Advanced Operations

FortiSIEM enables you to perform the following advanced operations:

• CMDB
  
  • Discovering Users
  • Creating FortiSIEM Users
  • Setting External Authentication
  • Setting 2-factor Authentication
  • Assigning FortiSIEM Roles to Users
  • Creating Business Services
  • Creating Dynamic CMDB Groups
  • Setting Device Geo-location
  • Creating CMDB Reports
• Incidents and Cases
  
  • Changing the Home Country
  • Searching Incidents
  • Tuning Incidents via Exceptions
  • Tuning Incidents via Modifying Rules
  • Tuning Incidents via Drop Rules
  • Tuning Incidents by Adjusting Thresholds
  • Clearing Incidents
  • Adding Comments or Remediation Advice to an Incident
  • Remediating an Incident
  • Notifying an Incident via Email
  • Creating New Rules
  • Creating a FortiSIEM Ticket
  • Creating a Ticket in External Ticketing System
• Device Support
  
  • Checking Device Monitoring Status and Health
  • Setting Devices Under Maintenance
  • Creating Custom Monitors
  • Setting Important Interfaces and Processes
  • Modifying System Parsers
  • Creating Custom Parsers
  • Handling Multiline Syslog
  • Creating Synthetic Transaction Monitors
  • Mapping events to Organizations
  • Adding Windows Agents
  • Adding Linux Agents
  • Forwarding Events to External Systems
• Rules, Reports and Dashboards
  
  • Creating New Rules
  • Creating New Reports
  • Scheduling Reports
  • Customizing Built-in Dashboards
  • Creating custom Dashboards
  • Customizing Business Service Dashboards
• Advanced System Health
  
  • Monitoring System Health
  • Monitoring Collector Health
  • Monitoring Elasticsearch Health
  • System Errors
  • Monitoring User and Query Activity
• Managing FortiSIEM
  • Administrator Tools
  • Backing Up and Restoring FortiSIEM Directories and Databases

Discovering Users

Users can be discovered via LDAP, OpenLDAP, or they can be added manually. Discovering users via OpenLDAP or OKTA are similar.

To discover users in Windows Active Directory, discover the Windows Domain Controller:

1. Go to ADMIN > Setup > Credentials.
2. Click New to create an LDAP discovery credential by entering the following in the Access Method Definition dialog box:
   1. Name for the credential
   2. Device Type as "Microsoft Windows Server 2012 R2"
   3. Access Protocol as "LDAP"
   4. Used For as "Microsoft Active Directory"
   5. Enter the Base DN and NetBios Domain
3. Test the LDAP Credentials.
4. Run discovery.
5. Go to CMDB > Users.
6. Click the "Refresh" icon on left panel and see the users displayed on the right panel.
   

To add users manually:

1. Go to CMDB > Users.
2. Click New and add the user information.

For details about Discovering Users, see here (Refer to the table by searching: Credentials for Microsoft Windows Server)

For details about Adding Users, see here.

Creating FortiSIEM Users

To create users that access FortiSIEM:

1. Login as a user with "Full Admin" rights.
2. Create the user in CMDB.
3. Set a password – after logging in, the user can set a new password.
4. Select the user and click Edit.
5. Select System Admin and enter the following:
   1. Authentication Mode - "Local" or "External"
   2. Enterprise case - select the Role
   3. Service Provide Case - select the Role for each Organization

For details about creating users, see here.

To change the password:

1. Login as the user.
2. Click the "User Profile" icon on the top-right corner.
3. Click Save.

Setting External Authentication

FortiSIEM users can be authenticated in two ways:

• Local authentication – user credentials are stored in FortiSIEM
• External authentication – user credentials are stored in an external database (AAA Server or Active Directory) and FortiSIEM communicates with the external database to authenticate the user

Step 1: Set up an Authentication Profile

1. Login as a user with Full Admin rights.
2. Create an authentication profile by visiting ADMIN > Settings > General > External Authentication.
3.  Click New.
4.  Provide the following information in the External Authentication Profile dialog box:
   1. Enter a Name for the profile
   2. Select an Organization from the drop-down list
   3. Set Protocol appropriately (for example, LDAP, LDAPS, or LDAPTLS for Active Directory)
   4. Enter the IP/Host and Port number
5. Make sure the credentials are defined in ADMIN > Setup > Credentials.
6. Select the entry and click Test to ensure it works correctly.

Step 2: Attach the Authentication Profile to the user

1. Select the user under CMDB > User and click Edit.
2. Select System Admin and click the edit icon.
3. Set Mode to "External" and set the Authentication Profile created.

For details about Setting up Authentication Profiles, see here.

For details about Editing Users, see here.

Setting 2-factor Authentication

FortiSIEM supports Duo as 2-factor authentication for FortiSIEM users:

Step 1: Set up an Authentication Profile

1. Login as a user with Full Admin rights.
2. Create an authentication profile by visiting ADMIN > Settings > General > External Authentication:
   1. Set Protocol to "Duo"
   2. Make sure the credentials are defined in ADMIN > Setup > Credentials
   3. Select the entry and click Test to make sure it works correctly

Step 2: Attach the Authentication Profile to the user

• Select the user CMDB > Users and click Edit
• Select System Admin and click the edit icon
• Set Mode to "External" and set the Authentication Profile created

For details about Setting up Authentication Profiles, see here.

For details about Editing Users, see here.

Assigning FortiSIEM Roles to Users

FortiSIEM allows the admin user to create Roles based on what data the user can see what the user can do with the data. To set up Roles:

Step 1: Create a Role of your choice

1. Login as a user with Full Admin rights.
2. Go to ADMIN > Settings > Role > Role Management.
3. Make sure there is a Role that suits your needs. If not, then create a new one by clicking New and entering the required information. You can also Clone an existing Role and make the changes.

Step 2: Attach the Role to the user

1. Select the user CMDB > Users and click Edit
2. Select System Admin and click the edit icon.
3. Set Default Role:
   1. Enterprise case – select the Role
   2. Service Provide Case – select Role for each Organization

For details about Setting up Roles, see here.

For details about Editing Users,see here.

Creating Business Services

Business Service is a smart grouping of devices. Once created, incidents are tagged with the impacted Business Service(s) and you can see business service health in a custom Business Service dashboard.

For details about creating a Business Service, see here.

For details about setting up Dynamic Business Service, see here.

For details about viewing Business Service health, see here.

Creating Dynamic CMDB Groups and Business Services

CMDB Groups are a key concept in FortiSIEM. Rules and Reports make extensive use of CMDB Groups. While inbuilt CMDB Groups are auto-populated by Discovery, user-defined ones and Business Services are not. You can use the Dynamic CMDB Group feature to make mass changes to user-defined CMDB Groups and Business Services.

To create Dynamic CMDB Group Assignment Rules:

1. Login as a user with ADMIN tab modification rights.
2. Go to ADMIN > Settings > Discovery > CMDB Group.
3. Click New.
4. Enter CMDB Membership Criteria based on Vendor, Model, Host Name and IP Range.
5. Select the CMDB group (Groups) or Business Services (Biz Services) to which the Device would belong if the criteria in Step 3 is met.
6. Click Save.

You can now click Apply to immediately move the Devices to the desired CMDB Groups and Business Services. Discovery will also honor those rules – so newly discovered devices would belong to the desired CMDB Groups and Business Services.

For details about Setting up Dynamic CMDB Groups and Business Services, see here.

Setting Device Geo-Location

FortiSIEM has location information for public IP addresses. For private address space, you can define the locations as follows:

1. Login as a user with ADMIN tab modification rights.
2. Go to ADMIN > Settings > Discovery > Location.
3. Click New.
4. Enter IP/IP Range.
5. Specify the Corresponding Location for the IP address Range.
6. Select Update Manual Devices if you want already discovered device locations to be updated.
7. Click Save.
   You can now click Apply to set the geo-locations for all devices matching the IP ranges.

For details about Setting Device Location, see here.

Creating CMDB Reports

If you want to extract data from FortiSIEM CMDB and produce a report, FortiSIEM can run a CMDB Report and display the values on the screen and allows you to export the data into a PDF or CSV file.

For details about Creating CMDB Reports, see here.

Changing the Home Country

Many rules and reports use the My Home CMDB Object as defined in RESOURCES > Country Groups > My Home. By default, it is set to United States of America.

For details on changing this, see here.

 

Searching Incidents

If you want to search for specific incidents, go to INCIDENTS > List > Actions > Search. A Search Windows appears on left. First, select the Time Window of interest. Then by clicking on any of the criteria, you can see the current values. You can select values to see matches incidents in the right pane.

For details about Searching Incidents, see here.

Tuning Incidents via Exceptions

If you do not want a rule to trigger for a specific Incident Attribute, then you can create an exception.

1. Go to INCIDENTS > List view.
2. Search the Incident (Actions > Search) or make sure that Incident shows in the right pane.
3. Highlight the Incident.
4. Click Actions > Edit Rule Exception.
5. Enter the exception criteria – attribute based or time-based.

For details about Tuning Incidents via Exceptions, see here.

Tuning Incidents via Modifying Rules

Sometimes modifying the rule is a better idea than creating exceptions. For example, if you do not want a rule to trigger for DNS Servers, simply modify the rule condition by stating something like “Source IP NOT CONTAIN DNS Server”. To do this:

1. Go to INCIDENTS > List view.
2. Search the Incident (Actions > Search) or make sure that Incident shows in the right pane.
3. Highlight the Incident
4. Click Actions > Edit Rule
5. Edit the Rule.
   If it is a System Rule, then you must save it as a User Rule. Deactivate the old System Rule and activate the new User Rule.

For details, see here.

Tuning Incidents via Drop Rules

Sometimes the rule can be prevented from triggering by dropping the event from rule considerations. There are two choices - (a) store the event in database but not trigger the rule or (b) drop the event completely.

To do this:

1. Go to INCIDENTS > List view.
2. Search the Incident (Actions > Search) or make sure that Incident shows in the right pane.
3. Highlight the Incident.
4. Click Actions > Create Event Dropping Rule.
5. Specify event drop criteria and action. Events can be dropped on certain parsed fields (like Reporting/Source/Destination IP and Regex filter on the content).

For details, see here.

Tuning Incidents by Adjusting Thresholds

Some performance rules are written using global thresholds, for example - the Rule “High Process CPU: Server” uses the global threshold “Process CPU Util Critical Threshold” defined in ADMIN > Device Support > Custom Properties.

You have two choices – (a) modify the global threshold or (b) modify the threshold for a specific device or a group of devices. If you change the global threshold, then the threshold will change for all devices.

To modify the global threshold, follow these steps:

1. Go ADMIN > Device Support > Custom Properties.
2. Select the property and click Edit.
3. Enter the new value and click Save.

For details, see here.

To modify the threshold for one device, follow these steps:

1. Go to CMDB.
2. Select the device and click Edit.
3. In the Properties tab, enter the new value and click Save.

To modify the threshold for a group of devices, repeat the above step for all devices.

Clearing Incidents

In some cases, the Incident may not be happening anymore as the exception condition was corrected.

 To clear one or more Incidents:

1. Go to INCIDENTS > List view.
2. Search the Incident (Actions > Search) or make sure that Incidents show in the right pane.
3. Highlight the Incidents.
4. Click Actions > Clear Incident
5. Enter Reason and click OK.

For details, see here.

Adding Comments or Remediation Advice to an Incident

To add a comment to an Incident:

1. Go to INCIDENTS > List view.
2. Search the Incident or make sure that Incidents show in the right pane.
3. Highlight the Incidents.
4. Click Actions > Edit Comment
5. Enter the Comment and click OK.

For details, see here.

Sometimes, it is necessary to add Remediation advice for the recipient of an Incident, so he can take some action to remediate the Incident. This has to be done by editing the Rule.

1. Go to RESOURCES > Rules.
2. Select a Rule and click Edit.
3. Enter Remediation Note text and click Save.

For details, see here.

The Remediation text can be added to the Incident Notification email template.

For details, see here.

Remediating an Incident

You can use the following commands to enable Windows Remote Management (WinRM) and set authentication on the target Windows Servers. See Remediations for information on adding, editing, and deleting a remeditation from the FortiSIEM UI.

In the remediation script:

1. When you initiate the WinRM session, set transport parameter to ssl.
2. Set the server_cert_validation option accordingly. If you do not need to validate the certificate, set to ignore. For example:

   session = winrm.Session(enforceOn, auth = (user, password), transport="ssl", server_cert_validation = "ignore")

In the target Windows server:

Note: You might need to disable Windows Firewall before running remediation.

1. Create the self-signed certificate in the certificate store, for example:

   New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "mySubjectName.lan"

   where Cert:\LocalMachine\My is the location of the certificate store and mySubjectName.lan is the subject alternate name extension of the certificate.

2. Create an HTTPS listener, for example:

   winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Port ="5986";Hostname="{your host name}"; CertificateThumbprint="{CertificateThumbprint}"}'

3. Start the WinRM service and set the service startup type to auto-start. The quickconfig command also configures a listener for the ports that send and receive WS-Management protocol messages using either HTTP or HTTPS on any IP address.

   winrm quickconfig -transport:https

4. Validate the WinRM service configuration and Listener.
   1. Check whether basic authentication is allowed, for example:

      winrm get winrm/config/service

   2. Check whether a listener is running, and verify the default ports, for example:

      winrm get winrm/config/listener

Remediation can be done either on an ad hoc basis (for example, user selects an Incident that has already occurred to Remediate) or using a Notification Policy where the system takes the Remediation action when Incident happens. First, make sure the Remediation script for your scenario is defined. Check the existing Remediation scripts in ADMIN > Settings > General > Notification > Remediation settings. If your device is not in the list, add the needed Remediation script.

To set ad hoc remediation:

1. Go to INCIDENTS > List view.
2. Search the Incident (Actions > Search) or make sure that Incidents show in the right pane.
3. Highlight the Incident you want to remediate (you can remediate only one Incident at a time)..
4. Click Actions > Remediate Incident.
5. In the Run Remediation dialog box:
   1. Select the script in the Remediation drop-down list that you want to run.
   2. Select the role that the script will run on from the Run On drop-down list.
   3. Open the Enforce On drop-down list to choose which devices the remediation script will run on. In the Run Remediation dialog box, open the Device tree. Select individual devices and shuttle them to the Selections column. (You can choose only individual devices; you cannot choose device groups.)
6. Click Run in the Run Remediation dialog box.

For details, see here.

To set policy-based remediation:

1. Go to ADMIN > Settings > General > Notification Policy.
2. Click New.
3. Under Action, click the edit icon next to Run Remediation/Script.
4. In the Notification Policy - Define Script/Remediation dialog box click New.
5. In the dialog box tha topens click either Legacy Script or Remediation:
   • Legacy Script: 
     • Enter the name and path to the script in the Script field.
     • Select the role the script will run on from the Run On drop-down list.
   • Remediation:
     • Select a remediation script from the Script drop-down list.
     • Select the role that the script will run on from the Run On drop-down list.
     • Open the Enforce On drop-down list to choose which devices the remediation script will run on. In theNotification Policy - Define Script/Remediation - Enforce On dialog box, open the Device tree. Select individual devices and shuttle them to the Selections column. (You can choose only individual devices; you cannot choose device groups.)
6. Click Save.

For details, see here.

To see the Notification history of an Incident:

1. Go to INCIDENTS > List view.
2. Search the Incident (Actions > Search) or make sure that Incidents show in the right pane.
3. Highlight the Incidents.
4. Click Actions > Show Notification History

For details, see here.

Notifying an Incident via Email

Notifying an Incident can be done either on ad hoc basis (for example - user selects an Incident that has already occurred to notify) or using a Notification Policy where the system takes the notification action when Incident happens.

First, make sure that Email Server has been properly defined in ADMIN > Settings > Email > Email Settings.

FortiSIEM has a built-in Incident Notification Email template. If you want a different one, please define it under ADMIN > Settings > Email > Incident Email Template.

For details, see here.

To set ad hoc notifications:

1. Go to INCIDENTS > List view.
2. Search the Incident (Actions > Search) or make sure that Incidents show in the right pane.
3. Highlight the Incidents.
4. Click Actions > Notify via Email.
5. Choose Receive Email Address and Email Template.
6. Click Send.

For details, see here.

For Policy based Notification

To send policy-based notifications:

1. Go to ADMIN > Settings > General > Notification Policy.
2. Click New.
3. Specify the Incident Filter Conditions (Severity, Rules, Time Range, Affected Items, Affected Organizations) carefully to avoid excessive emails.
4. Under Action, click Send Email/SMS to Target Users.
5. Enter Email Address or Users from CMDB.
6. Click Save.

For details, see here.

To see the Notification history of an Incident:

• Go to INCIDENTS > List view.
• Search the Incident (Actions > Search) or make sure that Incidents show in the right pane.
• Highlight the Incidents.
• Click Actions > Show Notification History

For details, see here.

Creating New Rules

Sometime, you may want to create a new rule from scratch.

For details, see here.

Creating a FortiSIEM Ticket

First make sure that:

• Ticket’s assigned user is in CMDB
• Assigned user’s Manager that is going to handle escalation is in CMDB
• A Ticket Escalation Policy is defined

For adding users see Advanced Operations > Creating System users.

For defining ticket escalation policy, see here.

To create a FortiSIEM ticket:

• Go to INCIDENTS > List view.
• Search the Incident (Action > Search) or make sure that Incidents show in the right pane.
• Highlight the Incidents.
• Click Actions > Create Ticket.
• Click Save

Note that you can put multiple Incidents on one ticket or add an Incident to an existing ticket.

For details, see here.

Creating a Ticket in External Ticketing System

First, define an Incident Outbound Integration Policy by visiting ADMIN > Settings > General > Integration.

For details, see here.

Then set the Incident Outbound Integration Policy in Notification Policy Action:

1. Go to ADMIN > Settings > General > Notification Policy.
2. Click New.
3. Specify the Incident Filter Conditions (Severity, Rules, Time Range, Affected Items, Affected Organizations) carefully to avoid excessive emails.
4. Under Action, click Invoke an Integration Policy.
5. Choose the Integration Policy.
6. Click Save.

For details, see here.

To update external ticket state in FortiSIEM:

1. Define an Incident Inbound Integration Policy by visiting ADMIN > Settings > General > External Integration.
2. Select the Policy and click Schedule to run the Incident Inbound Integration Policy.

For details, see here.

Creating New Rules

To create new Rules, go to RESOURCES > Rules, choose a folder and click New. Remember to test and activate the rule.

For details, see here.

Rules can also be created from ANALYTICS tab. Once you have run a search, create a rule from it by clicking Action > Create Rule.

For details, see here.

Creating New Reports

New Reports can be created from RESOURCES > Reports > Choose a Folder > Click New.

For details, see here.

Reports can also be created from ANALYTICS tab. Once you have run a search, you can save it as a Report by clicking Actions > Save Result.

For details, see here.

Scheduling Reports

Reports can be scheduled to run at later time and contain data for a specific period of time. Go to RESOURCES > Reports > Choose a Report > More > Schedule.

For details, see here.

Customizing Built-in Dashboards

FortiSIEM Built-in Dashboards are organized in Folders with multiple Dashboards in each Folder. You can add dashboards to any Folder or modify the dashboards in any built-in folder. Dashboard modification can include – modifying chart layout, chart settings or even adding new widgets for widget dashboards.

For details, see here.

You can also choose to display only a set of Dashboard Folders by visiting ADMIN > Settings > System > UI > Dashboard Settings.

Creating Custom Dashboards

You can either create a new Dashboard Folder and move dashboards in it or add dashboards to an existing folder.

To create a new Dashboard folder:

1. Click DASHBOARD
2. Open the Dashboard Folder drop-down list.
3. Click New.

To create a new Dashboard for the folder:

1. Select the Dashboard Folder from the drop-down list.
2. Click + to the right of the selected folder.
3. Enter a Name and Dashboard Type from the drop-down list in the Create New Dashboard dialog box.
4. If you created a Widget Dashboard, click + beneath the folder name to add Widgets to the Dashboard.

For details, see here.

Creating Business Service Dashboards

After creating a new Dashboard, choose Type = Business Service Dashboard. Then select the Business Service Selector on the top right to add Business Services to the Dashboard.

For details, see here.

Monitoring System Health

To see the system level health of every FortiSIEM Supervisor/Worker node, go to ADMIN > Health > Cloud Health. The top pane shows the overall health of various nodes – Supervisor and Workers. Click any one node and the bottom pane shows the health of the various processes in that node.

For details, see here.

Monitoring Collector Health

To see the system level health of every FortiSIEM Collector node, go to ADMIN > Health > Collector Health.

For details, see here.

Monitoring Elasticsearch Health

To see the Elasticsearch health information, go to ADMIN > Health > Elasticsearch Health.

For details, see here.

System Errors

To see the system errors, click the Jobs/Errors icon on the top-right corner of FortiSIEM GUI and select the Error tab. You can also run a report in ANALYTICS > click the Folders icon > Shortcuts > Top FortiSIEM Operational Errors.

Monitoring User and Query Activity

To see FortiSIEM User and Query Activity, click the User Activity icon () on the top-right corner of FortiSIEM GUI. The User Activity dialog box contains these tabs:

• Logged in Users
• Locked Users
• Query Status
• Query Workload

All of the tabs in the User Activity dialog box contain the time of the last refresh and the number of seconds until the next automatic refresh. By default, the automatic refresh interval is 60 seconds. To refresh the table on demand, click the Refresh button.

Logged in Users

This tab displays a table listing the users currently logged in to FortiSIEM. You can perform the following operations on this tab:

• Log Out - Select one or more users in the table and click Log Out. The selected users will be logged out of FortiSIEM.
• Log Out and Lock Out - Select one or more users in the table and click Log Out and Lock Out. The selected users will be logged out of FortiSIEM and prevented from logging back in.

The Logged in Users table contains the following information:

Column	Description
Organization	The Organization to which the user belongs.
User	The name of the user.
Full Name	The full name of the user.
Login IP	The IP address from which the user logged in.
Role	The name of the user's role.
Login Time	The date and time when the user logged in.
Session ID	The ID of the user's FortiSIEM session.

 

Locked Users

This tab displays a table listing the users currently locked out of FortiSIEM. Typically, user access to FortiSIEM can be locked due to multiple login failures. You can perform the following operations on this tab:

• Unlock - Select one or more users in the table and click Unlock.

Note: Users can also be unlocked by going to CMDB > Users > Actions > Unlock.

The Locked Users table contains the following information:

Column	Description
Organization	The Organization to which the user belongs.
User	The name of the user.
Full Name	The full name of the user.
Login IP	The IP address from which the user logged in.
Role	The name of the user's role.
Locked Time	The date and time when the user was locked out of FortiSIEM.

Query Status

This tab displays a table listing the status of current and recent queries. You can perform the following operations on this tab:

• Stop Query - Select a query from the table and click Stop Query. The selected query will be stopped remotely. If the query was sent from the ANALYTICS page, you should see a warning message saying this query was stopped manually. You should also be able to see the partial results you received before it was stopped.
• Search - Click the Search button to search for queries by Query name (plain text search), User name (multiple options selected via a checkbox), and/or query Type (multiple options selected via a checkbox).
• Sort - Click a column name. You can sort the column data in ascending or descending order.
• Job Distribution for Query - Click a query in the Query Status table to see the Job Distribution for Query <query_name> table. This table identifies the Worker nodes employed in processing the query and their status. For more information, see Obtaining Job Distribution for Query.

The Query Status table contains the following information:

Column	Description
Query ID	The ID of the query.
Query Name	The name of the query.
User	The name of the user who issued the query.
Type	The value of Type can be: Interactive - Queries executed directly from the ANALYTICS page. Scheduled - Queries scheduled from RESOURCE > Reports.
Start Time	The date and time when the query was issued.
Status	The value of Status can be: Running - The query is currently running. Waiting - The query is waiting in the queue because the maximum number of running queries has been reached.
Progress	The percent of progress the query has made towards completion.
Elapsed	The time, in seconds, that the query has run.

Obtaining Job Distribution for Query

To see how the query job is distributed between Worker nodes, click a query in the Query Status table. The Job Distribution for Query <query_name> table appears beneath the Query Status table.

• Sort - Click a column name. You can sort the column data in ascending or descending order.

The Job Distribution for Query <query_name> table contains the following information:

Column	Description
Node	The Worker IP address.
Status	The value of Status can be: Unknown - The query process is in an unknown state. Starting - The query has started processing. Running - The query is currently processing. Pausing - The query is in the process of pausing processing. Resuming - The query has resumed processing. Stopping - the query is in the process of stopping processing. Paused - The query has temporarily paused processing. Stopped - The query has stopped processing. Completed - The query has completed processing.
Progress	The percent of progress the query has made towards completion.
Running For	The time (in seconds) elapsed since the Start Time. Note: This value is calculated from the last refresh time, not the Last Update minus the Start Time.
Start Time	The date and time when the query began processing.
Last Update	The data and time when the Worker last reported a progress update.

Query Workload

This tab displays a table listing the available Worker nodes for a query job. You can perform the following operations on this tab:

• Sort - Click a column name. You can sort the column data in ascending or descending order.
• Status of Running Tasks - Click a Worker node row in the Query Workload table to display the Tasks Running On <Worker_IP_address> table. For more information, see Obtaining Running Tasks.

The Query Workload table contains the following information:

Column	Description
Node	The Worker IP address.
Status	The value of Status can be: Online - The Worker node is currently online. Offline - The Worker node is currently offline.
Interactive Tasks	The number of interactive tasks (that is, sent from the ANALYTICS page) assigned to the Worker node.
Scheduled Tasks	The number of scheduled tasks assigned to the Worker node.
Task Workload	The total number of tasks assigned to the Worker node.

Obtaining Running Tasks

To see the status of running tasks, click a Worker node in the Query Workload table. The Tasks Running On <Worker_IP_address> table appears beneath the Query Workload table. You can perform the following operations on this tab:

• Sort - Click a column name. You can sort the column data in ascending or descending order.

The Tasks Running On <Worker_IP_address> table contains the following information:

Column	Description
Query ID	The ID of the query.
Query Name	The name of the query.
User	The name of the user who issued the query.
Type	The value of Type can be: Interactive - Queries executed directly from the ANALYTICS page. Scheduled - Queries scheduled from RESOURCES > Reports.
Start Time	The date and time when the query began processing.
Status	See Status in Obtaining Job Distribution for Query.
Progress	The percent of progress the query has made towards completion.