NSE4 · Question #239
An administrator wishes to generate a report showing Top Traffic by service type. They notice that web traffic overwhelms the pie chart and want to exclude the web traffic from the report. Which of…
The correct answer is A. In the Service field of the Data Filter, type 80/tcp and select the NOT checkbox. To exclude web traffic from a FortiAnalyzer report, you should configure the Data Filter by specifying the HTTP service port (80/tcp) and enabling the 'NOT' checkbox.
Question
An administrator wishes to generate a report showing Top Traffic by service type. They notice that web traffic overwhelms the pie chart and want to exclude the web traffic from the report. Which of the following statements best describes how to do this?
Options
- AIn the Service field of the Data Filter, type 80/tcp and select the NOT checkbox.
- BAdd the following entry to the Generic Field section of the Data Filter: service="!web".
- CWhen editing the chart, uncheck wlog to indicate that Web Filtering data is being excluded when
- DWhen editing the chart, enter 'http' in the Exclude Service field.
How the community answered
(40 responses)- A80% (32)
- B3% (1)
- C10% (4)
- D8% (3)
Why each option
To exclude web traffic from a FortiAnalyzer report, you should configure the Data Filter by specifying the HTTP service port (80/tcp) and enabling the 'NOT' checkbox.
To exclude specific service types from a FortiAnalyzer report, you would configure the Data Filter by specifying `80/tcp` in the Service field and then selecting the 'NOT' checkbox, which ensures HTTP traffic on port 80 is excluded from the report data.
The syntax `service="!web"` is not the standard or correct method for excluding a specific service like HTTP in FortiAnalyzer's Data Filter, which typically uses port numbers or predefined service objects with negation.
Unchecking 'wlog' would exclude web filtering *log events*, not necessarily all web traffic identified by its service port, which is the goal of excluding 'web traffic' from a Top Traffic by service report.
While some reporting tools might have a direct 'Exclude Service' field in chart editing, FortiAnalyzer's primary and most granular mechanism for filtering report data by service is through the Data Filter template, using port numbers or service objects and the NOT operator.
Concept tested: FortiAnalyzer report data filtering by service
Source: https://docs.fortinet.com/document/fortianalyzer/7.4.0/administration-guide/200676/report-settings
Topics
Community Discussion
No community discussion yet for this question.