FortiGate Exposure Counts: What They Measure

FortiGate exposure counts vary because different views measure different things: the dashboard count reflects the number of distinct sources that triggered a threat signature, while the logs and reports count individual events or sessions. This article explains the three main numbers you will see, why they disagree, and how to interpret each one correctly.

Formula

Exposure is not a single formula but a ratio of two different counts. The first useful metric is events per source: divide the total number of threat events (e) by the number of distinct source IPs (s). The second is events per hour: divide total events (e) by the time window in hours (t).

In symbols:

• Events per source = e / s (events per source IP)
• Events per hour = e / t (events per hour)

Where:

• e = total number of threat events (count of log entries matching a signature)
• s = number of distinct source IP addresses that triggered at least one event
• t = time window in hours (e.g., 24 for one day)

The calculator above uses these to give you a quick way to normalize your own exposure data, whether you are comparing a busy vs. quiet day or deciding if a spike is just one noisy host.

Worked Example

Using the default values from the calculator: a 24-hour window, 12 distinct sources, and 345 total events.

1. Events per source = 345 / 12 = 28.75 events per source IP.
2. Events per hour = 345 / 24 = 14.375 events per hour.

The calculator shows 28.8 and 14.4 (rounded to one decimal), matching the hand calculation. This tells you that on average each source triggered about 29 events, and the firewall logged about 14 events every hour.

Why the Dashboard Count Differs from the Log Count

The most common confusion is between the big number on the FortiGate dashboard (often labeled “Threats Detected� or “Exposure�) and the number of log lines in the threat log. The dashboard count is a deduplicated count: it counts each unique source IP once, regardless of how many times that source triggered the same signature. The log count is a raw event count: every matching packet or session creates a log entry. So if one IP scans your firewall 500 times with the same exploit attempt, the log shows 500 events, but the dashboard exposure count shows 1 source.

Additionally, the dashboard may only count events that occurred in the last 24 hours (or your configured “exposure window�), while the log view might default to a different time range. Always check the time filter on both views before comparing.

What the Exposure Count Actually Measures

FortiGate’s “exposure� is a security score or count that reflects the number of unique sources that have triggered a threat signature in a given time window. It is not a measure of how many attacks were blocked (that is the “blocked� counter), nor is it a measure of vulnerability. It is a raw indicator of how many distinct external hosts have attempted something that matches a known attack pattern.

This is useful for spotting trends: a sudden jump from 5 to 50 sources suggests a widespread scan or a new botnet campaign. But it does not tell you whether any of those attempts succeeded. A high exposure count with zero successful intrusions is normal for any internet-facing firewall.

How to Choose the Right Number for Your Report

If you are writing a security report or presenting to management, match the number to the question:

• “How many distinct attackers?â€� → Use the dashboard exposure count (unique sources).
• “How many attack attempts?â€� → Use the raw event count from the logs.
• “How intense is the attack?â€� → Use events per source (as calculated above).
• “How does this compare to yesterday?â€� → Use the same metric and time window for both days.

Consistency is key: never mix unique-source counts with event counts in the same chart or paragraph.

Common Problems and Misconceptions

Misconception 1: “Exposure count = successful attacks.� False. The count only reflects that a signature matched. Most matches are blocked before any payload is delivered.

Misconception 2: “High exposure means my firewall is misconfigured.� Not necessarily. A firewall with a permissive policy (e.g., allowing all inbound traffic) will see more attempts simply because it is exposed to more of the internet. A properly configured firewall with strict rules can still have high exposure if it is directly reachable.

Common problem: time zone mismatches. The dashboard may use UTC while your logs use local time. This can shift counts by hours, making a 24-hour comparison look wrong. Always set both to the same time zone.

Common problem: duplicate events from the same source. If you see a single source with thousands of events, it is usually a port scan or a brute-force attempt. Use the events-per-source ratio to identify such outliers.

How to Read the Numbers in Practice

When you open the FortiGate dashboard, look for the “Threats� widget. It typically shows a number like “1,234� with a label like “Exposure�. That number is the count of unique source IPs that triggered a threat signature in the last 24 hours. To see the raw events, go to Log & Report → Threat Log. Filter by the same time range and look at the “Count� column or the total number of log entries.

If the two numbers are wildly different (e.g., exposure 10 but logs 10,000), it means a few sources are generating many events. That is worth investigating—maybe a compromised host inside your network is scanning outbound, or a single external botnet node is hammering you.

For a quick sanity check, use the calculator above with your own numbers. If your events per source is above 100, you likely have a very noisy source.

Limitations and What the Count Does Not Tell You

The exposure count is a simple metric with several blind spots:

• It does not indicate whether the attack was successful.
• It does not show which signature matched (you need the logs for that).
• It is affected by firewall policy: if you block all traffic from a country, you will see fewer sources from that region.
• It is time-window dependent: a 1-hour window will show fewer sources than a 24-hour window.
• It does not account for the severity of the threat—a low-severity scan counts the same as a critical RCE attempt.

For a complete picture, pair the exposure count with the top threat signatures and the top source IPs from the logs.

Frequently Asked Questions

Why does my FortiGate dashboard show a different number than the threat log? The dashboard counts unique source IPs (deduplicated), while the log counts every event. Also, check the time range and time zone on both views.

What is a “good� exposure count? There is no universal good number. A small business with a single public IP might see 5–20 sources per day; a large enterprise with many public IPs might see thousands. Focus on changes over time rather than absolute values.

Does a high exposure count mean I am being attacked successfully? No. It only means that traffic matched a threat signature. Most of that traffic is blocked. Check the “blocked� counter and the logs for any allowed traffic with a threat signature.

How do I reduce my exposure count? Reduce your attack surface: close unused ports, restrict inbound traffic with policies, and use geo-blocking if you do not need traffic from certain regions. Also, ensure your IPS and antivirus signatures are up to date.

Can I export the exposure count to a report? Yes. In FortiOS, you can use the built-in report templates or export the threat log to CSV. The dashboard widget itself is not directly exportable, but you can recreate the number by counting unique source IPs from the logs.

Why does the exposure count reset to zero sometimes? The count is based on a rolling time window (usually 24 hours). When the window moves, old events age out, so the number can drop sharply at the end of the day. This is normal.

Related

• Sony Xperia Video Converter: Formats & How to Convert
• Color-Changing Camouflage: Forest & Desert Use
• Steam DLC Not Downloading? Fixes That Work

in t | Time window (hours) | h | 24 | 1 | 8760
in s | Distinct sources | count | 12 | 1 | 100000
in e | Total events | count | 345 | 1 | 1000000
out rate | Events per source | events/source | e / s | 1
out per_hour | Events per hour | events/h | e / t | 1