Audit findings

Rule base, Audit findings lists the findings from the latest audit of every policy set (Fortinet: policy package), most serious first. Everyone can see it and download it.

Run an audit

Audits run:

after every scheduled sync, for every policy set on live connections, when Audit every package after a scheduled sync is on (the default);
when an offline snapshot is loaded, for every policy set in it;
on demand: Audit all packages on the Policy packages page (every policy set on live connections), or Run audit on one policy set.

Running audits on demand needs the Implementer, Security, Auditor or Administrator role. Each audit is recorded in the audit log with the number of findings by type.

The findings list always shows each policy set's latest audit.

Filters

Filter	Choices
Source	Live firewalls (default), or Snapshot: followed by a snapshot's name. Shown only when there are offline snapshots. Live firewalls and snapshots are never mixed.
Finding type	Every type, or one of Shadowed, Redundant, Partial overlap, Never hit, Inactive, Disabled, Too broad, Not logged, Best-effort.
Severity	Any severity, or Critical, High, Medium, Low, Info.

The filters are kept in the page address, so a filtered view can be bookmarked or shared. The number of matching findings is shown next to them. The finding-type chips on the Overview open this page filtered.

With a snapshot selected, the page title becomes Findings: and the snapshot's name, with the note that it is read-only.

The findings table

Column	Shows
Severity	Critical, High, Medium, Low or Info.
Type	The finding type. See Finding types.
Policy	The policy ID and name, and the management domain / policy set. Click it to open the policy in the rule stack.
What's wrong	The finding in words, naming the related policy where there is one.
Audited	When that policy set was audited.

Download CSV

Download CSV downloads the findings shown, with the current filters. The file is named after the snapshot (<snapshot>-findings.csv) or firesight-findings.csv.

CSV column	Content
`severity`	critical, high, medium, low or info
`type`	The internal finding name, such as `shadowed` or `conflict`
`connection`	The connection or snapshot
`adom`	The management domain
`package`	The policy set
`policy_id`	The policy ID
`policy_name`	The policy name
`message`	What's wrong
`related_policy_id`	The policy that causes it, if any
`audited`	When the policy set was audited (UTC)

Cells that start with =, +, -, @ or a tab are prefixed with an apostrophe, so a spreadsheet never runs a policy or object name from a firewall configuration as a formula.

PDF report

PDF report makes a branded report of the same findings, with the current filters. See PDF audit report.