Artica SIEM for FortiGate: FortiGate status
Policies, applications, application categories, UTM actions, threat levels, virtual domains and interface roles seen in the recent FortiGate logs.
Back to Artica SIEM for FortiGate
The FortiGate status page ranks what the recent logs say about the firewall itself: which policies matched, which applications and categories passed, which UTM actions and threat levels were reported, and how traffic crossed the interfaces.
Why use it
- You see at once which policy carries most of the traffic, and whether a rule you expect to match ever does.
- Threat levels and UTM actions show whether the security profiles are blocking anything.
- Each card opens its full ranking, with sessions, volume and share.
Opening the page
Click Statistics/SIEM > Fortigate. The header holds the period and the FortiGate.
The cards
Each card ranks one field of the FortiGate logs by number of sessions: top policies, top applications, application categories, UTM actions, threat levels, virtual domains, and inbound and outbound interface roles. The first value is highlighted with its share; the others carry a bar proportional to their share.
Blocked UTM actions are marked in red, and so are the critical and high threat levels. A value the FortiGate did not send for a session (no application, no UTM action) is shown as Not set.
More details at the bottom of a card opens the full ranking, up to 50 values, with sessions, volume and share.
What the period covers
These fields exist only in the detailed logs, which the SIEM keeps for a few hours before summarizing them. The footer of each card says recent window only when that is the case. For trends over weeks, use General data and Policies.