WEBVTT 1 00:00.000 --> 00:04.080 So now that we have all of our data, log and event information sent over to the 2 00:04.080 --> 00:05.280 40 analyzer, 3 00:05.280 --> 00:09.440 the next thing we should take a look at is how to actually work with those logs 4 00:09.440 --> 00:10.160 that are sitting 5 00:10.160 --> 00:14.390 here at the 40 analyzer. And one of the challenges with 40 analyzers is that 6 00:14.390 --> 00:15.360 there's more than just 7 00:15.360 --> 00:20.220 one way to look at and search for logs and events that are happening. So I'm 8 00:20.220 --> 00:21.520 going to start off with 9 00:21.520 --> 00:25.700 basic old logs that are being sent from the 40 gates over to the 40 analyzer 10 00:25.700 --> 00:26.080 and give you some 11 00:26.080 --> 00:30.700 examples in action of looking for and working with logs. So to start off, I'm WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:26.080 --> 00:30.700 examples in action of looking for and working with logs. So to start off, I'm 12 00:30.700 --> 00:31.600 going to log back 13 00:31.600 --> 00:35.870 into 40 analyzer and click log in. And also while we're right here at the 14 00:35.870 --> 00:37.360 initial steps for the 40 15 00:37.360 --> 00:40.680 analyzer, let me also walk you through how we could change a few settings 16 00:40.680 --> 00:41.920 should we need to. 17 00:41.920 --> 00:44.500 So right here, we have this widget for system information. I'll go ahead and 18 00:44.500 --> 00:45.280 make that bigger. 19 00:45.280 --> 00:49.100 So there's the host name, the serial number, the platform, the version, and how 20 00:49.100 --> 00:49.840 long it's been up. 21 00:49.840 --> 00:53.690 So if we wanted to use administrative domains, what we would do is click right 22 00:53.690 --> 00:54.800 here, boom, 23 00:54.800 --> 00:59.380 and enable administrative domains. That way, various firewalls and various Vd 24 00:59.380 --> 01:00.560 oms could be put into WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 24 00:59.380 --> 01:00.560 oms could be put into 25 01:00.560 --> 01:03.410 separate administrative domains. And that way you could have four or five 26 01:03.410 --> 01:04.480 different administrators 27 01:04.480 --> 01:08.420 responsible for different parts of the network. And you wouldn't have one giant 28 01:08.420 --> 01:09.840 blob of aggregated 29 01:09.840 --> 01:13.630 data you could segment it with administrative domains. So that's how you enable 30 01:13.630 --> 01:14.320 it right here. 31 01:14.320 --> 01:18.330 And then when you log on, you'd log on to a specific administrative domain. So 32 01:18.330 --> 01:19.040 I'm not going to enable 33 01:19.040 --> 01:22.000 that yet. So I'll click on cancel there. The second thing I want to share with 34 01:22.000 --> 01:22.640 you that we talked 35 01:22.640 --> 01:26.800 about in the overview was the operation mode. So if we're in analyzer mode, 36 01:26.800 --> 01:27.840 which is the default, 37 01:27.840 --> 01:31.040 that means we can run the reports from here, we can dig into the details of the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 37 01:27.840 --> 01:31.040 that means we can run the reports from here, we can dig into the details of the 38 01:31.040 --> 01:32.400 logs, do everything. 39 01:32.400 --> 01:35.330 And that's the basic way we think about a 40 analyzer. However, if you want 40 01:35.330 --> 01:37.040 this device to be a collector 41 01:37.040 --> 01:40.480 as an intermediate to collect the login information and to forward them off to 42 01:40.480 --> 01:41.520 another 40 analyzer, 43 01:41.520 --> 01:44.960 we click that button right there to tell this 40 analyzer to be in collector 44 01:44.960 --> 01:45.840 mode. So I'm going 45 01:45.840 --> 01:48.630 to leave it in analyzer mode. So I'll click on cancel there. But I also want to 46 01:48.630 --> 01:49.040 share with you 47 01:49.040 --> 01:52.560 how to do that. So go ahead and restore that to its normal size. And let's just 48 01:52.560 --> 01:53.440 confirm real quick 49 01:53.440 --> 01:58.270 with device manager that we have all of our 40 gates reporting, which they are 50 01:58.270 --> 01:58.960 fantastic. 51 01:58.960 --> 02:02.720 The branch is by itself. And then as part of our fabric, we have firewall one, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 51 01:58.960 --> 02:02.720 The branch is by itself. And then as part of our fabric, we have firewall one, 52 02:02.720 --> 02:04.080 two, and three. So 53 02:04.080 --> 02:07.280 let's start off with log view. Now there's a thing called 40 view as well, 54 02:07.280 --> 02:08.720 which gives us like a 55 02:08.720 --> 02:12.810 summarized grouping of information we'll cover that separately later. But let's 56 02:12.810 --> 02:13.440 start off with 57 02:13.440 --> 02:16.970 log view. And then let's go to 40. So when click around 40 gate from our 58 02:16.970 --> 02:18.000 previous video, I had 59 02:18.000 --> 02:21.850 left this at firewall to so we go ahead and let me go ahead and select all 60 02:21.850 --> 02:23.280 devices, click on okay. 61 02:23.280 --> 02:26.300 And then if we want to also we can click on refresh, if we thought there might 62 02:26.300 --> 02:27.200 be new data is coming 63 02:27.200 --> 02:31.980 in. So this is all the logs from all of the reporting, 40 gate devices. Now WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 63 02:27.200 --> 02:31.980 in. So this is all the logs from all of the reporting, 40 gate devices. Now 64 02:31.980 --> 02:32.480 currently we're 65 02:32.480 --> 02:36.130 looking at traffic logs as identified by this tab being selected. But there's 66 02:36.130 --> 02:36.880 also logs that we 67 02:36.880 --> 02:40.430 could look at regarding security. And there's also logs regarding events. So if 68 02:40.430 --> 02:41.200 we go to security, 69 02:41.200 --> 02:45.710 there's options for these security logs. And there's also events for these 70 02:45.710 --> 02:46.640 types of events. 71 02:46.640 --> 02:49.570 So right now we're just looking at traffic logs because this is selected. Now I 72 02:49.570 --> 02:50.240 've also noticed 73 02:50.240 --> 02:54.240 that on various different versions of 40 analyzer, they change the screens a 74 02:54.240 --> 02:55.200 little bit from time 75 02:55.200 --> 02:58.060 to time. And that's okay. So I'm gonna give us a little more real estate by 76 02:58.060 --> 02:59.040 collapsing the left 77 02:59.040 --> 03:02.450 hand column. So we're under log view, 40 gate, I'll go ahead and collapse that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 77 02:59.040 --> 03:02.450 hand column. So we're under log view, 40 gate, I'll go ahead and collapse that 78 03:02.450 --> 03:03.360 and that'll give us a 79 03:03.360 --> 03:07.020 little more room to work here. Now in a slightly older version of 40 analyzer, 80 03:07.020 --> 03:07.840 they had a little 81 03:07.840 --> 03:12.110 icon for a wrench for tools. But now we have an option called more. And that 82 03:12.110 --> 03:12.720 can give us these 83 03:12.720 --> 03:16.800 additional options. So if we click on more here, we can go to real time log. 84 03:16.800 --> 03:17.840 And with real time log, 85 03:17.840 --> 03:21.720 it's going to push the logs as they come in. So you're gonna see updates as 86 03:21.720 --> 03:22.800 those computers on the 87 03:22.800 --> 03:26.310 network are generating traffic and going through the firewall. Now even in real 88 03:26.310 --> 03:27.120 time view here, 89 03:27.120 --> 03:31.090 if we want to pause it, we can use this pause icon right here, simply pause it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 89 03:27.120 --> 03:31.090 if we want to pause it, we can use this pause icon right here, simply pause it. 90 03:31.090 --> 03:31.760 And that would 91 03:31.760 --> 03:36.560 keep it from scrolling and moving until we clicked on go again. Or if we go to 92 03:36.560 --> 03:37.360 the more and go to 93 03:37.360 --> 03:41.160 historical log, that's just going to show us what's there without refreshing 94 03:41.160 --> 03:42.720 automatically. However, 95 03:42.720 --> 03:46.100 even here with historical log, if we want to click on refresh, that'll cause 96 03:46.100 --> 03:46.800 the refresh to 97 03:46.800 --> 03:49.520 happen. So we can see the latest and greatest information. And then for any of 98 03:49.520 --> 03:50.000 these logs, 99 03:50.000 --> 03:53.680 we could double click on it to get more information regarding that specific log 100 03:53.680 --> 03:54.000 event, 101 03:54.000 --> 03:57.540 including the firewall that reported it, the source IP address of the device, 102 03:57.540 --> 03:58.000 where that traffic 103 03:58.000 --> 04:02.570 came into the firewall on port four, the user ad dash user one, and also where WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 103 03:58.000 --> 04:02.570 came into the firewall on port four, the user ad dash user one, and also where 104 04:02.570 --> 04:04.000 they were going 105 04:04.000 --> 04:08.550 and the activity associated with that in the application recognized with HTTPS. 106 04:08.550 --> 04:09.200 And a protocol 107 04:09.200 --> 04:13.530 six, that's the number for TCP has information on the duration and number of 108 04:13.530 --> 04:14.720 packets and so forth. 109 04:14.720 --> 04:18.200 And as we continue to scroll down, additional information on the authentication 110 04:18.200 --> 04:18.800 server used 111 04:18.800 --> 04:22.290 to identify that user, which is right there. Also the centralized source net 112 04:22.290 --> 04:23.040 rule that it went 113 04:23.040 --> 04:26.810 through and the actual name of the policy that permitted that traffic to go 114 04:26.810 --> 04:27.920 through. So I'll go 115 04:27.920 --> 04:31.330 ahead and close that now. Another option that we have is that we can actually WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 115 04:27.920 --> 04:31.330 ahead and close that now. Another option that we have is that we can actually 116 04:31.330 --> 04:32.480 look at these logs 117 04:32.480 --> 04:37.060 in a raw format, not formatted. So to do that, we click on more. And then from 118 04:37.060 --> 04:37.760 the dropdown, 119 04:37.760 --> 04:41.080 we can go ahead and select raw log, or if you want to see the formatted logs 120 04:41.080 --> 04:41.600 again, 121 04:41.600 --> 04:45.570 we could go back to more and select formatted log. Now also, as we look at this 122 04:45.570 --> 04:46.480 traffic log, 123 04:46.480 --> 04:51.360 we're currently looking at all devices. And it's also showing us for any time, 124 04:51.360 --> 04:52.160 we're not putting a 125 04:52.160 --> 04:55.800 date range, for example, we could say we want to look for traffic logs within 126 04:55.800 --> 04:56.960 the last, for example, 127 04:57.840 --> 05:01.760 seven days, or we could do a custom look up, we say, you know what, I want it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 127 04:57.840 --> 05:01.760 seven days, or we could do a custom look up, we say, you know what, I want it 128 05:01.760 --> 05:03.440 between start time of 129 05:03.440 --> 05:09.250 January 1st, 1970, all the way to July 20th, 2025, click on Okay. And then it 130 05:09.250 --> 05:10.400 would only show us the 131 05:10.400 --> 05:14.980 logs in that range, which based on the state, that's everything going way, way 132 05:14.980 --> 05:16.160 back. So we asked 133 05:16.160 --> 05:19.240 for traffic, for example, in the last five minutes, we could select that. And 134 05:19.240 --> 05:20.400 that would show us only 135 05:20.400 --> 05:24.630 the last five minutes, in this case, of traffic logs, and it was here, there's 136 05:24.630 --> 05:25.600 only four pages, 137 05:25.600 --> 05:28.770 where if we said, you know what, let's take a look at the last seven days, then 138 05:28.770 --> 05:29.600 we have a lot more 139 05:29.600 --> 05:33.700 pages to deal with. All right, I'm gonna go to page one, I'm gonna go ahead and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 139 05:29.600 --> 05:33.700 pages to deal with. All right, I'm gonna go to page one, I'm gonna go ahead and 140 05:33.700 --> 05:35.040 specify for this 141 05:35.040 --> 05:39.310 anytime, again, showing the logs for all devices for all time. Now, in addition 142 05:39.310 --> 05:39.920 to looking at the 143 05:39.920 --> 05:43.240 traffic logs, we can also look at these security logs. So we have quite a few 144 05:43.240 --> 05:44.320 options. Now, one 145 05:44.320 --> 05:48.610 thing you'll discover on a new 40 analyzer is that if it hasn't seen, for 146 05:48.610 --> 05:50.640 example, security 147 05:50.640 --> 05:54.890 information security logs regarding antivirus or IPS or application control, 148 05:54.890 --> 05:55.680 etc, they mean 149 05:55.680 --> 05:58.880 that show up here. So it doesn't mean it's broken or you're lacking a license. 150 05:58.880 --> 06:00.480 It simply means that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 150 05:58.880 --> 06:00.480 It simply means that 151 06:00.480 --> 06:05.190 it doesn't have any in the logs yet that can show you. So if we go to summary, 152 06:05.190 --> 06:05.760 this is going to show 153 06:05.760 --> 06:11.450 us the widgets for antivirus web filter SSL, DNS queries, and also take a look 154 06:11.450 --> 06:12.720 at the time it set 155 06:12.720 --> 06:17.280 is for the last hour. So if we said, you know what, let's go ahead and say last 156 06:17.280 --> 06:19.360 , how about last three 157 06:19.360 --> 06:21.950 weeks, then it's going to put that filter. And now it's going to include 158 06:21.950 --> 06:22.880 additional information, 159 06:22.880 --> 06:25.740 because we're asking it to look at a longer period of time. So there's an 160 06:25.740 --> 06:26.560 incident or something 161 06:26.560 --> 06:30.430 happened, you want to narrow it down to a narrow range of time, we could do it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 161 06:26.560 --> 06:30.430 happened, you want to narrow it down to a narrow range of time, we could do it 162 06:30.430 --> 06:32.240 right here. So now 163 06:32.240 --> 06:36.680 we have an antivirus file that was seen, we have some web filter events DNS 164 06:36.680 --> 06:38.320 queries, we have 165 06:38.320 --> 06:41.630 application firewall and SSL events as well. And if you wanted to narrow this 166 06:41.630 --> 06:42.320 down, we could go 167 06:42.320 --> 06:46.090 ahead and say, you know, let's take a look at just web filter events. So it 168 06:46.090 --> 06:47.680 looks like we have some 169 06:47.680 --> 06:51.680 policies in place that are monitoring traffic, but it looks like everything is 170 06:51.680 --> 06:52.160 being allowed 171 06:52.160 --> 06:55.260 through. So if we wanted to right click here, I'm passed through and say, you 172 06:55.260 --> 06:55.840 know what, 173 06:55.840 --> 07:00.080 let's go ahead and let's put a filter in place where the action is not passed WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 173 06:55.840 --> 07:00.080 let's go ahead and let's put a filter in place where the action is not passed 174 07:00.080 --> 07:00.960 through, then we 175 07:00.960 --> 07:06.940 could go ahead and see blocks. So here are the 123456789 blocks that have 176 07:06.940 --> 07:08.160 happened based on web 177 07:08.160 --> 07:12.030 filtering on the 40 analyzer coming from any possible device. So we could drill 178 07:12.030 --> 07:12.560 down into one 179 07:12.560 --> 07:16.350 of these, for example, let's go ahead and drill down into this one right here, 180 07:16.350 --> 07:16.960 we'll just go 181 07:16.960 --> 07:20.620 ahead and double click on it. And if we look at the details, it'll tell us the 182 07:20.620 --> 07:21.360 action of blocked 183 07:21.360 --> 07:26.060 right there. It's also indicating here why it was blocked because of a web 184 07:26.060 --> 07:27.280 filtering policy, 185 07:27.280 --> 07:31.520 denying access to any categories of websites that are based on alcohol. Where WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 185 07:27.280 --> 07:31.520 denying access to any categories of websites that are based on alcohol. Where 186 07:31.520 --> 07:32.240 if we take a look at 187 07:32.240 --> 07:35.820 this one right here and click on it, this was also blocked. There's the URL is 188 07:35.820 --> 07:36.560 trying to go to, 189 07:36.560 --> 07:40.080 which is a test malware site. And the reason for that it was another category 190 07:40.080 --> 07:41.520 of malicious websites. 191 07:41.520 --> 07:45.220 So the idea I want to share here is that we can get very granular with what we 192 07:45.220 --> 07:46.240 want to look at, 193 07:46.240 --> 07:50.490 where it's coming from, including what ranges of time we want to look at. So 194 07:50.490 --> 07:51.360 let's also have a 195 07:51.360 --> 07:54.710 little fun with this. Let me go ahead and remove the filter sitting looking for 196 07:54.710 --> 07:55.840 just the blocked. 197 07:55.840 --> 07:58.820 So I'm looking at web filter activity, because that's what's selected here from 198 07:58.820 --> 07:59.520 all devices, 199 07:59.520 --> 08:03.280 any possible time. And let's go back to summary. And let's take a look at the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 199 07:59.520 --> 08:03.280 any possible time. And let's go back to summary. And let's take a look at the 200 08:03.280 --> 08:03.920 widget here for 201 08:03.920 --> 08:07.860 web filter. So if we look at web filters, scroll down, wow, look at this proxy 202 08:07.860 --> 08:09.600 avoidance. So if 203 08:09.600 --> 08:14.290 we have policies in place that are supposed to not allow customers to try to 204 08:14.290 --> 08:15.520 bypass our proxies, 205 08:15.520 --> 08:19.980 it appears here, based on proxy avoidance and the action of pass through, it 206 08:19.980 --> 08:20.720 appears here that 207 08:20.720 --> 08:25.410 we have failed because we have some proxy avoidance, but we have pass through 208 08:25.410 --> 08:27.200 and 307 in the count field 209 08:27.200 --> 08:31.160 here. So we click on proxy avoidance, it automatically puts a filter in where WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 209 08:27.200 --> 08:31.160 here. So we click on proxy avoidance, it automatically puts a filter in where 210 08:31.160 --> 08:32.160 the action is passed 211 08:32.160 --> 08:35.420 through category description is proxy avoidance. And then we can take a look at 212 08:35.420 --> 08:36.320 what's going on, 213 08:36.320 --> 08:41.760 including who's doing it. So looks like user to here, has a whole bunch of 214 08:41.760 --> 08:43.680 proxy avoidance 215 08:43.680 --> 08:47.200 websites they've been going to. And that would be absolutely something we'd 216 08:47.200 --> 08:48.160 want to look into. 217 08:48.160 --> 08:51.460 So if it's a problem with our policy, we don't have fix our policy to specify 218 08:51.460 --> 08:52.000 that we don't want 219 08:52.000 --> 08:55.370 to just allow that traffic, we want to go ahead and block it if the customer is 220 08:55.370 --> 08:56.480 trying to go to 221 08:56.480 --> 09:00.500 proxy avoidance types of websites. So if we grab one of these, let's go ahead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 221 08:56.480 --> 09:00.500 proxy avoidance types of websites. So if we grab one of these, let's go ahead 222 09:00.500 --> 09:01.600 and let's grab this 223 09:01.600 --> 09:05.340 right here, I'll just double click on it to bring it up. As we scroll down, it 224 09:05.340 --> 09:06.880 's 80 user two at this 225 09:06.880 --> 09:11.700 IP address 1020 0.102 that was doing it. As we continue to scroll down, the 226 09:11.700 --> 09:13.040 action was passed through 227 09:13.040 --> 09:17.130 and the profile is called monitor all. And that monitor all profile, which is 228 09:17.130 --> 09:17.760 associated with 229 09:17.760 --> 09:22.130 the security policy is allowing proxy avoidance to go through. And as we 230 09:22.130 --> 09:23.520 continue to scroll down, 231 09:23.520 --> 09:27.760 here's the actual URL that the client was going to. So as a test of that, let's 232 09:27.760 --> 09:28.720 right click that 233 09:28.720 --> 09:33.420 and copy that. Let's go back to PC to his computer, let's open up a browser and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 233 09:28.720 --> 09:33.420 and copy that. Let's go back to PC to his computer, let's open up a browser and 234 09:33.420 --> 09:34.240 just confirm we can 235 09:34.240 --> 09:38.340 still get there. So I'll go ahead and put that URL in and a proxy.com. So here 236 09:38.340 --> 09:39.120 's where testing 237 09:39.120 --> 09:42.730 that it's being allowed. So if we wanted to correct that, we'd want to go back 238 09:42.730 --> 09:43.920 to the policy and correct 239 09:43.920 --> 09:47.280 it. So if we scroll up, so it's HQ firewall one, and if we scroll down a little 240 09:47.280 --> 09:48.080 bit, and it's a 241 09:48.080 --> 09:51.830 profile called monitor all that's using. So if we don't want to monitor all, 242 09:51.830 --> 09:52.720 and we want to start 243 09:52.720 --> 09:57.020 blocking on proxy avoidance types of websites, we could either replace that 244 09:57.020 --> 09:58.560 profile with a profile 245 09:58.560 --> 10:01.830 that starts blocking, or we can modify that profile. So let's go back to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 245 09:58.560 --> 10:01.830 that starts blocking, or we can modify that profile. So let's go back to 246 10:01.830 --> 10:03.360 firewall one. So here at firewall 247 10:03.360 --> 10:08.130 one under security profiles web filter, there's the profile right there. Let's 248 10:08.130 --> 10:09.440 go ahead and edit it. 249 10:09.440 --> 10:12.700 Currently shows it's being used. If we click that, it'll show us where it's 250 10:12.700 --> 10:13.600 being used in the 251 10:13.600 --> 10:17.780 end out with LDAP authentication. Great, great, great. So let's go ahead and 252 10:17.780 --> 10:19.680 modify this profile 253 10:19.680 --> 10:22.410 for web filtering. So I'm going to double click on it to edit it. And although 254 10:22.410 --> 10:23.280 it'll still be called 255 10:23.280 --> 10:26.510 monitor all, we'll go down to proxy avoidance and specify that we want to go 256 10:26.510 --> 10:27.760 ahead and do a block 257 10:27.760 --> 10:32.200 instead of just monitor, click on OK. And because that profile is being used by WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 257 10:27.760 --> 10:32.200 instead of just monitor, click on OK. And because that profile is being used by 258 10:32.200 --> 10:32.880 the policy, 259 10:32.880 --> 10:37.360 that client should no longer be able to go to proxy avoidance websites. So I'll 260 10:37.360 --> 10:37.920 go ahead and 261 10:37.920 --> 10:42.270 grab that URL, close the browser, and let's try it again. So we'll open up a 262 10:42.270 --> 10:43.520 browser, right click, 263 10:43.520 --> 10:49.040 paste and go. And this time says not not not gonna happen. Now in addition to 264 10:49.040 --> 10:49.920 us fixing that 265 10:49.920 --> 10:52.690 problem, if that was a security violation for our company, we're also going to 266 10:52.690 --> 10:53.520 have that logged 267 10:53.520 --> 10:57.610 information at the 40 analyzer, because firewall one and the other firewalls 268 10:57.610 --> 10:58.240 are all saying their 269 10:58.240 --> 11:02.210 information over to 40 analyzer. So if we go back to our 40 analyzer, and let's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 269 10:58.240 --> 11:02.210 information over to 40 analyzer. So if we go back to our 40 analyzer, and let's 270 11:02.210 --> 11:03.200 go ahead and say for 271 11:03.200 --> 11:06.490 web filtering, let's go ahead and look at the last five minutes, and I still 272 11:06.490 --> 11:07.520 have the filter in place 273 11:07.520 --> 11:11.010 for proxy avoidance, let me go ahead and clear off that filter. And right there 274 11:11.010 --> 11:12.080 , we have our blocks. 275 11:12.080 --> 11:14.690 Now another way of finding that would be to go ahead and say, you know what, I 276 11:14.690 --> 11:15.280 want to find 277 11:15.280 --> 11:18.450 everything that's not passed through. So put that filter in place, and that 278 11:18.450 --> 11:19.280 will show us those two 279 11:19.280 --> 11:22.260 blocks and those happen in the last five minutes. Here's another example of 280 11:22.260 --> 11:23.440 using the same technique 281 11:23.440 --> 11:28.050 I'm going to go ahead and specify I want to go ahead and use any time range. I 282 11:28.050 --> 11:28.880 'm also going to click on 283 11:28.880 --> 11:33.020 the X here to remove the filter for action doesn't equal pass through. And here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 283 11:28.880 --> 11:33.020 the X here to remove the filter for action doesn't equal pass through. And here 284 11:33.020 --> 11:33.680 in security, let's 285 11:33.680 --> 11:36.940 go down to application control. So if we scroll to the right a little bit, here 286 11:36.940 --> 11:37.920 's our applications, 287 11:37.920 --> 11:41.400 in fact, let me drag that over here a little bit further, so we can see it 288 11:41.400 --> 11:42.800 without having to scroll 289 11:42.800 --> 11:46.320 and scroll down. So regarding application control, let's say we want to find 290 11:46.320 --> 11:48.880 any log entries regarding 291 11:48.880 --> 11:53.410 social media, you can click on add filter, and then we go down to application 292 11:53.410 --> 11:54.400 category, and then over 293 11:54.400 --> 11:57.640 to the right, we can then go ahead and specify equals, and then we can have in 294 11:57.640 --> 11:58.320 social media, 295 11:58.320 --> 12:01.650 and then click on apply, and that'll put a filter in where the application WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 295 11:58.320 --> 12:01.650 and then click on apply, and that'll put a filter in where the application 296 12:01.650 --> 12:02.880 category equals social 297 12:02.880 --> 12:06.390 media. So instead of having to write it all out, you can actually use the 298 12:06.390 --> 12:07.120 interface to help you 299 12:07.120 --> 12:10.790 build it. So here in the application, we have LinkedIn, Facebook, Twitter, 300 12:10.790 --> 12:11.600 anybody narrow it down to 301 12:11.600 --> 12:15.390 what's happened more recently, we get once again, specify, for example, last 302 12:15.390 --> 12:16.640 five minutes. So here 303 12:16.640 --> 12:20.150 it says no record found, but if we send out traffic to social media site, let's 304 12:20.150 --> 12:21.920 do it. So here's PC2 305 12:21.920 --> 12:25.840 and our topology, saying traffic through firewall two and also the firewall one 306 12:25.840 --> 12:26.480 to get up to the 307 12:26.480 --> 12:29.760 internet, let's go ahead and go to Fortinet, and let's also go ahead and go to 308 12:29.760 --> 12:30.880 some social media. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 308 12:29.760 --> 12:30.880 some social media. So 309 12:30.880 --> 12:35.570 here's a set of bookmarks for social media, let's go to YouTube, and let's also 310 12:35.570 --> 12:37.360 go ahead and go to 311 12:37.360 --> 12:42.540 Facebook, and let's also go to Instagram, Grace, there's YouTube, Facebook, and 312 12:42.540 --> 12:43.760 Instagram, and we'll 313 12:43.760 --> 12:47.350 go ahead and close the browser and minimize our client here. And now currently 314 12:47.350 --> 12:48.320 it says no record 315 12:48.320 --> 12:51.940 found, but if we do a refresh here by clicking here on refresh, now it's 316 12:51.940 --> 12:52.800 showing us from the last 317 12:52.800 --> 12:57.050 five minutes, any application categories of social media, which includes our 318 12:57.050 --> 12:58.480 Facebook, LinkedIn, 319 12:58.480 --> 13:00.950 Twitter, and I'm not sure why Instagram is not showing up, they're only WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 319 12:58.480 --> 13:00.950 Twitter, and I'm not sure why Instagram is not showing up, they're only 320 13:00.950 --> 13:01.920 clicking on refresh. 321 13:01.920 --> 13:05.800 Now there we go, just a little bit of a delay for that information to get all 322 13:05.800 --> 13:06.800 sorted out here on 323 13:06.800 --> 13:10.170 the 40 analyzer. So before I leave this, I'm going to go ahead and clear my 324 13:10.170 --> 13:12.000 filters, and we could also 325 13:12.000 --> 13:16.830 use this for other types of events as well, DNS, wealth filtering, IPS, etc. 326 13:16.830 --> 13:17.840 Now another option we 327 13:17.840 --> 13:21.060 have on the 40 analyzer, I'm going to go ahead and bring back the sidebar here 328 13:21.060 --> 13:22.080 on the left, is we 329 13:22.080 --> 13:26.400 also have an option called a Fort review. And think of Fort review as a way of 330 13:26.400 --> 13:28.000 some views of our data 331 13:28.000 --> 13:31.730 and our logs that are kind of pre formatted for us. So here under Fort review, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 331 13:28.000 --> 13:31.730 and our logs that are kind of pre formatted for us. So here under Fort review, 332 13:31.730 --> 13:32.400 I'm going to go 333 13:32.400 --> 13:36.650 ahead and click here on threats. Now by default, it's showing us the last week, 334 13:36.650 --> 13:38.080 I'm going to go ahead 335 13:38.080 --> 13:45.040 and I'm going to say custom, because a few days ago, I generated some traffic. 336 13:45.040 --> 13:45.600 So we have something to 337 13:45.600 --> 13:49.950 look at here. So here under 40 view threats, top threats, my custom time frame 338 13:49.950 --> 13:51.280 is from 713 all the 339 13:51.280 --> 13:56.130 way to 720 of this year 2025. Or I could go ahead and say, you know, let's take 340 13:56.130 --> 13:57.200 a look at the last, 341 13:57.200 --> 14:00.990 let's say three weeks that'll cover us as well. And so I had a lot of fun not WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 341 13:57.200 --> 14:00.990 let's say three weeks that'll cover us as well. And so I had a lot of fun not 342 14:00.990 --> 14:02.160 getting in generating a 343 14:02.160 --> 14:05.640 lot of events that would show up here as well. So we're going to these top 344 14:05.640 --> 14:06.800 threats, we can click 345 14:06.800 --> 14:10.100 here on add filter, and we can go to, for example, threat level. And then with 346 14:10.100 --> 14:11.040 threat level selected, 347 14:11.040 --> 14:14.140 we go ahead and say equal. And we could go ahead and say, I only want to see 348 14:14.140 --> 14:15.520 the critical threat 349 14:15.520 --> 14:18.870 levels. So the critical selected, we click on apply, and that's going to be a 350 14:18.870 --> 14:20.000 filter in place to only 351 14:20.000 --> 14:24.380 show us where the threat level is critical. And that's based on the data here 352 14:24.380 --> 14:25.520 from the last three 353 14:25.520 --> 14:29.050 weeks. Or if we want to see the threat level of high, we could go ahead and 354 14:29.050 --> 14:30.480 remove that filter, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 354 14:29.050 --> 14:30.480 remove that filter, 355 14:30.480 --> 14:34.960 click on add filter again, go down to threat level, and say, I want to see the 356 14:34.960 --> 14:36.160 high and click on 357 14:36.160 --> 14:40.160 apply. And this time it's going to show us just the threat level of high. And 358 14:40.160 --> 14:41.360 if there's a CBE 359 14:41.360 --> 14:45.060 ID associated with that, you could also click to research that or go on a 360 14:45.060 --> 14:46.000 filter on a specific 361 14:46.000 --> 14:49.440 threat, we could, for example, right click on that threat. And from the sub 362 14:49.440 --> 14:50.480 menu select threat 363 14:50.480 --> 14:54.320 equals that exact threat. And that would filter out the where it's threat level 364 14:54.320 --> 14:55.520 high, and the exact 365 14:55.520 --> 14:58.720 threat is that one. And we could double click on this to look at more details 366 14:58.720 --> 14:59.680 regarding it. So 367 14:59.680 --> 15:03.220 there's the source user IP address coming into the firewall and the WAN1 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 367 14:59.680 --> 15:03.220 there's the source user IP address coming into the firewall and the WAN1 368 15:03.220 --> 15:04.320 interface. There's the 369 15:04.320 --> 15:08.300 threat score and the bytes received. And fortunately, this was blocked as 370 15:08.300 --> 15:09.600 indicated by the yellow right 371 15:09.600 --> 15:12.470 here. Now, because this was blocked, let's go back and make clear the filters. 372 15:12.470 --> 15:13.200 And let's take a look 373 15:13.200 --> 15:16.540 at examples something else that was allowed to go through. So we're going to 374 15:16.540 --> 15:16.960 top threats, 375 15:16.960 --> 15:22.000 and go ahead and clear the filters. And I have searched down here for some blue 376 15:22.000 --> 15:23.040 icons, which means 377 15:23.040 --> 15:26.170 that traffic was allowed to go through. And let's go ahead and select this one 378 15:26.170 --> 15:27.120 right here. So I'm 379 15:27.120 --> 15:31.010 going to say threat equals that one, which puts that filter in for us. And then WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 379 15:27.120 --> 15:31.010 going to say threat equals that one, which puts that filter in for us. And then 380 15:31.010 --> 15:31.840 I double click on 381 15:31.840 --> 15:35.430 this entry is putting a filter in place. And then for more detail, we just 382 15:35.430 --> 15:36.480 continue to double click. 383 15:36.480 --> 15:41.280 So here is detail about it regarding the 48, which was firewall one, the source 384 15:41.280 --> 15:41.920 and destination 385 15:41.920 --> 15:46.970 information and the action, which was allowed. And that was before we changed 386 15:46.970 --> 15:47.920 the profile to 387 15:47.920 --> 15:52.430 not allow proxy avoidance. So if we brought our client back in, and we'll open 388 15:52.430 --> 15:53.280 up a browser, 389 15:53.280 --> 15:58.290 and we'll go to proxym.com again, our attempt to impress enter, that should be 390 15:58.290 --> 16:00.000 denied. And also, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 390 15:58.290 --> 16:00.000 denied. And also, 391 16:00.000 --> 16:04.400 that new information will be sent over to the 40 analyzer, where we can now see 392 16:04.400 --> 16:04.960 it in the logs as 393 16:04.960 --> 16:08.550 well. So let me go ahead and close that browser, even minimize that, I go back 394 16:08.550 --> 16:09.200 to log view, 395 16:09.200 --> 16:13.600 I go back to source, let me go back to top threats and refresh here. And now we 396 16:13.600 --> 16:14.800 have an update. So now 397 16:14.800 --> 16:18.320 regarding proxym.com, if we double click on that, we have some that was allowed 398 16:18.320 --> 16:19.040 and some that was 399 16:19.040 --> 16:22.230 blocked. And that's being reflected right here. And one other item I want to 400 16:22.230 --> 16:23.360 share with you here in 401 16:23.360 --> 16:27.930 40 view is this section down here, these are called monitors under this line 402 16:27.930 --> 16:29.120 right here. So if we 403 16:29.120 --> 16:32.880 click on threats and events under the 40 view section, currently, it's set up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 403 16:29.120 --> 16:32.880 click on threats and events under the 40 view section, currently, it's set up 404 16:32.880 --> 16:33.600 for the last week. Let me 405 16:33.600 --> 16:37.710 go ahead and say the last, let's go ahead and say the last three weeks, all 406 16:37.710 --> 16:38.880 devices. And I'll let 407 16:38.880 --> 16:43.220 this refresh. This is going to show us our threats in a map view. So it's 408 16:43.220 --> 16:44.560 presuming we have our 409 16:44.560 --> 16:48.940 firewall set up as far as the location of those firewalls correctly as part of 410 16:48.940 --> 16:50.240 40 analyzer. And 411 16:50.240 --> 16:54.040 this is showing us our threat map in an animated fashion. You can also control 412 16:54.040 --> 16:54.960 the replay rate, 413 16:54.960 --> 16:58.410 then has a top threat destinations. And let me go ahead and make that full 414 16:58.410 --> 16:59.440 screen. There we go. 415 16:59.440 --> 17:02.600 So it was small enough where it wouldn't draw it. So here it's showing us the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 415 16:59.440 --> 17:02.600 So it was small enough where it wouldn't draw it. So here it's showing us the 416 17:02.600 --> 17:03.840 traffic for our top 417 17:03.840 --> 17:08.690 threat destinations. So I'm launching it from here. I have to be in Las Vegas, 418 17:08.690 --> 17:09.840 Nevada, and a lot of 419 17:09.840 --> 17:14.950 the attacks that I simulated and generated, we're going to United Kingdom and 420 17:14.950 --> 17:16.480 Spain and Germany and 421 17:16.480 --> 17:21.060 Indonesia and India. That's a great way to visually see our traffic flows. Go 422 17:21.060 --> 17:22.160 ahead and minimize that. 423 17:22.160 --> 17:25.840 And as we can just scroll down, we also have our top threats right here. And 424 17:25.840 --> 17:26.320 here it's currently 425 17:26.320 --> 17:30.030 sorted by threat level, but we could also sort it based on threat score. And as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 425 17:26.320 --> 17:30.030 sorted by threat level, but we could also sort it based on threat score. And as 426 17:30.030 --> 17:30.720 we scroll down, 427 17:30.720 --> 17:33.800 here's the top threats by weight and count right here. And then if we continue 428 17:33.800 --> 17:34.720 to scroll down, 429 17:34.720 --> 17:38.240 here's the top virus instance over time. And I only did it once. It was right 430 17:38.240 --> 17:38.960 here. So if you 431 17:38.960 --> 17:41.310 had lots of virus incidents, you could go ahead and say instead of saying most 432 17:41.310 --> 17:41.920 recent, you could 433 17:41.920 --> 17:45.900 also say most detected. So I'm going to go back to most recent. So with the 434 17:45.900 --> 17:46.880 four of you, it's some 435 17:46.880 --> 17:52.020 really clever, pre-prepared ways of viewing what's happening on your networks 436 17:52.020 --> 17:53.600 by using 40 analyzer 437 17:53.600 --> 17:57.020 to give us that overall view of what's happening. And if there's a widget that 438 17:57.020 --> 17:57.840 you don't want, 439 17:57.840 --> 18:01.180 you can go ahead and simply remove it by using the drop down here and saying WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 439 17:57.840 --> 18:01.180 you can go ahead and simply remove it by using the drop down here and saying 440 18:01.180 --> 18:02.640 remove. If you change 441 18:02.640 --> 18:06.540 your mind, you can always add it back by clicking on add widget and then add 442 18:06.540 --> 18:07.520 the widget back in, 443 18:07.520 --> 18:10.400 just like that. And here in the top threats by weight and count, you can also 444 18:10.400 --> 18:11.840 hover to identify 445 18:11.840 --> 18:16.240 what the event was. So that was a critical threat. Again, here in the kind of 446 18:16.240 --> 18:17.360 reddish orange color. 447 18:17.360 --> 18:21.000 And then down here, we have proxy avoidance, which was a medium threat. And 448 18:21.000 --> 18:21.520 also with the 449 18:21.520 --> 18:26.000 color coding of yellow versus blue, what was allowed, what was not allowed.