WEBVTT 1 00:00.000 --> 00:04.210 To wrap up this section on the fundamentals and introduction to using 40 Analy 2 00:04.210 --> 00:04.480 zer, 3 00:04.480 --> 00:08.160 I'd like to pose a customer scenario and here it is. The customer is 4 00:08.160 --> 00:09.840 considering using a 40 5 00:09.840 --> 00:13.870 Analyzer in their Fortinet based network. They have a few questions for us 6 00:13.870 --> 00:15.760 before they pull the trigger. 7 00:15.760 --> 00:19.760 So here's the questions. How does the 40 Analyzer, I'll put Faz for short there 8 00:19.760 --> 00:19.760 , 9 00:19.760 --> 00:23.760 how does the 40 Analyzer store the log and event data? And then secondly, does 10 00:23.760 --> 00:24.800 the 40 Analyzer 11 00:24.800 --> 00:29.200 reduce duplicate log and event entries and how does it do that? So here's what 12 00:29.200 --> 00:29.680 I love you to do. 13 00:29.680 --> 00:33.840 I'd like you to pause the video at this point, give those two questions some WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 13 00:29.680 --> 00:33.840 I'd like you to pause the video at this point, give those two questions some 14 00:33.840 --> 00:34.480 thought. And then 15 00:34.480 --> 00:37.280 when you're ready, click on resume and let's review that together. 16 00:37.280 --> 00:44.880 All right, so regarding how does the 40 Analyzer store the log and event data? 17 00:44.880 --> 00:50.160 It uses a flavor of SQL, structured query language, effectively a database to 18 00:50.160 --> 00:51.520 sort and keep track of 19 00:51.520 --> 00:54.870 all the log entries that it receives. And then secondly, does the 40 Analyzer 20 00:54.870 --> 00:55.680 reduce duplicate 21 00:55.680 --> 01:01.360 log and event entries? And if so, how? Well, the way it does that is if we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 21 00:55.680 --> 01:01.360 log and event entries? And if so, how? Well, the way it does that is if we have 22 01:01.360 --> 01:03.120 a group of 40 23 01:03.120 --> 01:07.480 gate firewalls that are part of the same security fabric. And by doing that, it 24 01:07.480 --> 01:08.560 can logically treat 25 01:08.560 --> 01:13.210 those 40 gates as like one grouping or family, and it will reduce the duplicate 26 01:13.210 --> 01:14.560 entries. So Firewall 27 01:14.560 --> 01:20.380 2 is doing IPS functions and Firewall 1 is doing filtering based on application 28 01:20.380 --> 01:21.760 types or categories 29 01:21.760 --> 01:25.720 of websites. All that information regarding what's happening is going to be 30 01:25.720 --> 01:26.800 consolidated here at 31 01:26.800 --> 01:31.080 the 40 Analyzer to give us a better picture and reduce all the duplicates. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 31 01:26.800 --> 01:31.080 the 40 Analyzer to give us a better picture and reduce all the duplicates. So 32 01:31.080 --> 01:31.520 that way, if it's 33 01:31.520 --> 01:34.880 just traffic, for example, going from this Windows computer out to the public 34 01:34.880 --> 01:35.840 internet. And let's 35 01:35.840 --> 01:39.270 imagine that traffic is allowed by all the firewall policies in place. The 40 36 01:39.270 --> 01:39.680 Analyzer, 37 01:39.680 --> 01:43.340 because these devices are on the same security fabric is going to reduce 38 01:43.340 --> 01:44.560 unnecessary duplicate 39 01:44.560 --> 01:48.270 entries. And that's how it does it by leveraging the 40 gate security fabric. 40 01:48.270 --> 01:49.040 So thanks for joining 41 01:49.040 --> 01:52.560 me in this set of videos as we've taken a first look at this wonderful tool 42 01:52.560 --> 01:54.000 called the 40 Analyzer. 43 01:54.000 --> 01:57.210 And I look forward to seeing you, my friend, in another set of videos very, 44 01:57.210 --> 01:58.640 very soon. Until then, 45 01:58.640 --> 02:02.640 I hope this has been informative, and I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 45 01:58.640 --> 02:02.640 I hope this has been informative, and I'd like to thank you for viewing.