Reporter for FortiGate Release Notes

Reporter for FortiGate 1.0.1.31 (2020-02-11)

First GA release of Fastvue Reporter for FortiGate.
Improved the logic that decides what columns are displayed in Activity Reports. Fields will no longer have their column removed when using exclude operators if there is also a filter using an include operator for the same field in the filter set.
Search Terms are no longer extracted from resources starting with /cortanaassist/

Fixed issue preventing the Fastvue Reporter service from starting on Server 2008 (non-R2) with certain regional settings.

Improved the calculation of the size of each URL within Fortinet FortiGate sessions.
Improved the extraction of Search Terms to reduce false positives.
Fixed issue preventing the Fastvue Reporter service from starting on systems with certain regional settings (including Portuguese).
Improved performance of Activity Reports.
Report email attachments will no longer be generated if the report contains no data.
Print, Export, and Share buttons are no longer available when a report does not contain data.
Fixed the formatting of TopX widgets in PDF exports.
Running in Demo Mode now populates YouTube videos, YouTube searches and other minor improvements.
New domain substitutes:
- musical.ly now shows as tiktok.com.
- spotifycdn.net now shows as spotify.com.
- dropboxapi.com now shows as dropbox.com.
- d3cv4a9a9wh0bt.cloudfront.net now shows as atlassian.com
- *.nflxso.net now shows as netflix.com

Improved data import performance.
Reported bandwidth sizes are no longer inflated by certain FortiGate event IDs (21, 37141, 39936, 39949).
Fixed further issues with Data Retention that may prevent old data from being deleted from disk.
Fixed report errors that may occur when reporting on large date ranges.
Fixed issue where the Largest Download shown on the Overview Dashboard may not match the Largest Download shown on the Bandwidth Dashboard.
Improved the performance of the Dashboard queries.
When importing syslog data via TCP, any "Connection Forcibly Closed" issues are automatically removed when the syslog connection is re-established.
If email settings are not configured, a prompt is now shown under the email options in Settings | Reports | Scheduled Report.
Improved Demo Data. YouTube URLs no longer show unknown:// as the URL scheme.

Download the latest version from the Fastvue Reporter for FortiGate Download Page. Join the Fastvue Product Testing program to access Fastvue’s latest pre-release products.

Reports can now be shared, exported and scheduled as PDF or CSV, and attached to report notification emails.
When exporting, sharing or scheduling Activity Reports as PDF or CSV, you get the option to export the report with session rows collapsed or expanded.
Improved the format of CSV exports.
Fixed an issue with Search Term detection when URLs are not logged with the correct encoding.
As some log events do not include Source Host, Fastvue Reporter now copies Source Hosts to each subsequent record in the same session after a valid Source Host has been detected.
Fixed issue preventing the 'Retry Report' button that gets displayed when viewing a failed report from working.

Download the latest version from the Fastvue Reporter for FortiGate Download Page. Join the Fastvue Product Testing program to access Fastvue’s latest pre-release products.

Fixed a major issue where data exceeding the retention policy was not removed if was older than 32 days.
Size is now calculated correctly for all URLs, working around an issue in FortiGate's Web Filter log (as shown below). Sizes reported on the Bandwidth dashboard, Reports and Alerts are now much more sensible/accurate.

This screenshot from FortiAnalyzer shows how FortiGate's Web Filter does not log the expected sent/received sizes for individual URLs. Fastvue Reporter for FortiGate now performs the calculations necessary to present accurate size values for each URL.
Improved Search Terms field to remove values that are not actual searches.
Added two new widgets 'Users' and 'Source Hosts and MACs' widgets to the Network section in IT / Network Security and All Usage Reports. Also moved the Network section higher in the report.
Improved diagnostic logging. Added metrics for System CPU, System RAM, and System Disk to show system-wide resource utilisation.
Fixed issues preventing the ability to cancel in-progress Overview Reports.
Activity Reports now limit the individual URLs returned within each browsing session's inner table to 2000 rows, improving performance and general readability.
Added APIs for retrieving Elasticsearch index details (Database.ElasticIndexInfo) and requesting a reindex (Database.ElasticReindex(index)) in the case that its field mapping becomes invalid.

Size is now calculated correctly for allowed URLs, working around an issue in FortiGate's Web Filter log.
Excluding values from an Activity Report no longer adds the excluded field as a column.
Saving Productivity Settings with an active browser translation plugin no longer voids Productivity Settings.
Colours in the Pie and Line charts now match on the Overview Dashboard
Alert evidence sample data is now populated when adding a new evidence column.

Fixed issue where Fastvue Reporter's data retention policy could prevent or slow the service from shutting down when it is deleting multiple indexes.
Fixed issue where the database status toggles between Operational/Failure status when running reports on a large number of old dates (older than 32 days).
IT Overview Widgets now show the 'number of blocks' for the top blocked site, top blocked category and top threat instead of size.
Fixed issues in URL parsing when the logged hostname also contains a port.
Changing data location via the UI or API now rejects the request if the path is the same, is a subfolder of the original path, or the new path cannot be written to.
Fixed areas of the user interface that were not working when installed on non-English variants of Windows Server. For example, viewing Import Issues was not working when installed on Turkish Windows. All ID-based lookups now use case-insensitive invariant culture string comparisons.
The installer now detects 32-bit operating systems and blocks installation.
Updated 3rd party libraries and licenses in Settings | About.

Elasticsearch's maximum and initial memory usage (appears as the Open JDK / Java process in Task Manager) can now be adjusted in Settings | Diagnostics | Database.
Fixed some stability issues where the Elasticsearch database would disconnect or change to the Preparing Elasticsearch status, preventing further queries until the database initialized.
The Service Not Responding dialog now disappears automatically once the Fastvue Reporter Service starts responding again.
Fixed issue where a blank website was shown in the 'Top Sites' sections for non-web data.
Fixed issue where antivirus data would result in strange values being shown in the Top Sites sections.
Souce hosts are no longer shown in the 'Top Sites' section for DHCP log events.