Is it possible to run a NQE query similar to aclEntry.lifecycleData?.lastUsed which returns the list of applications that has been identified passing through a security policy?
Something similar to Palo Alto’s “apps seen” or Fortinet’s Fortiview Application Usage?
Question
Application Usage by Firewall Policy With NQE Query
+4
I can add a feature request to parse that.
In the meantime, if you could determine what CLI command shows that data. You could add that as a Custom Command and parse it manually inside NQE.
That would be a welcome feature inclusion, thanks!
Hmm. I know that palo alto has a command for that “show running application cache” but I am not certain if Fortinet does. I am pretty certain that sort of breakdown would be sent to the fortianalyzer since that involves log analysis. I guess it would require reconstructing the functionality with a query against the fortianalyzer logs?
self-correction. I think this is the fortigate version of the same command:
execute log filter category 10
execute log filter field policyid <POLICY_ID>
execute log display
Badge winners
Sign up
Already have an account? Login
Welcome to the Forward Networks Community
No account yet? Create an account
Select a login option:
Register / Login Forward Employee LoginEnter your E-mail address. We'll send you an e-mail with instructions to reset your password.