahead and say last
, how about last three
weeks, then it's going to put that filter. And now it's going to include
additional information,
because we're asking it to look at a longer period of time. So there's an
incident or something
happened, you want to narrow it down to a narrow range of time, we could do it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
happened, you want to narrow it down to a narrow range of time, we could do it
right here. So now
we have an antivirus file that was seen, we have some web filter events DNS
queries, we have
application firewall and SSL events as well. And if you wanted to narrow this
down, we could go
ahead and say, you know, let's take a look at just web filter events. So it
looks like we have some
policies in place that are monitoring traffic, but it looks like everything is
being allowed
through. So if we wanted to right click here, I'm passed through and say, you
know what,
let's go ahead and let's put a filter in place where the action is not passed WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's go ahead and let's put a filter in place where the action is not passed
through, then we
could go ahead and see blocks. So here are the 123456789 blocks that have
happened based on web
filtering on the 40 analyzer coming from any possible device. So we could drill
down into one
of these, for example, let's go ahead and drill down into this one right here,
we'll just go
ahead and double click on it. And if we look at the details, it'll tell us the
action of blocked
right there. It's also indicating here why it was blocked because of a web
filtering policy,
denying access to any categories of websites that are based on alcohol. Where WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
denying access to any categories of websites that are based on alcohol. Where
if we take a look at
this one right here and click on it, this was also blocked. There's the URL is
trying to go to,
which is a test malware site. And the reason for that it was another category
of malicious websites.
So the idea I want to share here is that we can get very granular with what we
want to look at,
where it's coming from, including what ranges of time we want to look at. So
let's also have a
little fun with this. Let me go ahead and remove the filter sitting looking for
just the blocked.
So I'm looking at web filter activity, because that's what's selected here from
all devices,
any possible time. And let's go back to summary. And let's take a look at the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
any possible time. And let's go back to summary. And let's take a look at the
widget here for
web filter. So if we look at web filters, scroll down, wow, look at this proxy
avoidance. So if
we have policies in place that are supposed to not allow customers to try to
bypass our proxies,
it appears here, based on proxy avoidance and the action of pass through, it
appears here that
we have failed because we have some proxy avoidance, but we have pass through
and 307 in the count field
here. So we click on proxy avoidance, it automatically puts a filter in where WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here. So we click on proxy avoidance, it automatically puts a filter in where
the action is passed
through category description is proxy avoidance. And then we can take a look at
what's going on,
including who's doing it. So looks like user to here, has a whole bunch of
proxy avoidance
websites they've been going to. And that would be absolutely something we'd
want to look into.
So if it's a problem with our policy, we don't have fix our policy to specify
that we don't want
to just allow that traffic, we want to go ahead and block it if the customer is
trying to go to
proxy avoidance types of websites. So if we grab one of these, let's go ahead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
proxy avoidance types of websites. So if we grab one of these, let's go ahead
and let's grab this
right here, I'll just double click on it to bring it up. As we scroll down, it
's 80 user two at this
IP address 1020 0.102 that was doing it. As we continue to scroll down, the
action was passed through
and the profile is called monitor all. And that monitor all profile, which is
associated with
the security policy is allowing proxy avoidance to go through. And as we
continue to scroll down,
here's the actual URL that the client was going to. So as a test of that, let's
right click that
and copy that. Let's go back to PC to his computer, let's open up a browser and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and copy that. Let's go back to PC to his computer, let's open up a browser and
just confirm we can
still get there. So I'll go ahead and put that URL in and a proxy.com. So here
's where testing
that it's being allowed. So if we wanted to correct that, we'd want to go back
to the policy and correct
it. So if we scroll up, so it's HQ firewall one, and if we scroll down a little
bit, and it's a
profile called monitor all that's using. So if we don't want to monitor all,
and we want to start
blocking on proxy avoidance types of websites, we could either replace that
profile with a profile
that starts blocking, or we can modify that profile. So let's go back to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that starts blocking, or we can modify that profile. So let's go back to
firewall one. So here at firewall
one under security profiles web filter, there's the profile right there. Let's
go ahead and edit it.
Currently shows it's being used. If we click that, it'll show us where it's
being used in the
end out with LDAP authentication. Great, great, great. So let's go ahead and
modify this profile
for web filtering. So I'm going to double click on it to edit it. And although
it'll still be called
monitor all, we'll go down to proxy avoidance and specify that we want to go
ahead and do a block
instead of just monitor, click on OK. And because that profile is being used by WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
instead of just monitor, click on OK. And because that profile is being used by
the policy,
that client should no longer be able to go to proxy avoidance websites. So I'll
go ahead and
grab that URL, close the browser, and let's try it again. So we'll open up a
browser, right click,
paste and go. And this time says not not not gonna happen. Now in addition to
us fixing that
problem, if that was a security violation for our company, we're also going to
have that logged
information at the 40 analyzer, because firewall one and the other firewalls
are all saying their
information over to 40 analyzer. So if we go back to our 40 analyzer, and let's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
information over to 40 analyzer. So if we go back to our 40 analyzer, and let's
go ahead and say for
web filtering, let's go ahead and look at the last five minutes, and I still
have the filter in place
for proxy avoidance, let me go ahead and clear off that filter. And right there
, we have our blocks.
Now another way of finding that would be to go ahead and say, you know what, I
want to find
everything that's not passed through. So put that filter in place, and that
will show us those two
blocks and those happen in the last five minutes. Here's another example of
using the same technique
I'm going to go ahead and specify I want to go ahead and use any time range. I
'm also going to click on
the X here to remove the filter for action doesn't equal pass through. And here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the X here to remove the filter for action doesn't equal pass through. And here
in security, let's
go down to application control. So if we scroll to the right a little bit, here
's our applications,
in fact, let me drag that over here a little bit further, so we can see it
without having to scroll
and scroll down. So regarding application control, let's say we want to find
any log entries regarding
social media, you can click on add filter, and then we go down to application
category, and then over
to the right, we can then go ahead and specify equals, and then we can have in
social media,
and then click on apply, and that'll put a filter in where the application WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then click on apply, and that'll put a filter in where the application
category equals social
media. So instead of having to write it all out, you can actually use the
interface to help you
build it. So here in the application, we have LinkedIn, Facebook, Twitter,
anybody narrow it down to
what's happened more recently, we get once again, specify, for example, last
five minutes. So here
it says no record found, but if we send out traffic to social media site, let's
do it. So here's PC2
and our topology, saying traffic through firewall two and also the firewall one
to get up to the
internet, let's go ahead and go to Fortinet, and let's also go ahead and go to
some social media. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
some social media. So
here's a set of bookmarks for social media, let's go to YouTube, and let's also
go ahead and go to
Facebook, and let's also go to Instagram, Grace, there's YouTube, Facebook, and
Instagram, and we'll
go ahead and close the browser and minimize our client here. And now currently
it says no record
found, but if we do a refresh here by clicking here on refresh, now it's
showing us from the last
five minutes, any application categories of social media, which includes our
Facebook, LinkedIn,
Twitter, and I'm not sure why Instagram is not showing up, they're only WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Twitter, and I'm not sure why Instagram is not showing up, they're only
clicking on refresh.
Now there we go, just a little bit of a delay for that information to get all
sorted out here on
the 40 analyzer. So before I leave this, I'm going to go ahead and clear my
filters, and we could also
use this for other types of events as well, DNS, wealth filtering, IPS, etc.
Now another option we
have on the 40 analyzer, I'm going to go ahead and bring back the sidebar here
on the left, is we
also have an option called a Fort review. And think of Fort review as a way of
some views of our data
and our logs that are kind of pre formatted for us. So here under Fort review, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and our logs that are kind of pre formatted for us. So here under Fort review,
I'm going to go
ahead and click here on threats. Now by default, it's showing us the last week,
I'm going to go ahead
and I'm going to say custom, because a few days ago, I generated some traffic.
So we have something to
look at here. So here under 40 view threats, top threats, my custom time frame
is from 713 all the
way to 720 of this year 2025. Or I could go ahead and say, you know, let's take
a look at the last,
let's say three weeks that'll cover us as well. And so I had a lot of fun not WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's say three weeks that'll cover us as well. And so I had a lot of fun not
getting in generating a
lot of events that would show up here as well. So we're going to these top
threats, we can click
here on add filter, and we can go to, for example, threat level. And then with
threat level selected,
we go ahead and say equal. And we could go ahead and say, I only want to see
the critical threat
levels. So the critical selected, we click on apply, and that's going to be a
filter in place to only
show us where the threat level is critical. And that's based on the data here
from the last three
weeks. Or if we want to see the threat level of high, we could go ahead and
remove that filter, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
remove that filter,
click on add filter again, go down to threat level, and say, I want to see the
high and click on
apply. And this time it's going to show us just the threat level of high. And
if there's a CBE
ID associated with that, you could also click to research that or go on a
filter on a specific
threat, we could, for example, right click on that threat. And from the sub
menu select threat
equals that exact threat. And that would filter out the where it's threat level
high, and the exact
threat is that one. And we could double click on this to look at more details
regarding it. So
there's the source user IP address coming into the firewall and the WAN1 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there's the source user IP address coming into the firewall and the WAN1
interface. There's the
threat score and the bytes received. And fortunately, this was blocked as
indicated by the yellow right
here. Now, because this was blocked, let's go back and make clear the filters.
And let's take a look
at examples something else that was allowed to go through. So we're going to
top threats,
and go ahead and clear the filters. And I have searched down here for some blue
icons, which means
that traffic was allowed to go through. And let's go ahead and select this one
right here. So I'm
going to say threat equals that one, which puts that filter in for us. And then WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to say threat equals that one, which puts that filter in for us. And then
I double click on
this entry is putting a filter in place. And then for more detail, we just
continue to double click.
So here is detail about it regarding the 48, which was firewall one, the source
and destination
information and the action, which was allowed. And that was before we changed
the profile to
not allow proxy avoidance. So if we brought our client back in, and we'll open
up a browser,
and we'll go to proxym.com again, our attempt to impress enter, that should be
denied. And also, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
denied. And also,
that new information will be sent over to the 40 analyzer, where we can now see
it in the logs as
well. So let me go ahead and close that browser, even minimize that, I go back
to log view,
I go back to source, let me go back to top threats and refresh here. And now we
have an update. So now
regarding proxym.com, if we double click on that, we have some that was allowed
and some that was
blocked. And that's being reflected right here. And one other item I want to
share with you here in
40 view is this section down here, these are called monitors under this line
right here. So if we
click on threats and events under the 40 view section, currently, it's set up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
click on threats and events under the 40 view section, currently, it's set up
for the last week. Let me
go ahead and say the last, let's go ahead and say the last three weeks, all
devices. And I'll let
this refresh. This is going to show us our threats in a map view. So it's
presuming we have our
firewall set up as far as the location of those firewalls correctly as part of
40 analyzer. And
this is showing us our threat map in an animated fashion. You can also control
the replay rate,
then has a top threat destinations. And let me go ahead and make that full
screen. There we go.
So it was small enough where it wouldn't draw it. So here it's showing us the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it was small enough where it wouldn't draw it. So here it's showing us the
traffic for our top
threat destinations. So I'm launching it from here. I have to be in Las Vegas,
Nevada, and a lot of
the attacks that I simulated and generated, we're going to United Kingdom and
Spain and Germany and
Indonesia and India. That's a great way to visually see our traffic flows. Go
ahead and minimize that.
And as we can just scroll down, we also have our top threats right here. And
here it's currently
sorted by threat level, but we could also sort it based on threat score. And as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
sorted by threat level, but we could also sort it based on threat score. And as
we scroll down,
here's the top threats by weight and count right here. And then if we continue
to scroll down,
here's the top virus instance over time. And I only did it once. It was right
here. So if you
had lots of virus incidents, you could go ahead and say instead of saying most
recent, you could
also say most detected. So I'm going to go back to most recent. So with the
four of you, it's some
really clever, pre-prepared ways of viewing what's happening on your networks
by using 40 analyzer
to give us that overall view of what's happening. And if there's a widget that
you don't want,
you can go ahead and simply remove it by using the drop down here and saying WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
you can go ahead and simply remove it by using the drop down here and saying
remove. If you change
your mind, you can always add it back by clicking on add widget and then add
the widget back in,
just like that. And here in the top threats by weight and count, you can also
hover to identify
what the event was. So that was a critical threat. Again, here in the kind of
reddish orange color.
And then down here, we have proxy avoidance, which was a medium threat. And
also with the
color coding of yellow versus blue, what was allowed, what was not allowed.