Create a log "view" for each user

[richinnz]

Hi,

We have a shared firewall in our datacentre where 1 VDOM is servicing a number of customers, each customer having a VLAN interface.  

Is there a way I can create a user in FortiAnalyzer that is restricted to viewing only the logs passing through a particular src or dst interface on that VDOM so my customers can use FAZ but only see their logs?

I was thinking perhaps a meta field on the administrators account and have that referenced in the reports / log viewer etc, but unsure how, or even if this is the best way.

Thanks,

Richard

[chall_FTNT]

Admin users can be restricted to specific ADOMs which can be compromised of 1 or more devices/VDOMs.  For this to work, you need to isolate customers into separate VDOMs.  Those VDOMs can then be aggregated through a common VDOM (if necessary) or, if using VLANs, then a VLAN trunk to an upstream switch.

[richinnz]

Hi Chall,

Thanks for the reply.  I am already aware of this functionality, but I was asking whether it is possible to create an admin user (customer) on FAZ who has only a restricted view of the logs going to a specific ADOM.  In this case, I would add only one VDOM to the ADOM, and then I would want each user to only view logs with a specific srcintf or dstintf value.

I can modify the SQL in the reports as necessary, but I would need to reference some attribute of the logged in users' account that contains the interface name (e.g. meta field), and this was what I was inquiring about.  

Ideally I would like to do this across reports, noc/soc, and log view, but I would settle for just the reports section if at all possible.  

Regards,

Richard