Build a Compliance Report on FortiAnalyzer

Generating comprehensive compliance reports from network security logs is a critical task for maintaining regulatory adherence and demonstrating due…

Generating comprehensive compliance reports from network security logs is a critical task for maintaining regulatory adherence and demonstrating due diligence. FortiAnalyzer, Fortinet's centralized logging, analytics, and reporting platform, provides robust capabilities for this purpose. While it includes several pre-built compliance report templates, tailoring these for specific organizational requirements and ensuring their accuracy often necessitates customization beyond the default settings.

This article details the process of building and customizing a compliance report on FortiAnalyzer, focusing on version 7.2.x. We will cover template selection, dataset and chart customization, scheduling, and validation to ensure reports are both accurate and actionable.

Understanding FortiAnalyzer Report Components

Before diving into customization, it's essential to understand the core components that make up a FortiAnalyzer report:

Templates: Pre-defined structures that dictate the overall layout, sections, and included datasets. FortiAnalyzer ships with templates for PCI DSS, HIPAA, ISO 27001, NIST, and others.
Datasets: SQL-like queries against the FortiAnalyzer log database (ADOM-specific or global) that extract raw data for the report. Examples include "Top Denied Traffic" or "Authentication Failures."
Charts/Tables: Visual representations (pie charts, bar graphs, tables) of the data returned by datasets. These are embedded within report sections.
Sections: Logical groupings of charts and tables, often corresponding to specific compliance requirements (e.g., "Firewall Rule Review," "VPN Activity").
Macros: Dynamic placeholders (e.g., %%.Date.Report.Start%%) that FortiAnalyzer replaces with actual values during report generation.

Selecting and Customizing a Base Template

FortiAnalyzer offers several compliance templates that serve as an excellent starting point. Navigate to Reports > Report Definitions > Templates. For instance, if your organization needs to comply with PCI DSS, select the "PCI DSS" template.

To customize, clone the existing template: select the template, then click Clone. Give it a descriptive name like "PCI-DSS-Custom-v1.0". This ensures you don't modify the original system template, which simplifies future upgrades or troubleshooting.

Customizing Cover Page and General Settings

After cloning, open your new template. In the General tab, you can customize:

Cover Page: Upload a custom logo (e.g., company branding, PNG, or JPG, max 200x100 pixels recommended) and edit the title, subtitle, and introduction text. This is where you specify the report's purpose and scope.
Header/Footer: Add dynamic content using macros. Common macros include %%.Date.Report.Start%%, %%.Date.Report.End%%, %%.Report.Name%%, and %%.Page.Number%%.
Report Layout: Choose page size (A4, Letter) and orientation (Portrait, Landscape).

Refining Datasets and Charts

This is arguably the most critical part of customization. Compliance requirements often demand very specific data points that default datasets may not fully capture. Navigate to the Layout tab within your custom report template.

Modifying Existing Datasets

Each report section contains charts that draw from specific datasets. For example, a "Firewall Rule Change" section might use a dataset querying configuration changes. To modify a dataset:

Click on a chart within a section.
In the right-hand pane, under Data Source, click the pencil icon next to the dataset name.
The Edit Dataset window will appear. Here you see the SQL-like query.

Consider the "Top Denied Traffic" dataset, often found in network activity sections. The default query might look like:


SELECT
    srcip, dstip, dstport, sum(rcvdbyte+sentbyte) AS bytes
FROM
    $log WHERE $filter AND action='deny' AND logid=0000000005
GROUP BY
    srcip, dstip, dstport
ORDER BY
    bytes DESC
LIMIT 10

To make this more compliance-centric, you might need to:

Filter by specific FortiGate devices: Add AND adom='YourADOM' AND devid='FG100F_SN' if not already implicitly filtered by the ADOM context.
Include policy IDs: Add policyid to the SELECT and GROUP BY clauses to see which policy denied the traffic.
Exclude internal networks: Add AND srcip NOT LIKE '10.%' AND dstip NOT LIKE '10.%' to focus on external interactions.
Focus on specific ports/services: Add AND dstport IN (22, 23, 3389) to highlight attempts on sensitive services.

Creating New Datasets

If an existing dataset doesn't meet your needs, create a new one. Navigate to Reports > Report Definitions > Datasets. Click Create New. You'll specify the ADOM and write your query.

Example: To report on successful VPN logins from outside the corporate network (useful for NIST 800-53 AC-10):


SELECT
    srcip, user, dstip, service, COUNT(*) AS login_attempts, MAX(timestamp) AS last_login
FROM
    $log WHERE $filter AND logid='0100022904' AND action='authenticate' AND status='success' AND srcip NOT LIKE '192.168.%' AND srcip NOT LIKE '172.16.%' AND srcip NOT LIKE '10.%'
GROUP BY
    srcip, user, dstip, service
ORDER BY
    login_attempts DESC
LIMIT 50

After creating the dataset, go back to your report template, add a new section, and then add a new chart/table. Select your newly created dataset as the source. Configure chart type (Table is often best for detailed compliance data), columns, and sorting.

Note on $filter: This macro is dynamically replaced by FortiAnalyzer with the ADOM, device, and time period filters defined when the report is generated. Always include it in your dataset queries.

Scheduling and Delivery

Once your report template is perfected, schedule its generation and delivery. Go to Reports > Report Definitions > Report Settings.

Click Create New.
Report Name: "PCI-DSS-Monthly-Compliance".
Template: Select your customized template (e.g., "PCI-DSS-Custom-v1.0").
ADOM: Select the ADOM(s) relevant to the report. You can select multiple.
Time Period: For monthly compliance, choose "Last Month (Relative)".
Schedule: Set "Recurrence" to "Monthly", "Day of Month" to "1st", and "Time" (e.g., 02:00 AM) to ensure it runs outside business hours.
Output Options:
- Email: Enable, enter recipient email addresses (comma-separated), subject, and message. Choose attachment format (PDF is standard).
- SFTP: Enable, enter SFTP server IP/hostname, port (default 22), username, password, and destination directory (e.g., /FortiAnalyzer_Reports/PCI_DSS/). FortiAnalyzer 7.2.x supports SFTP. Ensure the target directory exists and the FortiAnalyzer unit has network reachability and authentication to the SFTP server.
- Save to Disk: This saves the report to the FortiAnalyzer's internal storage, viewable via the GUI under Reports > All Reports.
Report Generation: Choose "Generate Now" for immediate testing, or let the schedule handle it.

The "Recipient List" on the stub refers to the email recipient list within these schedule settings.

Validating and Troubleshooting Reports

After scheduling, it's crucial to validate the report's content. Don't wait for the monthly run; generate it for a sample period first.

Navigate to Reports > All Reports. If you performed a "Generate Now" or a scheduled report has run, you'll see your report listed. Click on it to view the PDF. Scrutinize each section:

Empty sections: As stated in the stub, empty sections often indicate that the underlying dataset queries are too restrictive or the log filters need tuning.
Missing data: Check if FortiGates are correctly sending logs to FortiAnalyzer and if the logs contain the expected fields. Use Log View to manually query logs for the specific criteria your dataset uses.
Incorrect data: Verify the time period and ADOM selection in the report schedule. Review dataset queries for logical errors (e.g., AND action='deny' instead of action='accept').
Performance issues: Very complex datasets over large time periods or multiple ADOMs can significantly slow down report generation. Optimize queries by adding more specific filters (e.g., logid, devid) and reducing LIMIT clauses if not all results are needed.

Common Pitfalls

Incorrect ADOM selection: Ensure your report schedule is configured for the correct ADOMs that contain the relevant FortiGate logs.
Dataset query errors: A typo or incorrect field name in a dataset query will result in an empty chart or an error during report generation. Use the "Test Dataset" feature when creating/editing datasets.
Log retention policies: FortiAnalyzer's log retention settings (System Settings > Dashboard > Disk Usage) might purge logs before your compliance reports can cover the required period. Adjust retention as needed, but be mindful of disk space.
Time synchronization: Ensure FortiGates and FortiAnalyzer have accurate and synchronized NTP settings. Time discrepancies can lead to missing data within reports.
SFTP/Email connectivity: Verify network connectivity and authentication details for SFTP servers and SMTP server settings (System Settings > Mail Server) for email delivery. Check FortiAnalyzer's system event logs for delivery failures.
Not using $filter: Omitting the $filter macro from dataset queries can lead to unexpected results, as the query won't respect the report's defined time period and ADOM context.