Functions

FortiGate Cloud has the following functions:

How FortiGate Cloud works

You can register one or multiple devices with FortiGate Cloud under a single account on the FortiGate Cloud portal.

Each device periodically sends logs to FortiGate Cloud for storage. You can configure log settings. For example, you can configure devices to send only traffic and event logs, or include security logs such as AV, application control, and IPS.

From the recorded logs, you can generate reports to identify trends in network traffic, individual user activity, and security threats across different applications. Drilldown capability and real-time alerting are also available.

FortiGate Cloud also creates copies of configurations that you can use for backup, restoration, or provisioning new devices. You can use a VPN tunnel to bring up the console of a device behind a firewall to perform configuration or policy changes remotely.

FortiGate Cloud is integrated with FortiCloud single sign on. After you create a FortiCloud SSO account, you can enable the FortiGate Cloud global or European service. You can also enable both services. You can deploy FortiGate devices to the global or Europe cloud service from the unified device inventory in the FortiGate Cloud portal. See Inventory on page 40. You can migrate historical data such as logs, reports, and backups between accounts under the same service (global or Europe), but you cannot migrate such data from one service to another. To migrate a FortiGate device from one service to the other, you must undeploy the device, then deploy the device again from Inventory on the desired service portal.

When you initially create your account in FortiGate Cloud, you choose the data center to use. You cannot transfer data and accounts between data centers, so migration requires a new account.

To confirm which version of FortiGate Cloud is currently in use, on the Fortinet website, use your FortiCloud account to access FortiGate Cloud. The version details are at the bottom of the FortiGate Cloud homepage.

FortiGate Cloud currently supports two languages: English and Japanese. You can select a language from the web portal login page. Other languages may be available in other regions.

You can provide feedback or request improvements to FortiGate Cloud using the envelope icon on the top-right of every screen. Fortinet cannot guarantee individual responses to requests.

Requirements

The following items are required before you can initialize FortiGate Cloud:

For Management, FortiGate Cloud supports FortiOS 5.0.0 through 6.2.1. For devices that are running unsupported FortiOS versions, you can use the Remote Access feature.

For Analysis, FortiGate Cloud supports all FortiOS versions.

FortiGate Cloud supports all high-end, mid-range, and entry-level FortiGate models. You can find more information about FortiGate models and specifications on the Fortinet website. All FortiWifi models support FortiGate Cloud.

The FortiGate does not require a hard drive if it uploads logs to FortiGate Cloud in real-time, which you can enable under Log Settings in FortiOS.

The following table lists port numbers that outbound traffic requires. On request, Fortinet can supply the destination IP addresses to add to an outbound policy, if required.

Deploying a FortiGate/FortiWifi to FortiGate Cloud

You can deploy FortiGate Cloud using one of the following methods:

l FortiGate key l Bulk key l Zero-touch deployment l FortiOS GUI

After deploying FortiGate Cloud using one of the methods described, complete basic configuration by doing the following:

1. Create a firewall policy with logging enabled. Configure log uploading if necessary.
2. Log in to FortiGate Cloud using your FortiCloud account.

To deploy a FortiGate/FortiWifi to FortiGate Cloud using the key:

1. Log in to the FortiGate Cloud portal, then click Add FortiGate.
2. In the Add FortiGate dialog, enter the key printed on your FortiGate.
3. From the Select Display Timezone forDevice dropdown list, select the desired time zone.
4. Under Select Sub Account, select the desired subaccount.
5. Click Submit.

To deploy multiple FortiGate/FortiWifi devices to FortiGate Cloud using a bulk key:

1. Log in to the FortiGate Cloud portal, then click Inventory.
2. Click Import Bulk Key.
3. In the Please input the Bulk Key: field, enter the bulk key.
4. Click Submit. The portal displays a list of the FortiGate/FortiWifi serial numbers associated with the bulk key.

To deploy multiple FortiGate/FortiWifi devices to FortiGate Cloud using zero-touch deployment:

See FortiDeploy on page 50.

To deploy a FortiGate/FortiWifi to FortiGate Cloud in the FortiOS GUI:

1. In the FortiCloud portal, ensure that you have a product entitlement for FortiGate Cloud for the desired FortiGate or FortiWifi.
2. In FortiOS, do one of the following:
   1. Go to Security Fabric > Settings, and enable Central Management. Click FortiGate Cloud.
   2. In the Dashboard, in the FortiGate Cloud widget, the Status displays as Not Activated. Click Not Activated.
3. Click the Activate
4. In the Activate FortiGate Cloud panel, for Account, select FortinetOne.
5. In the Email and Password fields, enter the email address and password associated with the FortiCloud account.
6. Enable Send logs to FortiGate Cloud. Click OK.
7. This should have automatically enabled Cloud Logging. Ensure that Cloud Logging was enabled. If it was not enabled, enable it, then set Type to FortiGate Cloud.

Deploying a FortiGate/FortiWifi to FortiGate Cloud

8. At this point, in FortiGate Cloud, you can access Analysis and SandBox features for this device. To access Management features, you must authorize the FortiGate in FortiGate Cloud by entering the a local superadministrator username and password when prompted. After authorization, you can manage that FortiGate from FortiGate Cloud.

To unsubscribe from FortiGate Cloud:

You can disconnect your account from the dashboard in your FortiGate/FortiWifi.

1. In the FortiOS Dashboard FortiGate Cloud widget, the Status appears as Activated. Click Activated, then click the Logout
2. In the confirmation dialog, click OK. This detaches the FortiGate/FortiWifi from the account and stops uploading logs.

Homepage

You see the homepage when you first open the FortiGate Cloud interface. From the homepage, you can add a FortiGate as described in To deploy a FortiGate/FortiWifi to FortiGate Cloud using the key: on page 11. You can also go to the Analysis on page 16, Management on page 29, SandBox on page 35, and Inventory on page 40 pages.

To view Fortinet devices that you have deployed using the same FortiCloud account under a different service, you can click # device(s)in othersite. This does not display if you have not deployed any devices under a different service. This displays a dropdown list of devices deployed using the same FortiCloud account under a different service. For example, if you are currently logged in to the Europe service, this link displays a dropdown list of devices deployed under the global service. If there are more than 20 devices deployed to the other service, the dropdown list only displays 20. You can go to the other service homepage by clicking Switch Site.

The homepage also displays currently active devices that you previously deployed to the current service, but later deployed to another service. For example, if you deployed a FortiGate to the global service, then deployed it to the Europe service, it shows up in the homepage for both services. The Active in column in the Analysis, Management, and SandBox homepages displays which service the device is currently connected to.

To add more administrators/users:

1. In the upper right of the FortiGate Cloud interface, select the My Account
2. Select Add User in the window.
3. Enter the new admin/user’s email address and name.
4. Select whether they are an admin (total control over the FortiGate Cloud interface) or a regular user (limited control, monitoring only).
5. From the Language dropdown list, select the desired language.
6. From the Default Entry Point dropdown list, select the desired default page. This is the default page the user sees when they log in to FortiGate Cloud.
7. Select Submit. The admin/user receives an email prompting them to set their account password and log in.

To replace an account ID with a new email address:

1. Log in to FortiGate Cloud using the account that you want to replace. In the upper right of the FortiGate Cloud interface, select the My Account In the list of users, ensure that the new email address is not already in use.
2. Add a new admin user, using the desired new email address. Follow the instructions in To add more administrators/users: on page 14 to add the new admin user.
3. Select Set as primary.
4. Log out of FortiGate Cloud.
5. Log in to FortiGate Cloud as the admin user added in step 2.
6. Click the My Account
7. In the list of users, click the Delete icon beside the old account to remove it from FortiGate Cloud.

You can move a FortiGate from the global service to the Europe service, or vice-versa. The example illustrates moving a FortiGate Cloud from the global service to the Europe service.

Homepage

To move a FortiGate from the global service to the Europe service:

1. Log in to the FortiGate Cloud global service.
2. On the Analysis, Management, or SandBox page, undeploy the FortiGate:
   1. Click the Config icon for the desired device.
   2. Click Undeploy.
   3. In the confirmation dialog, click YES.
   4. You have the option to place a unit where the FortiGate was deployed. The unit contains historical data and a serial number that starts with U.
3. Go to Inventory and confirm that the FortiGate is now listed under inventory.
4. Log in to the FortiGate Cloud Europe service.
5. Go to Inventory. Select the desired FortiGate, then click Deploy to FortiGate Cloud.

Log in to the FortiOS GUI. Reactivate FortiGate Cloud by following To deploy a FortiGate/FortiWifi to FortiGate Cloud in the FortiOS GUI: on page 12.

Analysis

The Analysis tab provide tools for monitoring and logging your device’s traffic, providing you centralized oversight of traffic and security events.

The Analysis homepage provides the following information about devices. You can select a device’s serial number or name to access analysis tools for that device:

• Model/serial number l Fortinet product type l Firmware version
• Status (If the device is connected through a management tunnel) l Last compiled report and last log uploaded l Subscription expiry date

You can use the gear icon to access additional functions:

To undeploy the FortiGate:

1. Click the Config icon for the desired device.
2. Click Undeploy.
3. In the confirmation dialog, click YES.
4. You have the option to place a unit where the FortiGate was deployed. The unit contains historical data and a serial number that starts with U.

To set the display timezone for the FortiGate:

The display timezone only affects log data view for the FortiGate and does not affect the FortiGate’s configured timezone. You can modify the FortiGate’s display timezone after it has already been set.

1. Go to Analysis.
2. Click the Config icon beside the desired device, then click Display Timezone.
3. From the Display Timezone forDevice dropdown list, select the desired timezone. Click Submit. The FortiGate Cloud GUI shows the FortiGate’s display timezone in the upper right corner.

To rename the FortiGate:

1. Click the Config icon for the desired device, then click Rename.
2. In the Device Name field, enter the desired name. Click Submit.

To delete data from the FortiGate:

1. Go to Analysis.
2. Click the Config icon beside the desired device, then click Options.
3. In the Delete Data before field, selected the desired date. Click Apply. FortiGate Cloud deletes the data on the FortiGate from before the selected date.

To go to the device list:

You can return to the device list from the Analysis, Management, or Sandbox page for an individual device.

1. In the upper left corner, click Show Device List.

FortiView

The default FortiView page is the summary view, which uses widgets to show a general overview of what is happening with your device. You can add new widgets by selecting Add Widget.

Each widget is a customizable box, showing certain information about the device. You can do the following with widgets:

• Click a widget title and drag it to move it around. l Delete a widget by selecting the X icon. l Set the refresh rate of widgets by selecting the dropdown list beside the refresh icon.

The following lists all widget types, grouped according to function:

Threats

Traffic Analysis

Websites

FortiView offers log information, reformatted into easily navigable charts, in a style similar to FortiView in FortiOS.

You can select a time period to view data for:

• Last 60 minutes l Last 24 hours l Last 7 days
• Last 30 days l Specified time period

You can set the chart’s refresh rate by clicking the Refresh icon. By using the Add Filter dropdown list, you can filter the chart by various factors. Individual chart entries may also allow you to filter by that entry’s data by selecting a filter icon on the right, or drill down to see all related log data, such as all log data through that interface.

FortiView charts reference

The following provides descriptions of all FortiView charts.

User Dashboard

The User Dashboard displays the number of users/entities that fit into the following security categories:

l Visited high risk websites l Infected by malware l Targeted by malware l Targeted by spam l Violated data leak rules l Used high-risk applications l Targeted by attacks l Attacked by protocol intrusion

You can click each category to view the list of users/entities affected. You can drill down further to view the list of incidents for each user/entity and the logs for each incident.

FSBP Dashboard

The FSBP Dashboard displays security rating results for the device, in the following categories:

• Overall Score l Maturity Milestones l Top Achievement
• Top Todo
• History Trend

The FSBP Dashboard is only available for devices that support the Security Rating feature.

Threats

Traffic Analysis

Website

System Events

VPN Events

Logs

Logs offers more detailed log information, access to individual log data, and downloadable log files. You can select a category of logs to view from the list on the left.

You can select a time period to view data for:

l Last 60 minutes l Last 24 hours l Last 7 days l Last 30 days l Specified time period

You can set the chart’s refresh rate by selecting the Change Refresh Period icon. By using the Add Filter dropdown list, you can filter the log list by various factors. Selecting Column Setting allows you to customize the default log view. By selecting Log Files, you can see the raw log data files and manually download them. The box in the lower right allows you to move through pages of log data by clicking the arrows or entering a page number.

You can download various types of raw logs from FortiGate Cloud. The log filename format is as follows:

<FortiGate serial number>_<log type>_<beginning of log date range>-<time of first log>-<end of log date range>-<time of last log>.log.gz

The log filename format uses a shortened identifier for each log type:

For example, consider an Application Control log that is generated for the period between October 23, 2019 and November 2, 2019 for a FortiGate with the serial number “FGT123”. The first log in the file has a timestamp of 6:09 PM, while the last log in the file has a timestamp of 9:32 AM. The log file name is as follows: FGT123_rlog_20191023-1809-20191101-0932.log.gz

Reports

Reports generates custom reports of specific traffic data, and can email them to specified addresses. Select a report to see a list of collected reports of that type. By default, there is a preconfigured Summary Report and a Web Activity Report.

You can Add new reports or Edit existing ones. Both open an editing interface, which allows you to edit the report content and add or remove sections.

To create a custom report:

1. Go to Analysis > Reports.
2. Click Add in the upper right, and choose to create a blank report, default Summary or Web Activity Report, copy an existing report, or import an external template. Click Submit.
3. To add a chart, click the gear icon and select Add Chart.
4. In the Predefined Chart List dialog, select the desired chart. You can further customize the chart by clicking Customize. Click Save.
5. Click the gear icon to add Descriptions, and Titles to the current section, or new 1- or 2-column sections.
6. Click Settings. You can upload a report logo and set the report language.
7. Click Save.
8. Select Run, and view the finished report.

To schedule a report:

1. Go to Analysis > Reports.
2. Click the desired report from the left pane.
3. Click Schedule to determine the range of time for which to generate reports: Daily, Weekly or Monthly, and which email to send the reports to. For example, if you want to generate a report for a month of data, you can select

Monthly and FortiGate Cloud will run and send the report once a month. You can also run a report immediately.

To configure report settings:

If you have enabled multitenancy, you can access these options in Group Management > Manage Report Configs.

1. Go to Analysis > Reports.
2. Click the desired report from the left pane.
3. Click Settings. You can upload a report logo and set the report language. Click Submit.

Reports reference

The following provides descriptions of preconfigured reports:

Event Management

In Event Management, you can set up email alerts for specific network structure emergencies, such as FortiGate Cloud losing connection to the device, or the device’s power supply failing. The page defaults to All Events in the left menu, which lists all past emergency events. Select Event Handlers to configure the alert settings.

You can enable events to track by selecting their checkboxes. If you want to receive an alert email when they occur, select the checkbox under Send Alert Email and enter the email address to send the alert email to.

Select the gear icon to configure each Event Handler directly and set the logged severity level and notification frequency.

Introduction

FortiDeceptor creates a network of decoy VMs to lure attackers and monitor their activities on the network. When attackers attack decoy VMs, their actions are analyzed to protect the network.

Key features of FortiDeceptor include:

• Deception OS: Windows, Linux, or SCADA OS images are available to create Decoy VMs. l Decoy VMs: Decoy VMs that behave like real endpoints can be deployed through FortiDeceptor. l Lures: Lures are services, applications, or users added to a Decoy VM to simulate a real user environment.
• FortiDeceptor Token Package: Install a FortiDeceptor Token Package to add breadcrumbs on real endpoints and lure an attacker to a Decoy VM. Tokens are normally distributed within the real endpoints and other IT assets on the network to maximize the deception surface. Use tokens to influence attackers’ lateral movements and activities. Examples of what you can use in a token include: cached credentials, database connections, network share, data files, and configuration files. l Monitor the hacker’s actions: Monitor Incidents, Events, and Campaign.
• An Event represents a single action, for example, a login-logout event on a victim host.
• An Incident represents all actions on a single victim host, for example, a login-logout, file system change, a registry modification, and a website visit on a single victim host.
• A Campaign represents the hacker’s lateral movement. All related Incidents are a Campaign. For example, an attacker logs on to a system using the credentials found on another system.
• Log Events: Log all FortiDeceptor system events.

Management

On the Management tab, you can remotely manage FortiGate and FortiWiFi devices that are connected to the FortiGate Cloud service.

The Management homepage provides the following information about devices. You can select a device’s serial number or name to access management tools for that device:

• Model/serial number l Fortinet product type l Firmware version
• Status (If the device is connected through a management tunnel) l Service the device is currently active in l Applied template

You can use the gear icon to access additional functions:

To undeploy the FortiGate:

1. Click the Config icon for the desired device.
2. Click Undeploy.
3. In the confirmation dialog, click YES.
4. You have the option to place a unit where the FortiGate was deployed. The unit contains historical data and a serial number that starts with U.

To authorize a new account to access the FortiGate’s historical data:

1. Click the Config icon for the desired device.
2. Click Authorize New Account.
3. In the Account ID field, enter the desired account ID.
4. Click Submit.

To rename the FortiGate:

1. Click the Config icon for the desired device, then click Rename.
2. In the Device Name field, enter the desired name. Click Submit.

To go to the device list:

You can return to the device list from the Analysis, Management, or Sandbox page for an individual device.

1. In the upper left corner, click Show Device List.

You must first enable the management tunnel on your device before you can see any management functions. On the device, run the following CLI commands:

config system central-management set mode backup set type fortiguard

end

Config

In Config, you can access a pared-down version of the remote device’s management interface to configure major features as if you were accessing the device itself. For descriptions of the configuration options, see the FortiOS documentation.

The configuration you see in FortiGate Cloud does not autorefresh. FortiGate Cloud displays a notification if the current local FortiGate configuration differs from the latest configuration uploaded to FortiGate Cloud. You can overwrite the FortiGate Cloud configuration with the current local FortiGate configuration by clicking Import, or merge the two configurations by clicking Merge. If you are merging the configurations and there is a conflict between them (for example, an option is enabled locally on the FortiGate but disabled in FortiGate Cloud), FortiGate Cloud keeps the local FortiGate Cloud configuration for that option. You can then make any changes you want to reflect on the device, and select Deploy to push the configuration to the device.

In the case that your device configuration version does not match the firmware version, FortiGate Cloud may display a Device config version does not match device firmware version message. You can click the Import button to synchronize the configurations.

To deploy cloud configuration to devices:

1. Go to Management > Config.
2. Before you edit any settings, click the Import button to retrieve the most up-to-date configuration from the FortiGate Cloud-connected device.
3. On this page, you have limited access to a pared-down version of the FortiGate interface, allowing you to edit interfaces, routes, policies, etc. Edit the FortiGate configuration as needed.
4. When you are ready to push your updated configuration back to the device, select Deploy in the upper right.
5. Wait for the configuration to download to the device. When it completes, a deployment log appears, showing you the changes as they appear in the CLI.

Backup

In Backup, you can back up, Edit, View, Compare (to other revisions), Download, Restore (to device), and Delete revisions. You can filter the revision list by firmware version or created time. You can also search for a specific backup.

To back up the device configuration to the cloud:

1. Go to Management > Backup.
2. Select Backup Config in the upper right, and enter the backup revision name. FortiGate Cloud adds the new configuration to the list. By selecting the icons on the right side, you can rename, view, compare, download, restore, and delete configuration files. The compare icon only appears once you have multiple revisions available.

To enable auto backup:

1. Go to Management > Backup > Auto Backup Setting.
2. Click Enable Auto Backup. Only setting changes on the FortiGate (locally from the FortiGate or from FortiGate

Cloud) trigger auto backup. You can select one of the following auto back up settings:

3. Click Apply.

Upgrade

In Upgrade, you can see the current firmware version installed on the device, and update to newer stable versions if they are available. The upgrade path that FortiGate Cloud displays may differ from the upgrade path that FortiGuard displays.

To upgrade remote device firmware:

1. Go to Management > Upgrade.
2. Verify your device’s current firmware version in the upper left before continuing.
3. If you are concerned about the effects of upgrading or have not upgraded recently, use the Upgrade Path Tool to ensure you are following the recommended upgrade path.
4. It is recommended to back up your device’s configuration before upgrading, in Management > Backup or in the device’s management interface.
5. Select an available firmware from the list, and select Upgrade. You can schedule a time and date to perform the remote upgrade. For example, you can schedule it during downtime to minimize disruption. A caution icon may also display to indicate that the upgrade path may not be supported.
6. Wait for the upgrade to take effect.

Script

In Script, you can create and run script files on connected remote devices to check device status or get bulk configuration information quickly.

To execute a script on a remote device:

1. Go to Management > Script.
2. In the upper right, select Add Script.
3. Enter a name and a description, and the CLI script content that you want to run. Each script is a series of CLI commands, one command per line. Click Submit.
4. Click the Deploy icon, and select a time to automatically deploy the script to the device.
5. To cancel the scheduled run, click the Cancel icon next to the scheduled time.
6. FortiGate Cloud records that script’s output. You can read it by clicking View Result.

SandBox

FortiSandbox Cloud is a service that uploads and analyzes files that FortiGate AV marks as suspicious.

In a proxy-based AV profile on a FortiGate, the administrator selects Inspect Suspicious Files with FortiGuard Analytics to enable a FortiGate to upload suspicious files to FortiGuard for analysis. Once uploaded, the file is executed and the resulting behavior analyzed for risk. If the file exhibits risky behavior or is found to contain a virus, a new virus signature is created and added to the FortiGuard AV signature database. The next time the FortiGate updates its AV database it will have the new signature. The turnaround time on Cloud SandBoxing and AV submission ranges from ten minutes (automated SandBox detection) to ten hours (if FortiGuard Labs is involved).

FortiGuard Labs considers a file suspicious if it exhibits some unusual behavior, yet does not contain a known virus (the behaviors that FortiGate Cloud Analytics considers suspicious change depending on the current threat climate and other factors).

The FortiGate Cloud console enables administrators to view the status of any suspicious files uploaded: Pending, Clean, Malware, or Unknown. The console also provides data on time, user, and location of the infected file for forensic analysis. SandBoxing is available in both free and paid FortiGate Cloud subscriptions.

You can view the FortiSandbox Cloud Service Description for details.

The SandBox tab collects information that the FortiSandbox Cloud service compiles. FortiSandbox Cloud submits files to FortiGuard for threat analysis. You can configure your use of the service and view analyzed files’ results.

You must enable Cloud SandBoxing on the FortiGate and submit a suspicious file for the SandBox tab to become visible.

The SandBox homepage provides the following information about devices. You can select a device’s serial number or name to access SandBox tools for that device:

• Model/serial number l Fortinet product type l Firmware version
• Status (If the device is connected through a management tunnel) l Service the device is currently active in l Last compiled report and last log uploaded l Subscription expiry date

You can use the gear icon to access additional functions:

To undeploy the FortiGate:

1. Click the Config icon for the desired device.
2. Click Undeploy.
3. In the confirmation dialog, click YES.
4. You have the option to place a unit where the FortiGate was deployed. The unit contains historical data and a serial number that starts with U.

To rename the FortiGate:

1. Click the Config icon for the desired device, then click Rename.
2. In the Device Name field, enter the desired name. Click Submit.

To set up FortiSandbox:

1. Go to Security Fabric > Settings and enable SandBox Inspection. Set SandBox type to FortiSandbox Cloud. The associated FortiGate Cloud account appears.
2. In Security Profiles > AntiVirus, create a profile that has Send Files To FortiSandbox Cloud ForInspection
3. Create a firewall policy with logging enabled that uses the FortiSandbox-enabled AV profile.
4. Once devices have uploaded some files to FortiSandbox Cloud, log in to the FortiGate Cloud portal to see the results.

To go to the device list:

You can return to the device list from the Analysis, Management, or Sandbox page for an individual device.

1. In the upper left corner, click Show Device List.

Dashboard

You can see an overview of the FortiSandbox results on the Dashboard.

The Dashboard contains the following widgets:

Records and On-Demand

Records displays files that your connected device’s AV has flagged as suspicious, which have been uploaded to FortiGate Cloud for FortiGuard analysis. In On-Demand, you can manually upload files for FortiGuard analysis, and view the analysis results. These pages may not appear if you do not have the FortiSandbox Cloud service enabled on the connected device.

You can select an analysis level and click the file names for more information. On-Demand also has an Export option, which allows you to export a CSV or PDF of on-demand results, and Upload File, where you can manually upload a file for analysis.

The maximum file size is 10 MB. The processing time may vary based on the file size.

Setting

In Setting, you can configure FortiSandbox Cloud settings:

• Enable Alert Setting: to enable alert emails, enter multiple emails (one per line) to receive alerts, and set which severity level triggers sending alert emails.
• Log Retention: set number of days to retain log data.
• Malware Package Options and URL Package Options: select the risk level of data that will be automatically submitted to FortiGuard to further antithreat research.

To configure FortiSandbox alert emails:

1. Go to SandBox > Setting.
2. Select Enable Alert Setting.
3. Enter emails into the list to contact in the event of a FortiSandbox alert.
4. Select the severity levels to trigger an alert.

Inventory

Inventory displays a centralized inventory of all FortiGate and FortiWifi devices from all FortiGate Cloud instances in a domain group, regardless of datacenter. For example, if you are accessing Inventory from the European datacenter, you will see the inventory of a connected FortiGate Cloud instance from the global datacenter.

Inventory is divided into tabs: FortiGate Inventory, FortiCare Inventory, FortiGate Cloud Deployed, and FortiManager Deployed. You can filter each list by searching for the device serial number in the SN searchbar or selecting the desired bulk key from the Bulk Key dropdown list.

FortiGate Inventory

FortiGate Inventory displays the inventory of all FortiGate and FortiWifi devices imported by FortiCloud key or bulk key to FortiGate Cloud, including each device’s subscription status. The inventory provides a centralized view of all devices imported into the Europe and global services. From here, you can deploy devices to FortiGate Cloud or FortiManager, if configured. You can also delete an imported device from the inventory.

To deploy devices to FortiGate Cloud:

1. On the homepage, go to Inventory.
2. Select the desired devices.
3. Click Deploy to FortiGate Cloud.
4. In the Deploy to FortiGate Cloud dialog, if you have enabled multitenancy, configure the following options:

5. Configure the timezone for the selected devices.
6. Click Deploy. These devices are deployed to FortiGate Cloud, and you can now access them on the FortiGate Cloud Deployed

To deploy a device to FortiManager:

1. On the homepage, go to Inventory.
2. From the Deploy to FortiManager dropdown list, select FortiManagerSetup .

Inventory

3. In the FortiManagerSetup dialog, enter the desired FortiManager IP address/FQDN and serial number. Click Submit.
4. Select the desired devices.
5. Click Deploy to FortiManager.
6. Click Deploy. These devices are deployed to FortiManager, and you can now view their serial numbers on the FortiManagerDeployed Once deployed to FortiManager, FortiGate Cloud has no control over the device. You cannot manage the device in FortiGate Cloud until you set central management back to FortiGate Cloud.

To delete a device from inventory:

1. On the homepage, go to Inventory.
2. Select the desired devices.
3. Click Delete.
4. In the confirmation dialog, click YES.

FortiCare Inventory

FortiCare Inventory displays the devices that are registered to FortiCare under the account’s primary administrator email address. Only the primary administrator can view and deploy these devices from the FortiCare Inventory to FortiGate Cloud. To deploy FortiCare devices to FortiGate Cloud, follow the instructions described in To deploy devices to FortiGate Cloud: on page 40, from the FortiCare Inventory tab.

FortiGate Cloud Deployed and FortiManager Deployed

The FortiGate Cloud Deployed and FortiManagerDeployed tabs displays all FortiGate and FortiWifi devices deployed to FortiGate Cloud and FortiManager, respectively. The tabs also display the devices’ subscription statuses and the date and time that they were deployed to FortiGate Cloud or FortiManager. Click a device serial number to access Analysis, Management, and SandBox functions for that device.

The FortiGate Inventory tab provides a centralized view of all devices imported into the Europe and global services. However, after you deploy a FortiGate to FortiGate Cloud, you can only view the FortiGates deployed to the service that you are currently logged in to on the FortiGate Cloud Deployed tab. For example, if you are currently logged in to the Europe service, the FortiGate Cloud Deployed tab only displays FortiGates deployed to the FortiGate Cloud Europe service.

Multitenancy

The multitenancy account is a FortiGate Cloud premium account designed for MSSPs. A multitenancy account is a oneor five-year service for an administrator to create and manage multiple subaccounts. It also allows you to move devices between these accounts. You can allocate administrators to each subaccount with full or read-only access, allowing more control over a managed service’s provisioning.

After you activate multitenancy, FortiGate Cloud replaces the default Analysis, Management, and SandBox homepages with the multitenancy Analysis, Management, and SandBox homepages.

You can access management actions from the multitenancy homepage. Some actions are not unique to multitenancy and are described elsewhere in this document. For descriptions of these functions, see Analysis on page 16, Management on page 29, and SandBox on page 35.

To activate multitenancy:

1. Contact your Fortinet partner or reseller, requesting the following SKU: FCLE-10-FCLD0-161-02-DD. They email you a multitenancy activation code.
2. In the FortiGate Cloud interface, select the My Account
3. Under the admin/user list, select Activate multi-tenancy feature.
4. Enter the activation code, and click Submit.

To configure basic multitenancy:

1. On the Inventory page, select Import FortiCloud Key or Import Bulk Key to add multiple FortiGate Cloud licenses at once.
2. On the FortiGate Inventory subpage, select one or multiple devices, and select Deploy to FortiGate Cloud. Select the subaccount for the selected devices and template, if any. You can also select a timezone for the devices.
3. Click Deploy. The devices are moved to the FortiGate Cloud Deployed

To assign a device to a subaccount on the homepage:

Assigning a device to a new subaccount keeps the device data in FortiGate Cloud, including logs, reports, and configuration backup, and moves this data to the new subaccount. To delete this data, you must undeploy your device from FortiGate Cloud, then assign it to the desired subaccount.

You can assign a device to a different subaccount, including RMA devices.

1. On the multitenancy homepage, click the Config icon beside the desired device, then click Assign To.
2. In the Assign To dialog, select the desired subaccount, then click Submit.
3. In the confirmation dialog, click YES.

To manage subaccounts:

1. The multitenancy homepage lists subaccounts on the left panel. To manage a subaccount, click the desired subaccount. From the dropdown list, select the desired management action.
2. On the multitenancy page, click the My Account You can view all accounts associated with this FortiGate Cloud. Use the dropdown list to view Global, SubAccount, or All Users. You can see in this dialog that users have different roles. For descriptions of the roles, see User roles on page 44.
3. Click the Edit icon for the desired account.
4. In the My Account > Edit User dialog, for Manage Sub Account, select Selected. Select the desired subaccounts for this user to manage.

User roles

The multitenancy account includes different user roles. You can view users and their roles by clicking the My Account icon.

Admin (All)

The Admin (All) user can view and access all subgroups on the left pane, and use Management functions.

Admin (1)

The Admin (1) user can only access devices under the one subaccount assigned to them (and any child subaccounts), as shown in the left pane. They can access Management functions.

Regular (All)

The Regular (All) user has view-only access to all subgroups, but has no access to Management functions.

Regular (1)

The Regular (1) user has view-only access to devices under the subaccount assigned to them (and any child subaccounts), as shown in the left pane. In this example, the user is assigned access to the sub_2 subaccount, which means they can also view devices assigned to the sub_2_a and sub_2_b subaccounts, which are children of the sub_2 subaccount. The Regular (1) user cannot access Management functions.

Group management

Multitenancy also enables group management actions. You can apply actions to a group of FortiGate and FortiWifi devices, simplifying administrative tasks.

Some group management actions require that you enable management on the selected device. See Management on page 29.

You can access group management actions from the Analysis and Management homepages when multitenancy is enabled.

Some actions are not unique to group management and are described elsewhere in this document in the context of use on a single device; multitenancy simply offers the ability to apply the action to multiple devices. For descriptions of these functions, see the following topics:

The following describes actions exclusive to group management:

To view group task status:

You can view the current status of group management actions.

1. On the Management homepage, click Group Management > Task Status. The Group Task Status displays the group management actions and their statuses. You can click # devices beside the task type to view the devices

that the group management action was applied to.

Templates

You can create device configuration templates and deploy different templates to applicable devices to simplify device management. FortiGate Cloud applies the template to the selected devices.

To create a template:

1. On the Management homepage, click Group Management > Manage Templates.
2. Click Create Template.
3. In the Name field, enter the desired template name.
4. In the Description field, enter the desired template description.
5. For Create template based on, select one of the following:

6. For Feature set, select the desired features.
7. For Sub Account, select the desired sub account for this template.
8. Click Apply.

To apply a template to devices:

1. On the Management homepage, select the desired devices
2. Click Group Management > Use Templates.
3. In the Use Templates dialog, select the desired template. The dialog only shows templates applicable for the current selected devices.
4. Click Apply. FortiGate Cloud applies the template to the selected devices.

To revoke templates from devices:

1. On the Management homepage, select the desired devices.
2. Click Group Management > Un-use Templates.
3. Click Apply. FortiGate Cloud revokes the templates from the selected devices.

To edit a template:

1. On the Management homepage, go to Group Management > Manage Templates.
2. Click the Edit icon for the desired template.
3. For a template that has already been applied to devices, you can configure device-specific settings:
   1. Go to the desired configuration page, then expand Device Specific Settings.
   2. Click Create New.
   3. In the New Device Specific Settings dialog, select the desired device’s serial number from the SN dropdown list.
   4. To configure a device-specific setting, enable Override Template Setting, then configure the desired option. Otherwise, FortiGate Cloud applies the template setting to the device. Click OK.

The example configures a device-specific setting for the time zone using Cape Verde Island time, which differs from the template setting, which uses Jerusalem time.

IOC

FortiGate Cloud IOC alerts administrators about newly found infections and threats to devices in their network. By analyzing UTM logging and activity, IOC provides a comprehensive overview of threats to the network.

IOC detects three threat types, based on the evolving FortiGuard database:

The free version of IOC is currently available on all accounts in the North America datacenter. The free version alerts you to threats and automatically prepares a comprehensive threat report. Threats listed only provide infected devices’ partial IP addresses: server and subnet.

A subscription grants access to IP address whitelisting, which allows you to narrow your malware search by excluding safe IP addresses and domains, and alert emails to notify you directly of detected network threats. You can also view infected devices’ full IP addresses, allowing you to better control their access to your network.

To purchase an IOC subscription:

1. Open the Plan page in the FortiGate Cloud IOC site, and select Buy Online.
2. Complete the purchase process, and wait for the key to arrive by email.
3. Log into the Fortinet Support website.
4. On the Asset page, register the code as if it were a new product’s serial number, and then enter the serial number of the FortiGate Cloud-connected device that you want the service to monitor. The service automatically takes effect.

To access IOC using a non-multitenancy account:

1. In the FortiGate list, click the Threats/Suspicious label under System Status. This only appears if the FortiGate has detected any threats.

To access IOC using a multitenancy account:

1. In the FortiGate list, look to the right. If your FortiGate has detected any threats, a bomb icon is visible. Click the bomb icon.

FortiDeploy

FortiDeploy is a product built into FortiGate Cloud for one-touch provisioning when devices are deployed locally or remotely. FortiDeploy provides automatic connection of FortiGates to be managed by FortiGate Cloud or a FortiManager.

At time of purchase, you can order a FortiDeploy SKU in addition to your FortiGate Cloud subscription.

When you visit the FortiGate Cloud portal and enter the bulk FortiGate Cloud key, you see a list of serial numbers from the order that contained the FortiDeploy SKU. After you confirm that the devices are connected, you can perform basic configuration on the devices remotely, such as sending a FortiManager IP address to all remote FortiGates, so that the FortiManager can manage them remotely.

FortiDeploy support starts the moment you send an email to cs@fortinet.com. You can also contact cs@fortinet.com if you have already purchased a FortiGate Cloud subscription and want to purchase FortiDeploy to add to your existing subscription.

FortiDeploy is available for FortiGate, FortiWiFi, and PoE desktop and 1U models up to the 900D. It is recommended for trained personnel to handle larger deployments. FortiDeploy is available for devices running FortiOS 5.2.2 and later.

To enable autojoining FortiGate Cloud:

From FortiOS 5.2.3 and later, the auto-join-forticloud option is enabled by default. It must be enabled for FortiDeploy to function correctly. You can ensure that the option is enabled by running the following commands:

config system fortiguard set auto-join-forticloud enable

end

After changing this setting, restart the device and ensure that the device is sending traffic to FortiGate Cloud to verify that you have configured it correctly.

To set central management to FortiGuard:

If your device is connected to FortiGate Cloud but not cloud-managed, ensure that central management is set to FortiGuard:

config system central-management set type fortiguard

end

Reboot the device, log into FortiGate Cloud, and see if you can manage the device.

To use FortiDeploy with a device deployed behind a NAT device:

The default address of the internal or LAN interface is the 192.168.1.0/24 subnet. IP conflicts can occur with departmentalization devices. You can unset each device’s default IP address:

config system interface edit internal unset ip

end end

FortiDeploy

config system interface edit lan unset ip

end

end

You can change the web-based management interface’s internal interface IP address in Network > Interfaces.

Set up FortiDeceptor

This section explains the initial set up of FortiDeceptor.

Connect to the GUI

Use the GUI to configure and manage FortiDeceptor.

To connect to the FortiDeceptor GUI:

1. Connect the port1 (administration) interface of the device to a management computer using an Ethernet cable.
2. Configure the management computer to be on the same subnet as the internal interface of the FortiDeceptor unit:
   • Change the IP address of the management computer to 168.0.2.
   • Change the IP address of the network mask to 255.255.0.
3. Go to https://192.168.0.99.
4. Type admin in the Name field, leave the Password field blank, and click Login.

You can now proceed with configuring your FortiDeceptor unit.

Connect to the CLI

You can use CLI commands to configure and manage FortiDeceptor.

To connect to the FortiDeceptor CLI:

1. In the FortiDeceptor banner at the top, click the CLI Console

The CLI Console pane opens.

2. If necessary, click Connect and enter your username and password.

The CLI Console pane has icons to disconnect from the CLI console, clear console text, download console text, copy console text, open the CLI console in its own window, and close the console.

3. To close the CLI console, click the Close

Change the system hostname

The System Information widget displays the full host name. You can change the FortiDeceptor host name.

To change the host name:

1. Go to Dashboard, System Information
2. Click Change beside Host Name.
3. In the New Name field, type a new host name.

The hostname can start with a character or digit, and cannot end with a hyphen. A-Z, a-z, 0-9, or hyphen are allowed (case-sensitive). Other symbols, punctuation, or white space are not allowed.

4. Click Apply.

Change the administrator password

By default, you can log in to the GUI using admin and no password. It is highly recommended that you add a password to the admin account. For better security, regularly change the admin account password and the passwords for any other administrator accounts that you add.

To change the password of the logged in administrator:

1. In the FortiDeceptor banner at the top, click the username and select Change Password.
2. Change the password and click OK.

To change the administrator password in the Administrators page:

1. Go to System > Administrators.
2. Select an administrator and click Edit.
3. Change the password and click OK.

Configure the system time

You can change the FortiDeceptor system time in the Dashboard. You can configure the FortiDeceptor system time manually or synchronize with an NTP server.

To configure the system time:

1. Go to Dashboard, System Information
2. Click Change beside System Time.
3. Set the system time and click Apply. You might need to log in again.

Deploy Decoy VM

Use the Deception pages allows you to deploy Decoy VMs on your network. When a hacker gains unauthorized access to Decoy VMs, their movements can be monitored to understand how they attack the network.

Apart from the default decoy Windows, Linux, or SCADA OS images, FortiDeceptor supports custom OS images with a purchased subscription service. You can upload your custom ISO images and install the FortiDeceptor Toolkit on the image. For instructions, click the Help icon in the toolbar and select Customization.

To use FortiDeceptor to monitor the network:

• Go to Deception > Deception OS to check the Deception OS available. See View available Deception OS on page

9. 9. l Go to Deception > Deployment Network to auto-detect or specify the network where the Decoy VMs are deployed.

• Go to Deception > Deployment Wizard to deploy the Decoy VM on the network.
• Go to Deception > Decoy & Lure Status to start or stop deployed Decoy VMs, or download the FortiDeceptor Token Package to manually install on computers. l Go to Deception > Decoy Map to see the network of Decoy VMs.
• Go to Deception > Whitelist to specify the network that is to be considered safe. This is useful if the administrator wants to log into the deployment network and not be flagged as an attacker.

View available Deception OS

The Deception > Deception OS page lists the deception OSes available for creating Decoy VMs.

Set up the Deployment Network

Use the Deception > Deployment Network page to set up a monitoring interface into a VLAN or a subnet.

To add a VLAN or subnet to FortiDeceptor:

1. Go to Deception > Deployment Network.
2. Enable Auto VLAN Detection to automatically detect the VLANs on your network.

Auto VLAN detection allows FortiDeceptor to detect the available VLANs on the deployment network interface and display them in the GUI. You can select and add the VLANs for the deployment of Decoys later.

3. Select the Detection Interface and click OK.

You can select multiple ports.

4. Click Add New VLAN/Subnet to manually add a VLAN or a subnet. Configure the following settings:

5. Click Save.

The network IP/mask must be an IP address and not a subnet.

You must use the following guidelines to set the network IP/mask:

• Interface name and VLAN ID must be unique among all network IP/masks.
• If VLAN ID is 0, the network IP/mask must be unique among all the network IP/masks without VLAN and all system interfaces.
• If VLAN is not 0, the network IP/mask must be unique among all subnets in the same VLAN.

Deploy Decoy VMs with the Deployment Wizard

Use the Deception > Deployment Wizard page to create and deploy Decoy VMs on your network. Decoy VMs appear as real endpoints to hackers and can collect valuable information about attacks.

To deploy Decoys on the network:

1. Go to Deception > Deployment Wizard.
2. Click + to add a Decoy VM.
3. Configure the following:

4. For an Ubuntu VM, turn on SSH or SAMBA. For Windows, turn on RDP or SMB.

For SCADA, turn on HTTP, FTP, TFTP, SNMP, MODBUS, S7COMM, BACNET, IPMI, TRICONEX, GUARDIANAST, or IEC104.

5. Click Add Lure for the service and configure the following:

6. To launch the decoy VM immediately, enable Launch Immediately.
7. To reset the decoy VM after it detects incidents, enable Reset Decoy and specify the Reset Interval value in seconds.
8. Click Next.
9. The Hostname can start with an English character or a digit, and must not end with a hyphen. Maximum 15 characters using A-Z, a-z, 0-9, or hyphen (case-sensitive). Other symbols, punctuation, or white space are not allowed. The Hostname cannot conflict with decoy names.
10. Click Add Interface.
11. Select the Deploy Interface. Set this to the VLAN or subnet added in Set up the Deployment Network on page 10
12. Configure the following settings in the Add Interface forDecoy pane:

13. Click Done.
14. To deploy the decoys on the network, click Deploy.
15. To save this as a template in Deception > Deployment Wizard, click Template.

Deploy the FortiDeceptor Token Package

Use a FortiDeceptor Token Package to add breadcrumbs on real endpoints and lure an attacker to a Decoy VM. Tokens are normally distributed within real endpoints and other IT assets on the network to maximize the deception surface.

To download a FortiDeceptor Token Package:

1. Go to Deception > Decoy & Lure Status.
2. Select the Decoy VM by clicking its checkbox.
3. To download the FortiDeceptor Token Package, click Download Package.

You can only download packages with valid IP addresses. A package must have a status of Initialized, Stopped, Running, or Failed.

To deploy or uninstall a FortiDeceptor Token Package on an existing endpoint:

1. Copy the downloaded FortiDeceptor Token Package to an endpoint such as a Windows or Linux endpoint.
2. Unzip the FortiDeceptor Token Package.
3. In the folder for the OS, such as windows or ubuntu, follow the instructions in txt to install or uninstall the Token Package.

l For Windows, open the windows folder, right-click windows_token.exe and select Run as administrator. l For Ubuntu, open Terminal and run python ./ubuntu_token.py.

When the FortiDeceptor Token Package is installed on a real Windows or Ubuntu endpoint, it increases the deception surface and lures the attacker to a Decoy VM.

Monitor Decoy & Lure Status

The Deception > Decoy & Lure Status page shows the status of the Decoys on your network.

We recommend operating Decoy VMs with the same status for expected behavior.

To view the Deception Status:

1. Go to Deception > Decoy & Lure Status.

To delete one or more Decoy VMs:

1. Go to Deception > Decoy & Lure Status.
2. Click Delete beside the Decoy VM.
3. Click OK.

To start one or more Decoy VM:

1. Go to Deception > Decoy & Lure Status.
2. Select one or more Decoy VMs that are stopped.
3. Click Start.

To stop one or more Decoy VMs:

1. Go to Deception > Decoy & Lure Status.
2. Select one or more Decoy VMs that are running.
3. Click Stop.

Decoy Map

Deception > Decoy Map is a visual representation of the entire network showing real endpoints and Decoy VMs. You can apply filters to focus on specific decoys.

To work with the Decoy Map:

1. Go to Deception > Decoy Map. l To change the display, drag items to another location. l Scroll to zoom in or out.

l Click a node to see its information.

2. Click Click to begin filtering to select a filter type and type values. Filter types include Decoy Name, Decoy IP, and Lure Type.

You can use multiple arguments with different filter types. All filter arguments and time indicator arguments are considered “AND” conditions.

3. To locate the node on the map, use the LOCATE BY IP
4. To save a snapshot of the map, click Save view .

Configure a Whitelist

Use the Deception > Whitelist page to add an IP address for an administrator to log into the network. User actions from a whitelisted IP address are recorded as an Event or Incident.

To add a new whitelist IP address:

1. Go to Deception > Whitelist.
2. Click Add New Whitelist IP and configure its settings:

DMZ Mode

Deploy a FortiDeceptor hardware unit or VM in the Demilitarized Zone (DMZ). You can monitor attacks on the DMZ network when FortiDeceptor is installed in the DMZ network.

Limitations of the DMZ Mode

The DMZ Mode in FortiDeceptor functions like regular mode with the following exceptions:

• When DMZ mode is enabled, the banner displays DMZ-MODE.
• In Deception > Deployment Network, Deception MonitorIP/Mask is hidden. See Set up the Deployment Network on page 10.
• In Deception > Decoy & Lure Status in the Deception Status view, the Attack Test selection is disabled.
• Decoy VMs are limited to one deploy Interface. For information about IP address range, see Deploy Decoy VMs with the Deployment Wizard on page 10.

To enable DMZ mode in the CLI:

dmz-mode -e

To disable DMZ mode in the CLI: dmz-mode -d

Monitor Attacks

Administrators can monitor attacks in two ways:

To monitor attacks using Incident pages:

• Incident > Analysis lists incidents and related events detected by FortiDeceptor. l Incident > Campaign lists attacks and related events detected by FortiDeceptor. l Incident > Attack Map shows attacks and related events detected by FortiDeceptor.

To monitor attacks using Dashboard widgets:

• Use the Dashboard Incidents & Events Distribution See Incidents and Events Distribution on page 18. l Use the Dashboard Incidents & Events Count widget.

Analysis

Incident > Analysis lists the Incidents detected by FortiDeceptor.

To use the Analysis page:

1. Go to Incident > Analysis.
2. The Analysis page displays the list of events:

3. To refresh the data, click Refresh.
4. To download the detailed analysis report in PDF format, click Export to PDF.
5. To mark items as read, expand the incident details or click Mark all as read.

Newly-detected incidents are in bold to indicate they are unread.

6. To display specific types of events, click Show All, IPS Events Only, or Web FilterEvents Only.
7. To specify columns and table settings, use the Settings icon at the bottom right.

Campaign

Incident > Campaign lists the Attacks detected by FortiDeceptor. An Attack consists of multiple Incidents.

To use the Campaign page:

1. Go to Incident > Campaign.
2. The Campaign page displays the list of attacks:

3. To refresh the data, click Refresh.
4. To export the data, click Export to PDF.
5. To specify columns and table settings, use the Settings icon at the bottom right.

Attack Map

Incident > Attack Map is a visual representation of the entire network showing real endpoints, Decoy VMs, and ongoing attacks.

To work with the Attack Map:

1. Go to Incident > Attack Map. l To change the display, drag items to another location. l Scroll to zoom in or out. l Click a node to see its information.
2. At the bottom of the Attack Map, use the timeline indicator to set the start and end time.
3. Click Click to begin filtering to select a different filter type and type values. Filter types include AttackerIP, Victim IP, and Decoy IP.

You can use multiple arguments with different filter types. All filter arguments and time indicator arguments are considered “AND” conditions.

4. To locate the node on the map, use the LOCATE BY IP
5. To save a snapshot of the map, click Save view .

Incidents and Events Distribution

This dashboard widget displays the number of incidents and events with the following risk level information and options.

Hover over the pie chart to see the number of Incidents or Events and their percentage.

To customize this widget:

1. Click the edit icon to make the following changes:

l Enter a Customized Widget Title. l Change the Refresh Interval. l Select a Time Period: Last 24 Hours, Last 7 Days, or Last 4 Weeks.

Incidents and Events Count

This dashboard widget displays the number of Incidents and Events.

To customize this widget:

1. Click the edit icon to make the following changes:

l Enter a Customized Widget Title. l Change the Refresh Interval. l Select a Time Period: Last 24 Hours, Last 7 Days, or Last 4 Weeks.

Top 10 Attackers by Events

This dashboard widget displays the top ten attackers by the number of events.

Top 10 Attackers by Incidents

This dashboard widget displays the top ten attackers by the number of incidents.

Top 10 IPS Attacks

This widget displays the top 10 IPS attacks by the number of attack events.

Incidents Distribution by Service

This dashboard widget displays the number of Incidents by service with the following information and options.

Global Attacker Distribution

This widget displays the number of Attackers by country on a global map.