Fortinet 4.7.2 FortiSIEM User Guide
Iklan
Iklan
FortiSIEM
User Guide
Version 4.7.2
FortiSIEM Installation Guide
1.
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.1
1.2.2
1.2.3
1.2.3.1.1
1.2.3.1.2
1.2.3.1.3
1.2.3.1.4
1.2.3.2.1
1.2.3.2.2
1.2.3.2.3
1.2.3.2.4
1.2.4
1.3.1
1.3.1.4.1
1.3.1.4.2
1.3.1.4.3
1.3.1.4.4
1.3.1.5.1
1.3.1.6.1
1.3.1.6.2
1.3.1.6.3
1.3.1.6.4
1.3.1.7.1
1.3.1.7.2
1.3.1.9.1
1.3.1.9.2
1.3.1.9.3
1.3.2
1.3.2.2.1
1.3.2.2.2
1.3.2.2.3
1.3.2.2.4
Page 2
FortiSIEM Installation Guide
1.3.2.10
1.3.2.11
1.3.2.12
1.4.1
1.4.1.2.1
1.4.1.2.2
1.4.1.2.3
1.4.1.2.4
1.4.1.3.1
1.4.1.3.2
1.4.1.4.1
1.4.1.4.2
1.4.1.4.3
1.4.1.4.4
1.4.1.4.5
1.4.1.5.1
1.4.1.5.2
1.4.1.5.3
1.4.1.6.1
1.4.1.6.2
1.4.1.6.3
1.4.2
1.4.2.3.1
1.4.2.3.2
1.4.2.4.1
1.4.2.4.2
1.4.2.4.3
1.4.2.4.4
1.4.2.4.5
1.4.2.4.6
1.4.2.4.7
1.4.2.4.8
1.4.2.4.9
1.4.2.5.1
1.4.2.5.2
1.4.2.6.1
1.4.2.6.2
1.4.2.6.3
1.4.2.6.4
1.4.2.6.5
1.4.2.6.6
1.4.2.6.7
1.4.2.6.8
1.4.2.6.9
1.4.2.7.1
1.4.2.8.1
1.4.2.8.2
1.4.2.8.3
1.4.2.8.4
1.4.2.8.5
1.4.2.8.6
1.4.2.8.7
1.4.2.8.8
1.4.2.8.9
Page 3
FortiSIEM Installation Guide
1.4.2.9.1
1.4.2.9.2
1.4.2.9.3
1.4.2.9.4
1.4.2.9.5
1.4.2.9.6
1.4.2.10
1.4.2.11
1.4.2.12
1.4.2.13
1.4.2.14
1.4.2.15
Page 4
FortiSIEM Installation Guide
1.4.2.16
1.4.2.17
1.4.2.18
1.4.2.19
1.4.2.20
1.4.2.21
1.4.2.22
1.4.2.23
1.4.2.24
1.4.3
1.4.3.1.1
1.4.5
1.4.6
1.4.3.10
1.4.3.11
1.4.3.12
1.4.3.13
1.4.3.14
1.4.4
1.4.4.1.1
1.4.4.1.2
1.4.4.1.3
1.4.4.1.4
1.4.4.3.1
1.4.4.3.2
1.4.7
Page 5
FortiSIEM Installation Guide
1.4.7.1.1
1.4.7.1.2
1.4.7.1.3
1.4.7.2.1
1.4.7.2.2
1.4.7.2.3
1.4.7.2.4
1.4.7.2.5
1.4.7.2.6
1.4.7.3.1
1.4.7.3.2
1.4.7.3.3
1.4.7.3.4
1.4.7.3.5
1.4.7.3.6
1.4.7.4.1
1.4.7.4.2
1.4.7.4.3
1.4.7.5.1
1.4.7.5.2
1.4.8
1.5.1
1.5.1.3.1
1.5.1.3.2
1.5.1.3.3
1.5.1.6.1
1.5.1.6.2
1.5.1.6.3
1.5.1.10
1.5.1.11
1.5.1.12
1.5.1.13
1.5.1.14
1.5.2
1.5.2.3.1
1.5.2.3.2
1.5.2.3.3
1.5.2.3.4
1.5.2.3.5
1.5.2.3.6
1.5.2.3.7
1.5.2.3.8
1.5.2.3.9
Page 6
FortiSIEM Installation Guide
1.5.2.4.1
1.5.2.4.2
1.5.2.4.3
1.5.2.4.4
1.5.3
1.5.4
1.5.4.5.1
1.5.5
1.6.1
1.6.1.1.1
1.6.1.1.2
1.6.1.1.3
1.6.1.1.4
1.6.1.1.5
1.6.1.1.6
1.6.1.2.1
1.6.1.2.2
1.6.1.2.3
1.6.1.2.4
1.6.2
1.6.2.1.1
1.6.2.1.2
1.6.2.1.3
1.6.2.1.4
1.6.2.1.5
1.6.2.1.6
1.6.2.1.7
1.6.2.1.8
1.6.2.2.1
1.6.2.2.2
1.6.2.2.3
1.6.2.2.4
1.6.2.2.5
1.6.2.2.6
1.6.2.2.7
1.6.2.2.8
1.6.2.2.9
1.6.2.3.1
1.6.2.3.2
1.6.2.3.3
1.6.2.3.4
1.6.2.3.5
1.6.2.3.6
Page 7
FortiSIEM Installation Guide
1.6.2.3.7
1.6.2.4.1
1.6.2.4.2
1.6.2.4.3
1.6.2.4.4
1.6.2.5.1
1.6.2.5.2
1.6.2.5.3
1.6.2.5.4
1.6.2.5.5
1.6.3
1.6.3.1.1
1.6.3.1.2
1.6.3.1.3
1.6.3.2.1
1.6.3.3.1
1.6.3.3.2
1.6.3.3.3
1.6.3.3.4
1.6.3.4.1
1.6.3.4.2
1.6.3.4.3
1.6.3.5.1
1.6.3.5.2
1.6.3.5.3
1.6.4
1.7.1
1.7.1.2.1
1.7.1.2.2
1.7.1.2.3
1.7.1.2.4
1.7.1.2.5
1.7.1.2.6
1.7.1.2.7
1.7.1.2.8
1.7.2
1.7.3
1.7.3.1.1
1.7.3.1.2
1.7.3.1.3
1.7.3.1.4
1.7.3.1.5
1.7.3.1.6
1.7.3.1.7
1.7.3.1.8
1.7.3.3.1
1.7.3.3.2
Page 8
FortiSIEM Installation Guide
1.8.1
Page 9
FortiSIEM Installation Guide FortiSIEM Installation Guide
FortiSIEM User Guide 4.7.2
Welcome to FortiSIEM product documentation.
Feel free to comment on any of the topics in this wiki and leave us your feedback
Can't find what you're looking for here? Check out the
View or download the 4.7.2 documentation as a PDF .
Customer Support Portal , where you can also file support tickets
Page 10
FortiSIEM Installation Guide
Release Notes
FortiSIEM Installation Guide
Page 11
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's new in Release 4.7.2
Special upgrade instructions for customers currently in releases earlier than 4.6.3
If you are currently running FortiSIEM earlier than 4.6.3
1.
2.
First, upgrade to 4.6.3 first by following the steps described here.
Then upgrade to 4.7.2 using normal upgrade procedures.
If you are already on FortiSIEM 4.6.3, then upgrade to 4.7.2 using normal upgrade procedures.
Special one-time post-upgrade service password change procedure
On an upgraded system, FortiSIEM recommends users to change the service password used by various processes on Supervisor, Workers, and Report server to communicate to the Application Server running on Supervisor node. It is currently a one time action - the existing service password will be changed to a new system generated one.
1.
2.
3.
4.
First, upgrade to 4.7.2 and make sure upgrade is successful
Make sure all processes on various nodes are up and running by visiting Cloud health page on Supervisor node
On Supervisor node as admin, run the command "phtools --change-svc-passwd ALL"
This will result in all the processes across super, worker, and report server to automatically restart. Make sure all the processes are up and running.
Remember to clear browser cache
After upgrade, remember to clear cached images in files in browsing data
Device Support
FortiSandbox - discovery, performance monitoring, log analysis and external threat intelligence (see
FortiWeb - discovery, performance monitoring and log analysis (see here
)
FortiMail - log analysis (see here
)
MalwareBytes - log analysis (see
Sophos UTM - log analysis (see
)
Bug Fixes
Bug ID
17552
15161
Severity
Major
Major
17025
17216,
17056
Major
Major
17466
16991
17290
15868
16969
Major
Normal
Normal
Normal
Normal
Component
System
App Server
Parser
System
Rule Engine
Performance
Monitor
Parser
Performance
Monitoring
System
Description
Patch Linux Kernel Local Privilege Escalation Vulnerability (“Dirty COW”) - CVE-2016-5195
FortiSIEM users cannot change their own passwords if they are read only users or were restricted by RBAC from viewing or making changes to CMDB users page
Cisco ASA parser code introduced in 4.5.1 leaks memory
FortiSIEM hangs during upgrade and reboot if there is no internet connectivity. This is because in 4.7.1, OS update was done during upgrade and reboot. This release provides two solutions: (1) OS upgrade via yum update now only happens during upgrade and not during reboot and (2) FortiSIEM goes to repositories set up in AWS Cloudfront AWS edge locations listed here ( https://aws.amazon.com/cloudfront/details/#edge-locations ) depending on where the FortiSIEM node is connecting from. The Cloudfront CDN distribution is created and controlled by FortiSIEM engineering. If the connection to this edge location fails, it connects to origin server ima ges-os.accelops.net
which is hosted by FortiSIEM engineering in AWS
Rule Engine sometimes crashes while evaluating FIRST and LAST aggregation operators
Sometime Java Agent has too many open files
AIX log Parser incorrectly parses reporting device name
Palo Alto Firewall configuration pulling SSH script not logging out
FortiSIEM Worker ssl.conf is overwritten during upgrade - e.g. if FortiSIEM Worker is configured to use valid CA certificates, these are overwritten during an upgrade to use self-signed. FortiSIEM Supervisor works correctly.
Page 12
FortiSIEM Installation Guide FortiSIEM Installation Guide
16984
16992
16995
17008
17058
17068
17097
17114
17115
17352
17354
17380
17382
17387
17409
17483
17076
17092
17098
17115
17248
17255
17405
17057
Normal
Normal
Normal
Normal
Normal
Normal
Normal
Normal
Normal
Normal
Normal
Normal
Normal
Normal
Normal
Normal
Enhancement
Enhancement
Enhancement
Enhancement
Enhancement
Enhancement
Enhancement
Enhancement
System
Performance
Monitoring
Rule Engine
Re-registered license not getting updated in Worker and Report Server.
Java agents (e.g. SQL based monitoring) can result in too many open files
GUI
GUI
GUI
While testing rules, Rule Master module may time out if the rule test evaluates to FALSE. RuleMaster never reports the status to the GUI.
White labeling does not work correctly in HTML5 GUI
User can no longer approve multiple CMDB devices at a time.
Performance
Monitoring
App Server
System
GUI
Ticketing system GUI can not load tickets if any ticket does not have a due date
FortiGate SSH based commands for Audit do not work when VDOMs are configured
CMDB replication setting in postgresql.conf on both Super and Report Server lost after upgrade
Prevent event loss during eps surge by adding another warning period to elastic eps enforcement
Query Engine
Parser
Discovery
Sometimes, the list of users in Assigned To in a ticket created from incident, may not be shown properly
Sometimes Incident Query with Incident Reporting IP IN A Device Group does not return result.
Device type in TrendMicro Deep Security Manager parser is incorrect.
Can not connect to a device via Telnet/SSH when user name is empty but password and enable password is set
Custom device discovery does not work when discovered device type is Generic Unix or Generic Linux. Discovery
GUI
Discovery
CMDB > Device > Link usage does not show data for non-FortiGate devices
SDEE based Test Connectivity to Cisco IPS does not work for Cisco IPS 7.0 and earlier that does not support
TLS 1.2
Data
Performance
Monitoring
GUI
Some Cylance Protect syslog can not be parsed
Allow a higher priority queue for Airline log monitoring
Remove "Forticare" from default exported Audit report name
Device Support Extend IBM Townsend parser
Device Support Update FortiGate IPS Event types (Signatures)
Device Support Update Forcepoint (previously McAfee Stonesoft) parser
Device Support Update F5 ASM parser
Device Support Update Nginx parser
Current Open Issues
Id Severity
8867 Normal
11036 Normal
14242 Normal
Component
Rule Engine
Rule Engine
Query Engine
15022 Normal
11112 Normal
14478 Normal
15109 Normal
15247 Normal
15253 Normal
Parser Engine
Rule Engine
GUI
Performance
Monitoring
Parser
Parser
Description
LAST and FIRST operators in rules do not work (may crash Rule Worker module)
Rule Worker module may abort when a PctChange Expression is used
RBAC data conditions not enforced for SP organizations when login in via the super org and moving to another org.
Parser module may stall/pause if a host name resolution is slow. Work around for now is to disable host name resolution.
COUNT DISTINCT operations consume large resources for rules utilizing Anomaly Detection
Sometimes GUI pops up warning (Large amount of data stored over the boundaries) when users restore the archived data or delete the restored data
Failed Custom JDBC job shows in performance page after Discovery
AIX Parser cannot parse events correctly.
Reporting device name is parsed wrong in LinuxInotifyParser (affects Linux file integrity monitoring via AccelOps agent)
Page 13
FortiSIEM Installation Guide FortiSIEM Installation Guide
14929 Normal
15068 Normal
15231 Normal
15233 Minor
Performance
Monitoring
Application
Server
Application
Server
Application
Server
15300 Minor GUI
9261 Enhancement Application
Server
Maintenance calendar issue - Maintenance for a device does not start at the configured time if there is a long running disabled job of another device
Dashboard Search Filtering Does not work for Clariion LUNs under Summary Tab
Generating PDF Reports over 100 Pages will drop Page Footer
"Validation Status" column in Admin->Event DB->Event Integrity does not allow for sorting.
For Report Server, if you sync -> unsync -> sync is rapid succession, then the last sync may not take effect
Charts in exported reports (PDF format) only contain stacked charts - not line charts
Page 14
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's new in Release 4.7.1
Special upgrade instructions for customers currently not on 4.6.3
If you are currently not on FortiSIEM 4.6.3,
1.
2.
First, upgrade to 4.6.3 first by following the steps described here.
Then upgrade to 4.7.1 using normal upgrade procedures.
If you are already on FortiSIEM 4.6.3, then upgrade to 4.7.1 using normal upgrade procedures.
Features
HTML5 based GUI for Incident
You can logon to the HTML5 version of Incident page using the link https://<SupervisorIP>/phoenix/html.
For details see
Malware URL threat feed
Previous releases allowed users to import Malware domain, IP, file hashes and Anonymity Networks as external threat intelligence feed. This release extends this functionality to Malware URLs.
.
Syslog over TLS
This release enables FortiSIEM to receive encrypted Syslog over TLS.
Device Audit framework
FortiSIEM discovers devices in depth, collects various performance/availability metrics, parses logs, traps and triggers rules. This release provides users a framework to run an audit on devices based on every piece of collected information.
Audit criteria can be based on
OS version
Installed software version
A set of reports representing audit violations
A set of rules triggering incidents representing audit violations
User can define audit criteria and run a check against devices - either on-demand or periodically on a schedule. The results can be displayed on
GUI, exported as PDF from GUI or emailed with PDF attachments.
.
Device Support - New
Aruba Switches - discovery (Bug 15800)
Alertlogic IPS - log parsing (Bug 16250)
Page 15
FortiSIEM Installation Guide FortiSIEM Installation Guide
AWS Elastic Load Balancer - log parsing (Bug 15752)
Device Support - Enhancements
F5 load balancer - detailed performance monitoring
Fortinet FortiOS - more detailed data collection and trap parsing
Aruba Clearpass Manager - more detailed log parsing (Bug 15542)
Checkpoint GAIA - monitor memory using UCD MIBs (Bug 16203)
HP/UX - more detailed syslog parsing (Bug 15565)
InfoBlox - more detailed syslog parsing (Bug 16121, Bug 16191)
Dell Equallogic - more detailed syslog parsing (Bug 15433)
TrendMicro Officescan - more detailed syslog parsing (Bug 16122)
Checkpoint FireWall-1 - parsing fix (Bug 16119)
Microsoft Windows - Added event id 4769 (Bug 16191)
Microsoft Windows - Added event id 6274, 6272 (Bug 12163)
Microsoft Windows - Added event id 5137 (Bug 7429)
Juniper SecureAccess - parser enhancement (Bug 16035)
Palo Alto Firewall - parser enhancements (Bug 16727, 16169)
Fortinet FortiOS Firewall - parser enhancements (Bug 16554)
Symantec Endpoint Control - parser enhancements (Bug 16210)
F5 ASM - parser enhancements (Bug 16726)
McAfee Stonesoft IPS - parser enhancements (Bug 16729)
Cisco Call Manager - parser enhancements (Bug 16395)
Cisco ACS Parser - parser enhancement (Bug 15550)
Imperva SecureSphere - parser improvements (Bug 16036)
HP Procurve - syslog parsing enhancement (Bug 12072)
Bug Fixes / Enhancements
Component Bug
ID
Severity
16779 Minor
16767 Minor
16340 Minor
16460 Minor
16009 Minor
16655 Minor
16067 Minor
16654 Minor
App Server
System
Parser
App Server
App Server
App Server
GUI
GUI
16764 Minor App Server
15296 Enhancement App Server
16898 Minor App Server
Description
A user cannot change their own password if the CMDB Tab view is restricted from them
File rename error on cross-partition operation may lead to event database archive failure
Incorrectly formatted Netflow packets can cause parser module to crash
Users who do not have permissions for Admin > Discovery can not launch discovery from CMDB
User created custom types (device, event, attribute) are created as Origin = System after upgrade
Empty "Time" in Incident Notification Policy can cause notification policy to not trigger
Can not add more than 100 devices to a CMDB Device folder
Can not handle CMDB Reports with filter conditions containing strings with spaces, e.g. Installed Software Name =
'Attack Definition'
Incident Notification Policy may some times trigger twice for the same incident id
Ability tp export test connectivity error, discovery error and discovery change delta results as PDF reports
Run script notification may sometimes fail to run
16055 Minor Parser
The 'vulnSolution' event attribute populated from Vulnerability pulling agents such
Qualys and Nessus need to allow for URLs.
16007 Minor App Server
16867 Enhancement Parser
16870 Minor Performance
Monitoring
15527 Enhancement GUI
16382 Enhancement App Server
16431 Enhancement Parser
An exception may happen during clear incident processing resulting in the clear incident not getting stored
SSH script for Foundry switches fails when the switch is configured to login to enable mode directly without typing in
"enable; username; password"
For custom SNMP monitoring, snmpbulkwalk command does not working for some OIDs while snmpwalk works
Allow users to edit the same property for multiple devices in one shot by simply multi-selecting the devices and entering new values
On CMDB Reports, Add 'Processor Name' attribute to "Server Hardware: Processor" report
System error message "Success ratio too low" is enhanced to report only when a large of retry attempts have occurred
Page 16
FortiSIEM Installation Guide FortiSIEM Installation Guide
Current Open Issues
Id Severity
8867 Normal
11036 Normal
14242 Normal
Component
Rule Engine
Rule Engine
Query Engine
15022 Normal Parser Engine
11112 Normal
14478 Normal
15109 Normal
Rule Engine
GUI
Performance
Monitoring
Parser
Parser
15247 Normal
15253 Normal
14929 Normal
15068 Normal
15231 Normal
15233 Minor
Performance
Monitoring
Application
Server
Application
Server
Application
Server
15300 Minor GUI
9261 Enhancement Application
Server
Description
LAST and FIRST operators in rules do not work (may crash Rule Worker module)
Rule Worker module may abort when a PctChange Expression is used
RBAC data conditions not enforced for SP organizations when login in via the super org and moving to another org.
Parser module may stall/pause if a host name resolution is slow. Work around for now is to disable host name resolution.
COUNT DISTINCT operations consume large resources for rules utilizing Anomaly Detection
Sometimes GUI pops up warning (Large amount of data stored over the boundaries) when users restore the archived data or delete the restored data
Failed Custom JDBC job shows in performance page after Discovery
AIX Parser cannot parse events correctly.
Reporting device name is parsed wrong in LinuxInotifyParser (affects Linux file integrity monitoring via AccelOps agent)
Maintenance calendar issue - Maintenance for a device does not start at the configured time if there is a long running disabled job of another device
Dashboard Search Filtering Does not work for Clariion LUNs under Summary Tab
Generating PDF Reports over 100 Pages will drop Page Footer
"Validation Status" column in Admin->Event DB->Event Integrity does not allow for sorting.
For Report Server, if you sync -> unsync -> sync is rapid succession, then the last sync may not take effect
Charts in exported reports (PDF format) only contain stacked charts - not line charts
Page 17
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's new in Release 4.6.3
Starting 4.6.3, AccelOps has been re-branded as FortiSIEM.
Enforce TLS 1.2 for tighter security
Special upgrade procedure
Upgrade steps for TLS 1.2 handling
Enforcing TLS 1.2 requires that the following steps be
followed in strict order
for upgrade to succeed.
Additional steps for TLS 1.2
compatibility are marked in bold
.
1.
Remove
/etc/yum.repos.d/accelops* and Run "yum --exclude=google-chrome-stable --exclude=cabextract update" on
, Supervisor and to get all TLS 1.2 related libraries up to date. Follow this yum update order Colle
2.
ctors Worker(s) Supervisor.
Pre-upgrade step for upgrading Supervisor: Stop FortiSIEM (previously AccelOps) processes all Workers by running "phtools
3.
4.
--stop ALL". Collectors can be up and running. This is to avoid build up of report files.
Upgrade Supervisor following usual steps.
5.
6.
If your environment has Worker nodes, Upgrade Workers following usual steps.
If your environment has AccelOps Windows Agents, then upgrade Windows Agent Manager from 1.1 to 2.0. Note t
here are special pre-upgrade steps to enable TLS 1.2
).
If your environment has Collectors, upgrade Collectors following usual steps.
Continuing to run previous collector versions 4.5.2 or earlier
If your environment has a collector and it is running AccelOps 4.5.2 or earlier (with JDK 1.7), then first patch the Collector for TLS 1.2
compatibility (see
here ). This step is not required for Collectors running AccelOps 4.6.1 or later.
Instructions if you are running 4.6.1 only
Please follow these instructions
only
if you are running 4.6.1 release
Running on VMWare ESX 6.0
If you are importing AccelOps VA, Collector, or Report Server images for VMWare on an ESXi 6.0 host, you will need to also "Upgrade
VM Compatibility" to ESXi 6.0. If the VM is already started, you need to shutdown the VM, and use the "Actions" menu to do this. Due to some incompatibility created by VMWare, our collector VM processes restarted and the collector could not register with the supervisor.
Similar problems are also likely to occur on supervisor, worker, or report server as well, so make sure their VM compatibilities are upgraded as well. More information about VM compatibility is available in the VMWare KB below:
https://kb.
vmware
.com/kb/1010675
Automatic OS upgrades after reboot
After you upgrade to 4.6.3, the system reboots itself and will automatically perform OS upgrades as described in detail
Features
FortiSIEM re-branding
From this release onward, AccelOps will be branded FortiSIEM.
Enforce TLS 1.2 for tighter security
Page 18
FortiSIEM Installation Guide FortiSIEM Installation Guide
FortiSIEM web servers now only advertise TLS1.2. All FortiSIEM components now communicate using secure TLS 1.2 protocol. This includes the following communications
Collector to Super/Worker
Worker to Super
Browser to Super
Windows Agent to Agent Manager
Agent Manager to Collector and Super
Windows Agent Enhancements
This release contains the following Windows Agent enhancements.
1. Enhanced user file monitoring: Windows Agent allows users to monitor changes in custom files. This release enhances this feature in the following ways.
a. Allow user to specify a custom string for each monitored file. The specified user defined string would be included in the event type as a signature for that file. For example, if user is monitoring a special
MyApp1
log file, then user can specify a custom b. string e.g.
MyApp1
and the event type would be
AO-WUA-UserFile-MyApp1
parser for each monitored log file by specifying the string
. This approach allows the user to write a specific
AO-WUA-UserFile-MyApp1
in the event format recognizer.
Allow wildcards in monitored file name; e.g. *radius.log. This enhancement allows for dynamically named log files including dates in file name. For example DHCP and RADIUS files are generated every day and the file names contain the date e.g.
012415radius.log.
2. Ability to monitor any file in Windows Event Manager tree: Prior to this release AccelOps only monitored specific log files in the
Windows Event Manager tree, namely Security, Application, Performance events, DNS logs, DHCP logs etc. This release provides the capability to monitor any file in Windows Event Manager tree. User needs to choose the desired Windows Event Manager folder and
3.
FortiSIEM Agent will start monitoring events for that application. The corresponding event type will contain the folder name to distinguish it from events from other folders.
4.
Windows CD/DVD/USB monitoring: FortiSIEM can now detect insertion/removal and certain file read/write activity on external media such as USB and CD/DVD. Specifically, the following cases are covered in this release a. b. c. a. b.
Detect when external media such as USB, CD, DVD is inserted
Detect when external media such as USB, CD, DVD is removed
Detect when a file is written to USB
Enhanced File integrity and Registry change monitoring: This release contains the following enhancements:
5.
6.
7. c. b. c.
User can exclude directories while specifying files to be monitored, e.g. monitor "C:\System32" but exclude "C:\System32\Log"
Include the process name triggered file modification in FortiSIEM events
Allow environment variables in the file path definition
Monitoring Template and License Assignment improvements: for details see
a.
.
User can define multiple monitoring templates per host, e.g. OS monitoring template, Application 1 monitoring template,
Application 2 monitoring template etc.
User can assign templates and licenses for large number of hosts with much fewer clicks than earlier releases
A searchable tabular display of Host to license and template assignments.
Allow multiple power shell and WMI scripts per monitoring template. Prior releases only allowed one script per template.
Create Alerts when an Agent is stopped, uninstalled or unresponsive. This allows users to report and detect these potential policy violations.
Bug Fixes / Enhancements
Component Description Bug
ID
Severity
13156 Major System
16125 Major
16555 Major
16433 Normal
16248 Normal
16442 Normal
16586 Normal
App Server
App Server
Parser
Parser
App Server
App Server
In high eps environment, license checking may fail because of the inability to fork new processes, resulting in workers to become unavailable.
The feature "Fire Incidents for Approved devices only" does not work correctly
User added widgets to dashboards in Super global mode always run in adhoc query mode (instead of inline mode), making dashboards run slowly
Netflow Application from Fortinet firewalls is not handled correctly
Syslog over TCP does not work correctly - logs are not complete
Summary dashboard loads slowly when there are large number of devices with location specified
Incident Notification over XML over HTTPS Notification does not work correctly because of handshake failure.
16286 Enhancement GUI
16567 Normal Performance
Monitoring
Add search filter for collectors in Admin > General Settings > Event Org mapping > Add > Collectors
AWS RDS monitoring sometimes does not work correctly.
Page 19
FortiSIEM Installation Guide FortiSIEM Installation Guide
16470 Normal
16581 Normal
Rule Engine
GUI
16530 Normal Performance
Monitoring
16481 Normal Performance
Monitoring
16093 Enhancement App Server
16251 Enhancement GUI, Parser
Incidents may not trigger when Event Dropping Rules refer to stale CMDB Objects
'Copy to remote' option is turned off for 'Scheduled for' when user schedules a report in Super/global mode.
SNMP V3 with AES not working after upgrading to 4.6.2
STM job credential manipulation may cause discover and performance monitor to crash. This is first introduced in 4.6.2
enhancement that obfuscates user names and password in system calls from back end processes
Report names are not meaningful when they are copied over to an external location in "Copy to remote" feature
Allow comma separated External Org in Event Org Mapping. This allows for multiple external organizations to map to a single FortiSIEM organization.
Current Open Issues
Id Severity
8867 Normal
11036 Normal
14242 Normal
Component
Rule Engine
Rule Engine
Query Engine
15022 Normal
11112 Normal
14478 Normal
15109 Normal
15247 Normal
15253 Normal
Parser Engine
Rule Engine
GUI
Performance
Monitoring
Parser
Parser
14929 Normal
15068 Normal
15231 Normal
Performance
Monitoring
Application
Server
Application
Server
15233 Minor Application
Server
GUI 15300 Minor
9261 Enhancement Application
Server
Description
LAST and FIRST operators in rules do not work (may crash Rule Worker module)
Rule Worker module may abort when a PctChange Expression is used
RBAC data conditions not enforced for SP organizations when login in via the super org and moving to another org.
Parser module may stall/pause if a host name resolution is slow. Work around for now is to disable host name resolution.
COUNT DISTINCT operations consume large resources for rules utilizing Anomaly Detection
Sometimes GUI pops up warning (Large amount of data stored over the boundaries) when users restore the archived data or delete the restored data
Failed Custom JDBC job shows in performance page after Discovery
AIX Parser cannot parse events correctly.
Reporting device name is parsed wrong in LinuxInotifyParser (affects Linux file integrity monitoring via AccelOps agent)
Maintenance calendar issue - Maintenance for a device does not start at the configured time if there is a long running disabled job of another device
Dashboard Search Filtering Does not work for Clariion LUNs under Summary Tab
Generating PDF Reports over 100 Pages will drop Page Footer
"Validation Status" column in Admin->Event DB->Event Integrity does not allow for sorting.
For Report Server, if you sync -> unsync -> sync is rapid succession, then the last sync may not take effect
Charts in exported reports (PDF format) only contain stacked charts - not line charts
Page 20
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's new in Release 4.6.2
Super or Worker Upgrade from 4.6.1 to 4.6.2
This is applicable only if you are upgrading from 4.6.1 to 4.6.2 on the supervisor or worker nodes. If you are upgrading from
4.5.2 or before, then you can ignore this step. You must run the following command as root prior to running the
phupgradeimage
comm and, or the upgrade will fail: rpm -e vmware-jre
Collector Upgrade from 4.6.1 to 4.6.2
. then you can ignore this step. You
GUI, or the upgrade will fail:
must run the following commands as
root
on each collector prior to upgrading the collector from the mkdir -p /opt/phoenixphscripts/bin ln -sf /opt/phoenix/phscripts/bin/phcollectorimageinstaller.py
/opt/phoenixphscripts/bin/phcollectorimageinstaller.py
Running on VMWare ESX 6.0
If you are importing AccelOps VA, Collector, or Report Server images for VMWare on an ESXi 6.0 host, you will need to also "Upgrade
VM Compatibility" to ESXi 6.0. If the VM is already started, you need to shutdown the VM, and use the "Actions" menu to do this. Due to some incompatibility created by VMWare, our collector VM processes restarted and the collector could not register with the supervisor.
Similar problems are also likely to occur on supervisor, worker, or report server as well, so make sure their VM compatibilities are upgraded as well. More information about VM compatibility is available in the VMWare KB below:
https://kb.
vmware
.com/kb/1010675
This release contains the following bugs fixes.
Bug Fixes
Bug
ID
Severity
15161 Major
Component
Performance Monitor,
Discovery
16235 Major Parser
16249 Minor
16237 Minor
Discovery
Performance
Monitoring
Description
The ability for AccelOps to connect to SNMP on a UDP port different than default 161, a 4.6.1 feature, does not work correctly.
WMI based pulling of Windows Security, Application and System logs truncates some event attributes. So certain windows eports and rules may not work correctly.
Default hardware serial numbers (like "None" in CentOS) causes two devices to be merged incorrectly during discovery
Long running performance monitoring jobs may cause new performance monitoring jobs to not take effect
Page 21
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's New in Release 4.6.1
RELEASE 4.6 UPGRADE REQUIREMENT
Starting 4.5.1, AccelOps Supervisor virtual machine requires 24GB RAM. The increase from 16GB RAM in prior releases is needed for the data collection robustness and visibility feature. Supervisor node is now caching device monitoring status for faster performance by avoiding database I/O. Without the additional RAM, Supervisor node will not operate properly.
RELEASE 4.6 NEEDS MORE OS SWAP SPACE
Starting 4.6.1, Linux swap space is increased to match the physical memory size, as recommended by Linux best practices for optimal system performance. This size is automatically increased during 4.6.1 upgrade which may cause upgrade to take a little longer than normal.
CLUSTER UPGRADE REQUIREMENT
Follow these steps while upgrading a VA cluster
1.
2.
3.
Shutdown all Workers. Collectors can be up and running.
Upgrade Super first (while all workers are shutdown)
After Super is up and running, upgrade worker one by one.
Step #1 prevents the accumulation of Report files while Super is not available during upgrade (#2). If these steps are not followed,
Supervisor may not be able to come up after upgrade because of excessive unprocessed report fie accumulation.
Note: Both Super and Worker MUST be on the same AccelOps version, else various software modules may not work properly.
However, Collectors can be in older versions - they will work except that they may not have the latest discovery and performance monitoring features in the Super/Worker versions. So AccelOps recommends that you also upgrade Collectors within a short period of time.
Major Windows Log (via WMI) Collection Issue
We have discovered a major issue in the 4.6.1 release:
Issue
WMI based log pulling from Windows servers incorrectly truncates event keys in the AccelOps generated log.
Impact
This causes some event attributes in Windows Security, Systems and Applications logs to be not parsed correctly. Consequently, the rules and reports that are based on those event attributes will not work.
Remediation
We are working on a 4.6.2 patch release to quickly address this issue. 4.6.2 is planned to be release next Tuesday.
You can either choose to wait till next week to upgrade to 4.6.2, or you can use the workaround below to patch your 4.6.1 version.
Download URL: https://images.accelops.net/VMs/patches/ao/4.6.1-Patch/
Steps to Apply Patch:
Step 1
:
Backup original wmic
Login to super/worker/collector as root
Run "su admin"
Run "cd /opt/phoenix/bin"
Run "cp wmic wmic.orig"
Step 2:
Replace the original wmic
Download new mic executable : https://images.accelops.net/VMs/patches/ao/4.6.1-Patch/
Upload wmic to super/worker/collector
Copy wmic to /opt/phoenix/bin
Run "chmod 775 mic"
Run "chown admin.admin wmic"
Note:
No restart is required. The new wmic executable will start generating the logs correctly.
Page 22
FortiSIEM Installation Guide FortiSIEM Installation Guide
This patch needs to be applied to all nodes that are collecting logs from windows servers. So better to patch supervisor, worker and all collectors running 4.6.1
This release adds features and functionality in several areas.
Salesforce ticketing and CMDB integration
Ability to decommission a device from CMDB
Ability to export/import widget dashboard
Performance and Availability Monitoring
Microsoft Azure compute discovery
CyberArk Password Vault Integration
Allow users to move devices from one system defined CMDB group to another
Reduce system CPU usage for SNMP V3
Keep Identity and Location database table size within limits
Allow scheduled reports to be copied to a new location
Allow queries via API to return results in csv format (gzipped)
Add a flag to control the use of winexe in discovery
Allow user to format Comment field in ServiceNow and ConnectWise for Incident Outbound
Ability to choose host name resolution mechanism during discovery
Create CMDB Report for Custom Threshold
Allow user to choose ports during SNMP port during discovery
Current Open Bugs/Enhancements
Platform Features
Two factor authentication
Presently the following 1-factor authentication methods are available for authenticating AccelOps GUI users:
Local authentication
External authentication via LDAP (Microsoft Active Directory and OpenLDAP), via RADIUS and
Cloud Authentication via SAML (Okta)
This release makes AccelOps more secure by enabling 2-factor authentication via Duo Security. Administrator needs to tighten user's authentication profile by specifying two factor authentication. AccelOps will prompt the user for second factor credential after regular login. Other 2 factor authentication services e.g. Google Authenticator will be added in future releases.
Details on how to set up two factor authentication is described
Salesforce ticketing and CMDB integration
This release extends third party CMDB and ticketing integration by providing a plugin module for Salesforce.
Devices discovered in AccelOps can be synced to Salesforce
A ticket can be created in Salesforce when an incident triggers in AccelOps
Ticket status is updated in AccelOps when it is closed in Salesforce
Details on Salesforce ticketing and CMDB integration is discussed
Page 23
FortiSIEM Installation Guide FortiSIEM Installation Guide
Ability to decommission a device from CMDB
Often there is a need to decommission a device and assign its IP Address to a new device. Currently, user has to delete the old device otherwise the old and the new devices will be merged as they share IP addresses. However there may be a need to keep the device in CMDB for audit purposes.
This release solves this problem by providing a separate folder for decommissioned devices. Once a device is decommissioned, it is removed from all CMDB groups and maintenance calendars, performance monitoring are stopped. The device is moved to the Decommissioned device folder. A new device with the same IP address can now be discovered and the two devices will coexist in CMDB.
Ability to export/import widget dashboard
This release provides the ability to export a widget dashboard definition into an XML file. Every dashboard customization e.g. chart types, widget positioning is saved. Another user can then import the XML file and see exactly the same dashboard. This feature saves lots of work in recreating dashboards.
Dark theme dashboard
This release allows users to have a dark theme dashboard. Currently this is a global setting - so all users would have the same theme.
Disaster recovery scripts
A common way to perform disaster recovery is as follows
Set up an separate AccelOps cluster (Super, Workers) in a distant location - this would be a passive instance
Replicate the CMDB, SVN and event database
CMDB can be replicated by copying the exported file or by enabling PostgreSQL replication
SVN and event database can be copied over via rsynch or NFS mechanisms
This release provides a script which can bring up the passive instance and make it active. When disaster strikes, the user would do the following steps
1.
2.
Run the script on the passive instance supervisor node.
Register the passive Supervisor
Performance and Availability Monitoring
Microsoft Azure compute discovery
This release enables users to discover virtual machines in the Microsoft Azure cloud using Azure API. The API provides basic information like host name and access IP address. Therefore, SNMP and/or WMI must be used to discover the virtual machines in depth.
Link usage dashboard
For perimeter network devices such as firewalls and routers, it is important to know which interfaces are busy and which traffic is consuming the most resources. This special dashboard provides this view and enables users to determine which router interfaces are overly utilized, which applications are using them and what is the QoS statistics.
Log Management and SIEM
CyberArk Password Vault Integration
AccelOps needs credentials to communicate to devices. Until this release, credentials needed to be stored locally (encrypted). This release allows
Page 24
FortiSIEM Installation Guide FortiSIEM Installation Guide device credentials to be fetched from CyberArk Password Vault. This makes AccelOps more secure.
Setting up CyberArk is discussed here
.
Using CyberArk for discovery is discussed here
.
Configuring AccelOps for receiving CyberArk syslog is discussed here.
Salesforce CRM Audit support
Audit logs from Salesforce CRM application can now be collected by AccelOps. For details see
Microsoft Azure Audit support
Audit trails from Microsoft Azure cloud can now be collected by AccelOps. For details, see
Cisco CloudAMP API support
Rather than have a FireSIGHT Manager on premise, customers can choose to send alerts to the cloud. Using Cisco provided CloudAMP API,
AccelOps is now able to collect (mostly end point) alerts from the Cisco Cloud.
ISO 27001 Compliance support
This release adds reports for ISO 27001/27002 compliance specifications.
Device Support
New Support
1.
2.
3.
4.
5.
Cisco ONS - discovery, performance monitoring via SNMP and log analysis - see
Cylance Protect - log analysis - see here
Pulse Secure VPN - log analysis - see
Cyphort - log analysis - see
McAfee Stonesoft IPS - log analysis - see
Significant Enhancements
Allow users to move devices from one system defined CMDB group to another
User could already move devices from one user defined group. This release extends that functionality to system defined groups.Using this feature, user can fix device mis-classifications by discovery.
Handle syslog over TCP
AccelOps can now ingest syslog over TCP as defined in IETF RFC 6587.
Reduce system CPU usage for SNMP V3
In earlier release, the use of SNMP V3 caused significant system CPU usage during performance monitoring. This issue is resolved by reducing the number of process forks.
Keep Identity and Location database table size within limits
Identity and location entries can quickly fill up PostgreSQL database. This release allow you to control the growth of Identity and location entries by specifying two entries in the phoenix_config.txt.
Page 25
FortiSIEM Installation Guide FortiSIEM Installation Guide
PURGE_IDENTITY_LOCATION_OVER_MONTHS = 12
PURGE_IDENTITY_LOCATION_OVER_ROWS = 1000000
PURGE_IDENTITY_LOCATION_OVER_MONTHS specifies the maximum age of Identity location database table entries.
PURGE_IDENTITY_LOCATION_OVER_ROWS specifies the maximum number of rows in the Identity location database table.
When any one of the above limits are hit, the Identity location database table is purged.
Allow scheduled reports to be copied to a new location
Earlier releases allow scheduled reports to be emailed. Now the reports can be copied to be remote location via SSH.
Allow queries via API to return results in csv format (gzipped)
It is possible to retrieve query results via API. The results are in XML format, which is not very efficient if the result set is large. This release allows query results to be retrieved in gzipped csv files.
Add a flag to control the use of winexe in discovery
AccelOps discovery uses winexe to detect HyperV VM, Windows domain controller diagnostic (dcdiag) and replication monitoring (repadmin
/replsummary). The winexe command is used to run a command on a remote windows server. However, by the nature of this command implementation by Microsoft, winexe starts a service called winexesvc on the remote server which customers do not find acceptable.
This release provides users an option to turn off winexe based discovery. This option is available in the discovery dialog.
Allow user to format Comment field in ServiceNow and ConnectWise for Incident Outbound
External ticketing systems do not have so many detailed incident attributes as AccelOps. This release enables to create a custom formatted string in the comment field in the external ticketing system.
.
Ability to choose host name resolution mechanism during discovery
AccelOps discovers by IP addresses and used first DNS and then SNMP/WMI to get host names from IP addresses. This release allows users to control the behavior.
An discovery option now allows users to choose between DNS first (i.e. the current behavior) or SNMP/WMI first (that means SNMP/WMI then
DNS).
Note - host names, once discovered are not overwritten by discovery.
Create CMDB Report for Custom Threshold
It is possible to now have a CMDB Report containing only those devices for which user has modified default thresholds.
Allow user to choose ports during SNMP port during discovery
AccelOps can now connect to SNMP via non-standard port. User can define the port during discovery. This option is available in the discovery dialog.
Bug Fixes / Enhancements
Page 26
FortiSIEM Installation Guide FortiSIEM Installation Guide
Id Severity Component
15147 Major
15473 Normal
8393 Normal
15221 Normal
System
App Server
System
15482 Enhancement App Server
15500 Normal Performance
Monitor
15975 Normal Performance
Monitor
15816 Normal Performance
Monitor
15771 Enhancement System
15316 Normal App Server
Description
Upgrade loses user defined parsers for user defined device types
Sync Update Config warning not clearing in System Error window
Credentials can be seen in plain text view when running ps on cli during discovery and performance monitoring
Backend C++ modules need to handle XML with empty attributes and not crash
Add Device Annotation in CMDB Report and Device Integration Inbound
Interface performance monitoring job may consume large memory when there are large number of interfaces
WMI based log collection executable crashes when handle large messages containing ":"
HyperV Performance monitor job may consume large amount of memory over time
15751 Normal App Server
14478 Normal
15449 Normal
System
System
15969 Normal Database
15403 Enhancement GUI
15468 Normal Performance
Monitor
15309 Enhancement Database, App
Server
15875 Normal App Server
15499 Normal
16002 Normal
15489 Normal
15197 Normal
16080 Normal
15466 Normal
15988 Normal
GUI
Parser
Parser
System
System
Parser
Data
Swap sizes on all nodes must be set to memory size to avoid performance issues
Excessive number of expired scheduled device maintenance entries causes performance issues. They are now deleted automatically.
Cloning/creating rules does not place them under the correct Function group (e.g. Security) unless the system (or numerous processes) are restarted
In some cases, system not able to restore the archived data or delete the restored data
Prevent large Postgresql log files in /cmdb/data/pg_log/ from filling the /cmdb disk
Baseline profile schema upgrade error causes excessive loging and failed base lines in some cases
RBAC: Report Server Sync button - disallow in "Run" mode, allow in Edit mode
Java vulnerability pulling agents can randomly fail because of incorrect way of checking for potentially non-existent parameters in the vulnerability scan reports.
Add Reporting Device Name to an incident. Show this field in Incident dashboard. Make sure Incident XML has this field.
Incident ID grew over time and results in an overflow causing incident report export to fail
Add "Device Type" in Incident XML for Incident Outbound Integration
Event rate in PH_SYSTEM_DEVAPP_EVENTS_PER_SEC is extremely high
PH_DEV_MON_HW_TEMP of HP Comware switch misses hardware components.
EMC VNX connectivity test stops working after upgrade
Need to add Kafka configuration for VA after upgrading to 4.5
WinOSWmiParser not parsing event id's 4800 and 4801 correctly
SNMP Service Unavailable incident can not triggered
Current Open Bugs/Enhancements
Id Severity
8867 Normal
11036 Normal
14242 Normal
15022 Normal
11112 Normal
14478 Normal
15109 Normal
15247 Normal
Component
Rule Engine
Rule Engine
Query Engine
Parser Engine
Rule Engine
GUI
Performance
Monitoring
Parser
Description
LAST and FIRST operators in rules do not work (may crash Rule Worker module)
Rule Worker module may abort when a PctChange Expression is used
RBAC data conditions not enforced for SP organizations when login in via the super org and moving to another org.
Parser module may stall/pause if a host name resolution is slow
COUNT DISTINCT operations consume large resources for rules utilizing Anomaly Detection
Sometimes GUI pops up warning (Large amount of data stored over the boundaries) when users restore the archived data or delete the restored data
Failed Custom JDBC job shows in performance page after Discovery
AIX Parser cannot parse events correctly.
Page 27
FortiSIEM Installation Guide FortiSIEM Installation Guide
15253 Normal Parser
14929 Normal
15068 Normal
15231 Normal
Performance
Monitoring
Application
Server
Application
Server
15233 Minor Application
Server
GUI 15300 Minor
9261 Enhancement Application
Server
Reporting device name is parsed wrong in LinuxInotifyParser (affects Linux file integrity monitoring via AccelOps agent)
Maintenance calendar issue - Maintenance for a device does not start at the configured time if there is a long running disabled job of another device
Dashboard Search Filtering Does not work for Clariion LUNs under Summary Tab
Generating PDF Reports over 100 Pages will drop Page Footer
"Validation Status" column in Admin->Event DB->Event Integrity does not allow for sorting.
For Report Server, if you sync -> unsync -> sync is rapid succession, then the last sync may not take effect
Charts in exported reports (PDF format) only contain stacked charts - not line charts
Page 28
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's new in Release 4.5.2
15265
15320
15344
15371
15376
15345
15369
15285
15372
15294
15313
15343
15120
15249
15253
15255
15399
15400
15266,
15330
15373
15317
15397
Bug Fixes
Bug ID
15260
15346
15368
Severity
Major
Major
Major
15398 Major
Major
Major
Normal
Component Description
GUI Group By cannot be saved in Rule sub-patterns when creating / editing rules
GUI
App Server
VCenter Cluster level CPU and Memory Utilization events are not generated
Sometimes airline monitoring events have customer id 1 (Super/local) instead of correct customer id
(corresponding airline)
System
System
Parser
Parser
Upgrade issue - VMware pulling via Collectors - Old VMware SDK libraries (vim25-4.0.jar,vim-4.0.jar) in Collector causes VMware event pulling problems
Upgrade issue - missing perl-IO-Socket-SSL and perl-NetAddr-IP packages on 4.5.1 Collector causes eStreamer communication to fail from Collelctor
"use_dns_lookup=no" flag NOT working for SyslogNGParser and UnixParser
Excessive DNS failed login causes phoenix.log to grow
Normal
Normal
Normal
Normal
Normal
Normal
Minor
Minor
Minor
Minor
Minor
Minor
Minor
Minor
Data
GUI
Data
Manager
Parser
App Server
App Server
Data
Data
Data
Data
Data
Data
Data
Data
Windows successful logon event parsed incorrectly as logon failure events
Mistakenly removes Event Receive Status for Windows Agent when user disables WMI event pull
Occasional crash in phDataManager due to out-of-scope pointer usage
Strange device types created in CMDB from Netflow discovery
Exception causes App server task cache and database to go out of synch - this causes memory leak in Agent
Manager
Creating a rule exception in Super Local will erroneously remove the corresponding entry from system watch list
Fortinet IPS Event Severity Parsing is incorrect
Some CMDB Reports containing single quote in Filter condition incorrectly displayed and do not produce correct results
Reporting device name is parsed wrong in LinuxInotifyParser
Windows Server Failed Logons report definition is incorrect because logon failure events do not have winLogonType
Reporting Device name is parsed incorrectly in agentless FIM events
AccelOps-WUA-WinLog should be parsed to syslog
Parsing error for sourcefire, cisco acs, junos
H3C syslog events have incorrect Reporting IP 0.0.7.224
Minor
Minor
Data
Data
One system CMDB report in Ungrouped category
Some profile rules did not report incident attributes correctly
Minor Data
Enhancement Data
Should not show SSH credential for Cisco FirePower in Credential tab
Parse IOS-CDP-NATIVE_VLAN_MISMATCH
Enhancement Enhancement Parse attribute from Windows System Time Change events and add a PCI report
New Device Support
Symantec DLP - log analysis - see here
IBM OS400 (iSeries) Log Parsing via Townsend Agent - see here
Tufin SecureTrack - log analysis - see here
IBM Guardium - log analysis - see here
Page 29
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 30
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's New in Release 4.5.1
NEW RELEASE 4.5 UPGRADE REQUIREMENT
Starting 4.5, Supervisor requires 24GB RAM. The increase from 16GB RAM in prior releases is needed for the data collection robustness and visibility feature. Supervisor node is now caching device monitoring status for faster performance by avoiding database
I/O. Without the additional RAM, Supervisor node will not operate properly.
This release adds features and functionality in several areas.
Data collection robustness and visibility
Export events to other Big Data systems via Kafka
CMDB Outbound Integration for ConnectWise
Performance and Availability Monitoring
Maintenance calendar for Synthetic Transaction Monitor jobs
SLA calculation for SNMP and WMI Ping
Log Management and Security Monitoring
Multi-tenant reporting device handling
DataManager and ReportWorker module robustness
Additional metrics on trend charts
Simplify Cloud and Collector health GUI
Ability to manually add hosts to Application Groups
Set important process and critical interface definitions directly from CMDB
Dashboard charting enhancements
Accounting for internal and performance monitoring events
Ability to change event database purge/archive thresholds
Ability to set remote directory renaming action during archive
Current Open Bugs/Enhancements
Platform Features
Data collection robustness and visibility
This release enhances the reliability and visibility of AccelOps data collection in the following ways.
Detailed visibility on when data was last collected: (a) data from performance monitoring jobs on a per device, per job basis and (b) data pushed from external devices on a per device per protocol basis. Last collection times are visible by simply visiting > tab. The times are updated frequently (every 2 minutes).
A versioning scheme is introduced to make sure that the Application Server and the data collection agents (Java agents and Performance Monitor modules in Collectors, Workers) are always in sync. This ensures that when user changes (either manual or from discovery) are always reflected in data collection. If there is a version discrepancy, means that data collection agents are not working on the most up to date version, an alert is created based on a system rule.
System rules are provided for the following error scenarios: User can decide to restart a module or the entire application via a notification policy/remediation scripts.
1.
2.
3. all jobs on a data collection agent are delayed a particular job on a data collection agent are delayed a version discrepancy is detected - a data collection agent (Collector, Worker) has not picked up the correct monitoring version within a certain amount of time
Details on how data collection times and status is reported in CMDB are
Page 31
FortiSIEM Installation Guide FortiSIEM Installation Guide
Export events to other Big Data systems via Kafka
AccelOps collects a wide variety of logs and performance metrics and uses the data for its own analysis. This release enables users to export the logs in a parsed format to any external system via Kafka, a highly scalable distributed message bus (see Apache Kafka ). AccelOps has developed a connector that publishes to the Kafka message bus. This feature can be used to populate a Big Data system with rich AccelOps data.
Details on configuring AccelOps for Kafka export is discussed
CMDB Outbound Integration for ConnectWise
ConnectWise is an important help desk / ticketing system specially for service providers. AccelOps already has two-way integration with
ConnectWise ticketing - a ticket can be created in ConnectWise and state updates in ConnectWise is reflected in AccelOps. This release extends the integration to cover CMDB. When AccelOps discovers a device, ConnectWise CMDB can be populated, either automatically or on demand.
When AccelOps discovers changes, the change can be synced to ConnectWise. A framework is provided to convert device attributes like
Organizations, host names, device types to ConnectWise specific fields and fields.
Details on configuring AccelOps for ConnectWise outbound CMDB integration is discussed
. AccelOps provides a special content mapping feature where any AccelOps CMDB attribute and values can be converted into a corresponding ConnectWise CMDB attribute and values (see
Step 11).
Dashboard slideshow
Users are now able to select a set of dashboards and display them in a slideshow mode on big monitors to cover the entire display. This is useful for Network and Security Operation Centers.
Details on creating dashboard slideshow is discussed here
.
Performance and Availability Monitoring
Maintenance calendar for Synthetic Transaction Monitor jobs
This release allows the ability to add Synthetic Transaction Monitor (STM) jobs to a maintenance calendar. While a STM job is under maintenance, the job is not executed and system rule does not trigger if the job fails.
Details on how to create maintenance calendars for STM jobs is detailed
Real time performance probing
Often for checking the health of a device or an application, it is necessary to probe the device and check its current performance metrics. Until now, the option in AccelOps would be to query the system for performance monitoring events - this does not quite serve the purpose since the polling intervals are too large (3 minutes of so for most jobs) - so you would not get results for next 3 minutes. This release allows users to probe the device at a much faster pace (e.g. few seconds apart) and see the metrics in a real time scrolling fashion on the GUI. These metrics are polled in addition to the regular scheduled performance polls - they are neither stored nor do they trigger any rules or are part of any report. Currently, only a subset of important system performance metrics are supported for real time performance probes, e.g. system CPU, memory, disk, interface and process utilization.
Details on how to probe devices for real time performance metrics is discussed
.
SLA calculation for SNMP and WMI Ping
Until now, we calculated Min/Max/Average Round Trip Time, downtime and SLA for ICMP Ping only. This notion is extended for two other critical performance monitoring protocols - SNMP and WMI.The events PH_DEV_MON_SNMP_PING_STAT and PH_DEV_MON_WMI_PING_STAT now contain the following additional attributes
Average Round Trip Time (RTT)
Max Round Trip Time
Min Round Trip Time
Pct Packet Loss
System Down time
System Degraded Time
SNMP Ping is calculated by issuing a very basic SNMP OID (1.3.6.1.2.1.1.1 - sysDescr in MIB-2) that is present in all SNMP implementations.
WMI Ping is calculated by fetching a basic WMI Class (Win32_OperatingSystem) that is present in all WMI implementations.
Page 32
FortiSIEM Installation Guide FortiSIEM Installation Guide
Statistical computations (e.g. max, min, average) are done by sending 5 requests for the same object a few seconds apart. System is considered down for the polling interval if packet loss is 100%. System is considered degraded for the polling interval if packet loss is less 100% but greater than 50%.
Two reports are provided
Top Devices by SNMP RTT
Top Devices by WMI RTT
Trace route monitoring
Trace route is important for monitoring hop by hop latency between two wide area end points. It is important to know when latency for a particular hop increases significantly - this is often a precursor for internet outage. This release allows users to run trace route from any AccelOps node to any destination using the Synthetic Transaction Monitoring (STM) framework.
Details on how to set up trace route monitoring is described
here . One report is provided: Top Trace Route Hops by RTT.
Log Management and Security Monitoring
Multi-tenant reporting device handling
This release allows AccelOps to handle reporting devices that are themselves multi-tenant. As an example, a Fortinet firewall can report logs for multiple organizations from the same source IP - the organizations is reported via the Virtual Domain variable. As another example, Qualys
Vulnerability Scanner can report vulnerabilities for the devices belonging to multiple organizations in the same report via the qualysAssetGroup attribute.
A framework is provided to handle multi-tenant reporting devices. User can set up mapping rules specifying attribute that specifies the external organization in the log.
mapping between external organization to AccelOps organization.
Using these definitions, reporting devices are created and logs are mapped to the respective organizations. Subsequently, rules also trigger in the
respective organizations. Details are in Event Organization Mapping .
Windows Agent Enhancements
This release provides several enhancements
1.
2.
3.
4.
5.
AccelOps Windows Agent and Agent Manager now communicate over HTTP(S) instead of HTTP
File integrity monitoring events will now contain users that made file changes
Ability to export and import license and monitoring template assignments
Support for non-English locale for Windows Servers
Differentiate between files and directories in AccelOps-WUA-FileMon events by using the osObjType attribute. This information is provided for the following cases: (a) create, (b) change, (c) rename but only for the new name. This information the following cases: (a) delete, (b) rename - for the old name.
can not
be provided for
Windows agent upgrade and configuration is covered
Device Support
New Support
9.
10.
11.
12.
5.
6.
7.
8.
1.
2.
3.
4.
13.
14.
15.
Nutanix - discovery and performance monitoring via SNMP - see here
Cisco FireSIGHT integration via eStreamer API - log monitoring - see
AWS RDS and EBS - performance monitoring - see
Airlines in-flight entertainment systems monitoring
Qualys Web Application Firewall log monitoring - see
CiscoWorks Network Control Manager (NCM) - log monitoring - see
Lantronix SLC Console Manager log monitoring - log monitoring - see
Vasco DigiPass - log monitoring - see here
Juniper DDoS Secure - log monitoring - see here
Cisco Wide Area Application Services (WAAS) - performance monitoring - see
Motorola AirDefense Wireless IDS - log monitoring - see here
Motorola WiNG WLAN Access Point - log monitoring - see
Cisco Telepresence Video Communication Server - log monitoring - see
Application server log monitoring - Redhat JBoss, IBM Websphere and Oracle Weblogic - see here
Brocade ADX load balancer - performance monitoring - see
Page 33
FortiSIEM Installation Guide FortiSIEM Installation Guide
16.
17.
18.
19.
Ruckus Wireless LAN - performance monitoring - see
Fortinet FortiManager - performance monitoring - see
NetBotz NBRK 2000 - environmental monitoring - see
Cisco NBAR monitoring - see here
Enhanced Support
VMware SDK 5.5 API integration - AccelOps automatically uses the API for the right VMware version.
Nessus 6.0 integration - AccelOps automatically determines the right Nessus server version and uses the right API for server versions 4,
5 and 6.
Significant Enhancements
DataManager and ReportWorker module robustness
In this release, DataManager and ReportWorker do not restart under the following conditions
NFS is temporarily not available
Unable to create directories during writing or purging
The modules fall behind in reading shared buffer storage
Additional metrics on trend charts
Users can now see maximum, minimum, percentiles and simple moving averages directly in trend charts in Analytics and Dashboard sections.
Simplify Cloud and Collector health GUI
Users can select what columns to display in Cloud and Collector health pages under Admin tab. By default, fewer columns are displayed now.
Ability to manually add hosts to Application Groups
Device and Application groups are important CMDB objects that allow users to write targeted rules and reports. Until now, Application groups were only populated by discovery. This release allows users to manually add to Application groups in cases where discovery is not practical.
Important user case:
Suppose a rule triggers, namely Excessive DNS requests from a host. The host is actually a DNS server which was not discovered.
There is need to create an exception for this rule for this DNS server.
Three choices -
1.
2.
3.
Create a rule exception for this host - sometimes this is not very manageable long term since the fact this is a DNS server can not be used in other analytics
Discover the host and make sure that the host is in the DNS server group - sometimes this may not be practical.
Manually add the server to the DNS server group using this feature. The DNS server group can be used for other rules and reports.
The rule would stop triggering - as desired
Set important process and critical interface definitions directly from CMDB
A important process and a critical Interface are always monitored for up/down status. Before this release, these needed to be configured from
Admin > General Settings. Setting important process was difficult since one had to type in the process name, This release allows user to set these directly from CMDB > Device.
Dashboard charting enhancements
The following improvements are added
For Bar charts, the legends appear next to the charts and not at the bottom. This improves legibility.
Maximum number of displayed entries are increased form 50 to 200.
Accounting for internal and performance monitoring events
Page 34
FortiSIEM Installation Guide FortiSIEM Installation Guide
AccelOps has 3 kinds of logs/events
External logs - these count towards the licensed eps
Performance Monitoring events generated by AccelOps when it monitors a device - these also count towards the licensed eps
Internal system logs - generally reporting errors and important informational events - these do not count towards the licensed eps
Since each of these log types have to indexed, stored and since they trigger rules and reports, system performance can be affected. This release provides accurate accounting of these event types via the phstatus commands and also system provided reports. See
for details.
Ability to change event database purge/archive thresholds
By default AccelOps starts to purge (or archive if archive is set) when the free space in event database falls below 10GB. This continues until free event database space reaches 20GB. In very high event rate situations, this 10GB buffer may not suffice and database may become full. This release allows the values to be customized by the user. In phoenix_config.txt, under the phDataManager section, modify the low_space_action_threshold and low_space_warning_threshold values and restart the phDataManager module. This needs to be done at
Supervisor and Worker nodes.
low_space_action_threshold: (default 10GB): when free space in event database, falls below this value, an action is taken - purge or archive. This continues until free space in event database grows to be more than low_space_warning_threshold low_space_warning_threshold: (default 20GB): when free space in event database, falls below this value, a warning is generated.
[BEGIN phDataManager]
....
low_space_action_threshold=10 low_space_warning_threshold=20
...
[END]
Ability to set remote directory renaming action during archive
When AccelOps is archiving and the destination directory already exists, then you can configure AccelOps to either rename the existing directory and archive new data to that location or skip archiving archive-rename_existing_directory - set to true for rename; event database will be properly archived archive-rename_existing_directory - set to false for skipping archiving
[BEGIN phDataManager]
....
archive_rename_existing_directory=true # if true, rename existing dir, otherwise, skip archiving the day.
...
[END]
Registration APIs
Three new APIs are provided for the following functions. For details, see
Register Workers to Supervisor
Register Collector to Supervisor
Register Supervisor to AccelOps License Manager
Bug Fixes / Enhancements
Page 35
FortiSIEM Installation Guide FortiSIEM Installation Guide
Id Severity
15147 Major
13921 Major
14228 Minor
14695 Minor
14940 Minor
15079 Minor
13647 Minor
14409 Normal
14274 Normal
15020 Normal
14347 Normal
14474 Normal
14667 Normal
14469 Normal
13393 Normal
13811 Normal
13626 Normal
14417 Normal
15014 Normal
15177 Normal
15182 Normal
14474 Normal
12992 Normal
8515 Normal
12319 Normal
13954 Normal
14576 Normal
14826 Normal
14844 Normal
14935 Normal
7463 Enhancement
13068 Enhancement
13726 Enhancement
Parser
Performance
Monitoring
GUI
Application
Server
Discovery
Performance
Monitoring
Performance
Monitoring
Performance
Monitoring
Application
Server
Application
Server
GUI
GUI
GUI
System
Application
Server
Application
Server
Discovery
GUI
GUI
GUI
Performance
Monitoring
Device
Support
Discovery
Performance
Monitoring
Rules
Application
Server
GUI
Component Description
System
Application
Server
System
System
System
Separate Chinese language support from English versions
SANS Low Sensitivity does not update by the system default API
New install images for Collector and Super utilize the same OS RPM packages
AccelOps can not connect to the Internet via a Proxy
Address Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability:
(CVE-2004-2320, CVE-2007-3008) by disabling the ability to respond to HTTP TRACE requests
Secure Redis service running on Supervisor node by disallowing access from the outside
Stopped Report Generates an Application Exception when it is re-ran
GUI
Need to escape special character in rule definition xml
VCenter discovery - sometimes a folder shows no VMs in Dashboard > VMView
Can't adjust sliders on Dashboard Widgets with multiple sliders
Add/Modify Rule Exception causes Rule to Save with a new name
External lookup broken on Summary Dashboards
Changing a Custom WMI (not just WMI) does not take effect even after discovery
Default WMI Parser not parsing Sharepoint Event Types Correctly
Resolve device hostname for ping only discover devices
No Performance Data Collected After Fortigate Firewall upgrade to version 5.2.3
Refined Sub-pattern in "Black List User Agent Match" to reduce false positives
Discovery merge need to OVERWRITE device group also instead of add on
CMDB Device filtering does not work when Reporting IP can be resolved by DNS
Some IOS hardware failure events do not parse
Device interface utilization may not be reported because of XML size overflow (extra large deployments)
"External Lookup" broken on Summary Dashboards
Reverse Tunnels do not timeout as described
NetBotz NBRK0200 is not discovered as NetBotz
Add Provisioned disk size into PH_DEV_MON_VM_DISK_UTIL event
Memory Utilization for HPUX process reported as higher than actual Physical Memory Utilization
PH_JAVA_AGENT_ERROR due to vmDataStore perfmap wrong key
When App server is restarted, false Collector down emails are sent out
Need to turn off Beaconing report generation when Beaconing feature is turned off
CMDB Exception Report does not correctly populate customer (Org)
Allow Location information in custom email template
Location CSV import needs to be able to do the following (a)intelligently find the entry, (b)merge the entries with changes that are necessary and (c) provide a UI update to tell which entries were updated with changes
Use labeled bars on bar charts rather than a legend
Page 36
FortiSIEM Installation Guide FortiSIEM Installation Guide
14212 Enhancement
14585 Enhancement
14701 Enhancement
GUI
Application
Server
Application
Server
GUI
Add a CMDB report for clear rules
Optimize CMDB Object REST API for EventType, BizService, Device, Application groups via App Server caching technique
Selenium import utilizing java web driver instead of python web driver scripts
14775 Enhancement
14781 Enhancement
13809 Enhancement
14989 Enhancement
14760 Enhancement
15149 Enhancement
GUI
GUI
GUI
GUI
Rule / Query
Engine
13776 Enhancement
15141 Enhancement
13726 Enhancement
14474 EnhancementGUI
Reports
Device
Support
GUI
15059 Enhancement
15091 Enhancement
Device
Support
Device
Support
In CMDB page, change "Last Updated Time" to "Last Discovered Time" and "Last Updated Method" to "Last
Discovered Method"
Widget dashboard - Table View - Allow one table for whole dashboard
Format report bundle PDF output - show correct page index, remove total number of pages
In Rule/report filter condition, allow user to choose any event attribute attribute IN CMDB Object
In Admin > Setup > Change/Performance Monitor page - Do not show devices deleted by discovery
Optimization of Rule and Report Worker for large IP Value Set
CMDB Report added to show Rules with Clear Conditions
Merge Windows via Log Discovery Using machine GUID
Using Labeled Bars on Bar-charts Rather than a Legend
Allow user to not show Event Type in Dashboard (save precious space)
Additional Parsing for DNS Bind (RPZ)
Handle Unknown event types for Ironport Mail and Web events
Current Open Bugs/Enhancements
Id Severity
8867 Major
11036 Major
14242 Major
15022 Major
11112 Major
14478 Major
15109 Major
Component
Rule Engine
Rule Engine
Query Engine
Parser Engine
Rule Engine
GUI
Description
LAST and FIRST operators in rules do not work (may crash Rule Worker module)
Rule Worker module may abort when a PctChange Expression is used
RBAC data conditions not enforced for SP organizations when login in via the super org and moving to another org.
Parser module may stall/pause if a host name resolution is slow
COUNT DISTINCT operations consume large resources for rules utilizing Anomaly Detection
Sometimes GUI pops up warning (Large amount of data stored over the boundaries) when users restore the archived data or delete the restored data
Failed Custom JDBC job shows in performance page after Discovery
14766 Major
15230 Major
15247 Normal
15253 Normal
14929 Normal
15068 Normal
15231 Normal
15294 Normal
14829 Normal
Performance
Monitoring
Application
Server
Parser
Parser
Parser
Performance
Monitoring
Application
Server
Application
Server
Parser
Documentation
LOG discovery does not work properly with multi-tenant reporting devices
Syslog-over-TCP does not work correctly
AIX Parser cannot parse events correctly.
Reporting device name is parsed wrong in LinuxInotifyParser (affects Linux file integrity monitoring via AccelOps agent)
Maintenance calendar issue - Maintenance for a device does not start at the configured time if there is a long running disabled job of another device
Dashboard Search Filtering Does not work for Clariion LUNs under Summary Tab
Generating PDF Reports over 100 Pages will drop Page Footer
Strange device types may be created by Netflow based LOG discovery. This does not affect system operation.
Rule syntax invalid if use "regexp" as the sub-pattern name
Page 37
FortiSIEM Installation Guide
15233 Minor Application
Server
GUI 15300 Minor
9261 Enhancement Application
Server
FortiSIEM Installation Guide
"Validation Status" column in Admin->Event DB->Event Integrity does not allow for sorting.
For Report Server, if you sync -> unsync -> sync is rapid succession, then the last sync may not take effect
Charts in exported reports (PDF format) only contain stacked charts - not line charts
Page 38
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's new in Release 4.4.5
This release contains the following bug fixes and enhancements. It fixes several issues that were newly introduced in 4.4.3.
Because of bugs 15121, 15075 and 15099, customers running 4.4.3 must immediately upgrade to 4.4.5 for a stable operation.
Bug
ID
Severity
15111 Major
15160 Major
15121 Major
15075 Major
Component
GUI
GUI
Parser
System
15099 Major System
15074 Major
15104 Major
15101 Minor
15102 Minor
14834 Normal
15112 Normal
Query
Performance
Monitor
Application
Server
Application
Server
System
GUI
15100 Normal Application
Server
15162 Enhancement System
15163 Enhancement System
15166 Enhancement Data
15176 Enhancement GUI
Description
(AO-SP) Rule exceptions created under an organization are not saved
Malware hash update via API does not work
Netflow events may be dropped because templates not maintained correctly.
This was newly introduced in 4.4.3.
Clear cache operation in phMonitor module could keep global cache lock and blocking global cache access.
This was newly introduced in 4.4.3.
Lack of mutex can cause a deadlock in phMonitor causing the system to not function correctly.
This was newly introduced in 4.4.3.
A race condition may cause Query Worker to enter a deadlock stage preventing queries from progressing.
Class based QoS data not generated even though the job is added.
Too many sockets opened while running a scheduled Report bundle may cause queries to fail.
(AO-SP) Rulemaster module may not pick up user changes on Rule exception for a specific organization
Partial archives directory can prevent Event DB purging leading to Event DB becoming full.
(AO-SP) Rule Exception notes not saved in per Org level
Improper exception thrown by Application Server on an invalid query may block other queries from progressing.
Disable AccelOps internal Apache logging.
Download of CMDB Objects containing large IP values (e.g. Blocked IP object containing malware data) needs to be optimized.
Handle new version of Cisco FirePower logs.
Identity and location may take a long time to load if the default time window is 1 day - set the default to 1 hour.
Page 39
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's new in Release 4.4.3
This release contains the following bug fixes and enhancements.
Bug
ID
Severity
13806 Major
14527 Major
14565 Major
14650 Major
14652 Major
14705 Major
14726 Major
14201 Normal
Component
Performance
Monitoring
App Server
App Server
App Server
App Server
App Server
App Server
Parser
Description
Server restart detection based on up time does not always work correctly in one case - if the server was in maintenance mode and this is the first time after maintenance and there was a server restart during maintenance.
Newly created Blocked IP and Domain groups can not be always downloaded correctly by the back end modules because the name in malware value group is incorrectly replaced by natural Id
Adding an Incident related report to Business Service Dashboard can cause the Dashboard to not show results
Upgrade from 4.4.1 to 4.4.2 may lead to duplicate Windows Servers in CMDB. In 4.4.2, hardware serial number is added to Windows server from Bios discovery via WMI. If a windows server existed in CMDB before 4.4.2, rediscovery in 4.4.2 would create a new windows server in CMDB with hardware serial number. The two windows servers one without hardware serial number and one with, would nor be merged. Workaround in 4.4.2 would be to delete the
Windows server without hardware serial number.
Some rules created before 4.4.2 does not work after upgrade. The rule caching optimization introduced in 4.4.2 has a bug which ignores some rules with empty created date values. Workaround in 4.4.2 would be to disable and then re-enable the rule.
User edits to interface speeds are overwritten by Discovery. This bug was introduced when we added two fields - sent speed and receive speed to replace the single interface speed
Custom properties (such as global CPU utilization thresholds, per-device CPU utilization thresholds) are lost after upgrade
Drop IPv6 net flow records if IPv6 and IPv4 records are mixed in received Netflow records - since we do not currently handle IPv6 records and they take up lots of storage space
Disable rate limit on rsyslog - this would ensure that all internal logs would be accurately received by the system
Performance Monitor module crashes sometime due to memory corruption
14476 Normal
14477 Normal
14528 Normal
14666 Normal
14690 Normal
14700 Normal
14724 Normal
System
Performance
Monitoring
App Server
Performance
Monitoring
Data
Data
Manager
Report
Worker
14395 Enhancement System
Blocked Domain and IP fields can not be downloaded if a field contains double quote in a field
The character \” in raw message causes custom WMI based performance monitor to have errors
The "A system User Created" rule in incorrectly categorized as a Availability rule
Do not abort when DataManager module fails to create directories in NFS. Create a log
PH_UNABLE_CREATE_DIR_1. The rule "System Critical: DataManager event store failed" would trigger.
In the Summary dashboard, the display of Availability Status column depends on the display of Ping Packet Loss column. So if the Ping Packet Loss column is removed, then the Availability Status column is also not displayed.
Optimize the number of value group requests from back end modules to Application Server by caching - this would reduce the load on the Application Server specially when there are lots of value groups resulting from large number of organizations, business services or large number pf CMDB Objects used in rules and reports
Beaconing - report Unknown Event Types as aggregates - not the raw events themselves
Add discovery and Performance Monitoring for Cisco FirePower IPS module
14567 Enhancement System
14584 Enhancement Discovery,
Performance
Monitoring
14688 Enhancement Discovery,
Performance
Monitoring
14691 Enhancement Discovery,
Performance
Monitoring
14684 Enhancement App Server
14720 Enhancement Data
14651 Enhancement Data
14671 Enhancement Data
14694 Enhancement Data
Add discovery and Performance Monitoring for Dell NSeries 4xxx switches
Add discovery and Performance Monitoring for H3C Comware
Bound the number of API downloaded Threat feed entries in the AccelOps CMDB - by default we never keep more than 100K active entries per threat feed group in AccelOps CMDB by default. This number can be increased or decreased by the user at their own risk. Since there is not guarantee on the quality and number of items in the external threat database, a sudden surge of downloaded entries can have detrimental effect on AccelOps system performance.
Parse a new format of Bit9 syslog
Parse Dell NSeries syslog
Squid Parser needs enhancements for RHEL 7 and squid 3.3
AccelOps Windows Agent generated DHCP logs must also populated Identity location table
Page 40
FortiSIEM Installation Guide
14699 Enhancement Data Add 11 more Windows Security event types
FortiSIEM Installation Guide
Page 41
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's new in Release 4.4.2
This release contains the following bug fixes and enhancements.
Bug
ID
9906
Severity
major
13817 major
13858 major
13941 major
13983 major
14005 major
14077 major
14083 major
14102 major
14177 major
14203 major
14221 major
14254 major
14262 major
14264 major
14287 major
14299 major
Component
14360 major
14393 major
10021 normal
12987 normal
13156 normal
App Server
GUI
Query
Performance
Monitoring
Performance
Monitoring
13157 normal
13355 normal
13483 normal
13602 normal
13651 minor
13652 minor
Performance
Monitoring
Performance
Monitoring
App Server
GUI
Data
Data
13702 enhancement App Server
13750 minor
13858 minor
Performance
Monitoring
Discovery
13911 minor Data
Description
Discovery
App Server
Performance
Monitoring
Discovery
Discovery
Performance
Monitoring
App Server
App Server
App Server
System
App Server
App Server
App Server
App Server
System
Windows
Agent
App Server
Unable to discover multiple AWS accounts in same organization
Optimize the display of large number (more than 20,000) of devices in CMDB - the query to obtain locations has performance issues causing Summary dashboard to not load
Advanced Web Synthetic Transaction Monitoring must work in all cases
AWS CloudTrail API pulls same log more than once
SQL server discovery via with JDBC fails with an Java error
MSSQL 2008 audit monitoring failed with error info: "Execution failed: Invalid column name 'IDcol'
Device properties will not work if property name, device name device group has special characters
Once we create OKTA external auth profile, certificate will not be updated.
Optimize large number of concurrent discoveries for Enterprise deployment with Collectors
Java run out memory during 4.4.1 upgrade due to /root/.bashrc did not get copied properly from
/opt/phoenix/config/sys/root/.bashrc
Sometimes business service reports are not deleted when a business service is not deleted - this causes a pileup of extra inline reports that are being run
Optimize device software patch and device location download to workers and collectors - this causes Workers to not start in large deployments
Dead lock found when accessing ehcache causing threads to be blocked
Connect-Wise incident outbound integration - AccelOps overwrites Summary and Status
Upgrade sometimes causes GlassFish ownership to become root
Windows Agent sometimes has a memory leak because of improper .NET usage
Optimize namedValue device group REST API - this causes ReportWorker module startup problems in large deployments
Rule Exceptions are lost when editing org local rule in org
Widget Dashboard does not honor RBAC - Read Only User can edit dashboards
Query result is incorrect for "user IN LDAP User Group"
Need the ability to modify event polling max for JDBC based polling for SQL database
Increase default process count to avoid fork failures
Netap ONTAPI API for Performance Monitoring chooses http, even when https is selected
Oracle Acme Packet Controller Session Count metric incorrect
Users with View only permission should not be able to add reports to dashboards
For VA with multiple collectors, sorting by any field for a collector restores entire device lis
A few reports have no descriptions
A few reports have incorrect descriptions
Add the ability to use the CMDB Description or Annotation field in Email notifications
Make timeout configurable for http client - so connections between AccelOps modules and Application Server does not time out
HP 3Com Series switch configuration is not pulled because of missing expect script in release
APC UPS events are not properly parsed
Page 42
FortiSIEM Installation Guide FortiSIEM Installation Guide
13923 enhancement Data
13953 minor App Server
Parse more fields from Cisco CDR records
Duplicated disks and networks adapters show in synched ServiceNow CMDB when the discovery or integration schedule interval is short
Monitor child device up/down status for Cisco Meraki Cloud Controller 13955 enhancement Performance
Monitoring
13956 enhancement Data
13976 minor App Server
13986 enhancement Data
14002 enhancement Data
14006 enhancement Data
14037 enhancement Data
14082 enhancement App Server
14085 minor
14086 normal
14090 normal
14091 normal
Data
App Server
Discovery
Discovery
14092 enhancement Data
14093 enhancement Discovery
14095 normal System
14096 enhancement Data
14098 normal Data
14101 normal Performance
Monitoring
14103 enhancement GUI
14107 enhancement Data
14111 enhancement Data
14113 enhancement System
14134 normal App Server
14189 minor
14197 minor
GUI
GUI
14201 enhancement Data
14204 enhancement GUI
14211 minor GUI
14248 enhancement GUI
14255 enhancement Data
14263 enhancement App Server
14268 enhancement Data
14271 enhancement Data
14279 minor Performance
Monitoring
14314 minor Data
14361 enhancement Data
14383 enhancement Performance
Monitor
Need additional parsing for several Win-Security events
Executive Summary Dashboard: Super/local view show other organization's locations
Parse more SNMP traps for Cisco WLAN Controller
Parse more McAfee Intrushield IPS events
Collect CPU and memory information for WLAN Controller
Parse more field for Cisco_UC_RTMT_ExcessiveVoiceQualityReports log
Provide warning for running Incident outbound integration on demand or on schedule to make sure user understands that tickets will be created for old incidents
HyperV Remaining Guest Memory Rule has wrong operator
Optimize the performance of distribution of big IP and domain lists (in malware feeds) from Supervisor to worker nodes. Currently Worker nodes take a long time to initialize because of long download times
Cisco IOS Running config can not be obtained in some cases because of short timeout in expect scripts
Cisco ASA config not discovered when the account has higher privilege (no enable mode)
Eliminate unnecessary "Performance monitoring jobs not picked up for execution" rules that trigger during large discoveries
Discovery Windows Server Serial Numbers via WMI (in Bios)
VM console blue screen shows version 4.3.3 after upgrade to 4.4.1
Add support for QNAP logs
System defined Read only User role can force log out other users
Config discovery timeout causes config change rules to trigger
Bulk select is not available on CMDB>Blocked IPS
Turn Ping suppression off by default - feature not fully developed
Parse syslog for Dell N Series Switch
Allow back-end process to be started only using admin account (not root account)
Failed to get report bundle results in some case
In Analytics Trend charts, y-axis data is not shown in bits/sec
Search filter in group editor removes filtered out items
Drop Netflow IPv6 flow records since IPv6 is not handled currently
Allow users to choose filters when adding reports to filters on a business service
"Locked Users" screen sometimes freezes the GUI
Allow users to keep the same report name after edit (for user reports)
Move "My Dashboard" to the 3rd place from the top after Incident dashboard to prevent excessive scrolling
Add 2-factor authentication via RADIUS
Add new reports for Windows Agent
Some Bit9 Carbon Black events not parsed
JDBC Custom Perf job fails because of special character in returned XML
Parse logon process for Windows logs via Snare for Win-Security-4624 - without this fix, Identity location page not updated
Support different UI logos for organizations
Extend support for Jboss 7.1+ (App server metric monitoring)
Page 43
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 44
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's New in Release 4.4.1
Integration Framework for External CMDB and Workflow Systems
User Interface and Navigation Enhancements
Revised Product Documentation and Customer Support Portal
Special Upgrade Instruction:
If you are running 4.3.3, then first run " phupdateinstall-4.3.3.sh
" as root on regular upgrade. See
Upgrade Overview for more details.
Super, Worker/s and Report Server, then proceed with
Important Post-Upgrade Procedure
After an upgrade, please clear all browser cache before accessing AccelOps GUI. Otherwise, browser caching may prevent AccelOps
GUI from working correctly.
Winexe execution and its effect
AccelOps uses the
winexe
command during discovery and monitoring of Windows servers for the following purposes
1.
2.
3.
Windows domain controller diagnostic (dcdiag) and replication monitoring (repadmin /replsummary)
HyperV Performance Monitoring
Windows Custom performance monitoring – to run a command (e.g. powershell) remotely on windows systems
Note that running the winexe command remotely will automatically install the winexesvc command on the windows server.
Features
Windows Agent
Currently AccelOps collects Windows logs and performance metrics using WMI and SNMP, or via third-party agents such as Correlog and Snare.
Pulling logs using WMI is expensive and difficult to maintain for high volume logging scenarios. Starting with this release, you can deploy
AccelOps agents to replace most of the above functionalities. AccelOps Windows agents can be purchased in two forms: Basic and Advanced.
Basic agents collect Security/System/Application logs, IIS/DNS/DHCP logs, and custom log files. Advanced agents can additionally collect installed software changes, registry changes, file changes for file integrity monitoring, and specific WMI and Powershell command outputs.
Windows agents can be configured via AccelOps Windows Agent Manager using configuration templates. Windows Agent Manager communicates to the AccelOps Supervisor node for licensing/registration, and sends events to Collector or Supervisor nodes in compressed and encrypted form. AccelOps recommends that basic discovery and performance monitoring be carried out via SNMP/WMI, but the log pulling be performed via the agents. See
license, contact [email protected]
for more information.
Beaconing
The Beaconing service transmits health and usage information about your AccelOps deployment to an AccelOps Cloud. Beaconing can be basic or advanced. Under basic beaconing, information transmitted includes the health of your AccelOps virtual appliances, CMDB device types, event parsing errors, performance monitoring job health, incident names, and summary information about the configuration of your deployment.
Advanced beaconing includes system logs. Note that no specific host name, IP address or user information information is transmitted except the
IP address of AccelOps virtual appliance themselves. This transmitted information is used exclusively by AccelOps support for forensic analysis of your system, and is never shared with anyone else. The basic Beaconing service is included as a standard feature in all 4.4+ versions of
AccelOps, while a more advanced version can be purchased to provide additional log-based support services. The basic version is turned on by default but you can opt out at any time. See
Using Beaconing to Communicate with AccelOps Support for more information.
External Threat Feed Integration Framework for Blocked Domains, Blocked IPs, Malware Hashes and Anonymity
Page 45
FortiSIEM Installation Guide FortiSIEM Installation Guide
Networks
Before release 4.4, AccelOps already integrated with external threat intelligence feeds (such as
ZeusTracker, EmergingThreats.net
, ,
) to populate blocked domains, blocked IPs, malware hashes and anonymity networks. However, the available integrations were mostly with free websites. Starting this release, user can integrate with their own paid content such as the Threat Stream OPTIC threat intelligence platform and others. A java based API is provided that enables you to integrate with any threat feed. If the threat feed is a website and the data is in the form of a comma separated file (csv) file format, then the integration can be accomplished from the AccelOps GUI itself by simply defining the column mappings and the separator. In all other cases, you will need to write Java classes based on examples
provided with AccelOps 4.4. See the topics
,
and
Setting Up External Data Sources for Malware Hashes
for more information.
Integration Framework for External CMDB and Workflow Systems
This framework enables you to integrate AccelOps CMDB and incidents with external systems. Specifically, device information and new device attributes from an external CMDB, such as BMC Atrium, can be imported into the AccelOps CMDB. AccelOps CMDB data can also be programmatically synched to an external CMDB, such as ServiceNow. AccelOps incidents can be pushed to a external workflow system, such as
ServiceNow and ConnectWise - this integration is two-way, as changes in the ticket state in an external CMDB can be reflected back in the corresponding AccelOps incident. The integrations are built on a Java based API. While industry leading platforms such as ServiceNow and
ConnectWise are already integrated out of the box, integrations with other CMDBs and workflow systems can be developed using the API. See the topics under
Integrating with External CMDB and Helpdesk Systems for more information.
Data Update Service
AccelOps provides built in extensive device support in terms of device discovery, performance monitoring, log parsing, rules and reports. However until now, users had to wait for a formal product release, for example 4.4.2, to get new device support and existing device support extensions such as parser fixes, rule and report extensions. Starting with this release, customers can get device support enhancements, for example
4.4.1.101, via a data update service, in between formal AccelOps releases. As AccelOps continually adds support for more devices, by subscribing to this service, you can receive updated device support as it becomes available, instead of having to wait for a formal release. See the topics under
Data Update Subscription Service for more information, and contact
to purchase a subscription.
AccelOps User Management
This release enables AccelOps administrators to see all the currently logged on and locked out AccelOps users. Users can be forcibly logged off from the system. Locked users can also be unlocked. Administrators can also see ongoing queries, the user who started the queries, and stop long running queries if needed.
User Interface and Navigation Enhancements
This release includes a number of enhancements to improve the user interface navigation and dashboards. Dashboard charts have now a flat look. The layout changed from column layout to cell layout where smaller charts can be combined with bigger charts on different rows. Cell size can be adjusted by the user on a widget by widget basis. The report selector has been redesigned. Single line chart now has a Gauge display in addition to text. Line charts can be stacked for better visual clarity. The Table view and combo view now allows user to set colors based on displayed metrics. See the topics under
User Interface Overview for FortiSIEM Dashboards
for more information.
Revised Product Documentation and Customer Support Portal
The AccelOps product documentation wiki, as well as the customer support knowledge base and community forums, have been completely re-organized and revised for this release to improve the discoverability and usability of information. We welcome your feedback and suggestions for future development at [email protected].
Enhancements
5.
6.
7.
8.
1.
2.
3.
4.
Ability to monitor asymmetric network link utilization where send and receive link speeds are unequal
Ability to exclude shared account names from Identity and location calculations
Collector tunnel plugin launch should use super host name from browser to handle NAT deployment
AO-SP: Every organization can have their own "My Home" country definition
Ability to run a query with specific values from Dashboard Charts
Ability to use Incident Category in Rule definition for filtering incidents for user defined rules
Ability to query location name using Analytics framework
Ability to choose a time period in Historical Search by dragging mouse over the time axis
Page 46
FortiSIEM Installation Guide FortiSIEM Installation Guide
12646
13424
13099
11137
11416
12042
12833
12955
13173
11350
Device Support
Device
Cisco Meraki Cloud Controller, Cisco Meraki Firewalls, Router/Switches and Wireless Access Points
Avaya Communication Manager
Windows Active Directory - health analysis by running dcdiag and repadmin/replsummary commands
Windows HyperV Monitoring
Dell Compellent Storage
Bit9 Security Platform
SourceFire NetworkAMP log analysis via syslog
Dell NSeries Router / Switch
HP Value Series Switches (19xx Series) and HP 3Com Switches (29xx
Series)
Access Protocols
SNMP
Syslog
SNMP Trap
SNMP
Used For
Discovery and Performance
Monitoring
Security Event Management and
Log Analysis
Availability Monitoring
Discovery and Performance
Monitoring
Call record analysis CDR files pushed to AccelOps via FTP or SCP
Remote command execution via
Winexe
Remote powershell via Winexe
SNMP
Syslog
Syslog
SNMP,
SSH
SNMP
SSH
Availability and Performance
Monitoring
Availability and Performance
Monitoring
Discovery and Performance
Monitoring
Security Event Management and
Log Analysis
Security Event Management and
Log Analysis
Discovery, Performance
Monitoring
Configuration change monitoring
Discovery and Performance
Monitoring
Configuration change monitoring
Bug Fixes
Edit Document
Bug
5423
Severity enhancement
Module
App Server major minor normal normal normal normal enhancement normal major normal
App Server
App Server
App Server
GUI
GUI
GUI
GUI
GUI
GUI
GUI
Description
Provide ability to tune event and perf data pulling jonb distribution so that resource intensive jobs (like VCenter pulling) does not run on
Supervisor node
Calendar view of incidents: actual # of incidents different from integer displayed
Collector tunnel plugin launch should use super hostname from browser to handle NAT deployment
(AO-SP) Every organization needs it own CMDB > My Home country definition
On Analytics > Rule tab, it sometimes take a long time to view the first set of rules
User is not able to edit device under super/local mode and for organizations without collector
Drill down from Biz service dashboard charts does not put the business service constraint in the search
Can not delete Biz Service from CMDB if it is referenced by other reports or rules
After editing a newly created user group, unable to edit the user in that group
Identity and location exported PDF content is empty
Sometimes the raw event log is empty when testing a rule
Page 47
FortiSIEM Installation Guide
9285
10593
11050
11054
12169
12203
12285
12539 major enhancement normal normal normal major normal normal
12001
12140
12347
12420
12434
12534
12548
12851
12870
12890
12774
12802
12902
12962
12973
13354
9973
10044
11768
12241
12246
12274
12346
12457
12504
12547
12708
12752
12783
12924 enhancement normal normal
12961
13665 normal normal
13673, 13625 normal
12232 normal normal normal normal normal normal normal normal minor normal normal normal normal normal normal enhancement enhancement normal normal minor normal enhancement normal minor minor normal normal minor
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
Page 48
FortiSIEM Installation Guide
Incidents triggered by user defined rules cannot be filtered by Incident Category (such as Security, Availability, Performance etc)
Loading Analytics > Historical > Structured > Load Report is slow as it is not paginated
A view only user should not be able to approve devices
If you only keep the Admin tab and hide all other tabs, then GUI left menu disappears
Quick Info > "Go to Identity" can't find the specified device .
Deleting collector causes problems when devices are still in CMDB
Ticket belonging to an organization with collector also can show in a different org without collector
When you copy a search result to a new tab, the search time interval and organization from the old search is not copied over to the new search
Historical search prior time range menu should include one hour time as a choice
The Device Time attribute is not properly displayed in Search results
Creating event dropping rule for an organization without collector does not work
Custom Performance monitoring: deleting matched positions only deletes bottom entry
Enforce RBAC control on user tab - an non full admin user should not be allowed to change his own permissions
Chinese characters in UI when locale is changed from English to non-english and back
When user switches to an Organization with collector, then GUI does not show system level important ports
Important processes defined in Super/global can be deleted or edited from org view
System defined device type will be overwritten when that device type is cloned and the clone's and version is modified
ON DNS Synthetic Transaction Monitoring, default port is always used and user defined port is ignored
Cannot change port value on a newly created Cisco IPS credential
Duplicated credential causes JDBC custom Performance Monitor testing failure
An organization user can see Super Global and another organizations Remedy Rule notification setting
Restrict customers from adding Organizations with past start and end dates
Need to (re)set to correct default port if customers change protocol in Discovery credential
Parser XML editor: If search strings contains a capital letter, then the Prev button is not working
On Firefox browser, email subject does not show while previewing custom email template
User cannot delete an organization if user assigns a rule to watch list system group
Allow more than 255 characters in Regular Expression box for a custom WINEXE Job
Restrict user from adding more than 16 event attributes for a custom performance job
Cannot delete authentication profiles for LDAP user with multiple authentication profiles
Allow user to bulk delete any CMDB group/item
Allow to display "latest" vulnerability and ips events for a device in CMDB, even if older than 24 hours
CMDB > Applications > Running On tab, "Process Param" column display nothing.
Cloning and Moving CMDB Items results in Unexpected Behaviour
Should validate email address format when creating a new CMDB
Impact org shows in maintenance column when switching to organization
Duplicate Components section in CMDB > Summary > Statistics
Can create duplicate biz service name in CMDB.
Can not add / edit the description for an CMDB > Applications > Infrastructure App item
Device Maintenance Takes Dates that are past due
CMDB Device Custom Property Threshold values info might be cut off if the property name is very long
Allow CMDB Reports to be emailed in CSV format in addition to PDF format
The group name does not show when user edits a newly created CMDB > Protocol and sets the Group
FortiSIEM Installation Guide
10314
11544
11804
12223
12446
12764
12775
4320
12276
12362
12926
13552
13681
2437
6482
12085
12381
12517
12724
12876
13253
13639
9610
10645
12395
13600
13622
13667
13683
13684
12411
13383
12454
13288
12528
10285
13192
10531
13179
9654
11864 normal enhancement normal minor enhancement normal normal normal normal normal normal normal normal normal normal normal normal minor enhancement enhancement normal minor normal normal normal normal normal normal normal major normal normal normal normal enhancement enhancement normal normal normal enhancement
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
GUI
Data
Data
Data
Data
Data
Data
Data
Data
GUI
GUI
GUI
GUI
GUI
GUI
Data
Data
Data
Data
Page 49
FortiSIEM Installation Guide
Drill down does not work for some of widgets
Add Location in the CMDB Search drop down
For hosts, system uptime is calculated from SNMP service uptime instead of system uptime
Report sort order does not affect to widget table view
Extend Dashboard widget extend time interval to include longer time periods
Invalid IP addresses with spaces can be entered in Incident Dashboard > Filter by IP
App Health page empty for EMC CLARiiON Summary and Dell Equallogic Summary
The sort function is lost in business service summary Dashboard
Duplicate "Free Array Storage" on Clariion Summary.
Single Line widget on a dashboard doesn't refresh if the information has no results
Dashboard Drill Down from Magnifying Glass does not work for Line View
If any report is run with the "Run Later" button and scheduled to be run for "Super" or something other than "Global", the PDF, the alert, and the email all show Organization "Global".
Reports with expressions in display columns do not show correct values after export
When values are less than 1, heat maps are displayed incorrectly
Provide an option to not have charts in PDF exported reports
Date format in PDF is US date formate even when Language is changed to English(European).
Historical Search: Once stopped a query, cannot run it again
Schedule report date format should be month/date/year instead of date/month/year
Need to shorten key info in incident visualization profile
System-defined rule exceptions work for orgs, but org user cannot see the exception in the editor.
New button is grey in Analytics > Rules > Ungrouped
The drop down box of subpattern is too small to show the name.
Two rules ("Multiple Logon Failures: Same Src and Dest, Multiple Accounts" and "Multiple Logon Failures: Same Src, Multiple Hosts") do not show "Triggered Event Count" incident attribute in GUI
Can't see email template names in Email Template pulldown for Notication Actions.
In CMDB -> Devices -> Topo (upper right corner) AccelOps always shows super's topology even if we chose an organization
The incident count is wrong on Incident Location dashboard
PDF export of Event Pulling errors does not show error reason
Add ability to mail::CC with Email Notification Policy
In CMDB tab, a device should be filtered/searched by location
Frequent SVN error - Could not create svn root dir https://<ip>/repos/cmdb - caused by script error
InfoBlox NiOS SNMP based discovery does not always set the device type correctly
Palo Alto Firewall: the event PAN-OS-SYSTEM-login-failed should trim single quote mark when parsing user name
Enhance IronPort web parser to cover different format
Sonicwall wlan logs from firewall not parsed properly
Add retry for creating folder in phDataManager
Add Guaranteed eps to these events
Add vmware datastore utilization rules
Rule "Critical APC Trap" cannot be auto cleared
Uncommon DNS Query Rule triggers unnecessarily for Microsoft DNS because of its handling of IPV6
Some WinOSWmi Spanish events not parsed because of missing keyword translation
Security Descriptor Field need to be parsed from Win-Security-4670 need to be parsered Security Descriptor Field
FortiSIEM Installation Guide
11930 normal
12970
13355
13611
13619
13629
13770
13640
11684
11847
10300
12747
12884
12919
13439
13390
13610
7726
12267
13612
13743
12985
11788
11993
12445
13004
13064
13338
13341
13345
12886
12913
10386
13609
10235
10377
10566 normal normal normal normal enhancement normal normal major normal enhancement enhancement normal normal normal enhancement normal normal normal normal normal enhancement normal normal major normal normal normal enhancement enhancement normal normal enhancement normal enhancement major major
FortiSIEM Installation Guide
Data
Data
Data
Data
Data
Data
Data
Data
Certain IOS events not parsed - IOS-ENVMON-FAN_FAILED, IOS-ENVMON-FAN_OK, IOS-ISDN-CONNECT, IOS-ISDN-DISCONNECT,
IOS-LAPP_ON_MSGS-LAPP_ON_CAUSE_VTSP_DISCONNECTED, IOS-SW_MATM-MACFLAP_NOTIF,
IOS-SWITCH_QOS_TB-TRUST_DEVICE_LOST, IOS-SWITCH_QOS_TB-TRUST_DEVICE_DETECTED
Fortigate wireless AP events needs to be parsed as wireless AP event
Incorrect test events for SyslogNG parser
Need to resolve host name parsed from syslog header into IP
Sourcefire NetworkAMP events not parsed correctly
Windows WMI and Snare parsers have some differences in parsing for the same event type
Brocade SAN Switch events parsed to Foundry-Ironware events
Windows System event types need to include source name
Data
Discovery
Identity
Parser
Parsing error when [ in attr value in phoenix logs
Special character "&" in host name causes topology to not display
Need to differentiate between domain user, AAA user and VPN user names when merging IP identities
Allow Netflow flows to be dropped like other events
Parser
Parser
WMI events 'Reporting IP' not parsed correctly
PH_DEV_MON events have incorrect Reporting Vendor, Reporting Model
Parser Extend the Sender IP choice in Event Forwarding to cover more than one event sender
Performance Monitoring Pre-define some ssh/telnet/winexe jobs in PerfMonitorTemplate.xml
Performance Monitoring AO still pulls custom perf events after disassociating the custom perf job from device
Performance Monitoring Oracle Acme Packet Controller Session Count metric not gathered
Performance Monitoring Sonicwall interface not monitored correctly
Performance Monitoring Arista interface does not include link errors
Performance Monitoring Monitor load average for linux machines
Performance Monitoring InfoBlox DHCP monitoring memory leak
Performance Monitoring VMware Cluster Consumed Memory values are Incorrect
Query / Report Query worker continues to perform stopped queries
Query / Report
Query / Report
Query / Report
Query / Report
Query / Report
Query / Report
Rule
Query may not finish when event candidate set is large
Exported query results on super global should show Super Global as organization instead of Super
Allow customers to report on "Password Age", "Password Last Set", "User Account Control" in CMDB User Reports
Exclude the event ASA-Update-Conn from the "Firewall Permit: Top Firewalls By Total Permitted Connections, Bytes" report
Exported Dynamic watchlists show incorrect Group and Domain if user changes group name
(AO-SP) The event PH_DEV_MON_HOST_PERF_STATE used for calculating network performance efficiency index has customer id always set to 1 - so network performance efficiency index can not be calculated on a per customer basis
Add reason for dropping events in PH_DROP_EVENT_FROM_SHARED_BUFFER event. This can help to debug overloaded situations and poorly defined rules.
Rule
Rule
Rule
System
System
In rule synch error window, when you edit org's rule under super global, then this rule becomes a super global rule
When running Test Rule do not create a real incident, only test incident
Network efficiency calculation is incorrect
Allow user to specify Super or Worker during install
Fix the following vulnerabilities - CVE-2007-6388, CVE-2007-5000, CVE-2008-0005, CVE-2010-0408, CVE-2010-0425, CVE-2010-0434
System Fix the following vulnerabilities - CVE-2012-0883, CVE-2012-0031, CVE-2011-3607, Disable SSH RC4 Cipher, Disable SSH CBC Mode
Cipher
Page 50
FortiSIEM Installation Guide FortiSIEM Installation Guide
10596
11649
12831
13008
13690 major major normal minor normal
System
System
System
System
System
SVN password in EC2 build gets reset after reboot
Failure to mount NFS on worker does not report fatal errors
Force AccelOps images to always mount to NFS v3
Disable SSLv3 and RC4 cypher by default on ssl.conf while upgrading from 4.2.* or 4.3.* to 4.4.*
Installation script should ask the user to set timezone correctly before setting IP address - timezone is critical for partitioning the incident database in CMDB
Caveats / Open Issues
Bug
Id
Issue
6940 Rule/Query does not work with NULL non-string fields (e.g. Source IP). These entries are skipped. It works however with NULL string values (such as Host name).
Workaround
8867 LAST and FIRST operators in rule group event constraints causes Rule Worker modules to crash
11036 PctChange operator in rule group event constraints causes Rule Worker modules to crash
11112 COUNT DISTINCT operations are expensive for anomaly rules
12900 Advanced HTTP STM via Selenium plugin does not work for some webpages - root cause is that AccelOps uses python export which does not support the full functionality of the browser plugin. Need to use java export instead of python export.
13744 Empty strings in synched report results should be exported to Report Server as NULL instead of empty strings. Within Tableau, CAST conversion operations FAIL when an empty string is encountered, but do not when a NULL is there.
None
If Group By conditions have non-string fields, then make sure that those fields are parsed in events.
Avoid using LAST and FIRST operators in Rule group event constraints
Avoid using PctChange operator in
Rule group event constraints
Avoid using COUNT DISTINCT in anomaly rules
None - use STM on simpler webpages.
Page 51
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's New in Release 4.3.3
AccelOps release 4.3.3 is focused on bug fixes and enhancements.
Bug ID
13182
12604
13010
13098
13020
13028
10302
13027
13243
13012
12901
13119
13337
12891
13190
12921
12865
12936
13233
13178
13315
13279
13221
12007
13122
13111
12953
13255
13011
12994
13063
12939
Severity
major major major major normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal normal
GUI
GUI
GUI
GUI
GUI
GUI
GUI
Rule
Parser
Component Description
Performance
Monitoring
Performance Monitoring jobs fail when devices discovery credentials are specified in sub-net notation
Potential event loss if Supervisor node is down for extended amount of time Event
Packager
GUI
Rule
App Server
App Server
Domain field is missing for manually added users for LDAP authentication
Excessive Incident Drop Logging may cause parser module to consume high CPU
The '&' character in a Rule name causes App Server out of memory error
App Server
App Server
When you discover with VM SDK first and then SNMP/WMI followed by consecutive VM SDK discoveries
(e.g. VM SDK->SNMP/WMI->VM SDK -> VMSDK), then discovered information via other means (e.g.
SNMP/WMI) may be incorrectly deleted from CMDB
Clear Condition Attribute does not show up without saving the rule
Exception thrown during App Server start up caused by SystemConfigManager not found
Device maintenance does not work if End Date not set App Server
App Server
App Server
App Server
Cannot query user-defined Watch list entries in Rules and Reports
Fix XSS vulnerability with Collector registration process
If there is an error in delivering a scheduled report, the report name is not captured in
PH_REPORT_ACTION_STATUS event
App Server
Discovery
Discovery
Discovery
Discovery
Discovery
Incident count on Dashboard Calendar View page does not match count in Incident Tab
Juniper SRX firewalls are sometimes discovered incorrectly as JunOS routers and therefore not put in the right CMDB group
HP ProCurve SSH based configuration discovery fails for newer switches
Cisco VoIP phones not discovered when phones do not have MAC address in SNMP walk (Call Manager
V10 and later)
Discovery of Windows Server Host Names differ from 4.2.3 - FQDN do not have highest priority
Discovering interfaces with /31 and /32 mask fails - traditionally these masks are not used in proper IP address definitions
Discovery
Discovery
GUI
GUI
GUI
Use LLDP in addition to CDP for Layer2 Port mapping discovery - PCs connected to non-Cisco phones connecting to Cisco Access Switches
Dell PowerConnect Switch configuration discovery via SSH fails for older switches
(AO-SP only) Editing the global exception for a rule would overwrite the org exception for the rule.
All Devices Dashboard Summary page does not populate when there is a special character ('&') in host name
Cannot drill down from widget dashboards by selecting a specific value in the charts - used to work in
3.7.6
Rules show incorrectly that Clear Condition is undefined, until clear condition is edited or viewed.
Report does not run when event attributes has %
CMDB Report for Active Rules does not work in Enterprise Edition
Dashboard error happens when user renames business service
Prev button does not work when searching for keyword in Custom Parser GUI
Edit Rule from Incident tab does not work correctly after Group By Name
Exceptions are not cloned when a rule is cloned
Rule does not fire if the DeviceToCMDBAttr function is used in Incident event type definition
Checkpoint certificate encode-decode inconsistent - an extra NULL termination character added to the
SIC before encoding can cause SIC mismatch errors during decode and the LEA connection to be aborted
Page 52
FortiSIEM Installation Guide FortiSIEM Installation Guide
11253
13249
12915
12910
12911
13029
12845
12968
13007
13013
12980, 12979
12647
13057
12925
13023, 13154,
12946, 13285,
12929, 13001
12895
13312, 12933,
13271
13113
13047
12932
13294
13000
13014
12766
13104
12989, 13103
12930, 12931
13207 enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support normal normal normal normal normal normal normal normal Device
Support
Upgrade normal enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support enhancement Device
Support
Parser
Parser
Performance
Monitoring
Performance
Monitoring
Performance
Monitoring
Performance
Monitoring
Query
Possible bug in WatchGuardFirewallParser causes the parser to fail to extract any useful attributes from the log.
Avoid reverse DNS look up in syslog for host names that do not match host name criteria
WINEXE does not work for Windows 2012 R2 - this is used for remotely communicating to Windows servers
Custom winexe based performance monitoring: inconsistent behavior- sometimes test returns correct items, however sometimes it also does not return any data
Custom winexe based performance monitoring: Unexpected "Variable <xxx> Not Found" error
Use SNMP/dskTable (first choice) and SNMP/hrStorage (backup) to calculate disk space utilization and reserved space for Linux based systems. Create an event when SNMP/dskTable is not configured.
Query tasks should be evenly distributed to all Worker nodes instead of assigning to first few Worker nodes
False positive on Windows Audit Log Cleared rule caused by not considering Source Name in Windows event log parsing
Disable SSLv3 and RC4 cypher by default on ssl.conf while upgrading from 4.2.* to 4.4.*
Add performance monitoring for FireEye MPS appliances
Support Cisco Meraki Cloud Controller - discovery, syslog, SNMP trap
Parse Cisco UCS syslog events
Add new IPS signature definitions for Palo Alto FW/IDS
Additional parsing for Sonicwall Firewall events: sent packets and receive packets
Add more parsing for Windows security event logs
Add event type Win-System-98 for detecting disk corruption
Additional parsing for NetScaler login events
Additional parsing for TrendMicro OfficeScan syslog
Additional parsing for Cisco IOS syslog
Additional parsing for Brocade network switches
Additional parsing for CiscoNxOS syslog
For JUNOS cpu monitoring, use 1.3.6.1.4.1.2636.3.1.13.1.21 (jnxOperating5MinLoadAvg) instead of
1.3.6.1.4.1.2636.3.1.13.1.8 (jnxOperatingCPU)
Additional parsing Cisco Call Manager syslog events
Add parser for Trend Micro's Deep Security tool
Support new format for Cisco IOS OSPF syslog message format
Additional parsing for Cisco Ironport Mail appliances - "TCP_DENIED events
Additional parsing for FortiGate events
Discover Virtual Switch hardware information for JunOS
Page 53
13120
13070
13042
13043
13216
13016
12996
13105
12934
10003
13234
13002
13181
FortiSIEM Installation Guide FortiSIEM Installation Guide enhancement Device
Support enhancement Device
Support enhancement App Server enhancement App Server enhancement App Server enhancement Rule enhancement Data enhancement System enhancement System enhancement GUI enhancement GUI enhancement GUI enhancement Performance
Monitoring
Discover hardware information for JunOS via SNMP
Parse Dell force 10 syslog
VA with Collectors: Duplicate devices when a device is discovered by Collector C1 while logs sent to different Collector C2
Incident Notification via XML/HTTP(S) - do not always require user name and password
Incident Notification via XML/HTTP(S) - Allow SOAP header and style sheet
Make the event delay threshold for Rule engine configurable
Optimize "Heavy UDP Host Scan on Fixed Port" rule by excluding DNS traffic
Include nload and iotop as part of pre-packaged tools
Allow user to disable "Low AccelOps eventdb Disk Space" System Error Messages
Report event limit in exported or manual reports if the report result count is more than the supported upper limit
Add a drop down in CMDB for Collectors (in addition to Organizations) - this helps to identify devices associated with a collector
Add capability to search credential association by IP in GUI - should be able to search for an IP address within an address range or a subnet
Provide a framework for computing host performance efficiency index based on Incident Triggers
Page 54
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's New in Release 4.3.1
This release adds features and functionality in several areas.
New chart types for search result visualization
Visualization for profiled metrics and drill down from incidents
Performance and Availability Monitoring
Ability to specify per-device threshold in rules
Enhanced custom command output monitoring
Windows custom command output monitoring
Log Management and Security Incident Event Monitoring (SIEM)
Amazon Web Services CloudTrail monitoring
Okta Single Sign-On (SSO) integration via SAML 2.0
Vendor default password usage detection
Detect malware via file hash and user agent match
Detect communication via Anonymity Networks (Open Proxies and TOR nodes)
Trigger event query optimization
Event dropping rule enhancement
CIDR format for specifying discovery ranges
IP Address management enhancements
Critical interface selection usability enhancement
Dynamic EPS Adjustment algorithm
Incident table and Identity/Location table partitioning
Paged control support for Microsoft Active Directory LDAP discovery
Events when device performance monitoring status changes
Enhanced custom parser development graphical user interface
Fixed Issues and Minor Enhancements
Performance Monitoring / Event Pulling / Synthetic Transaction Monitoring (STM)
New Product
AccelOps Visual Analytics
This release enables AccelOps data to be visualized using Tableau Visual Analytics and Visual Analytics Desktop in conjunction with the
AccelOps Report Server. Two kinds of AccelOps data can be visualized:
Data residing in Configuration Management Database (CMDB) e.g. Incidents, Device attributes
Any event database report result as long as it contains an aggregation condition e.g. GROUP BY
You can find full information in the
Visual Analytics section of this wiki.
AccelOps Systems Features
New chart types for search result visualization
This release enables users to visualize query results within AccelOps using scatter plots, bubble charts, tree maps and heat maps. This complements existing visualization via pie charts, bar charts, trend charts, and geo maps. Scatter plots enable users to see correlations between
Page 55
FortiSIEM Installation Guide FortiSIEM Installation Guide any pair of calculated measures (e.g. CPU and memory utilization, Sent and received bytes etc). Bubble charts add a third dimension to scatter plots to reflect the size of the added dimension, e.g. in a scatter plot containing CPU and memory utilization as the two dimensions, the third dimension could be total sent and received bits/sec. The tree map is a hierarchical tree-structured visualization that is often used to analyze dominating components of multidimensional data e.g. IPS signatures, network traffic etc. Heat maps show the calculated measure for two dimensions using a color grade that helps users to understand severity. These charts are available both in Analytics and Dashboard areas.
.
Visualization for profiled metrics and drill down from incidents
AccelOps creates statistical baselines (profiles) for a large number of use cases. While earlier releases showed this information in tabular form, this data can now be visualized. For a specific dimension (such as host), up to four measures can be visualized on a trending hour-by-hour basis for weekdays and weekends as a multi-series column chart. In general, the profiles can be visualized as a scatter plot. From an incident indicating excessive deviation from statistical measures, it is now possible to drill down into the baseline with one click.
This topic is discussed here .
Performance and Availability Monitoring
Ability to specify per-device threshold in rules
AccelOps has rules that trigger when certain thresholds are crossed. When the thresholds have to be fine-tuned on a per-device basis, rule conditions become complex and difficult to manage. This release solves this issue. Instead of explicit threshold values in rules, the thresholds are now defined as custom properties in which the user can choose to override the global thresholds by redefining the thresholds locally for a certain set of devices. Instead of hard-coding thresholds, rules are now written using a function that returns the appropriate values – local values if one is defined, global values otherwise. This approach keeps the number of rules the same, but allows users to set thresholds for any number of devices. Thresholds can be a simple number (e.g. CPU utilization) or a map (e.g. interface utilization for each interface, disk utilization for one or more disks).
This topic is covered
here (see the section: "Thresholds as Custom Properties").
Enhanced custom command output monitoring
This release enhances the way custom performance monitor command outputs are parsed into events. Prior to release 4.3.1, command outputs are parsed as one line into one event. This does not include, for example, “show version” commands for Cisco IOS routers that can span multiple lines. Release 4.3.1 improves this situation – multiple lines can be parsed into one event.
This topic is covered
Windows custom command output monitoring
A Windows custom performance monitor can be used to bring PowerShell command outputs into AccelOps. Prior to release 4.3.1, command output was obtained via Telnet/SSH, but that is not natural for Windows, and the user had to install Cygwin Telnet/SSH in Windows systems. This release enhances the situation by using winexe client on AccelOps - any Windows shell commands, such as PowerShell, can be remotely run on
Windows servers using WMI credentials. There is no need to install any software on Windows. Additionally, multi-line command outputs can be parsed into one event in AccelOps. This enhancement now enables customers to run PowerShell commands in Windows servers.
This topic is covered
Log Management and Security Incident Event Monitoring (SIEM)
Amazon Web Services CloudTrail monitoring
As more and more applications are deployed in the Cloud, monitoring user activity in the cloud is becoming increasingly important. For example, it is important to know when users are created, permissions are changed, virtual machines are spun up, network configurations are changed, or
Virtual Private Clouds (VPCs) are created. This release enables AccelOps to efficiently collect, parse, report, and alert on Amazon Web Services activity via the AWS CloudTrail API.
.
Box.com file monitoring
Box.com
is a cloud storage provider that is used by individuals as well as corporations to store and share files. This release enables AccelOps to
Page 56
FortiSIEM Installation Guide FortiSIEM Installation Guide monitor file activity within a Box.com
account. AccelOps securely logs on to the Box.com
account and monitors file creation, deletion, and modification activity within the account. More interestingly, for a specific file or all files in a folder, AccelOps can monitor file-sharing properties – is the file shared, is it password protected, is it preview/download enabled, and how many times was the file downloaded or viewed. If a particular file or directory contains confidential information, AccelOps can alert when any file in that directory was exposed to the outside or was viewed.
.
Okta Single Sign-On (SSO) integration via SAML 2.0
Oka is a cloud-based Single Sign-on (SSO) Service provider. This release enables AccelOps customers who are already authenticated in Okta to automatically log in to AccelOps without entering any credentials. AccelOps communicates via SAML 2.0 with Okta to verify user identity. In addition, AccelOps discovers all users defined in Okta (like Microsoft Active Directory) - the discovered users can be used in rule and report conditions and in notification policies. Finally, AccelOps collects Okta audit trails that can detect activity on the Okta web site such as account changes, logon activity, and other configuration changes.
.
Vendor default password usage detection
A common compliance requirement is to alert against the use of default vendor-defined credentials. This release enables AccelOps users to satisfy this requirement. AccelOps comes pre-built with a set of vendor and device specific default passwords. Users can add to this list.
Whenever a device discovery succeeds with a credential from this list, an alert triggers.
.
Detect malware via file hash and user agent match
This release comes with a set of built-in well-known malware user agents and malware file hash signatures. Users can also import their own lists from outside sources. Since malware is known to use non-standard http user agents, AccelOps alerts when it sees a malware user agent, regular expression-based match from web server or web-proxy logs. If AccelOps is configured for file integrity monitoring, then it can alert when it detects a malicious file hash match in a monitored directory.
Malware hash is discussed
User agent is discussed
Detect communication via Anonymity Networks (Open Proxies and TOR nodes)
A compromised host or a user with malicious intent uses various techniques to hide their identity, with two common examples being proxies and
TOR networks. This release comes with a set of built in well-known proxies and TOR networks. Users can also import their own lists from outside sources. Whenever AccelOps sees an IP address match from firewall logs or Netflow, an alert is created.
.
Device Support
Cisco VoIP infrastructure monitoring - see here
Cisco VoIP phone discovery from Cisco Call Manager via SNMP
Cisco Unity Connection - discovery and performance monitoring via SNMP
Cisco Presence Server - discovery and performance monitoring via SNMP
Cisco Contact Center - discovery and performance monitoring via SNMP
Cisco Tandeberg VCS - discovery and performance monitoring via SNMP
Cisco Telepresence MCU - discovery and performance monitoring via SNMP
More detailed performance monitoring of Cisco Call Manager – SIP Trunk Status, Gateway Status, H323 Device Status, Voice mail Server Status, CTI Device Status, Media Device Status
Parse 1000+ syslog messages from Cisco Call Manager and RTMT and create rules corresponding to RTMT Alerts
Oracle ACME Packet Controller - discovery and performance monitoring via SNMP
Brocade SAN Switch - discovery and performance monitoring via SNMP
Dell Force10 Switch - discovery and performance monitoring via SNMP - see
Dell PowerConnect switches - discovery and performance monitoring via SNMP - see here
Nimble Storage - discovery and performance monitoring via SNMP
Cisco WAPX WLAN Controllers - discovery and performance monitoring via SNMP
MS SQL Server 2014 - discovery, performance monitoring, audit log collection via SNMP, WMI, JDBC
Oracle Audit log parsing via syslog
Wireless LAN Controller "module" on Fortinet firewalls.
TrippLite Environmental Monitors
Page 57
FortiSIEM Installation Guide FortiSIEM Installation Guide
IBM WebSphere monitoring via HTTP(S) instead of JMX - see
Arista switches and routers - discovery and performance monitoring via SNMP - see
VMware vShield - log parsing via syslog
Significant Enhancements
Migrate SVN to local disk
AccelOps uses SVN to store device configuration data and installed software information. Over time, this repository can grow and contain a very large number of files. Earlier releases hosted SVN over NFS, and network performance could become an issue over time. Since all accesses to
SVN are via the Supervisor node, this release moves SVN to a Supervisor local disk on a separate logical drive. Fresh AccelOps 4.3.1 install automatically create a separate partition for storing SVN files. During AccelOps 4.3.1 upgrade process, a special pre-upgrade step is invoked to copy the SVN files over NFS to local disk. Actual upgrade does not begin unless existing SVN data has been copied over to the new disk - so the system continues to work during the pre-upgrade process.
Trigger event query optimization
Incidents are triggered by defined trigger events. When a user browses an incident in the graphical user interface, trigger events are shown, and incident notification emails can contain up to 10 trigger events. However, the AccelOps rule engine does not store raw events in memory, but only event identifiers, in an attempt to save memory. This means trigger events have to be retrieved from the event database by querying the event database. This query can be very expensive if the event is current, since the event may not have been indexed yet. This has been seen to create significant pressure on the AccelOps I/O system, especially if there is a sudden surge of incidents. This release addresses this issue by using an in-memory cache of raw messages for a short period of time.
Device location import
CMDB devices typically belong to private address spaces and their location is only known to the system administrators. There is now an easy way to input this information into AccelOps. Users can define locations by IP range or sub-net, and the location in CMDB will be instantly updated. The locations can be input manually via the graphical user interface, or imported from a file. In addition, devices can be searched by location in both the summary dashboard and CMDB.
.
Event dropping rule enhancement
Devices are often chatty and send all kinds of uninteresting logs to AccelOps. Since online storage is expensive, it is often necessary to be able to efficiently drop events before they are processed or stored. This release enhances event dropping rule framework by:
Including Source IP and Destination IP into the event dropping rule definition criteria
Allowing two different actions: drop completely, or store but do not trigger rules
Allowing the ability to automatically create drop rules from incidents in case the incident is a false positive, which is common in Network
IPS event correlation scenarios
.
CIDR format for specifying discovery ranges
The test connectivity and discovery IP ranges can now be specified in CIDR notion as well.
Launch discovery from CMDB
Page 58
FortiSIEM Installation Guide
Rediscovery can be directly launched from the CMDB page.
FortiSIEM Installation Guide
IP Address management enhancements
When allocating new addresses to hosts, it is often important to know the hosts that currently are assigned to addresses in a specific network segment. In prior releases, AccelOps discovered the network segments and showed only CMDB devices in that network segment. These do not include user devices such as laptops, workstations, mobile devices etc., since these devices do not necessarily belong in CMDB. Starting with this release, the Network Segment page also shows the hosts in the Identity and Location page belonging to the same network segment. Since
AccelOps accurately learns all the IP addresses in a network via DHCP and IP ARP cache scan, administrators can correctly see every active host belonging to a specific network segment.
This topic is discussed here .
Critical interface selection usability enhancement
AccelOps allows users to mark interfaces as critical, and such interfaces are always monitored for utilization and up/down status. A common example is switch trunk ports, since a trunk port going down can cause a widespread network outage. Currently there is no easy way in AccelOps to select the trunk ports of all switches. Instead, the user has to traverse every switch and select trunk ports within that switch, which can be very tedious for a large network containing a large number of switches. This release provides a flattened view of the network interfaces so that a user can quickly select a large number of interfaces matching some search criteria. This enables administrators to mark all critical interfaces for a large network with only a few clicks.
.
CMDB Report extensions
CMDB Reports are extended to include
Successful Performance Monitor Reports
Failed Performance Monitor Reports
Identity and Location Report
Scheduled Report
Devices not updated in last N days
Dynamic EPS Adjustment algorithm
AccelOps has an algorithm to re-distribute unused EPS at a collector to other collectors seeing an event spike. The algorithm is now adjusted to have the following property: A collector is now always guaranteed to have the events-per-second specified as "Guaranteed EPS." This EPS is never redistributed to other collectors. Only the excess EPS (defined as Overall EPS license minus the sum of all Guaranteed EPS) is redistributed on demand.
Incident table and Identity/Location table partitioning
In AccelOps CMDB, there are two tables that grow with time:
Page 59
FortiSIEM Installation Guide FortiSIEM Installation Guide
Incident table
Identity/Location table
The incident table grows as new incidents are created, while the Identity/Location table grows as new computers and users appear in the system or change location. As these tables grow, eventually the database may become full and read performance may suffer with corresponding growth in the table indices. In this release the following enhancements are made:
Incident Table Optimization:
The incident table is partitioned by month, so recent queries access the current month and result in fast returns
During migration to 4.3.1 release:
Data for the last three months is migrated to the new tables (based on Last Seen Time field)
All 'Active' incidents are migrated
Older incidents are archived. Scripts are provided for customer to migrate older incidents into 4.3.1 CMDB.
Scripts are provided to purge older incidents from 4.3.1 CMDB
Identity/Location Table Optimization:
The Identity/Location table is partitioned by month, so recent queries access the current month and result in fast returns
During migration to 4.3.1 release:
Data for the last three months is migrated to the new tables (based on Last Seen Time field)
Older entries are archived. Scripts are provided for customer to migrate older identity/location entries into 4.3.1 CMDB.
Scripts are provided to purge older identity/location entries from 4.3.1 CMDB
Paged control support for Microsoft Active Directory LDAP discovery
AccelOps discovers users in Microsoft Active Directory via LDAP protocol. By default, Microsoft LDAP search queries return up to 1000 entries per call (MaxPageSize limit - see Microsoft KB article ). Earlier AccelOps releases required administrators to increase the MaxPageSize limit to a much higher number for user discoveries to work. This is generally inconvenient and may also cause resource issues on the server. This release enhances this situation. AccelOps LDAP discovery now uses the paged control version of the LDAP search API to fetch an arbitrarily large number of entries - 1000 at a time. Administrators are not required to increase the MaxPageSize limit beyond the default 1000.
Events when device performance monitoring status changes
AccelOps now generates audit events when the performance monitoring status of a job changes.
1. User deleted a device or a collector:
<174>Nov 05 09:52:07
[PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[custId]=1,[phEventCategory]=2
,[srcIpAddr]=192.168.20.164,[phCustId]=1,[sessionId]=11178d2aeae08e
9c2babe2725fa1,[procName]=AppServer,[hostName]=HQ-A-Pxy-blueCoat,
[hostIpAddr]=172.16.0.141,
[eventSeverity]=PHL_INFO,[customer]=Super,[jobStatusType]=UserDelet edDevice,[user]=admin, [phLogDetail]=Monitors on device were deleted due to device being deleted
2. User disabled monitoring at a device level:
Page 60
2.
FortiSIEM Installation Guide FortiSIEM Installation Guide
<174>Nov 05 09:53:58
[PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[custId]=1,[phEventCategory]=2
,[srcIpAddr]=192.168.20.164,[phCustId]=1,[sessionId]=11178d2aeae08e
9c2babe2725fa1,[procName]=AppServer,[hostName]=ACCELOPS-W2K3B4,
[hostIpAddr]=192.168.64.124,[eventSeverity]=PHL_INFO,[custName]=Sup er,[jobStatusType]=UserDisabledDevice,[user]=admin,
[phLogDetail]=Monitoring device, 192.168.64.124, is disabled by user
3. User enabled monitoring at a device level:
<174>Nov 05 09:54:38
[PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[custId]=1,[phEventCategory]=2
,[srcIpAddr]=192.168.20.164,[phCustId]=1,[sessionId]=11178d2aeae08e
9c2babe2725fa1,[procName]=AppServer,[hostName]=ACCELOPS-W2K3B4,
[hostIpAddr]=192.168.64.124,[eventSeverity]=PHL_INFO,[custName]=Sup er,[jobStatusType]=UserEnabledDevice,[user]=admin,[phLogDetail]=Mon itoring device, 192.168.64.124, is enabled by user
4. User disabled a specific job:
<174>Nov 05 09:55:17
[PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[custId]=1,[phEventCategory]=2
,[phCustId]=1,[customer]=Super,[jobName]=System cpu usage,[srcIpAddr]=192.168.20.164,[appTransportProto]=SNMP,[sessionI d]=11178d2aeae08e9c2babe2725fa1,[procName]=AppServer,[hostIpAddr]=1
92.168.64.124,[hostName]=ACCELOPS-W2K3B4,
[eventSeverity]=PHL_INFO,[jobStatusType]=UserDisabledJob,[user]=adm in,[pullInteval]=180,[phLogDetail]=Protocol to monitor is disabled
5. User enabled a specific job:
<174>Nov 05 09:55:59
[PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[custId]=1,[phEventCategory]=2
,[phCustId]=1,[customer]=Super,[jobName]=System cpu usage,
[srcIpAddr]=192.168.20.164,[appTransportProto]=SNMP,[sessionId]=111
78d2aeae08e9c2babe2725fa1,[procName]=AppServer,[hostIpAddr]=192.168
.64.124,[hostName]=ACCELOPS-W2K3B4,
[eventSeverity]=PHL_INFO,[jobStatusType]=UserEnabledJob,[user]=admi n,[pullInteval]=180,[phLogDetail]=Protocol to monitor is enabled
6. User changed job polling interval:
Page 61
FortiSIEM Installation Guide
6.
FortiSIEM Installation Guide
<174>Nov 05 09:57:21
[PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[custId]=1,[phEventCategory]=2
,[phCustId]=1,[customer]=Super,[jobName]=System real memory usage,
[srcIpAddr]=192.168.20.164,[appTransportProto]=SNMP,[sessionId]=111
78d2aeae08e9c2babe2725fa1,[procName]=AppServer,[hostIpAddr]=192.168
.64.124,[hostName]=ACCELOPS-W2K3B4,[eventSeverity]=PHL_INFO,[jobSta tusType]=UserChangedPollIntv,[user]=admin,[pullInteval]=300,[phLogD etail]=Interval of protocol to monitor is changed
7. Discovery added a job for monitoring:
<174>Nov 05 10:05:14
[PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[custId]=1,[phEventCategory]=2
,[phCustId]=1,[customer]=Super,[jobName]=WMI Ping Status,
[appTransportProto]=WMI,[procName]=AppServer,[hostIpAddr]=192.168.6
4.124, [hostName]=ACCELOPS-W2K3B4,
[eventSeverity]=PHL_INFO,[jobStatusType]=DiscoveryAdded,[user]=SYST
EM(su),[pullInteval]=120,[phLogDetail]=Monitor on device is added
8. Discovery removed a job for monitoring:
<174>Nov 05 10:12:08
[PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[custId]=1,[phEventCategory]=2
,[phCustId]=1,[customer]=Super,[jobName]=Process Resource Usage via
WMI,
[appTransportProto]=WMI,[procName]=AppServer,[hostIpAddr]=192.168.6
4.124, [hostName]=ACCELOPS-W2K3B4,
[eventSeverity]=PHL_INFO,[jobStatusType]=DiscoveryRemoved,[user]=SY
STEM(su),[pullInteval]=180,[phLogDetail]=Status of protocol to monitor is changed
9. Performance Monitor module did not schedule a job:
Page 62
9.
FortiSIEM Installation Guide FortiSIEM Installation Guide
<174>Nov 05 10:33:01
[PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[custId]=1,[errReason]=Missing
/Invalid WMI credential for 192.168.20.207, PROC_RESOURCE,
[phEventCategory]=2,[phCustId]=1,[jobId]=1545818,[customer]=Super,[ jobName]=Process Resource Usage via WMI,
[srcIpAddr]=192.168.64.153,[appTransportProto]=WMI,[sessionId]=13b3
48ad44270e0249eafc9dfdc5,[procName]=AppServer,[hostIpAddr]=192.168.
20.207,[hostName]=win-li5sipp8s7s.accelops.net,[eventSeverity]=PHL_
INFO,[jobStatusType]=DiscoveryNotScheduled,[user]=1,[pullInteval]=1
80,[phLogDetail]=Monitor on device is not scheduled
10. Successful job:
11. Failed job:
<174>Nov 05 10:13:00
[PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[custId]=1,[errReason]=,[phEve ntCategory]=2,[phCustId]=1,[jobId]=1536112,[customer]=Super,[jobNam e]=Process Resource usage via
SNMP,[srcIpAddr]=192.168.64.153,[appTransportProto]=SNMP,[sessionId
]=128e159a35b9f0f4cd71ca80222b,[procName]=AppServer,[hostIpAddr]=19
2.168.20.170,[hostName]=qa-win2008-217.accelops.net,[eventSeverity]
=PHL_INFO,[jobStatusType]=ExecutionSuccess,[user]=1,[pullInteval]=1
20,[phLogDetail]=Status of monitor is changed by Job
<174>Nov 05 10:15:00
[PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[custId]=1,[errReason]=Failed to get process utilization in executeGeneralProcResourceJobOpt,[phEventCategory]=2,[phCustId]=1,[ jobId]=1536112,[customer]=Super,[jobName]=Process Resource usage via SNMP,
[srcIpAddr]=192.168.64.153,[appTransportProto]=SNMP,[sessionId]=12a b68da5ca2cceab2a69cbda16e,[procName]=AppServer,[hostIpAddr]=192.168
.20.170,[hostName]=qa-win2008-217.accelops.net,[eventSeverity]=PHL_
INFO,[jobStatusType]=ExecutionFailed,[user]=1,[pullInteval]=120,[ph
LogDetail]=Monitoring device failed
12. Job stays in “Discovered Added” state for more than 15 minutes and is not scheduled:
Page 63
12.
FortiSIEM Installation Guide FortiSIEM Installation Guide
<174>Nov 05 10:55:57
[PH_AUDIT_DEV_MON_JOB_NOT_STARTED]:[custId]=1,[phEventCategory]=2,[ phCustId]=1,[customer]=Super,[jobName]=ICMP Ping
Status,[appTransportProto]=PING,[procName]=AppServer,[hostIpAddr]=1
72.16.10.110,[hostName]=HOST-172.16.10.110,[eventSeverity]=PHL_INFO
,[jobStatusType]=DiscoveryAdded,[user]=SYSTEM(phDiscovery),[pullInt eval]=120,[phLogDetail]=Monitoring job did not start yet
Enhanced custom parser development graphical user interface
The custom parser development graphical user interface is enhanced to include the following:
1.
2.
Ability to search text within the XML file.
Add a line number in the XML file. When there is a Error in 'Validate' or 'Test', show the line number as a reference to help user fix the
3.
4.
5.
6.
7.
8.
9. problem.
Allow user to reformat the text after block update for easy readability.
Allow an option to Clear XML in one shot to allow for bulk replace.
Color code the XML tags and text for easy readability.
Show the parsed fields in Test results in a nice tabular form.
Improve the scrolling/editing response for large XML files.
Show the XML in a tree form - allow cross-linking of the XML Tree and the text edit window.
Allow user to increase the size of the edit window.
Page 64
FortiSIEM Installation Guide FortiSIEM Installation Guide
Fixed Issues and Minor Enhancements
General GUI
Bug 7489: Created a CMDB report named "Active Dependent Rules" that tracks which rules depend on other rules. This helps users to tweak/enable/disable chained system rules
Bug 8021: Added indices in ph_task and ph_alter tables in PostgreSQL - this improves the GUI experience when user visits Alert and
Task tabs
Bug 8054: Allow an option to search on 'Origin' field in every tab in Admin > Device Support area. This allows users to quickly see user defined Device/Application types, Event Types, Event Attribute Types, Parsers and Dashboard columns
Bug 8165: Show VLAN as a column in Analytics > Identity and Location Report
Bug 8181: Need to get result of scheduled report even if the report has no data
Bug 8291: Allow user to unlock an AccelOps account
Bug 8896: Allow scheduled reports to skip charts and only contain tables
Bug 9266: Added "errReason" attribute to system event PH_REPORT_ACTION_STATUS - the attribute states why notification failed
Bug 9670: CMDB Device shows under Scheduled Maintenance even after device removed from Schedule Maintenance Calendar
Bug 9900: Expose Last Updated Time and Discover Method fields of a device for use in CMDB reports
Bug 10083: Display a warning when user disables or deletes a rule that is referenced in other rules
Bug 10172: Change the AccelOps GUI CMDB > Users so that all locally created users cannot edit the "domain" field
Bug 10198: Removal of devices or organizations from CMDB sometimes display foreign key violation errors
Bug 10250: Remove "Show Password" check box for credential
Bug 10382: enhancement: allow HTML tags in custom e-mail templates
Bug 10394: Allow bulk disabling for blocked IP in the CMDB through the GUI
Bug 10450: Add 'Apply To' option to facilitate applying multiple authentication profiles to one or more users
Bug 10563: Add an Export button for Related Incidents screen
Bug 10830: Add locations view in summary dashboard
Bug 11343: Long device names truncated on Widget dashboard
Bug 11371: Allow import/ export of user defined watch list
Bug 11498: A rule with CLEAR conditions becomes invalid after clone process - constraints between main and clear rules are not properly copied over
Bug 11508: Ability to set locations for a large number of devices in one shot
Bug 11596: Ability to add Notes to Rule exceptions. One should also be report on Rule exceptions.
Bug 11597: Add Remediation section to Rule definition. Add this to default email template. Make this part of CMDB report. Add this to custom notification template.
Bug 12583: User can not manually add important processes that have the same name but different process parameters
Bug 12613: Columns on Amazon EC2 performance view should be same as EC2 dashboard
Bug 12694: Provide an option to not have charts in exported PDF reports
Bug 12698: Enable search on "Monitor Errors" and "Error Description" on Admin > Setup wizard > Monitor Change/Performance >
Monitor Errors popup
Bug 12760: Edit a Report Schedule and the Report automatically Runs
Bug 12786: Make error message clearer for event dropping rule creation on grouped incidents
Platform
Bug 9518: Glassfish log rotation is now configured for saving space - only keep 20 files and each of them max-sized 2000000 bytes.
Bug 9828: EPS Pulling functionality has limitations that lead to dropping of events by collectors
Bug 9938: Allow modular 'yum upgrades' for non-base-CentOS packages like JVM, Chrome, PostgreSQL, Glassfish
Bug 10144: Do not overwrite customer's ssl.conf during upgrade
Bug 11926: DNS caching code has performance issues
Bug 12130: AccelOps uses rsyslog to receive our internally generated events. There is a throttle defined there (200 messages in 5 minutes interval). This will result message loss in high throughput situation like VoIP phone discovery, Layer 2 port mapping discovery etc. This throttle is removed since this is intra-computer communication and can handle much higher message rates.
Bug 12538: Detailed events, rules and reports for performance monitoring status changes
Bug 12584: Collectors sometimes fail to negotiate HTTP(S) connection to Super/Worker if ever they choose SSLV3 (because of poodle vulnerability - possibly because of a man-in-the-middle device like a IPS or a firewall disallowing all SSLV3 negotiations.
Bug 12585:The phMonitor module crashes when it sees a 3.7.6's rest_cache_api list entry in phoenix_config.txt
Bug 12586: The configuration file phoenix_config.txt needs to be upgraded properly by maintaining user's changes from previous versions
Bug 12644: Run script notification may fail if the raw message contains special XML characters
Bug 12649: Updating Dynamic Watch List by incidents causes Application Server to run out of memory when there are many many-to-many relationships between incidents and dynamic watch lists
Bug 12650: Full VM build does not 'yum update' packages as previously designed
Performance Monitoring / Event Pulling / Synthetic Transaction Monitoring (STM)
Bug 9848: Packet transmission timeouts for SNMP v1 and v2 phoenix_config needs to be extended from 1 minute to 5 minutes
Bug 11423: Add Custom command output monitoring via winexe for windows environments
Bug 12066: Parse CVSS_BASE score for vulnerabilities into (vulnCvssBaseScore attribute)
Page 65
FortiSIEM Installation Guide FortiSIEM Installation Guide
Bug 12213: Cisco IOS CPU can not be monitored in some cases with multiple CPUs - performance monitoring has to identify the control plane cpus
Bug 12214: PerfMonitor module will stop sending PH_DEV_MON_PING_STAT events for a gateway if its immediate down steam device are down
Bug 12387: NexPose vulnerability report XML parsing takes a long time
Bug 12458: Checkpoint needs a resume event handler
Bug 12561: Discovery never removes a PING job even if the device is not reachable by PING during discovery. This is done since a
PING is fundamental for measuring up time. Only a user can manually disable PING jobs
Bug 12601: Admin > Setup wizard > Monitor Change/Performance tab does not reflect the status of successful discovery after correcting device credentials.
Bug 12604: Events are not picked up by parser module if Supervisor node is down for an extended period of time
Bug 12625: For Qualys Vulnerability Scanner, Test connectivity succeeds, but the discover method and event pull methods are not set in discovery, resulting in no job creation for Java agent.
Bug 12661: Don't trigger config change while getting config error
Bug 12730: Allow pulling interval to be less than 1 minute to pull windows logs at a faster rate. Added a phoenix config entry of
"wmi_pull_interval_scale" that can have a range from 1 (default) to 10. If users want to have a shorter interval for WMI event pulling, they can change it to 6 to make it 6 times faster; if the pulling interval in GUI is 1 minute, then events are pulled every 10 seconds.
Bug 12754: Enhance custom command output monitoring to generate an event to indicate no matching lines for regular expression. This can be used to detect e.g. a process is down from running the top command. If the regular custom command output monitoring command is PH_DEV_MON_CUST_DF then AccelOps would generate PH_DEV_MON_CUST_DF_NOT_FOUND when the are no matching lines in the command output
Bug 12787: Enhance performance monitoring status job upload to keep uploading if failed last time
Bug 12801: Custom command output monitoring - deleted items are still monitored
Bug 12803: Custom SNMP job monitoring sometimes fails to distinguish when one key is a prefix of the other; e.g.
SNMPv2-SMI::enterprises.9.9.48.1.1.1.5.1 from SNMPv2-SMI::enterprises.9.9.48.1.1.1.5.16. So the obtained value for
SNMPv2-SMI::enterprises.9.9.48.1.1.1.5.1 may be the value for SNMPv2-SMI::enterprises.9.9.48.1.1.1.5.16
Bug 12804: Custom Performance Monitoring - when custom transforms are nested, the order may not be preserved resulting in wrong calculations. For example, if custom transforms are defined as "used = transform(used/1024)", "total = transform(total/1024)" and
"memUtil = transform(used/total)", then the transforms must be calculated in the order used -> total -> memUtil. Earlier releases did not do this.
Rule / Query / Report Engine
Bug 8512: Turn off inaccurate system rule 'Windows Disk controller problem'
Bug 9847: Add Identity and location to CMDB Report
Bug 10996: Worker down rule did not trigger after license expires
Bug 11008: RFE: when retrieving Triggered Events for an Incident in GUI or e-mail notification, search 60 minutes before and after
Incident Time. This is fixed by the 'Trigger Event Query Optimization' feature
Bug 12322: Increase per rule GROUP BY thresholds - per cust and over all customers
Bug 12558: Improved cache miss handling for profile anomaly rule handling: The profiles for anomaly detection are stored in a SQLite database. When rule engine attempts to look up the average and standard deviation values for a particular key (e.g. IP address, port number etc), and an exact match is not found, then earlier releases picked up the lowest values for that profile in that database. This heuristic often causes unnecessary rule triggers. This release makes tightens the cache miss handling case - profile anomaly rules do not trigger for a key value if the average and standard deviation values are not found for that key value for that time period.
Bug 12640: When performing analytical searches when individual countries from the country groups are referenced in filter conditions as objects, then no results are returned
Discovery
Bug 10363: Disallow discovery via Virtual IP
Bug 10533: Add ability to define IP subnets in the 172.16.16.0/22 type format
Bug 11308: Foundry router becomes generic-generic
Bug 11972: Telnet discovery of HP Procurve switches fails due to error in expect script
Bug 12713: If host name contains unprintable characters like backspace(x08) and enquiry(x05), then parsing this XML causes app server to throw exceptions and run out of memory
Device Support
Bug 9942: RFE: add performance monitoring for Cisco WAPX (lightweight) devices
Bug 10006: RFE: add device support for Tripp lite UPS devices
Bug 10307: Microsoft cluster services incorrectly assigned to Microsoft Exchange Application Group
Bug 10362: Add support for (Oracle) Acme Packet Border Controller
Bug 10366: Support for Dell Force 10 Networking devices
Parsing area
Page 66
FortiSIEM Installation Guide FortiSIEM Installation Guide
Bug 8894: Cisco ASA parser: trailing white space in User attribute causing searches to miss events with condition User EQUALS 'string'
Bug 10418: Parse username in Windows MSSQL Event 18453
Bug 11351: Parse username in Win-Security-5145
Bug 12485: Parse jitter field in Cisco VoIP CDR/CMR record
Bug 12626: Snort events collected via database have wrong severity
Bug 12641: Added more Symantec Anti-virus events
Bug 12643: A null pointer exception can happen during pulling performance monitor config for discovery
Bug 12656: Some FortiGate traffic logs do not parse if "status=" is missing in the logs
Bug 12668: More Foundry switch logs to be parsed
Bug 12714: Enhance McAfee EPO parser to parse more logs
Bug 12716: Enhance Cisco IOS and NX-OS parser to parse more logs
Bug 12757: Put Fortigate firewall DHCP messages into the identity and location section - so the IP to user and host name mapping shows up when FortiGate is acting as the DHCP server
Bug 12765, 12767: Add a "Total Bit Rate" attribute for interface utilization and Netflow events - so user can quickly run 95th percentile on the total bandwidth for an interface
Data: System Rules/Reports
Bug 8512: Turn off inaccurate system rule 'Windows Disk controller problem'
Bug 10113: Added description for windows security events: 5142, 5143, 5144, 5168, 4985, 5145
Bug 12660: Enhance "Heavy TCP Port Scan" rule to exclude Windows Security Firewall logs (Win-Security-5156), ASA/PIX Teardown events (ASA-302014, PIX-302014, FWSM-302014)
Bug 12676: The event type group for JUNOS_KMD_VPN_DOWN_ALARM_USER event is incorrect
Page 67
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's new in Release 4.2.3
This release addresses several issues and enhancements on top of 4.2.2 release.
Note: To upgrade to this release, migrate to 4.2.1 first and then upgrade to 4.2.3. It is not possible to directly upgrade from 3.7.x or earlier releases to 4.2.2 because of the Linux Operating System changes.
The following are the
key issues
that are addressed in this release:
Bug 9211: Windows log and metric pulling via WMI has been optimized to be roughly 4x faster and more robust
Bug 11459: Checkpoint LEA log collection agent occasionally restarts
Bug 11631: VMware log pulling sometimes stops after encountering an exception in the API
Bug 11699: QueryMaster module memory grows to be large when there are over large number of devices (over 2500) in summary dashboard.
Other addressed issues include the following:
General GUI related fixes and enhancements
Bug 11353: App server stops picking discovery result xml files when malware site/IP auto update failed
Bug 11517: Windows server version in device selector UI can not be seen completely
Bug 11526: Delete custom event attribute or custom event type - the custom dashboard column not removed
Bug 11586: Footer shows wrong language when browser's OS language is not in English
Bug 11654: Custom Property Attribute not populating in query conditions
Bug 11655: CMDB/Performance page shows CPU green at 100% utilization
Bug 11735: App Server Exception for incidents with custom event attribute causes performance issues
Platform related fixes and enhancements
Bug 11435: Handle error: "File does not exist: /var/www/html/favicon.ico"
Bug 11574: Include misc debugging tools: nfsiostat, iostat, screen, ntop
Bug 11812: Custom group is not editable after migration
Performance Monitoring / STM related fixes and enhancements
Bug 11336: Add sent bits/sec and received bits/sec to Netflow metrics
Bug 11410: Nessus vulnerability scanner reports are not parsed correctly
Bug 11422: Add "Diff" system transform for custom SNMP and WMI performance monitoring
Bug 11426: Possible memory leak issue in VMware performance pulling agent
Bug 11428: Add use cases for Linux syslog monitoring - detect "yum update", system going down, network interface up/down, process killed by kernel because of out of memory
Bug 11449: The NMAP check during Flow based service detection can cause unnecessary probing traffic from AccelOps. Remove the nmap test or make it optional.
Bug 11450: VMware monitoring enhancements:
Add Cluster names and VCenter IP to all VMware host events
Add Folder to show VM performance metrics on the right hand side in VMware view
Add folder information to VMware guest and ESX events
Capture VMware tools version including it is out of date or not
Add cluster balance information
Bug 11470: Exclude Mounted Volumes from disk space monitoring at client machine. The mounted volume disk space has to be monitored at the server side.
Bug 11620: Some interfaces (like Serial) have send/recv bytes only from regular IF-MIB and not from high speed MIB; so need to pick interface speed from regular IF-MIB and not from high speed MIB so it is 2Mbps instead of 1536Mbps.
. Currently speed for T1 interfaces is picked from high speed MIB and
Rule / Query / Report Engine related fixes and enhancements
Bug 10934: The rule "Concurrent VPN Authentications To Same Account From Different Cities" need to be enhanced to cover the case where user attribute is not present in the log.
Bug 11360: Some pre-defined rules does not map Reporting IP to Destination IP in incident events - this may cause notification policy to trigger
Bug 11456: Include Reporting IP for consideration in Notification policy > Affected Objects. Currently Affected Object check includes only
Destination IP and Host IP.
Bug 11483: Rule synch - new worker causes performance issues
Bug 11594: Should restart phRuleMaster when failed to retrieve rule exception
Bug 11775: Incident fails to trigger when host name contains special characters which are not acceptable in XML e.g. &, <, > etc
Page 68
FortiSIEM Installation Guide FortiSIEM Installation Guide
Parsing related fixes and enhancements
Bug 10418: User name in Windows MSSQL Server Event 18453 is not parsed
Bug 11230: Certificate Information in Win-Security-4768 and Win-Security-4771 not parsed
Bug 11239: Event time order not always maintained at the Supervisor/Worker nodes
Bug 11280: FortiGate event "FortiGate-traffic-icmp-allowed" is improperly classified as a denied event and triggers rules
Bug 11466: Several events are not parsed for Barracuda Mail gateway
Bug 11473: If parser sets event severity, then let it win over event severity from syslog header
Bug 11615: Juniper SSL VPN parsing extensions
Bug 11634: User not parsed in Windows Security 4625 events
Bug 11696: For Cisco ASA, Network Interface > Security Level info not consistently propagated to parser - this causes problems in identifying source and destination interfaces for parsing network traffic
Discovery related fixes and enhancements
Bug 11260: CBQoS / BGP / OSPF metrics get falsely discovered for Cisco devices even when they are not configured on the device
Bug 11397: Allow HTTPS selection choice for NetApp ONTAPI discovery
Bug 11519: Update access IP after re-discovery if original access IP interface is down
Bug 11524: Handle ">" as prompt in Unix SSH scripts
Bug 11582: EMC VNX CPU Discovery fails with password special characters
Bug 11681: EMC VNX discovery fails when it has
only
Meta LUNs but no normal LUNs
Bug 11755: VMware VCenter 5.5 discovery cannot return the correct tree structure when a Data Center is created under a Folder
Device Support
Bug 11419: VMware VCNS log parsing
Bug 11474: Collect Back-to-back consistency point metric for NetApp from SNMP
Bug 11539: Support for Emerging Threats Snort rules
Bug 11553: Match Cisco MARS SIM rules
Bug 11559: NeXpose Rapid7 XML Export 2.0 Report format not supported
Bug 11570: Support FireEye HX appliance
Bug 11616: IronPort-Web Parser Logic Error
Bug 11680: Parse additional foundry syslog
Bug 11697: Add user name and source IP addr from ASA-113019 into identity and location report
Bug 11722: User information in Spanish win-security-4625 cannot be parsed correctly
Bug 11727: Update Cisco IPS Signatures to latest
Bug 11732: Windows events 673, 4769, 4773, 674, 677, 4770 are assigned to wrong log failure group causing brute force logon rules to fire
Bug 11733: Windows Clustering Failover rule definition needs to be tightened by adding the constraint eventSource =
"Microsoft-Windows-FailoverClustering"
Page 69
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's new in Release 4.2.2
This release fixes several issues and adds several enhancements on top of 4.2.1 release.
Note: To upgrade to this release, migrate to 4.2.1 first and then upgrade to 4.2.2. It is not possible to directly upgrade from 3.7.x to 4.2.2
because of the operating system changes.
General GUI related fixes and enhancements
Platform related fixes and enhancements
Performance Monitoring / STM related fixes and enhancements
Rule / Query / Report Engine related fixes and enhancements
Parsing related fixes and enhancements
Discovery related fixes and enhancements
General GUI related fixes and enhancements
Bug 5532: User can write duplicate event forwarding rules
Bug 8100: Under CMDB > Blocked IP addresses > Emerging Threats, the last updated time stays at 1969 even after setting up the
"Update Automatically"
Bug 9023: For Selenium based Web STM, the Selenium script upload file feature should report an error message when user doesn't select a file
Bug 10279: Exporting and then importing back the same report creates two reports
Bug 10306: Remedy incident clear time is incorrect in AccelOps
Bug 10741: Adding a Selenium script definition using Edit/Paste fails with run time error: Could not find Firefox in your system Path.
Bug 10816: Clone Event Attribute Type has not Value Type
Bug 10848: Null column header shows in report when exporting incident "Incident Notification Error"
Bug 10880: In Analytics > Generated Reports, a user with read only view privilege should not be able to delete a report
Bug 10972: Maintenance calendar month view should display as March 2014 instead of 03,2014
Bug 10993: Load Report page is not paginated - loads slowly
Bug 11017: User with edit and run privilege can not export Identity and Location Report
Bug 11027: User with View and Run privilege should not be able to Import Rules
Bug 11046: GUI allows multiple organizations without collectors with overlapping IP address ranges
Bug 11047: Incident notification via email: Incident details incorrectly shows Triggered Event Count instead of Incident Count
Bug 11051: Clicking Related Incidents for "Excessive Denied Connections From An External Country" shows errors
Bug 11067: Test Connectivity button does not work but the drop down menu works
Bug 11072: Schedule field in CMDB report on Report does not support multiple records
Bug 11178: Imported custom dashboard column can not show in org view
Bug 11264: Add "free disk" to Exec Summary and All Device dashboard
Bug 11306: Allow other Flow sources like SFLOW, ASA Netflow in CMDB > Interface Stats > Inbound/outbound flow drill down a
Selenium scrip
Platform related fixes and enhancements
Bug 11122: Incident notification via SNMP and HTTP(S) fails on VA mode
Bug 11127: Notification action is successful but the Incident Notification Status column is empty
Bug 11168: Incidents which belong org with collector can display in orgs without collector on incident dashboard calendar view page
Bug 11184: System error "succeed ratio too low" isn't cleared automatically
Bug 11286: Upgrade to CentOS 6.5
Performance Monitoring / STM related fixes and enhancements
Bug 11053: Capture reserved disk size for Linux disk space monitoring
Bug 11195: Incorrect User Connections information on MySQL dashboard
Bug 11221: Linux disk space monitoring (via SSH) does not work for Debian Linux
Bug 11305: Remove PH_DEV_MON_CUST restriction from Custom performance jobs - this allows new device type's CPU, Memory to be shown in dashboards
Bug 11332: Faulty Hardware monitoring - if failed once - then never reattempted again
Rule / Query / Report Engine related fixes and enhancements
Page 70
FortiSIEM Installation Guide FortiSIEM Installation Guide
Bug 11246: Unable generate reports using Network Segment folders
Parsing related fixes and enhancements
Bug 11099: Parse PostFix SMTP gateway logs
Bug 11149: Need to alert on Microsoft Cluster Service Failure errors
Bug 11153: Add parsing for Symantec IDS events
Bug 11167: Incorrect error handling for XML parsing by the parser module
Bug 11177: Need to set event severity from syslog priority field
Bug 11201: Fortinet parser extensions to cover more event parsing
Bug 11222: Clone and Test CiscoIPSParser does not work
Discovery related fixes and enhancements
Bug 11193: CMDB reports wrong memory unit for EMC VNX and Clarion
Bug 11232: Merge across Collectors incorrect in some cases - we need enhancement to merge same host across collectors so long they belong to same organization
Bug 11233: CMDB view is incorrect for VCenter discovered VMs when multiple guests on common ESX is split across customers
Bug 11236: Nx-OS interface speed incorrect when an interface has both ifHighSpeed and ifSpeed entries
Bug 11244: Need to add Windows 2008 R2, Windows 2003 R2, Windows 2012 R2 as new device types
Bug 11261: Cisco IOS router discovery crashes in certain cases with Cisco VoIP entries
Bug 11263: Show datastores for ESX during VCenter/ESX discovery
Bug 11264: Detailed Linux device type discovery using SSH - replace General Linux with Redhat Linux, Ubuntu Linux etc
Bug 11277: Remove extra "System Reserved" disk for Windows via WMI
Open Issues
Page 71
FortiSIEM Installation Guide FortiSIEM Installation Guide
What's new in Release 4.2.1
This release adds features and functionality in several areas.
Remote connectivity to collector devices
Query/Rule usability enhancements
Support OpenLDAP for user discovery and external authentication
Support secure LDAP protocols: LDAPS and LDAP Start TLS
Performance and Availability Monitoring
Customizable high performance summary dashboards
Generalized Selenium based Web Synthetic Transaction Monitoring (STM)
End-to-end Email Synthetic Transaction Monitoring (STM)
Custom SSH based command output monitoring
Log Management and Security Incident Event Monitoring (SIEM)
Agent less file change and file integrity monitoring
Miscellaneous Key Enhancements
Quick interface utilization drill down via Netflow
Add CMR Support for Cisco VoIP
Limit excessive generated incidents
Cisco ASA/IOS Remote Access VPN Monitoring
General GUI related fixes and enhancements
Platform related fixes and enhancements
Performance Monitoring / STM related fixes and enhancements
Rule / Query / Report Engine related fixes and enhancements
Parsing related fixes and enhancements
Discovery related fixes and enhancements
Systems Features
Fundamental system upgrade
This release upgrades the AccelOps platform to CentOS 6.4, Glassfish 3.2, Postgres 9.1 and JDK 1.7. This significantly enhances the stability and robustness of the base operating system and key sub-systems. In addition, the Apache web server is also upgraded to 2.2.25 to fix many vulnerabilities.
Run on Microsoft HyperV
In addition to VMware ESX, Redhat KVM and Amazon EC2, AccelOps supervisor, worker and collectors will now also run on Microsoft HyperV virtualization platform.
Installing AccelOps Supervisor, worker and collector on Microsoft HyperV is covered
Regex based search
Page 72
FortiSIEM Installation Guide FortiSIEM Installation Guide
Prior to Release 4.2.1, AccelOps allows the ability to search raw messages by AND/OR combination of keywords and via the CONTAINS and
NOT CONTAINS operator. This release adds the ability to search via regular expressions (REGEXP operator). Regular expressions can return precise search results than keyword based searches. Regular expressions can be used in searches, queries and rules for any string valued attribute such as Event Type, Raw Message etc.
Regex based search for real time search is covered here .
Regex based search for historical search is covered
Regex based search for rules is covered
Statistical anomaly detection
This release enables users to baseline any performance metric or flow data collected by AccelOps and create an alert when the current value of the metrics deviates significantly from its statistical baseline. Baselines are created on an hourly basis for each distinct hour of the day and separately for work and non-work days – a total of 48 buckets. This fine-grained approach allows for accurate behavioral analysis. The baselines are learned automatically and updated continuously in an attempt to learn the new normal.
The following baselines are available out of the box
Network Traffic Analysis
Network traffic - by sender, by receiver, by connection - total flows, sent bytes, received bytes, sent packets, received packets
Firewall TCP/UDP port traffic - by inbound, by outbound - permitted traffic and denied traffic - total flows
Firewall total denied flows
VPN usage - by user - time spent and total traffic volume
Host resource usage - CPU, Memory, Virtual Memory, Disk I/O
Application resource usage - CPU, Memory
Network interface usage – by interface - utilization, sent bytes, received bytes, sent errors, received errors
SAN usage - LUN I/O
NAS usage - Volume usage, Protocol latency
DNS requests - by sender - requests, unique resolution requests
ICMP requests - by sender - requests, unique destinations
Web requests - count, errors, distinct clients
Reporting eps
Login – successful count, failed count
Server process count
Login – successful count, failed count
Reported Event types
Reported Errors
User seen – distinct count
Statistical anomaly detection is covered here.
Ability to drop events
Certain devices and applications generate a significant of logs. Often logs are very verbose and certain log types are of little value and waste valuable storage. This release provides the ability for user to drop the events immediately after they are accepted by AccelOps. These logs do not count towards licensed eps and do not trigger rules.
Ability to drop events is covered
Enhanced PDF export
The charting technology in PDF reports is significantly enhanced – the exported charts now look similar to what the users see in GUI.
Page 73
FortiSIEM Installation Guide FortiSIEM Installation Guide
Remote connectivity to collector devices
After detecting a problem, often there is a need to open a session to a monitored device either via Telnet/SSH, VNC, HTTP(S), Microsoft RDP directly from AccelOps GUI. This release release enables AccelOps users to launch terminal sessions to monitored devices for the following two cases device is in the same data center as Supervisor/Worker device is in a remote date center behind a firewall and monitored by a Collector. This case uses a reverse SSH tunnels between
Collector and Super
The topic of opening remote connections to collector devices is covered here
.
CMDB device discovery filter
This release enables users to control the CMDB device discovery process by including or excluding certain device types. For virtualization discovery, powered off VMs and VM templates can also be excluded. This facilitates a "clean" CMDB consisting of only the devices of importance to the user.
Setting up CMDB device discovery filters is discussed
The following reports in CMDB > Reports > System Audit can be used to report on devices added or deleted to CMDB via discovery
CMDB: Device Addition and Deletion History
CMDB: Device Modification History
Delta discovery
Because of the depth at which AccelOps discovers a device, a full discovery of a range of devices can take some time. Often there is a need to quickly detect only the new devices in the network. This is an important PCI compliance requirement - for security purposes, it is critical to know if there are any new devices plugged in to the network. This release enables users to quickly discover devices and applications that are not already in AccelOps CMDB.
Setting up delta discovery is discussed here.
The following reports in CMDB > Reports > System Audit can be used to report on devices added or deleted to CMDB via discovery
CMDB: Device Addition and Deletion History
CMDB: Device Modification History
Query/Rule usability enhancements
This release improves the Query/Rule usability by creating the following shortcut operations.
Ability to turn a query to a rule (see here
) and vice versa (see
)
Ability to convert a historical search to a real time search and vice versa (see
Ability to smart copy a query from one tab to another (see
Page 74
FortiSIEM Installation Guide FortiSIEM Installation Guide
Ability to create display and filter templates and use them later in a query or rule (see here )
Support OpenLDAP for user discovery and external authentication
This release extends user discovery and external authentication capabilities from Microsoft Active Directory to also include OpenLDAP servers.
Setting up OpenLDAP based discoveries and external user authentication is covered
Support secure LDAP protocols: LDAPS and LDAP Start TLS
CMDB Report extensions
Currently users can create CMDB reports for exporting CMDB information. Currently this includes a report of devices in CMDB, their installed and running applications, hardware inventory etc. This release extends this capability to include users, rules and reports. Specifically users can now run reports on
Discovered users
AccelOps administrative users and their roles
Active Rules with exceptions if any
Scheduled Reports
Active Performance Monitors
For details see
The following inbuilt reports in CMDB Report section can be used to quickly get relevant information.
Discovered Users
Externally Authenticated AccelOps Users
Locally Authenticated AccelOps Users
Manually Defined Users
Active Rules
Inactive Rules
Rules with Exceptions
Scheduled Reports
Active Performance Monitors
Performance and Availability Monitoring
Customizable high performance summary dashboards
Summary dashboards, a unique AccelOps feature, provide a real-time bird's cross-domain metrics and health of a device or a group of devices or applications. There are 3 types of dashboards: single level e.g. All Network dashboard, Hardware summary two-level dashboards e.g. database performance dashboard, ESX-VM dashboard three level dashboards e.g. Business Service dashboard (Business Service -> Devices -> Applications), VM Cluster dashboard (Cluster
-> ESXs -> VMs)
In this release, all of these dashboards are enhanced for scalability and extensibility: the dashboards are now configurable users can create their own dashboards users can add their own performance metrics whether they are collected by default or created by customers as custom monitors paginated dashboard views eliminate the limitation of 300 devices/applications per dashboard - searching and sorting happens across the entire set of devices, not just on the page the user is on most performance metric computations (like maximum or average interface utilization over all interfaces of a device) are now shifted from the GUI to the Super/Worker cloud - this dramatically reduces GUI network bandwidth and improves GUI rendering speed.
The ability to customize a summary dashboard is covered here
.
Generalized Selenium based Web Synthetic Transaction Monitoring (STM)
The ability to monitor websites by running complex multi-level synthetic monitoring tests is an important criterion. This release allows AccelOps
Page 75
FortiSIEM Installation Guide FortiSIEM Installation Guide customers to record any web transaction from a web browser via Selenium plugin, and then play it back within AccelOps framework for continuous monitoring. Alerts can be triggered when the script fails to run or has an unacceptably large delay.
For setting up a Selenium based Web STM, see
End-to-end Email Synthetic Transaction Monitoring (STM)
For properly testing the health of email system, it is important to be able to test the entire path of an email: sender -> SMTP gateway -> receiving
SMTP gateway -> receiving mailbox. This release provides AccelOps users a framework to run end-to-end e-mail synthetic tests, e.g. AccelOps will send an email and make sure that the same email is received within an acceptable time limit. Alerts can be triggered when an email fails to arrive or has an unacceptably large delay.
For setting up an end-to-end email STM, see here
.
Custom SSH based command output monitoring
Often customers have scripts that monitor certain aspects of a system or an application and there is a need to get those script outputs into
AccelOps for reporting and alerting. This release provides customers a framework for running these scripts remotely, bringing back the command output via SSH, parsing the output and creating events for further analysis in AccelOps.
For setting up command output monitoring, see
Log Management and Security Incident Event Monitoring (SIEM)
Watch list
This release enables users to create and manage watch lists. Watch lists are (often dynamic) containers that can hold objects of interest, e.g.
Network Scanners, Frequent Locked out users, Externally excessive denied ports, High I/O Virtual machines etc. Watch lists can be dynamically populated when a rule triggers. An entry can leave the watch list if it does not trigger in a defined period of time or the entry could be permanent.
A watch list can also be populated statically. A watch list can be further used in a rule condition in a nested manner to trigger rules of significant more significance. Watch lists provide a easy way to keep track of important policy violators in a monitoring system without always running reports.
For setting up command output monitoring, see
Agent less file change and file integrity monitoring
Unauthorized and untested configuration changes often lead to critical failure conditions. AccelOps already provides a way to keep track of network device configuration changes. This capability is further extended in this release to address the following situations – in an agent less fashion.
File integrity via checksum for specific files or directories on a server – trigger an alert when there is a change in any file in any directory.
The files need to be accessible via SSH or Telnet.
Monitor the
content
of a file on devices and make sure that it is identical to a target “blessed” file. Alert when the monitored file differs from the target file and show exactly what has changed.
Setting up agent-less file change/integrity monitoring is discussed
Log integrity validation
This release enables AccelOps customers to demonstrate to security auditors that the collected logs have not been tampered with, while at rest within AccelOps monitoring system. To achieve this, logs are cryptographically signed immediately upon arrival at the AccelOps point of entry.
Using the AccelOps GUI, the cryptographic checksum can be validated to prove to the auditors that logs have not been tampered with. In case the logs have indeed been tampered with, AccelOps can identify the time period of the affected logs.
Log integrity validation is discussed here
.
Compliance reporting
AccelOps already provides compliance reports for the following standards: PCI, HIPAA, COBIT, GLBA, FISMA, NERC, GPG13. This release extends this set by providing compliance reports for the following standards
SANS Critical Controls
ISO
Page 76
FortiSIEM Installation Guide
PCI 3.0
FortiSIEM Installation Guide
Device Support
Checkpoint Provider-1 – collect firewall logs from CLM and audit logs from MDM - see
MySQL database - discovery, performance monitoring and audit log collection and analysis - see
IBM DB2 Audit Log – audit log parsing and analysis - see Configuring Security Gateways for details
Cisco AVC – log analysis via Netflow
McAfee Foundstone Vulnerability Scanner - full log parsing and analysis - see
for details
HyperV log parsing via Honeycomb agent
Windows log parsing and file integrity monitoring via Honeycomb agent
Windows log parsing via Correlog agent
Dell Blade center
EMC Data Domain
Citrix NetScaler performance monitoring
Link interface errors (1.3.6.1.2.1.10.7.2)
EMC Isilon
Alcatel AAA Radius syslog
Miscellaneous Key Enhancements
Quick interface utilization drill down via Netflow
This release enables users to quickly analyze a network interface usage issue by combining SNMP and Netflow. SNMP provides interface utilization metrics and Netflow provides the traffic on that interface. AccelOps makes this connection seamless assuming that the router/switch is monitored by SNMP and also sending Netflow to AccelOps.
To achieve this drill down
Go to CMDB, select the router and click 'Interface Stats'. The displayed data is from SNMP.
Page 77
FortiSIEM Installation Guide FortiSIEM Installation Guide
Note that for any interface, there is a drill down for Inbound or Outbound traffic. Select the desired direction and the interface usage for the chosen direction is displayed. This information is gathered from Netflow.
Page 78
FortiSIEM Installation Guide FortiSIEM Installation Guide
Manually define trunk ports
User identity and location is a key feature in AccelOps. To accomplish this, AccelOps automatically discovers switch trunk ports to ensure that only the access ports and not trunk ports show up in Identity and Location reports. An exception is of course VoIP ports which have PCs connected to them. This release enables to manually label certain discovered interfaces as trunk ports. Future discoveries will take this input into consideration and not create Identity and location entries for those user defined trunk ports.
To label a discovered interface as a trunk port, go to CMDB; choose a device; 'Edit' interfaces; check the Trunk Port checkbox and click Save.
You need to do a discovery again to get new identity and location information.
Add CMR Support for Cisco VoIP
Cisco VoIP Call information is in two files
CDR records - this contains primarily the Call originator and Call destination information
CMR records - this contains call quality information - MOS scores
Prior to this release, AccelOps only handled CDR records. This release is able to "join" CDR and CMR records to append the call quality information to the call originator/destination information in a single event.
The following system VoIP related reports are provided
The following system VoIP related rules are provided
Limit excessive generated incidents
Page 79
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco ASA/IOS Remote Access VPN Monitoring
Most Expensive Query report
As part of database performance monitoring, AccelOps can now monitor the most expensive queries. Currently it works for Oracle and MS SQL
Server.
Two system reports are provided.
The query result shows the query and the time taken.
Two rules are provided that trigger when a query takes more than 5 minutes to complete. The query has to complete for the rule to trigger.
VM Snapshot monitoring
VM Snapshots consume lots of space. This release allows you monitor the space taken up by snapshots
Page 80
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Apr 21 10:42:04 192.168.0.75 java:
[PH_DEV_MON_VM_SNAPSHOT]:[eventSeverity]=PHL_INFO,[vmName]=vCenter_074,
[phyMachName]=Host-192.168.0.70,[phyMachIpAddr]=192.168.0.70,[pollIntv]=
180,[hostName]=vcenter-74,
[hostIpAddr]=192.168.0.74,[snapshotName]=03_06_2014,[snapshotDescription
]=,[snapshotQuiesced]=false,
[snapshotId]=5,[snapshotCreateTime]=1394130116,[snapshotPowerState]=powe redOff,[snapshotStatus]=true,
[usedDiskMB]=8192,[datastore]=datastore-326
Three system reports are added
Excluded Disks
Often there are certain disk volumes that are either read only or always close to full and never grow. Because of these disks, these servers
.
Fixed Issues
General GUI related fixes and enhancements
Bug 7580: While trying to validate a custom parser (cloned), user gets "Backend error code: 139" and cannot continue working on parser
Bug 7589: Remove 300 device limitation in custom dashboard
Bug 7648: Devices do not update after moving Organizations
Bug 7713: Chart is not displayed in report if generate the report with "Display as" columns.
Bug 7780: CSV exported report does not need extra commas
Bug 7958: Dashboard displays error when Request XML is over 20MB
Bug 8119: Clear Reason for system cleared has incorrect "active for more than 7 days"
Bug 8166: When creating a Ticket the "Assigned To" drop down contains ALL LDAP users, not just AO users
Bug 8170: Add search box on floating dialog boxes showing Performance Monitor errors
Bug 8180: Customer ID of All Report Notification report shows Super always
Bug 8683: Dashboard for Oracle does not display instance status
Bug 8713: Need to allow to import downloaded malware domain csv file manually
Bug 8719: Display IPS Generator ID and IPS Signature ID in wrong format
Bug 8725: "Last Update" of malware domain/blocked IP is not updated
Bug 8736: Ability to set values for ports, applications, device types at global level in CMDB that apply to all orgs
Bug 8762: If you schedule a report and set a custom value in Maximum graphs or Maximum rows and save it then go back into scheduled reports, it goes back to default values. It appears graphs/rows are saved with the custom values because scheduled reports work correctly.
Bug 8768: After changing the Font - some words do not fit correctly
Bug 8826: Customer added a second email address in Admin -> General Settings -> Analytics. Scheduled Report emails are not being sent to the second address
Bug 8946: Org Users should not be able to see Systems Errors from other Orgs
Bug 8962: Allow for bulk delete of report results.
Bug 8963: Perf Incidents are not displayed properly from Dashboard (Exec. Summary)
Bug 8989: Disk utilization drill-down dialog stop working once browser loose focus
Bug 9072: When editing credentials of various protocols, they all display the 'description' field. SNMP v3 protocol does not display this field. This led users to incorrectly use the context field to to put description which caused failures.
Page 81
FortiSIEM Installation Guide FortiSIEM Installation Guide
Bug 9073: When looking at a widget - in this case "Top Incidents by Severity, Count", and you drill down into an incident, you are brought to the incident page with a list of the incidents - BUT - after sorting the widget, and drill down on the same incident, you are show an incorrect incident
Bug 9096: Parse out additional fields in Symantec AV events
Bug 9116: Remove SMS notification configuration from user guide
Bug 9182: Clear incident notification email contains incorrect host name which belongs to another org with the same IP
Bug 9311: Too many tasks causes GUI to be slow
Bug 9332: The report output limitation is incorrect in the pop up report run dialog
Bug 9374: Maintenance Calendar does not save Devices folders
Bug 9391: Notification policy does not work when set only the days of the week and the start date, toggle the days of the week
Bug 9539: Need to forbid "Test Rule" button for rules from organizations
Bug 9628: Daylight saving time (DST) causes report editing to not properly re-save time
Bug 9675: For Juniper SRX devices that have virtual interfaces with a 192.0.0.0 subnet mask, user cannot edit and modify any CMDB fields for this device
Bug 9734: Read-Only Admin Role allows credential to IP association edits with double click
Bug 9839: Provide ability to export IP Range to Credential associations. Currently, the Export button on Admin->Setup->Credentials only exports the credentials but not the IP to Credential associations
Bug 9892: When export CMDB report run for 1 Org, you get data for ALL Orgs
Bug 9953: Deleting Clear Conditions in Rule do not work
Bug 10023: In Dashboard > widgets > combo view, y -axis has no scale value
Bug 10046: Last updated method overwrites the health page. Discover first using WMI then VM_SDK and you get just the VM stats
Bug 10161: When SVN has too many configuration/installed software revisions on single device, UI got timed out by 120 seconds.
Finally, UI shows error and cannot see device configuration
Bug 10186: Email notification contains another organizations Interface description
Bug 10202: AO-SP: Rule Sync Errors dialog show other organization's error
Bug 10215: AO-SP: For Rule Synch errors, an Org user should be able see ONLY his own changes causing synch errors. Super/global should be able to see all Organization errors
Bug 10263: LDAP discovery does not add users when there is an exception caused by the address field is too large to fit into our 256 character column field on ph_contact
Bug 10288: For Report Bundles, report end times are off by 1 minute
Bug 10292: For Report Bundles, absolute schedule time not saved when custom email notification is chosen
Bug 10344: Prevent user from entering more characters then allowed in text fields in UI. When creating a device maintenance schedule, entering too many characters in the description field resulted in "transaction marked for rollback" message
Bug 10673: Custom group does not show up in role management UI Access tree. This issue is affecting to many places such as
Dashboard, CMDB, query condition builder
Bug 10829: When selecting multiple devices in CMDB for setting up maintenance schedule the devices do not have name in dialog box.
This is GUI issue only.
Platform related fixes and enhancements
Bug 7600: Provide a CMDB Report for Active Rules for an Organization
Bug 7680: External authentication does not work with OpenLDAP
Bug 7953: Events dropped based on Elastic EPS being too slow in changing values
Bug 8142: Event Packager port unnecessarily open on the super and workers
Bug 8213: Back end modules should check certificates during SSL communication
Bug 8278: Script for creating bluecoat ftp directory does not change owner.group to ftpuser.ftpuser
Bug 8279: Every time AO device is rebooted bluecoat ftp directory owner.group are reset to admin.admin preventing files from being ftp'ed to AO
Bug 8650: Need to consolidate NSCD package to nscd-2.5-24 with its updated configuration
Bug 8676: Proxy configuration does not work
Bug 8718: Add CMDB Report for Users in AccelOps
Bug 8869: Provide capability in CMDB reports to extract intersection (AND) of 2 criteria - when the criteria partially overlap
Bug 8983: Need to auto-compact JMS request queue
Bug 9065: Empty username and password in the base URL definition causes upgrade failed
Bug 9184: Support CS MARS type drop rules
Bug 9283: Documentation for Amazon AWS need to say Access key and Secret access key instead of User ID and Password
Bug 9341: Global EPS license is ignored when Elastic EPS allocates EPS based on previous configuration
Bug 9630: Create a report for all users with system roles in AccelOps
Bug 9669: Limit the amount of times that AppServer retries a transaction
Bug 9928: Create a report for Monitor Change Performance errors
Bug 9937: Do not overwrite phoenix_config.txt upon upgrade
Bug 10009: Create a report to show all processes and open ports
Bug 10143: Customer certificate overwritten in ssl.conf with 3.7.6 upgrade
Bug 10223: Cache files created by incident notification are never removed
Bug 10525: Provide an option to not show the Domain drop-down list from logon page for external authentication
Bug 10567: Fix customer found Apache security vulnerabilities
Performance Monitoring / STM related fixes and enhancements
Bug 7787: Add Virtual Memory Utilization Attributes support
Page 82
FortiSIEM Installation Guide FortiSIEM Installation Guide
Bug 8254: False high Exch Metrics
Bug 8700: Monitor VM snapshots
Bug 8837: AO is losing checkpoint firewall events every time phCheckpoint crashes
Bug 8919: The average processing time for Glassfish servlets and processors are wrong
Bug 8981: Windows log pulling time interval not implemented correctly
Bug 9137: Add load balancing metrics for Cisco ACE load balancer
Bug 9458: Need instance availability monitoring via Amazon AWS SDK
Bug 9508: Add performance monitoring for Citrix NetScaler
Bug 9627: "PH_DB_DATA_ERROR: cannot decrypt password for principal" exception thrown when running perfMonitor rest API on
Super in SP mode when there are devices monitored by a collector
Bug 10028: Performance monitor job status does not update (shows yellow star)
Bug 10222: Enhance custom performance monitor to include string index (currently only integer index)
Bug 10249: Cisco ASA CPU, memory utilization not populated correctly
Bug 10471: NX-OS devices PH_DEV_MON_INTF_UTIL not calculated correctly sometimes
Bug 10512: Apache metrics are not being pulled
Bug 10527: Fail to collect UDP echo IP SLA stats
Bug 10608: Monitoring Windows network interface statistics via WMI sometimes crashes when server has more than 1 network interface
Bug 10618: Hardware Monitoring for Cisco IOS and NX-OS devices stops after 3.7.6 upgrade
Bug 10650: Important process with long parameters (like java) are not being detected as down when they are indeed down
Bug 10827: Enhance Linux disk utilization by accounting for reserved space
Bug 10921: Generate per-host LUN usage metrics for EMC VNX/Clarion
Rule / Query / Report Engine related fixes and enhancements
Bug 7509: Prohibit user from choosing past dates in scheduled reports
Bug 8376: Reports saved as csv have blank "Event Name" column
Bug 8811: Query returns nothing for user defined port/protocol group
Bug 9405: Analytics can only query top level CMDB Application Groups
Bug 10183: When running a long report, App server needs to retry if Query Master does not respond
Bug 10345: Report Scheduler not sending reports at the correct time
Bug 10348: Daylight Savings Time (DST) causes report editing to not properly re-save time
Bug 10349: Quartz worker thread pool are too small to handle large set of scheduled reports
Bug 10487: Enhance CONTAIN operator to match anywhere in string - not just in the beginning
Bug 10767: Eliminate Rule synch errors caused by Rule exception
Parsing related fixes and enhancements
Bug 7625: Suppress certain events from being parsed
Bug 7639: Windows Parser does not completely parse when key pair fields are in Spanish
Bug 8216: Parse out additional fields in ASA-722051 event
Bug 8355: Allow event forwarding based on event severity
Bug 8702: Event Type Win-Security- 4656 does not parse object type and object name
Bug 8758: Symantec AnitVirus logs - virus file name not being parsed
Bug 8874: Fix Microsoft UAG parser
Bug 8889: Fix Forescout CounterACT parser
Bug 8895: Allow parsing of ":" in certain Cisoc IOS messages
Bug 8999: Windows WMI OS Parser does not properly parse all fields on SQL Server Events
Bug 9024: Windows Parser needs to strip the @Domain.xxx at the end of "account name" in the key-value-pair
Bug 9026: from Admin->Device Support->Event Type, if you click on the amplifier icon on the search box and uncheck ‘Device Type’, it ignores the search columns settings which always includes Device Type as part of search. Actually it ignores whatever is unchecked, it always displays the default
Bug 9451: WatchGuard Firewall Parser Missing Events
Bug 9587: Email subject is sometimes not parsed by Cisco IronPort Mail parser
Bug 9641: Save event name from Cisco IPS Alerts
Bug 9709: Add support for Alcatel AAA Radius syslog
Bug 9843: NetApp snnp traps not parsed
Bug 9861: Change Parser to not create User= "-" for event type IIS-Web-Client_Access_Denied
Bug 9862: F5 BIG-IP LTM new version has syslog not parsed by our current parser
Bug 9955: Cisco switch events for dynamic ARP inspection (SW_DAI-4-DHCP_SNOOPING_DENY) are not being fully parsed
Bug 10090: Cisco ASA Parser enhancement - add the type of Remote Access connection that is used when a DAP is applied
Bug 10091: Parse WLAN AP Host Name attribute for Cisco WLAN disassociation SNMP traps
Bug 10092: Enhance Cisco Call Manager CDR parser to get the CM Login User ID of the caller
Bug 10119: Logon Fail events misclassified as Login Success events
Bug 10286: AccelOps is not parsing Severity and Source / Destination addresses, Event Type, Event Name, etc. from Snort Sensor IDS logs, because of the <br0> between the [Priority 1]: and {TCP}
Bug 10324: Parse addition fields for Symantec Endpoint Protection (SEP) logs
Bug 10381: Fix JunOS log parsing errors
Bug 10408: Parse logs generated by Correlog windows agent
Bug 10418: Parse user name from Windows MSSQL Event 18453
Bug 10458: Convert TOS values to DSCP values in Netflow
Page 83
FortiSIEM Installation Guide FortiSIEM Installation Guide
Bug 10511: Parse out Account Name and Object Name for Win 4670 events
Discovery related fixes and enhancements
Bug 6574: Provide an option for removing VM monitoring
Bug 6955: Support secure LDAP protocol
Bug 7888: Checkpoint running SPLAT OS being incorrectly discovered as Generic Linux
Bug 8681: Redhat 10GB Interface discovered as 10MB
Bug 8769: Support MySQL - discovery, performance monitoring and log collection
Bug 8984: Compress Discovery result before sending to App server
Bug 9042: MS SQL Server JDBC discovery fails but AO still pulls some perf metrics but not all This is unique to MS SQL Server 2012.
Bug 9058: LDAP discovery using "daysToPasswordExpiry" is completely wrong
Bug 9070: Add SNMP support for Dell Blade Center / Chassis Mgmt Controller
Bug 9134: Support EMC Data Domain
Bug 9290: Add region to AWS EC2 discovery
Bug 9420: Checkpoint discovery does not have Installed Software/Running Process on GAIA/Security Platform
Bug 9474: VM discovery does not work with symbol character for password
Bug 9584: Make the 'show ip route' command optional in discovery of Border routers with millions of routes
Bug 9790: VMSDK discovery failure does not show complete failure reason
Bug 9827: Option to include or exclude VM Guest hosts during ESXi / VMSDK discovery
Bug 10025: Add device support for standalone Cisco WLAN AP (not controllers) running IOS
Bug 10171: Cisco IPS module in ASA has wrongly discovered IPS SW version
Bug 10437: Cannot discover Cisco device by SSH with high privilege user
Bug 10524: Discovering powered off VMs may cause incorrect merge if the VMs have a shared IP address
Bug 10530: Linux interface speed incorrect
Bug 10677: Interface alias not discovered when an interface has more than one addresses
Open Issues
Bug 7537: Can not create new incident category in VA mode. AO-SP works correctly. Workaround is to manually add the incident category to a rule in the database.
Bug 7191: Device Maintenance window cannot be larger than 1 day
Page 84
FortiSIEM Installation Guide FortiSIEM Installation Guide
FortiSIEM Basics
These topics provide an overview of the FortiSIEM solution, including its component and various deployment configurations.
Supervisors, Workers, Collectors, and Organizations
Standalone Supervisor Deployment for Enterprises
Supervisor and Worker Cluster Deployment for Enterprises
Supervisor with Collectors Deployment for Enterprises
Matrix of Enterprise Deployment Configuration Options
Multi-Tenant Deployment Options for Managed Service Providers or Multiple Organizations
Standalone Supervisor Deployment for Multi-Tenancy
Supervisor and Worker Cluster Deployment for Multi-Tenancy
Supervisor with Collectors Deployment for Multi-Tenancy
Matrix of Multi-Tenancy Deployment Configuration Options
Page 85
FortiSIEM Installation Guide FortiSIEM Installation Guide
Features and Architecture
FortiSIEM provides an all-in-one, seamlessly integrated and service-oriented IT infrastructure monitoring solution that covers performance, availability, change, and security monitoring aspects of network devices, servers, and applications. It is offered in two versions:
A VMware based virtual appliance, which you can deploy as a single appliance or a cluster of virtual appliances in a highly available, scaled-out grid architecture. This is what we refer to as FortiSIEM Enterprise.
Software-as-a-Service (SaaS), where you deploy a Collector virtual on-premises for a customer, and all of the customer data is transmitted to an FortiSIEM data center. This is what we refer to as FortiSIEM Multi-Tenant, since collector deployments are commonly used by organizations such as Managed Service Providers to monitor the services of their customers.
Some of the features of the FortiSIEM monitoring solution include:
Intelligent Device Discovery
The first step in the monitoring process is IT infrastructure discovery. FortiSIEM has a fast and intelligent discovery engine that can automatically crawl an IT infrastructure and discover network devices, servers, and applications in depth. The user needs to provide appropriate credentials, a discovery IP address range, and optionally a starting router IP address for faster discovery.
A wide range of information is discovered including hardware information, serial numbers and licenses, installed software, running applications and services, and router configuration. The discovered devices are automatically categorized into detailed functional groups, such as
Routers/Switches, Firewalls, and Network IPS, and this information is maintained within an integrated configuration management database
(CMDB). Some special relationships are also discovered, for example WLAN Access Points to WLAN Controllers, VMware guests to physical hosts, etc. The CMDB is kept up to date through user-defined scheduled discoveries and FortiSIEM listening to changes as part of performance monitoring.
A novel aspect of FortiSIEM discovery is that those aspects of a device that can be monitored are also discovered at the same time. For example, given SNMP, WMI, and JDBC credentials for a Windows server, FortiSIEM might discover the following:
System performance metrics that can be collected by SNMP, for example CPU, memory utilization, and disk space utilization
System performance metrics that can be collected by WMI, for example Disk I/O utilization, memory swap rates, and process utilization
Application specific metrics that can be collected by WMI, for example IIS, DNS, DHCP, and Exchange metrics
Event logs that can be collected by WMI
Database logs that can be pulled from the server by JDBC
You simply approve the discovered results and monitoring begins. This approach reduces human error, since FortiSIEM learns from the true device configuration state.
Analytics
FortiSIEM uses a unified event-based framework to analyze all data including logs, performance monitoring data. Logs can either be sent to
FortiSIEM via Syslog, SNMP traps, or other common log shipping methods, or FortiSIEM can periodically access the system and collect the logs.
Performance monitoring data is collected by periodically probing the system. The data is parsed, indexed, and stored in a proprietary flat-file based database. In contrast, the CMDB information is stored in a PostgreSQL relational database. FortiSIEM unified data management architecture combines the two databases and presents a single view to the user.
FortiSIEM provides a broad range of metrics. First, it is possible to search all data based on keywords or in a structured way using the attributes parsed by AcceOps. The search can be done in real time, in which the data streaming in from devices is displayed, or the search can be based on historical data. Historical data is referred to as Reports in FortiSIEM, and can be scheduled to run at intervals you set. A large number of reports are provided in a categorized fashion, based on device type, and also based on functionality such as availability, performance, change and security. Two novel aspects of FortiSIEM metrics include unification and drill-down capabilities. With unification, all the data is analyzed and presented the same way, whether it be real time search, reports, rules or performance, availability, or change or security data. By using drill-down you can start from a specific context, such as Top Authentication Failed Users, and iteratively select attributes to further analyze data and get to the root cause of a problem. As an example, the investigation of Top Authentication Failed users could follow a drill-down of pick user and time range -> Top Destination IP, Ports for specific user and time range -> pick destination IP and port -> Query all raw messages.
FortiSIEM also uses rules for real-time alerting - a real-time event correlation engine analyzes all data and triggers alerts based on these rules.
FortiSIEM ships with 500+ broad rules that cover a broad range of inter-related performance, availability, change and security scenarios. Rules can vary from simple text search and threshold conditions, to comprehensive logic supporting full Boolean operators and nested sub-patterns referencing multiple elements including thresholds and defined services. Thresholds can be static or dynamically derived from profiled network, system resource and user activity. You can add new rules, and customize existing ones, as described in
Business Services
Page 86
FortiSIEM Installation Guide FortiSIEM Installation Guide
A business service lets you view FortiSIEM metrics and prioritize alerts from a business service perspective. A business service is defined within
FortiSIEM as a smart container of relevant devices and applications serving a business purpose. Once defined, all monitoring and analysis can be presented from a business service perspective. It is possible to track service level metrics, efficiently respond to incidents on a prioritized basis, record business impact, and provide business intelligence on IT best practices, compliance reporting, and IT service improvement. What is also novel about FortiSIEM is how easily a business service can be defined and maintained. Because FortiSIEM automatically discovers the applications running on the servers as well as the network connectivity and the traffic flow, you can simply choose the applications and respective servers and be intelligently guided to choose the rest of components of the business service. This business service discovery and definition capability in FortiSIEM completely automates a process that would normally take many people and considerable effort to complete and maintain.
Architecture
The FortiSIEM virtual appliance solution operates as a turnkey, guest host application running within the most popular hypervisors with the option of using NFS or local storage. The implementation process is flexible and can be accomplished in phases to support a variety of distributed and hybrid-cloud implementations The FortiSIEM virtual appliance is placed on a network where it can obtain operational data, as well as establish sessions with the infrastructure. Remote sites can use the FortiSIEM Collector client to locally discover, collect, compress and securely transmit of operation data back to the FortiSIEM virtual appliance. FortiSIEM' scale-out architecture allows for virtual appliance clustering to increase processing capacity and availability. Additional virtual appliances can be added on-the-fly with nominal configuration, which will automatically distribute workload across cluster members to extend event analysis throughput and to reduce query response time.
Page 87
FortiSIEM Installation Guide FortiSIEM Installation Guide
Supervisors, Workers, Collectors, and Organizations
An FortiSIEM deployment can be configured using either a single virtual appliance, or with multiple virtual appliances that play different roles within the deployment. The
Supervisor virtual appliance is the primary component in both standalone and cluster deployments, and all deployments begin with the set up and configuration of the Supervisor. As described in
Supervisor and Worker Cluster Deployment for
deploy
Worker
virtual appliances to take up the extra load. Finally, you may encounter situations in which you need to deploy
Collectors
purpose of gathering data that will be processed by Supervisors and Workers. As described in
Supervisor with Collectors Deployment for
for the
Supervisor and Worker Cluster Deployment for Multi-Tenancy
, these are most likely situations where you need to monitor IT infrastructure for different sites, as in the case of a large or distributed enterprise, or for different organizations, as in the case of multi-tenant installations for Managed Service providers (MSPs). For these situations each
Organization
tailor your monitoring, analytics, and reports to meet the specific needs of that organization.
is defined separately within FortiSIEM, so you can
Page 88
FortiSIEM Installation Guide FortiSIEM Installation Guide
Deployment Options
FortiSIEM architecture of workers, collectors, and supervisors offers a number deployment options for enterprises at any level of scale, as well as deployment options for managed service providers who need multi-tenant solutions. Topics in this section describe these deployment options in detail, including use cases for each deployment type as well as node and server configurations for each deployment type.
Standalone Supervisor Deployment for Enterprises
Supervisor and Worker Cluster Deployment for Enterprises
Supervisor with Collectors Deployment for Enterprises
Matrix of Enterprise Deployment Configuration Options
Multi-Tenant Deployment Options for Managed Service Providers or Multiple Organizations
Standalone Supervisor Deployment for Multi-Tenancy
Supervisor and Worker Cluster Deployment for Multi-Tenancy
Supervisor with Collectors Deployment for Multi-Tenancy
Matrix of Multi-Tenancy Deployment Configuration Options
Page 89
FortiSIEM Installation Guide FortiSIEM Installation Guide
Enterprise Deployment Options
For FortiSIEM, an Enterprise deployment is one in which there is a single organization for which data is gathered and analyzed, and the virtual appliances are located entirely on-premises for that organization.
Standalone Supervisor Deployment for Enterprises
Supervisor and Worker Cluster Deployment for Enterprises
Supervisor with Collectors Deployment for Enterprises
Matrix of Enterprise Deployment Configuration Options
Page 90
FortiSIEM Installation Guide FortiSIEM Installation Guide
Standalone Supervisor Deployment for Enterprises
This is the simplest possible deployment option, in which a single Supervisor handles all the work of monitoring, processing, and analyzing data.
You can configure the Supervisor to use local or NFS storage, depending on your event data storage requirements, as described in
Page 91
FortiSIEM Installation Guide FortiSIEM Installation Guide
Supervisor and Worker Cluster Deployment for Enterprises
As the number of monitored devices, or the analyzed event rate, grows, one Supervisor may not be able to handle the load. In that case, you can deploy a cluster of Supervisor and Worker virtual appliances that share data over NFS. In a cluster deployment, the Supervisor and Worker nodes have specific functions:
Discovery always runs on the Supervisor node
Logs can be sent to either the Supervisor or Worker nodes, and parsing occurs on the node where the event is received
Performance monitoring jobs are distributed by the Supervisor node across all Supervisor and Worker nodes following a load distribution algorithm.
Users connect to the Supervisor via the AccelOps interface, and the Supervisor node runs the Application server, PostgreSQL
(containing CMDB) and SVN database
Adhoc user queries, preset continuously running reports, and rules are handled by the cluster in a collaborative manner
Worker nodes are stateless, and can be seamlessly added or removed from the cluster as needed as the number of monitored devices or the rate of events grows, or if better query performance is required
Page 92
FortiSIEM Installation Guide FortiSIEM Installation Guide
Supervisor with Collectors Deployment for Enterprises
There are two cases where a single Supervisor may not be enough for your deployment.
There are monitored devices behind a firewall that will not allow monitoring protocols like Windows Management Instrumention (WMI) to be used from the Supervisor
The Supervisor can only reach the monitored devices through a high latency network like a Wide Area Network (WAN), in which case monitoring like protocols like Simple Network Management Protocol (SNMP) or WMI do not work well
In these cases you can deploy
Collectors
to monitor the devices, and they will communicate to the Supervisor over HTTP(S). The Collectors communicate with the devices, collect and parse events and logs, compress them, and then send them to the Supervisor for monitoring and analysis. Collectors also can buffer the events, in case transmission to the Supervisor is interrupted. As shown in the diagrams, you can use
Collectors in a deployment with a single Supervisor, or in a deployment that also includes Workers.
An AccelOps deployment with a single Supervisor and Collectors
Page 93
FortiSIEM Installation Guide FortiSIEM Installation Guide
An AccelOps deployment using a Single Supervisor + 2 Workers + 2 Collectors
Page 94
FortiSIEM Installation Guide FortiSIEM Installation Guide
Matrix of Enterprise Deployment Configuration Options
This matrix shows the components required for each enterprise deployment option.
Deployment Option
Single Supervisor Node
Supervisor Node with
Collectors
Enterprise Cluster
Enterprise Cluster with
Collectors
Supervisor Node with
Tableau Visual Analytics
Supervisor Node with
Collectors and Tableau
Visual Analytics
Enterprise Cluster with Ta bleau Visual Analytics
x
x
x
x
Enterprise Cluster with
Collectors and Tableau
Visual Analytics
Supervisor
Node
x
x
x
x
Worker
Node
x
x
x
x
Collector
Node
x
x
x
x
NFS
Server
x
x
x
x
Report
Server
x
x
x
x
Visual
Analytics
Server
x
x
x
x
Description
This is the most basic single site enterprise deployment.
This is also an enterprise deployment covering multiple sites. Data collection is simplified by deploying a collector for the satellite sites.
This is the scalable enterprise deployment. An NFS Server is required in the data sharing architecture between Supervisor and Worker nodes.
This deployment adds collectors to the mix and is the most comprehensive enterprise deployment.
This is the most basic single node enterprise deployment, with added capability for Visual Analytics with Tableau
This is also an enterprise deployment covering multiple sites with added capability for Visual Analytics with Tableau deploying a collector for the satellite sites.
. Data collection is simplified by
This is the scalable enterprise deployment with added capability for with added capability for Visual Analytics with Tableau required in the data sharing architecture between Supervisor and Worker nodes.
. An NFS Server is
This deployment adds collectors to the mix and is the most comprehensive enterprise deployment, with added capability for Visual
Analytics with Tableau .
Page 95
FortiSIEM Installation Guide FortiSIEM Installation Guide
Multi-Tenant Deployment Options for Managed Service Providers or Multiple Organizations
While a common use case for FortiSIEM is the monitoring of IT infrastructure for a single enterprise, Managed Service Providers (MSPs) and large enterprises with multiple organizations can also use FortiSIEM to monitor IT infrastructure at the customer or organization level, either by splitting IP addresses to correspond to the customer or organization, or by deploying Collectors for each customer or organization and managing the monitoring and analysis of their data from a centralized Supervisor.
Standalone Supervisor Deployment for Multi-Tenancy
Supervisor and Worker Cluster Deployment for Multi-Tenancy
Supervisor with Collectors Deployment for Multi-Tenancy
Matrix of Multi-Tenancy Deployment Configuration Options
Page 96
FortiSIEM Installation Guide FortiSIEM Installation Guide
Standalone Supervisor Deployment for Multi-Tenancy
FortiSIEM allows users to create organizations, to and manage the entire IT infrastructure monitoring life cycle from data collection, storage, analytics and alerting for an organization that organization as a separate entity from other organizations. There are several use cases for this this multi-tenant model.
Hosting service providers that host multiple customers in their own data center
Managed service providers that manage a customer's data centers from their own data center
Large enterprises that want to manage separate parts of the organization as individual customers
The simplest multi-tenancy deployment involves a single Supervisor, with organizations defined through the splitting of IP address ranges. For example:
10.1.1.0/24 = Customer 1
10.1.2.0/24 = Customer 2
During the discovery process, FortiSIEM will tag a device with the right customer ID based on the IP address definition.
Page 97
FortiSIEM Installation Guide FortiSIEM Installation Guide
Supervisor and Worker Cluster Deployment for Multi-Tenancy
As the number of monitored devices, or the analyzed event rate, grows, one Supervisor may not be able to handle the load. In that case, you can deploy a cluster of Supervisor and Worker virtual appliances that share data over NFS. In a cluster deployment, the Supervisor and Worker nodes have specific functions:
Discovery always runs on the Supervisor node
Logs can be sent to either the Supervisor or Worker nodes, and parsing occurs on the node where the event is received
Performance monitoring jobs are distributed by the Supervisor node across all Supervisor and Worker nodes following a load distribution algorithm.
Users connect to the Supervisor via the AccelOps interface, and the Supervisor node runs the Application server, PostgreSQL
(containing CMDB) and SVN database
Adhoc user queries, preset continuously running reports, and rules are handled by the cluster in a collaborative manner
Worker nodes are stateless, and can be seamlessly added or removed from the cluster as needed as the number of monitored devices or the rate of events grows, or if better query performance is required
In these deployments, you can define organizations by splitting IP address ranges. For example:
10.1.1.0/24 = Customer 1
10.1.2.0/24 = Customer 2
During the discovery process, the AccelOps Supervisor node will tag a device with the correct customer ID based on the IP address definition.
Page 98
FortiSIEM Installation Guide
Supervisor with Collectors Deployment for Multi-Tenancy
FortiSIEM Installation Guide
Page 99
FortiSIEM Installation Guide FortiSIEM Installation Guide
Matrix of Multi-Tenancy Deployment Configuration Options
This matrix shows the components required for the each multi-tenancy deployment option.
Deployment Option
Single Multi-Tenant
Supervisor Node
Multi-Tenant Supervisor
Node Collectors with
Multi-Tenant Cluster
Multi-Tenant Cluster with
Collectors
Multi-Tenant Supervisor
Node with Tableau Visual
Analytics
Multi-Tenant Supervisor
Node with Collectors and T ableau Visual Analytics
Multi-Tenant Cluster with T ableau Visual Analytics
x
x
x
Multi-Tenant Cluster with
Collectors and Tableau
Visual Analytics
Supervisor
Node
x
x
x
x
Worker
Node
x
x
Collector
Node
x
x
NFS
Server
x
x
Report
Server
x
Visual
Analytics
Server
x
Description
This is the most basic single site multi-tenant deployment, primarily suitable for hosting providers. Organizations are created by splitting up the IP address space.
This is a service provider deployment covering multiple sites. Data collection is simplified by deploying a collector for the satellite sites. You can add organizations by assigning a collector to an organization, or by splitting up the IP address space.
This is a scalable service provider deployment suitable for deployments with large compute and storage needs. An NFS Server is required in the data sharing architecture between Supervisor and Worker nodes. Organi zations are created by splitting up the IP address space.
This deployment adds collectors to the configuration and is the most comprehensive service provider deployment. You can add organizations by assigning a collector to an organization, or by splitting up the IP address space.
This is the most basic single site multi-tenant deployment, with added capability for Visual Analytics with Tableau.
x
x
x
x
x
x
x
x
x
x
x
x
x
This is a service provider deployment covering multiple sites, with added capability for Visual Analytics with Tableau. Data collection is simplified by deploying a collector for the satellite sites.
This is a scalable service provider deployment ,with added capability for
Visual Analytics with Tableau. An NFS Server is required in the data sharing architecture between Supervisor and Worker nodes.
This deployment adds collectors to the configuration and is the most comprehensive service provider deployment, with added capability for
Visual Analytics with Tableau.
Page 100
FortiSIEM Installation Guide
Export Restrictions
AccelOps Export Control Classification Number is D5002.
Our Encryption Registration Number is available upon request.
Our product can not be exported, distributed, sold or used in: Cuba, Iran, Sudan, Syria and North Korea.
FortiSIEM Installation Guide
Page 101
FortiSIEM Installation Guide
Installing/Upgrading FortiSIEM
FortiSIEM Installation Guide
Page 102
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installation
Additional Information in the Help Center
You can find additional information about installation, upgrades, and license management for your AccelOps deployment in the Installati on, Upgrades, and Licenses section of the Help Center maintained by AccelOps Support.
The topics in this section are intended to guide you through the basic process of setting up and configuring your AccelOps deployment. This includes downloading and installing the AccelOps OVA image, using your hypervisor virtual machine manager to configure the hardware settings for your AccelOps node, setting up basic configurations on your Supervisor node, and registering your Supervisor and other nodes. Setting up IT infrastructure monitoring, including device discovery, monitoring configuration, setting up business services, is covered in under the section
Confi guring Your AccelOps Platform
.
What You Need to Know before You Begin Installation
What Kind of Deployment Will You Set Up?
Who Will Install and Configure AccelOps?
What Information Do You Need to Get Started?
The Basic Installation Process
What You Need to Know before You Begin Installation
What Kind of Deployment Will You Set Up?
Before beginning installation you should have determined the exact deployment configuration you will follow, as described in the topics under
a cluster deployment, or if want to use Visual Analytics, you will need to make sure that you have the necessary hardware and network components in place. We strongly recommend that you read through all the installation topics for your deployment configuration before you begin.
Who Will Install and Configure AccelOps?
These topics assume that you have the basic system administration skills required to install AccelOps, and that you are already familiar with the use of hypervisors such as VMware ESX or, if you are setting up a Cloud deployment, that you are already familiar with Cloud environments such as Amazon Web Services.
What Information Do You Need to Get Started?
You will need to have administrator-level permissions on the host where you will download and install AccelOps, and you will also need to have username and password associated with your AccelOps license. If you intend to use NFS storage for event data, you will also need to have set up an NFS server prior to installation.
The Basic Installation Process
The installation process for any AccelOps deployment consists of a few steps:
Import the AccelOps virtual appliance into a hypervisor or Amazon Web Services environment
Edit the virtual appliance hardware settings
Start and configure the virtual appliance from the hypervisor console
Register the virtual appliance
Topics in this section will take you through the specific installation and configuration instructions for the most popular hypervisors and deployment configurations.
System Performance Estimates and Recommendations for Large Scale Deployments
Browser Support and Hardware Requirements
Information Prerequisites for All FortiSIEM Installations
Installing in Amazon Web Services (AWS)
Determining the Storage Type for EventDB in AWS
Configuring Local Storage in AWS for EventDB
Setting Up Supervisor, Worker and Collector Nodes in AWS
Creating VPC-based Elastic IPs for Supervisor and Worker Nodes in AWS
Configuring the Supervisor and Worker Nodes in AWS
Page 103
FortiSIEM Installation Guide
Registering the Collector to the Supervisor in AWS
Setting up a Network Bridge for Installing AccelOps in KVM
Importing the Supervisor, Collector, or Worker Image into KVM
Configuring Supervisor Hardware Settings in KVM
Installing in Microsoft Hyper-V
Importing a Supervisor, Collector, or Worker Image into Microsoft Hyper-V
Setting the Network Time Protocol (NTP) for ESX
Installing a Supervisor, Worker, or Collector Node in ESX
Importing the Supervisor, Collector, or Worker Image into the ESX Server
Editing the Supervisor, Collector, or Worker Hardware Settings
Setting Local Storage for the Supervisor
Troubleshooting Tips for Supervisor Installations
Configuring the Supervisor, Worker, or Collector from the VM Console
Installing a Collector in Native Linux
Registering the Collector to the Supervisor
Using NFS Storage with AccelOps
Configuring NFS Storage for VMware ESX Server
Using NFS Storage with Amazon Web Services
Setting Up Snapshots of EBS Volumes that Host EventDB and CMDB in AWS
Moving CMDB to a separate Database Host
FortiSIEM Windows Agent and Agent Manager Install
FortiSIEM Windows Agent Pre-installation Notes
Installing FortiSIEM Windows Agent Manager
Installing FortiSIEM Windows Agent
FortiSIEM Installation Guide
Page 104
FortiSIEM Installation Guide FortiSIEM Installation Guide
System Performance Estimates and Recommendations for Large Scale Deployments
This topic includes estimates and recommendations for storage capacity, disk performance, and network throughput for optimum performance of
FortiSIEM deployments processing over 10,000 EPS.
In general, event ingestion at high EPS requires lower storage IOPS than for queries simply because queries need to scan higher volumes of data that has accumulated over time. For example, at 20,000 EPS, you have 86,400 times more data in a day than in one second, so a query such as
'Top Event types by count for the past 1 day' will need to scan 20,000 x 86,400 = ~ 1.72 billion events. Therefore, it is important to size your
FortiSIEM cluster to handle your query and report requirements first, which will also handle event ingestion very well. These are the top 3 things to do for acceptable FortiSIEM query performance:
1.
2.
3.
Add more worker nodes, higher than what is required for event ingestion alone
10Gbps network on NFS server is a must, and if feasible on Supervisor and Worker nodes as well
SSD Caching on NFS server - The size of the SSD should be as close to the size required to cache hot data. In typical customer scenarios, the last 1 month data can be considered hot data because monthly reports are quite commonly run
Schedule frequently run reports into the dashboard
If you have frequently run ranking reports that have group-by criteria (as opposed to raw message based reports), you can add such reports into a custom dashboard so that FortiSIEM schedules to run these reports in inline mode. Such reports compute their results in streaming manner as event data is processed in real-time. Such reports do not put any burden on the storage IOPS because they read very little data from the EventDB. Note that raw message reports (no group-by) are always computed directly from EventDB
An example scenario is presented at the end of this guide.
System
Performance
Component
Event Storage
Capacity
Root Disk
IOPS
CMDB Disk
IOPS
SVN Disk
IOPS
EventDB
IOPS for
Event
Ingestion
EventDB
Read IOPS for Queries
Estimates and Recommendations
Storage capacity estimates are based on an average event size of 64 compressed bytes x EPS (events per section).
Support and Hardware Requirements
includes a table with storage capacity requirements for up to 10,000 EPS.
Standard hard disk IOPS
1000 IOPS or more. Lab testing for EC2 scalability used 2000 IOPS.
1000 IOPS
1000 IOPS for 100K EPS (minimum)
As high as feasible to improve query performance (use SSD caching on NFS server when feasible). In EC2 scalability testing,
2000 read IOPS while ingesting 100K EPS using one supervisor and two workers produced these results:
Index Query – No filter, display COUNT(Matched Events), group-by event type for 24 hours
1.
2.
3.
Total Events processed = 2,594,816,711 (2.59 billion events)
Average events per second scanned by Query (QEPS) = 1.02 million QEPS
Average Query Runtime = 2543 seconds ( ~ 42 minutes )
Raw Event Log Query - Same as Index Query with filter Raw Event Log contains 'e'
1.
2.
3.
Total Events processed = 350,914,385 (350 million events)
Average events per second scanned by Query (QEPS) = 179,909 EPS (179k QEPS)
Average Query Runtime = 1950 seconds ( ~ 33 minutes )
Page 105
FortiSIEM Installation Guide FortiSIEM Installation Guide
Network
Throughput
Recommend 10Gbps network between Supervisor, Workers, and NFS server.
Using VMXNet3 Adapter for VMware
To achieve the best network throughput in VMware environments, delete the E1000 network adapter and add one that uses VMXNet3 for the eth0/eth1
network configuration. VMXNet3 adapter supports 10Gbps networking between VMs on the same host as well as across hosts, though you must also have a 10Gbps physical network adapter to achieve that level of throughput across hosts. You may need to upgrade the virtual hardware version ( VM
Ware KB 1003746 ) in order to have the ability to use VMXNet3. More details on different types of VMWare network adapters is available in VMWare KB 1001805
Achieving 10Gbps on AWS EC2
To achieve 10Gbps in the AWS EC2 environment, you will need to:
1. Deploy FortiSIEM Super, Workers, and NFS server on
8xlarge
class of instances (for example,
c3.8xlarge
). Refer to EC2 Instance Types for available types, and look for instance types with
10 Gigabit
noted next to
2. them.
You will need to use the HVM image for both the FortiSIEM image and NFS server image that supports enhanc
.
3. ed networking
Supervisor, Workers, and NFS Server must be placed under the same AWS EC2 placement group within an
AWS VPC.
Network
Interfaces
Number of
Workers
FortiSIEM recommends the use of separate network interfaces for event ingestion/GUI access and storage data to NFS
6000 EPS per worker for event ingestion. More worker nodes for query performance. See example below.
Example:
An MSP customer has 12,000 EPS across all their customers. Each event takes up 64 bytes on average in compressed form in the EventDB.
Storage and Query Performance Example
1 Year total events = 12000 * 86400 * 365 = 378.432 billion events
1 month total events = 12000 * 86400 * 365 = 31.536 billion events
1 Year Storage for 12,000 EPS = 12000 * 86400 * 365 * 64 bytes = 23TB
1 month Storage = ~ 2TB (SSD cache on NFS)
Run time for 'Top Event types by count for last 1 month' (@ 1 million
QEPS using 1 super + 2 workers) = 31536 seconds = 8.75 hours
Example run time for above query using 1 super + 20 workers = 1.25
hours*
* Assuming that read IOPS are not limited due to SSD cache for 1 month data
These calculations are just extrapolations based on a test on EC2. Actual results may vary from this because of differences in hardware, event data, types of queries. Therefore, it is recommended that customers do a pilot evaluation using production data either on-premise or on AWS before arriving at an exact number of worker nodes
Page 106
FortiSIEM Installation Guide FortiSIEM Installation Guide
Browser Support and Hardware Requirements
Supported Operating Systems and Browsers
Hardware Requirements for Supervisor and Worker Nodes
Hardware Requirements for Collector Nodes
Hardware Requirements for Report Server Nodes
Supported Operating Systems and Browsers
These are the browsers and operating systems that are supported for use with the FortiSIEM web client.
OS Supported Browsers Supported
Windows Firefox, Chrome, Internet Explorer 11.x, Microsoft Edge
Mac OS X
Linux
Firefox, Chrome, Safari
Firefox, Chrome
Hardware Requirements for Supervisor and Worker Nodes
The FortiSIEM Virtual Appliance can be installed using either storage configured within the ESX server or NFS storage. See the topic Configuring
NFS Server for more information on working with NFS storage.
Event Data Storage Requirements
The storage requirement shown in the
Event Data Storage
column is only for the eventdb
data, but the
/data
partition also includes
CMDB backups and queries. You should set the
/data
partition to a larger amount of storage to accommodate for this.
Encryption for Communication Between AccelOps Virtual Appliances
All communication between Collectors that are installed on-premises and FortiSIEM Supervisors and Workers is secured by TLS 1.2
encryption. Communications are managed by OpenSSL/Apache HTTP Server/mod_ssl on the Supervisor/Worker side, and libcurl, using the NSS library for SSL, on the Collector side.The FortiSIEM Supervisor/Workers use RSA certificate with 2048 bits as default.
You can control the exact ciphers used for communications between virtual appliances by editing the
SSLCipherSuite
section in the file
/etc/httpd/conf.d/ssl.conf on FortiSIEM Supervisors and Workers. You can test the ciphersuite for your Super or worker using the following nmap command: nmap --script ssl-cert,ssl-enum-ciphers -p 443 <super_or_worker_fqdn>
Overall EPS Quantity
1,500 1
4,500
Calculating Events per Second (EPS) and Exceeding the License Limit
AccelOps calculates the EPS for your system using a counter that records the total number of received events in a three minute time interval. Every second, a thread wakes up and checks the counter value. If the counter is less than 110% of the license limit (using the calculation 1.1 x EPS License x 180) , then AccelOps will continue to collect events. If you exceed 110% of your licensed EPS, events are dropped for the remainder of the three minute window, and an email notification is triggered. At the end of the three minute window the counter resets and resumes receiving events.
1
Host SW
ESXi (4.0 or later preferred)
ESXi (4.0 or later preferred)
Processor
4 Core 3 GHz, 64 bit
Memory
16 GB
24 GB
(4.5.1+)
4 Core 3 GHz, 64 bit 16 GB
24 GB
(4.5.1+)
OS/App and CMDB Storage
200GB (80GB OS/App, 60GB CMDB, 60G
B SVN )
Event Data Storage
(1 year)
3 TB
200GB (80GB OS/App, 60GB CMDB, 60G
B SVN )
8 TB
Page 107
FortiSIEM Installation Guide FortiSIEM Installation Guide
7,500
10,000
20,000
30,000
Higher than
30,000
1 Super
1 Worker
1 Super
1 Worker
1 Super
3 Workers
ESXi (4.0 or later preferred)
1 Super
5 Workers
ESXi (4.0 or later preferred)
Consult
FortiSIEM
ESXi (4.0 or later preferred)
ESXi (4.0 or later preferred)
Super: 8 Core 3
GHz, 64 bit
Worker: 4 Core 3
GHz, 64 bit
Super: 8 Core 3
GHz, 64 bit
Worker: 4 Core 3
GHz, 64 bit
Super: 8 Core 3
GHz, 64 bit
Worker: 4 Core 3
GHz, 64 bit
Super: 8 Core 3
GHz, 64 bit
Worker: 4 Core 3
GHz, 64 bit
Super: 24
GB
Worker:
16 GB
Super: 200GB (80GB OS/App, 60GB
CMDB, 60GB SVN )
Worker: 200GB (80GB OS/App)
Super: 24
GB
Worker:
16 GB
Super: 200GB (80GB OS/App, 60GB
CMDB, 60GB SVN )
Worker: 200GB (80GB OS/App)
Super: 24
GB
Worker:
16 GB
Super: 200GB (80GB OS/App, 60GB
CMDB, 60GB SVN )
Worker: 200GB (80GB OS/App)
Super: 24
GB
Worker:
16 GB
Super: 200GB (80GB OS/App, 60GB
CMDB, 60GB SVN )
Worker: 200GB (80GB OS/App)
12 TB
17 TB
34 TB
50 TB
Hardware Requirements for Collector Nodes
Component
Quantity Host SW
Collector 1 ESX
Collector 1 Native Linux
Suggested Platform: Dell PowerEdge R210 Rack Server
Processor Memory OS/App Storage
2 Core 2 GHz, 64 bit 4 GB 40 GB
2 Core, 64 bit 4GB 40 GB
Hardware Requirements for Report Server Nodes
Memory OS/App Storage
Component
Quantity Host
SW
Report
Server
1 ESX
Processor
8 Core 3
GHz, 64 bit
16 GB 200GB (80GB OS/App, 60GB
CMDB, 60GB SVN)
Reports Data Storage (1 year)
See recommendations under Hardware Requirements for
Supervisor and Worker nodes
Page 108
FortiSIEM Installation Guide FortiSIEM Installation Guide
Information Prerequisites for All FortiSIEM Installations
You should have this information ready before you begin installing the FortiSIEM virtual appliance on ESX:
1.
2.
The static IP address and subnet mask for your FortiSIEM virtual appliance.
The IP address of NFS mount point and NFS share name if using NFS storage. See the topics
Configuring NFS Storage for VMware
3.
4.
for more information.
The FortiSIEM host name within your local DNS server.
The VMWare ESX datastore location where the virtual appliance image will be stored if using ESX storage.
Proxy Server Authentication Not Supported
Proxy server authentication is not supported in this version of FortiSIEM. Turn off proxy server authentication or completely disable the proxy for your virtual appliance host.
Page 109
FortiSIEM Installation Guide FortiSIEM Installation Guide
Hypervisor Installations
Topics in this section cover the instructions for importing the AccelOps disk image into specific hypervisors and configuring the AccelOps virtual appliance. See the topics under General Installation for information on installation tasks that are common to all hypervisors.
Installing in Amazon Web Services (AWS)
Determining the Storage Type for EventDB in AWS
Configuring Local Storage in AWS for EventDB
Setting Up Supervisor, Worker and Collector Nodes in AWS
Creating VPC-based Elastic IPs for Supervisor and Worker Nodes in AWS
Configuring the Supervisor and Worker Nodes in AWS
Registering the Collector to the Supervisor in AWS
Setting up a Network Bridge for Installing AccelOps in KVM
Importing the Supervisor, Collector, or Worker Image into KVM
Configuring Supervisor Hardware Settings in KVM
Installing in Microsoft Hyper-V
Importing a Supervisor, Collector, or Worker Image into Microsoft Hyper-V
Setting the Network Time Protocol (NTP) for ESX
Installing a Supervisor, Worker, or Collector Node in ESX
Importing the Supervisor, Collector, or Worker Image into the ESX Server
Editing the Supervisor, Collector, or Worker Hardware Settings
Setting Local Storage for the Supervisor
Troubleshooting Tips for Supervisor Installations
Configuring the Supervisor, Worker, or Collector from the VM Console
Page 110
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installing in Amazon Web Services (AWS)
You Must Use an Amazon Virtual Public Cloud with AccelOps
You must set up a Virtual Public Cloud (VPC) in Amazon Web Services for FortiSIEM deployment rather than classic-EC2. FortiSIEM does not support installation in classic-EC2. See the Amazon VPC documentation for more information on setting up and configuring a
VPC. See
Creating VPC-based Elastic IPs for Supervisor and Worker Nodes in AWS
for information on how to prevent the public IPs of your instances from changing when they are stopped and started.
Using NFS Storage with Amazon Web Services
If the aggregate EPS for your FortiSIEM installation requires a cluster (an FortiSIEM virtual appliance + worker nodes), then you
must
set up an NFS server. If your storage requirements for the EventDB are more than 1TB, it is strongly recommended that you use an
NFS server where you can configure LVM+RAID0. For more information, see
Setting Up NFS Storage in AWS .
Determining the Storage Type for EventDB in AWS
Configuring Local Storage in AWS for EventDB
Setting Up Supervisor, Worker and Collector Nodes in AWS
Creating VPC-based Elastic IPs for Supervisor and Worker Nodes in AWS
Configuring the Supervisor and Worker Nodes in AWS
Registering the Collector to the Supervisor in AWS
Note: SVN password reset issue after system reboot for FortiSIEM 3.7.6 customers in AWS Virtual Private Cloud (VPC)
FortiSIEM uses SVN to store monitored device configurations. In AWS VPC setup, we have noticed that FortiSIEM SVN password gets changed if the system reboots - this prevents FortiSIEM from storing new configuration changes and viewing old configurations. The following procedure can be used to reset the SVN password to FortiSIEM factory default so that FortiSIEM can continue working correctly.
This script needs to be run only once.
1.
2.
3.
4.
5.
6.
7.
Logon to Super
Copy the attached “ao_svnpwd_reset.sh” script to Super on EC2+VPC deployment
Stop all backend processes before running script by issuing the following command:
phtools --stop all
Run following command to change script permissions:
"chmod +x ao_svnpwd_reset.sh"
Execute “ao_svnpwd_reset.sh” as root user: "./ao_svnpwd_reset.sh"
The system will reboot
Check SVN access to make sure that old configurations can be viewed.
Page 111
FortiSIEM Installation Guide FortiSIEM Installation Guide
Determining the Storage Type for EventDB in AWS
If the aggregate EPS for your FortiSIEM installation requires a cluster (a virtual appliance + Worker nodes), then you must set up an NFS server as described in
that you use an NFS server where you can configure LVM+RAID0, which is also described in those topics. Although it is possible to set up a similar LVM+RAID0 on the FortiSIEM virtual appliance itself, this has not been tested.
Here's an example of how to calculate storage requirements: At 5000 EPS, you can calculate daily storage requirements to be about 22-30GB
(300k events take roughly 15-20MB on average in compressed format stored in eventDB). So, in order to have 6 months of data available for querying, you need to have 4 - 6TB of storage.
If you only need one FortiSIEM node and your storage requirements are lower than 1TB, and is not expected to ever grow beyond this limit, you can avoid setting up an NFS server and use a local EBS volume for EventDB. For this option, see the topic
Configuring Local Storage in AWS for
.
Page 112
FortiSIEM Installation Guide
Configuring Local Storage in AWS for EventDB
Create the Local Storage Volume
Attach the Local Storage Volume to the Supervisor
Create the Local Storage Volume
1.
2.
3.
4.
Log in to AWS.
In the E2 dashboard, click
Volumes
.
5.
6.
Click
Set
Select the same
Availability Zone
Click
Create Volume
Size
to 100 GB to 1 TB (depending on storage requirement).
Create
.
.
region as the FortiSIEM Supervisor instance.
Attach the Local Storage Volume to the Supervisor
1.
2.
3.
4.
5.
In the EC2 dashboard, select the local storage volume.
In the Actions menu, select
For
For
Instance
Device
, enter
Click
Attach
.
Attach Volume
, enter the Supervisor ID.
/dev/xvdi.
.
FortiSIEM Installation Guide
Page 113
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up Supervisor, Worker and Collector Nodes in AWS
The basic process for installing an FortiSIEM Supervisor, Worker, or Collector node is the same. Since Worker nodes are only used in deployments that use NFS storage, you should first configure your Supervisor node to use NFS storage, and then configure your Worker node
information. Collector nodes are only used in multi-tenant deployments, and need to be registered with a running Supervisor node.
Creating VPC-based Elastic IPs for Supervisor and Worker Nodes in AWS
Configuring the Supervisor and Worker Nodes in AWS
Registering the Collector to the Supervisor in AWS
When you're finished with the specific hypervisor setup process, you need to complete your installation by following the steps described under
.
You Must Use an Amazon Virtual Public Cloud with AccelOps
You must set up a Virtual Public Cloud (VPC) in Amazon Web Services for FortiSIEM deployment rather than classic-EC2. FortiSIEM does not support installation in classic-EC2. See the Amazon VPC documentation for more information on setting up and configuring a
VPC. See
Creating VPC-based Elastic IPs for Supervisor and Worker Nodes in AWS
for information on how to prevent the public IPs of your instances from changing when they are stopped and started.
Using NFS Storage with Amazon Web Services
If the aggregate EPS for your FortiSIEM installation requires a cluster (an FortiSIEM virtual appliance + worker nodes), then you
must
set up an NFS server. If your storage requirements for the EventDB are more than 1TB, it is strongly recommended that you use an
NFS server where you can configure LVM+RAID0. For more information, see
Setting Up NFS Storage in AWS .
Page 114
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up AWS Instances
You Must Use an Amazon Virtual Public Cloud with AccelOps
You must set up a Virtual Public Cloud (VPC) in Amazon Web Services for FortiSIEM deployment rather than classic-EC2. FortiSIEM does not support installation in classic-EC2. See the Amazon VPC documentation for more information on setting up and configuring a
VPC. See
Creating VPC-based Elastic IPs for Supervisor and Worker Nodes in AWS
for information on how to prevent the public IPs of your instances from changing when they are stopped and started.
Using NFS Storage with Amazon Web Services
If the aggregate EPS for your FortiSIEM installation requires a cluster (an FortiSIEM virtual appliance + worker nodes), then you
must
set up an NFS server. If your storage requirements for the EventDB are more than 1TB, it is strongly recommended that you use an
NFS server where you can configure LVM+RAID0. For more information, see
Setting Up NFS Storage in AWS .
1.
2.
3.
4.
5.
Log in to your AWS account and navigate to the EC2 dashboard.
Click
Click
Launch Instance
.
Community AMIs
and search for the
Click
Select
.
Compute Optimized
.
AMI ID
associated with your version of FortiSIEM. The latest AMI IDs are on the image server where you download the other hypervisor images.
Click
Using C3 Instances
You should select one of the C3 instances with a
Network Performance
rating of
High
, or 10Gb performance. The current generation of C3 instances run on the latest Intel Xeons that AWS provides. If you are running these machines in production, it is significantly cheaper to use EC2 Reserved Instances (1 or 3 year) as opposed to on-demand instances.
6.
7.
Click : .
Review these configuration options:
Network and Subnet
Number of
Instances
Public IP
Placement
Group
EBS
Optimized
Instance
Select the VPC you set up for your instance.
For enterprise deployments, set to . For a configuration of 1 Supervisor + 2 Workers, set to . You can also add instances later to meet your needs.
1
Clear the option
Automatically assign a public IP address to your instances
if you want to use VPN.
A placement group is a logical grouping for your cluster instances. Placement groups have low latency, full-bisection
10Gbps bandwidth between instances. Select an existing group or create a new one.
An EBS optimized instance enables dedicated throughput between Amazon EBS and Amazon EC2, providing improved performance for your EBS volumes. Note that if you select this option, additional Amazon charges may apply.
8.
9.
Click
Next: Add Storage
.
For , , and
IOPS
, set options for your configuration.
Storage Configuration Options
In a configuration with three instances for 1 Supervisor + 2 Workers,
Volume Type
should be set to
Provisioned IOPS
, even though only the Supervisor node's CMDB data needs higher IOPS. For Workers,
Standard IOPS
is enough. You can also launch with Standard IOPS, and then add a separate EBS volume for CMDB separately with the higher Provisioned IOPS.
If you are using local storage for EventDB, click
Add New Volume
to create a new EBS volume, and set these options:
Device
Size
/dev/xvdi
50GB to 1TB, depending on storage requirement
Volume Type Provisioned IOPS
IOPS
2000
10.
11.
Click
Next: Tag Instance
.
Under
Value
, enter the
Name
you want to assign to all the instances you will launch, and then click
Create Tag
.
After you complete the launch process, you will have to rename each instance to correspond to its role in your configuration, such as
Page 115
FortiSIEM Installation Guide
11.
FortiSIEM Installation Guide
12.
13.
Supervisor, Worker1, Worker2.
Click
Next: Configure Security Group
Select
.
Select an Existing Security Group
, and then select the default security group for your VPC.
FortiSIEM needs access to HTTPS over port 443 for GUI and API access, and access to SSH over port 22 for remote management, which are set in the default security group. This group will allow traffic between all instances within the VPC.
Limiting IP Access
Make sure you have limited the IP addresses that can access your VPC, or that you have set up VPN access to it. VPN will block all inbound Internet traffic.
14.
15.
16.
Click
Review and Launch
.
Review all your instance configuration information, and then click
Launch
.
17.
18.
Select an existing or create a new
Key Pair
to connect to these instances via SSH.
If you use an existing key pair, make sure you have access to it. If you are creating a new key pair, download the private key and store it in a secure location accessible from the machine from where you usually connect to these AWS instances.
19.
Click
Launch Instances
.
When the EC2 Dashboard reloads, check that all your instances are up and running.
Name
you assigned in Step 11, select an instance to rename it according to its role
20.
All your instances will be tagged with the in your deployment.
For all types of instances, follow the instructions to SSH into the instances as described in
in AWS , and then run the script
phstatus.sh
to check the health of the instances.
Configuring the Supervisor and Worker Nodes
Page 116
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating VPC-based Elastic IPs for Supervisor and Worker Nodes in AWS
You need to create VPC-based Elastic IPs and attach them to your nodes so the public IPs don't change when you stop and start instances.
1.
2.
3.
4.
Log in to the Amazon VPC Console
In the navigation pane, click
.
Elastic IPs
.
5.
6.
Click
Allocate New Address
.
In the Allocate New Address dialog box, in the
Network platform
list, select
Yes, Associate
.
EC2-VPC
, and then click
Yes, Allocate
.
Select the Elastic IP address from the list, and then click
Associate Address
.
In the Associate Address dialog box, select the network interface for the NAT instance. Select the address to associate the EIP with from the Private IP address list, and then click
Page 117
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring the Supervisor and Worker Nodes in AWS
1.
2.
From the EC2 dashboard, select the instance, and then click
Connect
.
Select
Connect with a standalone SSH client
, and follow the instructions for connecting with an SSH client.
For the connection command, follow the example provided in the connection dialog, but substitute the FortiSIEM root user name for ec2user@xxxxxx
. The ec2-user .name is used only for Amazon Linux NFS server.
3.
4.
SSH to the Supervisor.
Run cd /opt/phoenix/deployment/jumpbox/aws.
5.
6.
Run the script
pre-deployment.sh to configure host name and NFS mount point.
7.
Accept the License Agreements.
Enter the
Host Name
.
Finding the Host Name
You can find the host name on the EC2 dashboard. Select the instance, right click, and then select
Connect with a standalone SSH client
. The host name will be listed under
Public DNS
.
8. Enter the
Mount Point
for your storage configuration.
NFS Storage
<NFS Server IP>:/data
For
<NFS Server IP>
, use the
10.0.0.X
IP address of the NFS Server running within the VPC
Local Storage
/dev/xvdi
9.
10.
11.
12.
13.
14.
15.
16.
The system will reboot.
Log in to the Supervisor.
Register the Supervisor by following steps
Run cd /opt/phoenix/deployment/jumpbox/aws.
Run the script deployment.sh (now includes running post-deployment.sh automatically).
The system will reboot and is now ready.
To install a worker node, follow steps 1-9 and the worker is ready
To add a Worker to the cluster (assume Worker is already installed) a. b. c. d.
Log in to the FortiSIEM GUI
Go to
Click
Add
Enter the
> private address
>
of the Worker Node
Page 118
FortiSIEM Installation Guide FortiSIEM Installation Guide
Registering the Collector to the Supervisor in AWS
1.
2.
3.
4.
Locate a Windows machine on AWS.
Open a Remote desktop session from your PC to that Windows machine on AWS.
Within the remote desktop session, launch a browser and navigate to https://<Collector-IP>:5480
Enter the Collector setup information.
Name
User ID
Collector Name
Admin User
Password
Admin Password
Cust/Org ID Organization Name
Cloud URL
Supervisor URL
5. Click
Save.
The Collector will restart automatically after registration succeeds.
Page 119
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installing in Linux KVM
The basic process for installing an FortiSIEM Supervisor, Worker, or Collector node in Linux KVM is the same as installing these nodes under
used in deployments that use NFS storage, you should first configure your Supervisor node to use NFS storage, and then configure your Worker node using the Supervisor NFS mount point as the mount point for the Worker. Collector nodes are only used in multi-tenant deployments, and need to be registered with a running Supervisor node.
Setting up a Network Bridge for Installing AccelOps in KVM
Importing the Supervisor, Collector, or Worker Image into KVM
Configuring Supervisor Hardware Settings in KVM
Page 120
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting up a Network Bridge for Installing AccelOps in KVM
If FortiSIEM is the first guest on KVM, then a bridge network may be required to enable network connectivity. For details see the KVM documentation provided by IBM .
In these instructions, br0
is the initial bridge network, network.
em1
is connected as a management network, and em4
is connected to your local area
1.
2.
In the KVM host, go to the directory
/etc/sysconfig/network-scripts/
.
Create a bridge network config file ifcfg-br0
.
DEVICE=br0
BOOTPROTO=none
NM_CONTROLLED=yes
ONBOOT=yes
TYPE=Bridge
NAME="System br0"
3. Edit network config file ifcfg-em4.
DEVICE=em4
BOOTPROTO=shared
NM_CONTROLLED=no
ONBOOT=yes
TYPE=Ethernet
UUID="24078f8d-67f1-41d5-8eea-xxxxxxxxxxxx"
IPV6INIT=no
USERCTL=no
DEFROUTE=yes
IPV4_FAILURE_FATAL=yes
NAME="System em4"
HWADDR=F0:4D:00:00:00:00
BRIDGE=br0
4. Restart the network service.
Page 121
FortiSIEM Installation Guide FortiSIEM Installation Guide
Importing the Supervisor, Collector, or Worker Image into KVM
1. Download and uncompress the FortiSIEM OVA package from the FortiSIEM image server to the location where you want to install the
2.
3.
4.
5.
6.
7.
8. image.
Start the KVM Virtual Machine Manager.
Select and right-click on a host to open the
Host Options
menu, and then select
New
.
In the
New VM
dialog, enter a
Select
Name
for your FortiSIEM node.
Import existing disk image
Browse to the location of OVA package and select it.
Choose the
Allocate
.
OS Type
and
Version
you want to use with this installation, and then click
Memory
and
CPUs
, and then click
Forward
to the FortiSIEM node as recommended in the topic
9. then click
Forward
.
Confirm the installation configuration of your node, and then click
Finish
.
Forward
.
Browser Support and Hardware Requirements
, and
Page 122
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring Supervisor Hardware Settings in KVM
5.
6.
7.
8.
1.
2.
3.
4.
In KVM Virtual Machine Manager, select the FortiSIEM Supervisor, and then click
Open
.
Click the
Information
icon to view the Supervisor hardware settings.
Select the
For
Virtual Network Interface
Source Device
.
, select an available bridge network.
See
Setting up a Network Bridge for Installing FortiSIEM in KVM for more information.
For
Device model
In the Supervisor
, select
Hypervisor default
, and then click
Hardware
settings, select
Apply
.
9.
In the
Click
Virtual Disk
dialog, open the
Add Hardware
Select the
Virtual Disk
.
Advanced options
, and for
Disk bus
, select
IDE
.
, and then select
Storage
.
Select managed or other existing storage
option, and then browse to the location for your storage.
10.
11.
You will want to set up a disk for both CMDB (60GB) and SVN (60GB). If you are setting up FortiSIEM Enterprise, you may also want to create a storage disk for EventDB, with
Storage format
set to
Raw
.
In the KVM Virtual Machine Manager, connect to the FortiSIEM Supervisor and power it on.
Follow the instructions in
Configuring the Supervisor, Worker, or Collector from the VM Console to complete the installation.
Related Links
Configuring the Supervisor, Worker, or Collector from the VM Console
Page 123
FortiSIEM Installation Guide
Installing in Microsoft Hyper-V
These topics describe how to install FortiSIEM on a Microsoft Hyper-V virtual server.
Importing a Supervisor, Collector, or Worker Image into Microsoft Hyper-V
Supported Versions
FortiSIEM has been tested to run on Hyper-V on Microsoft Windows 2012.
FortiSIEM Installation Guide
Page 124
FortiSIEM Installation Guide FortiSIEM Installation Guide
Importing a Supervisor, Collector, or Worker Image into Microsoft Hyper-V
Using Local or NFS Storage for EventDB in Hyper-V
Before you install an FortiSIEM virtual appliance in Hyper-V, you should decide whether you plan to use NFS storage or local storage to store event information in EventDB. If you decide to use a local disk, you can add a data disk of appropriate size. Typically, this will be named as /dev/sdd if it is the 4th disk. When using local disk, choose the type 'Dynamically expanding' (VHDX) format so that you are able to resize the disk if your EventDB will grow beyond the initial capacity.
If you are going to use NFS storage for EventDB, follow the instructions in the topic
Configuring NFS Storage for VMware ESX Server .
Disk Formats for Data Storage
FortiSIEM virtual appliances in Hyper-V use dynamically expanding VHD disks for the root and CMDB partitions, and a dynamically expanding VHDX disk for EventDB. Dynamically expanding disks are used to keep the exported Hyper-V image within reasonable limits. See the Microsoft documentation topic Performance Tuning Guidelines for Windows Server 2012 (or R2) for more information.
8.
9.
10.
11.
4.
5.
6.
7.
1. Download and uncompress the the FortiSIEM OVA package from the FortiSIEM image server to the location where you want to install the
2.
3. image.
Start Hyper-V Manager.
.
12.
In the
Action
menu, select
Import Virtual Machine
The
Import Virtual Machine Wizard
will launch.
Click
Next
.
Browse to the folder containing the OVA package, and then click
Next
.
Select the FortiSIEM image, and then click
For
Import Type
, select
In Hyper-V Manager, connect to the FortiSIEM virtual appliance and power it on.
Follow the instructions in
Next
.
Copy the virtual machine
, and then click
Finish
.
Next.
Select the storage folders for your virtual machine files, and then click
Next
.
Select the storage folder for your virtual machine's hard disks, and then click
Verify the installation configuration, and then click
Next
.
Configuring the Supervisor, Worker, or Collector from the VM Console to complete the installation.
Related Links
Configuring the Supervisor, Worker, or Collector from the VM Console
Page 125
FortiSIEM Installation Guide
Installing in VMware ESX
Setting the Network Time Protocol (NTP) for ESX
Installing a Supervisor, Worker, or Collector Node in ESX
Importing the Supervisor, Collector, or Worker Image into the ESX Server
Editing the Supervisor, Collector, or Worker Hardware Settings
Setting Local Storage for the Supervisor
Troubleshooting Tips for Supervisor Installations
Configuring the Supervisor, Worker, or Collector from the VM Console
FortiSIEM Installation Guide
Page 126
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting the Network Time Protocol (NTP) for ESX
It's important that your Virtual Appliance has the accurate time in order to correlate events from multiple devices within the environment.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
Log in to your VMWare ESX server.
Select your ESX host server.
Click the
Under Software, select Time Configuration.
Click
Properties
Select
Click
Options
Under
Under
Configuration
tab.
.
NTP Client Enabled
.
.
General
, select
NTP Setting
Start automatically
, click
.
Add...
.
Enter the IP address of the NTP servers to use.
Publicly Accessible NTP Server
If you don't have an internal NTP server, you can access a publicly available one at http://tf.nist.gov/tf-cgi/servers.cgi
11.
12.
Click
Restart NTP service
OK
.
Click to apply the changes.
Page 127
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installing a Supervisor, Worker, or Collector Node in ESX
The basic process for installing an FortiSIEM Supervisor, Worker, or Collector node is the same. Since Worker nodes are only used in deployments that use NFS storage, you should first configure your Supervisor node to use NFS storage, and then configure your Worker node
information. Collector nodes are only used in multi-tenant deployments, and need to be registered with a running Supervisor node.
Importing the Supervisor, Collector, or Worker Image into the ESX Server
Editing the Supervisor, Collector, or Worker Hardware Settings
Setting Local Storage for the Supervisor
Troubleshooting Tips for Supervisor Installations
When you're finished with the specific hypervisor setup process, you need to complete your installation by following the steps described under
.
Page 128
FortiSIEM Installation Guide FortiSIEM Installation Guide
Importing the Supervisor, Collector, or Worker Image into the ESX Server
5.
6.
7.
8.
1. Download and uncompress the FortiSIEM OVA package from the FortiSIEM image server to the location where you want to install the
2.
3.
4. image.
Log in to the VMware vSphere Client.
In the
File
menu, select
Browse
to the
.ova
Deploy OVF Template.
file (example:
FortiSIEM-VA-4.3.1.1145.ova
) and select it.
On the
OVF Details
page you will see the product and file size information.
9.
Click
Click
Next
Accept
Enter a
Select a
.
to accept the "End User Licensing Agreement," and then click
Name
for the Supervisor or Worker, and then click
Storage
Select a
Disk Format
, and then click
Next.
Next
location for the installed file, and then click
.
Next
.
Next
.
Disk Format Recommendation
FortiSIEM recommends using
Thick Provision Lazy Zeroed
.
10. Review the
Deployment Settings
, and then click
Finish
.
Do not turn off or reboot the system
Deployment will complete in 7 to 10 minutes. Do not turn off or reboot the system during this time.
11. When the deployment completes, click
Close
.
Running on VMWare ESX 6.0
If you are importing FortiSIEM VA, Collector, or Report Server images for VMWare on an ESXi 6.0 host, you will need to also "Upgrade
VM Compatibility" to ESXi 6.0. If the VM is already started, you need to shutdown the VM, and use the "Actions" menu to do this. Due to some incompatibility created by VMWare, our collector VM processes restarted and the collector could not register with the supervisor.
Similar problems are also likely to occur on supervisor, worker, or report server as well, so make sure their VM compatibilities are upgraded as well. More information about VM compatibility is available in the VMWare KB below: https://kb.
vmware.com/kb/1010675
Page 129
FortiSIEM Installation Guide FortiSIEM Installation Guide
Editing the Supervisor, Collector, or Worker Hardware Settings
Before you start the Supervisor, Worker, or Collector for the first time you need to make some changes to its hardware settings.
1.
2.
3.
In the VMware vSphere client, select the imported Supervisor, Worker, or Collector.
Right-click on the node to open the
Virtual Appliance Options
menu, and then select
Select the
Hardware
tab, and check that
Memory
is set to at least
16 GB
and
CPUs
Edit Settings... .
8
Memory Allocation for Large Deployments
For large deployments you should allocate at least 24GB of memory. See the topic information.
Hardware Requirements for more
Page 130
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Local Storage for the Supervisor
Using NFS Storage
You can install the Supervisor using either native ESX storage or NFS storage. These instructions are for creating native EXS storage.
the NFS server during Step 15 of the
Configuring the Supervisor, Worker, or Collector from the VM Console
process.
1.
2.
3.
4.
On
Hardware
tab, click
In the
Add Hardware
Add
.
dialog, select
Hard Disk
, and then click
Select
Create a new virtual disk
, and then click
Check that these selections are made in the
Next
.
Next
.
Create a Disk
dialog:
Disk Size
300GB
See the
Hardware Requirements for Supervisor and Worker Nodes
in the
Requirements topic for more specific disk size recommendations based on
Overall EPS
.
Thick Provision Lazy Zeroed
Disk
Provisioning
Location
Store to the Virtual Machine
5.
6.
In the
Advanced Options
dialog, make sure that the
Independent
option for
Mode
is not selected.
7.
Check all the options for creating the virtual disk, and then click
In the
Virtual Machine Properties
dialog, click
OK
.
The
Reconfigure virtual machine
task will launch.
Page 131
FortiSIEM Installation Guide FortiSIEM Installation Guide
Troubleshooting Tips for Supervisor Installations
Check the Supervisor System and Directory Level Permissions
Check the Supervisor System and Directory Level Permissions
Use SSH to connect to the Supervisor and check that the , , , and
[root@super ~]# ls -l / dr-xr-xr-x. 2 root root 4096 Oct 15 11:09 bin dr-xr-xr-x. 5 root root 1024 Oct 15 14:50 boot drwxr-xr-x 4 postgres postgres 4096 Nov 10 18:59 cmdb drwxr-xr-x 9 admin admin 4096 Nov 11 11:32 data drwxr-xr-x 15 root root 3560 Nov 10 11:11 dev
-rw-r--r-- 1 root root 34 Nov 11 12:09 dump.rdb
drwxr-xr-x. 93 root root 12288 Nov 11 12:12 etc drwxr-xr-x. 4 root root 4096 Nov 10 11:08 home dr-xr-xr-x. 11 root root 4096 Oct 15 11:13 lib dr-xr-xr-x. 9 root root 12288 Nov 10 19:13 lib64 drwx------. 2 root root 16384 Oct 15 14:46 lost+found drwxr-xr-x. 2 root root 4096 Sep 23 2011 media drwxr-xr-x. 2 root root 4096 Sep 23 2011 mnt drwxr-xr-x. 10 root root 4096 Nov 10 09:37 opt drwxr-xr-x 2 root root 4096 Nov 10 11:10 pbin dr-xr-xr-x 289 root root 0 Nov 10 11:13 proc drwxr-xr-x 8 admin admin 4096 Nov 11 00:37 query drwxr-xr-x 8 admin admin 4096 Nov 10 18:58 querywkr dr-xr-x---. 7 root root 4096 Nov 10 19:13 root dr-xr-xr-x. 2 root root 12288 Oct 15 11:08 sbin drwxr-xr-x. 2 root root 4096 Oct 15 14:47 selinux drwxr-xr-x. 2 root root 4096 Sep 23 2011 srv drwxr-xr-x 4 apache apache 4096 Nov 10 18:58 svn drwxr-xr-x 13 root root 0 Nov 10 11:13 sys drwxrwxrwt. 9 root root 4096 Nov 11 12:12 tmp drwxr-xr-x. 15 root root 4096 Oct 15 14:58 usr drwxr-xr-x. 21 root root 4096 Oct 15 11:01 var
Check that the
/data
,
/cmdb
, and
/svn directory level permissions match those in this table: svn
permissions match those in this table:
[root@super ~]# ls -l /data drwxr-xr-x 3 root root 4096 Nov 11 02:52 archive drwxr-xr-x 3 admin admin 4096 Nov 11 12:01 cache drwxr-xr-x 2 postgres postgres 4096 Nov 10 18:46 cmdb drwxr-xr-x 2 admin admin 4096 Nov 10 19:04 custParser drwxr-xr-x 5 admin admin 4096 Nov 11 00:29 eventdb drwxr-xr-x 2 admin admin 4096 Nov 10 19:04 jmxXml drwxr-xr-x 2 admin admin 4096 Nov 11 11:33 mibXml
[root@super ~]# ls -l /cmdb drwx------ 14 postgres postgres 4096 Nov 10 11:08 data
[root@super ~]# ls -l /svn drwxr-xr-x 6 apache apache 4096 Nov 10 18:58 repos
Check Backend System Health
Use SSH to connect to the supervisor and run phstatus
to see if the system status metrics match those in this table:
Page 132
FortiSIEM Installation Guide
[root@super ~]# phstatus
Every 1.0s: /opt/phoenix/bin/phstatus.py
System uptime: 12:37:58 up 17:24, 1 user, load average: 0.06, 0.01, 0.00
Tasks: 20 total, 0 running, 20 sleeping, 0 stopped, 0 zombie
Cpu(s): 8 cores, 0.6%us, 0.7%sy, 0.0%ni, 98.6%id, 0.0%wa, 0.0%hi, 0.1%si, 0.0%st
Mem: 16333720k total, 5466488k used, 10867232k free, 139660k buffers
Swap: 6291448k total, 0k used, 6291448k free, 1528488k cached
PROCESS UPTIME CPU% VIRT_MEM RES_MEM phParser 12:00:34 0 1788m 280m phQueryMaster 12:00:34 0 944m 63m phRuleMaster 12:00:34 0 596m 85m phRuleWorker 12:00:34 0 1256m 252m phQueryWorker 12:00:34 0 1273m 246m phDataManager 12:00:34 0 1505m 303m phDiscover 12:00:34 0 383m 32m phReportWorker 12:00:34 0 1322m 88m phReportMaster 12:00:34 0 435m 38m phIpIdentityWorker 12:00:34 0 907m 47m phIpIdentityMaster 12:00:34 0 373m 26m phAgentManager 12:00:34 0 881m 200m phCheckpoint 12:00:34 0 98m 23m phPerfMonitor 12:00:34 0 700m 40m phReportLoader 12:00:34 0 630m 233m phMonitor 31:21 0 1120m 25m
Apache 17:23:23 0 260m 11m
Node.js 17:20:54 0 656m 35m
AppSvr 17:23:16 0 8183m 1344m
DBSvr 17:23:34 0 448m 17m
FortiSIEM Installation Guide
Page 133
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring the Supervisor, Worker, or Collector from the VM Console
Do Not Press Control Keys
Do not press any control keys (for example again.
Control-C
or
Control-Z
) while configuring the virtual appliances in the VMware console, as this might cause the installation process to stop. If this happens you must erase the virtual appliance and start the installation process
1.
2.
3.
In the VMware vSphere client, select the Supervisor, Worker, or Collector virtual appliance
Right-click to open the
In the
Virtual Appliance Options
Virtual Appliance Options menu, select
menu, and then select
Open Console
.
Power > Power On
.
Network Failure Message
When the console starts up for the first time you may see a
Network eth0 Failed
message, but this is expected behavior.
4.
5.
6.
7.
In VM console, select
Set Timezone
and then press
Enter
.
Select your Location, and then press Enter.
8.
9.
Select your Country, and then press Enter.
Select your Timezone, and then press Enter.
Review your Timezone information, select , and then press
Enter
.
elect Login, and then press Enter.
10.
When the
Configuration
screen reloads, s
Enter the default login credentials .
1
Login
root
Password ProspectHills
11. Run the vami_config_net
script to configure the network.
/opt/vmware/share/vami/vami_config_net
12. When prompted, enter the the information for these network components to configure the Static IP address: IP Address, ,
(s).
Authenticated Proxy Server Not Supported
The authenticated proxy server is not supported in this version of FortiSIEM. Turn off proxy server authentication or completely disable the proxy for the ESX host.
13.
14.
15.
Y
Enter the
Host name,
and then press
Enter
.
For the Supervisor, set either the Local or NFS storage mount point.
For a Worker, use the same IP address of the NFS server you set for the Supervisor.
Supervisor Local storage
/dev/sdd
NFS storage
<NFS_Server_IP_Address>:/<Directory_Path>
After you set the mount point, the Supervisor will automatically reboot, and in 15 to 25 minutes the Supervisor will be successfully configured.
Page 134
FortiSIEM Installation Guide FortiSIEM Installation Guide
ISO Installation
These topics cover installation of FortiSIEM from an ISO under a native file system such as Linux, also known as installing "on bare metal."
Installing a Collector in Native Linux
Page 135
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installing a Collector in Native Linux
You can install Collectors on native Linux in a process that is similar to installing a Collector under Linux KVM. Be sure to read the section on
Har dware Requirements for Collectors
in Browser Support and Hardware Requirements
before starting the installation process.
1.
2.
3.
4.
Download the Linux collector ISO image from https://images.FortiSIEM.net/VMs/releases/CO/ .
Burn the ISO to a DVD so that you can boot from it to begin the setup.
Before you begin the installation, make sure the host where you want to install the Collector has an Internet connection.
Log into the server where you want to install the Collector as root
and make sure your boot DVD is loaded.
5. Go to
/etc/yum.repos.d
and make sure these configuration files are in the directory:
CentOS-Base.repo
CentOS-Debuginfo.repo
CentOS-Media.repo
CentOS-Vault.repo
6. As root
, run the update
command.
yum -y update
7. As root
, run the deployment
script.
/opt/phoenix/deployment/deployment.sh
8.
9.
The system will reboot itself when installation completes.
Follow the instructions in
Registering the Collector to the Supervisor to complete the Collector set up.
Installing in Dell PowerEdge R210 II
In the R210 II model of Dell PowerEdge, the net interface has been renamed to p1p1
and em1
, where in previous versions it was named eth0
. This can cause installation issues for your Collector. FortiSIEM recommends this workaround:
1. Find the script named either
/etc/sysconfig/network-scripts/ifcfg-p1p1
or
/etc/sysconfig/network-script s/ ifcfg-em1.
2.
3.
Rename the script to
/etc/sysconfig/network-scripts/ ifcfg-eth0.
In that script, edit
DEVICE=
to be
DEVICE=eth0
.
If you use the embedded NIC, the device name is em1
, and if another NIC is inserted, the device name will be p1p1
.
Page 136
FortiSIEM Installation Guide
General Installation
FortiSIEM Installation Guide
Page 137
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring Worker Settings
If you are using an FortiSIEM clustered deployment that includes both Workers and Collectors, you must define the nodes before you register any Collectors. When you register your Collectors, the Worker information will be retrieved and saved locally to the
Collector. The Collector will then upload event and configuration change information to the Worker.
Address
of your Worker
Worker Address in a Non-Clustered Environment
If you are not using an FortiSIEM clustered deployment, you will not have any Worker nodes. In that case, enter the IP address of the
Supervisor for the Worker Address, and your Collectors will upload their information directly to the Supervisor.
1.
2.
3.
Log in to your Supervisor node.
Go to
For
Admin > General Settings > System
Worker Address
.
, enter a comma-separated list of IP addresses or host names for the Workers.
The Collector will attempt to upload information to the the listed Workers, starting with the first Worker address and proceeding until it finds an available Worker.
Using a Load Balancer with Workers
You may also enter the Host Name or IP Address of a load balancer for the Worker Address, in which case the load balancer needs to be configured to send information to the Workers.
4. Click
Save
.
Page 138
FortiSIEM Installation Guide
Registering the Supervisor
1.
2.
3.
4.
In a Web browser, navigate to the Supervisor's IP address: https://<Supervisor IP>
Enter the login credentials associated with your FortiSIEM license, and then click
Register
.
When the
System is ready
message appears, click the
Enter the default login credentials.
Here
link to log in to FortiSIEM.
User ID
Password
admin admin*1
Cust/Org ID super
5. Go to
Admin > Cloud Health
and check that the Supervisor .
FortiSIEM Installation Guide
Page 139
FortiSIEM Installation Guide
Registering the Worker
1.
2.
3.
Go to
Admin > License Management > VA Information.
Click
Add,
enter the new Worker's IP address, and then click
OK
.
4.
When the new Worker is successfully added, click
OK
.
You will see the new Worker in the list of Virtual Appliances.
Go to
Admin > Cloud Health
and check that the Worker .
FortiSIEM Installation Guide
Page 140
FortiSIEM Installation Guide FortiSIEM Installation Guide
Registering the Collector to the Supervisor
The process for registering a Collector node with your Supervisor node depends on whether you are setting up the Collector as part of an enterprise or multi-tenant deployment. For a multi-tenant deployment,you must first create an organization and add Collectors to it before you register it with the Supervisor. For an enterprise deployment, you install the Collector within your IT infrastructure and then register it with the
Supervisor.
Create an Organization and Associate Collectors with it for Multi-Tenant Deployments
Register the Collector with the Supervisor for Enterprise Deployments
Create an Organization and Associate Collectors with it for Multi-Tenant Deployments
1.
2.
3.
4.
5.
6.
Log in to the Supervisor.
Go to
Admin > Setup Wizard > Organizations
.
Click
Enter
Add
Under
.
Collectors
, click
,
New
.
,
Enter the , ,
, and
Admin Email
.
, and
End Time
.
Unlimited Start and End Times
If you select
Unlimited
for Start Time and End Time, those fields will be greyed out for text entry.
7. Click Save.
8.
9.
The newly added organization and Collector should be listed on the
In a Web browser, navigate to https://<Collector-IP>:5480
.
Enter the Collector setup information.
Organizations
tab.
Name
User ID
Password
Collector Name
Organization Admin User
Organization Admin Password
Cust/Org ID Organization Name
Cloud URL
Supervisor URL
10.
11.
Click
Save.
The Collector will restart automatically after registration succeeds.
In the Supervisor interface, go to Admin > Collector Health and check that the Collector Health is Normal.
Register the Collector with the Supervisor for Enterprise Deployments
1.
2.
3.
Log in to the Supervisor.
Go to
Admin > License Management
. and check that Collectors are allowed by the license.
Go to
Setup Wizard > General Settings
and add at least the Supervisor's IP address.
4.
This should contain a list of the Supervisor and Worker accessible IP addresses or FQDNs.
Go to
Setup Wizard > Event Collector
and add the Collector information.
Setting
Name
Description
Will be used in step 6
Guaranteed EPS This is the number of Events per Second (EPS) that this Collector will be provisioned for
Start Time
Select
Unlimited
End Time Select
Unlimited
5. Connect to the Collector at https://
:<IP Address of the Collector>:5480.
6. Enter the
Name
from step 4.
7.
Userid
and
Password
are the same as the admin userid/password for the Supervisor.
8. The
IP address
is the IP address of the Supervisor.
9.
10.
For
Organization
, enter
Super
.
The Collector will reboot during the registration, and you will be able to see its status on the
Collector Health
page
.
Page 141
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using NFS Storage with AccelOps
When you install FortiSIEM, you have the option to use either local storage or NFS storage. For cluster deployments using Workers, the use of an
NFS Server is required for the Supervisor and Workers to communicate with each other. These topics describe how to set up and configure NFS servers for use with FortiSIEM.
Supported Versions
FortiSIEM only supports NFS Version 3.
Configuring NFS Storage for VMware ESX Server
Using NFS Storage with Amazon Web Services
Page 142
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring NFS Storage for VMware ESX Server
This topic describes the steps for installing an NFS server on CentOS Linux 6.x and higher for use with VMware ESX Server. If you are using an operating system other than CentOS Linux, follow your typical procedure for NFS server set up and configuration.
1. Login to CentOS 6.x as root
.
2. Download and Install the NFS packages.
yum install nfs-utils nfs-utils-lib
3. Run the NFS server startup scripts.
chkconfig nfs on service rpcbind start service nfs start
4. Check NFS service status and make sure the nfsd
service is running.
service nfs status
5. Create a new directory in the large volume to share with the FortiSIEM Supervisor and Worker nodes, and change the access permissions to provide FortiSIEM with access to the directory. mkdir /FortiSIEM chmod -R 777 /FortiSIEM
6. Edit the
/etc/exports
file to share the
/
FortiSIEM directory with the FortiSIEM Supervisor and Worker nodes.
vi /etc/exports /FortiSIEM
<Supervisor_IP_Address>(rw,sync,no_root_squash) /FortiSIEM
<Worker1_IP_Address>(rw,sync,no_root_squash) /FortiSIEM
<Worker2_IP_Address>(rw,sync,no_root_squash)
7. Save your changes to
/etc/exports
and restart the NFS server.
Page 143
7.
FortiSIEM Installation Guide FortiSIEM Installation Guide showmount -e localhost
Example:
Export list for localhost:
/FortiSIEM
<Supervisor_IP_Address>,<Worker1_IP_Address>,<Worker2_IP_Address>
8. Check shared directories.
service nfs restart
Related Links
Page 144
FortiSIEM Installation Guide
Using NFS Storage with Amazon Web Services
Setting Up Snapshots of EBS Volumes that Host EventDB and CMDB in AWS
FortiSIEM Installation Guide
Page 145
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up NFS Storage in AWS
Youtube Talk on NFS Architecture for AWS
Several architecture and partner options for setting up NFS storage that is highly available across availability zone failures are presented by an AWS Solutions Architect in this talk (40 min) and link to slides .
Using EBS Volumes
These instructions cover setting up EBS volumes for NFS storage. EBS volumes have a durability guarantee that is 10 times higher tha n traditional disk drives. This is because data in traditional disk drives is replicated within an availability zone for component failures
(RAID equivalent) , so adding another layer of RAID does not provide higher durability guarantees. EBS has an annual failure rate (AFR) of 0.1 to 0.5%. In order to have higher durability guarantees, it is necessary to take periodic snapshots of the volumes. Snapshots are stored in AWS S3, which has 99.999999999% durability (via synchronous replication of data across multiple data centers) and 99.99% availability. see the topic
Setting Up Snapshots of EBS Volumes that Host EventDB and CMDB in AWS for more information.
Using EC2 Reserved Instances for Production
If you are running these machines in production, it is significantly cheaper to use on-demand instances.
EC2 Reserved Instances (1 or 3 year) as opposed to
1.
2.
3.
Log in to your AWS account and navigate to the EC2 dashboard.
Click
Launch Instance
Select
.
HVM Amazon Linux AMI (HVM)
64-bit, and then click
Select
.
HVM v. PV
The reason to choose the HVM image over the default Paravirtualized (PV) image is that the HVM image automatically includes drivers to support enhanced networking per second), lower latency, and lower jitter.
, which uses SR-IOV for networking and provide higher performance (packets
4. Click
Compute Optimized
.
Using C3 Instances
You should select one of the C3 instances with a
Network Performance
rating of
High
, or 10Gb performance. The current generation of C3 instances run on the latest Intel Xeons that AWS provides. If you are running these machines in production, it is significantly cheaper to use EC2 Reserved Instances (1 or 3 year) as opposed to on-demand instances.
5.
6.
Click : .
Review these configuration options:
Select the VPC you set up for your instance.
Network and
Subnet
Public IP
Placement
Group
Shutdown
Behavior
Enable
Termination
Protection
EBS
Optimized
Instance
Clear the option
Stop
Automatically assign a public IP address to your instances
is selected.
if you want to use VPN.
A placement group is a logical grouping for your cluster instances. Placement groups have low latency, full-bisection
10Gbps bandwidth between instances. Select an existing group or create a new one.
Make sure
Make sure
An EBS optimized instance enables dedicated throughput between Amazon EBS and Amazon EC2, providing improved performance for your EBS volumes. Note that if you select this option, additional Amazon charges may apply.
Protect Against Accidental Termination
is selected.
7.
8.
Click
Next: Add Storage
.
Add EBS volumes up to the capacity you need for EventDB storage.
EventDB Storage Calculation Example
At 5000 EPS, you can calculate daily storage requirements to amount to roughly 22-30GB (300k events are 15-20MB on
Page 146
8.
FortiSIEM Installation Guide FortiSIEM Installation Guide average in compressed format stored in EventDB). In order to have 6 months of data available for querying, you need to have
4-6TB of storage. On AWS, the maximum EBS volume is sized at 1TB. In order to have larger disks, you need to create software RAID-0 volumes. You can attach, at most 8 volumes to an instance, which results in 8TB with RAID-0. There's no advantage in using a different RAID configuration other than RAID-0, because it does not increase durability guarantees. In order to ensure much better durability guarantees, plan on performing regular snapshots which store the data in S3 as described in
these volumes, the aggregate IOPS you get will be the sum of the IOPS on individual volumes.
9.
10.
11.
12.
Click
Next: Tag Instance
.
Under
Value
, enter the
Name
you want to assign to all the instances you will launch, and then click
After you complete the launch process, you will have to rename each instance to correspond to its role in your configuration, such as
Supervisor, Worker1, Worker2.
Click
Next: Configure Security Group
Select
.
Select an Existing Security Group
, and then select the default security group for your VPC.
Create Tag
.
FortiSIEM needs access to HTTPS over port 443 for GUI and API access, and access to SSH over port 22 for remote management, which are set in the default security group. This group will allow traffic between all instances within the VPC.
Limiting IP Access
Make sure you have limited the IP addresses that can access your VPC, or that you have set up VPN access to it. VPN will block all inbound Internet traffic.
13.
14.
15.
16.
17.
18.
19.
20.
Click
Review and Launch
.
Review all your instance configuration information, and then click
Select an existing or create a new
Key Pair
to connect to these instances via SSH.
If you use an existing key pair, make sure you have access to it. If you are creating a new key pair, download the private key and store it in a secure location accessible from the machine from where you usually connect to these AWS instances.
Click
Launch Instances
.
Launch
.
When the EC2 Dashboard reloads, check that all your instances are up and running.
Select the NFS server instance and click
Connect
.
Follow the instructions to SSH into the volumes as described in
Configuring the Supervisor and Worker Nodes in AWS
Configure the NFS mount point access to give the FortiSIEM internal IP full access.
# Update the OS and libraries with the latest patches
$ sudo yum update -y
$ sudo yum install -y nfs-utils nfs-utils-lib lvm2
$ sudo su -
# echo Y | mdadm --verbose --create /dev/md0 --level=0--chunk=256--raid-devices=4/dev/sdf /dev/sdg /dev/sdh /dev/sdi
# mdadm --detail --scan > /etc/mdadm.conf
# cat /etc/mdadm.conf
# dd if=/dev/zero of=/dev/md0 bs=512count=1
# pvcreate /dev/md0
# vgcreate VolGroupData /dev/md0
# lvcreate -l 100%vg -n LogVolDataMd0 VolGroupData
# mkfs.ext4 -j /dev/VolGroupData/LogVolDataMd0
# echo "/dev/VolGroupData/LogVolDataMd0 /data ext4 defaults 1 1">> /etc/fstab
# mkdir /data
# mount /data
# df -kh
# vi /etc/exports
/data 10.0.0.0/24(rw,no_root_squash)
# exportfs -ar
# chkconfig --levels 2345nfs on
# chkconfig --levels 2345rpcbind on
# service rpcbind start
Starting rpcbind: [ OK ]
# service nfs start
Starting NFS services: [ OK ]
Starting NFS mountd: [ OK ]
Stopping RPC idmapd: [ OK ]
Starting RPC idmapd: [ OK ]
Starting NFS daemon: [ OK ]
Page 147
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up Snapshots of EBS Volumes that Host EventDB and CMDB in AWS
In order to have high durability guarantees for FortiSIEM data, you should periodically create EBS snapshots on an hourly, daily, or weekly basis and store them in S3. The EventDB is typically hosted as a RAID-0 volume of several EBS volumes, as described in
. In order to reliably snapshot these EBS volumes together, you can use a script, ec2-consistent-snapshot volumes and create a snapshot. You an then use a second script, ec2-expire-snapshots
, to briefly freeze the
, to schedule cron jobs to delete old snapshots that are no longer needed. CMDB is hosted on a much smaller EBS volume, and you can also use the same scripts to take snapshots of it.
You can find details of how download these scripts and set up periodic snapshots and expiration in this blog post: http://twigmon.blogspot.com/2013/09/installing-ec2-consistent-snapshot.html
You can download the scripts from these from these Github projects: https://github.com/alestic/ec2-consistent-snapshot https://github.com/alestic/ec2-expire-snapshots
Page 148
FortiSIEM Installation Guide FortiSIEM Installation Guide
Moving CMDB to a separate Database Host
It is desirable to move the CMDB (postgres) database to a separate host for the following reasons:
1.
In larger deployments, reduce the database server load on the supervisor node in order to allow more resources for application server
2.
and other backend modules
Whenever high availability for CMDB data is desired, it is easier and cleaner to set up separate hosts with postgres replication that are managed separately than do this on the embedded postgres on the supervisor. This is especially true in AWS environment where AWS
Postgresql Relational Database Service (RDS) is just a few clicks to set up a DB instance that replicates across availability zones and automatically does failover
Freshly Installed Supervisor
1.
Install separate Postgresql DB servers or AWS RDS instance in Multi-AZ mode. Use Postgresql version 9.1 or greater. I'll use the RDS example in the remaining steps. For instance, let's say the hostname of RDS in us-west-2 region is
2.
3.
4.
5.
6.
7.
8.
9.
10. phoenixdb.XXXXXX.us-west-2.rds.amazonaws.com on port 5432 with username 'phoenix', DB name 'phoenixdb' and password
'YYYYYYYY'. You will need to allow super and worker nodes to be able to connect to port 5432 on the RDS service. You will have to change security groups to allow this
Make sure the above RDS host is reachable from FortiSIEM supervisor
Install FortiSIEM supervisor node and configure it as usual including adding a license
Stop all the running services so that CMDB will not be modified further
Dump the CMDB data in the local postgres DB into a local file
Import schema/data into the external postgres.
Change phoenix_config.txt to add DB_SERVER_* info
Change glassfish application server's domain.xml to point to the external CMDB server
Change phoenix_config.txt to remove checking for postgres process
Disable postgres from starting up
The exact steps are given below
Stopping services and moving CMDB data
# service crond stop
# Wait for phwatchdog to stop phxctl stop
# Wait for all processes to stop su - postgres pg_dump -U phoenix phoenixdb > phoenixdb-dump.sql
psql -U phoenix -h phoenixdb.XXXXXX.us-west-2.rds.amazonaws.com -p 5432
-f phoenixdb-dump.sql
# Type the password YYYYYYYY
# Ignore some minor errors such as it will not impact the product from operating correctly
REVOKE psql:phoenixdbdump.sql:1017727: ERROR: role "postgres" does not exist psql:phoenixdbdump.sql:1017728: ERROR: role "postgres" does not exist
GRANT
Page 149
FortiSIEM Installation Guide FortiSIEM Installation Guide
Edit phoenix_config.txt
vi /opt/phoenix/config/phoenix_config.txt
# change system_services in the phMonitorSupervisor section to remove psql. The original line is below which should be modified to the next line
#system_services=<system type="phMonitorSupervisor"><service><name>httpd</name><method>phshell 0 head
/etc/httpd/run/httpd.pid</method></service><service><name>glassfish</nam e><method>ps -ef | grep java | grep glassfish | grep -v pid | gawk
'{print $2}'</method></service><service><name>pgsql DB</name><method>ps
-ef | grep pgsql | grep postgres | grep -v pid | gawk '{print $2
}'</method></service></system>
#system_services=<system type="phMonitorSupervisor"><service><name>httpd</name><method>phshell 0 head
/etc/httpd/run/httpd.pid</method></service><service><name>glassfish</nam e><method>ps -ef | grep java | grep glassfish | grep -v pid | gawk
'{print $2}'</method></service></system>
# Add db_server_host and db_server_pwd
# db_server_host=phoenixdb.XXXXXX.us-west-2.rds.amazonaws.com
# db_server_pwd=YYYYYYYY
Edit glassfish domain.xml
vi /opt/glassfish/domains/domain1/config/domain.xml and change db host and pwd
# Under <jdbc-connection-pool> section, change these properties
# <property name="password" value="YYYYYYYY"></property>
# <property name="ServerName" value="phoenixdb.XXXXXX.us-west-2.rds.amazonaws.com"></property>
Page 150
FortiSIEM Installation Guide FortiSIEM Installation Guide
Turn off embedded postgres service
# Turn off postgres startup chkconfig postgresql-9.1 off
# Remove startdb from /etc/init.d/phProvision.sh
# echo "Starting Database server ...";
# /opt/phoenix/deployment/jumpbox/startdb; vi /etc/init.d/phProvision.sh
Production / Existing Supervisor
Performing these steps on an existing system may require an extended downtime of FortiSIEM services, so plan accordingly.
Make sure you have enough additional storage to dump the existing DB
1.
2.
3.
4.
5.
6.
Install and have the external postgres ready as described at the beginning of the previous section
Take point-in-time snapshots of supervisor to revert back if you hit any issue
Stop crond on super, and wait for phwatchdog to stop
Stop Apache on super and all workers so that collectors start buffering events
Shutdown the worker nodes while you move CMDB out
Follow the instructions from "Freshly Installed Supervisor" to complete the steps
Related articles
FortiSIEM Windows Agent and Agent Manager Install
Moving CMDB to a separate Database Host
Page 151
FortiSIEM Installation Guide FortiSIEM Installation Guide
FortiSIEM Windows Agent and Agent Manager Install
FortiSIEM can discover and collect performance metrics and logs from Windows Servers in an agent less fashion via WMI. However agents are needed when there is a need to collect richer data such as file integrity monitoring and from a large number of servers.
This section describes how to setup FortiSIEM Windows Agent and Agent Manager as part of FortiSIEM infrastructure.
Page 152
FortiSIEM Installation Guide FortiSIEM Installation Guide
FortiSIEM Windows Agent Pre-installation Notes
Hardware and Software Requirements
Communication Ports between Agent and Agent Manager
Licensing
When you purchase the Windows Agent Manager, you also purchase a set number of licenses that can be applied to the Windows devices you are monitoring. After you have set up and configured Windows Agent Manager, you can see the number of both Basic and Advanced licenses that are available and in use in your deployment by logging into your Supervisor node and going to will see an entry for
Basic Windows Licenses Allowed/Used
licenses have been applied by going to
and
Admin > Windows Agent Health
see the number of available and assigned licenses on the
Assign Licenses to Users
page.
Admin > License Management
Advanced Windows Licenses Allowed/Used
, where you
. You can see how these
. When you are logged into the Windows Agent Manager you can also
There are two types of licenses that you can associate with your Windows agent.
License
Type
None
Description
Advanced
Basic
An agent has been installed on the device, but no license is associated with it. This device will not be monitored until a license is applied to it.
The agent is licensed to monitor all activity on the device, including logs, installed software changes, and file/folder changes
The agent is licensed to monitor only logs on the device
When applying licenses to agents, keep in mind that
Advanced
and five of which are
Basic
Advanced
includes
Basic
, so if you have purchased a number of
, you could apply all 10 licenses to your devices as
Basic
.
Advanced
licenses, you could use all those licenses for the
Basic
purpose of monitoring logs.. For example, if you have purchased a total of 10 licenses, five of which are
Feature
Windows Security Logs
Windows Application Logs
Windows System Logs
Windows DNS Logs
Windows DHCP Logs
IIS logs
DFS logs
License Type
Basic
Basic
Basic
Basic
Basic
Basic
Basic
File Integrity Monitoring Advanced
Installed Software Change Monitoring Advanced
Registry Change Monitoring
Custom file monitoring
Advanced
Advanced
WMI output Monitoring
Power shell Output Monitoring
Advanced
Advanced
Page 153
FortiSIEM Installation Guide FortiSIEM Installation Guide
Hardware and Software Requirements
Windows Agents
Component
CPU
Hard Disk
Server OS
Desktop OS
RAM
Installed
Software
Windows OS
Language
Requirement
x86 or x64 (or compatible) at 2Ghz or higher
10 GB (minimum)
Windows XP-SP3 and above
(Recommended)
Windows 7/8
1 GB for XP
2+GB for Windows Vista & above
/ Windows Server
.NET Framework 4.0
PowerShell 2.0 or higher
Notes
Performance issues may occur due to limitations of desktop OS
.NET Framework 4.0 can be downloaded from h us/download/details.aspx?id=17718 ) ttp://www.microsoft.com/en-
You can download PowerShell from Microsoft at http://www.microsoft.com/e n-us/download/details.aspx?id=4045 .
English
Add Port 80 as an Exception to the Inbound Firewall Rule
If you are using a firewall, make sure to
add Port 80 and 443 as an exception to the inbound firewall rule.
Windows Agent Manager
Each Manager has been tested to handle up to 500 agents at an aggregate 7.5K events/sec.
Component Requirement
CPU
x86 or x64 (or compatible) at 2Ghz or higher
Hard Disk
Server OS
10 GB (minimum)
Windows Server 2008 and above (Strongly recommended)
Desktop OS Windows 7/8 (performance issues might occur)
RAM
For 32 bit OS, 2 GB for Windows 7 / 8 is a minimum
For 64 bit OS, 4 GB for Windows 7/8 and
Windows Server 2008 / 2012 is a minimum
Installed
Software
Windows
OS
Language
.NET Framework 4.5
SQL Server Express or SQL Server 2012 installed using “SQL Server
Authentication Mode”
Power Shell 2.0 or higher
IIS 7 or higherinstalled
IIS 7, 7.5: ASP .NET feature must be enabled from Application
Development Role Service of IIS
IIS 8.0+: ASP .NET 4.5 feature must be enabled from Application
Development Role Service of IIS
English
Notes
Performance issues may occur due to limitations of desktop OS
.NET Framework 4.5 can be downloaded from n-us/download/details.aspx?id=30653
Windows 8 and Windows Server 2012 http://www.microsoft.com/e
, and is already available on
You can download PowerShell from Microsoft at http://www.microsoft.com
/en-us/download/details.aspx?id=4045 .
SQL Server Express does not have any performance degradation compared to SQL Server 2012.
Page 154
FortiSIEM Installation Guide FortiSIEM Installation Guide
Supported versions
Windows Agent
Windows 7
Windows 8
Windows XP SP3 or above
Windows Server 2003 Server
Windows Server 2008
Windows Server 2008 R2
Windows Server 2012
Windows Server 2012 R2
Windows Agent Manager
Windows Server 2008
Windows Server 2008 R2
Windows Server 2012
Windows Server 2012 R2
Communication Ports between Agent and Agent Manager
TCP Port 443 (V1.1 on wards) and TCP Port 80 (V1.0) on Agent Manager for receiving events from Agents.
Ports 135, 137, 139, 445 needed for NetBIOS based communication
Page 155
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installing FortiSIEM Windows Agent Manager
Prerequisites
1. Make sure that the ports needed for communication between Windows Agent and Agent Manager are open and the two systems can
2. communicate
For versions 1.1 and higher, Agent and Agent Manager communicate via HTTPS. For this reason, there is a special pre-requisite: Get your
Common Name Subject Name
a. b. c. d. e. f.
Right click
Default Web Site
from IIS
Logon to Windows Agent Manager
Open IIS by going to Run, typing
inetmgr
and pressing enter
Go to
Default Web Site
in the left pane
and select
Edit Bindings
.
In
Site Bindings
dialog, check if you have
https
under
Type
column
If
https
is available, then i. ii. iii.
Select column corresponding to
In
https
Edit Site Binding
dialog, under
and click on
Edit
SSL certificate
section, click on
tab, note the value of
View...
button.
3. If
https
a.
In
Certificate
dialog, under
General Issued to
is not available, then you need to bind the default web site with https.
. This is your
Common Name / Subject Name
Import a New certificate. This can be done in one of two ways i. Either create a Self Signed Certificate as follows ii.
1.
2.
3.
4.
5.
6.
In
Create Self-Signed Certificate
You will see your new certificate in the
Or, Import a
1.
2.
3.
4.
Open IIS by going to Run, typing
inetmgr
and pressing enter
In the left pane, select computer name
In the right pane, double click on
Server Certificates
In the
Server Certificate
section, click on
Create Self-Signed Certificate..
. from the right pane
dialog, specify a friendly name for the certificate and click
OK
Server Certificates
third party certificate from a certification authority.
list
5.
Buy the certificate (.pfx or .cer file)
Install the certificate file in your server
Import the certificate in IIS
Go to IIS. Select
If certificate is PFX File a. b.
In
Computer name
and in the right pane select
Server Certificates
Server Certificates
section, click on
Import Certificate
dialog, browse to pfx file and put it in Certificate file(.pfx) box
Ok
Import...
in right pane c.
In the
6. If certificate is CER File a. b. c.
In
Server Certificates
In the
section, click on
Complete Certificate Request...
in right pane
Complete Certificate Request
Ok
dialog, browse to CER file and put it in File name section
Enter the friendly name, click . Your certificate gets imported to IIS .
b. Bind your certificate to
Default Web Site
i. ii. iii. iv. v.
Open IIS by going to Run, typing
inetmgr
and pressing enter
Right click on
Default Web Site
and select
In Site Bindings... dialog, click on Add..
In
Edit Bindings...
Add Site Binding
dialog, select 'https' from
Type
drop down menu
The
Host name
is optional but if you want to put it, then it must be the same as the certificate's common name / Subject vi. vii. nam
e
Select your certificate from
SSL certificate:
drop down list c.
Click
OK.
Your certificate is now bound to the
Default Web Site
.
4. Enable TLS 1.2 for Windows Agent Manager 2.0 for operating with FortiSIEM Supervisor/Worker 4.6.3 and above. By default
SSL3 / TLS 1.0 is enabled in Windows Server 2008-R2. Hence, before proceeding with the server installation, please enable TLS 1.2
manually as follows.
a. b.
Start elevated Command Prompt (i.e., with administrative privilege)
Run the following commands sequentially as shown.
Page 156
4. b.
FortiSIEM Installation Guide FortiSIEM Installation Guide
REG ADD
"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANN
EL\Protocols\TLS 1.1\Client" /v DisabledByDefault /t REG_DWORD
/d 00000000
REG ADD
"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANN
EL\Protocols\TLS 1.1\Server" /v DisabledByDefault /t REG_DWORD
/d 00000000
REG ADD
"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANN
EL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD
/d 00000000
REG ADD
"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANN
EL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD
/d 00000000 c. Restart computer
Procedures
1. On the machine where you want to install the manager, launch either the FortiSIEMServer-x86.MSI (for 32-bit Windows) or FortiSIEMSer
2.
3.
4. ver-x64.MSI (for 64-bit Windows) installer.
In the
In the
Welcome dialog, click
Next
.
EULA
dialog, agree to the Terms and Conditions and then click
Next
.
Specify the destination path for the installation, and then click
Next
.
5.
By default the Windows Agent Manager will be installed at
C:\Program Files\FortiSIEM\Server
.
Specify the destination path to install the client agent installation files, and then click
Next
.
By default these files will be installed at
6. them. a. b.
C:\FortiSIEM\Agent
. The default location will be on the drive that has the most free storage space. This path will automatically become a shared location that you will access from the agent devices to install the agent software on
In the
Database Settings
dialog,
Select the database instance where metrics and logs from the Windows devices will be stored.
Select whether you want to use Windows authentication, otherwise provide the login credentials that are needed to access the
7.
8. c.
SQL Server instance where the database is located.
Enter the path where FortiSIEM Agent Manager database will be stored. By default it is C:\FortiSIEM\Data
Provide the path to the FortiSIEM Supervisor, Worker, or Collector that will receive information about your Windows devices. Click
dialog, enter username and password credentials that you will use to log in to the Windows Agent
Next
.
9.
In the
Administrator Settings
Manager.
Both your username and password should be at least six characters long.
(New in Release 1.1 for HTTPS communication between Agent and Agent Manager) Enter the / of the
10.
11.
12.
SSL certificate created in pre-requisite step 2
Click
Install
.
When the installation completes, click
Finish
.
You can now exit the installation process, or click
Close Set Up and Run FortiSIEM
to log into your FortiSIEM virtual appliance.
Page 157
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installing FortiSIEM Windows Agent
Prerequisites
1. Windows Agent and Agent Manager need to be able to communicate - agents need to access a path on the Agent Manager machine to
2. install the agent software.
Starting with Version 1.1, there is a special requirement if you want user information appended to file/directory change events.
Typically file/directory change events do not have information about the user who made the change. To get this information, you have to do the following steps. Without this step, File monitoring events will not have user information.
a. In
Workgroup Environment
i. ii. iii. iv. v. vi. vii. viii. ix.
Go to
Control Panel
Open
Administrative Tools
Double click on
Local Security Policy
Expand
Advanced Audit Policy
configuration in the left-pane
Under
events
:
Advanced Audit Policy
Under System Audit Policies – Local Group Policy Object, select
Object Access
Double-click on
Click
Apply
Audit File System
Audit File System Properties dialog opens. In this dialog, under
. Under this select both Success and Failure check boxes
and then
OK
b. In
Active Directory Domain Environment
agent computers as follows: i. ii. iii. iv. v. vi. vii. viii.
, expand
System Audit Policies Local Group Policy Object
in the right-pane
Policy
tab, select
Configure the following audit
: FortiSIEM Administrator can use Group Policies to propagate the above settings to the ix. x. xi. xii. xiii.
Go to
Control Panel
Open
Administrative Tools
Click on
Group Policy Management
In
Group Policy Management
Under
Under
Domains
, expand
dialog, expand
Forest:<domain_name>
in the left-pane
Forest:<domain_name>
, expand
Domains
<domain_name>
Right-click on
<domain_name>
and click on '
Create a GPO in this domain, and link it here...
“
New GPO dialog appears. Enter a new name (e.g.,
MyGPO
) in
Name
text box. Press
OK.
MyGPO appears under the expanded <domain_name> in left-pane. Click on right-pane.
Under
Scope
tab, click on
MyGPO
and click on the Scope tab in the
Select
Add Security filtering
User, Computer or Group
section
dialog opens. In this dialog click the
Object Types dialog appears, uncheck all options and check the
Object Types
button.
Computers
option. Click
OK
.
Back in the
Select User, Computer or Group
dialog, enter the FortiSIEM Windows Agent computer names under
r the object name
to select area. You can choose computer names by clicking the Advanced' button and then in xiv.
Advanced dialog clicking on the
Ente
xv. xvi. xvii. xviii.
Find Now
button.
Once the required computer name is specified, click
OK
and you will find the selected computer name under
Security
Filtering
.
Repeat steps (xi) – (xiv) for all the required computers running FortiSIEM Windows Agent.
Right click on
Go to
MyGPO
in the left-pane and click on
Edit
.
Group Policy Management Editor opens. In this dialog, expand
> > >
Policies
under
Computer Configuration
>
.
Policies Windows Settings Security Settings Advanced Audit Policy Configuration Audit Policies >
xix.
Object Access > Audit File System.
In the
Audit File System Properties
dialog, under
Policy tab
select
Configure the following audit
events. Under this, select both
Success
and
Failure
check boxes.
Procedure
Installing one agent
1.
2.
3.
4.
Log into the machine where you want to install the agent software as an adminstrator.
Navigate to the shared location on the Windows Agent Manager machine where you installed the agent installation files in Step 5 of
Instal ling FortiSIEM Windows Agent Manager
The default path is
C:\FortiSIEM\Agent
In the shared location, double-click on the appropriate .MSI file to begin installation.
FortiSIEMAgent-x64.MSI
is for the 64-bit Agent, while
When the installation completes, go to a status of
Started
.
.
FortiSIEMAgent-x86.MSI for the 32-bit Agent
Start > Administrative Tools > Services
and make sure that the
FortiSIEM Agent Service
has
Installing multiple agents via Active Directory Group Policy
Multiple agents can be installed via GPO if all the computers are on the same domain.
1.
2.
Log on to Domain Controller
Create a separate Organization unit for containing all computers where FortiSIEM Windows Agent have to be installed.
a. b.
Go to > >
Right click on the root Domain on the left side tree. Click c.
Page 158
FortiSIEM Installation Guide
3.
4. c. d. c.
Provide a
Name
for the newly created Organizational Unit and click
Verify that the Organizational Unit has been created.
Assign computers to the new Organizational Unit.
a. b.
Click
Select a computer on the right pane. Right click and select
Click
Computers
OK.
Create a new GPO e. f. g. h. a. b. c. d.
Go to >
under the domain. The list of computers will be displayed on the right pane
Move
Under Domains, select the newly created
Organization Unit
Right click on the
Enter a
Under
Name
Organization Unit
>
and select
for the new GPO and click
Right click on the new GPO and click
Computer Configuration
Edit
, expand
OK
.
OK.
and then select the new Organizational Unit.
Create and Link a GPO here...
Verify that the new GPO is created under the chosen Organizational Unit
. Left tree now shows
Computer Configuration
i. j.
Click >
OK.
The selected MSI shows in the right pane under
Group Policy
OK.
Editor
window
and
User Configuration
Software Settings.
. Then go to AOWinAgt folder on the network folder. Select the Agent MSI you need - 32 bit or 64 bit. Click
5. Update the GPO on Domain Controller a. b.
6. Update GPO on Agents e.
For
Deploy Software
, select
Open a command prompt
Run
gpupdate /force
Log on to the computer
Open a command prompt
Run
gpupdate
Restart the computer
Assigned
and click a. b. c. d.
You will see FortiSIEM Windows Agent installed after restart
If you have a mix of 32 bit and 64 bit computers, need to have two separate Organizational Units - one for 32bit and one for 64bit, and then assign corresponding MSIs to each.
Page 159
FortiSIEM Installation Guide
Upgrade
Migrating from 3.7.x versions to 4.2.1
Migrating the SVN Repository to a Separate Partition on a Local Disk
Special pre-upgrade instruction for 4.3.3
Special pre-upgrade instruction for 4.6.1
Enabling TLS 1.2 Patch On Old Collectors
Upgrading to 4.6.3 for TLS 1.2
Setting Up the Image Server for Collector Upgrades
Upgrading a FortiSIEM Single Node Deployment
Upgrading a FortiSIEM Cluster Deployment
Upgrading FortiSIEM Windows Agent and Agent Manager
Automatic OS Upgrades during Reboot
FortiSIEM Installation Guide
Important Post-Upgrade Procedure
After an upgrade, please clear all browser cache before accessing FortiSIEM GUI. Otherwise, browser caching may prevent FortiSIEM
GUI from working correctly.
Page 160
FortiSIEM Installation Guide
Upgrade Overview
FortiSIEM Installation Guide
UPGRADE REQUIREMENT
Starting 4.5, Supervisor requires 24GB RAM. This is because Supervisor node is caching device monitoring status for faster performance.
Starting 4.6.1, Linux swap space is increased to match the physical memory size, as recommended by Linux best practices for optimal system performance. This size is automatically increased during 4.6.1 upgrade which may cause upgrade to take a little longer than normal.
AccelOps SNMP Configuration
If you enabled SNMP on FortiSIEM nodes (Collectors, Workers, Supervisors), it recommended that you modify the snmpd.local.conf file to store special configurations. You should not modify snmpd.conf file since FortiSIEM upgrade will wipe away the changes in snmpd.conf. To prevent changes from being lost, copy the changes to snmpd.local.conf file and then upgrade.
Upgrading from 3.7.6 to latest
1.
2.
3.
4.
5.
First upgrade to 4.2.1 following steps in
here . This involves OS migration
Upgrade from 4.2.1 to 4.3.1 following steps in
Upgrade from 4.3.1 to 4.5.2. This is a regular upgrade -
Upgrade from 4.5.2 to 4.6.3 following steps in
Upgrade from 4.6.3 to 4.7.1. This is a regular upgrade - single node case
and
multi-node case
This involves TLS 1.2 upgrade.
Upgrading from 4.2.x to latest
1.
2.
3.
4.
Upgrade to 4.3.1 following steps in here
. This involves SVN migration.
Upgrade from 4.3.1 to 4.5.2. This is a regular upgrade -
Upgrade from 4.5.2 to 4.6.3 following steps in
Upgrade from 4.6.3 to 4.7.1. This is a regular upgrade - single node case and
. This involves TLS 1.2 upgrade.
single node case and multi-node case multi-node case
Upgrading from 4.3.1 to latest
1.
2.
3.
Upgrade from 4.3.1 to 4.5.2. This is a regular upgrade -
Upgrade from 4.5.2 to 4.6.3 following steps in
Upgrade from 4.6.3 to 4.7.1. This is a regular upgrade - single node case single node case
and
and multi-node case
This involves TLS 1.2 upgrade.
multi-node case
Upgrading from 4.3.3 to latest
1.
2.
3.
4.
Do the special pre-upgrade step as in
Upgrade to 4.5.2. This is a regular upgrade - single node case
Upgrade from 4.5.2 to 4.6.3 following steps in
Upgrade from 4.6.3 to 4.7.1. This is a regular upgrade -
and multi-node case
This involves TLS 1.2 upgrade.
single node case and multi-node case
Page 161
FortiSIEM Installation Guide
Upgrading from 4.4.x, 4.5.1 to latest
1.
2.
3.
Upgrade to 4.5.2. This is a regular upgrade - single node case
Upgrade from 4.5.2 to 4.6.3 following steps in
This involves TLS 1.2 upgrade.
Upgrade from 4.6.3 to 4.7.1. This is a regular upgrade -
and multi-node case single node case and multi-node case
Upgrading from 4.5.2 to latest
1.
2.
Upgrade to 4.6.3 following steps in here.
This involves TLS 1.2 upgrade.
Upgrade from 4.6.3 to 4.7.1. This is a regular upgrade - single node case and multi-node case
Upgrading from 4.6.1 to latest
1.
2.
3.
Do the special pre-upgrade step as in
Upgrade to 4.6.3 following steps in here.
This involves TLS 1.2 upgrade.
Upgrade from 4.6.3 to 4.7.1. This is a regular upgrade - single node case and multi-node case
Upgrading from 4.6.2 to latest
1.
2.
Upgrade to 4.6.3 following steps in here.
This involves TLS 1.2 upgrade.
Upgrade from 4.6.3 to 4.7.1. This is a regular upgrade - single node case and multi-node case
Upgrading from 4.6.3 to latest
1. Upgrade to 4.7.1. This is a regular upgrade - single node case and multi-node case
Upgrading Windows Agents
FortiSIEM Windows Agent Upgrade is covered in Upgrading FortiSIEM Windows Agent and Agent Manager
FortiSIEM Installation Guide
Page 162
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating from 3.7.x versions to 4.2.1
The 4.2 version of FortiSIEM uses a new version of CentOS, and so upgrading to version 4.2 from previous versions involves a migration from those versions to 4.2.x, rather than a typical upgrade. This process involves two steps:
1.
2.
You have to migrate the 3.7.6 CMDB to a 4.2.1 CMDB on a 3.7.6 based system.
The migrated 4.2.1 CMDB has to be imported into a 4.2.1 system.
Topics in this section cover the migration process for supported hypervisors for both migrations in-place and using staging systems. Using a stagi ng system requires more hardware, but minimizes downtime and CMDB migration risk compared to the in-place method. If you decide to use the in-place method, we strongly recommend that you take snapshots for recovery.
Migrating Before Upgrading to 4.3.x
If you are running a 3.7.x version of FortiSIEM, you must first migrate from that version to version 4.2.1 before you can upgrade to version 4.3.x.
Migrating VMware ESX-based Deployments
Migrating an ESX Deployment with Local Storage in Place
Migrating an ESX Local Disk-based Deployment Using an rsync Tool
Migrating an ESX NFS-based Deployment in Place
Migrating an ESX NFS-based Deployment via a Staging System
Migrating an AWS EC2 Local Disk-based Deployment
Migrating an AWS EC2 NFS-based Deployment in Place
Migrating an AWS EC2 NFS-based Deployment via a Staging System
Migrating KVM-based deployments
Migrating a KVM Local Disc-based Deployment In Place
Migrating a KVM Local Disk-based Deployment using an RSYNC Tool
Migrating a KVM NFS-based Deployment In Place
Migrating a KVM NFS-based Deployment via a Staging System
Page 163
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating VMware ESX-based Deployments
The options for migrating VMware ESX deployments depend on whether you are using NFS for storage, and whether you choose to migrate in-place, or by using a staging system or rsync. Using the staging system requires more hardware, but minimizes downtime and CMDB migration risk compared to the in-place approach. The rsync method takes longer to complete because the event database has to be copied. If you use the i n-place method, then we strongly recommend that you take snapshots of the CDMB for recovery.
Internet access is needed for migration to succeed. A third party library needs to access the schema website.
<faces-config xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cdk="http://jboss.org/schema/richfaces/cdk/extensions" version="2.0" metadata-complete="false" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-facesconfig_2_0.xsd">
Migrating an ESX Deployment with Local Storage in Place
Migrating an ESX Local Disk-based Deployment Using an rsync Tool
Migrating an ESX NFS-based Deployment in Place
Migrating an ESX NFS-based Deployment via a Staging System
Page 164
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating an ESX Deployment with Local Storage in Place
Overview
This migration process is for an FortiSIEM deployment with a single virtual appliance and the CMDB data stored on a local VMware disk, and where you intend to run a 4.2.x version on the same physical machine as the 3.7.x version, but as a new virtual machine. This process requires these steps:
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
Registering Workers to the Supervisor
Prerequisites
Contact AccelOps Support to reset your license
Take a snapshot of your 3.7.x installation for recovery purposes if needed
Make sure the 3.7.x virtual appliance has Internet access
Download the 4.2.1 migration scripts (ao-db-migration-4.2.1.tar)
AccelOps license to access the scripts.
. You will need the Username and Password associated with your
Use More Storage for Your 4.2.1 Virtual Appliance
Install the 4.2.1 virtual appliance on the same host as the 3.7.x version with a local disk that is larger than the original 3.7.x version. You will need the extra disk space for copying operations during the migration.
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
1.
2.
3.
4.
Log in over SSH to your running 3.7.x virtual appliance as root.
Change the directory to
/root
.
Move or copy the migration script ao-db-migration-4.2.1.tar
to
/root
.
5.
6.
Untar the migration script.
Run ls -al to check that root
is the owner of the files ao-db-migration.sh
and ao-db-migration-archiver.sh
For each AccelOps Supervisor, Worker, or Collector node, stop all backend processes by running the phtools
.
command.
phtools --stop all
7. Run the archive script to create an archive version of the CMDB, and specify the directory where it should be created.
./ao-db-migration-archiver.sh /tmp/376_archive/
8. Check the that archive files phoenixdb_migration_*
and opt-migration-*.tar were successfully created in the destination
9. directory.
Copy the
Run the migration script on the 3.7.x CMDB archive you created in step 7.
The first argument is the location of the archived 3.7.x CMDB, and the second argument is the location where the migrated CMDB file will be kept. opt-migration-*.tar
file to
/root
.
10.
This contains various data files outside of CMDB that will be needed to restore the upgraded CMDB.
/root/ao-db-migration.sh /tmp/376_archive/cmdb-migration-xyz
/tmp/376_migration
11.
12.
Make sure the migrated files were successfully created.
Copy the migrated CMDB phoenixdb_migration_xyz
file to the
This file will be used during the CMDB restoration process.
/root
directory of your 4.2.1 virtual appliance
Page 165
FortiSIEM Installation Guide
12.
FortiSIEM Installation Guide
Removing the Local Disk from the 3.7.x Virtual Appliance
1.
2.
3.
4.
Log in to your vSphere client.
Select your 3.7.x virtual appliance and power it off.
Open the
Hardware
properties for your virtual appliance.
Select
Hard disk 3
, and then click
Remove
.
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
1.
2.
3.
Log in to your 4.2.1 virtual appliance as root.
Change the directory to
/opt/phoenix/deployment/.
Run the post-ao-db-migration.sh
script with the 3.7.x migration files phoenixdb_migration_xyz and opt-migration-*.ta
r.
./post-ao-db-migration.sh /root/phoenixdb_migration_xyz
/root/opt-migration-xyz.tar
4. When the migration script completes the virtual appliance will reboot.
Adding the Local Disk to the 4.2.1 Virtual Appliance
1. Log into your vSphere client.
2. Select your 4.2.1 virtual appliance and power it off.
3. Go the Hardware settings for your virtual appliance and select
Hard disk 3
.
4. Click Remove.
5. Click
Add.
6.
7.
8.
For Device Type, select Hard Disk, and then click Next.
Select Use an existing virtual disk, and then click Next.
9.
Browse to the location of the migrated virtual disk that was created by the migration script, and then click OK.
Power on the virtual appliance.
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
1. In the vSphere client, power off the 3.7.x Supervisor.
2.
3.
The IP Address for the 3.7.x Supervisor will be transferred to the 4.2.1 Supervisor.
Log in to the 3.7.x Supervisor as
Run the vami_config_net root
script.
over SSH.
Your virtual appliance will reboot when the IP address change is complete.
/opt/vmware/share/vami/vami_config_net
Registering Workers to the Supervisor
1.
2.
3.
4.
Log in to the Supervisor as admin.
Go to
Admin > License Management
.
Under
Under
VA Information
, click
Add
Admin > Collector Health
, and add the Worker.
and
Cloud Health
, check that the health of the virtual appliances is normal.
Setting the 4.2.1 SVN Password to the 3.7.x Password
1.
2.
3.
4.
Log in to the 4.2.1 Supervisor as root over SSH.
Change the directory to
/opt/phoenix/deployment/jumpbox
Run the SVN password reset script
./phsetsvnpwd.sh
Enter the following full admin credential to reset SVN password
.
Organization: Super
Page 166
FortiSIEM Installation Guide
User: admin
Password:****
Migration is now complete - Make sure all devices, user created rules, reports, dashboards are migrated successfully
Page 167
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating an ESX Local Disk-based Deployment Using an rsync Tool
Overview
This migration process is for an FortiSIEM deployment with a single virtual appliance and the CMDB data stored on a local VMware disk, and where you intend to run the 4.2.1 version on a different physical machine as the 3.7.x version. This process requires these steps:
Copy the 3.7.x CMDB to a 4.2.1 Virtual Appliance Using rsync
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
Registering Workers to the Supervisor
Prerequisites
Contact AccelOps Support to reset your license
Take a snapshot of your 3.7.x installation for recovery purposes if needed
Make sure the 3.7.x virtual appliance has Internet access
Download the 4.2.1 migration scripts (ao-db-migration-4.2.1.tar)
AccelOps license to access the scripts.
. You will need the Username and Password associated with your
Copy the 3.7.x CMDB to a 4.2.1 Virtual Appliance Using rsync
Installing rsynch
Before you can copy CMDB, you need to have rsync installed on the 3.7.x virtual appliance where you will be making the copy.
1.
2.
Log in to the 3.7.x Supervisor as root over SSH.
Copy
CentOS-Base.repo
to
/etc/yum.repos.d
.
cp /etc/yum.repos.d.orig/CentOS-Base.repo /etc/yum.repos.d
3. Install rsync yum repo
.
yum install rsync
1.
2.
3.
Log in to the 4.2.1 virtual appliance as root.
Check the disk size in the remote system to make sure that there is enough space for the database to be copied over.
Copy the directory
/data
from the 3.7.x virtual appliance to the 4.2.1 virtual appliance using the rsync tool.
rsync Command Syntax
/ rsync --progress -av root@<3.7.x_VA_ip_address>:/data/ /data/
4. After copying is complete, make sure that the size of the event database is identical to the 3.7.x system.
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
1.
2.
3.
4.
Log in over SSH to your running 3.7.x virtual appliance as root.
Change the directory to
/root
.
Move or copy the migration script
Untar the migration script.
ao-db-migration-4.2.1.tar
to
/root
.
5.
Page 168
FortiSIEM Installation Guide FortiSIEM Installation Guide
5.
6.
Run ls -al to check that root
is the owner of the files ao-db-migration.sh
and ao-db-migration-archiver.sh
For each AccelOps Supervisor, Worker, or Collector node, stop all backend processes by running the phtools
.
command.
phtools --stop all
7. Run the archive script to create an archive version of the CMDB, and specify the directory where it should be created.
./ao-db-migration-archiver.sh /tmp/376_archive/
8. Check the that archive files phoenixdb_migration_*
and opt-migration-*.tar were successfully created in the destination
9. directory.
Copy the
Run the migration script on the 3.7.x CMDB archive you created in step 7.
The first argument is the location of the archived 3.7.x CMDB, and the second argument is the location where the migrated CMDB file will be kept. opt-migration-*.tar
file to
/root
.
10.
This contains various data files outside of CMDB that will be needed to restore the upgraded CMDB.
/root/ao-db-migration.sh /tmp/376_archive/cmdb-migration-xyz
/tmp/376_migration
11.
12.
Make sure the migrated files were successfully created.
Copy the migrated CMDB phoenixdb_migration_xyz
file to the
This file will be used during the CMDB restoration process.
/root
directory of your 4.2.1 virtual appliance
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
1.
2.
3.
Log in to your 4.2.1 virtual appliance as root.
Change the directory to
/opt/phoenix/deployment/.
Run the post-ao-db-migration.sh
script with the 3.7.x migration files phoenixdb_migration_xyz and opt-migration-*.ta
r.
./post-ao-db-migration.sh /root/phoenixdb_migration_xyz
/root/opt-migration-xyz.tar
4. When the migration script completes the virtual appliance will reboot.
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
1. In the vSphere client, power off the 3.7.x Supervisor.
2.
3.
The IP Address for the 3.7.x Supervisor will be transferred to the 4.2.1 Supervisor.
Log in to the 3.7.x Supervisor as
Run the vami_config_net root
script.
over SSH.
Your virtual appliance will reboot when the IP address change is complete.
/opt/vmware/share/vami/vami_config_net
Registering Workers to the Supervisor
1. Log in to the Supervisor as admin.
2.
Page 169
FortiSIEM Installation Guide FortiSIEM Installation Guide
2.
3.
4.
Go to
Admin > License Management
.
Under
Under
VA Information
, click
Add
Admin > Collector Health
, and add the Worker.
and
Cloud Health
, check that the health of the virtual appliances is normal.
Setting the 4.2.1 SVN Password to the 3.7.x Password
1.
2.
3.
4.
Log in to the 4.2.1 Supervisor as root over SSH.
Change the directory to
/opt/phoenix/deployment/jumpbox
Run the SVN password reset script
./phsetsvnpwd.sh
Enter the following full admin credential to reset SVN password
.
Organization: Super
User: admin
Password:****
Migration is now complete - Make sure all devices, user created rules, reports, dashboards are migrated successfully
Page 170
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating an ESX NFS-based Deployment in Place
Overview
In this migration method, the production FortiSIEM systems are upgraded in-place, meaning that the production 3.7.x virtual appliance is stopped and used for migrating the CMDB to the 4.2.1 virtual appliance. The advantage of this approach is that no extra hardware is needed, while the disadvantage is extended downtime during the CMDB archive and upgrade process. During this downtime events are not lost but are buffered at the collector. However, incidents are not triggered while events are buffered. Prior to the CDMB upgrade process, you might want to take a snapshot of CMDB to use as a backup if needed.
The steps for this process are:
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
Mounting the NFS Storage on Supervisors and Workers
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
Registering Workers to the Supervisor
Prerequisites
Contact AccelOps Support to reset your license
Take a snapshot of your 3.7.x installation for recovery purposes if needed
Make sure the 3.7.x virtual appliance has Internet access
Download the 4.2.1 migration scripts (ao-db-migration-4.2.1.tar)
AccelOps license to access the scripts.
. You will need the Username and Password associated with your
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
1.
2.
3.
4.
Log in over SSH to your running 3.7.x virtual appliance as root.
Change the directory to
/root
.
Move or copy the migration script ao-db-migration-4.2.1.tar
to
/root
.
5.
6.
Untar the migration script.
Run ls -al to check that root
is the owner of the files ao-db-migration.sh
and ao-db-migration-archiver.sh
For each AccelOps Supervisor, Worker, or Collector node, stop all backend processes by running the phtools
.
command.
phtools --stop all
7. Run the archive script to create an archive version of the CMDB, and specify the directory where it should be created.
./ao-db-migration-archiver.sh /tmp/376_archive/
8. Check the that archive files phoenixdb_migration_*
and opt-migration-*.tar were successfully created in the destination
9. directory.
Copy the
Run the migration script on the 3.7.x CMDB archive you created in step 7.
The first argument is the location of the archived 3.7.x CMDB, and the second argument is the location where the migrated CMDB file will be kept. opt-migration-*.tar
file to
/root
.
10.
This contains various data files outside of CMDB that will be needed to restore the upgraded CMDB.
/root/ao-db-migration.sh /tmp/376_archive/cmdb-migration-xyz
/tmp/376_migration
11.
12.
Make sure the migrated files were successfully created.
Copy the migrated CMDB phoenixdb_migration_xyz
file to the
/root
directory of your 4.2.1 virtual appliance
Page 171
FortiSIEM Installation Guide
12.
This file will be used during the CMDB restoration process.
FortiSIEM Installation Guide
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
1.
2.
3.
Log in to your 4.2.1 virtual appliance as root.
Change the directory to
/opt/phoenix/deployment/.
Run the post-ao-db-migration.sh
script with the 3.7.x migration files phoenixdb_migration_xyz and opt-migration-*.ta
r.
./post-ao-db-migration.sh /root/phoenixdb_migration_xyz
/root/opt-migration-xyz.tar
4. When the migration script completes the virtual appliance will reboot.
Mounting the NFS Storage on Supervisors and Workers
Follow this process for each Supervisor and Worker in your deployment.
1.
2.
3.
Log in to your virtual appliance as root over SSH.
Run the mount
command to check the mount location.
Stop all AccelOps processes.
service crond stop phtools --stop all killall -9 phMonitor su - admin
/opt/glassfish/bin/asadmin stop-domain exit service postgresql-9.1 stop service httpd stop
4. Unmount 4.2.1 NFS storage location.
umount /data
5. Mount back to the 3.7.x NFS storage location.
Usage: mount -t nfs -o nfsvers=3 <NFS_Server_IP>:<Mount_Path>
/data ex: mount -t nfs -o nfsvers=3 192.168.67.168:/data/mig/SP61_376
/data
6. Verify mount location on the Supervisor or Workers.
Page 172
6.
FortiSIEM Installation Guide FortiSIEM Installation Guide
7. Change to the 3.7.x mount path location in the
/etc/fstab
file on the Supervisor or Workers.
8. Reboot the Supervisor or Worker.
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
1. In the vSphere client, power off the 3.7.x Supervisor.
2.
3.
The IP Address for the 3.7.x Supervisor will be transferred to the 4.2.1 Supervisor.
Log in to the 3.7.x Supervisor as
Run the vami_config_net root
script.
over SSH.
Your virtual appliance will reboot when the IP address change is complete.
/opt/vmware/share/vami/vami_config_net
Registering Workers to the Supervisor
1.
2.
3.
4.
Log in to the Supervisor as admin.
Go to
Admin > License Management
.
Under
Under
VA Information
, click
Add
Admin > Collector Health
, and add the Worker.
and
Cloud Health
, check that the health of the virtual appliances is normal.
Setting the 4.2.1 SVN Password to the 3.7.x Password
1.
2.
3.
4.
Log in to the 4.2.1 Supervisor as root over SSH.
Change the directory to
/opt/phoenix/deployment/jumpbox
Run the SVN password reset script
./phsetsvnpwd.sh
Enter the following full admin credential to reset SVN password
.
Organization: Super
User: admin
Password:****
Migration is now complete - Make sure all devices, user created rules, reports, dashboards are migrated successfully
Page 173
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 174
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating an ESX NFS-based Deployment via a Staging System
Overview
In this migration method, the production 3.7.x FortiSIEM systems are left untouched. A separate mirror image 3.7.x system is first created, and then upgraded to 4.2.1. The NFS storage is mounted to the upgraded 4.2.1 system, and the collectors are redirected to the upgraded 4.2.1
system. The upgraded 4.2.1 system now becomes the production system, while the old 3.7.6 system can be decommissioned. The collectors can then be upgraded one by one. The advantages of this method is minimal downtime in which incidents aren't triggered, and no upgrade risk. If for some reason the upgrade fails, it can be aborted without any risk to your production CMDB data. The disadvantages of this method are the requirement for hardware to set up the mirror 3.7.x mirror system, and longer time to complete the upgrade because of the time needed to set up the mirror system.
The steps in this process are:
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
Mounting the NFS Storage on Supervisors and Workers
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
Registering Workers to the Supervisor
Prerequisites
Contact AccelOps Support to reset your license
Take a snapshot of your 3.7.x installation for recovery purposes if needed
Make sure the 3.7.x virtual appliance has Internet access
Download the 4.2.1 migration scripts (ao-db-migration-4.2.1.tar)
AccelOps license to access the scripts.
. You will need the Username and Password associated with your
Create the 3.7.x CMDB Archive
1.
2.
3.
4.
Log in to your running 3.7.x production AccelOp virtual appliance as root.
Change the directory to
/root
.
Copy the migration script ao-db-migration-4.2.1.tar
to the
/root
directory.
5.
Untar the migration script.
Make sure that the owner of ao-db-migration.sh
and ao-db-migration-archiver.sh
files is root.
6. Run the archive script, specifying the directory where you want the archive file to be created.
./ao-db-migration-archiver.sh /tmp/376_archive/
7. Check that the archived files were successfully created in the destination directory.
8.
9.
You should see two files,
Copy the cmdb-migration-*.tar
cmdb-migration-*.tar
opt-migration-*.tar
, which will be used to migrate the 3.7.x CMDB, and
file to the 3.7.x staging Supervisor, using the same directory name you used in Step 6.
file to the /root directory of the 4.2.1 Supervisor.
opt-migration-*.tar
, which contains files stored outside of CMDM that will be needed to restore the upgraded CMDB to your new 4.2.1 virtual appliance.
Copy the
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
1.
2.
3.
Log in to your 4.2.1 virtual appliance as root.
Change the directory to
/opt/phoenix/deployment/.
Run the post-ao-db-migration.sh
script with the 3.7.x migration files phoenixdb_migration_xyz and opt-migration-*.ta
r.
./post-ao-db-migration.sh /root/phoenixdb_migration_xyz
/root/opt-migration-xyz.tar
4. When the migration script completes the virtual appliance will reboot.
Mounting the NFS Storage on Supervisors and Workers
Page 175
FortiSIEM Installation Guide
Follow this process for each Supervisor and Worker in your deployment.
1.
2.
3.
Log in to your virtual appliance as root over SSH.
Run the mount
command to check the mount location.
Stop all AccelOps processes.
service crond stop phtools --stop all killall -9 phMonitor su - admin
/opt/glassfish/bin/asadmin stop-domain exit service postgresql-9.1 stop service httpd stop
4. Unmount 4.2.1 NFS storage location.
FortiSIEM Installation Guide umount /data
5. Mount back to the 3.7.x NFS storage location.
Usage: mount -t nfs -o nfsvers=3 <NFS_Server_IP>:<Mount_Path>
/data ex: mount -t nfs -o nfsvers=3 192.168.67.168:/data/mig/SP61_376
/data
6. Verify mount location on the Supervisor or Workers.
7. Change to the 3.7.x mount path location in the
/etc/fstab
file on the Supervisor or Workers.
Page 176
7.
FortiSIEM Installation Guide FortiSIEM Installation Guide
8. Reboot the Supervisor or Worker.
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
1. In the vSphere client, power off the 3.7.x Supervisor.
2.
3.
The IP Address for the 3.7.x Supervisor will be transferred to the 4.2.1 Supervisor.
Log in to the 3.7.x Supervisor as
Run the vami_config_net root
script.
over SSH.
Your virtual appliance will reboot when the IP address change is complete.
/opt/vmware/share/vami/vami_config_net
Registering Workers to the Supervisor
1.
2.
3.
4.
Log in to the Supervisor as admin.
Go to
Admin > License Management
.
Under
Under
VA Information
, click
Add
Admin > Collector Health
, and add the Worker.
and
Cloud Health
, check that the health of the virtual appliances is normal.
Setting the 4.2.1 SVN Password to the 3.7.x Password
1.
2.
3.
4.
Log in to the 4.2.1 Supervisor as root over SSH.
Change the directory to
/opt/phoenix/deployment/jumpbox
Run the SVN password reset script
./phsetsvnpwd.sh
Enter the following full admin credential to reset SVN password
.
Organization: Super
User: admin
Password:****
Migration is now complete - Make sure all devices, user created rules, reports, dashboards are migrated successfully
Page 177
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating AWS EC2 Deployments
This section covers migrating FortiSIEM AWS EC2 based Virtual Appliances from 3.7.x to 4.2.1. Since FortiSIEM 4.2.1 has new CentOS version, the procedure is unlike a regular upgrade (say from 3.7.5 to 3.7.6) - certain special procedures have to be followed.
Very broadly, 3.7.6 CMDB have to be first migrated to a 4.2.1 CMDB on a 3.7.6 based system and then the migrated 4.2.1 CMDB has to be imported to a 4.2.1 system.
There are 4 choices based on
NFS or a single Virtual appliance based deployment
In-place or Staging based method is chosen for data migration
The various methods are explained later, but stated simply, staging approach take more hardware but minimizes downtime and CMDB migration risk compared to the in-place approach.
If in-place method is to be deployed, then a snapshot method is highly recommended for recovery purposes.
Note: Internet access is needed for migration to succeed. A third party library needs to access the schema website.
<faces-config xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cdk="http://jboss.org/schema/richfaces/cdk/extensions" version="2.0" metadata-complete="false" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-facesconfig_2_0.xsd">
Migrating an AWS EC2 Local Disk-based Deployment
Migrating an AWS EC2 NFS-based Deployment in Place
Migrating an AWS EC2 NFS-based Deployment via a Staging System
Page 178
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating an AWS EC2 Local Disk-based Deployment
Overview
This migration process is for an FortiSIEM deployment with a single virtual appliance and the CMDB data stored on a local AWS volume, and where you intend to run a 4.2.x version on the same physical machine as the 3.7.x version, but as a new virtual machine.
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
Change Local Volumes for Your AWS Instances
Change the IP Addresses Associated with Your Virtual Appliances
Registering Workers to the Supervisor
Setting the 4.2.1 SVN Password to the 3.7.x Password
Prerequisites
Contact AccelOps Support to reset your license
Take a snapshot of your 3.7.x installation for recovery purposes if needed
Make sure the 3.7.x virtual appliance has Internet access
Download the 4.2.1 migration scripts (ao-db-migration-4.2.1.tar)
AccelOps license to access the scripts.
. You will need the Username and Password associated with your
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
1.
2.
3.
4.
Log in over SSH to your running 3.7.x virtual appliance as root.
Change the directory to
/root
.
Move or copy the migration script ao-db-migration-4.2.1.tar
to
/root
.
5.
6.
Untar the migration script.
Run ls -al to check that root
is the owner of the files ao-db-migration.sh
and ao-db-migration-archiver.sh
For each AccelOps Supervisor, Worker, or Collector node, stop all backend processes by running the phtools
.
command.
phtools --stop all
7. Run the archive script to create an archive version of the CMDB, and specify the directory where it should be created.
./ao-db-migration-archiver.sh /tmp/376_archive/
8. Check the that archive files phoenixdb_migration_*
and opt-migration-*.tar were successfully created in the destination
9. directory.
Copy the
Run the migration script on the 3.7.x CMDB archive you created in step 7.
The first argument is the location of the archived 3.7.x CMDB, and the second argument is the location where the migrated CMDB file will be kept. opt-migration-*.tar
file to
/root
.
10.
This contains various data files outside of CMDB that will be needed to restore the upgraded CMDB.
/root/ao-db-migration.sh /tmp/376_archive/cmdb-migration-xyz
/tmp/376_migration
11.
12.
Make sure the migrated files were successfully created.
Copy the migrated CMDB phoenixdb_migration_xyz
file to the
This file will be used during the CMDB restoration process.
/root
directory of your 4.2.1 virtual appliance
Log in to the AWS EC2 dashboard and stop your 3.7.x virtual appliance.
Page 179
FortiSIEM Installation Guide FortiSIEM Installation Guide
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
1.
2.
3.
Log in to your 4.2.1 virtual appliance as root.
Change the directory to
/opt/phoenix/deployment/.
Run the post-ao-db-migration.sh
script with the 3.7.x migration files phoenixdb_migration_xyz and opt-migration-*.ta
r.
./post-ao-db-migration.sh /root/phoenixdb_migration_xyz
/root/opt-migration-xyz.tar
4. When the migration script completes the virtual appliance will reboot.
Change Local Volumes for Your AWS Instances
1.
2.
Log in to AWS EC2 dashboard and power off your 4.2.1 virtual appliance.
For instance,
3.7.x_data_volume
.
ID
3.
4.
5.
Detach the volume.
In the
Volumes
tab, find your 4.2.1 volume, and
Detach
Attach your 3.7.x volume to your 4.2.1 virtual appliance.
it.
4.2.1 Volume Device Name
Make sure the Device name for your 4.2.1 volume is dev/xvdf.
6.
7.
Power on your 4.2.1. virtual appliance.
Stop all back-end processes and change the SVN URL and Server IP address in database by running these commands.
phtools --stop all psql -U phoenix -d phoenixdb -c "update ph_sys_conf set value='https://<4.2.1-Private-IP-address>/repos/cmdb' where property='svn_url'" psql -U phoenix -d phoenixdb -c "update ph_sys_server set ip_addr='<4.2.1-Private-IP-address>' where id='1'"
Change the IP Addresses Associated with Your Virtual Appliances
1.
2.
3.
4.
Log in to the AWS EC2 dashboard.
Click
Click
Elastic IPS
5.
6.
In
, and then select the public IP associated with your 4.2.1 virtual appliance.
Disassociate Address
Elastic IPs
, and then
Yes, Disassociate
.
, select the IP address associated with your 3.7.x virtual appliance.
Click
Disassociate Address
, and then
Yes, Disassociate
.
In
Elastic IPs
, select the production public IP of your 3.7.x virtual appliance, and click virtual appliance.
The virtual appliance will reboot automatically after the IP address is changed.
Associate Address
to associate it with your 4.2.1
Registering Workers to the Supervisor
1.
2.
3.
4.
Log in to the Supervisor as admin.
Go to
Admin > License Management
.
Under
Under
VA Information
, click
Add
Admin > Collector Health
, and add the Worker.
and
Cloud Health
, check that the health of the virtual appliances is normal.
Setting the 4.2.1 SVN Password to the 3.7.x Password
1. Log in to the 4.2.1 Supervisor as root over SSH.
2.
Page 180
FortiSIEM Installation Guide FortiSIEM Installation Guide
2.
3.
4.
Change the directory to
/opt/phoenix/deployment/jumpbox
.
Run the SVN password reset script
./phsetsvnpwd.sh
Enter the following full admin credential to reset SVN password
Organization: Super
User: admin
Password:****
Migration is now complete - Make sure all devices, user created rules, reports, dashboards are migrated successfully
Page 181
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating an AWS EC2 NFS-based Deployment in Place
Overview
In this migration method, the production FortiSIEM systems are upgraded in-place, meaning that the production 3.7.x virtual appliance is stopped and used for migrating the CMDB to the 4.2.1 virtual appliance. The advantage of this approach is that no extra hardware is needed, while the disadvantage is extended downtime during the CMDB archive and upgrade process. During this downtime events are not lost but are buffered at the collector. However, incidents are not triggered while events are buffered. Prior to the CDMB upgrade process, you might want to take a snapshot of CMDB to use as a backup if needed.
The steps for this process are:
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
Mounting the NFS Storage on Supervisors and Workers
Change the SVN URL and Server IP Address
Change the IP Addresses Associated with Your Virtual Appliances
Registering Workers to the Supervisor
Setting the 4.2.1 SVN Password to the 3.7.x Password
Prerequisites
Contact AccelOps Support to reset your license
Take a snapshot of your 3.7.x installation for recovery purposes if needed
Make sure the 3.7.x virtual appliance has Internet access
Download the 4.2.1 migration scripts (ao-db-migration-4.2.1.tar)
AccelOps license to access the scripts.
. You will need the Username and Password associated with your
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
1.
2.
3.
4.
Log in over SSH to your running 3.7.x virtual appliance as root.
Change the directory to
/root
.
Move or copy the migration script ao-db-migration-4.2.1.tar
to
/root
.
5.
6.
Untar the migration script.
Run ls -al to check that root
is the owner of the files ao-db-migration.sh
and ao-db-migration-archiver.sh
For each AccelOps Supervisor, Worker, or Collector node, stop all backend processes by running the phtools
.
command.
phtools --stop all
7. Run the archive script to create an archive version of the CMDB, and specify the directory where it should be created.
./ao-db-migration-archiver.sh /tmp/376_archive/
8. Check the that archive files phoenixdb_migration_*
and opt-migration-*.tar were successfully created in the destination
9. directory.
Copy the
Run the migration script on the 3.7.x CMDB archive you created in step 7.
The first argument is the location of the archived 3.7.x CMDB, and the second argument is the location where the migrated CMDB file will be kept. opt-migration-*.tar
file to
/root
.
10.
This contains various data files outside of CMDB that will be needed to restore the upgraded CMDB.
/root/ao-db-migration.sh /tmp/376_archive/cmdb-migration-xyz
/tmp/376_migration
11.
Page 182
FortiSIEM Installation Guide FortiSIEM Installation Guide
11.
12.
Make sure the migrated files were successfully created.
Copy the migrated CMDB phoenixdb_migration_xyz
file to the
This file will be used during the CMDB restoration process.
/root
directory of your 4.2.1 virtual appliance
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
1.
2.
3.
Log in to your 4.2.1 virtual appliance as root.
Change the directory to
/opt/phoenix/deployment/.
Run the post-ao-db-migration.sh
script with the 3.7.x migration files phoenixdb_migration_xyz and opt-migration-*.ta
r.
./post-ao-db-migration.sh /root/phoenixdb_migration_xyz
/root/opt-migration-xyz.tar
4. When the migration script completes the virtual appliance will reboot.
Mounting the NFS Storage on Supervisors and Workers
Follow this process for each Supervisor and Worker in your deployment.
1.
2.
3.
Log in to your virtual appliance as root over SSH.
Run the mount
command to check the mount location.
Stop all AccelOps processes.
service crond stop phtools --stop all killall -9 phMonitor su - admin
/opt/glassfish/bin/asadmin stop-domain exit service postgresql-9.1 stop service httpd stop
4. Unmount 4.2.1 NFS storage location.
umount /data
5. Mount back to the 3.7.x NFS storage location.
Usage: mount -t nfs -o nfsvers=3 <NFS_Server_IP>:<Mount_Path>
/data ex: mount -t nfs -o nfsvers=3 192.168.67.168:/data/mig/SP61_376
/data
6. Verify mount location on the Supervisor or Workers.
Page 183
6.
FortiSIEM Installation Guide FortiSIEM Installation Guide
7. Change to the 3.7.x mount path location in the
/etc/fstab
file on the Supervisor or Workers.
8. Reboot the Supervisor or Worker.
Change the SVN URL and Server IP Address
Run these commands.
phtools --stop all psql -U phoenix -d phoenixdb -c "update ph_sys_conf set value='https://<4.2.1-Private-IP-address>/repos/cmdb' where property='svn_url'" psql -U phoenix -d phoenixdb -c "update ph_sys_server set ip_addr='<4.2.1-Private-IP-address>' where id='1'"
Change the IP Addresses Associated with Your Virtual Appliances
1.
2.
3.
4.
Log in to the AWS EC2 dashboard.
Click
Click
Elastic IPS
5.
6.
In
, and then select the public IP associated with your 4.2.1 virtual appliance.
Disassociate Address
Elastic IPs
, and then
Yes, Disassociate
.
, select the IP address associated with your 3.7.x virtual appliance.
Click
Disassociate Address
, and then
Yes, Disassociate
.
In
Elastic IPs
, select the production public IP of your 3.7.x virtual appliance, and click virtual appliance.
The virtual appliance will reboot automatically after the IP address is changed.
Associate Address
to associate it with your 4.2.1
Registering Workers to the Supervisor
1. Log in to the Supervisor as admin.
2.
Page 184
FortiSIEM Installation Guide FortiSIEM Installation Guide
2.
3.
4.
Go to
Admin > License Management
.
Under
Under
VA Information
, click
Add
Admin > Collector Health
, and add the Worker.
and
Cloud Health
, check that the health of the virtual appliances is normal.
Setting the 4.2.1 SVN Password to the 3.7.x Password
1.
2.
3.
4.
Log in to the 4.2.1 Supervisor as root over SSH.
Change the directory to
/opt/phoenix/deployment/jumpbox
Run the SVN password reset script
./phsetsvnpwd.sh
Enter the following full admin credential to reset SVN password
.
Organization: Super
User: admin
Password:****
Migration is now complete - Make sure all devices, user created rules, reports, dashboards are migrated successfully
Page 185
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating an AWS EC2 NFS-based Deployment via a Staging System
Overview
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
Mounting the NFS Storage on Supervisors and Workers
Change the IP Addresses Associated with Your Virtual Appliances
Registering Workers to the Supervisor
Setting the 4.2.1 SVN Password to the 3.7.x Password
In this migration method, the production 3.7.x FortiSIEM systems are left untouched. A separate mirror image 3.7.x system is first created, and then upgraded to 4.2.1. The NFS storage is mounted to the upgraded 4.2.1 system, and the collectors are redirected to the upgraded 4.2.1
system. The upgraded 4.2.1 system now becomes the production system, while the old 3.7.6 system can be decommissioned. The collectors can then be upgraded one by one. The advantages of this method is minimal downtime in which incidents aren't triggered, and no upgrade risk. If for some reason the upgrade fails, it can be aborted without any risk to your production CMDB data. The disadvantages of this method are the requirement for hardware to set up the mirror 3.7.x mirror system, and longer time to complete the upgrade because of the time needed to set up the mirror system.
Prerequisites
Contact AccelOps Support to reset your license
Take a snapshot of your 3.7.x installation for recovery purposes if needed
Make sure the 3.7.x virtual appliance has Internet access
Download the 4.2.1 migration scripts (ao-db-migration-4.2.1.tar)
AccelOps license to access the scripts.
. You will need the Username and Password associated with your
Create the 3.7.x CMDB Archive
1.
2.
3.
4.
Log in to your running 3.7.x production AccelOp virtual appliance as root.
Change the directory to
/root
.
Copy the migration script ao-db-migration-4.2.1.tar
to the
/root
directory.
5.
Untar the migration script.
Make sure that the owner of ao-db-migration.sh
and ao-db-migration-archiver.sh
files is root.
6. Run the archive script, specifying the directory where you want the archive file to be created.
./ao-db-migration-archiver.sh /tmp/376_archive/
7. Check that the archived files were successfully created in the destination directory.
8.
9.
You should see two files,
Copy the cmdb-migration-*.tar
cmdb-migration-*.tar
opt-migration-*.tar
, which will be used to migrate the 3.7.x CMDB, and
file to the 3.7.x staging Supervisor, using the same directory name you used in Step 6.
file to the /root directory of the 4.2.1 Supervisor.
opt-migration-*.tar
, which contains files stored outside of CMDM that will be needed to restore the upgraded CMDB to your new 4.2.1 virtual appliance.
Copy the
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
1.
2.
3.
Log in to your 4.2.1 virtual appliance as root.
Change the directory to
/opt/phoenix/deployment/.
Run the post-ao-db-migration.sh
script with the 3.7.x migration files phoenixdb_migration_xyz and opt-migration-*.ta
r.
./post-ao-db-migration.sh /root/phoenixdb_migration_xyz
/root/opt-migration-xyz.tar
4. When the migration script completes the virtual appliance will reboot.
Mounting the NFS Storage on Supervisors and Workers
Page 186
FortiSIEM Installation Guide
Follow this process for each Supervisor and Worker in your deployment.
1.
2.
3.
Log in to your virtual appliance as root over SSH.
Run the mount
command to check the mount location.
Stop all AccelOps processes.
service crond stop phtools --stop all killall -9 phMonitor su - admin
/opt/glassfish/bin/asadmin stop-domain exit service postgresql-9.1 stop service httpd stop
4. Unmount 4.2.1 NFS storage location.
FortiSIEM Installation Guide umount /data
5. Mount back to the 3.7.x NFS storage location.
Usage: mount -t nfs -o nfsvers=3 <NFS_Server_IP>:<Mount_Path>
/data ex: mount -t nfs -o nfsvers=3 192.168.67.168:/data/mig/SP61_376
/data
6. Verify mount location on the Supervisor or Workers.
7. Change to the 3.7.x mount path location in the
/etc/fstab
file on the Supervisor or Workers.
Page 187
7.
FortiSIEM Installation Guide FortiSIEM Installation Guide
8. Reboot the Supervisor or Worker.
Change the IP Addresses Associated with Your Virtual Appliances
1.
2.
3.
4.
Log in to the AWS EC2 dashboard.
Click
Click
Elastic IPS
5.
6.
In
, and then select the public IP associated with your 4.2.1 virtual appliance.
Disassociate Address
Elastic IPs
, and then
Yes, Disassociate
.
, select the IP address associated with your 3.7.x virtual appliance.
Click
Disassociate Address
, and then
Yes, Disassociate
.
In
Elastic IPs
, select the production public IP of your 3.7.x virtual appliance, and click virtual appliance.
The virtual appliance will reboot automatically after the IP address is changed.
Associate Address
to associate it with your 4.2.1
Registering Workers to the Supervisor
1.
2.
3.
4.
Log in to the Supervisor as admin.
Go to
Admin > License Management
.
Under
Under
VA Information
, click
Add
Admin > Collector Health
, and add the Worker.
and
Cloud Health
, check that the health of the virtual appliances is normal.
Setting the 4.2.1 SVN Password to the 3.7.x Password
1.
2.
3.
4.
Log in to the 4.2.1 Supervisor as root over SSH.
Change the directory to
/opt/phoenix/deployment/jumpbox
Run the SVN password reset script
./phsetsvnpwd.sh
Enter the following full admin credential to reset SVN password
.
Organization: Super
User: admin
Password:****
Migration is now complete - Make sure all devices, user created rules, reports, dashboards are migrated successfully
Page 188
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating KVM-based deployments
This section covers migrating FortiSIEM KVM based Virtual Appliances from 3.7.x to 4.2.1. Since FortiSIEM 4.2.1 has new CentOS version, the procedure is unlike a regular upgrade (say from 3.7.5 to 3.7.6) - certain special procedures have to be followed.
Very broadly, 3.7.6 CMDB have to be first migrated to a 4.2.1 CMDB on a 3.7.6 based system and then the migrated 4.2.1 CMDB has to be imported to a 4.2.1 system.
There are 4 choices based on
NFS or a single Virtual appliance based deployment
In-place or Staging or rsync based method is chosen for data migration
The various methods are explained later, but stated simply
Staging approach take more hardware but minimizes downtime and CMDB migration risk compared to the in-place approach rsync method takes longer to finish as event database has to be copied
If in-place method is to be deployed, then a snapshot method is highly recommended for recovery purposes.
Note: Internet access is needed for migration to succeed. A third party library needs to access the schema website.
<faces-config xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cdk="http://jboss.org/schema/richfaces/cdk/extensions" version="2.0" metadata-complete="false" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-facesconfig_2_0.xsd">
Page 189
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating a KVM Local Disc-based Deployment In Place
Overview
This migration process is for an FortiSIEM deployment with a single virtual appliance and the CMDB data stored on a local VMware disk, and where you intend to run a 4.2.x version on the same physical machine as the 3.7.x version, but as a new virtual machine. This process requires these steps:
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
Registering Workers to the Supervisor
Prerequisites
Contact AccelOps Support to reset your license
Take a snapshot of your 3.7.x installation for recovery purposes if needed
Make sure the 3.7.x virtual appliance has Internet access
Download the 4.2.1 migration scripts (ao-db-migration-4.2.1.tar)
AccelOps license to access the scripts.
. You will need the Username and Password associated with your
Use More Storage for Your 4.2.1 Virtual Appliance
Install the 4.2.1 virtual appliance on the same host as the 3.7.x version with a local disk that is larger than the original 3.7.x version. You will need the extra disk space for copying operations during the migration.
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
1.
2.
3.
4.
Log in over SSH to your running 3.7.x virtual appliance as root.
Change the directory to
/root
.
Move or copy the migration script ao-db-migration-4.2.1.tar
to
/root
.
5.
6.
Untar the migration script.
Run ls -al to check that root
is the owner of the files ao-db-migration.sh
and ao-db-migration-archiver.sh
For each AccelOps Supervisor, Worker, or Collector node, stop all backend processes by running the phtools
.
command.
phtools --stop all
7. Run the archive script to create an archive version of the CMDB, and specify the directory where it should be created.
./ao-db-migration-archiver.sh /tmp/376_archive/
8. Check the that archive files phoenixdb_migration_*
and opt-migration-*.tar were successfully created in the destination
9. directory.
Copy the
Run the migration script on the 3.7.x CMDB archive you created in step 7.
The first argument is the location of the archived 3.7.x CMDB, and the second argument is the location where the migrated CMDB file will be kept. opt-migration-*.tar
file to
/root
.
10.
This contains various data files outside of CMDB that will be needed to restore the upgraded CMDB.
/root/ao-db-migration.sh /tmp/376_archive/cmdb-migration-xyz
/tmp/376_migration
11.
12.
Make sure the migrated files were successfully created.
Copy the migrated CMDB phoenixdb_migration_xyz
file to the
This file will be used during the CMDB restoration process.
/root
directory of your 4.2.1 virtual appliance
Page 190
FortiSIEM Installation Guide
12.
FortiSIEM Installation Guide
Removing the Local Disk from the 3.7.x Virtual Appliance
1.
2.
3.
4.
Log in to your vSphere client.
Select your 3.7.x virtual appliance and power it off.
Open the
Hardware
properties for your virtual appliance.
Select
IDE Disk 2
, and then click
Remove
.
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
1.
2.
3.
Log in to your 4.2.1 virtual appliance as root.
Change the directory to
/opt/phoenix/deployment/.
Run the post-ao-db-migration.sh
script with the 3.7.x migration files phoenixdb_migration_xyz and opt-migration-*.ta
r.
./post-ao-db-migration.sh /root/phoenixdb_migration_xyz
/root/opt-migration-xyz.tar
4. When the migration script completes the virtual appliance will reboot.
Adding the Local Disk to the 4.2.1 Virtual Appliance
5.
6.
7.
8.
1.
2.
3.
4.
9.
10.
11.
Log in to Virtual Machine Manager.
Select your 4.2.1 virtual appliance and power it off.
Go the
Hardware
Click Remove.
settings for your virtual appliance and select
Click
Add Hardware.
Select
Storage.
Select the option to use
IDE Disk 3.
managed or existing storage
, and then browse to the location of the detached 3.7.x disk.
Click Finish.
Select Use an existing virtual disk, and then click Next.
Browse to the location of the migrated virtual disk that was created by the migration script, and then click
Power on the virtual appliance.
OK.
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
1. In the vSphere client, power off the 3.7.x Supervisor.
2.
3.
The IP Address for the 3.7.x Supervisor will be transferred to the 4.2.1 Supervisor.
Log in to the 3.7.x Supervisor as
Run the vami_config_net root
script.
over SSH.
Your virtual appliance will reboot when the IP address change is complete.
/opt/vmware/share/vami/vami_config_net
Registering Workers to the Supervisor
1.
2.
3.
4.
Log in to the Supervisor as admin.
Go to
Admin > License Management
.
Under
Under
VA Information
, click
Add
Admin > Collector Health
, and add the Worker.
and
Cloud Health
, check that the health of the virtual appliances is normal.
Setting the 4.2.1 SVN Password to the 3.7.x Password
1.
2.
3.
4.
Log in to the 4.2.1 Supervisor as root over SSH.
Change the directory to
/opt/phoenix/deployment/jumpbox
Run the SVN password reset script
./phsetsvnpwd.sh
Enter the following full admin credential to reset SVN password
.
Organization: Super
Page 191
FortiSIEM Installation Guide
User: admin
Password:****
Migration is now complete - Make sure all devices, user created rules, reports, dashboards are migrated successfully
Page 192
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating a KVM Local Disk-based Deployment using an RSYNC Tool
Overview
This migration process is for an FortiSIEM deployment with a single virtual appliance and the CMDB data stored on a local VMware disk, and where you intend to run the 4.2.1 version on a different physical machine as the 3.7.x version. This process requires these steps:
Copy the 3.7.x CMDB to a 4.2.1 Virtual Appliance Using rsync
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
Registering Workers to the Supervisor
Prerequisites
Contact AccelOps Support to reset your license
Take a snapshot of your 3.7.x installation for recovery purposes if needed
Make sure the 3.7.x virtual appliance has Internet access
Download the 4.2.1 migration scripts (ao-db-migration-4.2.1.tar)
AccelOps license to access the scripts.
. You will need the Username and Password associated with your
Copy the 3.7.x CMDB to a 4.2.1 Virtual Appliance Using rsync
Installing rsynch
Before you can copy CMDB, you need to have rsync installed on the 3.7.x virtual appliance where you will be making the copy.
1.
2.
Log in to the 3.7.x Supervisor as root over SSH.
Copy
CentOS-Base.repo
to
/etc/yum.repos.d
.
cp /etc/yum.repos.d.orig/CentOS-Base.repo /etc/yum.repos.d
3. Install rsync yum repo
.
yum install rsync
1.
2.
3.
Log in to the 4.2.1 virtual appliance as root.
Check the disk size in the remote system to make sure that there is enough space for the database to be copied over.
Copy the directory
/data
from the 3.7.x virtual appliance to the 4.2.1 virtual appliance using the rsync tool.
rsync Command Syntax
/ rsync --progress -av root@<3.7.x_VA_ip_address>:/data/ /data/
4. After copying is complete, make sure that the size of the event database is identical to the 3.7.x system.
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
1.
2.
3.
4.
Log in over SSH to your running 3.7.x virtual appliance as root.
Change the directory to
/root
.
Move or copy the migration script
Untar the migration script.
ao-db-migration-4.2.1.tar
to
/root
.
5.
Page 193
FortiSIEM Installation Guide FortiSIEM Installation Guide
5.
6.
Run ls -al to check that root
is the owner of the files ao-db-migration.sh
and ao-db-migration-archiver.sh
For each AccelOps Supervisor, Worker, or Collector node, stop all backend processes by running the phtools
.
command.
phtools --stop all
7. Run the archive script to create an archive version of the CMDB, and specify the directory where it should be created.
./ao-db-migration-archiver.sh /tmp/376_archive/
8. Check the that archive files phoenixdb_migration_*
and opt-migration-*.tar were successfully created in the destination
9. directory.
Copy the
Run the migration script on the 3.7.x CMDB archive you created in step 7.
The first argument is the location of the archived 3.7.x CMDB, and the second argument is the location where the migrated CMDB file will be kept. opt-migration-*.tar
file to
/root
.
10.
This contains various data files outside of CMDB that will be needed to restore the upgraded CMDB.
/root/ao-db-migration.sh /tmp/376_archive/cmdb-migration-xyz
/tmp/376_migration
11.
12.
Make sure the migrated files were successfully created.
Copy the migrated CMDB phoenixdb_migration_xyz
file to the
This file will be used during the CMDB restoration process.
/root
directory of your 4.2.1 virtual appliance
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
1.
2.
3.
Log in to your 4.2.1 virtual appliance as root.
Change the directory to
/opt/phoenix/deployment/.
Run the post-ao-db-migration.sh
script with the 3.7.x migration files phoenixdb_migration_xyz and opt-migration-*.ta
r.
./post-ao-db-migration.sh /root/phoenixdb_migration_xyz
/root/opt-migration-xyz.tar
4. When the migration script completes the virtual appliance will reboot.
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
1. In the vSphere client, power off the 3.7.x Supervisor.
2.
3.
The IP Address for the 3.7.x Supervisor will be transferred to the 4.2.1 Supervisor.
Log in to the 3.7.x Supervisor as
Run the vami_config_net root
script.
over SSH.
Your virtual appliance will reboot when the IP address change is complete.
/opt/vmware/share/vami/vami_config_net
Registering Workers to the Supervisor
1. Log in to the Supervisor as admin.
2.
Page 194
FortiSIEM Installation Guide FortiSIEM Installation Guide
2.
3.
4.
Go to
Admin > License Management
.
Under
Under
VA Information
, click
Add
Admin > Collector Health
, and add the Worker.
and
Cloud Health
, check that the health of the virtual appliances is normal.
Setting the 4.2.1 SVN Password to the 3.7.x Password
1.
2.
3.
4.
Log in to the 4.2.1 Supervisor as root over SSH.
Change the directory to
/opt/phoenix/deployment/jumpbox
Run the SVN password reset script
./phsetsvnpwd.sh
Enter the following full admin credential to reset SVN password
.
Organization: Super
User: admin
Password:****
Migration is now complete - Make sure all devices, user created rules, reports, dashboards are migrated successfully
Page 195
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating a KVM NFS-based Deployment In Place
Overview
In this migration method, the production FortiSIEM systems are upgraded in-place, meaning that the production 3.7.x virtual appliance is stopped and used for migrating the CMDB to the 4.2.1 virtual appliance. The advantage of this approach is that no extra hardware is needed, while the disadvantage is extended downtime during the CMDB archive and upgrade process. During this downtime events are not lost but are buffered at the collector. However, incidents are not triggered while events are buffered. Prior to the CDMB upgrade process, you might want to take a snapshot of CMDB to use as a backup if needed.
The steps for this process are:
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
Mounting the NFS Storage on Supervisors and Workers
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
Registering Workers to the Supervisor
Prerequisites
Contact AccelOps Support to reset your license
Take a snapshot of your 3.7.x installation for recovery purposes if needed
Make sure the 3.7.x virtual appliance has Internet access
Download the 4.2.1 migration scripts (ao-db-migration-4.2.1.tar)
AccelOps license to access the scripts.
. You will need the Username and Password associated with your
Upgrading the 3.7.x CMDB to 4.2.1 CMDB
1.
2.
3.
4.
Log in over SSH to your running 3.7.x virtual appliance as root.
Change the directory to
/root
.
Move or copy the migration script ao-db-migration-4.2.1.tar
to
/root
.
5.
6.
Untar the migration script.
Run ls -al to check that root
is the owner of the files ao-db-migration.sh
and ao-db-migration-archiver.sh
For each AccelOps Supervisor, Worker, or Collector node, stop all backend processes by running the phtools
.
command.
phtools --stop all
7. Run the archive script to create an archive version of the CMDB, and specify the directory where it should be created.
./ao-db-migration-archiver.sh /tmp/376_archive/
8. Check the that archive files phoenixdb_migration_*
and opt-migration-*.tar were successfully created in the destination
9. directory.
Copy the
Run the migration script on the 3.7.x CMDB archive you created in step 7.
The first argument is the location of the archived 3.7.x CMDB, and the second argument is the location where the migrated CMDB file will be kept. opt-migration-*.tar
file to
/root
.
10.
This contains various data files outside of CMDB that will be needed to restore the upgraded CMDB.
/root/ao-db-migration.sh /tmp/376_archive/cmdb-migration-xyz
/tmp/376_migration
11.
12.
Make sure the migrated files were successfully created.
Copy the migrated CMDB phoenixdb_migration_xyz
file to the
/root
directory of your 4.2.1 virtual appliance
Page 196
FortiSIEM Installation Guide
12.
This file will be used during the CMDB restoration process.
FortiSIEM Installation Guide
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
1.
2.
3.
Log in to your 4.2.1 virtual appliance as root.
Change the directory to
/opt/phoenix/deployment/.
Run the post-ao-db-migration.sh
script with the 3.7.x migration files phoenixdb_migration_xyz and opt-migration-*.ta
r.
./post-ao-db-migration.sh /root/phoenixdb_migration_xyz
/root/opt-migration-xyz.tar
4. When the migration script completes the virtual appliance will reboot.
Mounting the NFS Storage on Supervisors and Workers
Follow this process for each Supervisor and Worker in your deployment.
1.
2.
3.
Log in to your virtual appliance as root over SSH.
Run the mount
command to check the mount location.
Stop all AccelOps processes.
service crond stop phtools --stop all killall -9 phMonitor su - admin
/opt/glassfish/bin/asadmin stop-domain exit service postgresql-9.1 stop service httpd stop
4. Unmount 4.2.1 NFS storage location.
umount /data
5. Mount back to the 3.7.x NFS storage location.
Usage: mount -t nfs -o nfsvers=3 <NFS_Server_IP>:<Mount_Path>
/data ex: mount -t nfs -o nfsvers=3 192.168.67.168:/data/mig/SP61_376
/data
6. Verify mount location on the Supervisor or Workers.
Page 197
6.
FortiSIEM Installation Guide FortiSIEM Installation Guide
7. Change to the 3.7.x mount path location in the
/etc/fstab
file on the Supervisor or Workers.
8. Reboot the Supervisor or Worker.
Registering Workers to the Supervisor
1.
2.
3.
4.
Log in to the Supervisor as admin.
Go to
Admin > License Management
.
Under
Under
VA Information
, click
Add
Admin > Collector Health
, and add the Worker.
and
Cloud Health
, check that the health of the virtual appliances is normal.
Setting the 4.2.1 SVN Password to the 3.7.x Password
1.
2.
3.
4.
Log in to the 4.2.1 Supervisor as root over SSH.
Change the directory to
/opt/phoenix/deployment/jumpbox
Run the SVN password reset script
./phsetsvnpwd.sh
Enter the following full admin credential to reset SVN password
.
Organization: Super
User: admin
Password:****
Migration is now complete - Make sure all devices, user created rules, reports, dashboards are migrated successfully
Page 198
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating a KVM NFS-based Deployment via a Staging System
Overview
In this migration method, the production 3.7.x FortiSIEM systems are left untouched. A separate mirror image 3.7.x system is first created, and then upgraded to 4.2.1. The NFS storage is mounted to the upgraded 4.2.1 system, and the collectors are redirected to the upgraded 4.2.1
system. The upgraded 4.2.1 system now becomes the production system, while the old 3.7.6 system can be decommissioned. The collectors can then be upgraded one by one. The advantages of this method is minimal downtime in which incidents aren't triggered, and no upgrade risk. If for some reason the upgrade fails, it can be aborted without any risk to your production CMDB data. The disadvantages of this method are the requirement for hardware to set up the mirror 3.7.x mirror system, and longer time to complete the upgrade because of the time needed to set up the mirror system.
The steps in this process are:
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
Mounting the NFS Storage on Supervisors and Workers
Assigning the 3.7.x Supervisor's IP Address to the 4.2.1 Supervisor
Registering Workers to the Supervisor
Prerequisites
Contact AccelOps Support to reset your license
Take a snapshot of your 3.7.x installation for recovery purposes if needed
Make sure the 3.7.x virtual appliance has Internet access
Download the 4.2.1 migration scripts (ao-db-migration-4.2.1.tar)
AccelOps license to access the scripts.
. You will need the Username and Password associated with your
Create the 3.7.x CMDB Archive
1.
2.
3.
4.
Log in to your running 3.7.x production AccelOp virtual appliance as root.
Change the directory to
/root
.
Copy the migration script ao-db-migration-4.2.1.tar
to the
/root
directory.
5.
Untar the migration script.
Make sure that the owner of ao-db-migration.sh
and ao-db-migration-archiver.sh
files is root.
6. Run the archive script, specifying the directory where you want the archive file to be created.
./ao-db-migration-archiver.sh /tmp/376_archive/
7. Check that the archived files were successfully created in the destination directory.
8.
9.
You should see two files,
Copy the cmdb-migration-*.tar
cmdb-migration-*.tar
opt-migration-*.tar
, which will be used to migrate the 3.7.x CMDB, and
file to the 3.7.x staging Supervisor, using the same directory name you used in Step 6.
file to the /root directory of the 4.2.1 Supervisor.
opt-migration-*.tar
, which contains files stored outside of CMDM that will be needed to restore the upgraded CMDB to your new 4.2.1 virtual appliance.
Copy the
Restoring the Upgraded CMDB in a 4.2.1 Virtual Appliance
1.
2.
3.
Log in to your 4.2.1 virtual appliance as root.
Change the directory to
/opt/phoenix/deployment/.
Run the post-ao-db-migration.sh
script with the 3.7.x migration files phoenixdb_migration_xyz and opt-migration-*.ta
r.
./post-ao-db-migration.sh /root/phoenixdb_migration_xyz
/root/opt-migration-xyz.tar
4. When the migration script completes the virtual appliance will reboot.
Mounting the NFS Storage on Supervisors and Workers
Page 199
FortiSIEM Installation Guide
Follow this process for each Supervisor and Worker in your deployment.
1.
2.
3.
Log in to your virtual appliance as root over SSH.
Run the mount
command to check the mount location.
Stop all AccelOps processes.
service crond stop phtools --stop all killall -9 phMonitor su - admin
/opt/glassfish/bin/asadmin stop-domain exit service postgresql-9.1 stop service httpd stop
4. Unmount 4.2.1 NFS storage location.
FortiSIEM Installation Guide umount /data
5. Mount back to the 3.7.x NFS storage location.
Usage: mount -t nfs -o nfsvers=3 <NFS_Server_IP>:<Mount_Path>
/data ex: mount -t nfs -o nfsvers=3 192.168.67.168:/data/mig/SP61_376
/data
6. Verify mount location on the Supervisor or Workers.
7. Change to the 3.7.x mount path location in the
/etc/fstab
file on the Supervisor or Workers.
Page 200
7.
FortiSIEM Installation Guide FortiSIEM Installation Guide
8. Reboot the Supervisor or Worker.
Registering Workers to the Supervisor
1.
2.
3.
4.
Log in to the Supervisor as admin.
Go to
Admin > License Management
.
Under
Under
VA Information
, click
Add
Admin > Collector Health
, and add the Worker.
and
Cloud Health
, check that the health of the virtual appliances is normal.
Setting the 4.2.1 SVN Password to the 3.7.x Password
1.
2.
3.
4.
Log in to the 4.2.1 Supervisor as root over SSH.
Change the directory to
/opt/phoenix/deployment/jumpbox
Run the SVN password reset script
./phsetsvnpwd.sh
Enter the following full admin credential to reset SVN password
.
Organization: Super
User: admin
Password:****
Migration is now complete - Make sure all devices, user created rules, reports, dashboards are migrated successfully
Page 201
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating Collectors
1. After migrating all your Supervisors and Workers to 4.2.1, install the 4.2.1 Collectors.
2. SSH to the 3.7.x Collector as root.
3. Change the directory to
/opt/phoenix/cache/parser/events
.
4. Copy the files from this directory to the same directory on the 4.2.1 system.
5.
6.
7.
8.
Change the directory to
/opt/phoenix/cache/parser/upload/svn
.
Copy the files from this directory to the same directory on the 4.2.1 system.
Power off the 3.7.x Collector.
SSH to the 4.2.1 Collector and change its IP address to the same as the 3.7.x Collector by running the vami_config_net
script.
/opt/vmware/share/vami/vami_config_net
9. In a browser, navigate to https://<4.2.1_Collector_IP_address>:5480
and fill in the administration information to complete the
Collector setup/
Page 202
FortiSIEM Installation Guide FortiSIEM Installation Guide
Migrating the SVN Repository to a Separate Partition on a Local Disk
If you are using NFS storage, your SVN repository will be migrated to a local disk to improve performance and reliability. If you are using local storage only, the SVN repository will be moved out of the
/data
partition and into an
/svn
partition.
60GB Local Disk Storage Required
You must have 60GB of local storage on Supervisor node available for the SVN repository migration. Please create a new virtual disk size with a size of 60GB before starting the SVN migration.
1. SSH as root
into the Supervisor node where you want to run the SVN migration.
ssh root@<Super IP>
2. Run df –h
to see if an
/svn
partition does NOT exist. The migration script is going to create that partition.
This screenshot shows an expected typical partition structure.
3.
4.
Download ao-svn-migration.sh script from image server. ( https://images.FortiSIEM.net/upgrade/va/4.3.1
Copy or move the ao-svn-migration.sh
script to
/root
.
)
5. Run ls -al
to check that root
is the owner of ao-svn-migration.sh
.
6. Run chmod
to change the permissions on ao-svn-migration.sh
to
755
.
chmod 755 ao-svn-migration
7. Reboot the machine.
8. Log into the Supervisor as root.
9. Run ao-svn-migration.sh
.
. /ao-svn-migration
10. When the script executes, you will be asked to confirm that you have 60GB of local storage available for the migration. When the script completes, you will see the message
Upgrade Completed. SVN disk migration done
.
11. Run df –h
to confirm that the
/svn
partition was completed.
Page 203
FortiSIEM Installation Guide
Special pre-upgrade instruction for 4.3.3
1.
2.
3.
4.
SSH as root into the Supervisor node
Download " phupdateinstall-4.3.3.sh
" script
Copy or move the phupdateinstall-4.3.3.sh script to /root
Run chmod to change the permissions on phupdateinstall-4.3.3.sh to 755 chmod 755 phupdateinstall-4.3.3.sh
5. Run phupdateinstall-4.3.3.sh
./phupdateinstall-4.3.3.sh
6. Repeat step 1 to 5 on Worker/s and Report Server node
FortiSIEM Installation Guide
Page 204
FortiSIEM Installation Guide
Special pre-upgrade instruction for 4.6.1
Instructions for Supervisor node
Run the following command as root.
rpm -e vmware-jre
FortiSIEM Installation Guide
Instructions for Collector nodes
Run the following command as root on each collector prior to upgrading the collector from the GUI, or the upgrade will fail: mkdir -p /opt/phoenixphscripts/bin ln -sf /opt/phoenix/phscripts/bin/phcollectorimageinstaller.py
/opt/phoenixphscripts/bin/phcollectorimageinstaller.py
Page 205
FortiSIEM Installation Guide FortiSIEM Installation Guide
Enabling TLS 1.2 Patch On Old Collectors
Older AccelOps collectors 4.5.2 or earlier running JDK 1.7 do not have TLS 1.2 enabled. To enable them to communicate to FortiSIEM 4.6.3, follow these steps
1.
2.
SSH to Collector and edit /opt/phoenix/bin/runJavaAgent.sh
Enable TLS v1.2 option exec ${JAVA_HOME}/bin/java $initialJobXML
-Djava.library.path=/opt/phoenix/lib64
-Dhttps.protocols=SSLv3,TLSv1,TLSv1.1,TLSv1.2 -classpath
${MY_CLASS_PATH} -Xmx2048M com.ph.phoenix.agent.AgentMain "$@"
3. Save changes, restart Java and phAgentManager
killall -9 java
killall -9 phAgentManager
Page 206
FortiSIEM Installation Guide FortiSIEM Installation Guide
Upgrading to 4.6.3 for TLS 1.2
Enforcing TLS 1.2 requires that the following steps be
followed in strict order
for upgrade to succeed.
Additional steps for TLS 1.2
compatibility are marked in bold
.
1.
2.
libraries up to date. Follow this yum update order
3.
If your environment has a collector and it is running AccelOps 4.5.2 or earlier (with JDK 1.7), then first patch the Collector for
TLS 1.2 compatibility (see
4.
5.
Remove
/etc/yum.repos.d/accelops* and Run "yum update" on
Collectors Worker(s)
,
Supervisor.
, Supervisor and to get all TLS 1.2 related
here ). This step is not required for Collectors running AccelOps 4.6.1 or later.
Pre-upgrade step for upgrading Supervisor: Stop FortiSIEM (previously AccelOps) processes all Workers by running "phtools --stop ALL".
Collectors can be up and running. This is to avoid build up of report files.
6.
7.
Upgrade Supervisor following usual steps.
If your environment has Worker nodes, Upgrade Workers following usual steps.
If your environment has AccelOps Windows Agents, then upgrade Windows Agent Manager from 1.1 to 2.0. Note t
here are special pre-upgrade steps to enable TLS 1.2
(see here ).
If your environment has Collectors, upgrade Collectors following usual steps.
Page 207
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up the Image Server for Collector Upgrades
If you want to upgrade a multi-tenant deployment that includes Collectors, you must set up and then specify an image server that will be used as a repository for the Collector upgrade files. You can use a standard HTTP server for this purpose, but there is a preferred directory structure for the server. These instruction describe how to set up that structure, and then add a reference to the image server in your Supervisor node.
Setting Up the Image Server Directories
1.
2.
3.
Log into the image server with Admin rights.
Create the directory images/collector/upgrade
.
Download the latest collector image upgrade file from https://images.accelops.net/upgrade/offline/co/latest4/ to images/collector/up grade
.
4. Untar the file.
You should see a set of files that looks like this:
[image]# tar xvf /root/CO-4.3.3.1189.tar
CO-4.3.3.1189/
CO-4.3.3.1189/RPM-GPG-KEY
CO-4.3.3.1189/FortiSIEM-collector-4.3.3.1189.rpm
CO-4.3.3.1189/repodata/
CO-4.3.3.1189/repodata/other.xml.gz
CO-4.3.3.1189/repodata/filelists.xml.gz
CO-4.3.3.1189/repodata/primary.xml.gz
CO-4.3.3.1189/repodata/repomd.xml
5. Use the link
command to create a symbolic link to the latest directory.
/bin/link -sf /images/collector/upgrade/CO-x.x.x.xxxx
/images/collector/upgrade/latest
6. Make sure a directory tree structure like this is created in the images
directory before proceeding:
/images
/collector/upgrade/CO-x.x.x.xxxx
/FortiSIEM-collector-x.x.x.xxxx.rpm
/RPM-GPG-KEY
/repodata
/filelists.xml.gz
/other.xml.gz
/primary.xml.gz
/repomd.xml
7. Create a link from the image directories to the webserver html pages.
Page 208
7.
FortiSIEM Installation Guide
/bin/link -sf /images/collector/upgrade/latest
/var/www/html/vms/collector/upgrade/latest
8. Test the image server locations by entering one of the following addresses into a browser: http://images.myserver.net/vms/collector/upgrade/latest/ https://images.myserver.net/vms/collector/upgrade/latest/
Setting the Image Server in the Supervisor
1.
2.
3.
4.
5.
Log in to your Supervisor node.
Go to
Admin > General Settings > System
.
Under
Image Server
, enter the URL or IP address for your image server.
Enter the authentication credentials for your image server.
Click
Save
.
FortiSIEM Installation Guide
Page 209
FortiSIEM Installation Guide
Upgrading a FortiSIEM Single Node Deployment
These instructions cover the upgrade process for an FortiSIEM Enterprise deployment with a single Supervisor.
Upgrade Procedure
FortiSIEM Installation Guide
If you are running 4.3.3, then make sure that you have run "phupdateinstall-4.3.3.sh" as root
1.
2.
Using SSH, log in to the FortiSIEM virtual appliance as the root user.
Change to the pbin
directory.
cd /pbin
3. Run the command to download the image.
./phdownloadimage <userID> <password> <downloadUrl>
Example Command to Download the 4.7.1 Upgrade Image
.
/phdownloadimage <userID> <password> https://images.accelops.net/upgrade/va/latest/
UserID and Password should be same credentials you used for license registration.
4. Select
Yes
to confirm the download.
The console will show the progress of the download.
Do Not Stop the Download Process
It takes 40 - 60 minutes to download the upgrade image depending on network traffic. Do not stop the download process manually.
5. After the download completes, run this command to upgrade your virtual appliance.
./phupgradeimage
Do Not Stop the Upgrade Process
The system upgrade takes 10 - 30 minutes depending on the size of your databases and system resources. Do not stop the upgrade process manually.
6.
7.
Your console will display the progress of the upgrade process.
When the upgrade process is complete, your FortiSIEM virtual appliance will reboot.
Log in to your virtual appliance, and in the
Admin > Cloud Health
page, check that you are running the upgraded version of FortiSIEM.
Page 210
FortiSIEM Installation Guide FortiSIEM Installation Guide
Upgrading a FortiSIEM Cluster Deployment
Upgrading Supervisors and Workers
Overview
Follow these steps while upgrading a VA cluster
1.
2.
3.
4.
Shutdown all Workers. Collectors can be up and running.
Upgrade Super first (while all workers are shutdown)
After Super is up and running, upgrade worker one by one.
Upgrade collectors
Step #1 prevents the accumulation of Report files while Super is not available during upgrade (#2). If these steps are not followed, Supervisor may not be able to come up after upgrade because of excessive unprocessed report fie accumulation.
Note: Both Super and Worker MUST be on the same FortiSIEM version, else various software modules may not work properly. However,
Collectors can be in older versions - they will work except that they may not have the latest discovery and performance monitoring features in the
Super/Worker versions. So FortiSIEM recommends that you also upgrade Collectors within a short period of time.
If you have Collectors in your deployment, make sure you have configured an image server
to use as a repository for the Collector
Upgrading Supervisors and Workers
For both Supervisor and Worker nodes, follow the upgrade process described here, but be sure to upgrade the Supervisor node first.
1.
2.
Using SSH, log in to the FortiSIEM virtual appliance as the root user.
Change to the pbin
directory.
cd /pbin
3. Run the command to download the upgrade image.
./phdownloadimage <userID> <password> <downloadUrl>
Example Command to Download the 4.7.1 Upgrade Image
.
/phdownloadimage <userID> <password> https://images.accelops.net/upgrade/va/latest/
UserID and Password should be same credentials you used for license registration.
4. Select
Yes
to confirm the download.
The console will show the progress of the download.
Do Not Stop the Download Process
It takes 40 - 60 minutes to download the upgrade image depending on network traffic. Do not stop the download process manually.
5. After the download completes, run this command to upgrade your virtual appliance.
./phupgradeimage
Do Not Stop the Upgrade Process
The system upgrade takes 10 - 30 minutes depending on the size of your databases and system resources. Do not stop the
Page 211
5.
FortiSIEM Installation Guide FortiSIEM Installation Guide upgrade process manually.
6.
7.
Your console will display the progress of the upgrade process.
When the upgrade process is complete, your FortiSIEM virtual appliance will reboot.
Log in to your virtual appliance, and in the
Admin > Cloud Health
page, check that you are running the upgraded version of FortiSIEM.
Upgrading Collectors
The process for upgrading Collectors is similar to the process for Supervisors and Workers, but you must initiate the Collector process from the
Supervisor.
1.
2.
3.
Log in to the Supervisor node as an administrator.
Go to
Admin > General Settings
.
Under
Image Server Settings
, enter the download path to the upgrade image, and the
Username
and
Password
associated with your
4.
5.
6. license.
Go to
Click
Admin > Collector Health
.
Download Image
, and then click
Yes
to confirm the download.
As the download progresses you can click
When
Finished
appears in the
Refresh
to check its status.
Download Status
column of the
Collector Health
page, click
Install Image
.
7.
The upgrade process will begin, and when it completes, your virtual appliance will reboot. The amount of time it takes for the upgrade to complete depends on the network speed between your Supervisor node and the Collectors.
When the upgrade is complete, make sure that your Collector is running the upgraded version of FortiSIEM.
Page 212
FortiSIEM Installation Guide FortiSIEM Installation Guide
Upgrading FortiSIEM Windows Agent and Agent Manager
Upgrading Windows Agent License
Upgrade from V1.0 to V1.1
Version 1.0 and 1.1 Backward Incompatibility
Note 1.0 Agents and Agent Managers communicate only over HTTP while 1.1 Agents and Agent Managers communicate only over
HTTPS. Subsequently, 1.1 Agents and Agent managers are not backward compatible with 1.0 Agents and Agent Managers. You have to completely upgrade the entire system of Agents and Agent Managers.
1.
2.
3.
4.
5.
Uninstall V1.0 Agents
Close V1.0 Agent Manager Application.
Uninstall V1.0 Agent Manager
Bind Default Website with HTTPS as described in Pre-requisite in
Install V1.1 Agent Manager following a. In Database Settings dialog, enter the V1.0 database path as the "FortiSIEM Windows Agent Manager" SQL Server database b. path (Procedures Step 6 in
Installing FortiSIEM Windows Agent Manager
Installing FortiSIEM Windows Agent Manager
Installing FortiSIEM Windows Agent Manager
).
.
6.
7.
Enter the same Administrator username and password (as the previous installation) in the Agent Manager Administrator account creation dialog
Install V1.1 Agents
Assign licenses again. Use the Export and Import feature.
Upgrade from V1.1 to V2.0
Windows Agent Manager
1. Enable TLS 1.2 on Agent Manager - FortiSIEM Supervisor/Worker 4.6.3 and above enforces the use of TLS 1.2 for tighter security.
However, by default only SSL3 / TLS 1.0 is enabled in Windows Server 2008-R2. Therefore, enable TLS 1.2 for Windows Agent Manager
2.0 for operating with FortiSIEM Supervisor/Worker 4.6.3 and above.
a. b.
Start elevated Command Prompt (i.e., with administrative privilege) to Windows Agent Manager 1.1
Run the following commands sequentially as shown.
REG ADD
"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANN
EL\Protocols\TLS 1.1\Client" /v DisabledByDefault /t REG_DWORD
/d 00000000
REG ADD
"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANN
EL\Protocols\TLS 1.1\Server" /v DisabledByDefault /t REG_DWORD
/d 00000000
REG ADD
"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANN
EL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD
/d 00000000
REG ADD
"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANN
EL\Protocols\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD
/d 00000000
2.
3. c. Restart computer
Uninstall Agent Manager 1.1
Install SQL Server 2012-SP1 Feature Pack on Agent manager available at https://www.microsoft.com/en-in/download/details.aspx?id=35
Page 213
FortiSIEM Installation Guide FortiSIEM Installation Guide
3.
580.
a. Select the language of your choice and mark the following two MSIs (choose x86 or x64 depending on your platform) for download: i. ii.
SQLSysClrTypes.msi
b.
SharedManagementObjects.msi
Click on the Download button to download those two MSIs. Then double-click on those MSIs to install those one by one.
4. Install Agent Manager 2.0
a. b.
In Database Settings dialog, set the old database path as AccelOpsCAC database path.
Enter the same Administrator username and password (as in the previous installation) in the new Agent Manager Administrator
5. account creation dialog.
Run Database migration utility to convert from 1.1 to 2.0
a. b. c.
Open a Command Prompt window
Go to the installation directory (say, C:\Program Files\AccelOps\Server)
Run AOUpdateManager.exe with script.zip as the command line parameter. You will find script.zip alongside the MSI.
Windows Agent
1.
2.
Uninstall V1.0 Agents
Install Agents
Upgrading Windows Agent License
Follow these steps if you have bought additional Windows Agent licenses or extended the term of the license.
1.
2.
3.
4.
Login to AccelOps Supervisor using admin account
Go to
Go to
Admin License Management
> >
and make sure that the license is updated
Admin Setup Wizard Windows Agent
Edit each
Windows Agent Manager
entry and modify the agent count and license expiry date if needed
The new license will be automatically pushed to each Windows Agent Manager. You can now logon to each Windows Agent Manager and allocate the additional licenses if needed.
Uninstalling Agents
Single Agent
Simply uninstall like a regular Windows service
Multiple Agents using Group Policy
Go to the
Group Policy
you created during Agent installation. Right click and select
In the
Group Policy Management Editor
, go to
Installation
Right click on
FortiSIEM Windows Agent <version>
Edit
>
Click
All Tasks > Remove
In
Remove Software
dialog, choose the option
>
Immediately uninstall the software from users and computers.
The
FortiSIEM Windows Agent <version>
entry will disappear from the right pane Close the
Force the group policy update
On Domain Controller > cmd, run gpupdate /force
On Agent server > cmd, run gpupdate
Restart each Agent Computer to complete the uninstall.
.
Then click
OK
.
Group Policy Management Editor .
Page 214
FortiSIEM Installation Guide FortiSIEM Installation Guide
Automatic OS Upgrades during Reboot
In order to patch CentOS and system packages for
security updates
as well as bugfixes and make the system on-par with a fresh installed
FortiSIEM node, the following script is made available. Internet connectivity to CentOS mirrors should be working in order for the following script to be successful, otherwise the script will print and error and exit. This script is available on all nodes starting from 4.6.3: Supervisor, Workers,
Collectors, and Report Server
/opt/phoenix/phscripts/bin/phUpdateSystem.sh
The above script is also invoked during
system boot up
and is invoked in the following script:
/etc/init.d/phProvision.sh
The ensures that the node is up to date right after an upgrade and system reboot. If you are running a node that was first installed in an older release and upgraded to 4.6.3, then there are many OS/system packages that will be downloaded and installed the first time. Therefore, upgrade time is longer than usual. On subsequent upgrades and reboots, the updates will be small.
Nodes that are deployed in bandwidth constrained environments can disable this by commenting out the line phUpdateSystem.sh in phProvision.sh above. However, it is
strongly recommended
to keep this in-place to ensure that your node has security fixes from CentOS and minimize the risk of an exploit. Alternatively, in bandwidth constrained environments, you can deploy a freshly installed collector to ensure that security fixes are up to date.
Page 215
FortiSIEM Installation Guide
Configuring FortiSIEM
FortiSIEM Installation Guide
Page 216
FortiSIEM Installation Guide FortiSIEM Installation Guide
Initial System Configuration
Before you can initiate discovery and monitoring of your IT infrastructure, you will need to configure several general settings, add users, and add organizations for multi-tenant deployments.
Additional Information in the Help Center
You can find additional information about the configuration of your FortiSIEM deployment, including troubleshooting tips, in the FortiSIE
M Configuration section of the Help Center maintained by FortiSIEM Support.
Setting Up Routing Information for Reports and Incident Notifications
Setting Up Email Alert Routing for Scheduled Reports
Setting Up SNMP Traps for Incident Notifications
Setting Up XML Message Routing for Incident Notifications
Setting Up Routing for Remedy Tickets
Adding Users for Enterprise Deployments
Setting Up External Authentication
Configuring Okta Authentication
Adding Users from Active Directory via LDAP
Adding 2-factor Authentication via Duo Security
Managing Organizations for Multi-Tenant Deployments
Dynamic Distribution of Events per Second (EPS) across Collectors
How Devices are Added to Organizations
Adding Users to Multi-Tenant Deployments
Adding Super/Global Users to Organizations with Collectors
Adding Super/Global Users to Organizations without Collectors
Page 217
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up the Email Gateway
Before you can set up notifications, you have to set up the email gateway that your system will use for all alerts and system notifications.
1.
2.
3.
4.
5.
Log into your Supervisor node.
Go to
Admin > General Settings > Email Settings
.
Enter the
Email Gateway Server
.
Enter any additional account or connection information.
Click
Save
.
Page 218
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up Routing Information for Reports and Incident Notifications
Topics in this section describe how to set up email addresses to send alerts to when
, and distribution information for notifications associated with incidents. You can also automate the sending of tickets to a Remedy system when an incident occurs. These are all general settings, in that you don't need to have any rules or reports defined before you configure them. For information on configuring specific notification policies for rules and incidents, see see
. For information on configuring Remedy to work with FortiSIEM notifications,
Configuring Remedy to Accept Incident Notifications from FortiSIEM .
Setting Up Email Alert Routing for Scheduled Reports
Setting Up SNMP Traps for Incident Notifications
Setting Up XML Message Routing for Incident Notifications
Setting Up Routing for Remedy Tickets
Related Links
Configuring Remedy to Accept Incident Notifications from FortiSIEM
Page 219
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up Email Alert Routing for Scheduled Reports
to run and send email notifications to specific individuals. This setting is for default email notifications that will be sent when any scheduled report completes.
4.
5.
6.
7.
1.
2.
3.
Log into your Supervisor node.
Go to
Admin > General Settings > Analytics
.
+
Select
SMS
Click
OK
.
configured your email gateway yet, you will see an error message.
or
for the delivery method.
Enter the email address or SMS number.
Click
Save All
when you are done.
Sending Alerts to the Console
Select
Send an alert to console
if you also want to send alerts to the console. Alerts are always displayed in the Incidents tab, while the alerts sent to the console are immediately displayed but without any grouping by rule name, incident source, incident target, or other detail information.
Empty Reports
Sometimes a report may be empty because there are no matching events. If you don't want to send empty reports to users, select
Do not send scheduled emails if report is empty
. If you are running a multi-tenant deployment, and you select this option while in the
Super/Global view, this will apply only to Super/Global reports. If you want to suppress delivery of empty reports to individual organizations, you will have to configure this option in the organizational view.
Related Links
Page 220
FortiSIEM Installation Guide
Setting Up SNMP Traps for Incident Notifications
You can define SNMP traps that will be notified when an event triggers an incident.
5.
6.
7.
8.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Admin > General Settings > Analytics
.
Enter the
SNMP Trap IP Address
.
Enter the
SNMP Community String
that will authorize sending the trap to the SNMP trap IP address.
Select the
Select a
Click
Click
SNMP Trap Type
Protocol
Test SNMP
Save All
.
.
.
to check the connection.
Related Links
FortiSIEM Installation Guide
Page 221
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up XML Message Routing for Incident Notifications
You can configure FortiSIEM to send an XML message over HTTP(s) when an a incident is triggered by a rule.
1.
2.
3.
4.
5.
6.
Log in to your Supervisor.
Go to
Admin > General Settings > Analytics
.
For
HTTP(S) Server URL
, enter the URL of the remote host where the message should be sent.
Enter the
Username
and
Click
Click
Test HTTP
Save All
.
Password
to use when logging in to the remote host, and then
to check the connection.
Reconfirm
the password.
Page 222
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up Routing for Remedy Tickets
You can set up Remedy to accept notifications from FortiSIEM and generate tickets from those notifications, as described in Configuring Remedy to Accept Incident Notifications from FortiSIEM . These instructions explain how to set up the routing to your Remedy server.
1.
2.
3.
4.
5.
6.
Log in to your Supervisor node.
Go to
Admin > General Settings > Analytics
.
For
WSDL
Enter the
Click
, enter the URL of the Remedy Server.
Username
Save All
.
and
Password
associated with your Remedy server, and then
Click
Test Remedy
to test the connection.
Reconfirm
the password.
Related Links
Configuring Remedy to Accept Incident Notifications from FortiSIEM
Page 223
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up User Roles
FortiSIEM has a wide operational scope - it provides performance, availability, and environmental alerts, as well as change and security monitoring for network devices, servers and applications. It is difficult for one admin to monitor across the entire spectrum of available information.
In addition, devices may be in widely distributed geographical and administratively disjointed locations. Role-based access control provides a way to partition the FortiSIEM administrative reponsibilities across multiple admins.
A role defines two aspects of a user's interaction with the FortiSIEM platform:
Which
user interface elements
a user can see and the ability to use the associated Read/Write/Execute permissions. As an example, the built-in
Executive
role can see only the dashboard, while the be defined to the attribute level in which, for example, a
Server Admin
role cannot see network devices. Role permissions can
Tier1 Network Admin
role can see network devices but not their configurations.
What
data
can the user see. For example, consider a
Windows Admin
role and a
Unix Admin
role. They both can run the same reports, but the Windows admins sees only logs from Windows devices. This definition can also be fine-grained, for example one
Windows admin sub-role can be defined to see Windows performance metrics, while another Windows admin sub-role can see Windows authentication logs.
Topics in this section explain how to use the Default roles that come with FortiSIEM, and how to define new ones.
Page 224
FortiSIEM Installation Guide FortiSIEM Installation Guide
Default Roles
To perform any action with FortiSIEM, a user must be assigned a role with the required permissions. The roles listed in this table are default roles.
You can create custom roles and permissions by following the instructions in the topic
Role
Full Admin
Network Admin
System Admin
Server Admin
Windows Server
Admin
Permissions
Full access to the GUI and full access to the data. Only this role can define roles, create users and map users to roles.
Full access to the network device portion of the GUI and full access to logs from network devices
Full access to the Server/Workstation/Storage part of the GUI and full access to logs from those devices
Full access to the Server part of the GUI and full access to logs from those devices
Full access to the Windows Server part of the GUI and full access to logs from those devices
Unix Server Admin
Full access to the Unix Server part of the GUI and full access to logs from those devices
Security Admin
Full access to Security aspects of all devices
Storage Admin
DB Admin
Helpdesk
Full access to the Storage device part of the GUI and full access to logs from those devices
Full access to the database servers part of the GUI and full access to logs from those devices
Access to the Admin, CMDB, and Dashboard tabs, with view and run permissions for the the Analytics and Incidents tabs
Read Only Admin
Executive
View access to all tabs and permission to run reports
View access to the Business Service dashboard and personalized My Dashboard tabs, but reports can be populated by logs from any device
Page 225
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Custom User Roles
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Admin > Role Management.
Click
New
.
5.
Enter a
Role Name
and
Role Description
.
Enter the
Data Conditions
for this role.
6.
This restricts access to the event/log data that is available to the user, and will be appended to any query that is submitted by users with this role. This applies to both Real-Time and Historical searches, as well as Report and Dashboard information.
Enter the
CMDB Report Conditions
for this role.
7.
This restricts access to the reports for devices, users, and monitors that are available to the user with this role.
Select the
UI Access Conditions
for this role.
This defines the user interface elements that can be accessed by users with this role. By default, child nodes in the tree inherit the permissions of their immediate parent, however you can override those default permissions by explicitly editing the permission of the child node. Options for these settings are:
Setting Description
Full
No access restrictions
Edit
Run
The role can make changes to the UI element
The role can execute processes for the UI element
View
Hide
The role can only view the UI element
The UI element is hidden from the role
Hiding Network Segments
If a
Network Segment
is marked as hidden for a user role, then users with that role will not be able to see any of the devices whose IP addresses fall within that network segment, even if the CMDB folder(s) containing those devices have not been hidden.
Explicit v. Effective Permissions
When a permission icon is shown within a grey box, that means that the permission was explicitly set. If the icon is shown without a border, then it represents a node's effective permission. If a permission has not been set for a node, then its effective permission is that of its nearest parent in the tree.
Page 226
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Users for Enterprise Deployments
Adding users to enterprise deployments involves first deciding if you are going to use external authentication, or local authentication credentials defined within each user profile. You can then add users on an individual basis, or, if you are using LDAP authentication, you can discover users within Active Directory over LDAP. For mutt-tenant deployments you can add individual users to an organization as described in these topics, but if you need to add users who have a role in more than one organization (Global users), see the topics under
Setting Up External Authentication
Adding Users from Active Directory via LDAP
Adding 2-factor Authentication via Duo Security
Page 227
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up External Authentication
. The other options, RADIUS and Okta, follow the same authentication set up process.
Multiple Authentication Profiles
If more than one authentication profile is associated with a user, then the servers will be contacted one-by-one until a connection to one of them is successful. Once a server has been contacted, if the authentication fails, the process ends, and the user is notified that the authentication failed.
1.
2.
3.
4.
5.
6.
Log into your Supervisor node.
Go to
Admin > General Settings > External Authentication
.
Click
Add
.
If you are setting up authentication for an organization within a multi-tenant deployment, select the
Select the
Protocol
.
Complete the protocol settings.
Organization
.
Protocol User-Defined Settings
LDAP Access IP
Select
Set DN Pattern
to open a text field in which you can enter the DN pattern if you want to override the discovered pattern, or you want to add a specific LDAP user.
See
RADIUS Access IP
Shared Secret
Select
CHAP
if you are using encrypted authentication to your RADIUS server
Okta Certificate
See
Configuring Okta Authentication
for more information.
7. Click
Test
, and then enter credentials associated with the protocol you selected to make sure users can authenticate to your deployment.
You can now associate users to this authentication profile as described in
.
Page 228
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring Okta Authentication
To use Okta authentication for your FortiSIEM deployment, you must set up a SAML 2.0 Application in Okta, and then use the certificate associated with that application
when you configure external authentication
.
1.
2.
3.
Log into Okta.
In the
Applications
tab, create a new application using
Under
General Settings
, configure these settings:
Template SAML 2.0 App
.
Post Back URL
Destination
Recipient
https://<FortiSIEMIP>/phoenix/okta https://<FortiSIEMIP>/phoenix/okta
FortiSIEM
Audience Restriction
Super
authnContextClassRef PasswordProtectedTransport
Request Uncompressed
4.
5.
6.
7.
Click
In the
Save
.
Sign On
tab, click
View Setup Instructions
Click
Download Certificate
.
.
Follow the instructions in
Setting Up External Authentication
and enter the downloaded certificate for Okta authentication.
Page 229
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding a Single User
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
CMDB > Users
.
5.
6.
Click
New
.
Complete the
User Name
and user profile information.
For
System Administrator
, select
Select a
Default Role
for the user.
Yes
.
7.
8.
9.
for a list of default roles and permission. You can also create new roles as described in
, which will be available in this menu after you create them.
For
For
System Account Enabled
, select
Yes
.
Session Timeout
, enter the number of minutes after which an inactive user will be logged out.
For
User Lockout
, enter the number of minutes the user will be unable to log into the system after three successive authentication failures.
10. For
System Password Reset
, enter the number of days after which a user’s current password for logging in to the system will automatically expire.
If left blank, the user's password will never expire.
11. For
Password
, select
If you select
Local
Local
or
External
.
, enter and then reconfirm the user password. See external authentication.
Setting Up External Authentication
for more information about using
Multiple Authentication Profiles
If more than one authentication profile is associated with a user, then the servers will be contacted one-by-one until a connection to one of them is successful. Once a server has been contacted, if the authentication fails, the process ends, and the user is notified that the authentication failed.
12. Click Save.
Related Links
Page 230
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Users from Active Directory via LDAP
If you want to add users to your FortiSIEM deployment from an Active Directory server over LDAP, you must first add the login credentials for your server and associate them to an IP range, and then run the discovery process on the Active Directory server. If the server is discovered successfully, then all the users in that directory will be added to your deployment. You then need to set up an authentication profile, which will
become an option you can associate with users as described in Adding a Single User .
Create Login Credentials and Associate with an IP Address
Discover the Active Directory Server and Users
Page Size Limit for AccelOps Versions Prior to 4.3.1
There is a page size limit for each LDAP search result in the Active Directory server, which is often set to 1000. If any OU has more than 1000 users and the default limit is not increased, then all the users may not be discovered in FortiSIEM - this issue has been addressed in 4.3.1 by using the paged control LDAP search API. For information on how to change this limit, see this Microsoft KB article .
Create Login Credentials and Associate with an IP Address
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Admin > Setup Wizard > Credentials
.
5.
Enter a
Name
.
For
Device Type
, select
Microsoft Windows
.
Select your
Access Protocol
.
FortiSIEM supports these LDAP protocols:
Protocol
LDAP
Port
Non-secure version on port 389
LDAPS Secure version on port 636
LDAP Start TLS Secure version on port 389
12.
13.
14.
15.
6.
7.
8.
9.
For
For
Used For
Base DN
, select
Microsoft Active Directory
.
, be sure to enter the root of the LDAP user tree.
Enter the
NetBIOS/Domain
for your LDAP directory.
Enter the
User Name
for your LDAP directory.
10.
11.
For user discovery from OpenLDAP, specify the full DN as the user name. For Active Directory, use your server login name.
Enter and confirm the
Password
for your
User Name
.
Click
Save
.
Your LDAP credentials will be added to the list of
Under
Credentials
Enter IP Range to Credential Associations
, click
Select your LDAP credentials from the list of
Credentials
.
Add
.
.
Enter the
IP range
or host name for your Active Directory server.
Click
OK
.
16.
Your LDAP credentials will appear in the list of credential/IP address associations.
Click
Test Connectivity
to make sure you can connect to the Active Directory server.
Discover the Active Directory Server and Users
1.
2.
3.
4.
5.
6.
Go to
Admin > Discovery
.
Click
For
Add
Name
.
, enter
Active Directory
.
For
Include Range
, enter the IP address or host name for your Active Directory server.
7.
8.
Leave all the default settings, but clear the
Discover Routes
option.
Click
OK
.
Active Directory will be added to the list of discoverable devices.
Select the Active Directory device and click
After discovery completes, go to
Discover
CMDB > Users
.
to view the discovered users.
You may need to click
Refresh
for the user tree hierarchy to load.
Page 231
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Users from Okta
Create an Okta API Token
1.
2.
3.
Log in to Okta using your Okta credentials.
Got to
Click
Administration > Security > API Tokens
Create Token
.
.
You will use this token when you set up the Okta login credentials in the next section. Note that this token will have the same permissions as the person who generated it.
Create Login Credentials and Associate Them with an IP Address
1.
2.
3.
4.
5.
6.
7.
8.
Log in to your Supervisor node.
Go to
Admin > Setup Wizard > Credentials
.
Enter a
Name
.
For
For
Device Type
Enter the
NetBIOS/Domain
associated with your Okta account.
For example,
, select
Access Protocol
Okta.com
.
, select
Okta API
.
FortiSIEM.okta.com
For
Pull Interval
.
, enter how often, in minutes, you want FortiSIEM to pull information from Okta.
9.
Enter and reconfirm the
Security Token
you created.
10.
11.
12.
13.
Click
Save
.
Your LDAP credentials will be added to the list of
Under
Click
Credentials
.
Enter IP Range to Credential Associations
, click
Select your Okta credentials from the list of
Credentials
.
Enter the
OK
.
IP range
or host name for your Okta account.
Add
.
14.
Your Okta credentials will appear in the list of credential/IP address associations.
Click
Test Connectivity
to make sure you can connect to the Active Directory server.
Discover Okta Users
1.
2.
3.
4.
5.
6.
Go to
Admin > Discovery
.
Click
For
Add
Name
.
, enter
Okta
.
For
Include Range
, enter the IP address or host name for your Active Directory server.
7.
8.
Leave all the default settings, but clear the
Discover Routes
option.
Click
OK
.
Okta will be added to the list of discoverable devices.
Select the Okta device and click
After discovery completes, go to
Discover
.
CMDB > Users
to view the discovered users.
You may need to click
Refresh
for the user tree hierarchy to load.
Page 232
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding 2-factor Authentication via Duo Security
Obtain keys for FortiSIEM to communicate with Duo Security
1.
2.
3.
4.
5.
Sign up for a Duo Security account: signup.
This will be admin account for Duo Security.
Log in to Duo Security Admin Panel and navigate to
Applications
Click
Get
Protect an Application.
Duo Server Name Integration key Secret key
Generate
Application key
Locate
Web SDK
,
in the applications.
from the page. You will need it when you configure FortiSIEM.
as a long string. This is a password that Duo Security will not know. You can choose any 40 character long string or generate it as follows using python
import os, hashlib print hashlib.sha1(os.urandom(32)).hexdigest()
Create and Manage FortiSIEM users in Duo Security
This determines how the 2-factor authentication response page will look like in FortiSIEM and how user will respond to the second factor authentication challenge
1.
2.
3.
4.
Log in to Duo Security as admin user
Choose the
Logo
which will be shown to users as they log on
Choose the super set of 2-factor
Authentication Methods
.
Optional - you can create the specific users that will logon via FortiSIEM. If the users are not pre-created here, then user accounts will be created automatically when they attempt 2-factor authentication for the first time.
Add 2-factor authentication option for FortiSIEM users
1. Create a 2-factor authentication profile a. b. a. b. c. d. e.
Go to
Click
Add
Go to i. ii.
Check
Admin > General Settings > External Authentication
Enter
Name
Set
Organization
1.
2.
Click
Save
2. Add the 2-factor authentication profile to an user
>
Select a specific user
Second Factor
from Step 4 in "Obtain keys for FortiSIEM to communicate with Duo Security"
from Step 5 in "Obtain keys for FortiSIEM to communicate with Duo Security" checkbox
Select the 2-factor authentication profile created in Step 1
Click Save
Application key
.
to be the scopre of the users who will be authenticated.
For AO-VA, specify System.
For AO-SP, specify System if this will be used globally. Else specify a specific organization iii. iv.
Set
Protocol
as Duo v. vi.
Set
IP/Host
as the host name of Duo Security Server from Step 4 in "Obtain keys for FortiSIEM to communicate with
Duo Security"
Set , vii.
Set
Login to FortiSIEM using 2-factor authentication
Before logging in to FortiSIEM with 2-factor authentication, make sure that the three steps are completed.
Obtain keys for FortiSIEM to communicate with Duo Security
Create and Manage FortiSIEM users in Duo Security
Add 2-factor authentication option for FortiSIEM users
Follow these steps
1.
2.
Logon to FortiSIEM normally (first factor) using the credential defined in FortiSIEM - local or external in LDAP
If the 2-factor authentication is enabled, the user will now be redirected to the 2-factor step a. b.
If the user is not created in Duo system (by Duo admin), a setup wizard will let you set some basic information like phone number and ask you download the Duo app.
3.
If the user already exists in FortiSIEM, then follow the authentication method and click
Log in
The user will be able to log in to FortiSIEM
Page 233
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 234
FortiSIEM Installation Guide FortiSIEM Installation Guide
Managing Organizations for Multi-Tenant Deployments
Organizations can be created with or without Collectors. If you are using Collectors in a clustered deployment that includes Workers, please make sure you have followed the instructions in
make sure your Collectors properly upload information to the Workers.
before you have registered your Collectors with the Supervisor in order to
1.
2.
3.
4.
5.
6.
Log in to your Supervisor node as a Super/Global users.
Go to
Admin > Setup Wizard > Organization
.
Click
Add
.
Enter information for the organization.
If your organization uses Collectors, click
Complete the Collector information.
New
under
Collectors.
For
Guaranteed EPS
, enter the events per second from this collector that FortiSIEM will accept. See the topic
End Time
, enter the dates for which the Collector
7.
8. license is valid.
Click
9.
Events per Second (EPS) across Collectors for more information. For
Start Time
and
For
Save
Click
Save
.
.
Max Devices
, enter the maximum number of devices discovered by this collector that the system will accept.
Page 235
FortiSIEM Installation Guide FortiSIEM Installation Guide
Deleting Organizations
1.
2.
3.
4.
5.
6.
Note the
IP Address
and
7.
Log into your Supervisor node as a Super/Global user.
Go to
Admin > Setup Wizard > Organizations
.
Write down the of the organization you want to delete.
Go to
Admin > Collector Health
.
Collector Name
Log out of your Supervisor node.
of any Collectors associated with the organization you want to delete.
SSH into the Collector hosts for the organization as
Using
phTools , stop the Collector processes.
root
.
[root@FortiSIEM]# phtools --stop
8.
9.
10.
11.
Power down the Collector.
Log back into your Supervisor node as an Admin user for the organization you want to delete.
Go to
CMDB > Devices.
Delete all devices in both the
12.
13.
14.
15.
16.
Go to
Go to
Device View
CMDB > Device View > Users
and the
VM View
.
, and delete all users except for the default admin account under which you are currently logged in.
Admin > Setup Wizard > Synthetic Transaction Monitoring
and delete all STM tests.
Log out of your Supervisor node, and then log back in as the Super/Global user.
Go to
Admin > Collector Health.
Delete the organization's Collectors.
Issues with Deleting Collectors Because of In-Memory Processes
You may encounter issues with deleting Collectors if there are processes in memory on the Supervisor that are related to
Collector status that are updated to the CMDB. If you encounter these issues, please contact FortiSIEM Support.
17.
18.
19.
20.
Delete the organization.
Log out of your Supervisor node.
SSH into the Supervisor host machine as root
.
In the
/data
directory, delete the eventdb
database for that organization.
Finding the Right EventDB Database
You can tell which EventDB belongs to the organization you want to delete based on the organization ID that you wrote down
, you would look for
/data/eventdb/CUSTOMER_2005
as the database to delete. Be careful that you don't delete the EventDB for a continuing organization.
Page 236
FortiSIEM Installation Guide FortiSIEM Installation Guide
Dynamic Distribution of Events per Second (EPS) across Collectors
In multi-tenant deployments, the service provider is licensed a certain amount of EPS. The service provider distributes these EPS among the various collectors during collector setup by setting the
Guaranteed EPS
. Because an organization can have multiple collectors, the guaranteed
EPS for an organization is the sum total of guaranteed EPS for all collectors belonging to that organization. This total must be no more than the total EPS licensed to the service provider. The remaining EPS (the difference between the service provider EPS and the total EPS across all collectors), if any, is allocated to the super-local organization, the service provider's core system, if that needs to be monitored. To monitor this system, FortiSIEM recommends creating a new organization to monitor the service's own network, and to install another Collector to monitor that organization.
The redistribution algorithm uses three metrics for each Collector.
Guaranteed
EPS
Defined during
the collector configuration process while setting up an organization
Collector definition.
, FortiSIEM ensures that the collector can
always send EPS at this rate. This is a constant that never changes during the operation of the algorithm, unless you edit the
Incoming
EPS
Allocated
EPS
This is the EPS that the Collector sees. This changes continuously. You can view this metric for a Collector in
Admin >
Collector Health
.
This is the EPS that is currently allocated to the Collector by the redistribution algorithm. You can view this metric for a Collector in Admin > Collector Health.
Each Collector periodically reports Incoming EPS to the Supervisor, which then determines the Allocated EPS and pushes this control down to the collectors. Allocated EPS is set to Guaranteed EPS initially, but if for some Collector, Incoming EPS is greater than Allocated EPS, the Supervisor examines all Collectors and determines excess capacity as sum total of max (0,Allocated - Incoming) for all Collectors. If there is a Collector with excess capacity, its Allocated EPS is reduced and the excess amount is given to the Collector that needs the excess EPS. If the collector that gave up EPS, that is, Allocated EPS is less than Guaranteed EPS, subsequently needs the EPS, then EPS is taken away from the collectors with Allocated greater than Guaranteed and given back. This continuous readjustment is centrally coordinated by the Supervisor node.
Page 237
FortiSIEM Installation Guide FortiSIEM Installation Guide
How Devices are Added to Organizations
When you initiate device discovery for organizations, the way in which those devices are added to organizations depends on whether you are using Collectors in your deployment.
For organizations with Collectors, discovery is carried out by the Collector, and the Collector assigns devices to the organization with which it is associated. If organizations have an overlapping IP range, deploying Collectors and assigning them to a specific IP range and organization will ensure that the device is added to the correct organization.
For organizations without Collectors, discovery is carried out by the Supervisor. In this case, the
Include/Exclude IP Range
you defined when you set up the organization
is used to add the device to the organization.
If a device matches only one defined organization IP Range, then it is assigned to that organization
If a device matches multiple defined IP Ranges, then it is assigned to the Super organization
You can change a device's assigned organization manually, and FortiSIEM will automatically update the Include/Exclude IP Range for that organization. This updated IP range definition will then be used in the next discovery process. However, this may create confusing IP range definitions for the organization, so you may want to re-define the organization's IP range and rediscover devices.
Page 238
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Users to Multi-Tenant Deployments
Two kinds of admin users can be added users belonging to a specific organization or super-local users belonging to super-global
Adding specific organization users
This can be done from the specific organization admin account or from the super global account.
Logon as an appropriate administrator - two possibilities logon as admin user for that organization or logon as super-global and then switch user to that organization
Follow the steps for AO-VA case described
. Note that for Active Directory based discovery, the Active Directory server has to belong to that specific organization. If the Active Directory server belongs to super-local, then the users also belong to super and would not be visible for that organization.
FortiSIEM provides a short-cut to add admin users for multiple organizations in one shot
Logon as super-global
Manually create the user as described in the manual user creation mode here
.
Choose the Default role
Choose the permitted organizations and also override the default role for a specific organization if needed. In the example below, user1 is the Network Admin for every organization but System Admin for O-eng.
Adding super-global users
Super-global users are often need for managing multiple organizations, and can be created from the super-global account. There are two cases depending on whether organizations have collectors or not.
For the organizations-with-collector-only case, users must be created manually.
Logon as super-global
Manually create the user as described in the manual user creation mode here
Choose the Default role
Choose the permitted organizations. Override the default role for each specific organization, if needed. In the example below, user1 is the
Network Admin for every organization but System Admin for O-eng.
For the organizations-without-collector case, if the Active Directory Server belongs to super-local, then the discovered users would be visible from the super-global view and any of these users can be made an FortiSIEM user. In this case the steps are
Logon as super-global
Create the user as described here
- both manual and discovery-based approaches can be used
Choose the Default role
Choose the permitted organizations. And if needed, override the default role for specific organizations. In the example below, user1 is the
Network Admin for every organization but System Admin for O-eng.
Page 239
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Users to Organizations
though if you want to discover users in an Active Directory server over LDAP, the Active Directory server has to belong the organization where you want to add the user.
1. Log in to your Supervisor node either as the Admin user for the organization where you want to add the user, or log in as a Super/Global
2.
3. user to add the user to more than one organization.
Create the user as described in
Adding a Single User , or follow the instructions in
Adding Users from Active Directory via LDAP
.
If you have logged in as the Super/Global user, select the organizations where you want to add the user, overriding any Default Roles for the organization as necessary.
Page 240
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Super/Global Users to Organizations with Collectors
In multi-tenant deployments, you may need to create Super/Global users who have roles within multiple organizations. If your deployments include organizations with collectors, you must add add the users individually.
1.
2.
3.
4.
Log in to your Supervisor node as a Super/Global users.
Create the individual user as described in Adding a Single User , choosing the appropriate
Default Role
.
Select the
Permitted Organizations
the user is allowed to access, overriding any default role settings as necessary.
Click
Save
.
Page 241
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Super/Global Users to Organizations without Collectors
For the organizations-without-collector case, if the Active Directory Server belongs to super-local, then the discovered users would be visible from the super-global view and any of these users can be made an FortiSIEM user. In this case the steps are
Logon as super-global
Create the user as described here
- both manual and discovery-based approaches can be used
Choose the Default role
Choose the permitted organizations. And if needed, override the default role for specific organizations. In the example below, user1 is the
Network Admin for every organization but System Admin for O-eng.
Page 242
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring External Systems for Discovery and Monitoring
This section describes how to configure third party devices for monitoring by FortiSIEM.
Additional Information in the Help Center
You can find additional information about configuring devices, including troubleshooting tips, in the Device Configuration section of the
Help Center maintained by FortiSIEM Support.
Ports Used by FortiSIEM for Discovery and Monitoring
Supported Devices and Applications by Vendor
Configuring FortiSIEM Windows Agent and Agent Manager
Configuring Windows Monitoring
Troubleshooting Windows Agent Manager
Application Server Configuration
Microsoft ASP.NET Configuration
Oracle GlassFish Server Configuration
Authentication Server Configuration
Cisco Access Control Server (ACS) Configuration
Microsoft Internet Authentication Server (IAS) Configuration
Juniper Networks Steel-Belted RADIUS Configuration
CyberArk Password Vault Configuration
Microsoft SQL Server Configuration
SQL Server Database Level Event Creation Script (PH_Database_Level_Events.sql)
SQL Server DDL Event Creation Script (PH_DDL_Server_Level_Events.sql)
SQL Server Table Creation Script (PH_EventDB_Tables_Create.sql)
SQL Server Trigger Creation Script (PH_LogonEventsTrigger.sql)
Oracle Database Server Configuration
DHCP and DNS Server Configuration
Infoblox DNS/DHCP Configuration
Microsoft DHCP (2003, 2008) Configuration
Microsoft DNS (2003, 2008) Configuration
Directory Server Configuration
Microsoft Active Directory Configuration
Document Management Server Configuration
Microsoft SharePoint Configuration
Microsoft Exchange Configuration
Management Server/Appliance Configuration
Fortinet FortiManager Configuration
Citrix Receiver (ICA) Configuration
Unified Communication Server Configuration
Avaya Call Manager Configuration
Cisco Call Manager Configuration
Cisco Contact Center Configuration
Cisco Presence Server Configuration
Cisco Tandeberg Telepresence Video Communication Server (VCS) Configuration
Cisco Telepresence Multipoint Control Unit (MCU) Configuration
Cisco Telepresence Video Communication Server Configuration
Cisco Unity Connection Configuration
Apache Web Server Configuration
Microsoft IIS for Windows 2000 and 2003 Configuration
Microsoft IIS for Windows 2008 Configuration
Nginx Web Server Configuration
Cisco UCS Server Configuration
Page 243
FortiSIEM Installation Guide
Configuring Cloud Applications
AWS Access Key IAM Permissions and IAM Policies
AWS CloudTrail API Configuration
AWS EC2 CloudWatch API Configuration
Cisco FireAMP Cloud Configuration
Microsoft Azure AuditTrail Configuration
Salesforce CRM Audit Configuration
Configuring Console Access Devices
Lantronix SLC Console Manager Configuration
Configuring End point Security Software
Bit9 Security Platform Configuration
Cisco Security Agent (CSA) Configuration
ESET NOD32 Anti-Virus Configuration
McAfee ePolicy Orchestrator (ePO) Configuration
Sophos Endpoint Security and Control Configuration
Symantec Endpoint Protection Configuration
Trend Micro Intrusion Defense Firewall (IDF) Configuration
Trend Micro OfficeScan Configuration
Configuring Environmental Sensors
APC Netbotz Environmental Monitor Configuration
Check Point FireWall-1 Configuration
Check Point Provider-1 Firewall Configuration
Configuring MDS for Check Point Provider-1 Firewalls
Configuring MLM for Check Point Provider-1 Firewalls
Configuring CMA for Check Point Provider-1 Firewalls
Configuring CLM for Check Point Provider-1 Firewalls
Check Point VSX Firewall Configuration
Cisco Adaptive Security Appliance (ASA) Configuration
Dell SonicWALL Firewall Configuration
Fortinet FortiGate Firewall Configuration
Juniper Networks SSG Firewall Configuration
McAfee Firewall Enterprise (Sidewinder) Configuration
Palo Alto Firewall Configuration
WatchGuard Firebox Firewall Configuration
Configuring Load Balancers and Application Firewalls
Brocade ServerIron ADX Configuration
Citrix Netscaler Application Delivery Controller (ADC) Configuration
F5 Networks Application Security Manager
F5 Networks Local Traffic Manager Configuration
Qualys Web Application Firewall
Configuring Network Compliance Management Applications
Cisco Network Compliance Manager Configuration
Configuring Intrusion Protection Systems (IPS)
AirTight Networks SpectraGuard
Cisco Intrusion Protection System Configuration
Cylance Protect Endpoint Protection
Cyphort Cortex Endpoint Protection
FireEye Malware Protection System (MPS)
IBM Internet Security Series Proventia Configuration
Juniper DDoS Secure Configuration
Juniper Networks IDP Series Configuration
McAfee IntruShield Configuration
Motorola AirDefense Configuration
Snort Intrusion Protection System Configuration
Sourcefire 3D and Defense Center Configuration
TippingPoint Intrusion Protection System Configuration
Configuring Routers and Switches
Page 244
FortiSIEM Installation Guide
FortiSIEM Installation Guide
Alcatel TiMOS and AOS Switch Configuration
Arista Router and Switch Configuration
Cisco IOS Router and Switch Configuration
How CPU and Memory Utilization is Collected for Cisco IOS
Cisco Meraki Cloud Controller and Network Devices Configuration
Cisco NX-OS Router and Switch Configuration
Dell Force10 Router and Switch Configuration
Dell NSeries Switch Configuration
Dell PowerConnect Switch and Router Configuration
Foundry Networks IronWare Router and Switch Configuration
HP/3Com ComWare Switch Configuration
HP ProCurve Switch Configuration
HP Value Series (19xx) and HP 3Com (29xx) Switch Configuration
Juniper Networks JunOS Switch Configuration
Nortel ERS and Passport Switch Configuration
Barracuda Networks Spam Firewall Configuration
Blue Coat Web Proxy Configuration
Cisco IronPort Mail Gateway Configuration
McAfee Web Gateway Configuration
Microsoft ISA Server Configuration
Websense Web Filter Configuration
IBM OS400 Server Configuration
Microsoft Windows Server Configuration
Sun Solaris Server Configuration
Brocade SAN Switch Configuration
Dell Compellant Storage Configuration
Dell EqualLogic Storage Configuration
EMC Clarion Storage Configuration
EMC Isilon Storage Configuration
NetApp Filer Storage Configuration
Cisco VPN 3000 Gateway Configuration
Juniper Networks SSL VPN Gateway Configuration
Microsoft PPTP VPN Gateway Configuration
Configuring Vulnerability Scanners
McAfee Foundstone Vulnerability Scanner Configuration
Nessus Vulnerability Scanner Configuration
Qualys Vulnerability Scanner Configuration
Rapid7 NeXpose Vulnerability Scanner Configuration
Cisco Wide Area Application Server Configuration
Riverbed SteelHead WAN Accelerator Configuration
Aruba Networks Wireless LAN Configuration
Cisco Wireless LAN Configuration
Motorola WiNG WLAN AP Configuration
Ruckus Wireless LAN Configuration
Using Virtual IPs to Access Devices in Clustered Environments
Page 245
FortiSIEM Installation Guide
FortiSIEM Installation Guide
Ports Used by FortiSIEM for Discovery and Monitoring
These ports are used by FortiSIEM to discover devices, pull metrics and process event logs.
TCP/7936
TCP/7938
TCP/7940
TCP/110
TCP/135
TCP/143
UDP/161
UDP/162
TCP/389
TCP/443
TCP/993
TCP/7920
TCP/7922
TCP/7924
TCP/7926
TCP/7928
TCP/7930
TCP/7932
TCP/7934
TCP/995
TCP/1433
UDP/8686
TCP/18184
TCP/18190
Ports
UDP/514
TCP/1470
UDP/6514
TCP/6514
UDP/2055
TCP/22
Services
UDP syslog
TCP syslog
UDP syslog over TLS
TCP syslog over TLS netflow ssh
TCP/5480
ICMP
TCP/21
HTTP Registration
FTP (Receiving Bluecoat logs via ftp) x x
TCP/5432 postgresql
UDP/111, TCP/111 NFS portmapper
TCP/7900
TCP/7914
TCP/7916
TCP/7918 phMonitor phParser phQueryWorker phQueryMaster x x x x x x x x x x x
Super Worker Collector
x x x x x x x x x x x x x x x x x x x x x x x phDataManager phRuleMaster phRuleWorker phAgentManager phDiscover phCheckpoint phReportWorker phReportMaster phEventPackager phIpIdentityMaster phIpIdentityWorker
POP3
WMI
IMAP
SNMP
SNMP TRAP
LDAP
HTTPS
IMAP/SSL
POP/SSL
JDBC
JMX
Checkpoint LEA
Checkpoint CPMI Port x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x
Page 246
FortiSIEM Installation Guide
FortiSIEM Installation Guide FortiSIEM Installation Guide
Aruba
Networks
Aruba
Networks
Avaya
Avaya
Barracuda
Networks
Bit9
Supported Devices and Applications by Vendor
Vendor
AirTight
Networks
Alcatel
Alcatel
Alertlogic
Amazon
Amazon
Amazon
Amazon
Apache
Apache
APC
APC
Arista
Networks
Aruba
Networks
Model
SpectraGuard
TiMOS Routers and
Switches
AOS Routers and
Switches
Discovery
Overview
Discovered via
LOG only
SNMP: OS,
Hardware
SNMP: OS,
Hardware
Performance Monitoring Overview
Not natively supported - Custom monitoring needed
SNMP: CPU, memory, interface utilization, hardware status
SNMP: CPU, memory, interface utilization, hardware status
Log Analysis Overview
CEF format: Over 125 event types parsed covering various
Wireless suspicious activities
Not natively supported - Custom parsing needed
Configuration
Change monitoring
Currently not natively supported
Currently not natively supported
Not natively supported - Custom parsing needed
Currently not natively supported
Details
IPS
AWS Servers
AWS Elastic Block
Storage (EBS)
Discovered via
LOG only
AWS API: Server
Name, Access IP,
Instance ID,
Image Type,
Availability Zone
CloudWatch API:
Volume ID,
Status, Attach
Time
Currently not natively supported
CloudWatch API: System Metrics: CPU,
Disk I/O, Network
CloudWatch API: Read/Write Bytes, Ops,
Disk Queue
AlertLogic API - Snort event types
CloudTrail API: Over 325 event types parsed covering various
AWS activities
AWS Relational
Database Storage
(RDS)
Elastic Load
Balancer (ELB)
Tomcat Application
Server
Apache Web server
JMX: Version
SNMP: Process name
NetBotz
Environmental
Monitor
UPS
SNMP: Host name, Hardware model, Network interfaces
SNMP: Host name, Hardware model, Network interfaces
SNMP: OS,
Hardware
Routers and
Switches
SSH: configuration, running processes
Aruba Wireless LAN SNMP: Controller
OS, hardware,
Access Points
ClearPass Policy
Manager
Switches
Call Manager
Session Manager
Spam Firewall
Security platform
CloudWatch API: CPU, Connections,
Memory, Swap, Read/Write Latency and
Ops
Currently not natively supported
JMX: CPU, memory, servlet, session, database, threadpool, request processor metrics
SNMP: process level cpu, memory
HTTPS via the mod-status module:
Apache level metrics
SNMP: Temperature, Relative Humidity,
Airflow, Dew point, Current, Door switch sensor etc.
SNMP: UPS metrics
SNMP: CPU, Memory, Interface utilization,
Hardware Status
HTTP(S) Access logs -
Management logs - Covered via
CloudTrail API
Currently not natively supported
- Custom parsing needed
Syslog: W3C formatted access logs - per HTTP(S) connection:
Sent Bytes, Received Bytes,
Connection Duration
SNMP Trap: Over 125 SNMP
Trap event types parsed covering various environmental exception conditions
SNMP Trap: Over 49 SNMP
Trap event types parsed covering various environmental exception conditions
Syslog and NetFlow
SNMP: Controller CPU, Memory, Interface utilization, Hardware Status
SNMP: Access Point Wireless Channel utilization, noise metrics, user count
Currently not natively supported
SNMP Trap: Over 165 event types covering Authentication,
Association, Rogue detection,
Wireless IPS events
Discovery via
LOG
SNMP: OS,
Hardware
SNMP: OS,
Hardware
SNMP: OS,
Hardware
Application type discovery via LOG
Application type discovery via LOG
SNMP: Uptime, Interface utilization
SNMP: CPU, Memory, Interface utilization,
Hardware Status
SNMP: CPU, Memory, Interface utilization,
Hardware Status
Currently not natively supported
Currently not natively supported
Syslog: Successful and failed
AAA authentication, warnings and errors
Currently not natively supported
- Custom parsing needed
CDR: Call Records
Syslog: Over 20 event types covering mail scanning and filtering activity
Syslog: Over 259 event types covering various file monitoring activities
Currently not natively supported
CloudTrail API: various administrative changes on AWS systems and users
Covered via
CloudTrail API
Currently not natively supported
Currently not natively supported
Currently not natively supported
Currently not natively supported
SSH: Running config, Startup config
Currently not natively supported
Currently not natively supported
Currently not natively supported
Currently not natively supported
Currently not natively supported
Currently not natively supported
Currently not natively supported
Page 247
FortiSIEM Installation Guide FortiSIEM Installation Guide
Bit9
Blue Coat
Box.com
Brocade
Brocade
CentOS / Other
Linux distributions
CentOS / Other
Linux distributions
Checkpoint
DHCP Server
Checkpoint
Checkpoint
FireWall-1 versions
NG, FP1, FP2, FP3,
AI R54, AI R55, R65,
R70, R77, NGX, and
R75
Provider-1 versions
NG, FP1, FP2, FP3,
AI R54, AI R55, R65,
R70, R77, NGX, and
R75
VSX
Citrix
Citrix
Cisco
Cisco
Cisco
Carbon Black
Security Gateway Ve rsions v4.x and later
Cloud Storage
SAN Switch
ServerIron ADX switch
Linux
NetScaler
Application Delivery
Controller
ICA
ASA Firewall (single and multi-context) version 7.x and later
PIX Firewall
FWSM
Currently not natively supported
SNMP: OS,
Hardware
SNMP: OS,
Hardware
SNMP: Process
Utilization
SNMP: OS,
Hardware
SSH: interface security level needed for parsing traffic logs,
Configuration
SNMP: OS,
Hardware
SSH: interface security level needed for parsing traffic logs,
Configuration
SNMP: OS,
Hardware
SSH: interface security level needed for parsing traffic logs,
Configuration
Currently not natively supported
SNMP: OS,
Hardware
Currently not natively supported
SNMP: OS,
Hardware
SNMP: Host name, serial number, hardware
SNMP: OS,
Hardware,
Software,
Processes, Open
Ports
SSH: Hardware details, Linux distribution
Currently not natively supported
SNMP: CPU, Memory, Interface utilization,
Proxy performance metrics
Currently not natively supported
SNMP: CPU, Memory, Interface utilization Currently not natively supported Currently not natively supported
SNMP: Uptime, CPU, Memory, Interface
Utilization, Hardware status, Real Server
Statistics
SNMP: CPU, Memory, Disk, Interface utilization, Process monitoring, Process stop/start, Port up/down
SSH: Disk I/O, Paging
Syslog: File monitoring watch list hit
Syslog: Admin access to
Security Gateway
Currently not natively supported
Currently not natively supported
SFTP: Proxy traffic analysis
Box.com API: File creation, deletion, modify, file sharing
Syslog: Situations covering
Authentication Success/Failure,
Privileged logons, User/Group
Modification
SSH: File integrity monitoring,
Command output monitoring,
Target file monitoring
Currently not natively supported
SSH: File integrity monitoring, Target file monitoring
Agent: File integrity monitoring
Currently not natively supported
SNMP: OS,
Hardware
Currently not natively supported
AccelOps LinuxFileMon Agent:
File integrity monitoring
Syslog: DHCP activity (Discover,
Offer, Request, Release etc) -
Used in Identity and Location
SNMP: CPU, Memory, Interface utilization LEA from SmartCenter or Log
Server: Firewall Log, Audit trail, over 940 IPS Signatures
Not Applicable
LEA: Firewall Audit trail
Currently not natively supported LEA: Firewall Log, Audit trail
SNMP: CPU, Memory, Interface utilization LEA from SmartCenter or Log
SNMP: CPU, Memory, Interface utilization,
Hardware Status, Application Firewall metrics
SNMP: Process Utilization
WMI: ICA Session metrics
SNMP: CPU, Memory, Interface utilization,
Firewall Connections, Hardware Status
SNMP: CPU, Memory, Interface utilization,
Connections, Hardware Status
SNMP: CPU, Memory, Interface utilization,
Connections, Hardware Status
Server: Firewall Log, Audit trail
Syslog: Over 465 event types covering admin activity, application firewall events, health events
Syslog: Over 1600 event types parsed for situations covering admin access, configuration change, traffic log, IPS activity
NetFlow V9: Traffic log
Syslog: Over 1600 event types parsed for situations covering admin access, configuration change, traffic log, IPS activity
Syslog: Over 1600 event types parsed for situations covering admin access, configuration change, traffic log, IPS activity
LEA: Firewall Audit trail
LEA: Firewall Audit trail
Currently not natively supported
Currently not natively supported Currently not natively supported
SSH: Running config, Startup config
SSH: Running config, Startup config
SSH: Running config, Startup config
Check Point
Provider-1
Page 248
FortiSIEM Installation Guide
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
FortiSIEM Installation Guide
IOS based Routers and Switches
SNMP: OS,
Hardware
SSH: configuration, running process,
Layer 2 connectivity
SNMP: CPU, Memory, Interface utilization,
Hardware Status
SNMP: IP SLA metrics
SNMP: BGP metrics, OSPF metrics
Syslog: Over 200 event types parsed for situations covering admin access, configuration change, interface up/down, BGP interface up/down, traffic log,
IPS activity
SSH: Running config, Startup config
CatOS based
Switches
Nexus OS based
Routers and
Switches
Tandeberg
Tele-presence Video
Communication
Server (VCS)
Tandeberg
Tele-presence
Multiple Control Unit
(MCU)
Unity Connection
IronPort Mail
Gateway
SNMP: OS,
Hardware (Serial
Number, Image file, Interfaces,
Components)
SSH: configuration running process
SNMP: OS,
Hardware
SSH: configuration running process,
Layer 2 connectivity
SNMP: OS,
Hardware
SNMP: OS,
Hardware
SNMP: OS,
Hardware
SNMP: Class based QoS metrics
SNMP: NBAR metrics
SNMP: CPU, Memory, Interface utilization,
Hardware Status
SNMP: CPU, Memory, Interface utilization,
Hardware Status
SNMP: IP SLA metrics, BGP metrics,
OSPF metrics, NBAR metrics
SNMP: Class based QoS metrics
SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change
SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change
SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change
NetFlow V5, V9: Traffic logs
Syslog: Over 700 event types parsed for situations covering admin access, configuration change, interface up/down, BGP interface up/down, traffic log,
IPS activity
NetFlow V5, V9: Traffic logs
Syslog: Over 3500 event types parsed for situations covering admin access, configuration change, interface up/down, BGP interface up/down, traffic log, hardware status, software and hardware errors
ONS
ACE Application
Firewall
UCS Server
WLAN Controller and
Access Points
SNMP: OS,
Hardware
SNMP: OS,
Hardware
UCS API:
Hardware components processors, chassis, blades, board, cpu, memory, storage, power supply unit, fan unit
SNMP: OS,
Hardware, Access
Points
UCS API: Chassis Status, Memory Status,
Processor Status, Power Supply status,
Fan status
Call Manager
Contact Center
Presence Server
SNMP: OS,
Hardware, VoIP
Phones
SNMP: OS,
Hardware
SNMP: OS,
Hardware
SNMP: OS,
Hardware
NetFlow V5, V9: Traffic logs
SNMP Trap: Availability and
Performance Alerts
Syslog: Over 500 event types parsed for situations covering hardware errors, internal software errors etc
SNMP: Controller CPU, Memory, Interface utilization, Hardware Status
SNMP: Access Point Wireless Channel utilization, noise metrics, user count
SNMP: Call manager CPU, Memory, Disk
Interface utilization, Hardware Status,
Process level resource usage
SNMP Trap: Over 88 event types parsed for situations covering Authentication,
Association, Rogue detection,
Wireless IPS events
Syslog: Over 950 messages from Cisco Call Manager as well as Cisco Unified Real Time
Monitoring Tool (RTMT)
SNMP: VoIP phone count, Gateway count,
Media Device count, Voice mail server count and SIP Trunks count
CDR Records, CMR Records:
Call Source and Destination,
Time, Call Quality metrics (MOS
Score, Jitter, latency) SNMP: SIP Trunk Info, Gateway Status
Info, H323 Device Info, Voice Mail Device
Info, Media Device Info, Computer
Telephony Integration (CTI) Device Info
SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change
SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change
SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change
Currently not natively supported
- Custom parsing needed
Currently not natively supported
- Custom parsing needed
Currently not natively supported
- Custom parsing needed
Currently not natively supported
- Custom parsing needed
Currently not natively supported
- Custom parsing needed
Syslog: Over 45 event types covering mail scanning and forwarding status
SSH: Running config, Startup config
SSH: Running config, Startup config
Currently not natively supported
Currently not natively supported
Currently not natively supported
Currently not natively supported
Currently not natively supported
Currently not natively supported
Currently not natively supported
Currently not natively supported
Currently not natively supported
Page 249
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Cisco
Dell
Dell
Dell
Dell
Cylance
Cyphort
Dell
Dell
IronPort Web
Gateway
Cisco Network IPS
Appliances
Sourcefire 3D and
Defense Center
SNMP: OS,
Hardware
SNMP: OS,
Hardware
SNMP: OS,
Hardware
SNMP: CPU, Memory, Disk Interface utilization, Hardware Status, Process level resource usage, Install software change
SNMP: CPU, Memory, Disk Interface utilization, Hardware Status
W3C Access log (Syslog): Over
9 event types covering web request handling status
SDEE: Over 8000 IPS signatures
Currently not natively supported
Currently not natively supported
FireSIGHT Console
Cisco Security Agent SNMP or WMI:
Cisco Access
Control Server (ACS)
VPN 3000
Meraki Cloud
Controllers
Meraki Firewalls
OS, Hardware
SNMP or WMI:
OS, Hardware
SNMP: OS,
Hardware
SNMP: OS,
Hardware, Meraki devices reporting to the Cloud
Controller
SNMP: OS,
Hardware
SNMP or WMI: Process CPU and memory utilization eStreamer SDK: Intrusion events, Malware events, File events, Discovery events, User activity events, Impact flag events
SNMP Trap: Over 25 event types covering Host IPS behavioral signatures.
SNMP or WMI: Process CPU and memory utilization
Syslog: Passed and Failed authentications, Admin accesses
SNMP: CPU, Memory, Interface utilization Syslog: Successful and Failed
Admin Authentication, VPN
Authentication, IPSec Phase 1 and Phase 2 association, VPN statistics
SNMP: Uptime, Network Interface
Utilization
Currently not natively supported
- Custom parsing needed
SNMP Trap: Various availability scenarios
SNMP: Uptime, Network Interface
Utilization
Syslog: Firewall log analysis
Currently not natively supported
Currently not natively supported
Currently not natively supported
Currently not natively supported
Meraki
Routers/Switches
Meraki WLAN
Access Points
SNMP: OS,
Hardware
SNMP: OS,
Hardware
SNMP: Uptime, Network Interface
Utilization
SNMP: Uptime, Network Interface
Utilization
Currently not natively supported
Currently not natively supported
Currently not natively supported
MDS Storage Switch SNMP: OS,
Network Control
Manager (NCM)
Wide Area
Application Services
(WAAS)
Cylance Protect
Endpoint Protection
Cyphort Cortex
Endpoint Protection
SonicWall Firewall
Force10 Router and
Switch
NSeries Router and
Switch
PowerConnect
Router and Switch
Dell Hardware on
Intel-based Servers
Hardware
SNMP: Host name, Version,
Hardware model,
Network interfaces
SNMP: CPU, Memory, Interface utilization,
Disk utilization, Process cpu/memory utilization
SNMP: OS,
Hardware
SNMP: OS,
Hardware
SNMP: CPU, Memory, Interface utilization,
Firewall session count
SNMP: CPU, Memory, Interface utilization,
Interface Status, Hardware Status
Syslog: Endpoint protection alerts
Syslog: Endpoint protection alerts
Syslog: Firewall log analysis
(over 1000 event types)
SNMP: OS,
Hardware
SNMP: OS,
Hardware
Compellent Storage SNMP: OS,
Hardware
SNMP: CPU, Memory, Interface utilization,
Hardware Status
SNMP: CPU, Memory, Interface utilization,
Hardware Status
SNMP: CPU, Memory, Interface utilization,
Hardware Status
SNMP: Hardware SNMP: Hardware Status: Battery, Disk,
Memory, Power supply, Temperature,
Fan, Amperage, Voltage
SNMP: Network Interface utilization,
Volume utilization, Hardware Status
(Power, Temperature, Fan)
Currently not natively supported
- Custom parsing needed
Syslog: Network device software update, configuration analysis for compliance, admin login
Currently not natively supported
Currently not natively supported
SSH: Running config, Startup config
SSH: Startup config
SSH: Startup config
Currently not natively supported.
Currently not natively supported.
Page 250
FortiSIEM Installation Guide
Dell
EMC
EMC
EMC
EMC
ESET
FortiSIEM Installation Guide
EqualLogic Storage
Clariion Storage
SNMP: OS,
Hardware
(Network interfaces,
Physical Disks,
Components)
SNMP: Uptime, Network Interface utilization
SNMP: Hardware status: Disk, Power supply, Temperature, Fan, RAID health
:
disk count, Active disk count, Failed disk count, Spare disk count
SNMP: Connection metrics: IOPS,
Throughput
SNMP: Disk performance metrics: IOPS,
Throughput
Naviseccli: Host name, Operating system version,
Hardware model,
Serial number,
Network interfaces,
Installed Software,
Storage Controller
Ports
SNMP: Group level performance metrics:
Storage, Snapshot
Naviseccli: Storage Processor utilization,
Storage Port I/O, RAID Group I/O, LUN
I/O, Host HBA Connectivity, Host HBA
Unregistered Host, Hardware component health, Overall Disk health, Storage Pool
Utilization
VNX Storage
Isilon Storage
Naviseccli:
Hardware components,
RAID Groups and assigned disks,
LUNs and LUN ->
RAID Group mappings,
Storage Groups and memberships
Naviseccli: Host name, Operating system version,
Hardware model,
Serial number,
Network interfaces,
Installed Software,
Storage Controller
Ports
Naviseccli: Storage Processor utilization,
Storage Port I/O, RAID Group I/O, LUN
I/O, Host HBA Connectivity, Host HBA
Unregistered Host, Hardware component health, Overall Disk health, Storage Pool
Utilization
Naviseccli:
Hardware components,
RAID Groups and assigned disks,
LUNs and LUN ->
RAID Group mappings,
Storage Groups and memberships
SNMP: Host name, Operating system, Hardware
(Model, Serial number, Network interfaces,
Physical Disks,
Components)
SNMP: Uptime, Network Interface metrics
SNMP: Hardware component health: Disk,
Power supply, Temperature, Fan, Voltage
SNMP: Cluster membership change, Node health and performance (CPU, I/O),
Cluster health and performance, Cluster
Snapshot, Storage Quota metrics, Disk performance, Protocol performance
Data Domain
Nod32 Anti-virus
SNMP: Host name, Operating system, Hardware
(Model, Serial number, Network interfaces,
Physical Disks
SNMP: Interface utilization, Hardware
Status
SNMP: Overall Storage metrics: replication metrics, disk I/O, NFS metrics,
CIFS metrics
SNMP: Individual disk metrics: disk I/O, disk utilization, disk status
Application type discovery via LOG
Currently not natively supported
- Custom parsing needed
Syslog (CEF format): Virus found/cleaned type of events
Currently not natively supported.
Currently not natively supported.
Page 251
FortiSIEM Installation Guide FortiSIEM Installation Guide
FireEye
FireEye
F5 Networks
F5 Networks
F5 Networks
Fortinet
Fortinet
Fortinet
Fortinet
Fortinet
Foundry
Networks
Malware Protection
System (MPS)
HX Appliances for
Endpoint protection
Application Security
Manager
Local Traffic
Manager
Web Accelerator
FortiGate firewalls
FortiManager
FortiMail
FortiWeb
FortiSandbox
IronWare Router and
Switch
Application type discovery via LOG
Application type discovery via LOG
Discovery via
LOG
SNMP: Host name, Operating system, Hardware
(Model, Serial number, Network interfaces,
Physical Disks),
Installed Software,
Running Software
Discovery via
LOG
SNMP: OS, Host name, Hardware
(Serial Number,
Interfaces,
Components)
SNMP: Host name, Hardware model, Network interfaces,
Operating system version
Discovery via
LOG
SNMP: CPU, Memory, Disk, Interface utilization, Process monitoring, Process stop/start
SNMP: Uptime, CPU and Memory utilization, Network Interface metrics
SNMP: Uptime, CPU and Memory utilization, Network Interface metrics
Currently not supported
SNMP: OS, Host name, Hardware
(Serial Number,
Interfaces)
SNMP: OS, Host name, Hardware
(Serial Number,
Interfaces)
SNMP: OS,
Hardware
SSH: configuration, running process
SNMP: Uptime, CPU and Memory utilization, Network Interface metrics
SNMP: Uptime, CPU and Memory utilization, Network Interface metrics, Disk
Syslog: Over 120 event types covering admin logons, configuration changes, restarts, operational errors, malware and virus, spam
Syslog: Over 450 event types covering admin logons, configuration changes, restarts, operational errors, Web attacks,
HTTP Protocol anomaly
Syslog: Event types covering malware, network attacks and system events
Currently not natively supported
Currently not natively supported
Currently not natively supported
SNMP: Uptime, CPU, Memory, Interface utilization, Hardware Status
Syslog (CEF format): Malware found/cleaned type of events
Syslog (CEF format): Malware
Acquisition, Containment type of events
Syslog (CEF Format); Various application level attack scenarios - invalid directory access, SQL injections, cross site exploits
SNMP Trap: Exception situations including hardware failures, certain security attacks,
Policy violations etc
Syslog: Permitted and Denied
Traffic
Syslog: Permitted Traffic
Syslog: Over 3700 Traffic and system logs
Syslog: Over 6000 event types parsed for situations covering admin access, configuration change, interface up/down
SSH: Running config, Startup config
SSH: Running config, Startup config
FreeBSD
Huawei VRP Router and
Switch
SSH: Running config, Startup config
HP
HP
BladeSystem
HP-UX servers
SNMP: OS,
Hardware
SSH: configuration, running process,
Layer 2 connectivity
SNMP: Host name, Access IP,
Hardware components
SNMP: OS,
Hardware
SNMP: Uptime, CPU, Memory, Interface utilization, Hardware Status
SNMP: hardware status
SNMP: Uptime, CPU, Memory, Network
Interface, Disk space utilization, Network
Interface Errors, Running Process Count,
Running process CPU/memory utilization,
Running process start/stop
SNMP: Installed Software change
SSH : Memory paging rate, Disk I/O utilization
Syslog: Over 30 event types parsed for situations covering admin access, configuration change, interface up/down
Page 252
FortiSIEM Installation Guide FortiSIEM Installation Guide
HP
HP
HP
HP
HP
HP
IBM
IBM
IBM
IBM
IBM
IBM
Intel/McAfee
Intel/McAfee
Intel/McAfee
Intel/McAfee
HP Hardware on
Intel-based Servers
TippingPoint
UnityOne IPS
ProCurve Switches and Routers
Value Series (19xx)
Switches and
Routers
3Com (29xx)
Switches and
Routers
HP/3Com Comware
Switches and
Routers
Websphere
Application Server
DB2 Database
Server
ISS Proventia IPS
Appliances
AIX Servers
SNMP: hardware model, hardware serial, hardware components (fan, power supply, battery, raid, disk, memory)
SNMP: OS,
Hardware
SNMP: OS, hardware model, hardware serial, hardware components
SSH: configuration
SNMP: OS, hardware model, hardware serial, hardware components
SSH: configuration
SNMP: OS, hardware model, hardware serial, hardware components
SSH: configuration
SNMP: OS, hardware model, hardware serial, hardware components
SSH: configuration
SNMP or WMI:
Running processes
SNMP or WMI:
Running processes
SNMP: hardware status
SNMP: Uptime, CPU, Memory, Network
Interface, Network Interface Errors
SNMP: Uptime, CPU, Memory, Network
Interface, Network Interface Errors
SNMP: hardware status
SNMP: Uptime, CPU, Memory, Network
Interface, Network Interface Errors
SNMP: Uptime, CPU, Memory, Network
Interface, Network Interface Errors
SNMP: Uptime, CPU, Memory, Network
Interface, Network Interface Errors
SNMP: hardware status
HTTP(S): Generic Information, Availability metrics, CPU / Memory metrics, Servlet metrics, Database pool metrics, Thread pool metrics, Application level metrics,
EJB metrics
JDBC: Database Audit trail: Log on,
Database level and Table level
CREATE/DELETE/MODIFY operations
SNMP Trap: Over 100 traps covering hardware issues
Syslog: Over 4900 IPS alerts directly or via NMS
Syslog: Over 6000 vent types parsed for situations covering admin access, configuration change, interface up/down and other hardware issues and internal errors
SNMP: OS,
Hardware,
Installed Software,
Running
Processes, Open
Ports
SNMP: CPU, Memory, Disk, Interface utilization, Process monitoring, Process stop/start, Port up/down
SSH: Disk I/O, Paging
SNMP Trap: IPS Alerts: Over
3500 event types
Syslog: General logs including
Authentication Success/Failure,
Privileged logons, User/Group
Modification
SSH: Running config, Startup config
SSH: Startup config
SSH: Startup config
SSH: Startup config
SSH: Hardware details
OS 400
Guardium Database
Firewall
McAfee Sidewinder
Firewall
McAfee ePO
Intrushield IPS
SNMP: OS,
Hardware,
Installed Software,
Running
Processes
SNMP: Related process name and parameters
SNMP: OS,
Hardware
SNMP: CPU, Memory, Disk, Interface utilization, Process monitoring, Process stop/start
SNMP: Process resource utilization
SNMP: Hardware status
Stonesoft IPS
Syslog via PowerTech Agent:
Over 560 event types
Syslog: Firewall logs
SNMP Trap: Over 170 event types
Syslog: IPS Alerts
Syslog: IPS Alerts
Page 253
FortiSIEM Installation Guide FortiSIEM Installation Guide
Intel/McAfee
Intel/McAfee
Web Gateway
Foundstone
Vulnerability Scanner
Syslog: Web server log
JDBC: Vulnerability data
Infoblox
ISC
Juniper
Juniper
Juniper
Juniper
Juniper
Juniper
Juniper
Juniper
Lantronix
Liebert
Liebert
Liebert
DNS/DHCP
Appliance
Bind DNS
JunOS
Router/Switch
SRX Firewalls
SSG Firewall
ISG Firewall
SNMP: OS,
Hardware,
Installed Software,
Running
Processes
SNMP: Zone transfer metrics, DNS
Cluster Replication metrics, DNS
Performance metrics, DHCP Performance metrics, DDNS Update metrics, DHCP subnet usage metrics
SNMP: Hardware Status
SNMP Trap: Hardware/Software Errors
Syslog: DNS logs - name resolution activity - success and failures
SNMP: OS,
Hardware
SSH:
Configuration
SNMP: OS,
Hardware
SSH:
Configuration
SNMP: OS,
Hardware
SSH:
Configuration
SNMP: OS,
Hardware
SSH:
Configuration
Steelbelted RADIUS Discovered via
LOG
SNMP: CPU, Memory, Disk, Interface utilization, Hardware Status
SNMP: CPU, Memory, Disk, Interface utilization, Hardware Status
SNMP: CPU, Memory, Disk, Interface utilization, Hardware Status
SNMP: CPU, Memory, Disk, Interface utilization, Hardware Status
Syslog: DNS logs - name resolution activity - success and failures
Syslog: Over 1420 event types parsed for situations covering admin access, configuration change, interface up/down and other hardware issues and internal errors
Syslog: Over 700 event types parsed for situations covering traffic log, admin access, configuration change, interface up/down and other hardware issues and internal errors
Syslog: Over 40 event types parsed for situations covering traffic log, admin access, configuration change, interface up/down and other hardware issues and internal errors
Syslog: Over 40 event types parsed for situations covering traffic log, admin access, configuration change, interface up/down and other hardware issues and internal errors
Syslog - 4 event types covering admin access and AAA authentication
SSH: Startup configuration
SSH: Startup configuration
SSH: Startup configuration
SSH: Startup configuration
Secure Access
Gateway
Netscreen IDP
DDoS Secure
SLC Console
Manager
HVAC
SNMP: OS,
Hardware
SNMP: CPU, Memory, Disk, Interface utilization
Syslog - Over 30 event types parsed for situations covering
VPN login, Admin access,
Configuration Change
Syslog - directly from Firewall or via NSM - Over 5500 IPS Alert types parsed
Syslog - DDoS Alerts
Syslog - Admin access,
Updates, Commands run
FPC
UPS
SNMP: Host
Name, Hardware model
SNMP: Host
Name, Hardware model
SNMP: Host
Name, Hardware model
SNMP: HVAC metrics: Temperature: current value, upper threshold, lower threshold, Relative Humidity: current value, upper threshold, lower threshold,
System state etc
SNMP: Output voltage (X-N, Y-N, Z-N),
Output current (X, Y. Z), Neutral Current,
Ground current, Output power, Power
Factor etc
SNMP: UPS metrics: Remaining battery charge, Battery status, Time on battery,
Estimated Seconds Remaining, Output voltage etc
Malwarebytes Endpoint Protection Syslog (CEF format): Malware detected, quarantine success and failures
Liebert HVAC
Liebert UPS
Page 254
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft
Microsoft
Microsoft
Microsoft
Microsoft
Microsoft
Microsoft
Windows 2000,
Windows 2003,
Windows 2008,
Windows 2008 R2,
Windows 2012,
Windows 2012 R2
DHCP Server - 2003,
2008
SNMP: OS,
Hardware (for Dell and HP), Installed
Software, Running
Processes
SNMP: CPU, Memory, Disk, Interface utilization, Process utilization
WMI: SNMP: CPU, Memory, Disk,
Interface utilization, Detailed CPU/Memory usage, Detailed Process utilization
WMI: OS,
Hardware (for Dell and HP), BIOS,
Installed Software,
Running
Processes,
Services, Installed
Patches
SNMP: Running
Processes
WMI: DHCP metrics: request rate, release rate, decline rate, Duplicate Drop rate etc
DNS Server - 2003,
2008
SNMP: Running
Processes
WMI: DNS metrics: Requests received,
Responses sent, WINS requests received,
WINS responses sent, Recursive DNS queries received etc
WMI pulling: Security, System and Application logs
AccelOps Windows Agent
(HTTPS): Security, System and
Application logs, File Content change
Snare Agent (syslog): Security,
System and Application logs
Correlog Agent (syslog):
Security, System and
Application logs
AccelOps Windows Agent
(HTTPS): DHCP logs - release, renew etc
Snare Agent (syslog): DHCP logs - release, renew etc
Correlog Agent (syslog): DHCP logs - release, renew etc
AccelOps Windows Agent
(HTTPS): DNS logs - name resolution activity
Snare Agent (syslog): DNS logs
- name resolution activity
Correlog Agent (syslog): DNS logs - name resolution activity
Domain Controller /
Active Directory -
2003, 2008, 2012
SNMP: Running
Processes
LDAP: Users
WMI: Active Directory metrics: Directory
Search Rate, Read Rate, Write Rate,
Browse Rate, LDAP search rate, LDAP
Bind Rate etc
WMI: "dcdiag -e" command output - detect successful and failed domain controller diagnostic tests
WMI: "repadmin /replsummary" command output - Replication statistics
SQL Server - 2005,
2008, 2008R2, 2012,
2014
IIS versions
SNMP: Running
Processes
SNMP: Running
Processes
LDAP: Users with stale passwords, insecure password settings
SNMP or WMI: Process resource usage
JDBC: General database info,
Configuration Info, Backup Info,
JDBC: Per-instance like Buffer cache hit ratio, Log cache hit ratio etc
JDBC: per-instance, per-database
Performance metrics Data file size, Log file used, Log growths etc
JDBC: Locking info, Blocking info
SNMP or WMI: Process level resource usage
WMI: IIS metrics: Current Connections,
Max Connections, Sent Files, Received
Files etc
JDBC: database error log
JDBC: Database audit trail
AccelOps Windows Agent
(HTTPS): W3C Access logs -
Per instance Per Connection -
Sent Bytes, Received Bytes,
Duration
Snare Agent (syslog): W3C
Access logs
Correlog Agent (syslog): W3C
Access logs
ASP.NET
SNMP: Running
Processes
SNMP or WMI: Process level resource usage
SNMP: Installed
Software Change
AccelOps Windows
Agent: Installed
Software Change,
Registry Change
AccelOps Windows
Agent: File Integrity
Monitoring
Microsoft IIS for
Windows 2000 and 2003
WMI: Request Execution Time, Request
Wait Time, Current Requests,
Disconnected Requests etc
Page 255
FortiSIEM Installation Guide
Microsoft
Microsoft
Microsoft
Microsoft
Microsoft
Microsoft
Motorola
Motorola
Mikrotek
NetApp
Nimble
Internet
Authentication
Server (IAS)
HyperV Hypervisor
SNMP: Running
Processes
SNMP or WMI: Process level resource usage
Powershell over winexe: Guest/Host CPU usage, Memory usage, Page fault, Disk
Latency, Network usage
AccelOps Windows Agent
(HTTPS): AAA logs - successful and failed authentication
Snare Agent (syslog): AAA logs
- successful and failed authentication
Correlog Agent (syslog): AAA logs - successful and failed authentication
Sharepoint Server
Exchange Server
ISA Server
PPTP VPN Gateway
SNMP: Running
Processes
SNMP: Running
Processes
SNMP: Running
Processes
SNMP or WMI: Process level resource usage
LOGBinder Agent: SharePoint logs - Audit trail integrity, Access control changes, Document updates, List updates, Container object updates, Object changes,
Object Import/Exports,
Document views, Information
Management Policy changes etc
SNMP or WMI: Process level resource usage
WMI: Exchange performance metrics,
Exchange error metrics, Exchange mailbox metrics, Exchange SMTP metrics,
Exchange ESE Database, Exchange
Database Instances, Exchange Mail
Submission Metrics, Exchange Store
Interface Metrics etc
SNMP or WMI: Process level resource usage
AccelOps Windows Agent
(HTTPS): W3C Access logs -
Per Connection - Sent Bytes,
Received Bytes, Duration
Snare Agent (syslog): W3C
Access logs
Correlog Agent (syslog): W3C
Access logs
AccelOps Windows Agent
(HTTPS): VPN Access successful and failed
Snare Agent (syslog): VPN
Access - successful and failed
Correlog Agent (syslog): VPN
Access - successful and failed
Syslog: Wireless IDS logs AirDefense Wireless
IDS
WiNG WLAN Access
Point
Mikrotech Switches and Routers
DataONTAP based
Filers
NimbleOS Storage
Syslog: All system logs: User authentication, Admin authentication, WLAN attacks,
Wireless link health
Host name, OS,
Hardware model,
Serial number,
Components
SNMP: Host name, OS,
Hardware model,
Serial number,
Network interfaces, Logical volumes, Physical
Disks
SNMP: Uptime CPU utilization, Network
Interface metrics
SNMP: CPU utilization, Network Interface metrics, Logical Disk Volume utilization
SNMP: Hardware component health, Disk health
Host name,
Operating system version, Hardware model, Serial number, Network interfaces,
Physical Disks,
Components
ONTAP API: Detailed NFS V3/V4, ISCSI,
FCP storage IO metrics, Detailed LUN metrics, Aggregate metrics, Volume metrics, Disk performance metrics
SNMP: Uptime, Network Interface metrics,
Storage Disk Utilization
SNMP: Storage Performance metrics:
Read rate (IOPS), Sequential Read Rate
(IOPS), Write rate (IOPS), Sequential
Write Rate (IOPS), Read latency etc
SNMP Trap: Over 150 alerts hardware and software alerts
FortiSIEM Installation Guide
Page 256
FortiSIEM Installation Guide
Nessus
Nginx
Nortel
Nortel
Nutanix
Okta.com
OpenLDAP
Oracle
Oracle
Oracle
Oracle
Vulnerability Scanner
Web Server SNMP:
Application name
SNMP: Application Resource Usage
Nessus API: Vulnerability Scan results - Scan name, Host, Host
OS, Vulnerability category,
Vulnerability name, Vulnerability severity, Vulnerability CVE Id and Bugtraq Id, Vulnerability
CVSS Score, Vulnerability
Consequence etc
Syslog: W3C access logs: per
HTTP(S) connection: Sent
Bytes, Received Bytes,
Connection Duration
ERS Switches and
Routers
Passport Switches and Routers
Controller VM
SNMP: Host name, OS,
Hardware model,
Serial number,
Components
SNMP: Host name, OS,
Hardware model,
Serial number,
Components
SNMP: Host name, OS,
Hardware model,
Serial number,
Network interfaces,
Physical Disks,
Components
Okta API: Users
SNMP: Uptime CPU/memory utilization,
Network Interface metrics/errors,
Hardware Status
SNMP: Uptime CPU/memory utilization,
Network Interface metrics/errors,
Hardware Status
SNMP: Uptime CPU/memory utilization,
Network Interface metrics/errors, Disk
Status, Cluster Status, Service Status,
Storage Pool Info, Container Info
SSO Okta API: Over 90 event types covering user activity in Okta website
OpenLDAP
Enterprise Database
Server - 10g, 11g,
12c
MySQL Server
WebLogic
Application Server
Glassfish Application
Server
LDAP: Users
SNMP or
WMI: Process resource usage
SNMP or WMI:
Process resource usage
SNMP or
WMI: Process resource usage
SNMP or
WMI: Process resource usage
JDBC: Database performance metrics:
Buffer cache hit ratio, Row cache hit ratio,
Library cache hit ratio, Shared pool free ratio, Wait time ratio, Memory Sorts ratio etc
JDBC: Database Table space information: able space name, table space type, table space usage, table space free space, table space next extent etc
JDBC: Database audit trail: Database logon, Database operations including
CREATE/ALTER/DROP/TRUNCATE operations on tables, table spaces, databases, clusters, users, roles, views, table indices, triggers etc.
JDBC: User Connections, Table Updates, table Selects, Table Inserts, Table
Deletes, Temp Table Creates, Slow
Queries etc
JDBC: Table space performance metrics:
Table space name, table space type,
Character set and Collation, table space usage, table space free space etc
JDBC: Database audit trail Database log on, Database/Table
CREATE/DELETE/MODIFY operations
JMX: Availability metrics, Memory metrics,
Servlet metrics, Database metrics, Thread pool metrics, EJB metrics, Application level metrics
JMX: Availability metrics, Memory metrics,
Servlet metrics, Session metrics,
Database metrics, Request processor metrics, Thread pool metrics, EJB metrics,
Application level metrics, Connection metrics
Syslog: Listener log, Alert log,
Audit Log
FortiSIEM Installation Guide
Page 257
FortiSIEM Installation Guide FortiSIEM Installation Guide
Oracle
Palo Alto
Networks
PulseSecure
Qualys
Qualys
Rapid7
Riverbed
Redhat
Redhat
Redhat
Sun SunOS and
Solaris
PAN-OS based
Firewall
PulseSecure VPN
Vulnerability Scanner
Web Application
Firewall
NeXpose
Vulnerability Scanner
Steelhead WAN
Accelerators
Linux
JBOSS Application
Server
DHCP Server
SNMP: OS,
Hardware,
Software,
Processes, Open
Ports
SNMP: CPU, Memory, Disk, Interface utilization, Process monitoring, Process stop/start, Port up/down
SSH: Disk I/O, Paging
SSH: Hardware details
SNMP: Host name, OS,
Hardware,
Network interfaces
SNMP: Uptime, CPU utilization, Network
Interface metrics, Firewall connection count
SSH:
Configuration
Syslog: Situations covering
Authentication Success/Failure,
Privileged logons, User/Group
Modification
Syslog: Traffic log, Threat log
(URL, Virus, Spyware,
Vulnerability, File, Scan, Flood and data subtypes), config and system logs
SSH: Configuration
Change
Syslog: VPN events, Traffic events, Admin events
Qualys API: Vulnerability Scan results - Scan name, Host, Host
OS, Vulnerability category,
Vulnerability name, Vulnerability severity, Vulnerability CVE Id and Bugtraq Id, Vulnerability
CVSS Score, Vulnerability
Consequence etc syslog (JSON formatted): web log analysis
SNMP: Host name, Software version, Hardware model, Network interfaces
SNMP: Uptime, CPU / Memory / Network
Interface / Disk space metrics, Process cpu/memory utilization
SNMP: Hardware Status
SNMP: Bandwidth metrics:
(Inbound/Outbound Optimized Bytes -
LAN side, WAN side,
Connection metrics: Optimized/Pass through / Half-open optimized connections etc)
SNMP: Top Usage metrics: Top source,
Top destination, Top Application, Top
Talker
SNMP: OS,
Hardware,
Software,
Processes, Open
Ports
SNMP: Peer status: For every peer: State,
Connection failures, Request timeouts,
Max latency
SNMP: CPU, Memory, Disk, Interface utilization, Process monitoring, Process stop/start, Port up/down
SSH: Disk I/O, Paging
SSH: Hardware details, Linux distribution
SNMP: Process level
CPU/Memory usage
SNMP: Process level
CPU/Memory usage
JMX: CPU metrics, Memory metrics,
Servlet metrics, Database pool metrics,
Thread pool metrics, Application level metrics, EJB metrics
Rapid7 NeXpose API:
Vulnerability Scan results - Scan name, Host, Host OS,
Vulnerability category,
Vulnerability name, Vulnerability severity, Vulnerability CVE Id and Bugtraq Id, Vulnerability
CVSS Score, Vulnerability
Consequence etc
SNMP Trap: About 115 event types covering software errors, hardware errors, admin login, performance issues - cpu, memory, peer latency issues
Netflow: Connection statistics
Syslog: Situations covering
Authentication Success/Failure,
Privileged logons, User/Group
Modification
SSH: File integrity monitoring,
Command output monitoring,
Target file monitoring
Agent: File integrity monitoring
Syslog: DHCP address release/renew events
SSH: File integrity monitoring, Target file monitoring
Agent: File integrity monitoring
Page 258
FortiSIEM Installation Guide
Ruckus
Snort
Sophos
Squid
Symantec
TrendMicro
TrendMicro
TrendMicro
Tufin
Vasco
VMware
VMware
VMware
WatchGuard
Websense
Wireless LAN
IPS
Sophos Endpoint
Security and Control
Web Proxy
Symantec Endpoint
Protection
Office scan
Intrusion Defense
Firewall (IDF)
Deep Security
Manager
SecureTrack
DigiPass
VMware ESX and
VCenter vShield
VCloud Network and
Security (vCNS)
Manager
Firebox Firewall
SNMP: Controller host name,
Controller hardware model,
Controller network interfaces,
Associated WLAN
Access Points
SNMP: Process level
CPU/Memory usage
SNMP: Process level
CPU/Memory usage
VMWare SDK:
Entire VMware hierarchy and dependencies -
Data Center,
Resource Pool,
Cluster, ESX and
VMs
SNMP: Controller Uptime, Controller
Network Interface metrics, Controller
WLAN Statistics, Access Point Statistics,
SSID performance Stats
VMWare SDK: VM level: CPU, Memory,
Disk, Network, VMware tool status
VMWare SDK: ESX level: CPU, Memory,
Disk, Network, Data store
VMWare SDK: ESX level: Hardware
Status
VMWare SDK: Cluster level: CPU,
Memory, Data store, Cluster Status
VMWare SDK: Resource pool level: CPU,
Memory
Syslog: Over 40K IPS Alerts
JDBC: Over 40K IPS Alerts additional details including
TCP/UDP/ICMP header and payload in the attack packet
SNMP Trap: Endpoint events including Malware found/deleted, DLP events
Syslog: W3C formatted access logs - per HTTP(S) connection:
Sent Bytes, Received Bytes,
Connection Duration
Syslog: Over 5000 event types covering end point protection events malware/spyware/adware, malicious events
SNMP Trap: Over 30 event types covering end point protection events malware/spyware/adware, malicious events
Syslog: Over 10 event types covering end point firewall events
Syslog: Over 10 event types covering end point protection events
Syslog: Over 10 event types covering firewall policy management events
Syslog - Successful and Failed
Authentications, Successful and
Failed administrative logons
VMWare SDK: Over 800
VCenter events covering account creation, VM creation,
DRS events, hardware/software errors
Syslog: Over 10 events covering permitted and denied connections, detected attacks
Syslog: Over 10 events covering various activities
Web Filter
Syslog: Over 20 firewall event types
Syslog: Over 50 web filtering events and web traffic logs
FortiSIEM Installation Guide
Page 259
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring FortiSIEM Windows Agent and Agent Manager
FortiSIEM can discover and collect performance metrics and logs from Windows Servers in an agent less fashion via WMI. However agents are needed when there is a need to collect richer data such as file integrity monitoring and from a large number of servers.
This section describes how to setup FortiSIEM Windows Agent and Agent Manager as part of FortiSIEM infrastructure.
Configuring Windows Monitoring
Troubleshooting Windows Agent Manager
Page 260
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring Windows Monitoring
In a typical Windows device configuration, you would configure settings on the device itself that would connect it to FortiSIEM and enable the communication of metrics and logs from the device. With the Windows Agent Manager, you define a temple that you can apply to devices where the Windows Agent has been been installed. Once the template is defined and applied to a device, FortiSIEM will begin monitoring the device according to the template settings. You can apply the same template to more than one device, but you cannot apply more than one template to a single device.
Configure FortiSIEM Supervisor
Register Windows Agent Manager to FortiSIEM Supervisor
Configure Windows Agent Manager
License and Template Assignments in Agent Manager via Export/Import
Sample logs generated by FortiSIEM Windows Agents
Windows file content monitoring logs
Windows File integrity monitoring logs
Windows Installed Software logs
Procedure
Configure FortiSIEM Supervisor
1.
2.
Go to
Go to > a. b. Click
>
Add
to FortiSIEM i. ii. iii. iv. v.
Enter
and make sure that there are entries for Basic and Advanced Windows Agents.
and add Agent Managers
Click on
Windows Agents
tab
and enter information for an Windows Agent Manager. This information will be used by the Agent Manager to register
Agent Manager Name
Enter the number of
Enter the
Choose
Start Time
Click
OK
to Save
Basic Agents
and
and
End Time
Event Upload Destination
Advanced Agents
for license validity
assigned to this Agent Manager
- this is where the Agent Manager will upload events to.
Register Windows Agent Manager to FortiSIEM Supervisor
1.
2.
3.
4.
Log on to Windows Agent Manager
Launch FortiSIEM Windows Agent Manager application
Log on to the FortiSIEM Windows Agent Manager application using
User ID
and
Register the Windows Agent Manager to FortiSIEM a. b. c. d.
Enter
Supervisor IP/Host
Enter
Agent Manager Name
- this is defined in Step 2.b.i in
Enter
Enter
Organization Name
Organization User
- this is defined in Step 2.b.iv in and
Organization Password
5. created in Admin > Setup wizard.
Click Register. If registration is successful, then up in this page with Current Status as Running.
Password
created during setup
Configure FortiSIEM Supervisor
Configure FortiSIEM Supervisor
step
step as the Organizations credentials defined when the Organization was
Windows Agent Manager Dashboard
page is displayed. All the installed agents show
Configure Windows Agent Manager
1.
2.
Go to
Dashboard
and make sure that it displays all Windows Servers with FortiSIEM agents installed.
Create a Monitoring Template a. b.
Go to
Click
Template Settings +
Create Template
i. ii.
.
Enter a template name and description. Click
Specify options for each monitoring category
Settings
.
Category Description Settings
Page 261
2. b. ii.
FortiSIEM Installation Guide FortiSIEM Installation Guide
File/Folder
Changes
Registry
Changes
Monitor access and change to files and folders
Monitor changes to the root keys of Windows Registry hive
Click
New
.
Enter the full path of File/Folder to be modified
Select Include Subfolder(s) if the folders under the main directory needs to be monitored.
Narrow down the scope by either specify
Include
The chosen files/directories will be displayed.
or
Exclude
files
(
Note:
To get User information, you have do some special configuration
in Windows Agents as defined in Step 2 of Pre-requisites in Installing
Select the root keys (available keys are ,
, , and
HKEY_CURRE
NT_CONFIG
)
Set the time interval for how often the Agent will check for change. More
CPU will be used for shorter time intervals
Select Product Name, Version and Vendor to be included in an event when a change is detected.
Installed
Software
Logs
WMI
Classes
Powershell
Script
Monitor software install / uninstall on a Windows server
Collect
System/Security/Application logs and specific application logs
Run a WMI command and collect its output
Run Powershell command and send its output
Check
System
if you want to collect Windows System logs. Specify include/exclude event ids.
Check
Security
if you want to collect Windows Security logs. Specify include/exclude event ids.
Check
DNS
if you want to collect Windows DNS logs. Specify include/exclude event ids.
Check
DFS
if you want to collect Windows DFS logs. Specify include/exclude event ids.
Check
Application
if you want to collect Windows Application logs.
Specify include/exclude event ids.
IIS
include/exclude event ids.
Check
DHCP
if you want to collect Windows DHCP logs. Specify include/exclude event ids.
Check
User Logs
and specify the file(s) you want to monitored. Any time, the file changes, a log will be generated,
Select Category and then select the class
Select WMI Class Attributes
Specify how often the command needs to run
Note: you may need to write a parser in FortiSIEM to get accurate attribute based reporting
Enter a Powershell script
Specify how often the Powershell script needs to run
Note: you may need to write a parser in FortiSIEM to get accurate attribute based reporting
3. iii. iv. i. ii.
Click
Apply
Click
Save
Click
Associate License / Templates.
Click
1.
2.
3.
4.
to save the template
Associate Windows Computers with proper license and one or more Templates (Starting with release 2.0) a. b.
Search
to find the list of computers to apply the license/templates to
Choose
Simple
or
Advanced
For
Simple
mode
Select the field to
Search in.
Possible choices are Computer, OS, License Type, Template Name
.
5.
Type in the string to search in the adjacent edit box.
Click
Find
a. b.
.
The list of matched computers will be displayed in the area below the Search box.
iii. For
1.
2.
Select the Computers to which license/templates would be assigned
Select the header checkbox to select/unselect all
Advanced
Individually select/unselect the computers if needed
mode
For searching by computer names, type the search text next to
For searching by OS names, type the search text next to
OS
.
Computer
.
3.
Page 262
3. b.
FortiSIEM Installation Guide
3.
4.
For searching by
License Types
, select the desired license type from the drop down
For searching by a. b.
Template Names
, do one of the following.
For exact template name matches, set
Templates
to '
Specified from
' and select one or more templates from the next drop down and select the operator: AND or OR
' and type the search string
5.
6.
For searching template names, set
Templates
to '
Specified in
Click
Find
.
7.
The list of matched computers will be displayed in the area below the Search boxSelect a
Computer.
a. b.
Template
for a c. d.
Individually select/unselect the computers if needed
Make sure the list of computers in view are correct for the license/template assignment and are checked.
Click
Assign
i. ii. iii. iv. v.
Select
Click
Validate
Click e. Click
Save.
Select the Computers to which license/templates would be assigned
Select the header checkbox to select/unselect all
License Type
: Basic or Advanced or None
Select the additional
Template
to be assigned from the drop down
Assign
to add the template to the computer. The display would reflect the modification.
Click
Unassign
to remove the template from the computer. The display would reflect the modification.
License and Template Assignments in Agent Manager via Export/Import
5.
6.
7.
8.
1.
2.
3.
Logon to Agent Manager
Go to
Dashboard
and make sure that the Agents are showing up
Click
Export
- a list of Agents Computer name, Assigned license and Assigned template will be exported to a CSV formatted file named
4.
'ExportedAgentAssociation.csv' in the directory | |
Edit the CSV file to associate the right license type and monitoring template to each computer. Do not add any new computer or edit computer. Every computer known to the Agent Manager will be present in the csv file.
Click
Import
and put the CSV file in the Open file Dialog
Once Import finishes, a dialog will tell you the number of records processed and successfully updated.
9.
Click
Click
Assign Licenses to Computers
to see the License assignments
Associate Computers with Templates
to see Template assignments
Any warnings during import operations will be recorded in <CSVFilename>-<Date>-<Time>.log file in the directory
Verify Events in FortiSIEM
1.
2.
3.
4.
Log on to FortiSIEM
Go to
Select
Analytics Historical Search.
Filter Criteria
: Structured
Create the following condition:
Raw Event Log
CONTAIN AccelOps-WUA. Click
OK.
Note that all event types for all Windows Server
5.
6. generated logs are prefixed by AccelOps-WUA.
Select the following
Group By
a. b. a. b.
Reporting Device Name
Reporting IP
Select the following
Display Fields:
7.
8.
9. c.
Reporting Device Name
Reporting IP
COUNT(Matched Events)
Run the query for last 15 minutes
The Query will return all hosts that reported events in the last 15 minutes.
To drill down further, add
Event Type
to both
Group By
and
Display Fields
. Then rerun the query.
Sample logs generated by FortiSIEM Windows Agents
FortiSIEM Windows Agent Manager generates Windows logs in an easy to analyze "attribute=value" style without losing any information.
Windows System logs
Page 263
FortiSIEM Installation Guide FortiSIEM Installation Guide
#Win-System-Service-Control-Manager-7036
Thu May 07 02:13:42 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-WinLog
[monitorStatus]="Success" [eventName]="System"
[eventSource]="Service Control Manager" [eventId]="7036"
[eventType]="Information" [domain]="" [computer]="WIN-2008-LAW-agent"
[user]="" [userSID]="" [userSIDAcctType]="" [eventTime]="May 07 2015 10:13:41"
[deviceTime]="May 07 2015 10:13:41"
[msg]="The Skype Updater service entered the running state."
Thu May 07 02:13:48 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-WinLog
[monitorStatus]="Success" [eventName]="System"
[eventSource]="Service Control Manager" [eventId]="7036"
[eventType]="Information" [domain]="" [computer]="WIN-2008-LAW-agent"
[user]="" [userSID]="" [userSIDAcctType]="" [eventTime]="May 07 2015 10:13:47"
[deviceTime]="May 07 2015 10:13:47"
[msg]="The Skype Updater service entered the stopped state."
Windows Application logs
#Win-App-MSExchangeServiceHost-2001
Thu May 07 03:05:42 2015 WIN-2008-249.ersijiu.com 10.1.2.249
AccelOps-WUA-WinLog [monitorStatus]="Success" [eventName]="Application"
[eventSource]="MSExchangeServiceHost" [eventId]="2001"
[eventType]="Information" [domain]="" [computer]="WIN-2008-249.ersijiu.com"
[user]="" [userSID]="" [userSIDAcctType]="" [eventTime]="May 07 2015 11:05:42"
[deviceTime]="May 07 2015 11:05:42"
[msg]="Loading servicelet module
Microsoft.Exchange.OABMaintenanceServicelet.dll"
#MSSQL
#Win-App-MSSQLSERVER-17137
Thu May 07 03:10:16 2015 WIN-2008-249.ersijiu.com 10.1.2.249
AccelOps-WUA-WinLog [monitorStatus]="Success" [eventName]="Application"
[eventSource]="MSSQLSERVER" [eventId]="17137" [eventType]="Information"
[domain]="" [computer]="WIN-2008-249.ersijiu.com" [user]=""
[userSID]="" [userSIDAcctType]="" [eventTime]="May 07 2015 11:10:16"
[deviceTime]="May 07 2015 11:10:16"
[msg]="Starting up database 'model'."
Windows Security logs
Page 264
FortiSIEM Installation Guide FortiSIEM Installation Guide
#Win-Security-4624(Windows logon success)
Thu May 07 02:23:58 2015 WIN-2008-249.ersijiu.com 10.1.2.249
AccelOps-WUA-WinLog [monitorStatus]="Success" [eventName]="Security"
[eventSource]="Microsoft-Windows-Security-Auditing" [eventId]="4624"
[eventType]="Audit Success" [domain]=""
[computer]="WIN-2008-249.ersijiu.com" [user]="" [userSID]=""
[userSIDAcctType]="" [eventTime]="May 07 2015 10:23:56"
[deviceTime]="May 07 2015 10:23:56" [msg]="An account was successfully logged on." [[Subject]][Security ID]="S-1-0-0" [Account Name]=""
[Account Domain]="" [Logon ID]="0x0" [Logon Type]="3" [[New
Logon]][Security ID]="S-1-5-21-3459063063-1203930890-2363081030-500"
[Account Name]="Administrator" [Account Domain]="ERSIJIU" [Logon
ID]="0xb9bd3" [Logon GUID]="{00000000-0000-0000-0000-000000000000}"
[[Process Information]][Process ID]="0x0" [Process Name]="" [[Network
Information]][Workstation Name]="SP171" [Source Network
Address]="10.1.2.171"
[Source Port]="52409" [[Detailed Authentication Information]][Logon
Process]="NtLmSsp" [Authentication Package]="NTLM" [Transited
Services]=""
[Package Name (NTLM only)]="NTLM V2" [Key Length]="128" [details]=""
Windows DNS logs
#DNS Debug Logs
#AO-WUA-DNS-Started
Thu May 07 02:35:43 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DNS
[monitorStatus]="Success"
[msg]="5/7/2015 10:34:05 AM 20BC EVENT The DNS server has started."
#AO-WUA-DNS-ZoneDownloadComplete
Thu May 07 02:35:43 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DNS
[monitorStatus]="Success" [msg]="5/7/2015 10:34:05 AM 20BC EVENT
The DNS server has finished the background loading of zones. All zones are now available for DNS updates and zone transfers, as allowed by their individual zone configuration."
#AO-WUA-DNS-A-Query-Success
Thu May 07 02:48:25 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DNS
[monitorStatus]="Success" [msg]="5/7/2015
10:47:13 AM 5D58 PACKET 0000000002B74600 UDP Rcv 10.1.20.232 0002 Q [0001
D NOERROR] A (8)testyjyj(4)yjyj(3)com(0)"
Thu May 07 02:48:25 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DNS
[monitorStatus]="Success" [msg]="5/7/2015
10:47:13 AM 5D58 PACKET 0000000002B74600 UDP Snd 10.1.20.232 0002 R Q
[8085 A DR NOERROR] A (8)testyjyj(4)yjyj(3)com(0)"
Page 265
FortiSIEM Installation Guide FortiSIEM Installation Guide
#AO-WUA-DNS-PTR-Query-Success
Thu May 07 02:48:25 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DNS
[monitorStatus]="Success" [msg]="5/7/2015
10:47:22 AM 5D58 PACKET 00000000028AB4B0 UDP Rcv 10.1.20.232 0002 Q [0001
D NOERROR] PTR
(3)223(3)102(3)102(3)102(7)in-addr(4)arpa(0)"
Thu May 07 02:48:25 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DNS
[monitorStatus]="Success" [msg]="5/7/2015
10:47:22 AM 5D58 PACKET 00000000028AB4B0 UDP Snd 10.1.20.232 0002 R Q
[8085 A DR NOERROR] PTR
(3)223(3)102(3)102(3)102(7)in-addr(4)arpa(0)"
#DNS System Logs
#Win-App-DNS-2(DNS Server started)
Thu May 07 02:39:17 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-WinLog
[monitorStatus]="Success"
[eventName]="DNS Server" [eventSource]="DNS" [eventId]="2"
[eventType]="Information" [domain]="" [computer]="WIN-2008-LAW-agent"
[user]="" [userSID]="" [userSIDAcctType]="" [eventTime]="May 07 2015 10:39:17"
[deviceTime]="May 07 2015 10:39:17"
[msg]="The DNS server has started."
#Win-App-DNS-3(DNS Server shutdown)
Thu May 07 02:39:16 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-WinLog
[monitorStatus]="Success" [eventName]="DNS Server"
[eventSource]="DNS" [eventId]="3" [eventType]="Information" [domain]=""
[computer]="WIN-2008-LAW-agent" [user]="" [userSID]=""
[userSIDAcctType]="" [eventTime]="May 07 2015 10:39:16" [deviceTime]="May 07
Page 266
FortiSIEM Installation Guide
2015 10:39:16" [msg]="The DNS server has shut down.
FortiSIEM Installation Guide
Windows DHCP logs
AO-WUA-DHCP-Generic
Thu May 07 05:44:44 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DHCP
[monitorStatus]="Success" [ID]="00" [Date]="05/07/15"
[Time]="13:44:08" [Description]="Started" [IP Address]="" [Host Name]=""
[MAC Address]="" [User Name]="" [ TransactionID]="0"
[ QResult]="6" [Probationtime]="" [ CorrelationID]="" [Dhcid.]=""
#AO-WUA-DHCP-IP-ASSIGN
Thu May 07 05:56:41 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DHCP
[monitorStatus]="Success" [ID]="10" [Date]="05/07/15"
[Time]="13:56:37" [Description]="Assign" [IP Address]="10.1.2.124" [Host
Name]="Agent-247.yj" [MAC Address]="000C2922118E"
[User Name]="" [ TransactionID]="2987030242" [ QResult]="0"
[Probationtime]="" [ CorrelationID]="" [Dhcid.]=""
#AO-WUA-DHCP-Generic(Release)
Thu May 07 05:56:41 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DHCP
[monitorStatus]="Success" [ID]="12" [Date]="05/07/15"
[Time]="13:56:33" [Description]="Release" [IP Address]="10.1.2.124"
[Host Name]="Agent-247.yj" [MAC Address]="000C2922118E"
[User Name]="" [ TransactionID]="2179405838" [ QResult]="0"
[Probationtime]="" [ CorrelationID]="" [Dhcid.]=""
#AO-WUA-DHCP-IP-LEASE-RENEW
Wed Feb 25 02:53:28 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-DHCP
[monitorStatus]="Success" [ID]="11" [Date]="02/25/15"
[Time]="10:53:19" [Description]="Renew" [IP Address]="10.1.2.123" [Host
Name]="WIN-2008-249.yj" [MAC Address]="0050568F1B5D"
[User Name]="" [ TransactionID]="1136957584" [ QResult]="0"
[Probationtime]="" [ CorrelationID]="" [Dhcid.]=""
Windows IIS logs
Page 267
FortiSIEM Installation Guide FortiSIEM Installation Guide
#AO-WUA-IIS-Web-Request-Success
Thu May 07 03:49:23 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-IIS
[monitorStatus]="Success" [date]="2015-05-07"
[time]="03:44:28" [s-sitename]="W3SVC1"
[s-computername]="WIN-2008-LAW-AG" [s-ip]="10.1.2.242" [cs-method]="GET"
[cs-uri-stem]="/welcome.png" [cs-uri-query]="-" [s-port]="80"
[cs-username]="-" [c-ip]="10.1.20.232" [cs-version]="HTTP/1.1"
[cs(User-Agent)]="Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.36
+(KHTML,+like+Gecko)+Chrome/42.0.2311.135+Safari/537.36"
[cs(Cookie)]="-" [cs(Referer)]="http://10.1.2.242/"
[cs-host]="10.1.2.242" [sc-status]="200" [sc-substatus]="0"
[sc-win32-status]="0"
[sc-bytes]="185173" [cs-bytes]="324" [time-taken]="78" [site]="Default
Web Site" [format]="W3C"
#AO-WUA-IIS-Web-Client-Error
Thu May 07 03:49:23 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-IIS
[monitorStatus]="Success" [date]="2015-05-07" [time]="03:44:37"
[s-sitename]="W3SVC1" [s-computername]="WIN-2008-LAW-AG"
[s-ip]="10.1.2.242" [cs-method]="GET" [cs-uri-stem]="/wrongpage"
[cs-uri-query]="-"
[s-port]="80" [cs-username]="-" [c-ip]="10.1.20.232"
[cs-version]="HTTP/1.1"
[cs(User-Agent)]="Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.36
+(KHTML,+like+Gecko)+Chrome/42.0.2311.135+Safari/537.36"
[cs(Cookie)]="-" [cs(Referer)]="-" [cs-host]="10.1.2.242"
[sc-status]="404"
[sc-substatus]="0" [sc-win32-status]="2" [sc-bytes]="1382"
[cs-bytes]="347" [time-taken]="0" [site]="Default Web Site"
[format]="W3C"
#AO-WUA-IIS-Web-Forbidden-Access-Denied
Thu May 07 03:30:39 2015 WIN-2008-249.ersijiu.com 10.1.2.249
AccelOps-WUA-IIS [monitorStatus]="Success" [date]="2015-05-07"
[time]="03:30:15"
[s-ip]="10.1.2.249" [cs-method]="POST"
[cs-uri-stem]="/AOCACWS/AOCACWS.svc" [cs-uri-query]="-" [s-port]="80"
[cs-username]="-"
[c-ip]="10.1.2.42" [cs(User-Agent)]="-" [sc-status]="403"
[sc-substatus]="4" [sc-win32-status]="5" [time-taken]="1"
[site]="Default Web Site"
[format]="W3C"
Windows DFS logs
Page 268
FortiSIEM Installation Guide FortiSIEM Installation Guide
#Win-App-DFSR-1002
Thu May 07 03:01:12 2015 WIN-2008-LAW-agent 10.1.2.242
AccelOps-WUA-WinLog [monitorStatus]="Success" [eventName]="DFS
Replication"
[eventSource]="DFSR" [eventId]="1002" [eventType]="Information"
[domain]="" [computer]="WIN-2008-LAW-agent" [user]="" [userSID]=""
[userSIDAcctType]="" [eventTime]="May 07 2015 11:01:12"
[deviceTime]="May 07 2015 11:01:12" [msg]="The DFS Replication service is starting."
#Win-App-DFSR-1004
Thu May 07 03:01:12 2015 WIN-2008-LAW-agent 10.1.2.242
AccelOps-WUA-WinLog [monitorStatus]="Success" [eventName]="DFS
Replication"
[eventSource]="DFSR" [eventId]="1004" [eventType]="Information"
[domain]="" [computer]="WIN-2008-LAW-agent" [user]="" [userSID]=""
[userSIDAcctType]="" [eventTime]="May 07 2015 11:01:12"
[deviceTime]="May 07 2015 11:01:12" [msg]="The DFS Replication service has started."
#Win-App-DFSR-1006
Thu May 07 03:01:10 2015 WIN-2008-LAW-agent 10.1.2.242
AccelOps-WUA-WinLog [monitorStatus]="Success" [eventName]="DFS
Replication"
[eventSource]="DFSR" [eventId]="1006" [eventType]="Information"
[domain]="" [computer]="WIN-2008-LAW-agent" [user]="" [userSID]=""
[userSIDAcctType]="" [eventTime]="May 07 2015 11:01:10"
[deviceTime]="May 07 2015 11:01:10" [msg]="The DFS Replication service is stopping."
#Win-App-DFSR-1008
Thu May 07 03:01:11 2015 WIN-2008-LAW-agent 10.1.2.242
AccelOps-WUA-WinLog [monitorStatus]="Success" [eventName]="DFS
Replication"
[eventSource]="DFSR" [eventId]="1008" [eventType]="Information"
[domain]="" [computer]="WIN-2008-LAW-agent" [user]="" [userSID]=""
[userSIDAcctType]="" [eventTime]="May 07 2015 11:01:11"
[deviceTime]="May 07 2015 11:01:11" [msg]="The DFS Replication service has stopped."
Windows file content monitoring logs
Page 269
FortiSIEM Installation Guide FortiSIEM Installation Guide
#AO-WUA-UserFile
Thu May 07 05:40:08 2015 WIN-2008-LAW-agent 10.1.2.242
AccelOps-WUA-UserFile [monitorStatus]="Success"
[fileName]="C:\test\i.txt"
[msg]="another newline adddedddddd"
Windows File integrity monitoring logs
#AO-WUA-FileMon-Added
Thu May 07 05:30:59 2015 WIN-2008-LAW-agent 10.1.2.242
AccelOps-WUA-FileMon [monitorStatus]="Success" [userId]="Administrator"
[eventTime]="May 07 2015 05:30:58" [fileName]="C:\\test\\New Text
Document.txt" [osObjAction]="Added"
[hashCode]="d41d8cd98f00b204e9800998ecf8427e"
[msg]=""
#AO-WUA-FileMon-Renamed-New-Name
Thu May 07 05:31:02 2015 WIN-2008-LAW-agent 10.1.2.242
AccelOps-WUA-FileMon [monitorStatus]="Success" [userId]="Administrator"
[eventTime]="May 07 2015 05:30:58" [fileName]="C:\\test\\test.txt"
[osObjAction]="Renamed [New Name]"
[hashCode]="d41d8cd98f00b204e9800998ecf8427e"
[msg]=""
#AO-WUA-FileMon-Renamed-Old-Name
Thu May 07 05:31:02 2015 WIN-2008-LAW-agent 10.1.2.242
AccelOps-WUA-FileMon [monitorStatus]="Success" [userId]="Administrator"
[eventTime]="May 07 2015 05:31:01" [fileName]="C:\\test\\New Text
Document.txt" [osObjAction]="Renamed [Old Name]" [hashCode]=""
[msg]=""
#AO-WUA-FileMon-Modified
Thu May 07 05:31:14 2015 WIN-2008-LAW-agent 10.1.2.242
AccelOps-WUA-FileMon [monitorStatus]="Success" [userId]="Administrator"
[eventTime]="May 07 2015 05:31:13" [fileName]="C:\\test\\test.txt"
[osObjAction]="Modified" [hashCode]="23acb5410a432f14b141656c2e70d104"
[msg]=""
#AO-WUA-FileMon-Removed
Thu May 07 05:31:29 2015 WIN-2008-LAW-agent 10.1.2.242
AccelOps-WUA-FileMon [monitorStatus]="Success" [userId]="Administrator"
[eventTime]="May 07 2015 05:31:27" [fileName]="C:\\test\\test.txt"
[osObjAction]="Removed" [hashCode]="" [msg]=""
Windows Installed Software logs
Page 270
FortiSIEM Installation Guide FortiSIEM Installation Guide
#AO-WUA-InstSw-Added
Thu May 07 05:28:17 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-InstSw
[monitorStatus]="Success" [osObjAction]="Added"
[appName]="7-Zip 9.20 (x64 edition)" [vendor]="Igor Pavlov"
[appVersion]="9.20.00.0"
#AO-WUA-InstSw-Removed
Thu May 07 05:28:30 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-InstSw
[monitorStatus]="Success" [osObjAction]="Removed"
[appName]="7-Zip 9.20 (x64 edition)" [vendor]="Igor Pavlov"
[appVersion]="9.20.00.0"
Windows Registry change logs
#AO-WUA-Registry-Modified
Thu May 07 04:01:58 2015 WIN-2008-249.ersijiu.com 10.1.2.249
AccelOps-WUA-Registry [monitorStatus]="Success"
[regKeyPath]="HKLM\\SOFTWARE\\Microsoft\\ExchangeServer\\v14\\ContentIndex\\Cat alogHealth\\{0d2a342a-0b15-4995-93db-d18c3df5860d}" [regValueName]="TimeStamp"
[regValueType]="1"
[osObjAction]="Modified"
[oldRegValue]="MgAwADEANQAtADAANQAtADAANwAgADAAMwA6ADQAOQA6ADQANwBaAAAA"
[newRegValue]="MgAwADEANQAtADAANQAtADAANwAgADAANAA6ADAAMQA6ADQAOABaAAAA"
#AO-WUA-Registry-Removed
Thu May 07 05:25:09 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-Registry
[monitorStatus]="Success"
[regKeyPath]="HKLM\\SOFTWARE\\RegisteredApplications" [regValueName]="Skype"
[regValueType]="1" [osObjAction]="Removed"
[oldRegValue]="UwBPAEYAVABXAEEAUgBFAFwAQwBsAGkAZQBuAHQAcwBcAEkAbgB0AGUAcgBuAGUA dAAgAEMAYQBsAGwAXABTAGsAeQBwAGUAXABDAGEAcABhAGIAaQBsAGkAdABpAGUAcwBkAGgAZABoAGQ
AaABkAGgAZABoAGQAAAA=" [newRegValue]=""
Windows WMI logs
Page 271
FortiSIEM Installation Guide FortiSIEM Installation Guide
#AO-WUA-WMI-Win32_Processor
Thu May 07 03:53:33 2015 WIN-2008-LAW-agent 10.1.2.242 AccelOps-WUA-WMI
[monitorStatus]="Success" [__CLASS]="Win32_Processor"
[AddressWidth]="64" [Architecture]="9" [Availability]="3" [Caption]="Intel64
Family 6 Model 26 Stepping 5" [ConfigManagerErrorCode]=""
[ConfigManagerUserConfig]="" [CpuStatus]="1"
[CreationClassName]="Win32_Processor" [CurrentClockSpeed]="2266"
[CurrentVoltage]="33"
[DataWidth]="64" [Description]="Intel64 Family 6 Model 26 Stepping 5"
[DeviceID]="CPU0" [ErrorCleared]="" [ErrorDescription]=""
[ExtClock]="" [Family]="12" [InstallDate]="" [L2CacheSize]="0"
[L2CacheSpeed]="" [L3CacheSize]="0" [L3CacheSpeed]="0"
[LastErrorCode]="" [Level]="6" [LoadPercentage]="8"
[Manufacturer]="GenuineIntel" [MaxClockSpeed]="2266"
[Name]="Intel(R) Xeon(R) CPU E5520 @ 2.27GHz" [NumberOfCores]="1"
[NumberOfLogicalProcessors]="1"
[OtherFamilyDescription]="" [PNPDeviceID]="" [PowerManagementCapabilities]=""
[PowerManagementSupported]="0"
[ProcessorId]="0FEBFBFF000106A5" [ProcessorType]="3" [Revision]="6661"
[Role]="CPU" [SocketDesignation]="CPU socket #0"
[Status]="OK" [StatusInfo]="3" [Stepping]=""
[SystemCreationClassName]="Win32_ComputerSystem" [SystemName]="WIN-2008-LAW-AG"
UniqueId]="" [UpgradeMethod]="4" [Version]="" [VoltageCaps]="2"
Windows Powershell logs
Page 272
FortiSIEM Installation Guide
Troubleshooting Windows Agent Manager
FortiSIEM Installation Guide
Page 273
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring Applications
This section describes how to configure applications for discovery and for providing information to AccelOps.
Application Server Configuration
Microsoft ASP.NET Configuration
Oracle GlassFish Server Configuration
Authentication Server Configuration
Cisco Access Control Server (ACS) Configuration
Microsoft Internet Authentication Server (IAS) Configuration
Juniper Networks Steel-Belted RADIUS Configuration
CyberArk Password Vault Configuration
Microsoft SQL Server Configuration
SQL Server Database Level Event Creation Script (PH_Database_Level_Events.sql)
SQL Server DDL Event Creation Script (PH_DDL_Server_Level_Events.sql)
SQL Server Table Creation Script (PH_EventDB_Tables_Create.sql)
SQL Server Trigger Creation Script (PH_LogonEventsTrigger.sql)
Oracle Database Server Configuration
DHCP and DNS Server Configuration
Infoblox DNS/DHCP Configuration
Microsoft DHCP (2003, 2008) Configuration
Microsoft DNS (2003, 2008) Configuration
Directory Server Configuration
Microsoft Active Directory Configuration
Document Management Server Configuration
Microsoft SharePoint Configuration
Microsoft Exchange Configuration
Management Server/Appliance Configuration
Fortinet FortiManager Configuration
Citrix Receiver (ICA) Configuration
Unified Communication Server Configuration
Avaya Call Manager Configuration
Cisco Call Manager Configuration
Cisco Contact Center Configuration
Cisco Presence Server Configuration
Cisco Tandeberg Telepresence Video Communication Server (VCS) Configuration
Cisco Telepresence Multipoint Control Unit (MCU) Configuration
Cisco Telepresence Video Communication Server Configuration
Cisco Unity Connection Configuration
Apache Web Server Configuration
Microsoft IIS for Windows 2000 and 2003 Configuration
Microsoft IIS for Windows 2008 Configuration
Nginx Web Server Configuration
Page 274
FortiSIEM Installation Guide
Application Server Configuration
AccelOps supports the discovery and monitoring of these application servers.
Microsoft ASP.NET Configuration
Oracle GlassFish Server Configuration
FortiSIEM Installation Guide
Page 275
FortiSIEM Installation Guide FortiSIEM Installation Guide
Apache Tomcat Configuration
What is Discovered and Monitored
Settings for Access Credentials
Sample Event for Tomcat Metrics
What is Discovered and Monitored
Protocol Information discovered
JMX
Metrics collected Used for
Generic information: Application version, Application port
Availability metrics: Uptime, Application Server State
CPU metrics: CPU utilization
Memory metrics: Total memory, Free memory, Memory utilization, Virtual committed memory, Total Swap
Memory, Free Swap Memory Swap memory utilization, Heap Utilization, Heap Used Memory, Heap max memory, memory
,
Heap commit memory, Non-heap Utilization, Non-heap used memory, Non-heap max memory, Non-heap commit
Servlet metrics: Web application name, Servlet Name, Count allocated, Total requests, Request errors, Load time,
Avg Request Processing time
Session metrics:
Web context path, Peak active sessions, Current active sessions, Duplicate sessions, Expired sessions, Rejected sessions, Average session lifetime, Peak session lifetime, Session processing time, Session create rate, Session expire rate, Process expire frequency, Max session limited, Max inactive Interval
Database metrics: Web context path, Data source, Database driver, Peak active sessions, Current active sessions, Peak idle sessions, Current idle sessions
Thread pool metrics: Thread pool name, Application port, Total threads, Busy threads, Keep alive threads, Max threads, Thread priority, Thread pool daemon flag
Request processor metrics: Request processor name, Received Bytes, Sent Bytes, Average Request Process time, Max Request Processing time, Request Rate, Request Errors
Performance
Monitoring
Event Types
In
CMDB > Event Types
, search for "tomcat" in the
Device Type
and
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In
Analytics > Reports, search for "tomcat" in the Name column to see the reports associated with this application or device.
Configuration
JMX
1. Add the necessary parameters to the Tomcat startup script.
Windows
Modify the file
${CATALINA_BASE}\bin\catalina.bat
----Execute The Requested Command -----by adding these arguments for JVM before the comment rem
Page 276
1.
FortiSIEM Installation Guide FortiSIEM Installation Guide
JMX Configuration for Windows
set JAVA_OPTS=-Dcom.sun.management.jmxremote
-Dcom.sun.management.jmxremote.port=${Your JMX Port} \
-Dcom.sun.management.jmxremote.authenticate=true \
-Dcom.sun.management.jmxremote.ssl=false \
-Dcom.sun.management.jmxremote.access.file=jmxremote.access
\
-Dcom.sun.management.jmxremote.password.file=jmxremote.password \
Linux
Modify the file
${CATALINA_BASE}/bin/catalina.sh
by adding these arguments for JVM before the comment
# ----Execute
The Requested Command ------
JMX Configuration for Linux
JAVA_OPTS=" $ JAVA_OPTS -Dcom.sun.management.jmxremote \
-Dcom.sun.management.jmxremote.port=${ Your JMX Port} \
-Dcom.sun.management.jmxremote.authenticate=true \
-Dcom.sun.management.jmxremote.ssl=false \
-Dcom.sun.management.jmxremote.access.file=jmxremote.access \
-Dcom.sun.management.jmxremote.password.file=jmxremote.password" \
2. Edit the access authorization file jmxremote.access. monitorRole readonly controlRole readwrite
3. Edit the password file jmxremote.password.
The first column is user name and the second column is password). AccelOps only needs monitor access.
monitorRole <AccelOpsUserName> controlRole <userName>
4. In Linux, set permissions for the jmxremote.access
and jmxremote.password
only by the Tomcat operating system user.
files so that they are read-only and accessible
Page 277
4.
FortiSIEM Installation Guide FortiSIEM Installation Guide chmod 600 jmxremote.access
chmod 600 jmxremote.password
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
Settings for <device name><protocol name> Access Credentials
When setting the these settings:
Access Method Definition
for allowing AccelOps to access your Apache Tomcat application server over JMX, use
Setting
Name
Device Type
Access Protocol
Value
tomcat
Apache Tomcat
JMX
Pull Interval (minutes) 5
Port 9218
User Name
Password
The user you created in step 3
The password you created in step 3
Sample Event for Tomcat Metrics
<134>Jan 22 01:57:32 10.1.2.16 java:
[PH_DEV_MON_TOMCAT_CPU]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,
[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=9218,[app
Version]=Apache
Tomcat/7.0.27,[appServerState]=STARTED,[sysUpTime]=2458304,[cpuUtil]=0
<134>Jan 22 01:57:32 10.1.2.16 java:
[PH_DEV_MON_TOMCAT_MEMORY]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.
16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=9218,[ appVersion]=Apache
Tomcat/7.0.27,[appServerState]=STARTED,[freeMemKB]=116504,[freeSwapMemKB
]=2974020,[memTotalMB]=4095,[swapMemTotalMB]=8189,[virtMemCommitKB]=1699
00,[memUtil]=98,[swapMemUtil]=65,[heapUsedKB]=18099,[heapMaxKB]=932096,[ heapCommitKB]=48896,[heapUtil]=37,[nonHeapUsedKB]=22320,[nonHeapMaxKB]=1
33120,[nonHeapCommitKB]=24512,[nonHeapUtil]=91
<134>Jan 22 01:57:33 10.1.2.16 java:
[PH_DEV_MON_TOMCAT_SERVLET]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2
.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=9218,
[appVersion]=Apache
Tomcat/7.0.27,[webAppName]=//localhost/host-manager,[servletName]=HTMLHo
Page 278
FortiSIEM Installation Guide FortiSIEM Installation Guide stManager,[countAllocated]=0,[totalRequests]=0,[reqErrors]=0,[loadTime]=
0,[reqProcessTimeAvg]=0,[maxInstances]=20,[servletState]=STARTED
<134>Jan 22 01:57:33 10.1.2.16 java:
[PH_DEV_MON_TOMCAT_SESSION]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2
.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=9218,
[appVersion]=Apache
Tomcat/7.0.27,[webContextPath]=/host-manager,[activeSessionsPeak]=0,[act iveSessions]=0,[duplicateSession]=0,[expiredSession]=0,[rejectedSession]
=0,[sessionLifetimeAvg]=0,[sessionLifetimePeak]=0,[sessionProcessTimeMs]
=0,[sessionCreateRate]=0,[sessionExpireRate]=0,[webAppState]=STARTED,[pr ocessExpiresFrequency]=6,[maxSessionLimited]=-1,[maxInactiveInterval]=18
00
<134>Jan 22 01:57:33 10.1.2.16 java:
[PH_DEV_MON_TOMCAT_DB]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,[ hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=9218,[appV ersion]=Apache
Tomcat/7.0.27,[webContextPath]=/host-manager,[dataSource]="jdbc/postgres
1",[dbDriver]=org.postgresql.Driver,[activeSessionsPeak]=20,[activeSessi ons]=0,[idleSessionsPeak]=10,[idleSessions]=0
<134>Jan 22 01:57:33 10.1.2.16 java:
[PH_DEV_MON_TOMCAT_THREAD_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]=10
.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=9
218,[appVersion]=Apache
Tomcat/7.0.27,[threadPoolName]=ajp-apr-18009,[appPort]=18009,[totalThrea ds]=0,[busyThreads]=0,[keepAliveThreads]=0[maxThreads]=200,[threadPriori ty]=5,[threadPoolIsDaemon]=true
<134>Jan 22 01:57:33 10.1.2.16 java:
[PH_DEV_MON_TOMCAT_REQUEST_PROCESSOR]:[eventSeverity]=PHL_INFO,[destIpAd dr]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevP ort]=9218,[appVersion]=Apache
Page 279
FortiSIEM Installation Guide FortiSIEM Installation Guide
Tomcat/7.0.27,[reqProcessorName]="http-apr-18080",[recvBytes]=0,[sentByt es]=62748914,[totalRequests]=4481,[reqProcessTimeAvg]=44107,[reqProcessT imeMax]=516,[reqRate]=0,[reqErrors]=7
Page 280
FortiSIEM Installation Guide FortiSIEM Installation Guide
IBM WebSphere Configuration
What is Discovered and Monitored
Install the perfServletApp Application
Configure Security for the Application
Settings for Access Credentials
What is Discovered and Monitored
HTTPS Preferred for Monitoring over JMX
IBM WebSphere performance metrics can be obtained via HTTP(S) or JMX. The HTTP(S) based method is highly recommended since it consumes significantly less resources on AccelOps.
Protocol Information discovered
HTTP /
HTTP(S)
JMX
Syslog
Metrics collected
Generic information: Application version, Application port
Availability metrics: Uptime, Application Server State
CPU metrics: Application server instance, CPU utilization
Memory metrics: Heap utilization, Heap used memory, Heap free memory, Heap max memory, Heap commit memory
Servlet metrics: Application name, Web application name, Servlet Name, Invocation count
Database pool metrics: Application server instance, JDBC provider, Data source, Pool size, Closed connections,
Active Connections, Requests wait for connections, Connection use time, Connection factory type, Peak connections
Thread pool metrics: Application server instance, Thread pool name, Execute threads, Peak execute threads
Transaction metrics: Application server instance, Active Transaction, Committed Transaction, Rolled back
Transaction
Authentication metrics: Application name, Application server instance, Authentication Method, Count
Generic information: Application version, Application port
Availability metrics: Uptime, Application Server State
CPU metrics: Application server instance, CPU utilization
Memory metrics: Heap utilization, Heap used memory, Heap free memory, Heap max memory, Heap commit memory, Max System dumps on disk, Max heap dumps on disk
Servlet metrics: Application name, Web application name, Servlet Name, Invocation count, Request errors
Database pool metrics: Application server instance, JDBC provider, Data source, Pool size, Closed connections,
Active Connections, Requests wait for connections, Connection use time, Connection factory type, Peak connections
Thread pool metrics: Application server instance, Thread pool name, Execute threads, Peak execute threads
Application level metrics: Application name, Web application name, Application server instance, Web application context root, Active sessions, Peak active sessions
EJB metrics: Application name, Application server instance, EJB component name
Used for
Performance
Monitoring
Performance
Monitoring
Log analysis
Event Types
In
CMDB > Event Types
, search for "websphere" in the
Description
column to see the event types associated with this device.
PH_DEV_MON_WEBSPHERE_CPU (from HTTPS)
Page 281
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Dec 08 16:11:55 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_CPU]:[eventSeverity]=PHL_INFO,[destIpAddr]=10
.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=Host-10.1.2.16,[destDevPo rt]=9443,[appVersion]=8.5.5.3,[appServerInstance]=server1,[cpuUtil]
=0,[sysUpTime]=2340206,[appServerState]=RUNNING
PH_DEV_MON_WEBSPHERE_CPU (from JMX)
<134>Jan 22 02:15:23 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_CPU]:[eventSeverity]=PHL_INFO,[destIpAddr]=10
.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPo rt]=8880,[appVersion]=IBM WebSphere Application Server
7.0.0.11,[appServerInstance]=server1,[cpuUtil]=0,[sysUpTime]=42206,
[appServerState]=STARTED
PH_DEV_MON_WEBSPHERE_MEMORY (from HTTPS)
<134>Dec 08 16:11:55 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_MEMORY]:[eventSeverity]=PHL_INFO,[destIpAddr]
=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=Host-10.1.2.16,[destDe vPort]=9443,[appVersion]=8.5.5.3,[appServerInstance]=server1,[appSe rverState]=running,[heapFreeKB]=93208,[heapUsedKB]=168936,[heapComm itKB]=232576,[heapMaxKB]=262144,[heapUtil]=72
PH_DEV_MON_WEBSPHERE_MEMORY (from JMX)
<134>Jan 22 02:15:25 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_MEMORY]:[eventSeverity]=PHL_INFO,[destIpAddr]
=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDe vPort]=8880,[appVersion]=IBM WebSphere Application Server
7.0.0.11,[appServerInstance]=server1,[appServerState]=STARTED,[maxS ystemDumpsOnDisk]=10,[maxHeapDumpsOnDisk]=10,[heapFreeKB]=48140,[he apUsedKB]=172018,[heapCommitKB]=217815,[heapMaxKB]=262144,[heapUtil
]=78
PH_DEV_MON_WEBSPHERE_APP (from HTTPS)
Page 282
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Dec 08 16:11:55 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_APP]:[eventSeverity]=PHL_INFO,[destIpAddr]=10
.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=Host-10.1.2.16,[destDevPo rt]=9443,[appVersion]=8.5.5.3,[appServerInstance]=server1,[appName]
=isclite,[webAppName]=ISCAdminPortlet.war,[activeSessions]=0,[activ eSessionsPeak]=1
PH_DEV_MON_WEBSPHERE_APP (from JMX)
<134>Jan 22 02:18:24 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_APP]:[eventSeverity]=PHL_INFO,[destIpAddr]=10
.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPo rt]=8880,[appVersion]=IBM WebSphere Application Server
7.0.0.11,[appServerInstance]=server1,[appName]=isclite,[webAppName]
=isclite.war,[webContextRoot]=admin_host/ibm/console,[activeSession s]=0,[activeSessionsPeak]=1
PH_DEV_MON_WEBSPHERE_SERVLET (from HTTPS)
<134>Dec 08 16:11:55 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_SERVLET]:[eventSeverity]=PHL_INFO,[destIpAddr
]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=Host-10.1.2.16,[destD evPort]=9443,[appVersion]=8.5.5.3,[appServerInstance]=server1,[appN ame]=isclite,[webAppName]=isclite.war,[servletName]=/com.ibm.ws.con
sole.servermanagement/collectionTableLayout.jsp,[invocationCount]=2
PH_DEV_MON_WEBSPHERE_SERVLET (from JMX)
<134>Jan 22 02:15:24 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_SERVLET]:[eventSeverity]=PHL_INFO,[destIpAddr
]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destD evPort]=8880,[appVersion]=IBM WebSphere Application Server
7.0.0.11,[appServerInstance]=server1,[appName]=isclite,[webAppName]
=isclite.war,[servletName]=action,[reqErrors]=0,[invocationCount]=1
4
PH_DEV_MON_WEBSPHERE_DB_POOL (from HTTPS)
Page 283
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Dec 08 16:14:55 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_DB_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr
]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=Host-10.1.2.16,[destD evPort]=9443,[appVersion]=8.5.5.3,[appServerInstance]=server1,[jdbc
Provider]=Derby JDBC Provider
(XA),[dataSource]=jdbc/DefaultEJBTimerDataSource,[poolSize]=0,[clos edConns]=0,[activeConns]=0,[waitForConnReqs]=0,[connUseTime]=0
PH_DEV_MON_WEBSPHERE_DB_POOL (from JMX)
<134>Jan 22 02:15:23 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_DB_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr
]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destD evPort]=8880,[appVersion]=IBM WebSphere Application Server
7.0.0.11,[appServerInstance]=server1,[jdbcProvider]=Derby JDBC
Provider
(XA),[dataSource]=DefaultEJBTimerDataSource,[poolSize]=0,[closedCon ns]=0,[activeConns]=0,[waitForConnReqs]=0,[connUseTime]=0,[connFact oryType]=,[peakConns]=0
PH_DEV_MON_WEBSPHERE_THREAD_POOL (from HTTPS)
<134>Dec 08 16:14:55 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_THREAD_POOL]:[eventSeverity]=PHL_INFO,[destIp
Addr]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=Host-10.1.2.16,[d estDevPort]=9443,[appVersion]=8.5.5.3,[appServerInstance]=server1,[ threadPoolName]=WebContainer,[executeThreads]=2,[executeThreadPeak]
=6
PH_DEV_MON_WEBSPHERE_THREAD_POOL (from JMX)
<134>Jan 22 02:18:25 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_THREAD_POOL]:[eventSeverity]=PHL_INFO,[destIp
Addr]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[d estDevPort]=8880,[appVersion]=IBM WebSphere Application Server
7.0.0.11,[appServerInstance]=server1,[threadPoolName]=ORB.thread.po
ol,[executeThreads]=0,[executeThreadPeak]=0
PH_DEV_MON_WEBSPHERE_TRANSACTION (from HTTPS)
Page 284
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Dec 08 16:14:55 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_TRANSACTION]:[eventSeverity]=PHL_INFO,[destIp
Addr]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=Host-10.1.2.16,[d estDevPort]=9443,[appVersion]=8.5.5.3,[appServerInstance]=server1,[ activeTxCount]=0,[committedTxCount]=3406,[rolledBackTxCount]=0
PH_DEV_MON_WEBSPHERE_AUTHENTICATION (from HTTPS)
<134>Dec 08 16:14:55 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_AUTHENTICATION]:[eventSeverity]=PHL_INFO,[des tIpAddr]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=Host-10.1.2.16
,[destDevPort]=9443,[appVersion]=8.5.5.3,[appServerInstance]=server
1,[authenMethod]=TokenAuthentication,[count]=0
PH_DEV_MON_WEBSPHERE_EJB (from JMX)
<134>Jan 22 02:15:24 10.1.2.16 java:
[PH_DEV_MON_WEBSPHERE_EJB]:[eventSeverity]=PHL_INFO,[destIpAddr]=10
.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPo rt]=8880,[appVersion]=IBM WebSphere Application Server
7.0.0.11,[appServerInstance]=server1,[appName]=SchedulerCalendars,[ ejbComponentName]=Calendars.jar
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "websphere" in the Name column to see the reports associated with this device.
Configuration
HTTP(S)
Install the perfServletApp Application
1.
2.
3.
Log in to your Websphere administration console.
Go to
Applications > Application Types > WebSphere enterprise application.
Click
Install
.
4. Select
Remote file system
and browse to
{WebSphere_Home}/AppServer/installableApps/PerfServletApp.ear
.
5. Click
Next.
The
Context Root
for the application will be set to
/wasPerfTool
, but you can edit this during installation.
1. Go to
Security > Global Security.
2.
3.
4.
5.
Select
Enable application security
.
Go to
Applications > Application Types > Websphere Enterprise Applications
.
.
6.
Select
perfServletApp
.
Click
Click
Security role to user/group mapping
Map Users/Groups
.
7.
Page 285
FortiSIEM Installation Guide FortiSIEM Installation Guide
7.
8.
9.
10.
Use the Search feature to find and select the AccelOps user you want to provide with access to the application,
Click
Map Special Subjects
.
Select
Click
All Authenticated in Application's Realm
OK
.
Start the Application
.
1.
2.
3.
4.
Go to
Applications > Application Types > WebSphere enterprise application.
Select
perfServletApp
.
Click
Start
.
In a web browser, launch the application by going to http://<ip>:<port>/wasPerfTool/servlet/perfservlet
.
Default HTTP Port
The default port for HTTP is 9080, HTTPS is 9443. You can change these by going to
Servers > Server Types > WebSphere application servers > {serverInstance} > Configuration > Ports
.
JMX
Configuring the Default JMX Port
By default, your Websphere application server uses port 8880 for JMX. You can change this by logging in to your application server console and going to . password for JMX are the same as the credentials logging into the console.
To configure JMX communications between your Websphere application server and AccelOps, you need to copy several files from your application server to the Websphere configuration directory for each AccelOps virtual appliance that will be used for discovery and performance monitoring jobs. AccelOps does not include these files because of licensing restrictions.
1. Copy these files to the directory deployment.
/opt/phoenix/config/websphere/
for each Supervisor, Worker, and Collector in your AccelOps
File Type Location
Client Jars a. b.
${WebSphere_Home}/AppServer/runtimes/ com.ibm.ws
.admin.client.jar
${WebSphere_Home}/AppServer/plugins/ com.ibm.ws
.security.crypto.jar
SSL files a. b.
${WebSphere_Home}/AppServer/profiles/${Profile_Name}/etc/DummyClientKeyFile.jks
${WebSphere_Home}/AppServer/profiles/${Profile_Name}/etc/DummyClientTrustFile.jks
2. Install IBM JDK 1.6 or higher in the location your AccelOps deployment.
/opt/phoenix/config/websphere/java
for each Supervisor, Worker, and Collector in
You can now configure AccelOps to communicate with your IBM Websphere device by following the instructions in
Setting Access Credentials for
Device Discovery , and then initiate discovery of the device as described in the topics in
.
You can now configure AccelOps to communicate with your IBM Websphere device by following the instructions in
Setting Access Credentials for
Device Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
Settings for IBM Websphere HTTPS Access Credentials
When setting the
Access Method Definition
for letting AccelOps access your IBM Websphere device over HTTPS and SNMP, use these settings. When you are setting the
Device Credential Mapping Definition
, make sure to map both the HTTPS and SNMP credentials to the same IP address for your Websphere device.
HTTPS
Setting
Name
Device Type
Value
websphere_https
IBM Websphere App Server
Access Protocol HTTPS
Port
URL
9443
/wasPerfTools/servlet/perfservlet
Page 286
FortiSIEM Installation Guide
User Name
Password
Use the user name that you provided with access to the application
The password associated with the user that has access to the application
FortiSIEM Installation Guide
Settings for IBM Websphere SNMP Access Credentials
When setting the
Access Method Definition
for letting AccelOps access your IBM Websphere device over SNMP, use these settings.
When you are setting the
Device Credential Mapping Definition
, make sure to map both the HTTPS and SNMP credentials to the same IP address for your Websphere device.
SNMP Access Credentials for All Devices
When setting the settings. Set the
Access Method Definition
Name
and
for allowing AccelOps to communicate with your device over SNMP, use these
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own> include
Settings for IBM Websphere JMX Access Credentials
When setting the
Access Method Definition
for letting AccelOps access your IBM Websphere device over JMX, use these settings:
Setting
Name
Device Type
Access Protocol
Value
websphere
IBM Websphere App Server
JMX
Pull Interval (minutes) 5
Port 8880
User Name
Password
The administrative user for the application server
The password associated with the administrative user
Page 287
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft ASP.NET Configuration
What is Discovered and Monitored
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the
Performance Monitor Users Group
Enable DCOM Permissions for the Monitoring Account
Creating a User Who Belongs to the Domain Administrator Group
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
Enable the Monitoring Account to Access the Monitored Device
Enable DCOM Permissions for the Monitoring Account
Enable Account Privileges in WMI
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
Sample Event for ASP.NET Metrics
What is Discovered and Monitored
Protocol Information discovered
WMI
Metrics collected
Request Execution Time, Request Wait Time, Current Requests, Disconnected Requests, Queued requests, Disconnected Requests
Event Types
In
CMDB > Event Types
, search for "asp.net" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "asp.net" in the Name column to see the reports associated with this application or device.
Configuration
WMI
Used for
Performance
Monitoring
Required WMI Class
For ASP.NET metrics, make sure that the WMI class
Win32_PerfFormattedData_ASPNET_ASPNET is available on the ASP.NET
server.
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
5.
6.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Right-click
Users
and select
Create a user.
Go to
In the
Add User
.
Groups
, right-click
Distributed COM Users
, and then click
Distributed COM Users Properties
dialog, click
Add
.
Add to group
.
7.
8.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Page 288
FortiSIEM Installation Guide FortiSIEM Installation Guide
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Launch and Activation Permissions
, click
Find the user you created for the monitoring account, and make sure that user has the permission
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
Edit Limits
.
Allow
for
11.
12.
In the
Com Security
, and
Remote Activation
.
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
7.
8.
9.
10.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot e Enable
.
Click
Select the user you created for the monitoring account, and then click
In the
Advanced
.
Apply onto
Click
OK
menu, select to close the Permission Entry for CIMV2 dialog.
Edit
.
This namespace and subnamespaces
.
11.
Page 289
FortiSIEM Installation Guide FortiSIEM Installation Guide
11.
12.
13.
Click
OK
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Services and Applications
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
, select
Select
Windows Management Instrumentation
, and then click
Services
Restart
.
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
4.
5.
6.
Windows Firewall.
Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
Select Windows Firewall: Allow remote administration exception.
Run cmd.exe
and enter these commands: netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Sample Event for ASP.NET Metrics
[PH_DEV_MON_APP_ASPNET_MET]:[eventSeverity]=PHL_INFO,[fileName]=phPerfJo b.cpp,[lineNumber]=4868,[hostName]=QA-EXCHG,[hostIpAddr]=172.16.10.28,
[appGroupName]=Microsoft
ASPNET,[aspReqExecTimeMs]=0,[aspReqCurrent]=0,[aspReqDisconnected]=0,[as pReqQueued]=0,[aspReqRejected]=0,[aspReqWaitTimeMs]=0
Page 290
FortiSIEM Installation Guide FortiSIEM Installation Guide
Oracle GlassFish Server Configuration
What is Discovered and Monitored
Settings for Access Credentials
Sample Event for Glassfish Metrics
What is Discovered and Monitored
Protocol Information discovered
JMX
Metrics collected
Generic information: Application version, Application port
Availability metrics: Uptime, Application Server State
CPU metrics: CPU utilization
Memory metrics: Total memory, Free memory, Memory utilization, Virtual committed memory, Total Swap
Memory, Free Swap Memory Swap memory utilization, Heap Utilization, Heap Used Memory, Heap max memory, memory
,
Heap commit memory, Non-heap Utilization, Non-heap used memory, Non-heap max memory, Non-heap commit
Servlet metrics: Web application name, Servlet Name, Count allocated, Total requests, Request errors, Avg
Request Processing time
Session metrics: Web context path, Peak active sessions, Current active sessions, Duplicate sessions, Expired sessions, Rejected sessions, Average session lifetime, Peak session lifetime, Session processing time, Session create rate, Session expire rate, Process expire frequency, Max session limited, Max inactive Interval
Database metrics: Data source
Thread pool metrics: Current live threads, Max live threads
Request processor metrics: Request processor name, Received Bytes, Sent Bytes, Total requests, Average
Request Process time, Max Request Processing time, Request Rate, Request Errors, Max open connections,
Current open connections, Last Request URI, Last Request method, Last Request completion time
Application level metrics: Cache TTL, Max cache size, Average request processing time, App server start time,
Cookies allowed flag, Caching allowed flag, Linking allowed flag, Cross Context Allowed flag
EJB metrics: EJB component name, EJB state, EJB start time
Connection metrics: Request processor name, HTTP status code, HTTP total accesses
Used for
Performance
Monitoring
Event Types
Instructions - Remove before Publishing
Provide the prefix or keyword to use in searching for events for this application or device in the CMDB. If there are no specific event types for this device, write: There are no event types defined specifically for this device.
In
CMDB > Event Types
, search for "glassfish" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "glassfish" in the Name column to see the reports associated with this application or device.
Configuration
JMX
1. The default JMX port used by Oracle GlassFish is 8686. If you want to change it, modify the node jmx-connector ish_Home}\domains\${Domain_Name}\config\domain.xml
.
2. The username and password for JMX are the same as the web console.
of the file
${GlassF
Page 291
FortiSIEM Installation Guide FortiSIEM Installation Guide
You can now configure AccelOps to communicate with your Oracle GlassFish device by following the instructions in
Settings for Access Credentials
Settings for Oracle GlassFish JMX Access Credentials
When setting the Access Method Definition for allowing AccelOps to access your Oracle GlassFish device over JMX, use these settings.
Setting
Name
Device Type
Access Protocol
Pull Interval (minutes) 5
Value
glassfish
SUN Glassfish App Server
JMX
Port
User Name
Password
8686
The administrative user for the application server
The password associated with the administrative user
Sample Event for Glassfish Metrics
<134>Jan 22 02:00:29 10.1.2.201 java:
[PH_DEV_MON_GLASSFISH_APP]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.
201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]=868
6,[appVersion]=Sun Java System Application Server
9.1_02,[webContextRoot]=,[webAppState]=RUNNING,[cacheMaxSize]=10240,[cac heTTL]=5000,[reqProcessTimeAvg]=0,[startTime]=1358755971,[cookiesAllowed
]=true,[cachingAllowed]=false,[linkingAllowed]=false,[crossContextAllowe d]=true
<134>Jan 22 02:00:29 10.1.2.201 java:
[PH_DEV_MON_GLASSFISH_CPU]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.
201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]=868
6,[appVersion]=Sun Java System Application Server
9.1_02,[sysUpTime]=35266,[cpuUtil]=60
<134>Jan 22 02:00:29 10.1.2.201 java:
[PH_DEV_MON_GLASSFISH_MEMORY]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1
.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]=
8686,[appVersion]=Sun Java System Application Server
9.1_02,[freeMemKB]=479928,[freeSwapMemKB]=6289280,[memTotalMB]=16051,[me mUtil]=98,[swapMemUtil]=1,[swapMemTotalMB]=6142,[virtMemCommitKB]=402586
4,[heapUsedKB]=1182575,[heapMaxKB]=3106432,[heapCommitKB]=3106432,[heapU til]=38,[nonHeapUsedKB]=193676,[nonHeapMaxKB]=311296,[nonHeapCommitKB]=2
77120,[nonHeapUtil]=69
<134>Jan 22 02:00:29 10.1.2.201 java:
[PH_DEV_MON_GLASSFISH_SESSION]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.
1.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]
Page 292
FortiSIEM Installation Guide FortiSIEM Installation Guide
=8686,[appVersion]=Sun Java System Application Server
9.1_02,[webContextPath]=/__JWSappclients,[activeSessionsPeak]=0,[duplica teSession]=0,[activeSessions]=0,[expiredSession]=0,[rejectedSession]=0,[ sessionProcessTimeMs]=85,[sessionLifetimeAvg]=0,[sessionLifetimePeak]=0,
[maxSessionLimited]=-1,[maxInactiveInterval]=1800
<134>Jan 22 02:00:29 10.1.2.201 java:
[PH_DEV_MON_GLASSFISH_SERVLET]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.
1.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]
=8686,[appVersion]=Sun Java System Application Server
9.1_02,[webAppName]=phoenix,[webAppState]=RUNNING,[servletName]=DtExport
Servlet,[totalRequests]=0,[reqErrors]=0,[reqProcessTimeAvg]=0
<134>Jan 22 02:00:29 10.1.2.201 java:
[PH_DEV_MON_GLASSFISH_CONN_STAT]:[eventSeverity]=PHL_INFO,[destIpAddr]=1
0.1.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPor t]=8686,[appVersion]=Sun Java System Application Server
9.1_02,[reqProcessorName]=http8181,[httpStatusCode]=304,[httpTotalAccess es]=0
<134>Jan 22 02:00:29 10.1.2.201 java:
[PH_DEV_MON_GLASSFISH_EJB]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.
201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]=868
6,[appVersion]=Sun Java System Application Server
9.1_02,[ejbComponentName]=phoenix-domain-1.0.jar,[ejbState]=RUNNING,[sta rtTime]=1358755963,
<134>Jan 22 02:00:29 10.1.2.201 java:
[PH_DEV_MON_GLASSFISH_JMS]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.
201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]=868
6,[appVersion]=Sun Java System Application Server
9.1_02,[jmsSource]=jms/RequestQueue
<134>Jan 22 02:00:29 10.1.2.201 java:
[PH_DEV_MON_GLASSFISH_REQUEST_PROCESSOR]:[eventSeverity]=PHL_INFO,[destI pAddr]=10.1.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[de stDevPort]=8686,[appVersion]=Sun Java System Application Server
9.1_02,[reqProcessorName]=http4848,[recvBytes]=0,[sentBytes]=0,[totalReq uests]=0,[reqRate]=0,[reqProcessTimeAvg]=0,[reqProcessTimeMax]=0,[maxOpe nConnections]=0,[lastRequestURI]=null,[lastRequestMethod]=null,[lastRequ estCompletionTime]=0,[openConnectionsCount]=0,[reqErrors]=0
<134>Jan 22 02:00:29 10.1.2.201 java:
[PH_DEV_MON_GLASSFISH_THREAD_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]
=10.1.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevP ort]=8686,[appVersion]=Sun Java System Application Server
9.1_02,[liveThreads]=106,[liveThreadsMax]=138
<134>Jan 22 02:06:29 10.1.2.201 java:
[PH_DEV_MON_GLASSFISH_DB_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.
Page 293
FortiSIEM Installation Guide FortiSIEM Installation Guide
1.2.201,[hostIpAddr]=10.1.2.201,[hostName]=Host-10.1.2.201,[destDevPort]
=8686,[appVersion]=Sun Java System Application Server
9.1_02,[dataSource]=jdbc/phoenixDS
Page 294
FortiSIEM Installation Guide FortiSIEM Installation Guide
Oracle WebLogic Configuration
What is Discovered and Monitored
Settings for Access Credentials
Sample Event for WebLogic Metrics
What is Discovered and Monitored
Protocol Information discovered
JMX
Metrics collected
Generic information: Application version, Application port, SSL listen port, Listen port enabled flag, SSL listen port enabled
Availability metrics: Uptime, Application Server State
Memory metrics: Total memory, Free memory, Used memory, Memory utilization, Heap utilization, Heap used memory, Heap max memory, Heap commit memory, Total nursery memory
Servlet metrics: Application name, App server instance, Web application name, Web context name, Servlet name,
Invocation count, Servlet execution time
Database pool metrics: Application name, App server instance, Data source, Active connection count, Connection limit, Leaked connections, Reserve requests, Requests wait for connections
Thread pool metrics: App server instance, Completed requests, Execute threads, Pending requests, Standby threads, Total threads
EJB metrics: EJB component name, EJB state, EJB idle beans, EJB used beans, EJB pooled beans, EJB Waiter threads, EJB committed Transactions, EJB timedout transactions, EJB rolledback transactions, EJB activations,
EJB Passivations, EJB cache hits, EJB cache misses, EJB cache accesses, EJB cache hit ratio
Application level metrics: Application name, App server instance, Web application name, Web context root, Peak active sessions, Current active sessions, Total active sessions, Servlet count, Single threaded servlet pool count,
Used for
Performance
Monitoring
Event Types
In
CMDB > Event Types
, search for "WebLogic in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "WebLogic" in the Name column to see the reports associated with this application or device.
Configuration
JMX
Enable and Configure Internet Inter-ORB Protocol (IIOP)
1.
2.
3.
4.
Log into the administration console of your WebLogic application server.
In the
Change Center
of the administration console, click
In the left-hand navigation, expand
Environment
tab, then select
IIOP
.
Lock & Edit
and select
Servers
.
.
5.
6.
Click the
Protocols
7.
Select
Enable IIOP
.
Expand the
Advanced
options.
For
Default IIOP Username and Default IIOP Password
, enter the username and password that you will use as the access credentials when configuring AccelOps to communicate with your application server.
Enable IIOP Configuration Changes
1.
2.
Go to the
Change Center
of the administration console.
Click
Activate Changes
.
Page 295
FortiSIEM Installation Guide FortiSIEM Installation Guide
2.
You can now configure AccelOps to communicate with your IBM Websphere device by following the instructions in
Setting Access Credentials for
Device Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
Settings for Oracle WebLogic JMX Access Credentials
When setting the these settings.
Access Method Definition
for allowing AccelOps to access your Oracle WebLogic application server over JMX, use
The port for JMX is the same as the web console, and the default value is 7001.
Setting
Name
Device Type
Value
weblogic
Oracle WebLogic App Server
Access Protocol JMX
Pull Interval (minutes) 5
Port 7001
User Name
Password
The administrative user you created in step 7.
The password you created in step 7.
Sample Event for WebLogic Metrics
<134>Jan 22 02:12:20 10.1.2.16 java:
[PH_DEV_MON_WEBLOGIC_GEN]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.1
6,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=7001,[a ppVersion]=WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008 1137967
,[appServerInstance]=examplesServer,[appServerState]=RUNNING,[sysUpTime]
=1358476145,[appPort]=7001,[sslListenPort]=7002,[listenPortEnabled]=true
,[sslListenPortEnabled]=true
<134>Jan 22 02:12:20 10.1.2.16 java:
[PH_DEV_MON_WEBLOGIC_MEMORY]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.
2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=7001
,[appVersion]=WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008 1137967
,[appServerInstance]=examplesServer,[appServerState]=RUNNING,[heapUsedKB
]=153128,[heapCommitKB]=262144,[heapFreeKB]=109015,[heapUtil]=59,[heapMa xKB]=524288,[usedMemKB]=4086224,[freeMemKB]=107624,[memTotalMB]=4095,[me mUtil]=97,[nurserySizeKB]=88324
<134>Jan 22 02:12:22 10.1.2.16 java:
[PH_DEV_MON_WEBLOGIC_SERVLET]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1
.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=700
1,[appVersion]=WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008
1137967
,[appServerInstance]=examplesServer,[appName]=consoleapp,[webAppName]=ex amplesServer_/console,[servletName]=/framework/skeletons/wlsconsole/plac eholder.jsp,[webContextRoot]=/console,[invocationCount]=1094,[servletExe cutionTimeMs]=63
Page 296
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Jan 22 02:15:24 10.1.2.16 java:
[PH_DEV_MON_WEBLOGIC_DB_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1
.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=700
1,[appVersion]=WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008
1137967
,[appServerInstance]=examplesServer,[appName]=examples-demoXA-2,[dataSou rce]=examples-demoXA-2,[activeConns]=0,[connLimit]=1,[leakedConns]=0,[re serveRequests]=0,[waitForConnReqs]=0
<134>Jan 22 02:12:20 10.1.2.16 java:
[PH_DEV_MON_WEBLOGIC_THREAD_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]=
10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]
=7001,[appVersion]=WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008
1137967
,[appServerInstance]=examplesServer,[completedRequests]=14066312,[execut eThreads]=7,[pendingRequests]=0,[standbyThreads]=5,[totalThreads]=43
<134>Jan 22 02:12:20 10.1.2.16 java:
[PH_DEV_MON_WEBLOGIC_EJB]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.1
6,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=7001,[a ppVersion]=WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008 1137967
,[appServerInstance]=examplesServer,[ejbComponentName]=ejb30,[ejbIdleBea ns]=0,[ejbUsedBeans]=0,[ejbPooledBeans]=0,[ejbWaiter]=0,[ejbCommitTransa ctions]=0,[ejbTimedOutTransactions]=0,[ejbRolledBackTransactions]=0,[ejb
Activations]=0,[ejbPassivations]=0,[ejbCacheHits]=0,[ejbCacheMisses]=0,[ ejbCacheAccesses]=0,[ejbCacheHitRatio]=0
<134>Jan 22 02:12:23 10.1.2.16 java:
[PH_DEV_MON_WEBLOGIC_APP]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.1
6,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=7001,[a ppVersion]=WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008 1137967
,[appServerInstance]=examplesServer,[appName]=webservicesJwsSimpleEar,[w
Page 297
FortiSIEM Installation Guide FortiSIEM Installation Guide ebAppName]=examplesServer_/jws_basic_simple,[webContextRoot]=/jws_basic_ simple,[activeSessions]=0,[activeSessionsPeak]=0,[activeSessionTotal]=0,
[numServlet]=4,[singleThreadedServletPool]=5
Page 298
FortiSIEM Installation Guide FortiSIEM Installation Guide
Redhat JBOSS Configuration
What is Discovered and Monitored
Configuring JMX on the JBOSS Application Server
Configuring AccelOps to Use the JMX Protocol with JBOSS Application Server
Settings for Access Credentials
Sample Event for JBOSS Metrics
What is Discovered and Monitored
Protocol Information discovered
JMX
Metrics collected
Generic information: Application version, Application port
Availability metrics: Uptime, Application Server State
CPU metrics: Application server instance, CPU utilization
Memory metrics: Heap utilization, Heap used memory, Heap free memory, Heap max memory, Heap commit memory, Max System dumps on disk, Max heap dumps on disk
Servlet metrics: Application name, Web application name, Servlet Name, Invocation count, Request errors
Database pool metrics: Application server instance, JDBC provider, Data source, Pool size, Closed connections,
Active Connections, Requests wait for connections, Connection use time, Connection factory type, Peak connections
Thread pool metrics: Application server instance, Thread pool name, Execute threads, Peak execute threads
Application level metrics: Application name, Web application name, Application server instance, Web application context root, Active sessions, Peak active sessions
EJB metrics: Application name, Application server instance, EJB component name
Used for
Performance
Monitoring
Event Types
In
CMDB > Event Types
, search for "boss" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for jobs" in the Name column to see the reports associated with this application or device.
Configuration
JMX
Configuring JMX on the JBOSS Application Server
Changing the Default JMX Port
The default port for JMX is 1090. If you want to change it, modify the file
${JBoss_Home}\server\default\conf\bindingservi ce.beans\META-INF\bindings-jboss-beans.xml.
Page 299
FortiSIEM Installation Guide FortiSIEM Installation Guide
<bean class="org.boss.services.bindging.ServiceBindingMetadata">
<property name="serviceName">jboss.remoting:service=JMXConnectorServer,protoc ol=rmi</property>
<property name="port">1090</property>
<property name="description">RMI/JRMP socket for connecting to the JMX MBeanServer</property>
</bean>
1. Enable authentication security check. Open the file
MXConnector
bean, and uncomment the
${JBoss_Home}\server\default\deploy\jmx-jboss-beans.xml
, find the
J securityDomain
property.
<bean name="JMXConnector" class="org.boss.system.server.jmx.JMXConnector">
<!-- configuration properties -->
<!-- To enable authentication security checks, uncomment the following --!>
<!--UNCOMMENT THIS -->
<property name="securityDomain">jmx-console</property>
2. Modify the file
${JBoss_Home}\server\default\conf\props\jmx-console-roles.properties
administrator role.
to configure the JMX admin=JBossAdmin,HttpInvoker
3. Modify the file
${JBoss_Home}\server\default\conf\props\jmx-console-users.properties and password for JMX.
to configure the username admin=yourpassword
4. Configure DNS resolution for the JBOSS application server in your AccelOps Supervsior, Workers, and Collectors by adding the IP
5. address and DNS name of the JBOSS application server to their application server name, you can skip this step.
Start JBoss.
/etc/hosts
files. If DNS is already configured to resolve the JBOSS
${JBoss_Home}/bin/run.sh -b 0.0.0.0
or
${JBoss_Home}/bin/run.sh -b ${Binding IP}
Page 300
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring AccelOps to Use the JMX Protocol with JBOSS Application Server
To configure JMX communications between your JBOSS application server and AccelOps, you need to copy several files from your application server to the JBOSS configuration directory for each AccelOps virtual appliance that will be used for discovery and performance monitoring jobs.
AccelOps does not include these files because of licensing restrictions.
JBOSS Version Files to Copy
4.x, 5.x, 6.x
Copy
${JBoss_Home}/lib/jboss-bootstrap-api.jar
to
/opt/phoenix/config/JBoss/
7.0
7.1
No copying is necessary
Copy
${JBoss_Home}/bin/client/jboss-client.jar
to
/opt/phoenix/config/JBoss/
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
Settings for Redhat JBOSS JMX Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your <device name> over <protocol>, use these settings:
Setting
Name
Device Type
Access Protocol
Pull Interval (minutes) 5
Value
jboss
Redhat JBOSS App Server
JMX
Port
User Name
Password
8880
The user you created in step 2
The password you created for the user in step 3
Sample Event for JBOSS Metrics
<134>Feb 06 11:38:35 10.1.2.16 java:
[PH_DEV_MON_JBOSS_CPU]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,[ hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=1090,[appV ersion]=6.1.0.Final
"Neo",[appServerState]=STARTED,[sysUpTime]=6202359,[cpuUtil]=2
<134>Feb 06 11:38:36 10.1.2.16 java:
[PH_DEV_MON_JBOSS_MEMORY]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.1
6,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=1090,[a ppVersion]=6.1.0.Final
"Neo",[appServerState]=STARTED,[freeMemKB]=264776,[freeSwapMemKB]=142786
4,[memTotalMB]=4095,[memUtil]=94,[swapMemUtil]=83,[swapMemTotalMB]=8189,
[virtMemCommitKB]=1167176,[heapUsedKB]=188629,[heapMaxKB]=466048,[heapCo mmitKB]=283840,[heapUtil]=66,[nonHeapUsedKB]=106751,[nonHeapMaxKB]=31129
6,[nonHeapCommitKB]=107264,[nonHeapUtil]=99
<134>Feb 06 11:38:36 10.1.2.16 java:
Page 301
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_JBOSS_APP]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,[ hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=1090,[appV ersion]=6.1.0.Final
"Neo",[webContextRoot]=//localhost/,[webAppState]=RUNNING,[cacheMaxSize]
=10240,[cacheTTL]=5000,[reqProcessTimeAvg]=10472,[startTime]=1353919592,
[cookiesAllowed]=true,[cachingAllowed]=true,[linkingAllowed]=false,[cros sContextAllowed]=true
<134>Feb 06 11:38:36 10.1.2.16 java:
[PH_DEV_MON_JBOSS_SERVLET]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.
16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=1090,[ appVersion]=6.1.0.Final
"Neo",[webAppName]=//localhost/admin-console,[servletName]=Faces
Servlet,[totalRequests]=6,[reqErrors]=0,[loadTime]=0,[reqProcessTimeAvg]
=10610
<134>Feb 06 11:38:36 10.1.2.16 java:
[PH_DEV_MON_JBOSS_DB_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.
16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=1090,[ appVersion]=6.1.0.Final
"Neo",[dataSource]=DefaultDS,[dataSourceState]=Started
<134>Feb 06 11:38:36 10.1.2.16 java:
[PH_DEV_MON_JBOSS_REQUEST_PROCESSOR]:[eventSeverity]=PHL_INFO,[destIpAdd r]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPo rt]=1090,[appVersion]=6.1.0.Final
"Neo",[reqProcessorName]=ajp-0.0.0.0-8009,[recvBytes]=0,[sentBytes]=0,[r eqProcessTimeAvg]=0,[reqProcessTimeMax]=0,[totalRequests]=0,[reqRate]=0,
[reqErrors]=0
<134>Feb 06 11:38:36 10.1.2.16 java:
[PH_DEV_MON_JBOSS_EJB]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,[ hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=1090,[appV ersion]=6.1.0.Final
"Neo",[ejbComponentName]=ejbjar.jar,[ejbBeanName]=HelloWorldBeanRemote,[ ejbAvailCount]=0,[ejbCreateCount]=0,[ejbCurrCount]=0,[ejbMaxCount]=0,[ej bRemovedCount]=0,[ejbInstanceCacheCount]=null,[ejbPassivations]=null,[ej bTotalInstanceCount]=null
<134>Feb 06 11:38:36 10.1.2.16 java:
[PH_DEV_MON_JBOSS_THREAD_POOL]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.
1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-JMX,[destDevPort]=10
90,[appVersion]=6.1.0.Final
Page 302
FortiSIEM Installation Guide FortiSIEM Installation Guide
"Neo",[threadPoolName]=ajp-0.0.0.0-8009,[appPort]=8009,[totalThreads]=0,
[busyThreads]=0,[maxThreads]=2048,[threadPriority]=5,[pollerSize]=32768,
[threadPoolIsDaemon]=true
Page 303
FortiSIEM Installation Guide
Authentication Server Configuration
AccelOps supports these authentication servers for discovery and monitoring.
Cisco Access Control Server (ACS) Configuration
Microsoft Internet Authentication Server (IAS) Configuration
Juniper Networks Steel-Belted RADIUS Configuration
CyberArk Password Vault Configuration
FortiSIEM Installation Guide
Page 304
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Access Control Server (ACS) Configuration
What is Discovered and Monitored
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the
Performance Monitor Users Group
Enable DCOM Permissions for the Monitoring Account
Creating a User Who Belongs to the Domain Administrator Group
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
Enable the Monitoring Account to Access the Monitored Device
Enable DCOM Permissions for the Monitoring Account
Enable Account Privileges in WMI
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP Application type
WMI
Syslog
Application type, service mappings
Application type
Metrics collected
Process level CPU utilization, Memory utilization
Process level metrics: uptime, CPU Utilization, Memory utilization, Read I/O, Write
I/O
Successful and Failed Authentications, Successful and Failed administrative logons,
RADIUS accounting logs
Used for
Performance Monitoring
Performance Monitoring
Security Monitoring and compliance
Event Types
In
CMDB > Event Types
device.
, search for "cisco secure acs" in the
Device Type
and
Description
column to see the event types associated with this
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
1.
2.
3.
4.
Log into the device you want to enable SNMP for as an administrator.
Go to
Control Panel >Program and Features.
Click
Turn Windows features on or off .
If you are installing on a Windows 7 device, select
Simple Network Management Protocol (SNMP).
Features > Add features > SNMP Services
.
5.
6.
If you are installing on a Windows 2008 device, in the
Server Manager
window, go to
7.
If necessary, select SNMP to enable the service.
Go to
Programs > Administrative Tools > Services.
to set the SNMP community string and include AccelOps in the list of hosts that can access this server via SNMP.
8. Select
SNMP Service and right-click Properties.
9.
10.
Set the community string to public.
11.
Go to the Security tab and enter the AccelOps IP Address.
Restart the SNMP service.
WMI
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Page 305
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
11.
12.
mote Access
.
Click
OK
.
In the
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
In the
Com Security
Com Security
tab, under
Launch and Activation Permissions
, click
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
Edit Defaults
.
Allow
for
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Local Access
and
Re
Local Access
and
Re
Page 306
FortiSIEM Installation Guide FortiSIEM Installation Guide
12.
Enable Account Privileges in WMI
, and
Remote Activation
.
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
Windows Firewall.
4. Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
5.
6.
Select
Run
Windows Firewall: Allow remote administration exception.
cmd.exe
and enter these commands: netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
Syslog
1.
2.
3.
4.
5.
Log in to your Cisco Access Controls Server as an administrator.
Go to
Start > All Programs > CiscoSecure ACS v4.1 > ACS Admin
.
In the left-hand navigation, click System Configuration, then click
Select
Syslog
for
For each of these reports, click
Configure
under
Logging
, and
.
RADIUS Accounting
to send these reports to AccelOps.
CSV
, and select the following attributes to include in the CSV output.
Report
Failed Attempts
CSV Attributes
Message-Type
User-Name
NAS-IP-Address
Authen-Failure-Code
Author-Failure-Code
Caller-ID
NAS-Port
Author-Date
Group-Name
Filter Information
Access Device
AAA Server
Page 307
5.
FortiSIEM Installation Guide FortiSIEM Installation Guide
Passed Authentication
RADIUS Accounting
Message-Type
User-Name
NAS-IP-Address
Authen-Failure-Code
Author-Failure-Code
Caller-ID
NAS-Port
Author-Date
Group-Name
Filter Information
Access Device
AAA Server
Proxy-IP-Address
Source-NAS
PEAP/EAP-FAST-Clear-Name
Real Name
User-Name
NAS-IP-Address
NAS-Port
Group-Name
Service-Type
Framed-Protocol
Framed-IP-Address
Calling-Station-Id
Acct-Status-Type
Acct-Input-Octets
Acct-Output-Octets
Acct-Session-Id
Acct-Session-Time
Acct-Input-Packets
Acct-Output-Packets
6.
7.
For each of these reports, click
Configure
under
Syslog
, and for that will receive the syslogs as the syslog server, enter 514 for
Syslog Server
Port
, and set
IP
To make sure your changes take effect, go to
System Configuration > Service Control
, and click
to .
Restart ACS
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 308
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft Internet Authentication Server (IAS) Configuration
What is Discovered and Monitored
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
WMI
Syslog
Event Types
In
CMDB > Event Types
, search for "microsoft isa" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
WMI
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
Page 309
FortiSIEM Installation Guide FortiSIEM Installation Guide
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Launch and Activation Permissions
, click
Find the user you created for the monitoring account, and make sure that user has the permission
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
Edit Limits
.
Allow
for
11.
12.
In the
Com Security
, and
Remote Activation
.
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
4.
Windows Firewall.
5.
6.
Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
Select Windows Firewall: Allow remote administration exception.
Run cmd.exe
and enter these commands:
Page 310
FortiSIEM Installation Guide netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Syslog
You need to configure your Microsoft Internet Authentication Server to save logs, and then you can use the Windows Agent Manager to configure the type of log information you want sent to AccelOps.
1.
2.
3.
4.
5.
6.
Log in to your server as an administrator.
Go to
Start > Administrative Tools > Internet Authentication Service
.
In the left-hand navigation, select Remote Access Logging, then select
Right-click on
For
Directory
, enter
Click
OK
.
Local File
to open the
Properties
Local File
menu, and then select
Log File
.
C:\WINDOWS\system32\LogFiles\IAS
.
.
You can now use Windows Agent Manager
to configure what information will be sent to AccelOps.
Page 311
FortiSIEM Installation Guide FortiSIEM Installation Guide
Juniper Networks Steel-Belted RADIUS Configuration
What is Discovered and Monitored
Protocol Information discovered
SNMP
WMI
Syslog
Application type
Application type, service mappings
Application type
Metrics collected
Process level CPU utilization, Memory utilization
Process level metrics: uptime, CPU Utilization, Memory utilization, Read I/O, Write
I/O
Successful and Failed Authentications, Successful and Failed administrative logons,
RADIUS accounting logs
Used for
Performance Monitoring
Performance Monitoring
Security Monitoring and compliance
Event Types
In
CMDB > Event Types
device.
, search for "Juniper Steel-Belted RADIUS" in the
Device Type
column to see the event types associated with this
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Syslog
1.
2.
Login as administrator
Install and configure Epilog application to convert log files written by Steelbelted RADIUS server into syslogs for sending to AccelOps a. b.
Download Epilog from Epilog download site and install it on your Windows Server.
Launch Epilog from StartAll ProgramsInterSect AllianceEpilog for windows c. Configure Epilog application as follows i. Select Log Configuration on left hand panel, click Add button to add log files whose content needs to be sent to
AccelOps. These log files are written by the Steelbelted RADIUS server and their paths are correct. Also make sure the
Log Type is SteelbeltedLog.
ii. Select Network Configuration on left hand panel. On the right, set the destination address to that of AccelOps server, port to 514 and make sure that syslog header is enabled. Then click Change Configuration button.
iii. Click the "Apply the latest audit configuration" link on the left hand side to apply the changes to Epilog applications.
DHCP logs will now sent to AccelOps in real time.
Page 312
FortiSIEM Installation Guide FortiSIEM Installation Guide
Vasco DigiPass Configuration
What is Discovered and Monitored
Protocol Information discovered
Syslog
Metrics collected
Successful and Failed Authentications, Successful and Failed administrative logons
Used for
Security Monitoring and compliance
Event Types
In
CMDB > Event Types
important ones are
, search for "Vasco DigiPass" in the
Device Type
column to see the event types associated with this device. Some
Vasco-DigiPass-KeyServer-AdminLogon-Success
Vasco-DigiPass-KeyServer-UserAuth-Success
Vasco-DigiPass-KeyServer-UserAuth-Failed
Vasco-DigiPass-KeyServer-AccountLocked
Vasco-DigiPass-KeyServer-AccountUnlocked
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Configure the Vasco DigiPass management Console to send syslog to AccelOps. AccelOps is going to parse the logs automatically. Make sure the syslog format is as follows.
Page 313
FortiSIEM Installation Guide FortiSIEM Installation Guide
May 16 18:21:50 vascoservername ikeyserver[3575]: {Success},
{Administration}, {S-001003}, {A command of type [User] [Unlock] was successful.}, {0xA46B6230BA60B240CE48011B0C30D393}, {Source
Location:10.1.2.3}, {Client Location:10.1.2.3}, {User ID:flast},
{Domain:company.com}, {Input Details: {User ID : flast} {Domain Name : company.com}}, {Output Details: {User ID : flast} {Password : ********}
{Created Time : 2013/05/13 19:06:52} {Modified Time : 2013/05/16
18:21:49} {Has Digipass : Unassigned} {Status : 0} {Domain Name : company.com} {Local Authentication : Default} {Back-end Authentication :
Default} {Disabled : no} {Lock Count : 0} {Locked : no} {Last Password
Set Time : 2013/05/13 19:06:52} {Static Password History : d0NdVMhSdvdNEQJkkKTWmiq8iB4K1dWreMf5FQlZM7U=} {Key ID :
SSMINSTALLSENSITIVEKEY}}, {Object:User}, {Command:Unlock}, {Client
Type:Administration Program}
May 15 20:27:35 vascoservername ikeyserver[3575]: {Success},
{Administration}, {S-004001}, {An administrative logon was successful.},
{0x25AB20F3222F554A96CFFD2886AE4C71}, {Source Location:10.1.2.3},
{Client Location:10.1.2.3}, {User ID:admin}, {Domain:company.com},
{Client Type:Administration Program}
May 17 18:43:22 vascoservername ikeyserver[3582]: {Info},
{Initialization}, {I-002010}, {The SOAP protocol handler has been initialized successfully.}, {0x0E736D24D54E717E6F5DA6C09E89F8EE},
{Version:3.4.7.115}, {Configuration Details:IP-Address: 10.1.2.3,
IP-Port: 8888, Supported-Cipher-Suite: HIGH, Server-Certificate:
/var/identikey/conf/certs/soap-custom.pem, Private-Key-Password:
********, CA-Certificate-Store:
/var/identikey/conf/certs/soap-ca-certificate-store.pem,
Client-Authentication-Method: none, Reverify-Client-On-Reconnect: False,
DPX-Upload-Location: /var/dpx/}
Page 314
FortiSIEM Installation Guide FortiSIEM Installation Guide
CyberArk Password Vault Configuration
What is Discovered and Monitored
Protocol
Syslog (CEF formatted and others)
Information discovered Logs parsed Used for
CyberArk Safe Activity Security Monitoring and compliance
Event Types
In
CMDB > Event Types
, search for "CyberArk-Vault" in the
Device Type
column to see close to 400 event types associated with this device.
Rules
In > , search for "CyberArk":
CyberArk Vault Blocked Failure
CyberArk Vault CPM Password Disables
CyberArk Vault Excessive Failed PSM Connections
CyberArk Vault Excessive Impersonations
CyberArk Vault Excessive PSM Keystroke Logging Failure
CyberArk Vault Excessive PSM Session Monitoring Failure
CyberArk Vault Excessive Password Release Failure
CyberArk Vault File Operation Failure
CyberArk Vault Object Content Validation Failure
CyberArk Vault Unauthorized User Stations
CyberArk Vault User History Clear
Reports
In > , search for "CyberArk":
CyberArk Blocked Operations
CyberArk CPM Password Disables
CyberArk CPM Password Retrieval
CyberArk File Operation Failures
CyberArk Impersonations
CyberArk Object Content Validation Failures
CyberArk PSM Monitoring Failures
CyberArk Password Resets
CyberArk Privileged Command Operations
CyberArk Provider Password Retrieval
CyberArk Trusted Network Area Updates
CyberArk Unauthorized Stations
CyberArk User History Clears
CyberArk User/Group Modification Activity
CyberArk Vault CPM Password Reconcilations
CyberArk Vault CPM Password Verifications
CyberArk Vault Configuration Changes
CyberArk Vault Failed PSM connections
CyberArk Vault Modification Activity
CyberArk Vault PSM Keystore Logging Failures
CyberArk Vault Password Changes from CPM
CyberArk Vault Password Release Failures
CyberArk Vault Successful PSM Connections
Top CyberArk Event Types
Top CyberArk Safes, Folders By Activity
Top CyberArk Users By Activity
CyberArk Configuration for sending syslog in a specific format
1. Open \PrivateArk\Server\DBParm.ini file and edit the SYSLOG section: a. b. c. d.
SyslogServerIP – Specify AccelOps supervisor, workers and collectors separated by commas.
SyslogServerProtocol – Set to the default value of UDP.
e. f.
SyslogServerPort – Set to the default value of 514.
SyslogMessageCodeFilter – Set to the default range 0-999.
SyslogTranslatorFile – Set to Syslog\AccelOps.xsl.
UseLegacySyslogFormat - Set to the default value of No.
2. Copy the relevant XSL translator file to the Syslog subfolder specified in the SyslogTranslatorFile parameter in DBParm.ini.
Page 315
FortiSIEM Installation Guide
3. Stop and Start Vault (Central Server Administration) for the changes to take effect.
Make sure the syslog format is as follows.
<5>1 2016-02-02T17:24:42Z SJCDVVWCARK01 CYBERARK:
Product="Vault";Version="9.20.0000";MessageID="295";Message="Retrieve password";Issuer="Administrator";Station="10.10.110.11";File="Root\snmpC ommunity";Safe="TestPasswords";Reason="Test";Severity="Info"
<30>Mar 22 20:13:42 VA461_1022 CyberArk AIM[2453]: APPAP097I Connection to the Vault has been restored
<27>Mar 22 20:10:50 VA461_1022 CyberArk AIM[2453]: APPAP289E Connection to the Vault has failed. Further attempts to connect to the Vault will be avoided for [1] minutes.
<27>Mar 24 23:41:58 VA461_1022 CyberArk AIM[2453]: APPAU002E Provider
[Prov_VA461_1022] has failed to fetch password with query
[Safe=TestPutta;Object=Telnet91] for application [AccelOps]. Fetch reason: [APPAP004E Password object matching query
Page 316
FortiSIEM Installation Guide
Database Server Configuration
AccelOps supports these database servers for discovery and monitoring.
Microsoft SQL Server Configuration
SQL Server Database Level Event Creation Script (PH_Database_Level_Events.sql)
SQL Server DDL Event Creation Script (PH_DDL_Server_Level_Events.sql)
SQL Server Table Creation Script (PH_EventDB_Tables_Create.sql)
SQL Server Trigger Creation Script (PH_LogonEventsTrigger.sql)
Oracle Database Server Configuration
FortiSIEM Installation Guide
Page 317
FortiSIEM Installation Guide FortiSIEM Installation Guide
IBM DB2 Server Configuration
What is Discovered and Monitored
Configuring IBM DB2 Audit on Linux - DB2 side
Configuring IBM DB2 Audit on Windows - DB2 side
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP Application type
Metrics collected
Process level CPU and memory utilization
WMI
JDBC
Application type, service mappings
None
Process level metrics: uptime, CPU utilization, Memory utilization, Read I/O KBytes/sec, Write I/O
KBytes/sec
Database audit trail: Successful and failed database log on, Database CREATE/DELETE/MODIFY operations, Table CREATE/DELETE/MODIFY/INSERT operations
Event Types
In
CMDB > Event Types
, search for "db2" in the
Device Type
and
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Configuring IBM DB2 Audit on Linux - DB2 side
1.
2.
3.
Log in to IBM Installation Manager.
Click the
Databases
Enter these settings.
+ Database Connection
Field
Database
Connection
Name
Data
Server
Type
Database
Name
Setting
Enter a name for the connection, such as AccelOps
DB2 for Linux, Unix, and Windows
Host name db2.org
Port number
50000
Clear text password JDBC
Security
User ID The username you want to use to access this Server from AccelOps
Password The password you want to use with the User ID
.
Used for
Performance
Monitoring
Performance
Monitoring
Security
Monitoring
Page 318
3.
FortiSIEM Installation Guide FortiSIEM Installation Guide
JDBC URL jdbc:db2://db2.org:50000/<databasename>:retrieveMessagesFromServerOnGetMessage=true;securityMechanism=3;
4.
5.
6.
7.
8.
9.
10.
In the
Job Manager
tab, click
For
Name
, enter
For
Type
, select D
Click
OK
.
Add script.
audit
.
Add database to audit task.
Add Job
B2 CLP Script
.
Add schedule detail to audit task.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Configuring IBM DB2 Audit on Windows - DB2 side
1.
2.
3.
Create a non-admin user on Windows, for example “AoAuditUser” , and set password
Login DB2 task center, add the user to DB Users, connect it to database
Grant Permission (use Administrator), use commands below a. Grant audit permission to db2admin db2 connect to sample user administrator using 'ProspectHills!'
DB2 GRANT EXECUTE ON PROCEDURE SYSPROC.AUDIT_ARCHIVE TO
DB2ADMIN
DB2 GRANT EXECUTE ON PROCEDURE SYSPROC.AUDIT_DELIM_EXTRACT TO
DB2ADMIN db2 grant load on database to db2admin db2 grant secadm on database to db2admin db2 connect reset b. Grant query permission to non-admin user db2 connect to sample user db2admin using 'ProspectHills!' db2 grant select on AUDIT to AOAuditUser db2 grant select on CHECKING to AOAuditUser db2 grant select on OBJMAINT to AOAuditUser db2 grant select on SECMAINT to AOAuditUser db2 grant select on SYSADMIN to AOAuditUser db2 grant select on VALIDATE to AOAuditUser db2 grant select on CONTEXT to AOAuditUser db2 grant select on EXECUTE to AOAuditUser db2 connect reset c. check permission for non-admin user
Page 319
3. c.
FortiSIEM Installation Guide FortiSIEM Installation Guide db2 connect to sample user AOAuditUser using 'ProspectHills!' db2 select count (*) from DB2ADMIN.AUDIT
db2 select count (*) from DB2ADMIN.CHECKING
db2 select count (*) from DB2ADMIN.OBJMAINT
db2 select count (*) from DB2ADMIN.SECMAINT
db2 select count (*) from DB2ADMIN.SYSADMIN
db2 select count (*) from DB2ADMIN.VALIDATE
db2 select count (*) from DB2ADMIN.CONTEXT
db2 select count (*) from DB2ADMIN.EXECUTE
db2 connect reset
4.
5.
Create Catalog with db2admin
Create task in DB2 user Administrator: a. b. c.
Open DB2 task center, create a task like below
Add schedule
Add task
Settings for Access Credentials
Settings for IBM DB2 JDBC Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your <device name> over <protocol>, use these settings:
Setting
Name
Device Type
Value
db2_linux
IBM DB2
Access Protocol
Used For
Pull Interval (minutes) 5
Port 50000
Database Name
JDBC audit
Audit Table
Checking Table
ObjMaint Table
SecMaint Table
SysAdmin Table
Validate Table
Context Table
Execute Table
User Name
Password db2inst1.AUDIT
db2inst1.CHECKING
db2inst1.OBJMAINT
db2inst1.SECMAINT
db2inst1.SYSADMIN
db2inst1.VALIDATE
db2inst1.CONTEXT
db2inst1.EXECUTE
The administrative user for your IBM DB2 server
The password associated with the administrative user for your IBM DB2 server
Sample Events
Page 320
FortiSIEM Installation Guide FortiSIEM Installation Guide
IBMDB2_CHECKING_OBJECT
<134>May 14 13:57:39 10.1.2.68 java:
[IBMDB2_CHECKING_OBJECT]:[eventSeverity]=PHL_INFO,[objName]=TABLES,[srcI pAddr]=127.0.0.1,[srcApp]=DB2HMON,[dbName]=SAMPLE,[appVersion]=DB2 v10.1.0.0,[instanceName]=db2inst1,[eventTime]=2014-05-14-13.44.41.085567
,[user]=db2inst1,[eventCategory]=CHECKING,[dbRetCode]=0
IBMDB2_CHECKING_FUNCTION
<134>May 14 13:57:39 10.1.2.68 java:
[IBMDB2_CHECKING_FUNCTION]:[eventSeverity]=PHL_INFO,[objName]=CHECKING,[ srcIpAddr]=127.0.0.1,[srcApp]=DB2HMON,[dbName]=SAMPLE,[appVersion]=DB2 v10.1.0.0,[instanceName]=db2inst1,[eventTime]=2014-05-14-13.44.40.739649
,[user]=db2inst1,[eventCategory]=CHECKING,[dbRetCode]=0
IBMDB2_STATEMENT
<134>May 14 13:57:40 10.1.2.68 java:
[IBMDB2_STATEMENT]:[eventSeverity]=PHL_INFO,[srcIpAddr]=127.0.0.1,[srcAp p]=db2bp,[dbName]=SAMPLE,[appVersion]=DB2 v10.1.0.0,[instanceName]=db2inst1,[eventTime]=2014-05-14-13.48.59.433204
,[user]=db2inst1,[eventCategory]=EXECUTE,[dbRetCode]=0
IBMDB2_COMMIT
<134>May 14 13:57:40 10.1.2.68 java:
[IBMDB2_COMMIT]:[eventSeverity]=PHL_INFO,[srcIpAddr]=10.1.2.81,[srcApp]= db2jcc_application,[dbName]=SAMPLE,[appVersion]=DB2 v10.1.0.0,[instanceName]=db2inst1,[eventTime]=2014-05-14-13.51.30.447924
,[srcName]=SP81,[user]=db2inst1,[eventCategory]=EXECUTE,[dbRetCode]=0
IBMDB2_ROLLBACK
<134>May 14 13:57:40 10.1.2.68 java:
[IBMDB2_ROLLBACK]:[eventSeverity]=PHL_INFO,[srcIpAddr]=127.0.0.1,[srcApp
]=db2bp,[dbName]=SAMPLE,[appVersion]=DB2 v10.1.0.0,[instanceName]=db2inst1,[eventTime]=2014-05-14-13.43.43.827986
,[user]=db2inst1,[eventCategory]=EXECUTE,[dbRetCode]=0
IBMDB2_CONNECT
<134>May 14 13:57:40 10.1.2.68 java:
[IBMDB2_CONNECT]:[eventSeverity]=PHL_INFO,[srcIpAddr]=127.0.0.1,[srcApp]
=DB2HMON,[dbName]=SAMPLE,[appVersion]=DB2 v10.1.0.0,[instanceName]=db2inst1,[eventTime]=2014-05-14-13.44.39.991288
,[user]=db2inst1,[eventCategory]=EXECUTE,[dbRetCode]=0
IBMDB2_CONNECT_RESET
<134>May 14 13:57:40 10.1.2.68 java:
[IBMDB2_CONNECT_RESET]:[eventSeverity]=PHL_INFO,[srcIpAddr]=127.0.0.1,[s rcApp]=db2bp,[dbName]=SAMPLE,[appVersion]=DB2 v10.1.0.0,[instanceName]=db2inst1,[eventTime]=2014-05-14-13.43.43.829149
,[user]=db2inst1,[eventCategory]=EXECUTE,[dbRetCode]=0
IBMDB2_CREATE_OBJECT
<134>May 14 13:57:40 10.1.2.68 java:
[IBMDB2_CREATE_OBJECT]:[eventSeverity]=PHL_INFO,[objName]=CAN_MONITOR=CA
N_MONITOR_FUNC,[srcIpAddr]=10.1.2.68,[srcApp]=DS_ConnMgt_,[dbName]=SAMPL
E,[appVersion]=DB2 v10.1.0.0,[instanceName]=db2inst1,[eventTime]=2014-05-14-13.30.14.827242
Page 321
FortiSIEM Installation Guide FortiSIEM Installation Guide
,[srcName]=10.1.2.68,[user]=db2inst1,[eventCategory]=OBJMAINT,[dbRetCode
]=0
IBMDB2_JDBC_PULL_STAT
<134>May 14 13:57:39 10.1.2.68 java:
[IBMDB2_JDBC_PULL_STAT]:[eventSeverity]=PHL_INFO,[reptModel]=DB2,[dbName
]=SAMPLE,[instanceName]=db2inst1,[reptVendor]=IBM,[rptIp]=10.1.2.68,[aud itEventCount]=30,[relayIp]=10.1.2.68,[dbEventCategory]=db2inst1.AUDIT,[a ppGroupName]=IBM DB2 Server
IBMDB2_ARCHIVE
<134>May 14 13:57:39 10.1.2.68 java:
[IBMDB2_ARCHIVE]:[eventSeverity]=PHL_INFO,[srcIpAddr]=127.0.0.1,[srcApp]
=db2bp,[dbName]=SAMPLE,[appVersion]=DB2 v10.1.0.0,[instanceName]=db2inst1,[eventTime]=2014-05-14-13.43.44.002046
,[user]=db2inst1,[eventCategory]=AUDIT,[dbRetCode]=0
IBMDB2_EXTRACT
<134>May 14 13:57:39 10.1.2.68 java:
[IBMDB2_EXTRACT]:[eventSeverity]=PHL_INFO,[srcIpAddr]=127.0.0.1,[srcApp]
=db2bp,[dbName]=SAMPLE,[appVersion]=DB2 v10.1.0.0,[instanceName]=db2inst1,[eventTime]=2014-05-14-13.38.45.865016
,[user]=db2inst1,[eventCategory]=AUDIT,[dbRetCode]=0
IBMDB2_LIST_LOGS
<134>May 14 14:03:39 10.1.2.68 java:
[IBMDB2_LIST_LOGS]:[eventSeverity]=PHL_INFO,[srcIpAddr]=127.0.0.1,[srcAp
Page 322
FortiSIEM Installation Guide FortiSIEM Installation Guide p]=db2bp,[dbName]=SAMPLE,[appVersion]=DB2 v10.1.0.0,[instanceName]=db2inst1,[eventTime]=2014-05-14-13.58.43.204054
,[user]=db2inst1,[eventCategory]=AUDIT,[dbRetCode]=0
Page 323
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft SQL Server Configuration
What is Discovered and Monitored
Enabling SNMP on Windows Server 2003
Enabling SNMP on Windows 7 or Windows Server 2008 R2
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
JDBC for Performance Monitoring
Create a Read-Only User to Access System Tables
JDBC for Database Audit Trail Collection
Create a Read-Only User to Access System Tables
Settings for Access Credentials
Per Instance Performance Metrics
Per Instance, per Database Performance Metrics
Supported Versions
SQL Server 2005
SQL Server 2008
SQL Server 2008 R2
SQL Server 2012
SQL Server 2014
What is Discovered and Monitored
The following protocols are used to discover and monitor various aspects of Microsoft SQL server.
Protocol Information discovered
SNMP
WMI
WMI
Application type
Application type, service mappings
Metrics collected
Process level CPU and memory utilization
Process level metrics: uptime, CPU utilization, Memory utilization, Read I/O KBytes/sec, Write I/O KBytes/sec
JDBC
JDBC
JDBC
Used for
Performance
Monitoring
Performance
Monitoring
Windows application event logs - successful and failed login
General database info: database name, database version, database size, database owner, database created date, database status, database compatibility level
Database configuration Info
: Configure name, Configure value, Configure max and min value, Configure running value
Database backup Info:
Database name, Last backup date, Days since last backup
Database performance metrics (per-instance): Buffer cache hit ratio, Log cache hit ratio, Transactions /sec,
Page reads/sec, Page writes/sec, Page splits/sec, Full scans/sec, Deadlocks/sec, Log flush waits/sec, Latch waits/sec, Data file(s) size, Log file(s) used, Log growths, Log shrinks, User connections, Target server memory,
Total Server Memory, Active database users, Logged-in database users, Available buffer pool pages, Free buffer pool pages, Average wait time
Database performance metrics (per-instance, per-database):
Database name, Data file size, Log file used, Log growths, Log shrinks, Log flush waits/sec, Transaction /sec, Log cache hit ratio
Locking info: Database id, Database object id, Lock type, Locked resource, Lock mode, Lock status
Blocking info
Blocking Sp Id, Blocking Login User, Blocking Database, Blocking Command, Blocking Process Name, Blocked duration
: Blocked Sp Id, Blocked Login User, Blocked Database, Blocked Command, Blocked Process Name,
Security
Monitoring
Availability
Monitoring
Performance
Monitoring
Performance
Monitoring
Page 324
FortiSIEM Installation Guide FortiSIEM Installation Guide
JDBC
JDBC None
Database error log
Database audit trail: Failed database logon is also collected through performance monitoring as logon failures cannot be collected via database triggers.
Database audit trail: Successful and failed database logon, Various database operation audit trail including
CREATE/ALTER/DROP/TRUNCATE operations on tables, table spaces, databases, clusters, users, roles, views, table indices, triggers etc.
Availability /
Performance
Monitoring
Security
Monitoring and compliance
Event Types
In
CMDB > Event Types
device.
, search for "sql server" in the
Device Name
and
Description
column to see the event types associated with this
Rules
In
Analytics > Rules
, search for " sql server" in the
Name
column to see the rules associated with this application or device.
Reports
In Analytics > Reports, search for "sql server" in the Name column to see the reports associated with this application or device.
Configuration
SNMP
Enabling SNMP on Windows Server 2003
SNMP is typically enabled by default on Windows Server 2003, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you need to make sure that the SNMP Management tool has been enabled for your device.
1.
2.
In the
Start
menu, go to
Administrative Tools > Services
.
Go to
Control Panel > Add or Remove Programs
.
3. Click
Add/Remove Windows Components
.
4. Select
Management and Monitoring Tools
and click
Details
.
Make sure that
Simple Network Management Tool
is selected.
9.
10.
11.
12.
5.
6.
7.
8.
If it isn't selected, select it, and then click
Next
to install.
Go to Start > Administrative Tools > Services.
Select and open
SNMP Service
.
Click the
Security
Select
Under
tab.
Send authentication trap
Accepted communities
15.
Click
Click
Add
.
Apply
Under
.
SNMP Service
, click
.
, make sure there is an entry for
public
that is set to
read-only.
13.
14.
Select
Accept SNMP packets from these hosts.
Click
Add.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Restart service
.
Enabling SNMP on Windows 7 or Windows Server 2008 R2
SNMP is typically enabled by default on Windows Server 2008, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you should check that SNMP Services have been enabled for your server.
1.
2.
3.
4.
9.
10.
11.
12.
5.
6.
7.
8.
13.
14.
15.
Log in to the Windows 2008 Server where you want to enable SNMP as an administrator.
In the
Under
Under
If not, click
Add Feature
, then select
In the
Click
Click
Under
Start
Add
.
Apply
menu, select
Control Panel
.
Programs
Features
Select and open
Click the
Select
.
, click
, see if
Server Manager
SNMP Service
Turn Windows features on/off
SNMP Services
is installed.
SNMP Service
Security
tab.
window, go to
, click
.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
Select
Accept SNMP packets from these hosts.
Click
Add.
public
that is set to
read-only.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Restart service
.
.
SMNP Service
and click
Next
to install the service.
Services > SNMP Services
.
Page 325
FortiSIEM Installation Guide FortiSIEM Installation Guide
WMI
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
8.
mote Access
Click
OK
.
.
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
Local Access
and
Re
Local Access
and
Re
9.
Page 326
FortiSIEM Installation Guide FortiSIEM Installation Guide
9.
10.
In the
Com Security
tab, under
Launch and Activation Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click 11.
12.
In the
Com Security
, and
Remote Activation
.
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
4.
Windows Firewall.
Select
Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
5.
6.
Select Windows Firewall: Allow remote administration exception.
Run cmd.exe
and enter these commands: netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
JDBC for Performance Monitoring
Creating an User for SQL Server Monitoring
A regular Windows account cannot be used for SQL Server monitoring. AccelOps runs on Linux and certain windows libraries needed to do so are not available on Linux. You have to create a separate user with read-only privileges.
Create a Read-Only User to Access System Tables
1. Log in to your SQL Server with an sa account, and then create a read-only user to access system tables.
Page 327
1.
FortiSIEM Installation Guide FortiSIEM Installation Guide
EXEC SP_ADDLOGIN 'AOPerfLogin', 'ProspectHills!', 'master';
EXEC SP_ADDROLE 'AOPerfRole';
EXEC SP_ADDUSER 'AOPerfLogin', 'AOPerfUser', 'AOPerfRole';
GRANT VIEW SERVER STATE TO AOPerfLogin;
GRANT SELECT ON dbo.sysperfinfo TO AOPerfRole;
GRANT EXEC on xp_readerrorlog to AOPerfRole
2. Log in with your newly created read-only account and run these commands.
Check to see if you get the same results with your read-only account as you do with your sa account.
SP_WHO2 'active';
SELECT * FROM sys.databases;
SELECT * FROM dbo.sysperfinfo;
SELECT COUNT(*) as count FROM sysprocesses GROUP BY loginame;
3. The following additional configuration steps should be performed for the collection of Logon Failures.
a. b. c.
For Server 2012 -
For Server 2014 - https://technet.microsoft.com/en-us/library/ms175850(v=sql.110).aspx
https://technet.microsoft.com/sr-latn-rs/library/ms175850(v=sql.120)
For Server 2016 - https://msdn.microsoft.com/en-us/library/ms175850.aspx
JDBC for Database Audit Trail Collection
Creating a User for SQL Server Monitoring
A regular Windows account cannot be used for SQL Server monitoring. AccelOps runs on Linux and certain windows libraries needed to do so are not available on Linux. You have to create a separate user with read-only privileges.
Create a Read-Only User to Access System Tables
1. Log in to your SQL Server with an sa account, and then create a read-only user to access system tables.
EXEC SP_ADDLOGIN 'AOPerfLogin', 'ProspectHills!', 'master';
EXEC SP_ADDROLE 'AOPerfRole';
EXEC SP_ADDUSER 'AOPerfLogin', 'AOPerfUser', 'AOPerfRole';
GRANT VIEW SERVER STATE TO AOPerfLogin;
GRANT SELECT ON dbo.sysperfinfo TO AOPerfRole;
GRANT EXEC on xp_readerrorlog to AOPerfRole
1.
2.
3.
Save the four SQL Server Scripts attached to this topic to
My Documents > SQL Server Management Studio > Projects
as four separate files.
Login to SQL Server Management Studio with an sa account.
4.
Browse to and execute the
Database and Table Creation
script to create the database and tables.
Browse to and execute the
Logon Trigger Creation
script to create triggers.
SQL Server introduced Logon Trigger in SQL Server 2005 SP2, so the database version must be greater than 2005 SP2 for logon trigger
5. creation to succeed.
Browse to and execute the
DDL Server Level Trigger Creation
script to create database events.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
Page 328
FortiSIEM Installation Guide FortiSIEM Installation Guide
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Settings for SQL Server JDBC Access Credentials for Performance Monitoring
When setting the
Access Method Definition
use these settings.
for allowing AccelOps to access your SQL Server over JDBC for performance monitoring,
Create a Separate Credential for Each Database Instance
If multiple database instances are running on the same server, then each instance must run on a separate port, and you must create a separate access credential for each instance. You must also remember to associate each instance with the server's
IP number for the
Device Credential Mapping Definition
.
Setting
Name
Device Type
Value
The name of the database instance you're creating the credential for
Microsoft SQL Server
Access Protocol
Used For
Pull Interval (minutes) 5
JDBC
Performance Monitoring
Port
Database Name
User Name
Password
1433
<leave this field blank>
The user you created in step 1 of the JDBC configuration
The password associated with the user you created in step 1
Settings for SQL Server JDBC Access Credentials for Database Audit Trail Collection
When setting the
Access Method Definition
for allowing AccelOps to access your SQL Server database instance over JDBC for database audit trail collection, use these settings.
Create a Separate Credential for Each Database Instance
If multiple database instances are running on the same server, then each instance must run on a separate port, and you must create a separate access credential for each instance. You must also remember to associate each instance with the server's
IP number for the
Device Credential Mapping Definition
.
Setting
Name
Device Type
Value
The name of the database instance you're creating the credential for
Microsoft SQL Server
Access Protocol
Used For
Pull Interval (minutes) 5
JDBC
Audit
Page 329
FortiSIEM Installation Guide FortiSIEM Installation Guide
Port
Database Name
Logon Event Table
DDL Event Table
User Name
Password
1433
<leave this field blank>
PH_Events.dbo.LogOnEvents
PH_Events.dbo.DDLEvents
The user you created in step 1 of the JDBC configuration
The password associated with the user you created in step 1
Creating a Database Truncate Script
Since audit tables grow after time, it is often a good idea to create a database truncate script that can run as a maintenance task and keep the table size under control. it is often necessary to create a database truncate procedure as follows
1.
2.
3.
4.
5.
Log into Microsoft SQL Management Studio and connect to the DB instance.
Under Management, go to Maintenance Plans, and create a new plan with the name RemoveOldLogs.
For
Subplan
Click the
Go to
, enter
Calendar
TRUNCATE
, and for
Description
View > Tool Box > Execute T-SQL Statement
6.
A T-SQL box will be added to the subplan.
In the T-SQL box, enter this command.
, enter
TRUNCATE TABLE
.
icon to create a recurring, daily task starting at 12:00AM and running every 30 minutes until 11:59:59PM.
.
use PH_Events;
EXEC sp_MSForEachTable 'TRUNCATE TABLE ?';
7.
8.
Click
OK
.
You will be able to see the history of this script's actions by right-clicking on the maintenance task, and then selecting
View History
.
Sample Events
Per Instance Performance Metrics
Page 330
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Apr 16 10:17:56 172.16.22.100 java:
[PH_DEV_MON_PERF_MSSQL_SYS|PH_DEV_MON_PERF_MSSQL_SYS]:[eventSeverity]=PH
L_INFO,[hostIpAddr]=172.16.22.100,[hostName]=wwwin.accelops.net,
[appGroupName]=Microsoft SQL
Server,[dbDataFileSizeKB]=13149056,[dbLogFileUsedKB]=26326,[dbLogGrowthC ount]=4,[dbLogShrinkCount]=0,[dbLogFlushPerSec]=1.69,[dbTransPerSec]=4.4
4,
[dbDeadLocksPerSec]=0,[dbLogCacheHitRatio]=60.01,[dbUserConn]=16,[dbTarg etServerMemoryKB]=1543232,[dbTotalServerMemoryKB]=1464760,[dbPageSplitsP erSec]=0.45,
[dbPageWritesPerSec]=0.01,[dbLatchWaitsPerSec]=0.77,[dbPageReadsPerSec]=
0.01,[dbFullScansPerSec]=1.83,[dbBufferCacheHitRatio]=100,[dbCount]=8,[d bUserCount]=25,
[dbLoggedinUserCount]=2,[dbPagesInBufferPool]=116850,[dbPagesFreeInBuffe rPool]=2336,[dbAverageWaitTimeMs]=239376,
[appVersion]=Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1
(X64),[serverName]=WIN-08-VCENTER,[instanceName]=MSSQLSERVER,[appPort]=1
433
Per Instance, per Database Performance Metrics
[PH_DEV_MON_PERF_MSSQL_PERDB]:[eventSeverity]=PHL_INFO,[hostIpAddr]=172.
16.22.100,[hostName]=wwwin.accelops.net,[dbName]=tempdb,[appGroupName]=M icrosoft SQL Server,
[dbDataFileSizeKB]=109504,[dbLogFileUsedKB]=434,[dbLogGrowthCount]=4,[db
LogShrinkCount]=0,[dbTransPerSec]=0.96,[dbLogFlushPerSec]=0.01,[dbLogCac heHitRatio]=44.44,
[appVersion]=Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1
(X64),[serverName]=WIN-08-VCENTER,[instanceName]=MSSQLSERVER,[appPort]=1
433
Generic Info
[PH_DEV_MON_PERF_MSSQL_GEN_INFO]:[eventSeverity]=PHL_INFO,[dbName]= tempdb,[dbSize]= 3.0,[dbowner]= sa,[dbId]= 2,[dbcreated]= 1321545600,
[dbstatus]= Status=ONLINE; Updateability=READ_WRITE;
UserAccess=MULTI_USER; Recovery=SIMPLE; Version=655;
Collation=SQL_Latin1_General_CP1_CI_AS; SQLSortOrder=52;
IsAutoCreateStatistics; IsAutoUpdateStatistics,
[dbcompatibilityLevel]= 100,[spaceAvailable]= 0.9,[appVersion]=
Microsoft SQL Server 2008 (RTM) - 10.0.1600.22 (Intel X86),[serverName]=
WIN03MSSQL\SQLEXPRESS
Config Info
Page 331
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_PERF_MSSQL_CONFIG_INFO]:[eventSeverity]=PHL_INFO,[configureN ame]= user instances enabled,[configMinimum]= 0,[configMaximum]=
1,[dbConfigValue]= 1,
[configRunValue]= 1,[appVersion]= Microsoft SQL Server 2008 (RTM) -
10.0.1600.22 (Intel X86),[serverName]= WIN03MSSQL\SQLEXPRESS
Locking Info
[PH_DEV_MON_PERF_MSSQL_LOCK_INFO]:[eventSeverity]=PHL_INFO,[dbId]=
4,[objId]= 1792725439,[lockType]= PAG,[lockedResource]=
1:1256,[lockMode]= IX,
[lockStatus]= GRANT,[appVersion]= Microsoft SQL Server 2008 (RTM) -
10.0.1600.22 (Intel X86),[serverName]= WIN03MSSQL\SQLEXPRESS
Blocking Info
[PH_DEV_MON_PERF_MSSQL_BLOCKBY_INFO]:[eventSeverity]=PHL_INFO,[blockedSp
Id]= 51,[blockedLoginUser]= WIN03MSSQL\Administrator,[blockedDbName]= msdb,
[blockedCommand]= UPDATE,[blockedProcessName]= Microsoft SQL Server
Management Studio - Query,[blockingSpId]= 54,[blockingLoginUser]=
WIN03MSSQL\Administrator,
[blockingDbName]= msdb,[blockingCommand]= AWAITING
COMMAND,[blockingProcessName]= Microsoft SQL Server Management Studio -
Query,[blockedDuration]= 5180936,
[appVersion]= Microsoft SQL Server 2008 (RTM) - 10.0.1600.22 (Intel
X86),[serverName]= WIN03MSSQL\SQLEXPRESS
Error Log
[PH_DEV_MON_PERF_MSSQL_ERROR_LOG_INFO]:[eventSeverity]=PHL_INFO,[logDate
]= 1321585903,[processInfo]= spid52,[logText]= Starting up database
'ReportServer$SQLEXPRESSTempDB'.,
[appVersion]= Microsoft SQL Server 2008 (RTM) - 10.0.1600.22 (Intel
X86),[serverName]= WIN03MSSQL\SQLEXPRESS
Logon Events
Page 332
FortiSIEM Installation Guide FortiSIEM Installation Guide
134>Feb 08 02:55:34 10.1.2.54 java:
[MSSQL_Logon_Success]:[eventSeverity]=PHL_INFO, [eventTime]=2014-02-08
02:54:00.977, [rptIp]=10.1.2.54, [relayIp]=10.1.2.54, [srcName]=<local machine>, [user]=NT SERVICE\ReportServer$MSSQLSERVEJIANFA,
[srcApp]=Report Server, [instanceName]=MSSQLSERVEJIANFA, [procId]=52,
[loginType]=Windows (NT) Login,
[securityId]=AQYAAAAAAAVQAAAALJAZf5XMbcLh8PUDY31LioZ3Uwo=, [isPooled]=1,
[destName]=WIN-S2EDLFIUPQK, [destPort]=1437,
DDL Events - Create Database
<134>Sep 29 15:34:48 10.1.2.54 java:
[MSSQL_Create_database]:[eventSeverity]=PHL_INFO, [eventTime]=2013-09-29
15:34:05.687, [rptIp]=10.1.2.54, [relayIp]=10.1.2.54,
[user]=WIN-S2EDLFIUPQK\Administrator, [dbName]=JIANFA,
[instanceName]=MSSQLSERVER, [objName]=, [procId]=59, [command]=CREATE
DATABASE JIANFA, [destName]=WIN-S2EDLFIUPQK, [destPort]=1433,
DDL Events - Create index
<134>Sep 29 15:34:48 10.1.2.54 java:
[MSSQL_Create_index]:[eventSeverity]=PHL_INFO, [eventTime]=2013-09-29
15:30:40.557, [rptIp]=10.1.2.54, [relayIp]=10.1.2.54,
[user]=WIN-S2EDLFIUPQK\Administrator, [dbName]=master,
[instanceName]=MSSQLSERVER, [objName]=IndexTest, [procId]=58,
[command]=create index IndexTest on dbo.MSreplication_options(optname);,
[schemaName]=dbo, [objType]=INDEX, [destName]=WIN-S2EDLFIUPQK,
[destPort]=1433
Page 333
FortiSIEM Installation Guide
Microsoft SQL Server Scripts
FortiSIEM Installation Guide
Page 334
FortiSIEM Installation Guide FortiSIEM Installation Guide
SQL Server Database Level Event Creation Script (PH_Database_Level_Events.sql)
USE master;
GO
CREATE TRIGGER PH_Database_Level_Events on DATABASE
FOR DDL_DATABASE_LEVEL_EVENTS
AS
DECLARE @eventData AS XML;
SET @eventData = EVENTDATA();
INSERT INTO PH_Events.dbo.DDLEvents(EventTime, EventType, SPID,
ServerName, LoginName, ObjectName, ObjectType, SchemaName, DatabaseName,
CommandText, XMLEvent)
VALUES(cast(@eventData.query('data(//PostTime)') as varchar(64)),
cast(@eventData.query('data(//EventType)') as varchar(128)),
cast(@eventData.query('data(//SPID)') as varchar(128)),
cast(@eventData.query('data(//ServerName)') as varchar(128)),
cast(@eventData.query('data(//LoginName)') as varchar(128)),
cast(@eventData.query('data(//ObjectName)') as varchar(128)),
cast(@eventData.query('data(//ObjectType)') as varchar(128)),
cast(@eventData.query('data(//SchemaName)') as varchar(128)),
cast(@eventData.query('data(//DatabaseName)') as varchar(64)),
cast(@eventData.query('data(//TSQLCommand/CommandText)') as varchar(128)),
@eventData
);
Page 335
FortiSIEM Installation Guide FortiSIEM Installation Guide
SQL Server DDL Event Creation Script (PH_DDL_Server_Level_Events.sql)
CREATE TRIGGER PH_DDL_Server_Level_Events
ON ALL SERVER
FOR DDL_ENDPOINT_EVENTS, DDL_LOGIN_EVENTS, DDL_GDR_SERVER_EVENTS,
DDL_AUTHORIZATION_SERVER_EVENTS,
CREATE_DATABASE, ALTER_DATABASE, DROP_DATABASE
/**FOR DDL_SERVER_LEVEL_EVENTS**/
AS
DECLARE @eventData AS XML;
SET @eventData = EVENTDATA();
/**declare @eventData as XML; set @eventData = EVENTDATA();**/ insert into PH_Events.dbo.DDLEvents(EventTime, EventType, SPID,
ServerName, LoginName, ObjectName, ObjectType, SchemaName, DatabaseName,
CommandText, XMLEvent) values(cast(@eventData.query('data(//PostTime)') as varchar(64)),
cast(@eventData.query('data(//EventType)') as varchar(128)),
cast(@eventData.query('data(//SPID)') as varchar(128)),
cast(@eventData.query('data(//ServerName)') as varchar(128)),
cast(@eventData.query('data(//LoginName)') as varchar(128)),
cast(@eventData.query('data(//ObjectName)') as varchar(128)),
cast(@eventData.query('data(//ObjectType)') as varchar(128)),
cast(@eventData.query('data(//SchemaName)') as varchar(128)),
cast(@eventData.query('data(//DatabaseName)') as varchar(64)),
cast(@eventData.query('data(//TSQLCommand/CommandText)') as varchar(128)),
/** DB_NAME(),**/
@eventData);
Page 336
FortiSIEM Installation Guide
SQL Server Table Creation Script (PH_EventDB_Tables_Create.sql)
CREATE DATABASE PH_Events
GO
CREATE TABLE PH_Events.dbo.DDLEvents
(
XMLEvent XML,
DatabaseName VARCHAR(64),
EventTime DATETIME DEFAULT (GETDATE()),
EventType VARCHAR(128),
SPID VARCHAR(128),
ServerName VARCHAR(128),
LoginName VARCHAR(128),
ObjectName VARCHAR(128),
ObjectType VARCHAR(128),
SchemaName VARCHAR(128),
CommandText VARCHAR(128)
)
GO
CREATE TABLE PH_Events.dbo.LogonEvents
(
XMLEvent XML,
EventTime DATETIME,
EventType VARCHAR(128),
SPID VARCHAR(128),
ServerName VARCHAR(128),
LoginName VARCHAR(128),
LoginType VARCHAR(128),
SID VARCHAR(128),
HostName VARCHAR(128),
IsPooled VARCHAR(128),
AppName VARCHAR(255)
)
FortiSIEM Installation Guide
Page 337
FortiSIEM Installation Guide FortiSIEM Installation Guide
SQL Server Trigger Creation Script (PH_LogonEventsTrigger.sql)
This script is to create a server level trigger called database server. The trigger locates at the
PH_LoginEvents
. It will record all logon events when a user establishes a session to the
database server > Server Objects > Triggers
.
CREATE TRIGGER PH_LoginEvents
ON ALL SERVER WITH EXECUTE AS self
FOR LOGON
AS
BEGIN
DECLARE @event XML
SET @event = EVENTDATA()
INSERT INTO PH_Events.dbo.LogonEvents
(EventTime,EventType,SPID,ServerName,LoginName,LoginType,SID,HostName,Is
Pooled,AppName,XMLEvent)
VALUES(CAST(CAST(@event.query('/EVENT_INSTANCE/PostTime/text()') AS
VARCHAR(64)) AS DATETIME),
CAST(@event.query('/EVENT_INSTANCE/EventType/text()') AS
VARCHAR(128)),
CAST(@event.query('/EVENT_INSTANCE/SPID/text()') AS
VARCHAR(128)),
CAST(@event.query('/EVENT_INSTANCE/ServerName/text()') AS
VARCHAR(128)),
CAST(@event.query('/EVENT_INSTANCE/LoginName/text()') AS
VARCHAR(128)),
CAST(@event.query('/EVENT_INSTANCE/LoginType/text()') AS
VARCHAR(128)),
CAST(@event.query('/EVENT_INSTANCE/SID/text()') AS VARCHAR(128)),
CAST(@event.query('/EVENT_INSTANCE/ClientHost/text()') AS
VARCHAR(128)),
CAST(@event.query('/EVENT_INSTANCE/IsPooled/text()') AS
VARCHAR(128)),
APP_NAME(),
@event)
END;
Page 338
FortiSIEM Installation Guide FortiSIEM Installation Guide
MySQL Server Configuration
What is Discovered and Monitored
JDBC for Database Auditing - MySQL Server
Settings for Access Credentials
System Level Performance Metrics
Table Space Performance Metrics
System Level Performance Metrics
Database CREATE/DELETE/MODIFY Events
Table CREATE/DELETE/MODIFY Events
What is Discovered and Monitored
Protocol Information discovered
SNMP Application type
WMI
JDBC
JDBC
Application type, service mappings
Metrics collected
Process level CPU and memory utilization
Process level metrics: uptime, CPU utilization, Memory utilization, Read I/O KBytes/sec, Write I/O KBytes/sec
JDBC None
Used for
Performance
Monitoring
Performance
Monitoring
Generic database information: Version, Character Setting
Database performance metrics: User COnnections, Table Updates, table Selects, Table Inserts, Table Deletes,
Temp Table Creates, Slow Queries, Query cache Hits, Queries registered in cache, Database Questions, Users,
Live Threads
Table space performance metrics
: Table space name, table space type, Character set and Collation, table space usage, table space free space, Database engine, Table version, Table Row Format, Table Row Count, Average
Row Length, Index File length, Table Create time, Table Update Time
Database audit trail: Successful and failed database log on, Database CREATE/DELETE/MODIFY operations,
Table CREATE/DELETE/MODIFY/INSERT operations
Performance
Monitoring
Security
Monitoring
Event Types
Instructions - Remove before Publishing
Provide the prefix or keyword to use in searching for events for this application or device in the CMDB. If there are no specific event types for this device, insert this text: There are no event types defined specifically for this device.
In
CMDB > Event Types
, search for "mysql" in the
Device Type
and
Description
columns to see the event types associated with this device.
Rules
In
Analytics > Rules
, search for "mysql" in the
Name
column to see the rules associated with this application or device.
Reports
In Analytics > Reports, search for ""mysql" in the Name and
Description
columns to see the reports associated with this application or device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
JDBC for Database Auditing - MySQL Server
You need to configure your MySQL Server to write audit logs to a database table. This topic in the MySQL documentation how to set the destination tables for log outputs.
explains more about
Page 339
FortiSIEM Installation Guide
1. Start MySQL server with TABLE output enabled.
bin/mysqld_safe --user=mysql --log-output=TABLE &
2. Login to mysql, run the following SQL commands to enable general.log in MyISAM.
FortiSIEM Installation Guide
SET @old_log_state = @@global.general_log;
SET GLOBAL general_log = 'OFF';
ALTER TABLE mysql.general_log ENGINE = MyISAM;
SET GLOBAL general_log = @old_log_state;
SET GLOBAL general_log = 'ON';
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Settings for MySQL Server JBDC Access Credentials for Performance Monitoring
When setting the
Access Method Definition
monitoring, use these settings.
for allowing AccelOps to access your MySQL Server over JDBC for performance
Setting
Name
Device Type
Value
MySQL-Performance-Monitoring
Oracle MySQL
Access Protocol
Used For
JBDC
Performance Monitoring
Pull Interval (minutes) 5
Port 3306
User Name
Password
The administrative user for the database server
The password associated with the administrative user
Page 340
FortiSIEM Installation Guide FortiSIEM Installation Guide
Settings for MySQL Server JBDC Access Credentials for Database Auditing
When setting the
Access Method Definition
use these settings.
for allowing AccelOps to access your MySQL Server over JDBC for database auditing,
Setting
Name
Device Type
Access Protocol
Used For
Value
MySQL-Audit
Oracle MySQL
JBDC
Audit
Pull Interval (minutes) 5
Port 3306
Database Name
Audit Table mysql general_log
User Name
Password
The administrative user for the database server
The password associated with the administrative user
Sample events
System Level Performance Metrics
<134>Apr 21 19:06:07 10.1.2.8 java: [PH_DEV_MON_PERF_MYSQLDB]:
[eventSeverity]=PHL_INFO,
[hostIpAddr]=172.16.22.227, [hostName]=MYSQL, [appGroupName]=MySQL
Database
Server, [appVersion]=MySQL 5.6.11, [charSetting]=utf8,
[dbConnections]=24, [dbComUpdate]=0, [dbComSelect]=1, [dbComInsert]=0,
[dbComDelete]=0, [dbCreatedTmpTables]=0, [dbSlowQueries]=0,
[dbQcacheHits]=0, [dbQcacheQueriesinCache]=0,
[dbQuestions]=7, [dbThreadsConnected]=1, [dbThreadsRunning]=1
Table Space Performance Metrics
<134>Apr 29 10:06:07 172.16.22.227 java:
[PH_DEV_MON_PERF_MYSQLDB_TABLESPACE]: [eventSeverity]=PHL_INFO,
[appGroupName]=MySQL Database Server,
[instanceName]=mysql, [tablespaceName]=general_log,
[tablespaceType]=PERMANENT, [tablespaceUsage]=0.01,
[tablespaceFreeSpace]=4193886,
[dbEngine]=MyISAM, [tableVersion]=10, [tableRowFormat]=dynamic,
[tableRows]=124, [tableAvgRowLength]=80, [tableIndexLength]=1024,
[tableCreateTime]=2013-04-29 15:12:30, [tableUpdateTime]=2013-04-29
12:35:46, [tableCollation]=utf8_general_ci
Page 341
FortiSIEM Installation Guide
System Level Performance Metrics
FortiSIEM Installation Guide
<134>Apr 21 19:06:07 10.1.2.8 java: [PH_DEV_MON_PERF_MYSQLDB]:
[eventSeverity]=PHL_INFO,
[hostIpAddr]=172.16.22.227, [hostName]=MYSQL, [appGroupName]=MySQL
Database
Server, [appVersion]=MySQL 5.6.11, [charSetting]=utf8,
[dbConnections]=24, [dbComUpdate]=0, [dbComSelect]=1, [dbComInsert]=0,
[dbComDelete]=0, [dbCreatedTmpTables]=0, [dbSlowQueries]=0,
[dbQcacheHits]=0, [dbQcacheQueriesinCache]=0,
[dbQuestions]=7, [dbThreadsConnected]=1, [dbThreadsRunning]=1
Logon/Logoff Events
<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_ Logon_Success]:
[eventSeverity]=PHL_INFO, [eventTime]=2013-04-29 15:14:54,
[rptIp]=172.16.22.227,
[srcIp]=172.16.22.227, [user]=admin, [logonTime]=2013-04-29 15:14:54,
[logoffTime]=, [actionName]=Connect, [msg][email protected] on
<134>Apr 10 14:29:22 abc-desktop java:
[MYSQL_Logoff]:[eventSeverity]=PHL_INFO, [eventTime]=2013-04-10
14:29:22, [rptIp]=172.16.22.227,
[srcIp]=172.16.22.227, [user]=admin, [logonTime]=,
[logoffTime]=2014-04-10 14:29:22, [actionName]=quit, [msg]=
<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_ Logon_Fail]:
[eventSeverity]=PHL_WARN, [eventTime]=2013-04-29 15:14:54,
[rptIp]=172.16.22.227,
[srcIp]=172.16.22.227, [user]=admin, [logonTime]=2013-04-29 15:14:54,
[logoffTime]=, [actionName]=Connect,
[msg]=Access denied for user 'admin'@'172.16.22.227' (using password:
YES)
Database CREATE/DELETE/MODIFY Events
Page 342
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_Create_database]:
[eventSeverity]=PHL_INFO, [eventTime]=2013-04-29 15:14:54,
[rptIp]=172.16.22.227,
[srcIp]=172.16.22.227, [user]=admin, [actionName]=Query, [msg]=create database sliutest
<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_Drop_database]:
[eventSeverity]=PHL_INFO, [eventTime]=2013-04-29 15:14:54,
[rptIp]=172.16.22.227,
[srcIp]=172.16.22.227, [user]=admin, [actionName]=Query, [msg]=drop database sliutest
Table CREATE/DELETE/MODIFY Events
<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_Create_table]:
[eventSeverity]=PHL_INFO, [eventTime]=2013-04-29 15:14:54,
[rptIp]=172.16.22.227,
[srcIp]=172.16.22.227, [user]=admin, [actionName]=Query, [msg]=CREATE
TABLE tutorials_tbl( tutorial_id INT NOT NULL AUTO_INCREMENT, tutorial_title VARCHAR(100) NOT NULL, tutorial_author VARCHAR(40)
NOT NULL, submission_date DATE, PRIMARY KEY ( tutorial_id ) )
<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_Delete_table]:
[eventSeverity]=PHL_INFO, [eventTime]=2013-04-29 15:14:54,
[rptIp]=172.16.22.227,
[srcIp]=172.16.22.227, [user]=admin, [actionName]=Query, [msg]=DELETE
FROM tutorials_tbl WHERE tutorial_id=2NOT NULL, tutorial_author VARCHAR(40) NOT NULL, submission_date DATE,
PRIMARY KEY ( tutorial_id )
<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_Insert_table]:
[eventSeverity]=PHL_INFO, [eventTime]=2013-04-29 15:14:54,
[rptIp]=172.16.22.227,
[srcIp]=172.16.22.227, [user]=admin, [actionName]=Query, [msg]=INSERT
INTO tutorials_tbl (tutorial_title, tutorial_author, submission_date)
VALUES ("Learn Java", "John Smith", NOW())
<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_Drop_table]:
[eventSeverity]=PHL_INFO, [eventTime]=2013-04-29 15:14:54,
[rptIp]=172.16.22.227,
[srcIp]=172.16.22.227, [user]=admin, [actionName]=Query, [msg]=DROP table sliutable
Page 343
FortiSIEM Installation Guide FortiSIEM Installation Guide
Oracle Database Server Configuration
What is Discovered and Monitored
JDBC for Database Performance Monitoring - Oracle Database Server
JDBC for Database Auditing - Oracle Database Server
Configuring listener log and error log via SNARE - Oracle side
Settings for Access Credentials
System Level Database Performance Metrics
Table Space Performance Metrics
Oracle Audit Trail (AccelOps Generated Events)
Supported Versions
Oracle Database 10g
Oracle Database 11g
Oracle Database 12c
What is Discovered and Monitored
Protocol Information discovered
SNMP Application type
WMI
JDBC
Application type, service mappings
Metrics collected
Process level CPU and memory utilization
Process level metrics: uptime, CPU utilization, Memory utilization, Read I/O KBytes/sec, Write I/O KBytes/sec
JDBC
Syslog
JDBC None
Used for
Performance
Monitoring
Performance
Monitoring
Generic database information: version, Character Setting, Archive Enabled, Listener Status, Instance Status, Last backup date,
Database performance metrics: Buffer cache hit ratio, Row cache hit ratio, Library cache hit ratio, Shared pool free ratio, Wait time ratio, Memory Sorts ratio, Host CPU Util ratio, CPU Time ratio, Disk Read/Write rates
(operations and MBps), Network I/O Rate, Enqueue Deadlock rate, Database Request rate, User Transaction rate,
User count, Logged on user count, Session Count, System table space usage, User table space usage, Temp table space usage, Last backup date, Days since last backup
Table space performance metrics
space, table space next extent
: Table space name, table space type, table space usage, table space free
Listener log, Alert log, Audit Log
Database audit trail: Successful and failed database logon, Various database operation audit trail including
CREATE/ALTER/DROP/TRUNCATE operations on tables, table spaces, databases, clusters, users, roles, views, table indices, triggers etc.
Performance
Monitoring
Security
Monitoring
Event Types
In
CMDB > Event Types
, search for "oracle database" in the
Description
column to see the event types associated with this device.
Rules
In
Analytics > Rules
, search for "oracle database" in the
Description
column to see the rules associated with this application or device.
Reports
In Analytics > Reports, search for "oracle database" in the Name column to see the reports associated with this application or device.
Configuration
SNMP
Page 344
FortiSIEM Installation Guide FortiSIEM Installation Guide
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
JDBC for Database Performance Monitoring - Oracle Database Server
To configure your Oracle Database Server for performance monitoring by AccelOps, you need to create a read-only user who has select permissions for the database. This is the user you will use to create the access credentials for AccelOps to communicate with your database server.
1. Open the SQLPlus application.
2. Log in with a system-level account.
3. Connect to your instance as sysdba.
SQL> conn / as sysdba;
Connected.
4. Create a non-admin user account.
SQL> create user phoenix_agent identified by
"accelops";
User created.
5. Assign permissions to the user.
grant select on V_$SYSMETRIC to phoenix_agent; grant select on v_$version to phoenix_agent; grant select on V_$BACKUP_SET to phoenix_agent; grant select on v_$sql to phoenix_agent; grant select on v_$instance to phoenix_agent; grant select on v_$parameter to phoenix_agent; grant select on v_$session to phoenix_agent; grant select on dba_objects to phoenix_agent; grant select on dba_tablespaces to phoenix_agent; grant select on dba_tablespace_usage_metrics to phoenix_agent; grant select on NLS_DATABASE_PARAMETERS to phoenix_agent;
6. Verily that the permissions were successfully assigned to the user.
Page 345
6.
FortiSIEM Installation Guide FortiSIEM Installation Guide
SQL> grant select on v_$sysmetric to phoenix_agent;
Grant succeeded.
SQL> grant select on V_$SYSMETRIC to phoenix_agent;
Grant succeeded.
SQL> grant select on v_$version to phoenix_agent;
Grant succeeded.
SQL> grant select on V_$BACKUP_SET to phoenix_agent;
Grant succeeded.
SQL> grant select on v_$sql to phoenix_agent;
Grant succeeded.
SQL> grant select on v_$instance to phoenix_agent;
Grant succeeded.
SQL> grant select on v_$parameter to phoenix_agent;
Grant succeeded.
SQL> grant select on v_$session to phoenix_agent;
Grant succeeded.
SQL> grant select on dba_objects to phoenix_agent;
Grant succeeded.
SQL> grant select on dba_tablespaces to phoenix_agent;
Grant succeeded.
SQL> grant select on dba_tablespace_usage_metrics to phoenix_agent;
Grant succeeded.
SQL> grant select on NLS_DATABASE_PARAMETERS to phoenix_agent;
Grant succeeded.
Verify the permissions.
SQL*Plus: Release 11.2.0.1.0 Production on Wed Jul 2 07:48:01 2014
Copyright (c) 1982, 2010, Oracle. All rights reserved.
Enter user-name: phoenix_agent
Enter password:
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit
Production
With the Partitioning, OLAP, Data Mining and Real Application
Testing options
SQL> select count(*) from v$sql;
COUNT(*)
----------
696
SQL> select count(*) from dba_tablespaces;
COUNT(*)
----------
5
JDBC for Database Auditing - Oracle Database Server
Page 346
FortiSIEM Installation Guide
Required Environmental Variables
Make sure that these environment variables are set
ORACLE_HOME= C:\app\Administrator\product\11.2.0\dbhome_1
ORACLE_BASE= C:\app\Administrator
1. Create audit trail views by executing cataaudit.sql
as the sysdb
user.
Linux: su- oracle
sqlplus /nolog
conn / as sysdba;
@$ORACLE_HOME/rdbms/admin/cataudit.sql; quit
Windows: sqlplus /nolog conn / as sysdba;
@%ORACLE_HOME%/rdbms/admin/cataudit.sql; quit
2. Enable auditing by modifying the Oracle instance initialization file init<SID>.ora.
This is typically located in
$ORACLE_BASE/admin/<SID>/pfile
where
DIS
is the Oracle instance
AUDIT_TRAIL = DB or
AUDIT_TRAIL = true
3. Restart the database.
su - oracle
sqlplus /nolog
conn / as sysdba;
shutdown immediate;
startup;
quit
4. Create a user account and grant select privileges to that user.
FortiSIEM Installation Guide
Page 347
4.
FortiSIEM Installation Guide FortiSIEM Installation Guide su - oracle
sqlplus /nolog
conn / as sysdba
Create user phoenix_agent identified by "phoenix_agent_pwd"
(NOTE: please correct this set -- above steps showed that we created phoenix_agent already, just add the grant steps and utilize the "accelops" password;
Grant connect to phoenix_agent;
Grant select on dba_audit_trail to phoenix_agent;
Grant select on v_$session to phoenix_agent;
5. Turn on auditing.
su - oracle sqlplus /nolog conn / as sysdba; audit session; quit;
6. Fetch the audit data to make sure the configuration was successful.
su - oracle;
sqlplus phoenix_agent/phoenix_agent_pwd;
select count (*) from dba_audit_trail;
You should see the count changing after logging on a few times.
Configuring listener log and error log via SNARE - Oracle side
1. Install and configure Epilog application to send syslog to AccelOps a. b.
Download Epilog from Epilog download site and install it on your Windows Server.
Launch Epilog from StartAll ProgramsInterSect AllianceEpilog for windows c. Configure Epilog application as follows i. Select Log Configuration on left hand panel, click Add button to add Oracle Listener log file to be sent to AccelOps.
make sure the Log Type is OracleListenerLog
.
Also
ii. Click Add button to add Oracle Alert log file to be sent to AccelOps.
Also make sure the Log Type is OracleAlertLog
.
iii. After adding both the files, SNARE Log Configuration will show both the files included as follows
Page 348
1. c.
FortiSIEM Installation Guide iv. Select Network Configuration on left hand panel. On the right, set the destination address to that of AccelOps server, port to 514 and make sure that syslog header is enabled. Then click Change Configuration button.
v. Click the "Apply the latest audit configuration" link on the left hand side to apply the changes to Epilog applications.
DHCP logs will now sent to AccelOps in real time.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Settings for Oracle Database Server JDBC Access Credentials for Performance Monitoring
When setting the settings.
Access Method Definition
for allowing AccelOps to access your Oracle database server over JDBC, use these
Setting
Name
Device Type
Value
phoenix_agent_accelops
Oracle Database Server
Access Protocol
Used For
JDBC
Performance Monitoring
Pull Interval (minutes) 5
Port 1521
Instance Name orcl2
User Name
Password
The user you created for performance monitoring
The password associated with the user
Sample Events
System Level Database Performance Metrics
Page 349
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_PERF_ORADB]:[eventSeverity]=PHL_INFO, [hostIpAddr]=10.1.2.8,
[hostName]=Host-10.1.2.8, [appGroupName]=Oracle Database Server,
[appVersion]=Oracle Database 11g Enterprise Edition Release 11.1.0.7.0 -
Production, [instanceName]=orcl, [instanceStatus]=OPEN,
[charSetting]=ZHS16GBK, [archiveEnabled]=FALSE,
[lastBackupDate]=1325566287,
[listenerStatus]=OPEN,[dbBufferCacheHitRatio]=100,[dbMemorySortsRatio]=1
00,[dbUserTransactionPerSec]=0.13,[dbPhysicalReadsPerSec]=0,
[dbPhysicalWritesPerSec]=0.48,[dbHostCpuUtilRatio]=0,[dbNetworkKBytesPer
Sec]=0.58,[dbEnqueueDeadlocksPerSec]=0,[dbCurrentLogonsCount]=32,[dbWait
TimeRatio]=7.13,[dbCpuTimeRatio]=92.87,
[dbRowCacheHitRatio]=100,[dbLibraryCacheHitRatio]=99.91,[dbSharedPoolFre eRatio]=18.55,[dbSessionCount]=40,[dbIOKBytesPerSec]=33.26,[dbRequestsPe rSec]=3.24,
[dbSystemTablespaceUsage]= 2.88,[dbTempTablespaceUsage]=
0,[dbUsersTablespaceUsage]= 0.01,[dbUserCount]=
2,[dbInvalidObjectCount]= 4
Table Space Performance Metrics
[PH_DEV_MON_PERF_ORADB_TABLESPACE]:[eventSeverity]=PHL_INFO,
[appGroupName]=Oracle Database Server, [instanceName]=orcl,
[tablespaceName]=UNDOTBS1, [tablespaceType]=UNDO,
[tablespaceUsage]=0.01, [tablespaceFreeSpace]=4193886,
[tablespaceNextExtent]=0
[PH_DEV_MON_PERF_ORADB_TABLESPACE]:[eventSeverity]=PHL_INFO,
[appGroupName]=Oracle Database Server, [instanceName]=orcl,
[tablespaceName]=USERS, [tablespaceType]=PERMANENT,
[tablespaceUsage]=0.01, [tablespaceFreeSpace]=4193774,
[tablespaceNextExtent]=0
Oracle Audit Trail (AccelOps Generated Events)
<134>Apr 10 12:51:42 abc-desktop java:
[ORADB_PH_Logoff]:[eventSeverity]=PHL_INFO, [retCode]=0,
[eventTime]=2009-04-10 14:29:22:111420, [rptIp]=172.16.10.40,
[srcIp]=QA-V-CtOS-ora.abc.net, [user]=DBSNMP, [logonTime]=2009-04-10
14:29:22:111420, [logoffTime]=2009-04-10 14:29:22,
[privUsed]=CREATE_SESSION,
Oracle Audit Log
Page 350
FortiSIEM Installation Guide FortiSIEM Installation Guide
<172>Oracle Audit[25487]: LENGTH : '153' ACTION :[004] 'bjn' DATABASE
USER:[9] 'user' PRIVILEGE :[4] 'NONE' CLIENT USER:[9] 'user' CLIENT
TERMINAL:[14] 'terminal' STATUS:[1] '0']
<172>Oracle Audit[6561]: LENGTH : '158' ACTION :[6] 'COMMIT' DATABASE
USER:[8] 'user' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'user' CLIENT
TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '200958341'
<172>Oracle Audit[28061]: LENGTH: 265 SESSIONID:[9] 118110747
ENTRYID:[5] 14188 STATEMENT:[5] 28375 USERID:[8] user ACTION:[3] 100
RETURNCODE:[1] 0 COMMENT$TEXT:[99] Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=10.90.217.247)(PORT=4566))
PRIV$USED:[1] 5
Oracle Listener Log
<46>Dec 13 06:07:08 WIN03R2E-110929 OracleListenerLog 0
12-OCT-2011 16:17:52 *
(CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=Administrator))(COMMAND=status
)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=185599744)) * status * 0
Oracle Alert Log
<46>Dec 13 06:07:08 WIN03R2E-110929 OracleAlertLog 0 ORA-00312: online log 3 thread 1: 'C:\APP\ADMINISTRATOR\ORADATA\ORCL\REDO03.LOG'
Page 351
FortiSIEM Installation Guide
DHCP and DNS Server Configuration
AccelOps supports these DHCP and DNS servers for discovery and monitoring.
Infoblox DNS/DHCP Configuration
Microsoft DHCP (2003, 2008) Configuration
Microsoft DNS (2003, 2008) Configuration
FortiSIEM Installation Guide
Page 352
FortiSIEM Installation Guide FortiSIEM Installation Guide
Infoblox DNS/DHCP Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP Host Name, Hardware model, Serial number, Network Interfaces, Running processes, Installed software
SNMP
SNMP
SNMP
SNMP
Trap
Metrics collected
System CPU utilization, Memory utilization, Disk usage, Disk I/O
Used for
Performance
Monitoring
Process level CPU utilization, Memory utilization
Zone Transfer metrics: For each zone: DNS Responses Sent, Failed DNS Queries,
DNS Referrals, Non-existent DNS Record Queries, DNS Non-existent Domain
Queries, Recursive DNS Query Received
: DNS Replication Queue Status, Sent Queue
DNS Cluster Replication metrics
From Master, Last Sent Time From Master, Sent Queue To Master, Last Sent Time
To Master
DNS Performance metrics
: NonAuth DNS Query Count, NonAuth Avg DNS
Latency, Auth DNS Query Count, Auth Avg DNS Latency, Invalid DNS Port
Response, Invalid DNS TXID Response
DHCP Performance metrics
: Discovers/sec, Requests/Sec, Releases/Sec,
Offers/sec, Acks/sec, Nacks/sec, Declines/sec, Informs/sec
DDNS Update metrics
: DDNS Update Success, DDNS Update Fail, DDNS Update
Reject, DDNS Prereq Update Reject, DDNS Update Latency, DDNS Update Timeout
DHCP subnet usage metrics
: For each DHCP Subnet (addr, mask) - percent used
Hardware status
Hardware failures, Software failures
Security
Monitoring and compliance
Availability monitoring
Availability monitoring
Event Types
In
CMDB > Event Types
, search for "infoblox" in the
Device Type
and
Description
columns to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "infoblox" in the Name and
Description
column to see the reports associated with this application or device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
SNMP Trap
AccelOps processes events from this device via SNMP traps sent by the device. Configure the device to send send SNMP traps to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Page 353
FortiSIEM Installation Guide
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
FortiSIEM Installation Guide
Page 354
FortiSIEM Installation Guide FortiSIEM Installation Guide
ISC BIND DNS Configuration
What is Discovered and Monitored
Protocol Information discovered Metrics collected
SNMP
Syslog
Application type
Application type
Process level CPU utilization, Memory utilization
Used for
Performance Monitoring
DNS name resolution activity: DNS Query Success and Failure by type Security Monitoring and compliance
Event Types
Instructions - Remove before Publishing
Provide the prefix or keyword to use in searching for events for this application or device in the CMDB. If there are no specific event types for this device, insert this text: There are no event types defined specifically for this device.
In
CMDB > Event Types
, search for "isc bind" in the
Device Type
and
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Syslog
Configure the ISC BIND DNS Server to Send Syslogs
1.
2.
3.
Edit named.conf
and add a new line:
Edit the include /var/named/conf/logging.conf;.
/var/named/conf/logging.conf
Restart BIND by issuing
Configure Syslog to Send to AccelOps
file, and in the
/etc/init.d/named restart
.
channel queries_file { }
section add syslog local3;
1. Edit syslog.conf
and add a new line:
Local7.* @<IP address of the AccelOps server>.
2. Restart the syslog daemon by issuing
/etc/init.d/syslog restart
.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Sample BIND DNS Logs
Page 355
FortiSIEM Installation Guide FortiSIEM Installation Guide
<158>Jan 28 20:41:46 100.1.1.1 named[3135]: 28-Jan-2010 20:40:28.809
client 192.168.29.18#34065: query: www.google.com IN A +
Page 356
FortiSIEM Installation Guide FortiSIEM Installation Guide
Linux DHCP Configuration
What is Discovered and Monitored
Configure Linux DHCP to Forward Logs to Syslog Daemon
Configure Syslog to Forward to Accelops
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP
Syslog
Application type
Application type
Metrics collected
Process level CPU utilization, Memory utilization
DHCP address release/renew events that are used by AccelOps for Identity and location: attributes include IP Address, MAC address, Host Name
Used for
Performance Monitoring
Security and compliance (associate machines to IP addresses)
Event Types
In
CMDB > Event Types
, search for "linux dhcp" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
1. Make sure that snmp libraries are installed.
2.
3.
4.
5.
6.
AccelOps has been tested to work with net-snmp libraries.
Log in to your device with administrator credentials.
Modify the
/etc/snmp/snmpd.conf
file: a. b. c.
Define the community string for AccelOps usage and permit snmp access from AccelOps IP.
Allow AccelOps to (read-only) view the mib-2 tree.
Open up the entire tree for read-only view.
Restart the snmpd deamon by issuing
Make sure that snmpd is running.
/etc/init.d/snmpd restart
Add the snmpd daemon to start from boot by issuing
.
chkconfig snmpd on
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Syslog
Configure Linux DHCP to Forward Logs to Syslog Daemon
1.
2.
Edit dhcpd.conf
and insert the line
Restart dhcpd by issuing
Configure Syslog to Forward to Accelops
log-facility local7
/etc/init.d/dhcpd restart
.
;.
1.
2.
Edit syslog.conf
Sample Syslog
and add a new line:
Restart syslog daemon by issuing
Local7.* @<IP address of AccelOps server>
/etc/init.d/syslog restart
.
.
Page 357
FortiSIEM Installation Guide FortiSIEM Installation Guide
<13>Aug 26 19:28:11 DNS-Pri dhcpd: DHCPREQUEST for 172.16.10.200
(172.16.10.8) from 00:50:56:88:4e:17 (26L2233B1-02)
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 358
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft DHCP (2003, 2008) Configuration
What is Discovered and Monitored
Enabling SNMP on Windows Server 2003
Enabling SNMP on Windows 7 or Windows Server 2008 R2
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
What is Discovered and Monitored
Protocol Information discovered
SNMP
WMI
Process details
Process details, process to service mappings
Syslog Application type
Metrics collected
Process level CPU utilization, Memory utilization
Process level metrics (Win32_Process, Win32_PerfRawData_PerfProc_Process): uptime,
CPU utilization, Memory utilization, Read I/O, Write I/O
DHCP metrics (Win32_PerfFormattedData_DHCPServer_DHCPServer)
: DHCP request rate, release rate, decline rate, Duplicate Drop rate, Packet Rate, Active Queue length, DHCP response time, Conflict queue length
DHCP address release/renew events that are used by AccelOps for Identity and location: attributes include IP Address, MAC address, Host Name
Used for
Performance Monitoring
Performance Monitoring
Security and compliance
(associate machines to IP addresses)
Event Types
In
CMDB > Event Types
, search for "microsoft dhcp" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
Enabling SNMP on Windows Server 2003
SNMP is typically enabled by default on Windows Server 2003, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you need to make sure that the SNMP Management tool has been enabled for your device.
1.
2.
In the
Start
menu, go to
Administrative Tools > Services
.
Go to
Control Panel > Add or Remove Programs
.
3. Click
Add/Remove Windows Components
.
4. Select
Management and Monitoring Tools
and click
Details
.
Make sure that
Simple Network Management Tool
is selected.
If it isn't selected, select it, and then click
Next
to install.
9.
10.
11.
12.
5.
6.
7.
8.
Go to Start > Administrative Tools > Services.
Select and open
SNMP Service
.
Click the
Select
Security
tab.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
public
that is set to
Click
Click
Add
.
Apply
.
read-only.
13.
14.
Select
Accept SNMP packets from these hosts.
Click
Add.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
15.
Page 359
FortiSIEM Installation Guide FortiSIEM Installation Guide
15. Under
SNMP Service
, click
Restart service
.
Enabling SNMP on Windows 7 or Windows Server 2008 R2
SNMP is typically enabled by default on Windows Server 2008, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you should check that SNMP Services have been enabled for your server.
1.
2.
3.
4.
9.
10.
11.
12.
5.
6.
7.
8.
13.
14.
15.
Log in to the Windows 2008 Server where you want to enable SNMP as an administrator.
In the
Under
Under
If not, click
Add Feature
, then select
In the
Click
Click
Under
Start
Add
.
Apply
menu, select
Control Panel
.
Programs
Features
Select and open
Click the
Select
.
, click
, see if
Server Manager
SNMP Service
Turn Windows features on/off
SNMP Services
is installed.
SNMP Service
Security
tab.
window, go to
, click
.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
Select
Accept SNMP packets from these hosts.
Click
Add.
public
that is set to
read-only.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Restart service
.
.
SMNP Service
and click
Next
to install the service.
Services > SNMP Services
.
WMI
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1. Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
2.
Page 360
FortiSIEM Installation Guide FortiSIEM Installation Guide
2.
3.
4.
5.
6.
7.
Right-click
OK
Users
For example,
and select
Add User
.
Create a user for the @accelops.com domain.
Go to
Groups
, right-click
For
.
Administrators
, and then click
In the
Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3.
8.
Click
OK
Click . to close the Domain Admins Properties dialog.
Add to Group
.
Members
tab, and then click
Add
.
Enable the Monitoring Account to Access the Monitored Device
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Launch and Activation Permissions
, click
Find the user you created for the monitoring account, and make sure that user has the permission
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
Edit Limits
.
Allow
for
11.
12.
In the
Com Security
, and
Remote Activation
.
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
Windows Firewall.
4. Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
5.
6.
Select
Run
Windows Firewall: Allow remote administration exception.
cmd.exe
and enter these commands: netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Page 361
FortiSIEM Installation Guide FortiSIEM Installation Guide
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Syslog
1.
2.
3.
4.
5.
Log into your Microsoft DHCP server as an administrator.
Go to
Start > Administrative Tools > DHCP
.
Select the DHCP server you want to monitor, then right-click and select
Click the
Click the
General
tab, and then select
DNS
Properties
.
tab, and then select
Enable DHCP audit logging
.
Dynamically update DNS A and PTR records only if requested by the DHCP clients
and
Discard
6.
7.
8.
9.
A and PTR records when lease is deleted
.
Click the
Advanced
Set to
C:\WINDOWS\system32\dhcp.
Set
Database path
to
C:\\WINDOWS\system32\dhcp
10.
Set
tab.
Audit log file path
to
Clock
OK
to complete configuration.
.
Backup path
C:\\WINDOWS\System32\dhcp\backup
.
Use the Windows Agent Manager to further configure sending syslogs from your device to AccelOps.
1.
Sample Microsoft DHCP Syslog
<15>May 27 17:22:43 ADS-Pri.ACME.net WinDHCPLog 0
11,05/27/08,17:22:43,Renew,192.168.20.46,Lucy-XPS.ACME.net,009096F27636,
<15>Jun 20 12:20:58 ADS-Pri.ACME.net WinDHCPLog 0
10,06/20/08,12:20:58,Assign,192.168.20.35,mission.,000D5639076C,
<13>Mar 29 10:25:28 192.168.0.10 WinDHCPLog 0
30,03/29/10,10:25:27,DNS Update
Request,40.20.168.192,John-lap.ACME.net,,
<13>Mar 29 10:25:05 192.168.0.10 WinDHCPLog 0
32,03/29/10,10:25:01,DNS Update
Successful,192.168.20.32,Mary-laptop.ACME.net,,
<13>Jun 1 14:24:08 192.168.0.10 WinDHCPLog 0 31,06/01/10,14:24:08,DNS
Update Failed,192.168.26.31,Joe-LAPTOP.ACME.net,-1,
<13>Jun 1 14:24:08 192.168.0.10 WinDHCPLog 0 25,06/01/10,14:24:07,0 leases expired and 1 leases deleted,,,,
Settings for Access Controls
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 362
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft DNS (2003, 2008) Configuration
What is Discovered and Monitored
Enabling SNMP on Windows Server 2003
Enabling SNMP on Windows 7 or Windows Server 2008 R2
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP
WMI
Application type
Application type, service mappings
Syslog Application type
Metrics collected
Process level CPU utilization, Memory utilization
Process level metrics (Win32_Process, Win32_PerfRawData_PerfProc_Process): uptime, CPU utilization,
Memory utilization, Read I/O, Write I/O
DNS metrics (Win32_PerfFormattedData_DNS_DNS)
: DNS requests received, DNS responses sent, WINS requests received, WINS responses sent, Recursive DNS queries received, Recursive DNS queries failed,
Recursive DNS queries timeout, Dynamic DNS updates received, Dynamic DNS updates failed, Dynamic DNS updates timeout, Secure DNS update received, Secure DNS update failed, Full DNS Zone Transfer requests sent,
Full DNS Zone Transfer requests received, Incremental DNS Zone Transfer requests sent, ncremental DNS Zone
Transfer requests received
DNS name resolution activity: DNS Query Success and Failure by type
Used for
Performance
Monitoring
Performance
Monitoring
Security
Monitoring
Event Types
In
CMDB > Event Types
, search for "microsoft dans" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
Enabling SNMP on Windows Server 2003
SNMP is typically enabled by default on Windows Server 2003, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you need to make sure that the SNMP Management tool has been enabled for your device.
1.
2.
In the
Start
menu, go to
Administrative Tools > Services
.
Go to
Control Panel > Add or Remove Programs
.
3. Click
Add/Remove Windows Components
.
4. Select
Management and Monitoring Tools
and click
Details
.
Make sure that
Simple Network Management Tool
is selected.
If it isn't selected, select it, and then click
Next
to install.
5.
6.
7.
8.
9.
10.
Go to
Select and open
Click the
Select
Under
Start > Administrative Tools > Services.
SNMP Service
Security
tab.
Accepted communities
.
Send authentication trap
.
, make sure there is an entry for
Select
Accept SNMP packets from these hosts. public
that is set to
read-only.
11.
Page 363
FortiSIEM Installation Guide FortiSIEM Installation Guide
11.
12.
13.
14.
Click
Add.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
15.
Click
Click
Add
Under
.
Apply
.
SNMP Service
, click
Restart service
.
Enabling SNMP on Windows 7 or Windows Server 2008 R2
SNMP is typically enabled by default on Windows Server 2008, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you should check that SNMP Services have been enabled for your server.
1.
2.
3.
4.
9.
10.
11.
12.
5.
6.
7.
8.
13.
14.
15.
Log in to the Windows 2008 Server where you want to enable SNMP as an administrator.
In the
Under
Under
If not, click
Add Feature
, then select
In the
Click
Click
Under
Start
Add
.
Apply
menu, select
Control Panel
.
Programs
Features
Select and open
Click the
Select
.
, click
, see if
Server Manager
SNMP Service
Turn Windows features on/off
SNMP Services
is installed.
SNMP Service
Security
tab.
window, go to
, click
.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
Select
Accept SNMP packets from these hosts.
Click
Add.
public
that is set to
read-only.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Restart service
.
.
SMNP Service
and click
Next
to install the service.
Services > SNMP Services
.
WMI
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Page 364
FortiSIEM Installation Guide FortiSIEM Installation Guide
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Launch and Activation Permissions
, click
Find the user you created for the monitoring account, and make sure that user has the permission
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
Edit Limits
.
Allow
for
11.
12.
In the
Com Security
, and
Remote Activation
.
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
4.
Windows Firewall.
Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
5.
6.
Select Windows Firewall: Allow remote administration exception.
Run cmd.exe
and enter these commands:
Page 365
6.
FortiSIEM Installation Guide FortiSIEM Installation Guide netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Syslog
Use the Windows Agent Manager to configure sending syslogs from your device to AccelOps.
Sample Windows DNS Syslog
<13>Aug 10 19:14:36 192.168.20.99 MSDNSLog 0 20090810 19:13:43 15EC
PACKET 025AED90 UDP Rcv 192.168.20.35 b66e Q [0001 D NOERROR] A
(12)autodiscover(8)accelops(3)net(0)
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 366
FortiSIEM Installation Guide
Directory Server Configuration
AccelOps supports these directory servers for discovery and monitoring.
Microsoft Active Directory Configuration
FortiSIEM Installation Guide
Page 367
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft Active Directory Configuration
What is Discovered and Monitored
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
What is Discovered and Monitored
Protocol Information discovered
WMI
WMI
WMI
Metrics collected
Win32_PerfRawData_NTDS_NTDS class: Directory Search Rate, Read Rate, Write Rate, Browse Rate, LDAP search rate, LDAP Bind Rate, New LDAP Connection Rate, Successful LDAP Bind Rate, LDAP Active Threads,
LDAP Bind Time, LDAP Client Sessions
"dcdiag -e" command output - detect successful and failed domain controller diagnostic tests
"repadmin /replsummary" command output - detect replication statistics
Event Types
PH_DEV_MON_DCDIAG (output of "dcdiag -e" command)
Used for
Performance
Monitoring
[PH_DEV_MON_DCDIAG]:[hostIpAddr]=10.1.20.59,[hostName]=WIN-IGO8O8M5
JVT,[errReason]="",[testResult]="passed",[testSubject]="WIN-IGO8O8M
5JVT",[testName]="NCSecDesc"
PH_DEV_MON_SRC_AD_REPL_STAT (output of "repadmin /replsummary" command)
[PH_DEV_MON_SRC_AD_REPL_STAT]:[hostIpAddr]=10.1.20.59,[hostName]=WI
N-IGO8O8M5JVT, [largestReplDelta]=">60 days",[failureCount]=0.00,[count]=5.00,[failurePct]=0.00,[srcName]=
"WIN-IGO8O8M5JVT",[errReason]=""
PH_DEV_MON_DST_AD_REPL_STAT (output of "repadmin /replsummary" command)
[PH_DEV_MON_DST_AD_REPL_STAT]:[hostIpAddr]=10.1.20.59,[hostName]=W
IN-IGO8O8M5JVT, [largestReplDelta]=">60 days",[failureCount]=0.00,[count]=5.00,[failurePct]=0.00,[destName]
="WIN-IGO8O8M5JVT",[errReason]=""
Rules
Failed Windows DC Diagnostic Test
Reports
Successful Windows Domain Controller Diagnostic Tests
Failed Windows Domain Controller Diagnostic Tests
Source Domain Controller Replication Status
Page 368
FortiSIEM Installation Guide
Destination Domain Controller Replication Status
Configuration
WMI
Required WMI Class
For Active Directory metrics, make sure that this WMI class is available on the Active Directory server.
Win32_PerfRawData_NTDS_NTDS
FortiSIEM Installation Guide
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the
Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
Page 369
FortiSIEM Installation Guide FortiSIEM Installation Guide
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Launch and Activation Permissions
, click
Find the user you created for the monitoring account, and make sure that user has the permission
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
Edit Limits
.
Allow
for
11.
12.
In the
Com Security
, and
Remote Activation
.
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
Windows Firewall.
4. Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
5.
6.
Select
Run
Windows Firewall: Allow remote administration exception.
cmd.exe
and enter these commands: netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Page 370
FortiSIEM Installation Guide
Document Management Server Configuration
AccelOps supports these document management servers for discovery and monitoring.
Microsoft SharePoint Configuration
FortiSIEM Installation Guide
Page 371
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft SharePoint Configuration
What is Discovered and Monitored
Installing and Configuring LOGbinder SP Agent
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
What is Discovered and Monitored
Protocol Information discovered
WMI
Metrics/Logs collected
SharePoint logs - Audit trail integrity, Access control changes, Document updates, List updates, Container object updates, Object changes, Object Import/Exports, Document views, Information Management Policy changes
Used for
Log analysis and compliance
Event Types
In
CMDB > Event Types
, search for "sharepoint" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In
Analytics > Reports, search for "sharepoint" in the Name column to see the reports associated with this application or device.
Configuration
Microsoft SharePoint logs are supported via LOGbinder SP agent from Monterey Technology group. The agent needs to be installed on the
SharePoint server.
Configure the agent to write logs to Windows Security log
. AccelOps simply reads the logs from windows security logs via
WMI and categorizes the SharePoint specific events and parses SharePoint specific attributes.
Installing and Configuring LOGbinder SP Agent
LOGbinder Install web link
LOGbinder Configuration web link - remember to configure LOGbinder SP agent to write to Windows security log
LOGbinder SP getting started document - remember to configure LOGbinder SP agent to write to Windows security log
WMI
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
My Computer
, and then
Properties
.
3.
Page 372
FortiSIEM Installation Guide FortiSIEM Installation Guide
3.
4.
Select the
COM Security
Allowed.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Launch and Activation Permissions
, click
Find the user you created for the monitoring account, and make sure that user has the permission
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
Edit Limits
.
Allow
for
11.
12.
In the
Com Security
, and
Remote Activation
.
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
Page 373
FortiSIEM Installation Guide FortiSIEM Installation Guide
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
4.
Windows Firewall.
Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
5.
6.
Select Windows Firewall: Allow remote administration exception.
Run cmd.exe
and enter these commands: netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
Page 374
FortiSIEM Installation Guide
Mail Server Configuration
AccelOps supports these mail servers for discovery and monitoring.
Microsoft Exchange Configuration
FortiSIEM Installation Guide
Page 375
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft Exchange Configuration
What is Discovered and Monitored
Enabling SNMP on Windows Server 2003
Enabling SNMP on Windows 7 or Windows Server 2008 R2
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP
WMI
WMI
Application type
Application type, service mappings
Metrics collected
Process level CPU and memory utilization for the various exchange server processes
Process level metrics: uptime, CPU utilization, Memory utilization, Read I/O KBytes/sec, Write I/O KBytes/sec for the various exchange server processes
WMI
Used for
Performance
Monitoring
Performance
Monitoring
Exchange performance metrics (obtained from Win32_PerfRawData_MSExchangeIS_MSExchangeIS WMI class
): VM Largest Block size, VM Large Free Block Size, VM Total Free Blocks, RPC Requests, RPC Request Peak,
RPC Average Latency, RPC Operations/sec, User count, Active user Count, Peak User Count, Active Connection
Count, Max Connection Count
Exchange error metrics (obtained from Win32_PerfRawData_MSExchangeIS_MSExchangeIS WMI class): RPC
Success, RPC Failed, RPC Denied, RPC Failed - Server Busy, RPC Failed - Server Unavailable, Foreground RPC
Failed, Backgorund RPC Failed
Exchange mailbox metrics (obtained from Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox and
Win32_PerfRawData_MSExchangeIS_MSExchangeISPublic WMI classes) : Per Mailbox: Send Queue, Receive
Queue, Sent Message, Submitted Message, Delivered Message, Active User, Peak User
Exchange SMTP metrics (obtained from Win32_PerfRawData_SMTPSVC_SMTPServer WMI class) :
Categorization Queue, Local Queue, Remote Queue, Inbound Connections, Outbound Connections, Sent
Bytes/sec, Received Bytes/sec, Retry Count, Local Retry Queue, Remote Retry Queue
Exchange ESE Database (Win32_PerfFormattedData_ESE_MSExchangeDatabase):
Exchange Database Instances (Win32_PerfFormattedData_ESE_MSExchangeDatabaseInstances):
Exchange Mail Submission Metrics (Win32_PerfFormattedData_MSExchangeMailSubmission_MSExchangeMail
Submission):
Exchange Store Interface Metrics (Win32_PerfFormattedData_MSExchangeStoreInterface_MSExchangeStoreInt erface):
Exchange Replication Metrics (Win32_PerfFormattedData_MSExchangeReplication_MSExchangeReplication):
Exchange Transport Queue Metrics (Win32_PerfFormattedData_MSExchangeTransportQueues_MSExchangeTr ansportQueues):
Application Logs
Performance
Monitoring
Security
Monitoring and
Compliance
Event Types
In
CMDB > Event Types
, search for "microsoft exchange" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "microsoft exchange" in the Name column to see the reports associated with this application or device.
Configuration
Page 376
FortiSIEM Installation Guide FortiSIEM Installation Guide
SNMP
Enabling SNMP on Windows Server 2003
SNMP is typically enabled by default on Windows Server 2003, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you need to make sure that the SNMP Management tool has been enabled for your device.
1.
2.
In the
Start
menu, go to
Administrative Tools > Services
.
Go to
Control Panel > Add or Remove Programs
.
3. Click
Add/Remove Windows Components
.
4. Select
Management and Monitoring Tools
and click
Details
.
Make sure that
Simple Network Management Tool
is selected.
If it isn't selected, select it, and then click
Next
to install.
9.
10.
11.
12.
5.
6.
7.
8.
Go to Start > Administrative Tools > Services.
Select and open
SNMP Service
.
Click the
Select
Security
tab.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
public
that is set to
15.
Click
Click
Add
.
Apply
Under
.
SNMP Service
, click
read-only.
13.
14.
Select
Accept SNMP packets from these hosts.
Click
Add.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Restart service
.
Enabling SNMP on Windows 7 or Windows Server 2008 R2
SNMP is typically enabled by default on Windows Server 2008, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you should check that SNMP Services have been enabled for your server.
1.
2.
3.
4.
9.
10.
11.
12.
5.
6.
7.
8.
13.
14.
15.
Log in to the Windows 2008 Server where you want to enable SNMP as an administrator.
In the
Under
Under
If not, click
Add Feature
, then select
In the
Click
Click
Under
Start
Add
.
Apply
menu, select
Control Panel
.
Programs
Features
Select and open
Click the
Select
.
, click
, see if
Server Manager
SNMP Service
Turn Windows features on/off
SNMP Services
is installed.
SNMP Service
Security
tab.
window, go to
, click
.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
Select
Accept SNMP packets from these hosts.
Click
Add.
public
that is set to
read-only.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Restart service
.
.
SMNP Service
and click
Next
to install the service.
Services > SNMP Services
.
WMI
Required WMI Classes
For Exchange metrics, make sure that these WMI classes are available on the Exchange server.
Win32_PerfRawData_MSExchangeIS_MSExchangeIS
Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox
Win32_PerfRawData_MSExchangeIS_MSExchangeISPublic
Win32_PerfRawData_SMTPSVC_SMTPServer
Win32_PerfFormattedData_ESE_MSExchangeDatabase
Win32_PerfFormattedData_ESE_MSExchangeDatabaseInstances
Win32_PerfFormattedData_MSExchangeMailSubmission_MSExchangeMailSubmission
Win32_PerfFormattedData_MSExchangeStoreInterface_MSExchangeStoreInterface
Win32_PerfFormattedData_MSExchangeReplication_MSExchangeReplication
Win32_PerfFormattedData_MSExchangeTransportQueues_MSExchangeTransportQueues
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Page 377
FortiSIEM Installation Guide FortiSIEM Installation Guide
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
11.
12.
mote Access
.
Click
OK
.
In the
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
In the
Com Security
Com Security
tab, under
Launch and Activation Permissions
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
, and
Remote Activation
.
, click
Edit Defaults
.
Allow
for
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
Page 378
FortiSIEM Installation Guide FortiSIEM Installation Guide
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
Windows Firewall.
4. Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
5.
6.
Select
Run
Windows Firewall: Allow remote administration exception.
cmd.exe
and enter these commands: netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 379
FortiSIEM Installation Guide
Management Server/Appliance Configuration
AccelOps supports these web servers for discovery and monitoring.
Fortinet FortiManager Configuration
FortiSIEM Installation Guide
Page 380
FortiSIEM Installation Guide FortiSIEM Installation Guide
Fortinet FortiManager Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Hardware model, Network interfaces, Operating system version
Metrics Collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Used For
Availability and
Performance
Monitoring
Event Types
Regular monitoring events
PH_DEV_MON_SYS_CPU_UTIL
PH_DEV_MON_SYS_MEM_UTIL
PH_DEV_MON_SYS_DISK_UTIL
PH_DEV_MON_NET_INTF_UTIL
Rules
Regular monitoring rules
Reports
Regular monitoring reports
Configuration
Please configure the device so that AccelOps can access it via SNMP.
Configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device Discovery
, and then initiate discovery of the device as described in the topics in
.
Page 381
FortiSIEM Installation Guide
Remote Desktop Configuration
AccelOps supports these remote desktop applications for discovery and monitoring.
Citrix Receiver (ICA) Configuration
FortiSIEM Installation Guide
Page 382
FortiSIEM Installation Guide FortiSIEM Installation Guide
Citrix Receiver (ICA) Configuration
What is Discovered and Monitored
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected
WMI From
PH_DEV_MON_APP_ICA_SESS_MET
:
ICA Latency Last Recorded
ICA Latency Session Average
ICA Latency Session Deviation
ICA Input Session Bandwidth
ICA Input Session Line Speed
ICA Input Session Compression
ICA Input Drive Bandwidth
ICA Input Text Echo Bandwidth
ICA Input SpeedScreen Data Bandwidth
Input Audio Bandwidth
ICA Input VideoFrame Bandwidth
ICA Output Session Bandwidth
ICA Output Session Line Speed
ICA Output Session Compression
ICA Output Drive Bandwidth
ICA Output Text Echo Bandwidth
ICA Output SpeedScreen Data Bandwidth
ICA Output Audio Bandwidth
ICA Output VideoFrame Bandwidth
Used For
Event Types
In
CMDB > Event Types
, search for "citrix ICA" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "citrix ICA" in the Name column to see the reports associated with this application or device.
Configuration
WMI
Required WMI Class
Make sure the WMI class
Win32_PerfRawData_CitrixICA_ICASession
is available on the host machine for Citrix ICA.
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Right-click
Create a user.
Go to
Users
and select
Groups
, right-click
Add User
.
Distributed COM Users
, and then click
Add to group
.
5.
Page 383
FortiSIEM Installation Guide FortiSIEM Installation Guide
5.
6.
In the
Distributed COM Users Properties
dialog, click
Add
.
7.
8.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the
Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Launch and Activation Permissions
, click
Find the user you created for the monitoring account, and make sure that user has the permission
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
Edit Limits
.
Allow
for
11.
12.
In the
Com Security
, and
Remote Activation
.
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
Go to
Select
Select the
Security
tab.
Expand the
Root
directory and select
Click
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
Security
.
, and then right-click and select
CIMV2
.
Properties
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
.
Enable Account
and
Remot
Page 384
FortiSIEM Installation Guide FortiSIEM Installation Guide
6.
7.
8.
9.
10.
11.
12.
13.
e Enable
.
Click
Advanced
In the
Click
Click
OK
OK
In the left-hand navigation, under
Select
.
Select the user you created for the monitoring account, and then click
Apply onto
menu, select
This namespace and subnamespaces
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
Services and Applications
Windows Management Instrumentation
, select
, and then click
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
Edit
.
.
Services
Restart
.
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
Windows Firewall.
4. Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
5.
6.
Select
Run
Windows Firewall: Allow remote administration exception.
cmd.exe
and enter these commands: netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Page 385
FortiSIEM Installation Guide
Unified Communication Server Configuration
AccelOps supports these VoIP servers for discovery and monitoring.
Avaya Call Manager Configuration
Cisco Call Manager Configuration
Cisco Contact Center Configuration
Cisco Presence Server Configuration
Cisco Tandeberg Telepresence Video Communication Server (VCS) Configuration
Cisco Telepresence Multipoint Control Unit (MCU) Configuration
Cisco Telepresence Video Communication Server Configuration
Cisco Unity Connection Configuration
FortiSIEM Installation Guide
Page 386
FortiSIEM Installation Guide FortiSIEM Installation Guide
Avaya Call Manager Configuration
What is Discovered and Monitored
Configure AccelOps to Receive CDR Records from Cisco Call Manager
Configure Avaya Call Manager to Send CDR Records to AccelOps
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP
SFTP
Application type
Metrics collected
System metrics: Uptime, Interface utilization
Call Description Records (CDR): Calling Phone IP, Called Phone IP, Call
Duration
Used for
Performance Monitoring
Performance and Availability
Monitoring
Event Types
Avaya-CM-CDR: Avaya CDR Records
Rules
None
Reports
None.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
SFTP
SFTP is used to send Call Description Records (CDRs) to AccelOps.
Configure AccelOps to Receive CDR Records from Cisco Call Manager
1.
2.
Log in to your AccelOps virtual appliance as
Change the directory.
root
over SSH.
cd /opt/phoenix/bin
3. Create an FTP account for user
ftpuser
with the home directory
/opt/phoenix/cache/avayaCM/<call-manager-ip>
. If this is
4. the first time you have created a Call Manager definition, you will be prompted for the ftpuser password. When you create subsequent
Call Manager definitions, the same password will be used, and you will see a Success message when the definition is created.
The CDR records do not have field definitions, they only have values. Field definitions are needed to properly interpret the values. Make sure that the CDR fields definitions matches the default one supplied by AccelOps in /opt/phoenix/config/AvayaCDRConfig.csv. AccelOps will interpret the CDR record fields according to the field definitions specified in /opt/phoenix/config/AvayaCDRConfig.csv and generate events like the following.
Page 387
4.
FortiSIEM Installation Guide FortiSIEM Installation Guide
Wed Feb 4 14:37:41 2015 1.2.3.4 AccelOps-FileLog-AvayaCM [Time of day-hours]="11" [Time of day-minutes]="36" [Duration-hours]="0"
[Duration-minutes]="00" [Duration-tenths of minutes]="5" [Condition code]="9" [Dialed number]="5908" [Calling number]="2565522011"
[FRL]="5" [Incoming circuit ID]="001" [Feature flag]="0" [Attendant console]="8" [Incoming TAC]="01 1" [INS]="0" [IXC]="00" [Packet count]="12" [TSC flag]="1"
Configure Avaya Call Manager to Send CDR Records to AccelOps
1.
2.
Log in to Avaya Call Manager.
Send CDR records to AccelOps by using this information
Field Value
Host Name/IP Address <AccelOps IP address>
User Name
Password ftpuser
<The password you created for ftpuser>
Protocol
Directory Path
SFTP
/ opt/phoenix/cache/ avayaCM /<call-manager-ip>
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 388
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Call Manager Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol
SNMP
SNMP
Syslog
Information discovered
Application type
VoIP phones and registration status
WMI (for
Windows based
Call Managers)
SFTP
Application type, service mappings
Metrics collected
Call Description Records (CDR): Calling Phone IP, Called Phone IP, Calling Party Number, Original
Called Party Number, Final Called Party Number, Call Connect Time, Call Disconnect Time, Call
Duration
Call Management Records (CMR): Latency, Jitter, Mos Score - current, average, min, max for each call in CDR
Syslog messages from Cisco Call Manager as well as Cisco Unified Real Time Monitoring Tool (RTMT)
Used for
System metrics: Uptime, CPU utilization, Memory utilization, Disk utilization, Interface utilization,
Process count, Per process: CPU utilization, Memory utilization
Call Manager metrics:
Global Info: VoIP phone count, Gateway count, Media Device count, Voice mail server count and SIP
Trunks count broken down by Registered/Unregistered/Rejected status (AccelOps Event Type:
PH_DEV_MON_CCM_GLOBAL_INFO)
SIP Trunk Info: Trunk end point, description, status (AccelOps Event Type:
PH_DEV_MON_CCM_SIP_TRUNK_STAT)
SIP Trunk Addition, Deletion: AccelOps Event Type:
PH_DEV_MON_CCM_NEW_SIP_TRUNK, PH_DEV_MON_CCM_DEL_SIP_TRUNK
Gateway Status Info: Gateway name, Gateway IP, description, status (AccelOps Event Types:
PH_DEV_MON_CCM_GW_STAT)
Gateway Status Change, Addition, Deletion: AccelOps Event Type:
PH_DEV_MON_CCM_GW_STAT_CHANGE, PH_DEV_MON_CCM_NEW_GW,
PH_DEV_MON_CCM_DEL_GW
H323 Device Info: H323 Device name, H323 Device IP, description, status AccelOps Event Types:
PH_DEV_MON_CCM_H323_STAT)
Gateway Status Change, Addition, Deletion: AccelOps Event Type:
PH_DEV_MON_CCM_H323_STAT_CHANGE, PH_DEV_MON_CCM_NEW_H323,
PH_DEV_MON_CCM_DEL_H323
Voice Mail Device Info: Voice Mail Device name, Voice Mail Device IP, description, status (AccelOps
Event Types: PH_DEV_MON_CCM_VM_STAT)
Voice Mail Device Status Change, Addition, Deletion: AccelOps Event Type:
PH_DEV_MON_CCM_VM_STAT_CHANGE, PH_DEV_MON_CCM_NEW_VM,
PH_DEV_MON_CCM_DEL_VM
Media Device Info: Media Device name, Media Device IP, description, status (AccelOps Event Types:
PH_DEV_MON_CCM_MEDIA_STAT)
Media Device Status Change, Addition, Deletion AccelOps Event Type:
PH_DEV_MON_CCM_MEDIA_STAT_CHANGE, PH_DEV_MON_CCM_NEW_MEDIA,
PH_DEV_MON_CCM_DEL_MEDIA
Computer Telephony Integration (CTI) Device Info: CTI Device name, CTI Device IP, description, status (AccelOps Event Types: PH_DEV_MON_CCM_CTI_STAT)
CTI Device Status Change, Addition, Deletion AccelOps Event Type:
PH_DEV_MON_CCM_CTI_STAT_CHANGE, PH_DEV_MON_CCM_NEW_CTI,
PH_DEV_MON_CCM_DEL_CTI
Process level metrics: Per process: Uptime, CPU utilization, Memory utilization, Read I/O KBytes/sec,
Write I/O KBytes/sec
Performance
Monitoring
Availability
Monitoring
Performance
Monitoring
Performance and Availability
Monitoring
Event Types
In
CMDB > Event Types
device.
, search for "cisco_uc" and "cisco_uc_rtmt" in the
Display Name
column to see the event types associated with this
Page 389
FortiSIEM Installation Guide FortiSIEM Installation Guide
Rules
In
Analytics > Rules
, search for "cisco call manager" in the
Name
column to see the rules associated with this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
WMI (for Call Manager installed under Windows)
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Users
and select
Go to
Groups
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the Domain Admins Properties dialog, select the
Add to Group
Members
.
tab, and then click
For
Enter the object names to select
, enter the user you created in step 3.
Add
.
7.
Page 390
FortiSIEM Installation Guide FortiSIEM Installation Guide
7.
8.
Click
Click
OK
. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Launch and Activation Permissions
, click
Find the user you created for the monitoring account, and make sure that user has the permission
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
Edit Limits
.
Allow
for
11.
12.
In the
Com Security
, and
Remote Activation
.
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
Windows Firewall.
4. Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
5.
6.
Select
Run
Windows Firewall: Allow remote administration exception.
cmd.exe
and enter these commands: netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
SFTP
Page 391
FortiSIEM Installation Guide
SFTP is used to send Call Description Records (CDRs) to AccelOps.
Configure AccelOps to Receive CDR Records from Cisco Call Manager
1.
2.
Log in to your Accelops virtual appliance as
Change the directory.
root
over SSH.
FortiSIEM Installation Guide cd /opt/phoenix/bin
3.
4.
5.
Run
./phCreateCdrDestDir <call-manager-ip>
This creates an FTP account for user
Modify phoenix_config.txt entry
ftpuser
Switch user to admin by issuing "su - admin"
.
with the home directory
/opt/phoenix/cache/ccm/<call-manager-ip>
. If this is the first time you have created a Call Manager definition, you will be prompted for the ftpuser password. When you create subsequent
Call Manager definitions, the same password will be used, and you will see a Success message when the definition is created.
ccm_ftp_directory = /opt/phoenix/cache/ccm
6. Restart phParser by issuing "killall -9 phParser"
Configure Cisco Call Manager to Send CDR Records to AccelOps
1.
2.
3.
4.
Log in to Cisco Call Manager.
Go to
Click
Tools > CDR Management Configuration
.
The CDR Management Configuration window will open.
Add New
.
Enter this information.
Field Value
Host Name/IP Address <AccelOps IP address>
User Name
Password ftpuser
<The password you created for ftpuser>
Protocol
Directory Path
SFTP
/ opt/phoenix/cache/ccm/<call-manager-ip>
5. Click
Save
.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 392
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 393
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Contact Center Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information discovered
SNMP
SSH
Application type
Metrics collected
System metrics: CPU utilization, Memory utilization, Disk utilization, Interface utilization, Hardware Status,
Process count, Process level CPU and memory utilization, Install software change
Disk I/O monitoring
Used for
Performance
Monitoring
Event Types
There are no event types defined specifically for this device.
Rules
In
Analytics > Rules
, search for "cisco contact center" in the
Name
column to see the rules associated with this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Setting Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Value
ssh-generic
Device Type <select device type from drop down>
Access Protocol SSH
Page 394
FortiSIEM Installation Guide
Port
User Name
Password
22
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 395
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Presence Server Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information discovered
SNMP
SSH
Application type
Metrics collected
System metrics: CPU utilization, Memory utilization, Disk utilization, Interface utilization, Hardware Status,
Process count, Process level CPU and memory utilization, Install software change
Disk I/O monitoring
Used for
Performance
Monitoring
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Setting Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Value
ssh-generic
Device Type <select device type from drop down>
Access Protocol SSH
Page 396
FortiSIEM Installation Guide
Port
User Name
Password
22
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 397
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Tandeberg Telepresence Video Communication Server (VCS) Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP
SSH
Application type
Metrics collected
System metrics: CPU utilization, Memory utilization, Disk utilization, Interface utilization, Hardware Status,
Process count, Process level CPU and memory utilization, Install software change
Disk I/O monitoring
Used for
Performance
Monitoring
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Value
ssh-generic
Device Type <select device type from drop down>
Access Protocol SSH
Page 398
FortiSIEM Installation Guide
Port
User Name
Password
22
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 399
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Telepresence Multipoint Control Unit (MCU) Configuration
What is Discovered and Monitored
What is Discovered and Monitored
The following protocols are used to discover and monitor various aspects of Cisco Tandeberg VCS
Protocol Information discovered Metrics collected
SNMP Application type
Used for
System metrics: Uptime, Interface utilization Performance Monitoring
Event Types
In
CMDB > Event Types
, search for "cisco telepresence" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device. .
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Setting Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 400
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Telepresence Video Communication Server Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Logs parsed
Syslog
Used for
Call attempts, Call rejects, Media stats, Request, response, Search Log Analysis
Event Types
In
CMDB > Event Types
, search for "Cisco-TVCS" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined reports for this device.
Reports
There are no predefined reports for this device.
Page 401
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Unity Connection Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP Application type
Metrics collected
System metrics: CPU utilization, Memory utilization, Disk utilization, Interface utilization, Hardware Status,
Process count, Process level CPU and memory utilization
Used for
Performance
Monitoring
Event Types
In
CMDB > Event Types
, search for "cisco unity" in the
Description
column to see the event types associated with this device.
Rules
In
Analytics > Rules
, search for "cisco unity" in the
Name
column to see the rules associated with this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 402
FortiSIEM Installation Guide
Web Server Configuration
AccelOps supports these web servers for discovery and monitoring.
Apache Web Server Configuration
Microsoft IIS for Windows 2000 and 2003 Configuration
Microsoft IIS for Windows 2008 Configuration
Nginx Web Server Configuration
FortiSIEM Installation Guide
Page 403
FortiSIEM Installation Guide FortiSIEM Installation Guide
Apache Web Server Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol
SNMP
Information discovered
Application type
HTTP(S) via the mod-status module
Syslog Application type
Metrics collected
Process level metrics: CPU utilization, Memory utilization
Apache
metrics
: Uptime, CPU load, Total Accesses, Total Bytes Connections, Requests/sec,
Bytes/sec, Bytes/req, Busy Workers, Idle Workers
W3C access logs: attributes include Client IP, URL, User Agent, Referrer, HTTP Version, HTTP
Method, HTTP Status Code, Sent Bytes, Received Bytes, Connection Duration
Used for
Performance
Monitoring
Performance
Monitoring
Security Monitoring and compliance
Event Types
In
CMDB > Event Types
, search for "apache" in the
Device Type
and
Description
column to see the event types associated with this device.
Rules
here are no predefined rules for this device.
Reports
In Analytics > Reports, search for "apache" in the Name column to see the reports associated with this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
HTTPS
To communicate with AccelOps over HTTPS, you need to configure the mod_status module in your Apache web server.
1.
2.
Log in to your web server as an administrator.
Open the configuration file
/etc/Httpd.conf
.
3. Modify the file as shown in these code blocks, depending on whether you are connecting over HTTP without authentication, or over
HTTPS with authentication.
Page 404
3.
FortiSIEM Installation Guide
Without Authentication
LoadModule status_module modules/mod_status.so
...
ExtendedStatus on
...
#Configuration without authentication
<Location /server-status>
SetHandler server-status
Order Deny,Allow
Deny from all
Allow from .foo.com
</Location>
With Authentication
LoadModule status_module modules/mod_status.so
...
ExtendedStatus on
...
#Configuration with authentication
<Location /server-status>
SetHandler server-status
Order deny,allow
Deny from all
Allow from all
AuthType Basic
AuthUserFile /etc/httpd/account/users
AuthGroupFile /etc/httpd/account/groups
AuthName "Admin"
Require group admin
Satisfy all
</Location>
4. If you are using authentication, you will have to add user authentication credentials.
a. Go to
/etc/httpd
, and if necessary, create an account
directory.
b. In the account
directory, create two files, users
and groups
.
c. In the groups
file, enter admin:admin
.
d. Create a password for the admin user.
htpasswd --c users admin
5. Reload Apache.
Page 405
FortiSIEM Installation Guide
FortiSIEM Installation Guide
/etc/init.d/httpd reload
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Syslog
Install and configure Epilog application to send syslog to AccelOps
1.
2.
Download Epilog from Epilog download site and install it on your Windows Server.
For Windows, launch Epilog from StartAll ProgramsInterSect AllianceEpilog for windows
3.
4.
For Linux, type http://<yourApacheServerIp>:6162
Configure Epilog application as follows a. Go to Log Configuration. Click Add button and add the following log files to be sent to AccelOps
/etc/httpd/logs/access_log b.
/etc/httpd/logs/ssl_access_log
Go to Network Configuration i. ii. iii.
Set AO System IP(all-in-1 or collector) in Destination Server address (10.1.2.20 here);
Set 514 in Destination Port text area c.
Click Change Configuration to save the configuration
Apply the Latest Audit Configuration. Apache logs will now sent to AccelOps in real time.
Define the Apache Log Format
You need to define the format of the logs that Apache will send to AccelOps.
1.
2.
Open the file
/etc/httpd/conf.d/ssl.conf
Add this line to the file.
for editing.
CustomLog logs/ssl_request_log combined
3. Uncomment this line in the file.
#CustomLog logs/access_log common
4. Add this line to the file.
CustomLog logs/access_log combined
5. Reload Apache.
/etc/init.d/httpd reload
Apache Syslog Log Format
Page 406
FortiSIEM Installation Guide FortiSIEM Installation Guide
<142>Sep 17 13:27:37 SJ-Dev-S-RH-VMW-01.prospecthills.net ApacheLog
192.168.20.35 - - [17/Sep/2009:13:27:37 -0700] "GET
/icons/apache_pb2.gif HTTP/1.1" 200 2414 "http://192.168.0.30/"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)"
<134>Mar 4 17:08:04 137.146.28.68 httpd: [ID 702911 local0.info]
192.168.20.38 - - [04/Mar/2010:16:35:21 -0800] "GET /bugzilla-3.0.4/
HTTP/1.1" 200 10791 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 GTB6"
<142>Sep 17 13:27:37 135.134.33.23 HTTP: [ID 702911 local0.info]
192.168.20.38 - - [04/Mar/2010:16:35:21 -0800] "GET /bugzilla-3.0.4/
HTTP/1.1" 200 10791 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 GTB6"
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Settings for Apache Web Server HTTPS Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your Apache web server over https, use these settings.
Setting
Name
Device Type
Value
Apache-https generic
Access Protocol HTTP or HTTPS
Port
URL
80 (HTTP) or 443 (HTTPS) server-status?auto
User Name
Password
The admin account you created when configuring HTTPS
The password associated with the admin account
Page 407
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft IIS for Windows 2000 and 2003 Configuration
What is Discovered and Monitored
Enabling SNMP on Windows Server 2003
Enabling SNMP on Windows 7 or Windows Server 2008 R2
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP Application type
WMI
Syslog
Metrics collected
Process level metrics: CPU utilization, memory utilization
Application type, service mappings
Application type
Process level metrics: uptime, CPU Utilization, Memory utilization, Read I/O, Write I/O
IIS metrics
: Current Connections, Max Connections, Sent Files, Received Files, Sent Bytes, Received
Bytes, ISAPI Requests, Not Found Errors
W3C access logs: attributes include IIS Service Instance, Client IP, URL, User Agent, Referrer, HTTP
Version, HTTP Method, HTTP Status Code, Sent Bytes, Received Bytes, Connection Duration
Event Types
In
CMDB > Event Types
, search for "microsoft is" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Used for
Performance
Monitoring
Performance
Monitoring
Security
Monitoring and compliance
Reports
There are no predefined reports for this device.
Configuration
SNMP
Enabling SNMP on Windows Server 2003
SNMP is typically enabled by default on Windows Server 2003, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you need to make sure that the SNMP Management tool has been enabled for your device.
1.
2.
In the
Start
menu, go to
Administrative Tools > Services
.
Go to
Control Panel > Add or Remove Programs
.
3. Click
Add/Remove Windows Components
.
4. Select
Management and Monitoring Tools
and click
Details
.
Make sure that
Simple Network Management Tool
is selected.
5.
6.
7.
8.
9.
10.
11.
12.
If it isn't selected, select it, and then click
Next
to install.
Go to Start > Administrative Tools > Services.
Select and open
SNMP Service
.
Click the
Security
Select
tab.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
Click
Add public
that is set to
read-only.
Select
Accept SNMP packets from these hosts.
Click
Add.
13.
Enter the
.
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
14.
Page 408
FortiSIEM Installation Guide FortiSIEM Installation Guide
14.
15.
Click
Apply
Under
.
SNMP Service
, click
Restart service
.
Enabling SNMP on Windows 7 or Windows Server 2008 R2
SNMP is typically enabled by default on Windows Server 2008, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you should check that SNMP Services have been enabled for your server.
1.
2.
3.
4.
9.
10.
11.
12.
5.
6.
7.
8.
13.
14.
15.
Log in to the Windows 2008 Server where you want to enable SNMP as an administrator.
In the
Under
Under
If not, click
Add Feature
, then select
In the
Click
Click
Under
Start
Add
.
Apply
menu, select
Control Panel
.
Programs
Features
Select and open
Click the
Select
.
, click
, see if
Server Manager
SNMP Service
Turn Windows features on/off
SNMP Services
is installed.
SNMP Service
Security
tab.
window, go to
, click
.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
Select
Accept SNMP packets from these hosts.
Click
Add.
public
that is set to
read-only.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Restart service
.
.
SMNP Service
and click
Next
to install the service.
Services > SNMP Services
.
WMI
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
Page 409
FortiSIEM Installation Guide FortiSIEM Installation Guide
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
11.
12.
mote Access
.
Click
OK
.
In the
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
In the
Com Security
Com Security
tab, under
Launch and Activation Permissions
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
, and
Remote Activation
.
, click
Edit Defaults
.
Allow
for
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
4.
5.
6.
Windows Firewall.
Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
Select Windows Firewall: Allow remote administration exception.
Run cmd.exe
and enter these commands: netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7.
Page 410
FortiSIEM Installation Guide FortiSIEM Installation Guide
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Syslog
Use
Windows Agent Manager to configure the sending of syslogs from this device.
Sample IIS Syslog
<13>Oct 9 12:19:05 ADS-Pri.ACME.net IISWebLog 0
2008-10-09 19:18:43 W3SVC1 ADS-PRI 192.168.0.10 GET /iisstart.htm - 80 -
192.168.20.80 HTTP/1.1
Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv:1.9.0.3)+Gecko/200809
2417+Firefox/3.0.3 - - 192.168.0.10 200 0 0 2158 368 156
<46>Mar 29 12:21:03 192.168.0.40 FTPSvcLog 0 2010-03-29 19:20:32
127.0.0.1 - MSFTPSVC1 FILER 127.0.0.1 21 [1]PASS IEUser@ - 530 1326 0 0
0 FTP - - - -
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 411
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft IIS for Windows 2008 Configuration
What is Discovered and Monitored
Enabling SNMP on Windows Server 2003
Enabling SNMP on Windows 7 or Windows Server 2008 R2
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
What is Discovered and Monitored
Metrics collected Protocol Information discovered
SNMP Application type Process level metrics: CPU utilization, memory utilization
Used for
WMI
Syslog
Application type, service mappings
Application type
Process level metrics: uptime, CPU Utilization, Memory utilization, Read I/O, Write I/O
IIS metrics
: Current Connections, Max Connections, Sent Files, Received Files, Sent Bytes, Received
Bytes, ISAPI Requests, Not Found Errors
W3C access logs: attributes include IIS Service Instance, Client IP, URL, User Agent, Referrer, HTTP
Version, HTTP Method, HTTP Status Code, Sent Bytes, Received Bytes, Connection Duration
Performance
Monitoring
Performance
Monitoring
Security
Monitoring and compliance
Event Types
Instructions - Remove before Publishing
Provide the prefix or keyword to use in searching for events for this application or device in the CMDB. If there are no specific event types for this device, insert this text: There are no event types defined specifically for this device.
In
CMDB > Event Types
, search for "microsoft is" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
Enabling SNMP on Windows Server 2003
SNMP is typically enabled by default on Windows Server 2003, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you need to make sure that the SNMP Management tool has been enabled for your device.
1.
2.
In the
Start
menu, go to
Administrative Tools > Services
.
Go to
Control Panel > Add or Remove Programs
.
3. Click
Add/Remove Windows Components
.
4. Select
Management and Monitoring Tools
and click
Details
.
Make sure that
Simple Network Management Tool
is selected.
If it isn't selected, select it, and then click
Next
to install.
5.
6.
Go to Start > Administrative Tools > Services.
Select and open
SNMP Service
.
7.
Page 412
FortiSIEM Installation Guide FortiSIEM Installation Guide
7.
8.
9.
10.
11.
12.
13.
14.
15.
Click the
Select
Security
tab.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
public
that is set to
read-only.
Select
Accept SNMP packets from these hosts.
Click
Add.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Click
Click
Add
Under
.
Apply
.
SNMP Service
, click
Restart service
.
Enabling SNMP on Windows 7 or Windows Server 2008 R2
SNMP is typically enabled by default on Windows Server 2008, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you should check that SNMP Services have been enabled for your server.
1.
2.
3.
4.
9.
10.
11.
12.
5.
6.
7.
8.
13.
14.
15.
Log in to the Windows 2008 Server where you want to enable SNMP as an administrator.
In the
Under
Under
If not, click
Add Feature
, then select
In the
Click
Click
Under
Start
Add
.
Apply
menu, select
Control Panel
.
Programs
Features
Select and open
Click the
Select
.
, click
, see if
Server Manager
SNMP Service
Turn Windows features on/off
SNMP Services
is installed.
SNMP Service
Security
tab.
window, go to
, click
.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
Select
Accept SNMP packets from these hosts.
Click
Add.
public
that is set to
read-only.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Restart service
.
.
SMNP Service
and click
Next
to install the service.
Services > SNMP Services
.
WMI
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
Page 413
FortiSIEM Installation Guide FortiSIEM Installation Guide
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Domain Admin User
set up
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the
Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Launch and Activation Permissions
, click
Find the user you created for the monitoring account, and make sure that user has the permission
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
Edit Limits
.
Allow
for
11.
12.
In the
Com Security
, and
Remote Activation
.
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
Windows Firewall.
4. Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
5.
6.
Select
Run
Windows Firewall: Allow remote administration exception.
cmd.exe
and enter these commands:
Page 414
6.
FortiSIEM Installation Guide FortiSIEM Installation Guide netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Syslog
Use the
Windows Agent Manager to configure sending syslogs from your device to AccelOps.
Sample IIS Syslog
<13>Oct 9 12:19:05 ADS-Pri.ACME.net IISWebLog 0
2008-10-09 19:18:43 W3SVC1 ADS-PRI 192.168.0.10 GET /iisstart.htm - 80 -
192.168.20.80 HTTP/1.1
Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv:1.9.0.3)+Gecko/200809
2417+Firefox/3.0.3 - - 192.168.0.10 200 0 0 2158 368 156
<46>Mar 29 12:21:03 192.168.0.40 FTPSvcLog 0 2010-03-29 19:20:32
127.0.0.1 - MSFTPSVC1 FILER 127.0.0.1 21 [1]PASS IEUser@ - 530 1326 0 0
0 FTP - - - -
Setting Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 415
FortiSIEM Installation Guide FortiSIEM Installation Guide
Nginx Web Server Configuration
Settings for Access Credentials
The following protocols are used to discover and monitor various aspects of Nginx webserver.
Protocol Information discovered
SNMP
Syslog
Application type
Metrics collected Used for
Process level metrics: CPU utilization, Memory utilization
W3C access logs: attributes include Client IP, URL, User Agent, Referrer, HTTP Version, HTTP Method,
HTTP Status Code, Sent Bytes, Received Bytes, Connection Duration
Performance
Monitoring
Security Monitoring and compliance
Event Types
In
CMDB > Event Types
, search for "nginx" in the
Device Type
and
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Example nginx Syslog
<29>Jun 15 07:59:03 ny-n1-p2 nginx: "200.158.115.204","-","Mozilla/5.0
(Windows NT 5.1 WOW64; rv:9.0.1) Gecko/20100178
Firefox/9.0.1","/images/design/header-2-logo.jpg","GET","http://wm-cente r.com/images/design/header-2-logo.jpg","200","0","/ypf-cookie_auth/index
.html","0.000","877","-","10.4.200.203","80","wm-center.com","no-cache, no-store, must-revalidate","-","1.64","_","-","-"
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Page 416
FortiSIEM Installation Guide
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
FortiSIEM Installation Guide
Page 417
FortiSIEM Installation Guide
Configuring Blade Servers
AccelOps supports these blade servers for discovery and monitoring.
Cisco UCS Server Configuration
FortiSIEM Installation Guide
Page 418
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco UCS Server Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
Cisco
UCS API
Host name, Access IP,
Hardware components processors, chassis, blades, board, cpu, memory, storage, power supply unit, fan unit
Metrics collected
Chassis status: Input Power, Input Avg Power, Input Max Power, Input Min Power, Output Power,
Output Avg Power, Output Max Power, Output Min Power
Memory status
: Temp (C), Avg Temp (C), Max Temp (C), Min Temp (C)
Processor status
: Input Current, Input Avg Current, Input Max Current, Input Min Current, Temp
(C), Avg Temp (C), Max Temp (C), Min Temp (C)
: Temp (C), Max Temp (C), Avg Temp (C), Min Temp (C), Input 210Volt, Avg
Power supply status
Input 210Volt, Max Input 210Volt, Min Input 210Volt, Output 12Volt, Avg Output 12Volt, Max Output
12Volt, Min Output 12Volt, Output 3V3Volt, Avg Output 3V3Volt, Max Output 3V3Volt, Min Output
3V3Volt, Output Current, Avg Output Current, Max Output Current, Min Output Current, Output
Power, Avg Output Power, Max Output Power,Min Output Power
Fan status
: Fan Speed, Average Fan Speed, Max Fan Speed, Min Fan Speed
Event Types
In
CMDB > Event Types
, search for "cisco us" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "cisco us" in the Name column to see the reports associated with this application or device.
Used for
Availability and
Performance
Monitoring
Configuration
UCS XML API
AccelOps uses Cisco the Cisco UCS XML API to discover Cisco UCS and to collect hardware statistics. See the Cisco UCS documentation for information on how to configure your device to connect to AccelOps over the API.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
Settings for Cisco UCS Server API Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your Cisco UCS Server over the API, use these settings:
Setting
Name
Device Type
Access Protocol
Value
ucs
Cisco UCS
UCS API
Page 419
FortiSIEM Installation Guide
Pull Interval (minutes) 5
Port 8880
User Name
Password
The user name you set up in your UCS server to communicate with AccelOps
The password associated with user name
FortiSIEM Installation Guide
Sample Cisco UCS Events
Power Supply Status Event
[PH_DEV_MON_UCS_HW_PSU_STAT]:[eventSeverity]=PHL_INFO,[hostName]=machine
,[hostIpAddr]=10.1.2.36,[hwComponentName]=sys/chassis-1/psu-2,
[envTempdDegC]=47.764706,[envTempAvgDegC]=36.176472,[envTempMaxDegC]=47.
764706,[envTempMinDegC]=25.529411,[input210Volt]=214.294113,
[input210AvgVolt]=210.784317,[input210MaxVolt]=214.294113,[input210MinVo lt]=207.823532,[ouput12Volt]=12.188235,[ouput12AvgVolt]=12.109803,
[ouput12MaxVolt]=12.376471,[ouput12MinVolt]=11.905882,[ouput3V3Volt]=3.1
41176,[ouput3V3AvgVolt]=3.374510,[ouput3V3MaxVolt]=3.458823,
[ouput3V3MinVolt]=3.141176,[outputCurrentAmp]=15.686275,[outputCurrentAv gAmp]=20.261436,[outputCurrentMaxAmp]=24.509804,
[outputCurrentMinAmp]=15.686275,[outputPowerWatt]=191.188004,[outputPowe rAvgWatt]=245.736252,[outputPowerMaxWatt]=303.344879,
[outputPowerMinWatt]=191.188004
Processor Status Event
[PH_DEV_MON_UCS_HW_PROCESSOR_STAT]:[eventSeverity]=PHL_INFO,
[hostName]=machine,[hostIpAddr]=10.1.2.36,
[hwComponentName]=sys/chassis-1/blade-3/board/cpu-2,
[inputCurrentAmp]=101.101959,[inputCurrentAvgAmp]=63.420914,
[inputCurrentMaxAmp]=101.101959,[inputCurrentMinAmp]=44.580391,
[envTempdDegC]=5.788235,[envTempAvgDegC]=6.216993,[envTempMaxDegC]=6.431
373,[envTempMinDegC]=5.788235,
Chassis Status Event
[PH_DEV_MON_UCS_HW_CHASSIS_STAT]:[eventSeverity\]=PHL_INFO,[hostName]=ma chine,[hostIpAddr]=10.1.2.36,[hwComponentName]=sys/chassis-1,
[inputPowerWatt]=7.843137,[inputPowerAvgWatt]=7.843137,[inputPowerMaxWat t]=7.843137,[inputPowerMinWatt]=7.843137, outputPowerWatt]=0.000000,[outputPowerAvgWatt]=0.000000,[outputPowerMaxW att]=0.000000,[outputPowerMinWatt]=0.000000
Memory Status Event
Page 420
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_UCS_HW_MEMORY_STAT]:[eventSeverity]=PHL_INFO,[hostName]=mach ine,[hostIpAddr]=10.1.2.36,
[hwComponentName]=sys/chassis-1/blade-1/board/memarray-1/mem-9,[envTempd
DegC]=51.000000,[envTempAvgDegC]=50.128208,
[envTempMaxDegC]=51.000000,[envTempMinDegC]=48.000000
Fan Status Event
[PH_DEV_MON_UCS_HW_FAN_STAT]:[eventSeverity]=PHL_INFO,[hostName]=machine
,[hostIpAddr]=10.1.2.36,
[hwComponentName]=sys/chassis-1/fan-module-1-5/fan-2,[fanSpeed]=7800.000
000,[fanSpeedAvg]=7049.000000,
[fanSpeedMax]=8550.000000,[fanSpeedMin]=2550.00000
Page 421
FortiSIEM Installation Guide FortiSIEM Installation Guide
HP BladeSystem Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Access IP, Hardware components - processors, chassis, blades, board, cpu, memory, storage, power supply unit, fan unit
Metrics collected
Hardware status: Fan status, Power supply status, power enclosure status, Overall status
Used for
Availability and
Performance
Monitoring
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover the HP BladeSystem and collect hardware statistics. See the instructions on configuring SNMP in your
Bladesystem documentation to enable communications with AccelOps.
After you have configured SNMP on your BladeSystem blade server, you can configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device Discovery
, and then initiate discovery of the device as described in the topics in
Page 422
FortiSIEM Installation Guide
Configuring Cloud Applications
AccelOps supports these cloud applications for monitoring.
AWS Access Key IAM Permissions and IAM Policies
AWS CloudTrail API Configuration
AWS EC2 CloudWatch API Configuration
Cisco FireAMP Cloud Configuration
Microsoft Azure AuditTrail Configuration
Salesforce CRM Audit Configuration
FortiSIEM Installation Guide
Page 423
FortiSIEM Installation Guide FortiSIEM Installation Guide
AWS Access Key IAM Permissions and IAM Policies
In order to monitor AWS resources in AccelOps, an access key and a corresponding secret access key is needed. Prior to the availability of AWS
IAM users, the recommendation was to create an access key at the level of root AWS account. This practice has been deprecated since the availability of AWS IAM users as you can read from the AWS Security Credentials best practice guide . If you were monitoring AWS using such access keys, the first step is to delete such keys and create keys based on a standalone IAM user dedicated for monitoring purposes in
AccelOps. This document explains how to create such a user, and what permissions and policies to add to allow AccelOps to monitor your AWS environment.
Create IAM user for AccelOps monitoring
1.
2.
3.
4.
Login to the IAM Console - Users Tab .
Click
Create Users
Type in a username, e.g. aomonitoring under
5.
6.
Leave the checkbox
Enter User Names
Generate an access key for each user
Click
Download Credentials
and click on
Close
button
.
selected or select it if it is not selected
The downloaded CSV file contains the Access Key ID and Secret Access Key that you can use in AccelOps to monitor various AWS services. You will need to add permissions before you can actually add them in AccelOps.
Change permissions for IAM user
1.
2.
3.
4.
Select the user aomonitoring
Switch to tab
Permissions
Click
Attach Policy
.
Select
AmazonEC2ReadOnlyAccess, AWSCloudTrailReadOnlyAccess, AmazonRDSReadOnlyAccess, CloudWatchReadOnlyAccess, A mazonSQSFullAccess
and click Attach Policy
You can choose to skip attaching some policies if you do not use that service or plan on monitoring that service. For instance, if you do not use RDS, then you do not need to attach
AmazonRDSReadOnlyAccess
5. You can choose to provide blanket read-only access to all S3 buckets by attaching the policy
AmazonS3ReadOnlyAccess
. Alternatively,
6. you can specificy a more restricted policy as described in the next step
Now, identify the set of S3 bucket(s) that you have configured to store Cloudtrail logs for each region. You can create an
inline policy,
ch oose
custom policy
, then paste the sample policy below. Make sure you replace the actual S3 bucket names below
udtrail2
with the ones you have configured
aocloudtrail1, aoclo
S3 bucket read-only policy
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:Get*",
"s3:List*"
],
"Resource": [
"arn:aws:s3:::aocloudtrail1",
"arn:aws:s3:::aocloudtrail2"
]
}
]
}
Page 424
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 425
FortiSIEM Installation Guide FortiSIEM Installation Guide
AWS CloudTrail API Configuration
What is Discovered and Monitored
Settings for Access Credentials
Sample Events for AWS CloudTrail
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
CloudTrail API None None Security Monitoring
Event Types
In
CMDB > Event Types
, search for "Cloudtrail" in the
Device Type
column to see the event types associated with this device. See the
API reference for more information about the event types available for CloudTrail monitoring.
Amazon
Rules
There are no predefined rules for this device. However,
Reports
In
Analytics > Reports
, search for "cloudtrail" in the
Name
column to see the rules associated with this device.
Configuration
.
AccelOps receives information about AWS events through the CloudTrail API. After creating an S3 bucket for the storage of log files on AWS, you then configure the Simple Notification Service (SNS) and Simple Queue Service (SQS) to create a notification for the log file and have it delivered by SQS. In your AccelOps virtual appliance you then enter access credentials so AccelOps can communicate with CloudTrail as it would any other device.
Create a new Cloudtrail
1.
2.
3.
4.
Log in to
Click https://console.aws.amazon.com/cloudtrail
Switch to the
Trails
.
region
5.
6.
Click on
Add New Trail
Enter a
Trail name
Select for
such as aocloudtrail
Apply Trail to all regions
.
for which you want to generate cloud trail logs.
You will need to create a cloudtrail for each region by following all the steps mentioned here for cloudtrail, SQS, and SNS. You cannot use 'Apply Trail to all regions' to collect trails for all regions in one S3 bucket and have AccelOps pull these logs. In the future, AccelOps will be enhanced to support this capability
7.
8.
9.
10.
11.
12.
Select
Yes
for
Create a new S3 bucket.
'
For S3 bucket, enter a name like s3aocloudtrail
.
Click
Advanced
Select
Yes
for
For
SNS topic
Click
Create
.
.
Create a new SNS topic.
, enter a name like snsaocloudtrail
.
13.
Leave the rest of advanced settings to the default values
A dialog will confirm that logging is turned on.
Configure Simple Queue Service (SQS) Delivery
1. Log in to https://console.aws.amazon.com/sqs .
2.
Page 426
FortiSIEM Installation Guide FortiSIEM Installation Guide
2.
3.
4.
Switch to the
region
in which you created a new cloudtrail above
Click
Create New Queue
.
Enter a
Queue Name
such as sqsaocloudtrail
5. Enter the
Queue Settings.
Setting
Default Visibility Timeout
Message Retention Period
This must be set for between 5 and 50 minutes. A lower value is recommended for high event rates to avoid event loss.
Maximum Message Size
Delivery Delay
Receive Message Wait Time
Value
0 seconds
10 minutes
256KB
0 seconds
5 seconds
6.
7.
Click
Create Queue.
When the queue is created, click the
Details
tab and make note of the
ARN
(Amazon Resource Name), as you will need this when configuring the Simple Notification Service below and when configuring the access credentials for AccelOps.
Set Up Simple Notification Service (SNS)
1.
2.
3.
4.
5.
6.
7.
Log in to https://console.aws.amazon.com/sns .
Select
Topics
Select the SNS topic
Click
Actions > Subscribe to topic
For
For
Protocol
Endpoint
Click
, select snsaocloudtrail
that you specified when creating a cloudtrail
Amazon SQS
, enter the
ARN
Create Subscription
.
.
from the menu to launch the popup
Create Subscription
of the queue that you created when setting up SQS.
.
Give Permission for Amazon SNS to Send Messages to SQS
1.
2.
3.
4.
5.
6.
Log in to https://console.aws.amazon.com/sqs .
Select the queue you created, sqsaocloudtrail
In the
From the
Choose a Topic
The
Click
Queue Actions
Topic ARN
Subscribe
.
menu, select
Subscribe Queue to SNS Topic
dropdown, select the SNS topic
will be automatically filled
.
snsaocloudtrail
that you created earlier.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
amazon.com
entry in
Admin > Setup Wizard > Event Pulling
.
Settings for Access Credentials
Settings for AWS CloudTrail API Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access the CloudTrail API, use these settings.
Setting
Name
Device Type
Value
aocloudtrail
Amazon AWS CloudTrail
Access Protocol Amazon AWS CloudTrail
Region Region where your AWS instance is located
Bucket The name of the S3 bucket you created ( s3aocloudtrail
SQS Queue URL Enter the ARN of your queue without the http://
prefix
)
Access Key ID
Secret Key
The access key for your AWS instance
The secret key for your AWS instance
Page 427
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sample Events for AWS CloudTrail
Fri Oct 10 14:44:23 2014 AccelOps-CloudTrail
[additionalEventData/LoginTo]=https://console.aws.amazon.com/console/hom e?state=hashArgs%23&isauthcode=true [additionalEventData/MFAUsed]=No
[additionalEventData/MobileVersion]=No [awsRegion]=us-east-1
[eventID]=fdf8f837-7e75-46a0-ac95-b6d15993ebf7 [eventName]=ConsoleLogin
[eventSource]=SIGNIN [eventTime]=2014-10-10T06:38:11Z
[eventVersion]=1.01 [requestParameters]=null
[responseElements/ConsoleLogin]=Success [sourceIPAddress]=211.144.207.10
[userAgent]=Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36
[userIdentity/accountId]=623885071509
[userIdentity/arn]=arn:aws:iam::623885071509:user/John.Adams
[userIdentity/principalId]=AIDAIUSNMEIUYBS7AN4UW
[userIdentity/type]=IAMUser [userIdentity/userName]=John.Adams
Fri Oct 10 14:19:45 2014 AccelOps-CloudTrail [awsRegion]=us-east-1
[eventID]=351bda80-39d4-41ed-9e4d-86d6470c2436
[eventName]=DescribeInstances [eventSource]=EC2
[eventTime]=2014-10-10T06:12:24Z [eventVersion]=1.01
[requestID]=2d835ae2-176d-4ea2-8523-b1a09585e803
[requestParameters/filterSet/items/0/name]=private-ip-address
[requestParameters/filterSet/items/0/valueSet/items/0/value]=10.0.0.233
[responseElements]=null [sourceIPAddress]=211.144.207.10
[userAgent]=aws-sdk-php2/2.4.7 Guzzle/3.7.1 curl/7.19.7 PHP/5.3.3
[userIdentity/accessKeyId]=AKIAI2MUUCROHFSLLT3A
[userIdentity/accountId]=623885071509
[userIdentity/arn]=arn:aws:iam::623885071509:root
[userIdentity/principalId]=623885071509 [userIdentity/type]=Root
[userIdentity/userName]=accelops
Page 428
FortiSIEM Installation Guide FortiSIEM Installation Guide
AWS EC2 CloudWatch API Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol
CloudWatch API
Information Discovered Metrics Collected
Machine name
Internal Access IP
Instance ID
Image ID
Availability Zone
Instance Type
Volume ID
Status
Attach Time
CPU Utilization
Received Bits/sec
Sent Bits/sec
Disk reads (Instance Store)
Disk writes (Instance Store)
Disk reads/sec (Instance Store)
Disk writes/sec (Instance Store)
Packet loss
Read Bytes (EBS)
Write Bytes (EBS)
Read Ops (EBS)
Write Ops (EBS)
Disk Queue (EBS)
Used For
Performance Monitoring
Event Types
PH_DEV_MON_EBS_METRIC captures EBS metrics
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
. You should also be sure to read the topic
Discovering Amazon Web Services (AWS) Infrastructure
.
Settings for Access Credentials
Settings for AWS CloudWatch Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access AWS CloudWatch, use these settings.
Setting
Name
Device Type
Value
ec2
Amazon AWS EC2
Access Protocol AWS SDK
Region The region in which your AWS instance is located
Access Key ID
Secret Key
The access key for your EC2 instance
The secret key for your EC2 instance
Page 429
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sample events
[PH_DEV_MON_EC2_METRIC]:[eventSeverity]=PHL_INFO,[fileName]=phPerfJob.cp
p,[lineNumber]=6571,[hostName]=ec2-54-81-216-218.compute-1.amazonaws.com
,[hostIpAddr]=10.144.18.131,[cpuUtil]=0.334000,[diskReadKBytesPerSec]=0.
000000,[diskWriteKBytesPerSec]=0.000000,[diskReadReqPerSec]=0.000000,[di skWriteReqPerSec]=0.000000,[sentBytes]=131,[recvBytes]=165,[sentBitsPerS ec]=17.493333,[recvBitsPerSec]=22.026667,[phLogDetail]=
[PH_DEV_MON_EBS_METRIC]:[eventSeverity]=PHL_INFO,[fileName]=deviceAws.cp
p,[lineNumber]=133,[hostName]=ec2-52-69-215-178.ap-northeast-1.compute.a
mazonaws.com,[hostIpAddr]=172.30.0.50,[diskName]=/dev/sda1,[volumeId]=vo l-63287d9f,[diskReadKBytesPerSec]=7.395556,[diskWriteKBytesPerSec]=7.395
556,[ioReadsPerSec]=0.000000,[ioWritesPerSec]=0.010000,[diskQLen]=0,[phL ogDetail]=
Page 430
FortiSIEM Installation Guide FortiSIEM Installation Guide
AWS RDS Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Type Protocol
Relational Database Storage (RDS) CloudWatch API
Information Discovered Metrics Collected
CPU Utilization
User Connections
Free Memory
Free Storage
Used Swap
Read Latency
Write Latency
Read Ops
Write Ops
Used For
Performance Monitoring
Event Types
PH_DEV_MON_RDS_METRIC captures RDS metrics
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
If you have not already configured Access Keys and permissions in AWS, please follow the steps outlined in
Access Key IAM Permissions and IAM Policies
.
Discovering AWS RDS
1. Create a AWS credential a. b.
Go to Admin > Credentials > Step 1: Enter Credentials
Click
Add
i. ii. iii. iv.
Set
Device Type
to Amazon AWS RDS
Set
Access Protocol
as AWS SDK
Set
Region
as the region in which your AWS instance is located v.
Set
Access Key ID
as the access key for your EC2 instance
Set
Secret Key
c. Click Save as the secret key for your EC2 instance
2. Create a IP to credential mapping a. b.
Set
IP/IP Range
to amazon.com
Choose
Credentials
to the one created in Step 1b
3.
4.
Click test Connectivity to make sure the credential is working correctly
Go to Admin > Discovery a. b. c.
Set
Discovery Type
Click OK to Save
as AWS Scan
5.
Select the entry and Click
Discover
After Discovery finishes, check CMDB > Amazon Web Services > AWS Database
Sample Events
Page 431
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_RDS_METRIC]:[eventSeverity]=PHL_INFO,[fileName]=deviceAwsRDS
.cpp,[lineNumber]=104,[hostName]=mysql1.cmdzvvce07ar.ap-northeast-1.rds.
amazonaws.com,[hostIpAddr]=54.64.131.93,[dbCpuTimeRatio]=1.207500,[dbUse rConn]=0,[dbEnqueueDeadlocksPerSec]=0.000587,[freeMemKB]=489,[freeDiskMB
]=4555,[swapMemUtil]=0.000000,[ioReadsPerSec]=0.219985,[ioWritesPerSec]=
0.213329,[devDiskRdLatency]=0.08,[devDiskWrLatency]=0.4029,[phLogDetail]
=
Page 432
FortiSIEM Installation Guide FortiSIEM Installation Guide
Box.com Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol
Box.com
API
Information Discovered
Ccreation, deletion, and modification activity for specific files or folders
File-sharing properties, including whether the file is shared, password protected, or preview/download enabled, and how many times the file was downloaded or viewed
Metrics
Collected
Used
For
Event Types
In
CMDB > Event Types
, search for "box.com" and look for
BOX
events in the
Name
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
AccelOps can monitor a directory or subdirectory, for example
/All Files
or
/All Files/my files, or a single file , for example
/All
Files/my files/user guide.pdf
. When you
set up the access credentials for AccelOps to communicate with Box.com
path to the folder or files you want to monitor, so you should have your Box.com storage set up before you set up your access credentials. You also won't need to initiate discovery of Box.com as you would with other devices, but should go to to
Admin > Setup wizard > Event Pulling
make sure that a Box.com event pulling job is created after you have successfully set up access credentials.
and
Settings for Access Credentials
Settings for Box.com API Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access the Box.com API, use these settings.
Reauthorizing Access to Box.com
If AccelOps loses connectivity to Box.com, for example if an access token expires, you can edit the original credential and click
Re-authorize on Box.com
. This button is available only after you have created and saved a Box.com access credential for the first time.
Setting
Name
Device Type
Value
BOX
Box.com Box
Access Protocol Box API
File Type Select Folder or File
File/Directory Path The path to the file or directory you want to monitor
Box.com Account The email address for your Box.com account
Password The password associated with the administrative user
When you click
Save
, you will be redirected to the Box.com website.
1. Enter your login credentials for Box.com.
2.
Page 433
FortiSIEM Installation Guide FortiSIEM Installation Guide
2.
3.
Click
Authorize
.
Click
Grant access to Box
.
4.
You should see a message that the authorization for AccelOps to access your Box.com account was successful.
Follow the rest of the instructions in
Setting Access Credentials for Device Discovery
Box.com account with the access credentials you created.
for associating the IP address of your
Sample Box.com Events
//the following event is generated when a folder called share was created using the [email protected] account
[PH_DEV_MON_BOX_FILE_CREATE]:[eventSeverity]=PHL_INFO,[fileName]=phBoxAg ent.cpp,[lineNumber]=625,[fileType]=folder,
[targetName]=share,[fileSize64]=0,[filePath]=/All Files,[fileOwner]=box usage,[fileDesc]=,[user]=box usage,
[userId]=225282673,[accessTime]=1412700374,[accountName]=box.usage@gmail
.com,[fileId]=2541809279,[fileVersion]=1,
[targetHashCode]=,[phLogDetail]=
//the following event is generated when a file called All
Files/share/b.txt was created using the [email protected] account
[PH_DEV_MON_BOX_FILE_CREATE]:[eventSeverity]=PHL_INFO,[fileName]=phBoxAg ent.cpp,[lineNumber]=625,[fileType]=file,
[targetName]=b.txt,[fileSize64]=0,[filePath]=/All
Files/share,[fileOwner]=box usage,[fileDesc]=,[user]=box usage,
[userId]=225282673,[accessTime]=1412700377,[accountName]=box.usage@gmail
.com,[fileId]=21701906465,[fileVersion]=1,[targetHashCode]=da39a3ee5e6b4 b0d3255bfef95601890afd80709,[phLogDetail]=
//the following event is generated when a file called All
Files/share/b.txt was deleted using the [email protected] account
[PH_DEV_MON_BOX_FILE_DELETE]:[eventSeverity]=PHL_INFO,[fileName]=phBoxAg ent.cpp,[lineNumber]=503,[fileType]=file,
[targetName]=b.txt,[fileSize64]=0,[filePath]=/All
Files/share,[fileOwner]=box usage,[fileDesc]=,[user]=box usage,
[userId]=225282673,[accessTime]=0,[accountName][email protected],[fil eId]=21701844673,[fileVersion]=1,[targetHashCode]=da39a3ee5e6b4b0d3255bf ef95601890afd80709,[phLogDetail]=
//the following event is generated when a file called All
Files/share/a.txt was modified using the [email protected] account
[PH_DEV_MON_BOX_FILE_MODIFY]:[eventSeverity]=PHL_INFO,[fileName]=phBoxAg ent.cpp,[lineNumber]=652,[fileType]=file,
[targetName]=a.txt,[fileSize64]=8,[filePath]=/All Files,[fileOwner]=box usage,[fileDesc]=,[user]=box usage,
[userId]=225282673,[accessTime]=1412700491,[accountName]=box.usage@gmail
.com,[fileId]=21701903189,[fileVersion]=2,[targetHashCode]=0a74245f78b73
39ea8cdfc4ac564ed14dc5c22ad,[phLogDetail]=
//the following event is generated periodically for each monitored file
Page 434
FortiSIEM Installation Guide FortiSIEM Installation Guide and folder
[PH_DEV_MON_BOX_FILE_SHARE]:[eventSeverity]=PHL_INFO,[fileName]=phBoxAge nt.cpp,[lineNumber]=601,[fileType]=folder,
[targetName]=share,[fileSize64]=0,[filePath]=/All Files,[fileOwner]=box usage,[fileDesc]=,[accountName][email protected],
[fileId]=2541809279,[fileVersion]=1,[infoURL]=https://app.box.com/s/zine
Page 435
FortiSIEM Installation Guide FortiSIEM Installation Guide f627pyuexdcxir1q,[downloadURL]=,[filePasswordEnabled]=no,
[filePreviewEnabled]=yes,[fileDownloadEnabled]=yes,[fileUnshareAtTime]=-
1,[filePreviewCount]=0,[fileDownloadCount]=0,[phLogDetail]=
Page 436
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco FireAMP Cloud Configuration
What is Discovered and Monitored
Sample Events for Salesforce Audit
What is Discovered and Monitored
Protocol
CloudAMP API
Logs Collected
End point malware activity
Used For
Security Monitoring
Event Types
In
CMDB > Event Types
, search for "Cisco FireAMP Cloud" in the
Search
column to see the event types associated with this device.
Rules
There are no predefined rules for Cisco FireAMP Cloud
Reports
There are no predefined reports for Cisco FireAMP Cloud .
Configuration
Create Cisco FireAMP Cloud Credential
5.
6.
7.
8.
1.
2.
3.
4.
Log in to AccelOps Supervisor node.
Go to
Admin > Setup Wizard > Credentials
.
In Step 1, Click
Add
to create a new credential
For
Device Type
, select
For
For
Access Protocol
For
Manual
Click
Save
.
Cisco FireAMP Cloud
, select
Password Configuration
FireAMP Cloud API
, select
credential method, enter
,
Manual
or
CyberArk
Client ID
and
Client Secret
.
9.
For CyberArk credential method specify CyberArk properties.
Test Connectivity
5.
6.
7.
8.
1.
2.
3.
4.
Log in to AccelOps Supervisor node.
Go to
Admin > Setup Wizard > Credentials
.
In Step 2, Click
Add
to create a new association
For
Name/IP/IP Range
, enter
For
Credentials
Click
Save api.amp.sourcefire.com
, enter the name of c
Select the entry just created and Click redential created in the " Salesforce Audit Credential " step.
Test Connectivity without Ping.
A pop up will appear and show the Test Connectivity results.
Go to
Admin > Setup Wizard > Pull Events
and make sure an entry is created for Microsoft Audit Log Collection
Sample Events for Salesforce Audit
[FireAMP_Cloud_Threat_Detected]:[eventSeverity]=PHL_CRITICAL,[connectorG
UID]=d2f5d61f-feb0-4b67-80fd-073655b86425,[date]=2015-11-25T19:17:39+00:
00,[detection]=W32.DFC.MalParent,[detectionId]=6159251516445163587,[even tId]=6159251516445163587,[eventType]=Threat
Detected,[eventTypeId]=1090519054,[fileDispostion]=Malicious,[fileName]= rjtsbks.exe,[fileSHA256]=3372c1edab46837f1e973164fa2d726c5c5e17bcb888828 ccd7c4dfcc234a370,[hostName]=Demo_TeslaCrypt
Page 437
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft Azure AuditTrail Configuration
What is Discovered and Monitored
Sample Events for Microsoft Azure Audit Trail
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Azure CLI None None Security Monitoring
Event Types
In
CMDB > Event Types
, search for "Microsoft Azure Auditl" in the
Search
column to see the event types associated with this device.
Rules
There are no predefined rules for Microsoft Azure Audit
Reports
There are no predefined reports for Microsoft Azure Audit.
Configuration
Create Microsoft Azure Audit Credential
5.
6.
7.
8.
1.
2.
3.
4.
Log in to AccelOps Supervisor node.
Go to
Admin > Setup Wizard > Credentials
.
In Step 1, Click
Add
to create a new credential
For
Device Type
, select
For
For
Access Protocol
Manual
Click
Save
.
Microsoft Azure Audit
, select
For
Password Configuration
Azure CLI
, select
Manual
or
CyberArk
9.
credential method, enter the user name and credentials
,
Test Connectivity
5.
6.
7.
8.
1.
2.
3.
4.
Log in to AccelOps Supervisor node.
Go to
Admin > Setup Wizard > Credentials
.
In Step 2, Click
Add
to create a new association
For
Name/IP/IP Range
, enter some IP Address
For
Credentials
, enter the name of c
Click
Save
Select the entry just created and Click redential created in the " Microsoft Azure Audit Credential " step.
Test Connectivity without Ping.
A pop up will appear and show the Test Connectivity results.
Go to
Admin > Setup Wizard > Pull Events
and make sure an entry is created for Microsoft Audit Log Collection
Sample Events for Microsoft Azure Audit Trail
Page 438
FortiSIEM Installation Guide FortiSIEM Installation Guide
2016-02-26 15:19:10
AccelOps-Azure,[action]=Microsoft.ClassicCompute/virtualmachines/shutdow n/action,[caller][email protected],[level]=Er ror,[resourceId]=/subscriptions/3ed4ee1c-1a83-4e02-a928-7ff5e0008e8a/res ourcegroups/china/providers/Microsoft.ClassicCompute/virtualmachines/chi na,[resourceGroupName]=china,[eventTimestamp]=2016-02-14T06:12:18.553970
9Z,[status]=Failed,[subStatus]=Conflict,[resourceType]=Microsoft.Classic
Compute/virtualmachines,[category]=Administrative
Page 439
FortiSIEM Installation Guide FortiSIEM Installation Guide
Okta Configuration
AccelOps can integrate with Okta as a single-sign service for AccelOps users, discover Okta users and import them into the CMDB, and collect audit logs from Okta. See
Setting Up External Authentication
will begin to monitor Okta events.
for information on configuring Okta to use as a single-sign on service, and
for discovering users and associating them with the Okta authentication profile. Once you have discovered Okta users, AccelOps
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Okta API
Event Types
In
CMDB > Event Types
, search for "okta" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Sample Okta Event
Mon Jul 21 15:50:26 2014 AccelOps-Okta [action/message]=Sign-in successful [action/objectType]=core.user_auth.login_success
[action/requestUri]=/login/do-login [actors/0/displayName]=CHROME
[actors/0/id]=Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
[actors/0/ipAddress]=211.144.207.10
[actors/0/login][email protected] [actors/0/objectType]=Client
[eventId]=tev-UlpTnWJRI2vXNRKTJHE4A1405928963000
[eventName]=USER-AUTH-LOGIN-SUCCESS [published]=2014-07-21T07:49:23.000Z
[requestId]=U8zGA0zxVNXabfCeka9oGAAAA
[sessionId]=s024bi4GPUkRaegPXuA1IFEDQ [targets/0/displayName]=YaXin Hu
[targets/0/id]=00uvdkhrxcPNGYWISAGK
[targets/0/login][email protected] [targets/0/objectType]=User
Page 440
FortiSIEM Installation Guide FortiSIEM Installation Guide
Salesforce CRM Audit Configuration
What is Discovered and Monitored
Sample Events for Salesforce Audit
What is Discovered and Monitored
Protocol
Salesforce API
Logs Collected
Successful/Failed Login, API Query Activity, Dashboard Activity, Opportunity Activity,
Report Export Activity, Report Activity, Document Download Activity
Used For
Security Monitoring
Event Types
In
CMDB > Event Types
, search for "Salesforce Audit" in the
Search
column to see the event types associated with this device.
Rules
There are no predefined rules for Salesforce CRM Audit
Reports
There are many reports defined in
Analytics > Reports > Device > Application > CRM
Salesforce Failed Logon Activity
Salesforce Successful Logon Activity
Top Browsers By Failed Login Count
Top Browsers By Successful Login Count
Top Salesforce Users By Failed Login Count
Top Salesforce Users By Successful Login Count
Top Successful Salesforce REST API Queries By Count, Run Time
Top Failed Salesforce Failed REST API Queries By Count, Run Time
Top Salesforce API Queries By Count, Run Time
Top Salesforce Apex Executions By Count, Run Time
Top Salesforce Dashboards Views By Count
Top Salesforce Document Downloads By Count
Top Salesforce Opportunity Reports By Count
Top Salesforce Report Exports By Count
Top Salesforce Reports By Count, Run Time
Top Salesforce Events
Configuration
Create Salesforce Audit Credential
5.
6.
7.
8.
1.
2.
3.
4.
Log in to AccelOps Supervisor node.
Go to
Admin > Setup Wizard > Credentials
.
In Step 1, Click
Add
to create a new credential
For
Device Type
, select
For
For
Access Protocol
Manual
Click
Save
.
Salesforce Salesforce Audit
, select
For
Password Configuration
Salesforce API
, select
Manual
or
CyberArk
9.
credential method, enter the user name, password and Security Token.
,
Test Connectivity
5.
6.
7.
8.
1.
2.
3.
4.
Log in to AccelOps Supervisor node.
Go to
Admin > Setup Wizard > Credentials
.
In Step 2, Click
Add
to create a new association
For
Name/IP/IP Range
, enter
For
Credentials login.salesforce.com
, enter the name of c
Click
Save
Select the entry just created and Click redential created in the " Salesforce Audit Credential " step.
Test Connectivity without Ping.
A pop up will appear and show the Test Connectivity results.
Page 441
FortiSIEM Installation Guide FortiSIEM Installation Guide
7.
8. Go to
Admin > Setup Wizard > Pull Events
and make sure an entry is created for Salesforce Audit Log Collection
Sample Events for Salesforce Audit
[Salesforce_Activity_Perf]:[activityType]=API,[activityName]=get_user_in fo,[srcIpAddr]=23.23.13.166,[user][email protected],[deviceTime]=145
8112097,[isSuccess]=false,[runTime]=31,[cpuTime]=9,[dbTime]=19434051,[in foURL]=Api
Page 442
FortiSIEM Installation Guide
Configuring Console Access Devices
AccelOps supports these console access devices for discovery and monitoring.
Lantronix SLC Console Manager Configuration
FortiSIEM Installation Guide
Page 443
FortiSIEM Installation Guide FortiSIEM Installation Guide
Lantronix SLC Console Manager Configuration
What is Discovered and Monitored
Protocol Information discovered Metrics/Logs collected
Syslog
Used for
Admin access, Updates, Commands run Log analysis and compliance
Event Types
Around 10 event types are generated by parsing Lantronix SLC logs. The complete list can be found in CMDB > Event Types by searching for
Lantronix-SLC. Some important ones are
Lantronix-SLC-RunCmd
Lantronix-SLC-Update
Lantronix-SLC-User-Logon-Success
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
AccelOps processes events from this device via syslog. Configure the device to send syslog to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
Example Syslog
<174>xmsd: gen/info-Syslog server changed to 10.4.3.37
<38>xwsd[32415]: auth/info-Web Authentication Success for user andbr003
Page 444
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring End point Security Software
The following anti-virus and host security (HIPS) applications are supported for discovery and monitoring by FortiSIEM.
Bit9 Security Platform Configuration
Cisco Security Agent (CSA) Configuration
ESET NOD32 Anti-Virus Configuration
McAfee ePolicy Orchestrator (ePO) Configuration
Sophos Endpoint Security and Control Configuration
Symantec Endpoint Protection Configuration
Trend Micro Intrusion Defense Firewall (IDF) Configuration
Trend Micro OfficeScan Configuration
Page 445
FortiSIEM Installation Guide FortiSIEM Installation Guide
Bit9 Security Platform Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog Logs Security Monitoring
Event Types
In
CMDB > Event Types
, search for "Bit9" in the
Device Type
columns to see the event types associated with this device.
Rules
Bit9 Agent Uninstalled or File Tracking Disabled
Bit9 Fatal Errors
Blocked File Execution
Unapproved File Execution
Reports
Bit9 Account Group Changes
Bit9 Fatal and Warnings Issues
Bit9 Functionality Stopped
Bit9 Security Configuration Downgrades
Bit9 Configuration
Syslog
AccelOps processes events from this device via syslog. Configure the device to send syslog to AccelOps on port 514.
Sample Syslog
<14>1 2015-04-06T16:24:02Z server1.foo.com - - - - Bit9 event: text="Server discovered new file
'c:\usersacct\appdata\local\temp\3cziegdd.dll'
[361aa7fbd5d00aa9952e94adc01d6f8d4cb08766eb03ff522ba5c7a2f9e99f9f]." type="Discovery" subtype="New file on network" hostname="SVR123" username="SVR123\acct" date="4/6/2015 4:22:52 PM" ip_address="10.168.1.1" process="c:\abc\infrastructure\bin\scannerreset.exe" file_path="c:\users\acct\appdata\local\temp\3cziegdd.dll" file_name="3cziegdd.dll" file_hash="361aa7fbd5d00aa9952e94adc01d6f8d4cb08766eb03ff522ba5c7a2f9e99 f9f" installer_name="csc.exe" policy="High Enforce" process_key="00000000-0000-1258-01d0-7085edb50080" server_version="7.2.0.1395" file_trust="-2" file_threat="-2" process_trust="-1" process_threat="-1"
Page 446
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Security Agent (CSA) Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol
SNMP Trap
Information Discovered Metrics Collected Used For
Events
There are no specific events defined for this device.
Rules
AccelOps uses these rules to monitor events for this device:
Rule
Agent service control
Agent UI control
Application control
Buffer overflow attacks
Clipboard access control
COM component access control
Connection rate limit
Data access control
Description
Attempts to modify agent configuration
Attempts to modify agent UI default settings, security settings, configuration, contact information
Attempts to invoke processes in certain application classes
Attempts to acccess clipboard data written by sensitive data applications
Unusual attempts to access certain COM sets including Email objects
File access control
Kernel protection
Network access control
Network interface control
Network shield
Windows event log
Registry access control
Resource access control
Rootkit/kernel protection
Excessive connections to web servers or from email clients
Unusual attempts to access restricted data sets such as configuration files, password etc. by suspect applications
Unusual attempts to read or write restricted files sets such as system executables, boot files etc. by suspect applications
Unusual attempts to modify kernel functionality by suspect applications
Attempts to connect to local network services
Attempts by local applications to open a stream connection to the NIC driver
Attacks based on bad IP/TCP/UDP/ICMP headers, port and host scans etc
Attempts to write certain registry entries
Symbolic link protection
Unusual attempts to load files after boot
Service restart Service restarts
Sniffer and protocol detection Attempts by packet/protocol sniffer to receive packets
Syslog control Syslog events
Page 447
FortiSIEM Installation Guide FortiSIEM Installation Guide
System API control Attempts to access Windows Security Access Manager (SAM)
Reports
There are no predefined reports for Cisco Security Agent.
Configuration
SNMP Trap
AccelOps processes events from this device via SNMP traps sent by the device. Configure the device to send send SNMP traps to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
Example SNMP Trap
2008-05-13 11:00:36 192.168.1.39 [192.168.1.39]:SNMPv2-MIB::sysUpTime.0
= Timeticks: (52695748) 6 days, 2:22:37.48
SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.8590.3.1
SNMPv2-SMI::enterprises.8590.2.1 = INTEGER: 619
SNMPv2-SMI::enterprises.8590.2.2 = INTEGER: 261
SNMPv2-SMI::enterprises.8590.2.3 = STRING:
"sjdevVwindb06.ProspectHills.net"
SNMPv2-SMI::enterprises.8590.2.4 = STRING: "2008-05-13 19:03:21.157"
SNMPv2-SMI::enterprises.8590.2.5 = INTEGER: 5
SNMPv2-SMI::enterprises.8590.2.6 = INTEGER: 452
SNMPv2-SMI::enterprises.8590.2.7 = STRING: "C:\\Program
Files\\RealVNC\\VNC4\\winvnc4.exe"
SNMPv2-SMI::enterprises.8590.2.8 = NULL SNMPv2-SMI::enterprises.8590.2.9
= STRING: "192.168.20.38"
SNMPv2-SMI::enterprises.8590.2.10 = STRING: "192.168.1.39"
SNMPv2-SMI::enterprises.8590.2.11 = STRING: "The process 'C:\\Program
Files\\RealVNC\\VNC4\\winvnc4.exe'
(as user NT AUTHORITY\\SYSTEM) attempted to accept a connection as a server on TCP port 5900 from 192.168.20.38 using interface Wired\\VMware
Accelerated AMD PCNet Adapter. The operation was denied."
SNMPv2-SMI::enterprises.8590.2.12 = INTEGER: 109
SNMPv2-SMI::enterprises.8590.2.13 = STRING: "192.168.1.39"
SNMPv2-SMI::enterprises.8590.2.14 = STRING: "W"
SNMPv2-SMI::enterprises.8590.2.15 = INTEGER: 3959
SNMPv2-SMI::enterprises.8590.2.16 = INTEGER: 5900
SNMPv2-SMI::enterprises.8590.2.17 = STRING: "Network access control"
SNMPv2-SMI::enterprises.8590.2.18 = STRING: "Non CSA applications, server for TCP or UDP services"
SNMPv2-SMI::enterprises.8590.2.19 = INTEGER: 33
SNMPv2-SMI::enterprises.8590.2.20 = STRING: "CSA MC Security Module"
SNMPv2-SMI::enterprises.8590.2.21 = NULL
SNMPv2-SMI::enterprises.8590.2.22 = STRING: "NT AUTHORITY\\SYSTEM"
SNMPv2-SMI::enterprises.8590.2.23 = INTEGER: 2
Page 448
FortiSIEM Installation Guide FortiSIEM Installation Guide
ESET NOD32 Anti-Virus Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
ESET NOD32 Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation , and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps Supervisor.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Example Syslog
<35313912>Jul 26 18:06:12 LMHCAPEAV01 ERA Server: [2011-07-26
13:06:12.784] V5 [4e2f02148110] [00000e9c] <SESSION_INFO> Kernel connection from 10.0.52.25:48071 accepted
<35313864>Jul 26 18:06:13 LMHCAPEAV01 ERA Server: [2011-07-26
13:06:13.221] V5 [4e2f02148110] [00000e9c] <SESSION_INFO> Kernel connection from
10.0.52.25:48071 closed (code 0,took 438ms, name 'Lmhathnsmt01', mac
'00-1E-4F-E8-49-03', product 'ESET NOD32 Antivirus BUSINESS EDITION', product version '04.00002.00071', virus signature db version
'63(20110726)')
Page 449
FortiSIEM Installation Guide FortiSIEM Installation Guide
MalwareBytes Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected
Syslog
Used For
Malware detection log Security Monitoring
Event Types
In
CMDB > Event Types
, search for "malwarebytes" to see the event types associated with this device.
Rules
Malware found but not remediated
Reports
In
Analytics > Reports
, search for "malware found" to see the reports associated with this device.
Configuration
Syslog
AccelOps processes events from this device via syslog. Configure the device to send syslog to AccelOps on port 514.
Sample Syslog
<45>1 2016-09-23T14:40:35.82-06:00 reportDeviceName
Malwarebytes-Endpoint-Security 1552 - -
{"security_log":{"client_id":"ef5f8fc8-ad0e-46f8-b6d7-1a85d5f73e64","hos t_name":"Abc-cbd","domain":"abc.com","mac_address":"FF-FF-FF-FF-FF","ip_ address":"10.1.1.1","time":"2016-09-23T14:40:14","threat_level":"Moderat e","object_type":"FileSystem","object":"HKLM\\SOFTWARE\\POLICIES\\GOOGLE
\\UPDATE","threat_name":"PUM.Optional.DisableChromeUpdates","action":"Qu arantine","operation":"QUARANTINE","resolved":true,"logon_user":"dsamuel s","data":"data","description":"No description","source":"MBAM","payload":null,"payload_url":null,"payload_ process":null,"application_path":null,"application":null}}
Page 450
FortiSIEM Installation Guide FortiSIEM Installation Guide
McAfee ePolicy Orchestrator (ePO) Configuration
What is Discovered and Monitored ePO Configuration
What is Discovered and Monitored
Protocol
SNMP Traps
Information Discovered Metrics Collected Used For
Event Types
In
CMDB > Event Types
device.
, search for "mcafee epolicy" in the
Description
column to see the event types associated with this application or
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
ePO Configuration
SNMP Trap
AccelOps processes events from this device via SNMP traps sent by the device.
1.
2.
Log in to the McAfee EPO console.
Go to
Menu > Configuration > Registered Servers
, and then click
The
Registered Server Builder
opens.
7.
8.
9.
10.
3.
4.
5.
6.
For
Server type
, enter
SNMP Server
.
For
Name
, enter the IP address of your SNMP server.
Enter any
Notes
For
Address
, and then click
Next
to go to the
Details
For
Community
, enter
SNMPv1
.
public
.
Click
Send Test Trap
, and then click .
page.
, enter the IP address or DNS Name for the AccelOps virtual appliance that will receive the SNMP trap.
For
SNMP Version
, select
New Server
.
OK
Log in to your Supervisor node and use
Real Time Search to see if AccelOps received the trap.
Example SNMP Trap
Page 451
FortiSIEM Installation Guide FortiSIEM Installation Guide
2011-04-14 01:28:46 192.168.20.214(via UDP: [192.168.20.214]:45440)
TRAP, SNMP v1, community public
SNMPv2-SMI::enterprises.3401 Enterprise Specific Trap (5) Uptime:
0:00:00.30
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.9.245 = STRING: "To
SJ-Dev-S-RH-DNS-01"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.11.245 = STRING: "My
Organization"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.12.245 = STRING: "Directory"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.18.245 = STRING: "Any"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.19.245 = STRING: "Any"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.33.245 = STRING: "(Any)"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.15.245 = STRING: "4/16/08
3:07:04 AM"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.31.245 = STRING: "1278"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.32.245 = STRING: "file infected. No cleaner available, file deleted successfully"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.16.245 = STRING: "1"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.17.245 = STRING: "1"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.13.245 = STRING: "VirusScan"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.14.245 = STRING: "Virus detected and removed"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.22.245 = STRING: "EICAR test file"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.23.245 = STRING: "Not
Available"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.24.245 = STRING:
"192.168.1.6"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.25.245 = STRING:
"SJDEVSWINIIS01"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.26.245 = STRING:
"C:\Documents and
Settings\administrator.PROSPECTHILLS\Desktop\eicar.com"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.27.245 = STRING: "3"
SNMPv2-SMI::enterprises.3401.12.2.1.1.4.1.1.6.245 = STRING: "4/16/08
3:07:04 AM"
Page 452
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sophos Endpoint Security and Control Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol
SNMP Trap
Information Discovered Metrics Collected Used For
Event Types
In
CMDB > Event Types
device.
, search for "sophos endpoint" in the
Device Type
column to see the event types associated with this application or
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device. .
Sophos Configuration
SNMP Trap
AccelOps processes Sophos Endpoint control events via SNMP traps sent from the management console. Configure the management console to send SNMP traps to AccelOps, and the system will automatically recognize the messages.
SNMP Traps are configured within the Sophos policies.
1.
2.
3.
4.
5.
6.
In the
In the
Policies
In the
policy
messages.
pane, double-click the policy you want to change.
dialog, in the
In the
Messages to send
Configure
In the
Messaging
dialog, go to the
panel, click
Messaging
.
SNMP messaging
tab and select
Enable SNMP messaging.
panel, select the types of event for which you want Sophos Endpoint Security and Control to send SNMP
SNMP trap destination
field, enter the IP address of the recipient.
In the
SNMP community name
field, enter the SNMP community name.
Sample SNMP Trap
2011-05-03 18:22:32 172.15.30.8(via UDP: [172.15.30.8]:1216) TRAP, SNMP v1, community public
SNMPv2-SMI::enterprises.2604.2.1.1.1 Enterprise Specific Trap (1)
Uptime: 5:59:55.31
SNMPv2-SMI::enterprises.2604.2.1.1.2.1.1 = STRING: "File
\"C:\WINDOWS\system32\LDPackage.dll\" belongs to virus/spyware
'Mal/Generic-S'."
SNMPv2-SMI::enterprises.2604.2.1.1.2.2.2 = STRING: "9.5.5"
Page 453
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sophos UTM Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected
Syslog
Used For
Configuration change, command execution Log Management, Compliance and SIEM
Event Types
In
CMDB > Event Types
, search for "sophos-utm" to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
FortiSIEM processes events from this device via syslogs sent by the device. Configure the device to send syslog to FortiSIEM as directed in the device's product documentation, and FortiSIEM will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Sample Syslog Message
<30>2016:07:05-16:57:39 c-server-1 httpproxy[15760]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="10.10.10.10" dstip="1.1.1.1" user="" group="" ad_domain="" statuscode="302" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffCustoConteFilte (Custom_Default content filter action)" size="0" request="0xdc871600" url="http://a.com" referer="http://foo.com/bar/" error="" authtime="0" dnstime="1" cattime="24080" avscantime="0" fullreqtime="52627" device="0" auth="0" ua="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like
Gecko" exceptions="" category="154" reputation="unverified" categoryname="Web Ads"
Page 454
FortiSIEM Installation Guide FortiSIEM Installation Guide
Symantec Endpoint Protection Configuration
What is Discovered and Monitored
Symantec Endpoint Protection Configuration
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog Logs Security Monitoring
Event Types
In
CMDB > Event Types
this device.
, search for "symantec endpoint" in the
Device Type
and
Description
columns to see the event types associated with
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Symantec Endpoint Protection Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device.
Configuring Log Transmission to AccelOps
1.
2.
3.
4.
5.
Log in to Symantec Endpoint Protection Manager.
Go to
Admin> Configure External Logging > Servers > General
.
Select
For
Enable Transmission of Logs to a Syslog Server
Syslog Server
, enter
514
.
.
, enter the IP address of the AccelOps virtual appliance.
For
UDP Destination Port
Configuring the Types of Logs to Send to AccelOps
1.
2.
Go to
Admin> Configure External Logging > Servers > Log Filter
Select the types of logs and events you want to send to AccelOps.
.
Sample Syslog
<13>Feb 23 12:36:37 QA-V-Win03-App1.ProspectHills.net SymAntiVirus 0
2701170C2410,3,2,1,QA-V-WIN03-APP1,Administrator,,,,,,,16777216,"Scan started on selected drives and folders and all extensions.",1235421384,,0,,,,,0,,,,,,,,,,,{C11B44CF-35C9-4342-AB3D-E0E9
E3756510},,(IP)-0.0.0.0,,ACME,00:50:56:A3:30:2F,11.0.1000.1112,,,,,,,,,,
,,,,,,0,,,,,
<54>Jun 11 12:24:38 SymantecServer sjdevswinapp05: Site: Site sjdevswinapp05,Server: sjdevswinapp05,Domain: Default,Admin: admin,Administrator log on failed
<54>Jun 11 12:24:51 SymantecServer sjdevswinapp05: Site: Site sjdevswinapp05,Server: sjdevswinapp05,Domain: Default,Admin: admin,Administrator log on succeeded
Page 455
FortiSIEM Installation Guide FortiSIEM Installation Guide
<54>Feb 23 13:08:29 SymantecServer sjdevswinapp05: Virus found,Computer name: Filer,Source: Real Time Scan,Risk name: EICAR Test
String,Occurrences: 1,C:/Documents and
Settings/Administrator.PROSPECTHILLS/Local
Settings/Temp/vpqz3cxj.com,"",Actual action: Cleaned by deletion,Requested action: Cleaned,Secondary action: Quarantined,Event time: 2009-02-23 21:06:51,Inserted: 2009-02-23 21:08:29,End: 2009-02-23
21:06:51,Domain: Default,Group: Global\Prospecthills,Server: sjdevswinapp05,User: Administrator,Source computer: ,Source IP: 0.0.0.0
Mar 16 15:11:06 SymantecServer aschq97: NF77088-PCA,Local:
192.168.128.255,Local: 138,Local: FFFFFFFFFFFF,Remote:
192.168.128.86,Remote: ,Remote: 138,Remote:
0015C53B9216,UDP,Inbound,Begin: 2009-03-16 15:05:02,End: 2009-03-16
15:05:02,Occurrences: 1,Application:
C:/WINDOWS/system32/ntoskrnl.exe,Rule: Allow local file sharing,Location: Default,User: ,Domain: ASC
<54>Feb 24 11:51:19 SymantecServer sjdevswinapp05: QA-V-Win03-App2,[SID:
20352] HTTP Whisker/Libwhisker Scan (1) detected. Traffic has been allowed from this application: C:\WINDOWS\system32 toskrnl.exe,Local:
0.0.0.0,Local: 000000000000,Remote: ,Remote: 192.168.1.4,Remote:
000000000000,Inbound,TCP,Intrusion ID: 0,Begin: 2009-02-24 11:50:01,End:
2009-02-24 11:50:01,Occurrences: 1,Application:
C:/WINDOWS/system32/ntoskrnl.exe,Location: Default,User:
Administrator,Domain: PROSPECTHILLS
<54>Jul 28 08:08:52 SymantecServer corpepp01: 6910p-X751008R,Category:
2,Symantec AntiVirus,New virus definition file loaded. Version:
130727ag.
<54>Jul 28 08:09:32 SymantecServer corpepp01: CORPMIO-H4VYWB1,Category:
2,Symantec AntiVirus,Symantec Endpoint Protection services shutdown was successful.
<52>Jul 28 08:10:13 SymantecServer corpepp01: TEMPEXP02,Category:
0,Smc,Failed to disable Windows firewall
<54>Jul 28 08:08:52 SymantecServer corpepp01: 8440p-X0491JYR,Category:
0,Smc,Connected to Symantec Endpoint Protection Manager (10.0.11.17)
<54>Jul 28 08:08:52 SymantecServer corpepp01: 8440p-X0491JYR,Category:
0,Smc,Disconnected from Symantec Endpoint Protection Manager
(10.0.11.17)
<54>Jul 28 08:09:52 SymantecServer corpepp01: CORPES-3042,Category:
0,Smc,Connected to Symantec Endpoint Protection Manager (corphqepp01)
<54>Jul 28 08:09:52 SymantecServer corpepp01: CORPES-3042,Category:
Page 456
FortiSIEM Installation Guide FortiSIEM Installation Guide
0,Smc,Disconnected from Symantec Endpoint Protection Manager (corpepp01)
<54>Jul 28 08:09:32 SymantecServer corpepp01: CORPMIO-H4VYWB1,Category:
0,Smc,Network Threat Protection - - Engine version: 11.0.480 Windows
Version info: Operating System: Windows XP (5.1.2600 Service Pack 3)
Network info: No.0 "Local Area Connection 3" 00-15-c5-46-58-1e
"Broadcom NetXtreme 57xx Gigabit Controller" 10.0.208.66
<54>Jul 28 07:55:32 SymantecServer corpepp01: tol-afisk,Blocked,Unauthorized NT call rejected by protection driver.,System,Begin: 2011-07-27 15:29:57,End: 2011-07-27 15:29:57,Rule:
Page 457
FortiSIEM Installation Guide
Built-in rule,6092,AcroRd32.exe,0,None,"FuncID=74H,
RetAddr=18005CH",User: afisk,Domain: HST
FortiSIEM Installation Guide
Page 458
FortiSIEM Installation Guide FortiSIEM Installation Guide
Trend Micro Intrusion Defense Firewall (IDF) Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Trend Micro Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation , and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Example Syslog
<134>May 31 15:24:34 DSK-FT11XL1 dsa_mpld:
REASON=PLD:Disallow_Web_Proxy_Autodiscovery_Protocol REV IN=
OUT=Local_Area_Connection
MAC=00:26:B9:80:74:71:2C:6B:F5:35:4E:00:08:00 SRC=192.168.20.2
DST=192.168.13.39 LEN=133 PROTO=UDP SPT=53 DPT=58187 CNT=1 act=Reset
POS=0
SPOS=0 NOTE=CVE-2007-5355 FLAGS=0
Page 459
FortiSIEM Installation Guide FortiSIEM Installation Guide
Trend Micro OfficeScan Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol
SNMP Trap
Information Discovered Metrics Collected Used For
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Trend Micro Configuration
SNMP Trap
AccelOps processes events from this device via SNMP traps sent by the device. Configure the device to send send SNMP traps to AccelOps as directed in the device's product documentation , and AccelOps will parse the contents.
Example SNMP Trap
2011-04-14 02:17:54 192.168.20.214(via UDP: [192.168.20.214]:45440)
TRAP, SNMP v1, community public SNMPv2-SMI::enterprises.6101
Enterprise Specific Trap (5) Uptime: 0:00:00.30
SNMPv2-SMI::enterprises.6101.141 = STRING: "Virus/Malware:
Eicar_test_file Computer: SJDEVVWINDB05 Domain: ABC File:
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\yc8eayj0.com Date/Time: 4/10/2008
14:23:26 Result: Virus successfully detected, cannot perform the Clean action (Quarantine) "
Page 460
FortiSIEM Installation Guide
Configuring Environmental Sensors
AccelOps supports these devices for monitoring.
APC Netbotz Environmental Monitor Configuration
FortiSIEM Installation Guide
Page 461
FortiSIEM Installation Guide FortiSIEM Installation Guide
APC Netbotz Environmental Monitor Configuration
What is Monitored and Collected
What is Monitored and Collected
Metrics collected Protocol Information
Discovered
SNMP
(V1, V2c)
Host name, Hardware model, Network interfaces
SNMP
Trap (V1,
V2c)
SNMP Trap
Used for
Temperature: Sensor Id, Sensor label, Enclosure Id, Temperature
Relative Humidity
Air Flow
: Sensor Id, Sensor label, Enclosure Id, Relative Humidity
: Sensor Id, Sensor label, Enclosure Id, Air Flow
Dew Point Temperature
: Sensor Id, Sensor label, Enclosure Id, Dew Point Temperature
Current
: Sensor Id, Sensor label, Enclosure Id, Current
Audio Sensor Reading
: Sensor Id, Sensor label, Enclosure Id, Audio Sensor Reading
Dry Contact Sensor Reading
: Sensor Id, Sensor label, Enclosure Id, Dry Contact Sensor Reading
Door Switch Sensor Reading
: Sensor Id, Sensor label, Enclosure Id, Door Switch Sensor Reading
(Open/Close)
Camera Motion Sensor Reading
: Sensor Id, Sensor label, Enclosure Id, Camera Motion Sensor
Reading (Motion/No Motion)
Hadware Status (for NBRK0200): Contact Status, Output Relay Status, Outlet Status, Alarm
Device Status, Memory Sensor Status, Memory Output Status, Memory Outlet Status, memory
Beacon Status
EMS Status (for NBRK0200): EMS Hardware Status, Connection State
Hardware Probe (for NBRK0200): Sensor Id, Temperature, Relative Humidity, Connection State
Code
Module Sensor (for NBRK0200): Sensor Name, Sensor location, Temperature, Relative Humidity,
Connection State Code
See
Event Types
for more information about viewing the SNMP traps collected by AccelOps for this device.
Availability and
Performance
Monitoring
Availability and
Performance
Monitoring
Event Types
In
CMDB > Event Types
, search for "NetBotz" in the
Name
column to see the event types associated with this application or device.
Event types for NetBotz NBRK0200
PH_DEV_MON_HW_STATUS
[PH_DEV_MON_HW_STATUS]:[eventSeverity]=PHL_INFO,[fileName]=deviceNe tBotz.cpp,[lineNumber]=1642,[hostName]=Unknown,[hostIpAddr]=10.62.9
7.61,[hwStatusCode]=2,[hwProbeStatus]=2,[hwInputContactStatus]=2,[h wOutputRelayStatus]=0,[hwOutletStatus]=2,[hwAlarmDeviceStatus]=0,[h wMemSensorStatus]=0,[hwMemOutputStatus]=2,[hwMemOutletStatus]=2,[hw
MemBeaconStatus]=2,[phLogDetail]=
PH_DEV_MON_HW_EMS_STATUS
Page 462
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_HW_EMS_STATUS]:[eventSeverity]=PHL_INFO,[fileName]=devi ceNetBotz.cpp,[lineNumber]=1871,[hostName]=Unknown,[hostIpAddr]=10.
62.97.61,[reptDevName]=Unknown,[emsHwStatus]=0,[phyMachConnectionSt ateCode]=2,[hwLogStatus]=1,[phLogDetail]=
PH_DEV_MON_HW_PROBE
[PH_DEV_MON_HW_PROBE]:[eventSeverity]=PHL_INFO,[fileName]=deviceNet
Botz.cpp,[lineNumber]=2100,[hostName]=Unknown,[hostIpAddr]=10.62.97
.61,[envSensorLabel]=Sensor
MM:4,[envTempDegF]=74,[envTempHighThreshDegF]=138,[envHumidityRel]=
51,[envHumidityRelHighThresh]=90,[envHumidityRelLowThresh]=10,[seri alNumber]=L3,[phyMachConnectionStateCode]=3,[maxTempThresh]=140,[mi nTempThresh]=32,[maxHumidityThresh]=99,[minHumidityThresh]=0,[phLog
Detail]=
PH_DEV_MON_HW_MODULE_SENSOR
[PH_DEV_MON_HW_MODULE_SENSOR]:[eventSeverity]=PHL_INFO,[fileName]=d eviceNetBotz.cpp,[lineNumber]=2567,[hostName]=Unknown,[hostIpAddr]=
10.62.97.61,[moduleNumber]=0,[envSensorId]=1,[envSensorLabel]=Senso r MM:1,[envSensorLoc]=Orland Park
Server,[envTempDegF]=74,[envHumidityRel]=50,[phyMachConnectionState
Code]=1,[hwAlarmDevicetatus]=1,[phLogDetail]=
Rules
In
Analytics > Rules
, search for "NetBotz" in the
Name
column to see the rules associated with this application or device.
Reports
In
Analytics > Reports
, search for "Netbotz" in the
Name
column to see the reports associated with this application or device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
SNMP Trap
AccelOps processes events from this device via SNMP traps sent by the device. Configure the device to send send SNMP traps to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
Example SNMP Trap
Setting Access Credentials
Page 463
FortiSIEM Installation Guide FortiSIEM Installation Guide
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 464
FortiSIEM Installation Guide FortiSIEM Installation Guide
APC UPS Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered
SNMP
(V1, V2c)
Host name, Hardware model, Network interfaces
Metrics collected
UPS metrics: Remaining battery charge, Battery status, Replace battery indicator, Time on battery, Output status, Output load, Output voltage, Output frequency
SNMP
Trap
Used for
Availability and
Performance
Monitoring
Availability and
Performance
Monitoring
Event Types
In
CMDB > Event Types, search for "apc" in the Device Type column to see the event types associated with
this device.
Rules
In
Analytics > Rules
, search for "apc" in the
Name
column to see the rules associated with this device.
Reports
In
Analytics > Reports, search for "apc" in the Name column to see the reports associated with this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
SNMP Trap
AccelOps processes events from this device via SNMP traps sent by the device. Configure the device to send send SNMP traps to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
Example SNMP Trap
Setting Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Page 465
FortiSIEM Installation Guide
Community String <your own>
FortiSIEM Installation Guide
Page 466
FortiSIEM Installation Guide FortiSIEM Installation Guide
Generic UPS Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered
SNMP
(V1, V2c)
Host name, Hardware model, Network interfaces
Metrics collected
UPS metrics: Remaining battery charge, Battery status, Time on battery, Estimated
Seconds Remaining, Output voltage, Output current, Temperature
Used for
Availability and
Performance
Monitoring
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
UPS-MIB Required
Your device must have a UPS-MIB database to communicate with AccelOps over SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Setting Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 467
FortiSIEM Installation Guide FortiSIEM Installation Guide
Liebert FPC Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information
Discovered
SNMP
(V1, V2c)
Host name,
Hardware model, Network interfaces
Metrics collected
Output voltage (X-N, Y-N, Z-N), Output current (X, Y. Z), Neutral Current, Ground current, Output power, Power
Factor, Output Frequency, Output Voltage THD (Vx, Vy, Vz), Output Current THD (Lx, Ly. Lz), Output KWh,
Output Crest factor (Lx, Ly, Lz),
Output K-factor (Lx, Ly, Lz), Output Lx Capacity, output Ly capacity
Used for
Availability and
Performance
Monitoring
Event Types
In
CMDB > Event Types
, search for "LIebert FPC" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "Liebert FPC" in the Name column to see the reports associated with this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 468
FortiSIEM Installation Guide FortiSIEM Installation Guide
Liebert HVAC Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information
Discovered
SNMP
(V1, V2c)
Host name,
Hardware model,
Network interfaces
Metrics collected Used for
HVAC metrics: Temperature: current value, upper threshold, lower threshold, Relative Humidity: current value, upper threshold, lower threshold, System state, Cooling state, Heating state, Humidifying state, Dehumidifying state, Economic cycle, Fan state, Heating capacity, Cooling capacity
Availability and
Performance
Monitoring
AccelOps uses SNMP to discover and collector metrics from Generic UPS devices - requires the presence of UPS-MIB on the UPS device.
Follow Liebert HVAC documentation to enable AccelOps to poll the device via SNMP.
Event Types
In
CMDB > Event Types
, search for "Liebert HVAC" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In
Analytics > Reports, search for "Liebert HVAC" in the Name column to see the reports associated with this device.
Configuration
SNMP
UPS-MIB Required
Your device must have a UPS-MIB database to communicate with AccelOps.
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 469
FortiSIEM Installation Guide FortiSIEM Installation Guide
Liebert UPS Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP
(V1, V2c)
Host name, Hardware model, Network interfaces
Metrics collected
UPS metrics: Remaining battery charge, Battery status, Time on battery, Estimated
Seconds Remaining, Output voltage, Output current, Temperature
Used for
Availability and
Performance
Monitoring
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
UPS-MIB Required
Your device must include a UPS-MIB database to communicate with AccelOps.
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 470
FortiSIEM Installation Guide
Configuring Firewalls
AccelOps supports these firewalls for discovery and monitoring.
Check Point FireWall-1 Configuration
Check Point Provider-1 Firewall Configuration
Configuring MDS for Check Point Provider-1 Firewalls
Configuring MLM for Check Point Provider-1 Firewalls
Configuring CMA for Check Point Provider-1 Firewalls
Configuring CLM for Check Point Provider-1 Firewalls
Check Point VSX Firewall Configuration
Cisco Adaptive Security Appliance (ASA) Configuration
Dell SonicWALL Firewall Configuration
Fortinet FortiGate Firewall Configuration
Juniper Networks SSG Firewall Configuration
McAfee Firewall Enterprise (Sidewinder) Configuration
Palo Alto Firewall Configuration
WatchGuard Firebox Firewall Configuration
FortiSIEM Installation Guide
Page 471
FortiSIEM Installation Guide FortiSIEM Installation Guide
Check Point FireWall-1 Configuration
What is Discovered and Monitored
Add AccelOps as a Managed Node
Create an OPSEC Application for AccelOps
Create a Firewall Policy for AccelOps
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Firewall model and version, Network interfaces
LEA
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Firewall connection count
All traffic and system logs
Used for
Availability and
Performance
Monitoring
Security and
Compliance
Event Types
In
CMDB > Event Types
, search for "firewall-1" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
LEA
Add AccelOps as a Managed Node
1.
2.
3.
4.
5.
6.
Log in to your Check Point SmartDomain Manager.
In the
Global Policies
tab, select
.
Select the
Multi-Domain Security Management
, and then right-click to select
Launch Global SmartDashboard
7.
8.
9.
Click the
Select
Select
Enter a
Name
for your AccelOps host, like
AccelOpsVA
.
Enter the
Click
Nodes
General Properties
OK
.
Firewall
tab.
Network Objects
.
icon.
, and then right-click to select
Node > Host...
IP Address
of your AccelOps virtual appliance.
.
Create an OPSEC Application for AccelOps
1.
2.
3.
4.
5.
6.
In the
Firewall
tab, click the
Servers and OPSEC
icon.
Select
OPSEC Applications
, and then right-click to select
New > OPSEC Application
.
Click the
General
tab.
Enter a
Name
for your OPSEC application, like
For
Host
Under
, select the AccelOps host.
Client Entities
, select
LEA
and
CPMI
.
OPSEC_AccelOpsVA
.
Page 472
FortiSIEM Installation Guide FortiSIEM Installation Guide
6.
7.
8.
9.
10.
11.
For Check Point FireWall-1, also select
Click
Communication
.
Enter a one-time password.
This is the password you will use in setting up access credentials for your firewall in AccelOps.
Click
Close and re-open the application.
In the
Initialize
General
.
tab, next to
This is the
AccelOps Client SIC DN
SNMP
.
Communication
credentials for your firewall in AccelOps.
, the
DN
field will now contain a value like
CN= OPSEC_AccelOpsVA,0=MDS..i6g4zq
.
that you will need when you copy the secure internal communication certificates and set the access
Create a Firewall Policy for AccelOps
1.
2.
3.
4.
5.
In Servers and Opsec > OPSEC Applications, select your AccelOps application.
In the
Rules
Right-click
Right-click
Right-click
menu, select
SOURCE
SERVICE
, then click
DESTINATION
Top
.
, then click
Add
, then click
Add
and select your AccelOps virtual appliance.
Add
and select your Check Point firewall.
and select
FW1_lea
, and
CPMI
.
if you are configuring a Check Point FireWall-1 firewall.
6.
7.
8.
9.
10.
11.
Also select
snmp
Right-click
Right-click
TRACK
and select
Go to
Click
Go to
In the
Policy > Install
OK
.
AccelOps.
ACTION
and select
.
OPSEC Applications
General
tab of the
Accept
.
Log
.
and select your AccelOps application.
Properties
window, make sure that the communications have been enabled between your firewall and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 473
FortiSIEM Installation Guide FortiSIEM Installation Guide
Check Point Provider-1 Firewall Configuration
What is Discovered and Monitored
Component Configuration for Domain-Level Audit Logs
Component Configuration for Firewall Logs
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Firewall model and version, Network interfaces
LEA
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Firewall connection count
All traffic and system logs
Used for
Availability and
Performance
Monitoring
Security and
Compliance
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration Overview
The configuration of Check Point Provider-1 depends on the type of log that you want sent to AccelOps. There are two options:
Domain level audit logs, which contain information such as domain creation, editing, etc.
Firewall logs, which include both audit log for firewall policy creation, editing, etc., and traffic logs
These logs are generated and stored among four different components:
Multi-Domain Server (MDS), where domains are configured and certificates have to be generated
Multi-Domain Log Module (MLM), where domain logs are stored
Customer Management Add-on (CMA), the customer management module
Customer Log Module (CLM), which consolidates logs for an individual customer/domain
Discover Paired Components on the Same Collector or Supervisor
Discovery of the MLM requires the certificate of the MDS, and discovery of the CLM requires the certificate of the CMA. Make sure that you discover the MDS & MLM pair, and the CMA & CLM pair, on the same Supervisor or Collector. If you attempt to discover them on separate Collectors, discovery will fail.
Component Configuration for Domain-Level Audit Logs
1.
2.
3.
Use the
Client SIC
obtained while configuring MDS to configure MLM.
Component Configuration for Firewall Logs
1.
2.
3.
Use the
Client SIC
obtained while configuring CMA to configure CLM.
.
If you want to pull firewall logs from a domain, you have to configure CLM for that domain.
See these topics for instructions on how to configure each component for Check Point Provider-1 firewalls.
Configuring MDS for Check Point Provider-1 Firewalls
Configuring MLM for Check Point Provider-1 Firewalls
Configuring CMA for Check Point Provider-1 Firewalls
Page 474
FortiSIEM Installation Guide
Configuring CLM for Check Point Provider-1 Firewalls
FortiSIEM Installation Guide
Page 475
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring MDS for Check Point Provider-1 Firewalls
Get the MDS Server SIC for AccelOps Access Credentials
Add AccelOps as a Managed Node
Create an OPSEC Application for AccelOps
Create a Firewall Policy for AccelOps
Copy Secure Internal Communication (SIC) certificates
Settings for Access Credentials
The Check Point Provider-1 firewall Multi-Domain Server (MDS) is where domains are configured and certificates are generated for communicating with AccelOps. if you want to have domain logs from the Multi-Domain Log Module (MLM) sent from your firewall to AccelOps, you must first configure and discover MDS, then use the AO Client SIC created for your AccelOps OPSEC application to configure the access credentials for MLM.
Discover Paired Components on the Same Collector or Supervisor
Discovery of the MLM requires the certificate of the MDS, and discovery of the CLM requires the certificate of the CMA. Make sure that you discover the MDS & MLM pair, and the CMA & CLM pair, on the same Supervisor or Collector. If you attempt to discover them on separate Collectors, discovery will fail.
Configuration
Get the MDS Server SIC
for AccelOps Access Credentials
You will use the MDS Server SIC to create access credentials in AccelOps for communicating with your server.
1.
2.
3.
4.
Log in to your Check Point SmartDomain Manager.
Select
Select
Multi-Domain Server Contents
MDS
In the
General
tab, under
.
, and then right-click to select
Configure Multi-Domain Server...
.
Secure Internet Communication
, note the value for
DN
.
Add AccelOps as a Managed Nod
e
1.
2.
3.
4.
5.
6.
7.
8.
9.
Log in to your Check Point SmartDomain Manager.
In the
.
Select the
Select
Click
Global Policies
tab, select
Enter the
OK
.
Firewall
tab.
Click the
Network Objects
icon.
Multi-Domain Security Management
, and then right-click to select
Launch Global SmartDashboard
Select
Nodes
, and then right-click to select
General Properties
Enter a
Name
for your AccelOps host, like
AccelOpsVA
.
IP Address
.
Node > Host...
.
of your AccelOps virtual appliance.
Create an OPSEC Application for AccelOps
1.
2.
3.
4.
5.
6.
In the
Firewall
tab, click the
Servers and OPSEC
icon.
Select
OPSEC Applications
, and then right-click to select
New > OPSEC Application
.
Click the
General
tab.
Enter a
Name
for your OPSEC application, like
SNMP
.
OPSEC_AccelOpsVA
.
For
Host
, select the AccelOps host.
Under
Client Entities
, select
LEA
and
CPMI
.
7.
8.
9.
10.
For Check Point FireWall-1, also select
Click
Communication
.
Enter a one-time password.
This is the password you will use in setting up access credentials for your firewall in AccelOps.
11.
Click
In the
Initialize
General
.
Close and re-open the application.
tab, next to
Communication
This is the
AccelOps Client SIC DN
credentials for your firewall in AccelOps.
Create a Firewall Policy for AccelOps
, the
DN
field will now contain a value like
CN= OPSEC_AccelOpsVA,0=MDS..i6g4zq
.
that you will need when you copy the secure internal communication certificates and set the access
1.
2.
3.
4.
5.
In Servers and Opsec > OPSEC Applications, select your AccelOps application.
In the
Rules
Right-click
Right-click
Right-click
menu, select
SOURCE
SERVICE
, then click
DESTINATION
Top
.
, then click
Add
, then click
Add
and select your AccelOps virtual appliance.
Add
and select your Check Point firewall.
and select
FW1_lea
, and
CPMI
.
if you are configuring a Check Point FireWall-1 firewall.
6.
7.
Also select
snmp
Right-click
ACTION
and select
Accept
.
Right-click
TRACK
and select
Log
.
8.
Page 476
FortiSIEM Installation Guide FortiSIEM Installation Guide
8.
9.
10.
11.
Go to
Policy > Install
.
Click
OK
.
Go to
OPSEC Applications
and select your AccelOps application.
In the
General
tab of the
Properties
window, make sure that the communications have been enabled between your firewall and
AccelOps.
Copy Secure Internal Communication (SIC) certificatesCopy Client SIC
1.
2.
3.
4.
Go to
Manage > Server and OPSEC Applications
.
Select
OPSEC Application
and then right-click to select
accelops
Click
Edit.
Enter the
Copy Server SIC
SIC DN
of your application.
.
1.
2.
3.
4.
5.
In the
Firewall
tab, go to
Manage
.
Click the
Click
Edit
Enter the
Network Object
.
SIC DN
.
icon, and then right-click to select
Check Point Gateway
.
If there isn't a field to enter the SIC DN, click
Test SIC Status
and a dialog will display the SIC DN.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
Settings for Check Point Provider-1 Firewall SSLCA Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your Check Point Provider-1 Firewall MDS, use these settings. When you complete the access credentials, click Generate Certificate to establish access between your firewall and AccelOps.
Setting
Name
Device Type
Value
MDS
Checkpoint Provider-1 MDS
Access Protocol
MDS IP
CheckPoint SSLCA
The IPS address of your server
Checkpoint LEA Port The port used by LEA on your server
AO Client SIC The DN number of your AccelOps OPSEC application
MDS Server SIC The DN number of your server
Password
CPMI Port
Activation Key
The password associated with the administrative user
The port used by CPMI on your server
The password you used in creating your OPSEC application
1. Generate a certificate for MDS communication in AccelOps a. Configure Checkpoint Provider-1 MDS credential as shown below.
Activation key
AO Client SIC
was the one-time password you input in Step 2f above.
was generated in Step 2g above
MDS Server SIC
was generated in Step 1 above b. Click "Generate Certificate". It should be successful. Note that the button will be labeled 'Regenerate Certificate' if you have already generated the certificate once
Page 477
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring MLM for Check Point Provider-1 Firewalls
Get MLM Server SIC for Setting Up AccelOps Access Credentials
Settings for Access Credentials
Prerequisites
You need to have configured and discovered your Check Point Provider-1 MDS
before you configure the Multi-Domain Log Module
(MLM). You will need the
AO Client SIC
that was generated when you created your AccelOps OPSEC application in the MDS to set up the access credentials for your MLM in AccelOps.
Discover Paired Components on the Same Collector or Supervisor
Discovery of the MLM requires the certificate of the MDS, and discovery of the CLM requires the certificate of the CMA. Make sure that you discover the MDS & MLM pair, and the CMA & CLM pair, on the same Supervisor or Collector. If you attempt to discover them on separate Collectors, discovery will fail.
Configuration
Get MLM Server SIC for Setting Up AccelOps Access Credentials
1.
2.
3.
4.
Log in to your Check Point SmartDomain Manager.
In the
General
tab, click
Multi-Domain Server Contents
.
Right-click
MLM
and select
Configure Multi-Domain Server...
Next to
Communication, note the value for DN.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
Settings for Check Point Provider-1 MLM SSLCA Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your Check Point MLM over SSLCA, use these settings.
Setting
Name
Device Type
Access Protocol
Value
MLM
Checkpoint Provider-1 MLM
CheckPoint SSLCA
MLM IP The IPS address of your module
Checkpoint LEA Port The port used by LEA on your server
AO Client SIC The DN number of your AccelOps OPSEC application
MLM Server SIC
CPMI Port
MDS IP
The DN number of your MLM
The port used by CPMI on your server
The IP address of your MDS server
Page 478
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring CMA for Check Point Provider-1 Firewalls
The Check Point Provider-1 Customer Management Add-On (CMA) creates logs that are then consolidated by the Customer Log Module (CLM).
If you want the CLM to send logs to AccelOps, you need to first configure the CMA and obtain the for communication between the CLM and AccelOps.
AO Client SIC
to configure access credentials
Get CMA Server SIC for Setting Up AccelOps Access Credentials
Add AccelOps as a Managed Node
Create an OPSEC Application for AccelOps
Create a Firewall Policy for AccelOps
Settings for Access Credentials
Discover Paired Components on the Same Collector or Supervisor
Discovery of the MLM requires the certificate of the MDS, and discovery of the CLM requires the certificate of the CMA. Make sure that you discover the MDS & MLM pair, and the CMA & CLM pair, on the same Supervisor or Collector. If you attempt to discover them on separate Collectors, discovery will fail.
Configuration
Get CMA Server SIC
for Setting Up AccelOps Access Credentials
5.
6.
7.
8.
1.
2.
3.
4.
Log in to your Check Point SmartDomain Manager.
Click the
Select
General
Domain Contents
Select the
tab.
Domain Management Server
Select the
Desktop
tab.
Select the
Network Objects
icon.
Double-click on the
Click
.
and right-click to select
Domain Management Server
Test SIC Status... .
Note the value for DN. You will use this for the your CMA server.
to view the
Launch Application > Smart Dashboard
.
General Properties
CMA Server SIC
dialog.
setting when creating the access credentials for AccelOps to access
Add AccelOps as a Managed Nod
e
1.
2.
3.
4.
5.
6.
7.
8.
9.
Log in to your Check Point SmartDomain Manager.
In the
.
Select the
Select
Click
Global Policies
tab, select
Enter the
OK
.
Firewall
tab.
Click the
Network Objects
icon.
Multi-Domain Security Management
, and then right-click to select
Launch Global SmartDashboard
Select
Nodes
, and then right-click to select
General Properties
Enter a
Name
for your AccelOps host, like
AccelOpsVA
.
IP Address
.
Node > Host...
.
of your AccelOps virtual appliance.
Create an OPSEC Application for AccelOps
1.
2.
3.
4.
5.
6.
In the
Firewall
tab, click the
Servers and OPSEC
icon.
Select
OPSEC Applications
, and then right-click to select
New > OPSEC Application
.
Click the
General
tab.
Enter a
Name
for your OPSEC application, like
SNMP
.
OPSEC_AccelOpsVA
.
For
Host
, select the AccelOps host.
Under
Client Entities
, select
LEA
and
CPMI
.
7.
8.
9.
10.
For Check Point FireWall-1, also select
Click
Communication
.
Enter a one-time password.
This is the password you will use in setting up access credentials for your firewall in AccelOps.
11.
Click
In the
Initialize
General
.
Close and re-open the application.
tab, next to
Communication
This is the
AccelOps Client SIC DN
credentials for your firewall in AccelOps.
Create a Firewall Policy for AccelOps
, the
DN
field will now contain a value like
CN= OPSEC_AccelOpsVA,0=MDS..i6g4zq
.
that you will need when you copy the secure internal communication certificates and set the access
1.
2.
3.
4.
5.
In Servers and Opsec > OPSEC Applications, select your AccelOps application.
In the
Rules
menu, select
Right-click
Right-click
Right-click
SOURCE
Top
.
, then click
DESTINATION
SERVICE
Add
, then click
, then click
Add
and select your AccelOps virtual appliance.
Add
and select your Check Point firewall.
and select
FW1_lea
, and
CPMI
.
Page 479
FortiSIEM Installation Guide FortiSIEM Installation Guide
5.
6.
7.
8.
9.
10.
11.
Also select
snmp
if you are configuring a Check Point FireWall-1 firewall.
Right-click
Right-click
TRACK
and select
Go to
Click
Go to
In the
Policy > Install
OK
.
AccelOps.
ACTION
and select
.
OPSEC Applications
General
tab of the
Accept
.
Log
.
and select your AccelOps application.
Properties
window, make sure that the communications have been enabled between your firewall and
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
Settings for Check Point Provider-1 Firewall CLA SSLCA Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your Check Point Provider-1 Firewall CMA, use these settings. When you complete the access credentials, click
Generate Certificate
to establish access between your firewall and
AccelOps.
Setting
Name
Device Type
Access Protocol
CMA IP
Value
CMA
Checkpoint Provider-1 CMA
CheckPoint SSLCA
The IPS address of your server
Checkpoint LEA Port The port used by LEA on your server
AO Client SIC The DN number of your AccelOps OPSEC application
CMA Server SIC
CPMI Port
Activation Key
The DN number of your server
The port used by CPMI on your server
The password you used in creating your OPSEC application
Page 480
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring CLM for Check Point Provider-1 Firewalls
Get CLM Server SIC for Creating AccelOps Access Credentials
Settings for Access Credentials
Prequisites
You must first configure and discover the Check Point CLA and obtain the
AO Client SIC
before you can configure the Customer Log
Module (CLM). The AO Client SIC is generated when you create the AccelOps OPSEC application.
Discover Paired Components on the Same Collector or Supervisor
Discovery of the MLM requires the certificate of the MDS, and discovery of the CLM requires the certificate of the CMA. Make sure that you discover the MDS & MLM pair, and the CMA & CLM pair, on the same Supervisor or Collector. If you attempt to discover them on separate Collectors, discovery will fail.
Configuration
Get CLM Server SIC for Creating AccelOps Access Credentials
5.
6.
7.
8.
1.
2.
3.
4.
Log in to your Check Point SmartDomain Manager.
Click the
General
tab.
Select
Domain Contents
.
Select the
Domain Management Server
and right-click to select
Launch Application > Smart Dashboard
.
Select the
Desktop
tab.
Click the
Network Objects
icon.
Under
Check Point
, select the CLM host and double-click to open the
9.
Under Secure Internal Communication, click
Click
Close
.
Click
OK
.
General Properties
dialog.
10.
11.
In the
SIC Status
dialog, note the value for
Test SIC Status...
.
DN
.
This is the CLM Server SIC that you will use in setting up access credentials for the CLM in AccelOps.
Install the Database
1.
2.
In the
Actions
menu, select
Policy > Install Database...
Select the MDS Server and the CLM, and then
The database will install in both locations.
OK
.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
Settings for Check Point Provider-1 Firewall CLM SSLCA Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your Check Point Provider-1 Firewall CMA, use these settings. When you complete the access credentials, click
Generate Certificate
to establish access between your firewall and
AccelOps.
Setting
Name
Device Type
Value
CLM
Checkpoint Provider-1 CLM
Access Protocol
CLM IP
CheckPoint SSLCA
The IP address of the host where your CLM is located
Checkpoint LEA Port The port used by LEA on your server
AO Client SIC The DN number of your AccelOps OPSEC application
CLM Server SIC
CPMI Port
The DN number of your server
The port used by CPMI on your server
Page 481
FortiSIEM Installation Guide
1.
CMA IP The IP address of the host where your CMA is located
FortiSIEM Installation Guide
Page 482
FortiSIEM Installation Guide FortiSIEM Installation Guide
Check Point VSX Firewall Configuration
What is Discovered and Monitored
Add AccelOps as a Managed Node
Create an OPSEC Application for AccelOps
Create a Firewall Policy for AccelOps
Copy Secure Internal Communication (SIC) certificates
Settings for Access Credentials
What is Discovered and Monitored
AccelOps uses SNMP, LEA to discover the device and to collect logs, configurations and performance metrics.
Protocol Information Discovered
SNMP Host name, Firewall model and version, Network interfaces
LEA
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Firewall connection count
All traffic and system logs
Used for
Availability and
Performance
Monitoring
Security and
Compliance
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
LEA
Add AccelOps as a Managed Node
1.
2.
3.
4.
5.
6.
Log in to your Check Point SmartDomain Manager.
In the
Global Policies
tab, select
.
Select the
Multi-Domain Security Management
, and then right-click to select
Launch Global SmartDashboard
7.
8.
9.
Click the
Select
Select
Enter a
Name
for your AccelOps host, like
AccelOpsVA
.
Enter the
Click
Nodes
General Properties
OK
.
Firewall
tab.
Network Objects
.
icon.
, and then right-click to select
Node > Host...
IP Address
of your AccelOps virtual appliance.
.
Create an OPSEC Application for AccelOps
1.
2.
In the
Firewall
tab, click the
Servers and OPSEC
icon.
Select
OPSEC Applications
, and then right-click to select
New > OPSEC Application
.
3.
Page 483
FortiSIEM Installation Guide FortiSIEM Installation Guide
3.
4.
5.
6.
Click the
General
tab.
Enter a
Name
for your OPSEC application, like
For
Host
, select the AccelOps host.
Under
Client Entities
, select
LEA
and
CPMI
.
SNMP
.
OPSEC_AccelOpsVA
.
7.
8.
9.
10.
11.
For Check Point FireWall-1, also select
Click
Enter a one-time password.
This is the password you will use in setting up access credentials for your firewall in AccelOps.
Click
Close and re-open the application.
In the
Communication
.
Initialize
General
.
tab, next to
Communication
This is the
AccelOps Client SIC DN
credentials for your firewall in AccelOps.
, the
DN
field will now contain a value like
CN= OPSEC_AccelOpsVA,0=MDS..i6g4zq
.
that you will need when you copy the secure internal communication certificates and set the access
Create a Firewall Policy for AccelOps
1.
2.
3.
4.
5.
In Servers and Opsec > OPSEC Applications, select your AccelOps application.
In the
Rules
Right-click
Right-click
Right-click
menu, select
SOURCE
SERVICE
, then click
DESTINATION
Top
.
, then click
Add
, then click
Add
and select your AccelOps virtual appliance.
Add
and select your Check Point firewall.
and select
FW1_lea
, and
CPMI
.
if you are configuring a Check Point FireWall-1 firewall.
6.
7.
8.
9.
10.
11.
Also select
snmp
Right-click
Right-click
TRACK
and select
Go to
Click
Go to
In the
Policy > Install
OK
.
AccelOps.
ACTION
and select
.
OPSEC Applications
General
tab of the
Accept
.
Log
.
and select your AccelOps application.
Properties
window, make sure that the communications have been enabled between your firewall and
Copy Secure Internal Communication (SIC) certificates
Copy Client SIC
1.
2.
3.
4.
Go to
Manage > Server and OPSEC Applications
.
Select
OPSEC Application
and then right-click to select
accelops
Click
Edit.
Enter the
Copy Server SIC
SIC DN
of your application.
.
1.
2.
3.
4.
5.
In the
Firewall
tab, go to
Manage
.
Click the
Click
Edit
Enter the
Network Object
.
SIC DN
.
icon, and then right-click to select
Check Point Gateway
.
If there isn't a field to enter the SIC DN, click
Test SIC Status
and a dialog will display the SIC DN.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 484
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Adaptive Security Appliance (ASA) Configuration
What is Discovered and Monitored
Commands Used During Telnet/SSH Communication
Set Up AccelOps as a NetFlow Receiver
Create a NetFlow Service Policy
Configure the Template Refresh Rate
Settings for Access Credentials
What is Discovered and Monitored
Protocol
SNMP (V1,
V2c, V3)
Information Discovered
Host name, Hardware model, Network interfaces,
Hardware component details: serial number, model, manufacturer, software and firmware versions of components such as fan, power supply, network cards etc., Operating system version, SSM modules such as IPS
Metrics collected
Uptime, CPU and Memory utilization, Free processor and I/O memory,
Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Firewall connection count
SNMP (V1,
V2c, V3)
SNMP (V1,
V2c, V3)
Hardware health: temperature, fan and power supply status
OSPF connectivity, neighbors, state, OSPF Area OSPF state change
SNMP (V1,
V2c, V3)
Used for
Availability and
Performance
Monitoring
IPSec VPN Phase 1 tunnel metrics: local and remote Vpn Ip addresses, Tunnel status, Tunnel Uptime, Received/Sent BitsPerSec,
Received/Sent Packets, Received/Sent BitsPerSec, Received/Sent
Dropped Packets, Received/Sent Rejected Exchanges, Received/Sent
Invalid Exchanges Invalid Received Pkt Dropped, Received Exchanges
Rejected, Received Exchanges Invalid
Routing
Topology,
Availability
Monitoring
Performance
Monitoring
Telnet/SSH Running and startup configuration, Interface security levels, Routing tables, Image file name,
Flash memory size
IPSec VPN Phase 2 tunnel metrics:
local and remote Vpn Ip addresses, Tunnel status, Tunnel Uptime, Received/Sent BitsPerSec,
Received/Sent Packets, Received/Sent BitsPerSec, Received/Sent
Dropped Packets, Received/Sent Auth Failed, Sent Encrypted Failed,
Received Decrupt failed, Received Replay Failed
Startup configuration change, delta between running and startup configuration
Telnet/SSH
Performance
Monitoring,
Security and
Compliance
Open server ports
Virtual context for multi-context firewalls, ASA interface security levels needed for setting source and destination IP address in syslog based on interface security level comparisons, ASA name mappings from IP addresses to locally unique names needed for converting names in syslog to IP addresses
Traffic logs (for ASA 8.x and above) Netflow
(V9)
Syslog Device type All traffic and system logs
Security and
Compliance
Security and
Compliance
Event Types
Page 485
FortiSIEM Installation Guide FortiSIEM Installation Guide
Instructions - Remove before Publishing
Provide the prefix or keyword to use in searching for events for this application or device in the CMDB. If there are no specific event types for this device, insert this text: There are no event types defined specifically for this device.
In
CMDB > Event Types
, search for "asa" in the
Device Type
column to see the event types associated with this device.
Rules
In
Analytics > Rules
, search for "asa" in the
Description
column to see the rules associated with this device.
Reports
In
Analytics > Reports
, search for "asa" in the
Description
column to see the reports associated with this device.
Configuration
Don't Configure SNMP Trap
Don't configure ASA to send logs via SNMP trap, AccelOps doesn't parse them.
Check Security Levels
Make sure interface security levels are appropriately set in AccelOps. In your AccelOps Supervisor, go to
CMDB > Device > Network >
Firewall
and select your firewall. Click the interfaces are in between. This information can either be discovered via SSH or entered manually after SNMP discovery. Without correct security level information, ASA traffic built and teardown logs can not be parsed correctly (they may not have correct source and destination addresses and ports).
Interface
tab, and make sure that the inside secutity level is 100, outside is 0 and other
SNMP
1. Log in to your ASA with administrative privileges.
Configure SNMP with this command.
snmp-server host <ASA Interface name> <AccelOps IP> poll community
<community string>
Syslog
1.
2.
3.
Log in to your ASA with administrative privileges.
Enter configuration mode (config terminal).
Enter the following commands: no names logging enable logging timestamp logging monitor errors logging buffered errors logging trap debugging logging debug-trace logging history errors logging asdm errors logging mail emergencies logging facility 16 logging host <ASA interface name> <AccelOps IP>
Sample Cisco ASA Syslog
Page 486
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Nov 28 2007 17:20:48: %ASA-6-302013: Built outbound TCP connection
76118 for outside:207.68.178.45/80 (207.68.178.45/80) to inside:192.168.20.31/3530 (99.129.50.157/5967)
SSH
1.
2.
Log in to your ASA with administrative privileges.
Configure SSH with this command.
ssh <AccelOps IP> <AccelOps IP netmask> <ASA interface name>
Telnet
1.
2.
Log in to your ASA with administrative privileges.
Configure telnet with this command.
telnet <AccelOps IP> <AccelOps IP netmask> <ASA interface name>
Commands Used During Telnet/SSH Communication
The following commands are used for discovery and performance monitoring via SSH. Make sure that the accounts associated with the ASA access credentials you set up in AccelOps have permission to execute these commands.
Critical Commands
It is critical to have no names
and logging timestamp
commands in the configuration, or logs will not be parsed correctly.
1.
2. show startup-config show running-config
3.
4. show version show flash
5.
6. show context show ip route
7.
8. enable
9. terminal pager 0 terminal length 0
NetFlow
NetFlow is an optimized protocol for collecting high volume traffic logs. You should configure NetFlow with ASM, the ASA device manager.
Set Up AccelOps as a NetFlow Receiver
5.
6.
7.
8.
1.
2.
3.
4.
Login to ASDM.
Go to
Configuration > Device Management > Logging > Netflow.
Under Collectors, click
Add.
For
Interface
, select the ASA interface over which NetFlow will be sent to AccelOps.
For
IP Address or Host Name
, enter the IP address or host name for your AccelOps virtual appliance that will receive the NetFlow logs.
For
UDP Port
, enter
2055
.
Click
OK
.
Select
Disable redundant syslog messages
.
9.
This prevents the netflow equivalent events from being also sent via syslog.
Click
Apply
.
Create a NetFlow Service Policy
1.
Page 487
FortiSIEM Installation Guide FortiSIEM Installation Guide
1.
2.
Go to
Configuration > Firewall > Service Policy Rules
.
Click
The
Add
.
Service Policy Wizard
will launch.
3.
4.
5.
6.
7.
8.
Select
For
For
For
Global - apply to all interfaces
Traffic Match Criteria
Source
Click OK.
and
Flow Event Type
For
Collectors
, select
Destination
, select
All
, and then click
Next
.
Source and Destination IP Address
, and then click
Any
, and then click
Next
.
, select the AccelOps virtual appliance IP address.
Next
.
Configure the Template Refresh Rate
This is an optional step. The template refresh rate is the number of minutes between sending a template record to AccelOps. The default is 30 minutes, and in most cases this is sufficient. Since flow templates are dynamic, AccelOps cannot process a flow until it knows the details of the corresponding template. This command may not always be needed, but if flows are not showing up in AccelOps, even if tcpdump indicates that
they are, this is worth trying. flow-export template timeout-rate 1
You can find out more about configuring NetFlow in the Cisco support forum .
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Telnet Access Credentials for All Devices
These are the generic settings for providing Telnet access to your device from AccelOps
Setting
Name
Device Type
Value
Telnet-generic
<select device type from drop down>
Access Protocol Telnet
Port 23
User Name
Password
A user who has permission to access the device over Telnet
The password associated with the user
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting Value
Page 488
FortiSIEM Installation Guide
Name
Device Type ssh-generic
<select device type from drop down>
Access Protocol SSH
Port 22
User Name
Password
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 489
FortiSIEM Installation Guide FortiSIEM Installation Guide
Dell SonicWALL Firewall Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Hardware model, Network interfaces, Operating system version
Syslog Device type
Metrics collected
CPU Utilization, Memory utilization and Firewall
Session Count
All traffic and system logs
Used for
Availability and Performance
Monitoring
Availability, Security and
Compliance
Event Types
In
CMDB > Event Types
, search for "sonicwall" in the
Device Type
column to see the event types associated with Dell SonicWALL firewalls.
Rules
There are no predefined rules for Dell SonicWALL firewalls.
Reports
There are no predefined reports for Dell SonicWALL firewalls.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Dell SonicWALL Firewall Administrator's Guide (PDF)
Syslog
4.
Under
Syslog Servers
, click
The Syslog Settings wizard will open.
Enter the
IP Address
Add
.
5.
6.
7.
8.
1.
2.
Log in to your SonicWALL appliance.
Go to
Log > Syslog
.
3.
Keep the default settings.
of your AccelOps Supervisor or Collector.
Keep the default
Port
setting of .
Click
OK
.
Go to
Firewall > Access Rules
.
514
Select the rule that you want to use for logging, and then click
Edit
.
In the
General
tab, select
Enable Logging
, and then click
OK
.
Repeat for each rule that you want to enable for sending syslogs to AccelOps.
Your Dell SonicWALL firewall should now send syslogs to AccelOps.
Example Syslog
Page 490
FortiSIEM Installation Guide FortiSIEM Installation Guide
Jan 3 13:45:36 192.168.5.1 id=firewall sn=000SERIAL time="2007-01-03
14:48:06" fw=1.1.1.1 pri=6 c=262144 m=98 msg="Connection Opened" n=23419 src=2.2.2.2:36701:WAN dst=1.1.1.1:50000:WAN proto=tcp/50000
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 491
FortiSIEM Installation Guide FortiSIEM Installation Guide
Fortinet FortiGate Firewall Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol
SNMP
Information Discovered
Host name, Hardware model,
Network interfaces, Operating system version
Telnet/SSH Running configuration
Syslog Device type
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Configuration Change
All traffic and system logs
Used for
Availability and
Performance
Monitoring
Performance
Monitoring, Security and Compliance
Availability, Security and Compliance
Event Types
In
CMDB > Event Types
, search for "fortigate" in the
Name
and
Description
columns to see the event types associated with this device.
Rules
In
Analytics > Rules
, search for "fortigate" in the
Name
column to see the rules associated with this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP and SSH
1.
2.
3.
4.
5.
6.
7.
Log in to your firewall as an administrator.
Go to
System > Network
.
Select the FortiGate interface IP that AccelOps will use to communicate with your device, and then click
Edit
.
For
Administrative Access
, makes sure that
Click
Go to
OK
System > Config > SNMP v1/v2c
Click
Create New
.
SSH
and
to enable the public
community.
SNMP
are selected.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
These commands are used for discovery and performance monitoring via SSH. Please make sure that the access credentials you provide in
AccelOps have the permissions necessary to execute these commands on the device.
1. show firewall address
2. show full-configuration
Syslog
Sending Logs Over VPN
If you are sending these logs across a VPN, Fortigate will try to use the WAN interface for the source
of all system traffic. You can change this by setting the source-ip
option to the IP used on the Fortigates Internal/LAN interface.
With the Web GUI
1.
Page 492
FortiSIEM Installation Guide FortiSIEM Installation Guide
1.
2.
3.
4.
Log in to your firewall as an administrator.
Go to
Log &Report > Log Config > syslog
.
Enter the , , and
Minimum Log Level and Facility
Make sure that
With the CLI
CSV format
is not selected.
for your AccelOps virtual appliance.
note th
1.
2.
Connect to the Fortigate firewall over SSH and log in.
To configure your firewall to send syslog over UDP, enter this command, replacing the IP address
192.168.53.2
with the IP address of your AccelOps virtual appliance.
config log syslogd setting
set status enable
set server "192.168.53.2"
set facility user
set port 514 end
3. Verify the settings.
frontend # show log syslogd setting config log syslogd setting
set status enable
set server "192.168.53.2"
set facility user end
Example FortiGate Syslog
<185>date=2010-04-11 time=20:31:25 devname=APS3012404200944 device_id=APS3012404200944 log_id=0104032002 type=event subtype=admin pri=alert vd=root user="root" ui=ssh(10.1.20.21) action=login status=failed reason="name_invalid" msg="Administrator root login failed from ssh(10.1.20.21) because of invalid user name"
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Page 493
FortiSIEM Installation Guide
Access Protocol SNMP
Community String <your own>
Telnet Access Credentials for All Devices
These are the generic settings for providing Telnet access to your device from AccelOps
Setting
Name
Device Type
Value
Telnet-generic
<select device type from drop down>
Access Protocol Telnet
Port 23
User Name
Password
A user who has permission to access the device over Telnet
The password associated with the user
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Device Type
Value
ssh-generic
<select device type from drop down>
Access Protocol SSH
Port 22
User Name
Password
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 494
FortiSIEM Installation Guide FortiSIEM Installation Guide
Juniper Networks SSG Firewall Configuration
What is Discovered and Monitored
Create SNMP Community String and Management Station IP
Modify Policies so Traffic Matching a Policy is Sent via Syslog to AccelOps
Set AccelOps as a Destination Syslog Server
Set the Severity of Syslogs to Send to AccelOps
Sample Parsed FortiGate Syslog
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Hardware model,
Network interfaces, Operating system version
Telnet/SSH Running configuration
Syslog Device type
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths),
Firewall connection count
Configuration Change
Traffic log, Admin login activity logs, Interface up/down logs
Used for
Availability and
Performance
Monitoring
Performance
Monitoring, Security and Compliance
Availability, Security and Compliance
Event Types
In
CMDB > Event Types
, search for "SSG" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP and SSH
Enable SNMP, SSH, and Ping
1.
2.
3.
4.
Log in to your firewall's device manager as an administrator.
Go to
Network > Interfaces > List
.
5.
Select the interface and click
Under
Service Options
, for
Edit
For
Other Services
, select
Ping
.
.
Management Services
, select
SNMP
and
SSH
.
Create SNMP Community String and Management Station IP
1.
2.
3.
4.
Go to
Configuration > Report Settings > SNMP
.
If the public
community is not available, create it and provide it with read-only access.
Enter the
Host IP
address and
Netmask
of your AccelOps virtual appliance.
5.
Select the Source Interface that your firewall will use to communicate with AccelOps.
Click
OK
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Syslog
Modify Policies so Traffic Matching a Policy is Sent via Syslog to AccelOps
1.
Page 495
FortiSIEM Installation Guide
1.
2.
3.
4.
Go to
Policies
.
Select a policy and click
Options
.
Select
Click
Logging
OK
.
.
Set AccelOps as a Destination Syslog Server
5.
6.
7.
8.
1.
2.
3.
4.
9.
10.
Go to
Select
Select
Configuration > Report Settings > Syslog
Enable syslog messages
Select the
Under
For
Facility
Source Interface
Syslog servers
For
Port
, enter
For
Select
Enable
.
Click Apply.
514
.
Security Facility
Event Log
and
, enter the
, select
.
.
that your firewall will use to communicate with AccelOps.
, select
LOCALD
.
IP/Hostname
LOCALD
.
Traffic Log
.
of your AccelOps virtual appliance.
Set the Severity of Syslogs to Send to AccelOps
1.
2.
3.
4.
Go to
Configuration > Report Setting > Log Settings
.
Click
Select the
Click
Syslog
Apply
.
.
Severity Levels
of the syslogs you want sent to AccelOps.
Sample Parsed FortiGate Syslog
FortiSIEM Installation Guide
<129>Aug 26 11:09:45 213.181.33.233 20090826, 6219282, 2009/08/26
09:09:40, 2009/08/26 08:09:49, global.CoX, 1363,
CoX-eveTd-fw1, 213.181.41.226, traffic, traffic log, untrust, (NULL),
81.243.104.82, 64618, 81.243.104.82,
64618, dmz, (NULL), 213.181.36.162, 443, 213.181.36.162, 443, tcp, global.CoX, 1363, Workaniser_cleanup, fw/vpn, 34, accepted, info, no, (NULL), (NULL), (NULL), (NULL), 3, 858, 1323, 2181,
0, 0, 14, 1, no, 0, Not
<129>Aug 26 11:09:45 213.181.33.233 20090826, 6219282, 2009/08/26
09:09:40, 2009/08/26 08:09:49, global.CoX, 1363,
CoX-eveTd-fw1, Category, Sub-Category, untrust, (NULL), 81.243.104.82,
64618, 81.243.104.82, 64618, dmz,
(NULL), 213.181.36.162, 443, 213.181.36.162, 443, tcp, global.Randstad,
1363, Workaniser_cleanup, fw/vpn, 34, accepted, info, no, (NULL), (NULL), (NULL), (NULL), 3, 858, 1323, 2181, 0, 0, 14,
1, no, 0, Not
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Page 496
FortiSIEM Installation Guide
Community String <your own>
Telnet Access Credentials for All Devices
These are the generic settings for providing Telnet access to your device from AccelOps
Setting
Name
Device Type
Value
Telnet-generic
<select device type from drop down>
Access Protocol Telnet
Port
User Name
Password
23
A user who has permission to access the device over Telnet
The password associated with the user
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Value
ssh-generic
Device Type <select device type from drop down>
Access Protocol SSH
Port
User Name
Password
22
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 497
FortiSIEM Installation Guide FortiSIEM Installation Guide
McAfee Firewall Enterprise (Sidewinder) Configuration
What is Discovered and Monitored
Sample Parsed Sidewinder Syslog
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog
Event Types
In
CMDB > Event Types
, search for "sidewinder" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Sample Parsed Sidewinder Syslog
Jun 18 10:34:08 192.168.2.10 wcrfw1 auditd: date="2011-06-18 14:34:08
+0000",fac=f_http_proxy,area=a_libproxycommon, type=t_nettraffic,pri=p_major,pid=2093,logid=0,cmd=httpp,hostname=wcrfw1
.community.int,event="session end",app_risk=low, app_categories=infrastructure,netsessid=1adc04dfcb760,src_geo=US,srcip=7
4.70.205.191,srcport=3393,srczone=external,protocol=6, dstip=10.1.1.27,dstport=80,dstzone=dmz1,bytes_written_to_client=572,byte s_written_to_server=408,rule_name=BTC-inbound, cache_hit=1,start_time="2011-06-18 14:34:08 +0000",application=HTTP
Page 498
FortiSIEM Installation Guide FortiSIEM Installation Guide
Palo Alto Firewall Configuration
What is Discovered and Monitored
Set AccelOps as a Syslog Destination
Set the Severity of Logs to Send to AccelOps
Create a Log Forwarding Profile
Use the Log Forwarding Profile in Firewall Policie
Sample Parsed Palo Alto Syslog Mesage
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Hardware model,
Network interfaces, Operating system version
Telnet/SSH Running configuration
Syslog Device type
Metrics collected
Uptime, CPU utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Firewall connection count
Configuration Change
Traffic log, Threat log (URL, Virus, Spyware, Vulnerability, File, Scan, Flood and data subtypes), config and system logs
Used for
Availability and
Performance
Monitoring
Performance
Monitoring, Security and Compliance
Availability, Security and Compliance
Event Types
In
CMDB > Event Types
, search for "palo alto" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "palo alto" in the Description column to see the reports associated with this device.
Configuration
SNMP, SSH, and Ping
5.
6.
7.
8.
1.
2.
3.
4.
Log in to the management console for your firewall with administrator privileges.
In the Device tab, clickSetup.
Click
Edit
.
, and
SNMP
are selected.
Under
MGMT Interface Services
, make sure
For
SNMP Community String
, enter public
.
If there are entries in the
Permitted IP
list,
Add
the IP address of your AccelOps virtual appliance.
Click
OK
.
Go to
Setup > Management
and check that SNMP is enabled on the management interface
Syslog
Set AccelOps as a Syslog Destination
1.
2.
3.
4.
5.
6.
7.
8.
Log in to the management console for your firewall with administrator privileges.
In the
Device
Click
New
.
tab, go to
Log Destinations > Syslog
Enter a
Name
for your AccelOps virtual appliance.
For
For
For
Server
Port
Facility
Click OK.
, enter the IP address of your virtual appliance.
, enter
514
.
, select
LOG_USER
.
.
Page 499
FortiSIEM Installation Guide FortiSIEM Installation Guide
Set the Severity of Logs to Send to AccelOps
1.
2.
3.
4.
In the
Device
tab, go to
Log Settings > System
.
Click
Edit...
.
For each type of log you want sent to AccelOps, select the AccelOps virtual appliance in the
Syslog
menu.
Click
OK
.
Create a Log Forwarding Profile
1.
2.
In the
Objects
tab, go to
Log Forwarding > System
.
Create a new log forwarding profile by entering a
Name
for the profile, and then setting
Syslog
3. appliance for each type of log you want send to AccelOps.
Click
OK
.
to the IP address of your AccelOps virtual
Use the Log Forwarding Profile in Firewall Policie
1.
2.
3.
4.
5.
In the
Policies
tab, go to
Security > System
.
For each security rule that you want to send logs to AccelOps, click
Options
.
For
Log Forwarding Profile
, select the profile you created for AccelOps.
Click
OK
.
Commit changes
Logging Permitted Web Traffic
By default, Palo Alto firewalls only log web traffic that is blocked by URL filtering policies. If you need to log permitted web traffic, follow these steps.
1.
2.
In the
Objects
tab, go to
Security Profiles > URL Filtering
.
to create a new one.
3.
Edit an existing profile by clicking on its name, or click
Add
.
4.
5.
For website categories that you want to log, select
Alert
Traffic matching these website category definitions will be logged.
Click
OK
.
For each security rule that you want to send logs to AccelOps, edit the rule and add the new url filter.
Sample Parsed Palo Alto Syslog Mesage
<14>May 6 15:51:04 1,2010/05/06
15:51:04,0006C101167,TRAFFIC,start,1,2010/05/06
15:50:58,192.168.28.21,172.16.255.78,::172.16.255.78,172.16.255.78,rule3
,,,icmp,vsys1,untrust,untrust,ethernet1/1,ethernet1/1,syslog-172.16.20.1
52,2010/05/06
15:51:04,600,2,0,0,0,0,0x40,icmp,allow,196,196,196,2,2010/05/06
15:50:58,0,any,0
<14>May 6 15:51:15 1,2010/05/06
15:51:15,0006C101167,SYSTEM,general,0,2010/05/06
15:51:15,,unknown,,0,0,general,informational,User admin logged in via
CLI from 192.168.28.21
<14>May 9 17:55:21 1,2010/05/09
17:55:21,0006C101167,THREAT,url,6,2010/05/09
17:55:20,172.16.2.2,216.163.137.68,::172.16.255.78,216.163.137.68,Dynami cDefault,,,web-browsing,vsys1,trust,untrust,ethernet1/2,ethernet1/1,sysl og-172.16.20.152,2010/05/09
17:55:21,976,1,1126,80,38931,80,0x40,tcp,block-url,"www.playboy.com/favi con.ico",(9999),adult-and-pornography,informational,0
Settings for Access Credentials
Page 500
FortiSIEM Installation Guide FortiSIEM Installation Guide
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Telnet Access Credentials for All Devices
These are the generic settings for providing Telnet access to your device from AccelOps
Setting
Name
Device Type
Value
Telnet-generic
<select device type from drop down>
Access Protocol Telnet
Port 23
User Name
Password
A user who has permission to access the device over Telnet
The password associated with the user
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Value
ssh-generic
Device Type <select device type from drop down>
Access Protocol SSH
Port
User Name
Password
22
A user who has access credentials for your device over SSH
The password for the user
Page 501
FortiSIEM Installation Guide FortiSIEM Installation Guide
WatchGuard Firebox Firewall Configuration
What is Discovered and Monitored
Sample Parsed Firebox Syslog Message
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog
Event Types
In
CMDB > Event Types
, search for "firebox" in the
Device Type
and
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Sample Parsed Firebox Syslog Message
Spaces in Interface Names
If the interface name has space, for example
VLAN 0-External
instead of
VLAN0-External
, then the string may not be parsed correctly. This is because the log message does not clearly mark the beginning and end of a field. A clearly specified log format would have specified
"srcIntf = "VLAN 0-External""
with a well specified list of keywords such as , r, etc.
<140>Oct 10 17:20:57 Datasphere (2012-10-10T22:20:57) firewall: Deny
1-Digital VLAN0-External 52 tcp 20 63 10.0.254.20
1.1.1.1 34905 22 offset 8 S 3895962691 win 2105 (Everything - Deny-00)
Page 502
FortiSIEM Installation Guide
Configuring Load Balancers and Application Firewalls
AccelOps supports these load balancers and application firewalls for discovery and monitoring.
Brocade ServerIron ADX Configuration
Citrix Netscaler Application Delivery Controller (ADC) Configuration
F5 Networks Application Security Manager
F5 Networks Local Traffic Manager Configuration
Qualys Web Application Firewall
FortiSIEM Installation Guide
Page 503
FortiSIEM Installation Guide FortiSIEM Installation Guide
Brocade ServerIron ADX Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information discovered
SNMP Host name, serial number, hardware (CPU, memory, network interface etc)
Metrics/Logs collected
Uptime, CPU, Memory, Interface Utilization, Hardware status,
Real Server Statistics
Used for
Performance/Availability
Monitoring
Event Types
PH_DEV_MON_SYS_CPU_UTIL
[PH_DEV_MON_SYS_CPU_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=devic eBrocadeServerIron.cpp,[lineNumber]=434,[cpuName]=CPU,[hostName]=lb
1-1008-qts,[hostIpAddr]=10.120.3.15,[cpuUtil]=55.000000,[pollIntv]=
176,[phLogDetail]=
PH_DEV_MON_SYS_MEM_UTIL
[PH_DEV_MON_SYS_MEM_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=devic eBrocadeServerIron.cpp,[lineNumber]=456,[memName]=Physical
Memory,[hostName]=lb1-1008-qts,[hostIpAddr]=10.120.3.15,[memUtil]=1
0.000000,[pollIntv]=176,[phLogDetail]=
PH_DEV_MON_NET_INTF_UTIL
[PH_DEV_MON_NET_INTF_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phIn tfFilter.cpp,[lineNumber]=323,[intfName]=GigabitEthernet8,[intfAlia s]=,[hostName]=lb1-1008-qts,[hostIpAddr]=10.120.3.15,[pollIntv]=56,
[recvBytes64]=1000000,[recvBitsPerSec]=142857.142857,[inIntfUtil]=0
.014286,[sentBytes64]=2000000,[sentBitsPerSec]=285714.285714,[outIn tfUtil]=0.028571,[recvPkts64]=0,[sentPkts64]=0,[inIntfPktErr]=0,[in
IntfPktErrPct]=0.000000,[outIntfPktErr]=0,[outIntfPktErrPct]=0.0000
00,[inIntfPktDiscarded]=0,[inIntfPktDiscardedPct]=0.000000,[outIntf
PktDiscarded]=0,[outIntfPktDiscardedPct]=0.000000,[outQLen64]=0,[in tfInSpeed64]=1000000000,[intfOutSpeed64]=1000000000,[intfAdminStatu s]=up,[intfOperStatus]=up,[daysSinceLastUse]=0,[totIntfPktErr]=0,[t otBitsPerSec]=428571.428571,[phLogDetail]=
PH_DEV_MON_SERVERIRON_REAL_SERVER_STAT
Page 504
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_SERVERIRON_REAL_SERVER_STAT]:[eventSeverity]=PHL_INFO,
[fileName]=deviceBrocadeServerIron.cpp,[lineNumber]=507,[hostName]= lb1-1008-qts,[hostIpAddr]=10.120.3.15,[realServerIpAddr]=10.120.10.
131,[realServerState]=7,[failedPortExists]=2,[openConnectionsCount]
=2,[peakConns]=114,[activeSessions]=4,[phLogDetail]=
PH_DEV_MON_HW_STATUS
[PH_DEV_MON_HW_STATUS]:[eventSeverity]=PHL_INFO,[fileName]=deviceBr ocadeServerIron.cpp,[lineNumber]=359,[hostName]=lb1-1008-qts,[hostI pAddr]=10.120.3.15,[hwStatusCode]=2,[hwPowerSupplyStatus]=0,[hwTemp
SensorStatus]=2,[hwFanStatus]=0,[phLogDetail]=
[PH_DEV_MON_HW_STATUS_TEMP_CRIT]:[eventSeverity]=PHL_CRITICAL,[file
Name]=device.cpp,[lineNumber]=13812,[hostName]=lb1-1008-qts,[hostIp
Addr]=10.120.3.15,[hwStatusCode]=2,[hwComponentName]=1-Temperature sensor,[hwComponentStatus]=Critical,[phLogDetail]=
PH_DEV_MON_HW_TEMP
[PH_DEV_MON_HW_TEMP]:[eventSeverity]=PHL_INFO,[fileName]=deviceBro cadeServerIron.cpp,[lineNumber]=401,[hostName]=lb1-1008-qts,[hostIp
Addr]=10.120.3.15,[hwComponentName]=Temp1,[envTempDegF]=90,[phLogDe tail]=
Rules
There are no predefined rules for this device other than covered by generic network devices.
Reports
There are no predefined reports for this device other than covered by generic network devices.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Page 505
FortiSIEM Installation Guide FortiSIEM Installation Guide
Citrix Netscaler Application Delivery Controller (ADC) Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information discovered Metrics/Logs collected
Syslog
Used for
Permitted and Denied traffic Log analysis and compliance
Event Types
Instructions - Remove before Publishing
Provide the prefix or keyword to use in searching for events for this application or device in the CMDB. If there are no specific event types for this device, insert this text: There are no event types defined specifically for this device.
In
CMDB > Event Types
, search for "netscaler" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "nestler" in the Name column to see the reports associated with this device.
Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Example Syslog
<182> 07/25/2012:19:56:41 PPE-0 : UI CMD_EXECUTED 473128 : User nsroot - Remote_ip 10.13.8.75 - Command "show ns hostName" - Status
"Success"
<181> 07/25/2012:19:56:05 NS2-MAIL PPE-0 : EVENT DEVICEUP 33376 :
Device "server_vip_NSSVC_SSL_172.17.102.108:443(accellion:443)" - State
UP
<181> 07/25/2012:19:55:35 NS2-MAIL PPE-0 : EVENT DEVICEDOWN 33374 :
Device "server_vip_NSSVC_SSL_172.17.102.108:443(accellion:443)" - State
DOWN
<182> 07/24/2012:15:37:08 PPE-0 : EVENT MONITORDOWN 472795 : Monitor
Monitor_http_of_Domapps:80(10.50.15.14:80) - State DOWN
Page 506
FortiSIEM Installation Guide FortiSIEM Installation Guide
F5 Networks Application Security Manager
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information discovered
Syslog
Metrics/Logs collected
Various application level attack scenarios - invalid directory access, SQL injections, cross site exploits.
Event Types
Used for
Log analysis and compliance
Instructions - Remove before Publishing
Provide the prefix or keyword to use in searching for events for this application or device in the CMDB. If there are no specific event types for this device, insert this text: There are no event types defined specifically for this device.
In
CMDB > Event Types
, search for "f5-asm" in the
Name
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Example Syslog
Page 507
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Jun 26 14:18:56 f5virtual.tdic.ae
ASM:CEF:0|F5|ASM|10.2.1|Successful Request|Successful
Request|2|dvchost=f5virtual.adic.com dvc=192.168.1.151
cs1=master-key_default cs1Label=policy_name cs2=master-key cs2Label=web_application_name deviceCustomDate1=Jul 13 2011 16:24:25 deviceCustomDate1Label=policy_apply_date externalId=3601068286554428885 act=passed cn1=404 cn1Label=response_code src=10.10.77.54 spt=49399 dst=10.10.175.82 dpt=443 requestMethod=POST app=HTTPS request=/ipp/port1 cs5=N/A cs5Label=x_forwarded_for_header_value rt=Jun 26 2012 14:18:55 deviceExternalId=0 cs4=N/A cs4Label=attack_type cs6=N/A cs6Label=geo_location cs3Label=full_request cs3=POST /ipp/port1
HTTP/1.1\r\nHost: 127.0.0.1:631\r\nCache-Control: no-cache\r\nContent-Type: application/ipp\r\nAccept: application/ipp\r\nUser-Agent: Hewlett-Packard IPP\r\nContent-Length:
9\r\n\r\n
Page 508
FortiSIEM Installation Guide FortiSIEM Installation Guide
F5 Networks Local Traffic Manager Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP Host name, serial number, hardware (CPU, memory, network interface, disk etc) and software information (running and installed software)
SNMP
Trap
Syslog
Metrics/Logs collected
Uptime, CPU, Memory, Disk utilization, Interface
Utilization, Hardware status, process level CPU and memory urilization
Exception situations including hardware failures, certain security attacks, Policy violations etc
Permitted and Denied traffic
Used for
Performance/Availability
Monitoring
Performance/Availability
Monitoring
Log analysis and compliance
Event Types
Instructions - Remove before Publishing
Provide the prefix or keyword to use in searching for events for this application or device in the CMDB. If there are no specific event types for this device, insert this text: There are no event types defined specifically for this device.
In
CMDB > Event Types
, search for "f5-LTM" in the
Name
column to see the event types associated with this device.
Search for "f5-BigIP" in
CMDB > Event Types
to see event types associated with SNMP traps for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
SNMP Trap
AccelOps processes events from this device via SNMP traps sent by the device. Configure the device to send send SNMP traps to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
Example SNMP Trap
Page 509
FortiSIEM Installation Guide FortiSIEM Installation Guide
2012-01-18 14:13:43 0.0.0.0(via UDP: [192.168.20.243]:161) TRAP2, SNMP v2c, community public . Cold Start Trap (0) Uptime:
0:00:00.00 DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks:
(33131) 0:05:31.31 SNMPv2-MIB::snmpTrapOID.0 = OID:
SNMPv2-SMI::enterprises.3375.2.4.0.1
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Example Syslog
<133>Oct 20 13:52:46 local/tmm notice tmm[5293]: 01200004:5: Packet rejected remote IP 172.16.128.26 port 137 local IP 172.16.128.255 port
137 proto UDP: Port closed.
<134>Jul 30 15:28:33 tmm1 info tmm1[7562]: 01070417: 134: ICSA: non-session UDP packet accepted, source: 112.120.125.48 port: 10144, destination: 116.58.240.252 port: 53
<134>Jul 30 15:28:33 tmm1 info tmm1[7562]: 01070417: 134: ICSA: non-session TCP packet accepted, source: 108.83.156.153 port: 59773, destination: 116.58.240.225 port: 80
<134>Jul 30 15:28:33 tmm2 info tmm2[7563]: 01070417: 134: ICSA: non-session ICMP packet accepted, source: 10.11.218.10, destination:
10.255.111.2, type code: Echo Reply
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 510
FortiSIEM Installation Guide FortiSIEM Installation Guide
F5 Networks Web Accelerator
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information discovered Metrics/Logs collected
Syslog Permitted traffic
Used for
Log analysis and compliance
Event Types
In
CMDB > Event Types
, search for "f5-web" in the
Name
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Example Syslog
<182>Oct 20 13:52:56 local/BadReligion1 info logger: [ssl_acc] 1.1.1.2 admin [20/Oct/2011: 13:52:56 -0400] "POST /iControl/iControlPortal.cgi
HTTP/1.1" 200 654
Page 511
FortiSIEM Installation Guide FortiSIEM Installation Guide
Qualys Web Application Firewall
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information discovered Metrics/Logs collected
Syslog
Used for
Permitted and Denied Web traffic Log analysis and compliance
Event Types
The following event types are generated by parsing Qualys Web Application Firewall traffic logs and analyzing the HTTP error code.
Qualys-WAF-Web-Request-Success
Qualys-WAF-Web-Bad-Request
Qualys-WAF-Web-Client-Access-Denied
Qualys-WAF-Web-Client-Error
Qualys-WAF-Web-Forbidden-Access-Denied
Qualys-WAF-Web-Length-Reqd-Access-Denied
Qualys-WAF-Web-Request
Qualys-WAF-Web-Request-Redirect
Qualys-WAF-Web-Server-Error
Rules
There are no predefined rules for this device.
Reports
Relevant reports are defined in CMDB > Reports > Device > Network > Web Gateway
Configuration
AccelOps processes events from this device via syslog sent in
JSON format
. Configure the device to send syslog to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
Example Syslog
Note that each JSON formatted syslog contains many logs.
Page 512
FortiSIEM Installation Guide FortiSIEM Installation Guide
<1350>1 2015-05-15T12:57:30.945000+00:00 localhost qualys_waf -
QUALYS_WAF -
{"timestamp":"2015-05-15T12:57:30.945-00:00","duration":6011,"id":"487c1
16c-4908-4ce3-b05c-eda5d5bb7045","clientIp":"172.27.80.170","clientPort"
:9073,"sensorId":"d3acc41f-d1fc-43be-af71-e7e10e9e66e2","siteId":"41db09
70-8413-4648-b7e2-c50ed53cf355","connection":{"id":"bc1379fe-317e-4bae-a e30-2a382e310170","clientIp":"172.27.80.170","clientPort":9073,"serverIp
":"192.168.60.203","serverPort":443},"request":{"method":"POST","uri":"/
","protocol":"HTTP/1.1","host":"esers-test.foo.org","bandwidth":0,"heade rs":[{"name":"Content-Length","value":"645"},{"name":"Accept","value":"t ext/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.
8"},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.1; WOW64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135
Safari/537.36"},{"name":"Content-Type","value":"application/x-www-form-u rlencoded"},{"name":"Referer","value":"https://esers-test.ohsers.org/"},
{"name":"Accept-Encoding","value":"gzip, deflate"},{"name":"Accept-Language","value":"en-US,en;q=0.8"}],"headerOr der":"HILCAUTRELO"},"response":{"protocol":"HTTP/1.1","status":"200","me ssage":"OK","bandwidth":0,"headers":[{"name":"Content-Type","value":"tex t/html; charset=utf-8"},{"name":"Server","value":"Microsoft-IIS/8.5"},{"name":"C ontent-Length","value":"10735"}],"headerOrder":"CTXSDL"},"security":{"au ditLogRef":"b02f96e9-2649-4a83-9459-6a02da1a5f05","threatLevel":60,"even ts":[{"tags":["qid/226015","cat/XPATHi","cat/SQLi","qid/150003","loc/req
/body/txtUserId","cfg/pol/applicationSecurity"],"type":"Alert","rule":"m ain/qrs/sqli/xpathi/condition_escaping/boolean/confidence_high/3","messa ge":"Condition escaping detected (SQL or XPATH injection) txtUserId.","confidence":80,"severity":60,"id":"262845566"},{"tags":["ca t/correlation","qid/226016"],"type":"Observation","rule":"main/correlati on/1","message":"Info: Threat level exceeded blocking threshold
(60).","confidence":0,"severity":0,"id":"262846018"},{"tags":["cat/corre lation","qid/226016"],"type":"Observation","rule":"main/correlation/1"," message":"Info: Blocking refused as blocking mode is disabled.","confidence":0,"severity":0,"id":"262846167"},{"tags":["cat/c orrelation","cat/XPATHi","qid/226015"],"type":"Alert","rule":"main/corre lation/1","message":"Detected:
XPATHi.","confidence":80,"severity":60,"id":"268789851"}]}}
Page 513
FortiSIEM Installation Guide
Configuring Network Compliance Management Applications
AccelOps supports these Network Compliance Management applications and monitoring.
Cisco Network Compliance Manager Configuration
FortiSIEM Installation Guide
Page 514
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Network Compliance Manager Configuration
What is Discovered and Monitored
Protocol Information discovered Metrics/Logs collected
Syslog
Used for
Network device software update, configuration analysis for compliance, admin login Log analysis and compliance
Event Types
Over 40 event types are generated by parsing Cisco Network Configuration Manager logs. The complete list can be found in CMDB > Event
Types by searching for Cisco-NCM. Some important ones are
Cisco-NCM-Device-Software-Change
Cisco-NCM-Software-Update-Succeeded
Cisco-NCM-Software-Update-Failed
Cisco-NCM-Policy-Non-Compliance
Cisco-NCM-Device-Configuration-Deployment
Cisco-NCM-Device-Configuration-Deployment-Failure
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
AccelOps processes events from this device via syslog. Configure the device to send syslog to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
Example Syslog
Note that each JSON formatted syslog contains many logs.
Page 515
FortiSIEM Installation Guide FortiSIEM Installation Guide
490998571 Mon Mar 03 03:09:31 EST 2014 Savvy Device Command Script
Completed Successfully server01.foo.com 10.4.161.32 Script 'Re-enable
EasyTech port for Cisco IOS configuration' completed. Connect -
Succeeded Connected via ssh to 10.170.30.9 [in realm Default Realm]
Login / Authentication - Succeeded Successfully used: Last successful password (Password rule Retail TACACS NCM Login) Optional:Script -
Succeeded Successfully executed: prepare configuration for deployment
Script - Succeeded Successfully executed: deploy to running configuration via TFTP through CLI Bypassed: deploy to running configuration via SCP through CLI. (Requires SCP, CLI to be enabled.)
Tried: deploy to running configuration via FTP through CLI (Warning: SSH server username or password not specified in NA admin settings.)
Optional:Script - Succeeded Successfully executed: determine result of deployment operation Script run:
------------------------------------------------------------ ! interface fast0/16 no shut
491354611 Tue Mar 04 03:38:22 EST 2014 FooA Software Update Succeeded server01.foo.com 1.1.1.32 44571 10.173.30.9 $OrignatorEmail$ FooA
Update Device Software 2014-03-04 03:30:00.0 usmist_1699295009
(1.13.3.9) Succeeded
Page 516
FortiSIEM Installation Guide
Configuring Intrusion Protection Systems (IPS)
AccelOps supports these intrusion protection systems for discovery and monitoring.
AirTight Networks SpectraGuard
Cisco Intrusion Protection System Configuration
Cylance Protect Endpoint Protection
Cyphort Cortex Endpoint Protection
FireEye Malware Protection System (MPS)
IBM Internet Security Series Proventia Configuration
Juniper DDoS Secure Configuration
Juniper Networks IDP Series Configuration
McAfee IntruShield Configuration
Motorola AirDefense Configuration
Snort Intrusion Protection System Configuration
Sourcefire 3D and Defense Center Configuration
TippingPoint Intrusion Protection System Configuration
FortiSIEM Installation Guide
Page 517
FortiSIEM Installation Guide FortiSIEM Installation Guide
AirTight Networks SpectraGuard
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog
Event Types
In
CMDB > Event Types
, search for "airtight" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Example Syslog
<30><2013.09.09 19:45:16>CEF:0|AirTight|SpectraGuard
Enterprise|6.7|5.51.515|Authorized AP operating on non-allowed channel|3|msg=Stop: Authorized AP [AP2.12.c11d] is operating on non-allowed channel. rt=Sep 09 2013 19:45:16 UTC dvc=10.255.1.36
externalId=726574 dmac=58:BF:EA:FA:26:EF cs1Label=TargetDeviceName cs1=AP2.12.c11d cs2Label=SSID cs2=WiFiHiSpeed cs3Label=SecuritySetting cs3=802.11i cn1Label=RSSI_dBm cn1=-50 cn2Label=Channel cn2=149 cs4Label=Location cs4=//FB/FBFL2
Page 518
FortiSIEM Installation Guide
Cisco FireSIGHT
This section describes how AccelOps collects logs from Cisco FireSIGHT console.
What is Discovered and Monitored
What is Discovered and Monitored
Protocol
eStreamer API
Information Discovered Logs Collected
Intrusion Events
Malware Events
File Events
Discovery Events
User Activity Events
Impact Flag Events
Used For
Security Monitoring
Event Types
Intrusion events: PH_DEV_MON_FIREAMP_INTRUSION
FortiSIEM Installation Guide
[PH_DEV_MON_FIREAMP_INTRUSION]:[eventSeverity]=PHL_CRITICAL,[fileNa me]=phFireAMPAgent.cpp,[lineNumber]=381,[reptDevIpAddr]=10.1.23.177
,[envSensorId]=6,[snortEventId]=393258,[deviceTime]=1430501705,[eve ntType]=Snort-1,[compEventType]=PH_DEV_MON_FIREAMP_INTRUSION,[ipsGe neratorId]=137,[ipsSignatureId]=2,[ipsClassificationId]=32,[srcIpAd dr]=10.131.10.1,[destIpAddr]=10.131.10.120,[srcIpPort]=34730,[destI pPort]=443,[ipProto]=6,[iocNum]=0,[fireAmpImpactFlag]=7,[fireAmpImp act]=2,[eventAction]=1,[mplsLabel]=0,[hostVLAN]=0,[userId]=3013,[we bAppId]=0,[clientAppId]=1296,[appProtoId]=1122,[fwRule]=133,[ipsPol icyId]=63098,[srcIntfName]=b16c69fc-cd95-11e4-a8b0-b61685955f02,[de stIntfName]=b1a1f900-cd95-11e4-a8b0-b61685955f02,[srcFwZone]=9e3405
2a-9b4f-11e4-9b83-efa88d47586f,[destFwZone]=a7bd89cc-9b4f-11e4-8260
-63a98d47586f,[connEventTime]=1430501705,[connCounter]=371,[srcGeoC ountryCode]=0,[destGeoCountryCode]=0,[phLogDetail]=
Malware events: PH_DEV_MON_FIREAMP_MALWARE
Page 519
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_FIREAMP_MALWARE]:[eventSeverity]=PHL_INFO,[fileName]=ph
FireAMPAgent.cpp,[lineNumber]=487,[reptDevIpAddr]=10.1.23.177,[envS ensorId]=6,[deviceTime]=1430502934,[srcIpAddr]=10.110.10.73,[destIp
Addr]=10.0.112.132,[srcIpPort]=21496,[destIpPort]=80,[ipProto]=6,[f ileName]=CplLnk.exe
,[filePath]=,[fileSize64]=716325,[fileType]=1,[fileTimestamp]=0,[ha shAlgo]=SHA,[hashCode]=f1bfab10090541a2c3e58b4b93c504be8b65cdc82320
9c7f4def24acc38d7fd1
,[fileDirection]=1,[fireAmpFileAction]=3,[parentFileName]=,[parentF ileHashCode]=,[infoURL]=http://wrl/wrl/CplLnk.exe
,[threatScore]=0,[fireAmpDisposition]=3,[fireAmpRetrospectiveDispos ition]=3,[iocNum]=1,[accessCtlPolicyId]=125870424,[srcGeoCountryCod e]=0,[destGeoCountryCode]=0,[webAppId]=0,[clientAppId]=638,[applica tionId]=676,[connEventTime]=1430502933,[connCounter]=409,[cloudSecI ntelId]=0,[phLogDetail]=
File events: PH_DEV_MON_FIREAMP_FILE
[PH_DEV_MON_FIREAMP_FILE]:[eventSeverity]=PHL_INFO,[fileName]=phFir eAMPAgent.cpp,[lineNumber]=541,[reptDevIpAddr]=10.1.23.177,[envSens orId]=6,[deviceTime]=1430497343,[srcIpAddr]=10.131.15.139,[destIpAd dr]=10.0.112.137,[srcIpPort]=1587,[destIpPort]=80,[ipProto]=6,[file
Name]=Locksky.exe
,[hashAlgo]=SHA,[hashCode]=aa999f5d948aa1a731f6717484e1db32abf92fdb
5f1e7ed73ad6f5a21b0737c1,[fileSize64]=60905,[fileDirection]=1,[fire
AmpDisposition]=3,[fireAmpSperoDisposition]=4,[fireAmpFileStorageSt atus]=11,[fireAmpFileAnalysisStatus]=0,[threatScore]=0,[fireAmpFile
Action]=3,[fileType]=17,[applicationId]=676,[destUserId]=2991,[info
URL]=http://wrl/wrl/Locksky.exe
,[signatureName]=,[accessCtlPolicyId]=125869976,[srcGeoCountryCode]
=0,[destGeoCountryCode]=0,[webAppId]=0,[clientAppId]=638,[connCount er]=103,[connEventTime]=1430497343,[phLogDetail]=
Discovery events:
PH_DEV_MON_FIREAMP_DISCOVERY_NETWORK_PROTOCOL
PH_DEV_MON_FIREAMP_DISCOVERY_NETWORK_PROTOCOL]:[eventSeverity]=
PHL_INFO,[fileName]=phFireAMPAgent.cpp,[lineNumber]=815,[reptDe vIpAddr]=10.1.23.177,[destIpPort]=2054,[ipProto]=54,[phLogDetai l]=
PH_DEV_MON_FIREAMP_DISCOVERY_OS_FINGERPRINT
Page 520
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_FIREAMP_DISCOVERY_OS_FINGERPRINT]:[eventSeverity]=P
HL_INFO,[fileName]=phFireAMPAgent.cpp,[lineNumber]=737,[reptDev
IpAddr]=10.1.23.177,[fingerprintId]=01f772b2-fceb-4777-8a50-1e1 f27426ad0,[osType]=Windows
7,[hostVendor]=Microsoft,[osVersion]=NULL,[phLogDetail]=
PH_DEV_MON_FIREAMP_DISCOVERY_CLIENT_APP
[PH_DEV_MON_FIREAMP_DISCOVERY_CLIENT_APP]:[eventSeverity]=PHL_I
NFO,[fileName]=phFireAMPAgent.cpp,[lineNumber]=775,[reptDevIpAd dr]=10.1.23.177,[clientAppId]=638,[appName]=Firefox,[phLogDetai l]=
PH_DEV_MON_FIREAMP_DISCOVERY_SERVER
[PH_DEV_MON_FIREAMP_DISCOVERY_SERVER]:[eventSeverity]=PHL_INFO,
[fileName]=phFireAMPAgent.cpp,[lineNumber]=853,[reptDevIpAddr]=
10.1.23.177,[applicationId]=676,[appTransportProto]=HTTP,[phLog
Detail]=
User activity events: PH_DEV_MON_FIREAMP_USER_LOGIN
[PH_DEV_MON_FIREAMP_USER_LOGIN]:[eventSeverity]=PHL_INFO,[fileName]
=phFireAMPAgent.cpp,[lineNumber]=672,[reptDevIpAddr]=10.1.23.177,[d eviceTime]=1430490441,[user]=ABerglund
,[userId]=0,[ipProto]=710,[emailId]=,[loginType]=0,[destIpAddr]=198
.18.133.1 ,[phLogDetail]=
Impact Flag events: PH_DEV_MON_FIREAMP_IMPACT_FLAG
[PH_DEV_MON_FIREAMP_IMPACT_FLAG]:[eventSeverity]=PHL_CRITICAL,[file
Name]=phFireAMPAgent.cpp,[lineNumber]=591,[reptDevIpAddr]=10.1.23.1
77,[envSensorId]=6,[snortEventId]=34,[deviceTime]=1430491431,[event
Type]=Snort-648,[compEventType]=PH_DEV_MON_FIREAMP_IMPACT_FLAG,[ips
GeneratorId]=1,[ipsSignatureId]=14,[ipsClassificationId]=29,[srcIpA ddr]=10.131.12.240,[destIpAddr]=10.131.11.46,[srcIpPort]=80,[destIp
Port]=8964,[ipProto]=6,[fireAmpImpactFlag]=7,[phLogDetail]=
Rules
There are no predefined rules for this device.
Page 521
FortiSIEM Installation Guide
Reports
The following reports are provided
1.
2.
3.
4.
5.
6.
7.
Top Cisco FireAMP Malware Events
Top Cisco FireAMP File Analysis Events
Top Cisco FireAMP Vulnerable Intrusion Events
Top Cisco FireAMP Discovered Login Events
Top Cisco FireAMP Discovered Network Protocol
Top Cisco FireAMP Discovered Client App
Top Cisco FireAMP Discovered OS
Configuration
AccelOps obtains events from Cisco FireSIGHT via eStreamer protocol.
Cisco FireSIGHT Configuration
1.
2.
3.
4.
5.
Logon to Cisco FIRESIGHT console
Go to
Click
Create Client
> > a. b.
Enter IP address and password for AccelOps
Click Save
Select the types of events that should be forwarded to AccelOps
Click
Download Certificate
and save the certificate to a local file
AccelOps Configuration
1.
2.
Go to a. b. c. d. e. a. b.
Set
>
Create a credential
>
Device Type
to Cisco FireAMP
Set
Access Method
to eStreamer
Enter the
Password
as in Step 3a above
Click
Click
Save
and enter the certificate downloaded in Step 5
3. Create an IP range to Credential Association
Enter
Certificate File Upload
IP address
Enter the
of the FireSIGHT Console
credential
created in Step 2 above
4. Click
Test Connectivity
- AccelOps will start collecting events from the FIRESIGHT console
FortiSIEM Installation Guide
Page 522
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Intrusion Protection System Configuration
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
SNMP
SDEE Alerts
Performance and Availability Monitoring
Security Monitoring
Event Types
In
CMDB > Event Types
, search for "cisco ips" in the
Device Type
and
Description
columns to see the event types associated with this device.
Rules
In
Analytics > Rules
, search for "cisco ips" in the
Name
column to see the rules associated with this device.
Reports
In Analytics > Reports, search for "cisco ips" in the Name column to see the reports associated with this device.
Configuration
SNMP
1.
2.
3.
4.
5.
6.
7.
8.
9.
Log in to the device manager for your Cisco IPS.
Go to
Configuration > Allowed Hosts/Networks
.
Click
Enter the IP address of your AccelOps virtual appliance to add it to the access control list, and then click
Go to
For
For
For
For
Add
.
Configuration > Sensor Management > SNMP > General Configuration
Read-Only Community String
Sensor Contact
and
Sensor Agent Port
Sensor Location
, enter
161
.
Sensor Agent Protocol
, select
, enter
udp
.
public
, enter
.
Unknown
.
.
OK
.
If you need to create an SDEE account for AccelOps to use, go to
Configuration > Users
and
Add
a new administrator.
Sample XML-Formatted Alert
<\!-\- CISCO IPS \-->
<evAlert eventId="1203541079317487802" severity="low">
<originator>
<hostId>MainFW-IPS</hostId>
<appName>sensorApp</appName>
<appInstanceId>376</appInstanceId>
</originator>
<time offset="0" timeZone="UTC">1204938398491122000</time>
<signature sigName="ICMP Network Sweep w/Echo" sigId="2100" subSigId="0" version="S2"></signature>
<interfaceGroup>vs1</interfaceGroup><vlan>0</vlan>
<participants>
<attack>
<attacker>
<addr locality="OUT">2.2.2.1</addr>
</attacker>
<victim>
<addr locality="OUT">171.64.10.225</addr>
Page 523
FortiSIEM Installation Guide
<os idSource="unknown" type="unknown" relevance="relevant"></os>
</victim>
<victim>
<addr locality="OUT">171.66.255.87</addr>
<os idSource="unknown" type="unknown" relevance="relevant"></os>
</victim>
<victim>
<addr locality="OUT">171.66.255.86</addr>
<os idSource="unknown" type="unknown" relevance="relevant"></os>
</victim>
<victim>
<addr locality="OUT">171.66.255.84</addr>
<os idSource="unknown" type="unknown" relevance="relevant"></os>
</victim>
<victim>
<addr locality="OUT">171.66.255.85</addr>
<os idSource="unknown" type="unknown" relevance="relevant"></os>
</victim>
<victim>
<addr locality="OUT">171.66.255.82</addr>
<os idSource="unknown" type="unknown" relevance="relevant"></os>
</victim>
</attack>
</participants>
FortiSIEM Installation Guide
Page 524
FortiSIEM Installation Guide FortiSIEM Installation Guide
<alertDetails>InterfaceAttributes: context="single_vf" physical="Unknown" backplane="GigabitEthernet0/1" </alertDetails>
</evAlert>
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 525
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cylance Protect Endpoint Protection
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected
Syslog
Used For
End point malware alerts Security Monitoring
Event Types
In
CMDB > Event Types
, search for "cylance" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps processes events from this device via
CEF formatted syslog
sent by the device. Configure the device to send syslog to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
Example Syslog
CylancePROTECT: Event Type: AppControl, Event Name: pechange, Device
Name: WIN-7entSh64, IP Address: (192.168.119.128), Action: PEFileChange,
Action Type: Deny, File Path:
C:\Users\admin\AppData\Local\Temp\MyInstaller.exe, SHA256:
04D4DC02D96673ECA9050FE7201044FDB380E3CFE0D727E93DB35A709B45EDAA
Page 526
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cyphort Cortex Endpoint Protection
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected
Syslog
Used For
End point malware alerts Security Monitoring
Event Types
In
CMDB > Event Types
, search for "cyphort" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps processes events from this device via
CEF formatted syslog
sent by the device. Configure the device to send syslog to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
Example Syslog
<134>Feb 23 21:58:05 tap54.eng.cyphort.com cyphort:
CEF:0|Cyphort|Cortex|3.2.1.16|http|TROJAN_GIPPERS.DC|8|externalId=374 eventId=13348 lastActivityTime=2015-02-24 05:58:05.151123+00 src=172.16.0.1 dst=10.1.1.26
fileHash=acf69d292d2928c5ddfe5e6af562cd482e6812dc fileName=79ea1163c0844a2d2b6884a31fc32cc4.bin fileType=PE32 executable
(GUI) Intel 80386, for MS Windows startTime=2015-02-24
05:58:05.151123+00
Page 527
FortiSIEM Installation Guide FortiSIEM Installation Guide
FireEye Malware Protection System (MPS)
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog
Event Types
In
CMDB > Event Types
, search for "fireeye mps" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Example Syslog
<164>fenotify-45640.alert:
CEF:0|FireEye|MPS|6.0.0.62528|MC|malware-callback|9|rt=Apr 16 2012
15:54:41 src=192.168.26.142 spt=0 smac=00:14:f1:90:c8:01 dst=2.2.2.2
dpt=80 dmac=00:10:db:ff:50:00 cn1Label=vlan cn1=202 cn2Label=sid cn2=33335390 cs1Label=sname cs1=Trojan.Gen.MFC cs4Label=link cs4=https://10.10.10.10/event_stream/events_for_bot?ev_id\=45640 cs5Label=ccName cs5=3.3.3.3 cn3Label=ccPort cn3=80 proto=tcp cs6Label=ccChannel cs6= shost=abc.org <http://abc.org> dvchost=ALAXFEYE01 dvc=10.10.10.10 externalId=45640
Page 528
FortiSIEM Installation Guide FortiSIEM Installation Guide
Fortinet FortiSandbox
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host Name, OS, version, Hardware
Syslog
HTTP(S) Threat feed - Malware URL, Malware
Hash
Metrics Collected
CPU, Memory, Disk, Interface utilization
Malware found/cleaned, Botnet, Malware URL, System
Events
Used For
Performance Monitoring
Log Management, Security Compliance,
SIEM
Log Management, Security Compliance,
SIEM
Event Types
In
CMDB > Event Types
, search for "fortisandbox-" to see the event types associated with this device.
Rules
In
CMDB > Rules
, search for "fortisandbox-" to see the rules associated with this device.
Also, basic availability rules in
CMDB > Rules> Availability > Network
and performance rules trigger in
CMDB > Rules> Performance > Network
also
Reports
In CMDB > Reports, search for "fortisandbox-" to see the rules associated with this device.
Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog format is the same as that shown in the example.
Example Syslog
Oct 12 14:35:12 172.16.69.142
devname=turnoff-2016-10-11-18-46-05-172.16.69.142
device_id=FSA3KE3A13000011 logid=0106000001 type=event subtype=system pri=debug user=system ui=system action= status=success reason=none letype=9 msg="Malware package: urlrel version 2.88897 successfully released, total 1000"
<14>2016-08-19T06:48:51 devhost=turnoff-2016-08-15-19-24-55-172.16.69.55
devid=FSA35D0000000006 tzone=-25200 tz=PDT date=2016-08-19 time=06:48:51 logid=0106000001 type=event subtype=system level=information user=admin ui=GUI action=update status=success reason=none letype=9 msg="Remote log server was successfully added"
Page 529
FortiSIEM Installation Guide FortiSIEM Installation Guide
IBM Internet Security Series Proventia Configuration
What is Discovered and Monitored
Define AccelOps as a Response Object for SNMP Traps
Define a Response Rule to Forward SNMP Traps to AccelOps
What is Discovered and Monitored
Protocol
SNMP Traps
Information Discovered Metrics Collected Used For
Event Types
Instructions - Remove before Publishing
Provide the prefix or keyword to use in searching for events for this application or device in the CMDB. If there are no specific event types for this device, insert this text: There are no event types defined specifically for this device.
In
CMDB > Event Types
, search for "proventia" in the
Device Type
and
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP Trap
AccelOps receives SNMP traps from IBM/ISS Proventia IPS appliances that are sent by IBM/ISS SiteProtector Management Console. You need to first configure IBM/ISS Proventia to send alerts to IBM/ISS SiteProtector, then configure IBM/ISS SiteProtector to send those alerts as SNMP traps to AccelOps.
Configure IBM/ISS Proventia Appliances to Send SNMP Notifications to IBM/ISS SiteProtector Management Console
1.
2.
3.
4.
5.
6.
Log in to the IBM Proventia IPS web interface.
Click
Manage System Settings > SiteProtector Management.
Click and select
Click and select
Specify the
Register withSiteProtector
Configure these settings:
.
Local Settings Override SiteProtector Group Settings
, , and
Logging Level
.
.
Setting
Authentication
Level
Agent
Manager
Name
Agent
Manager
Address
Agent
Manager Port
Description
Use the default
first-time trust
Enter the Agent Manager name exactly as it appears in SiteProtector. This setting is case-sensitive.
Enter the Agent Manager's IP address
Use the default value
3995
Page 530
6.
FortiSIEM Installation Guide FortiSIEM Installation Guide
User Name
User
Password
Use Proxy
Settings
If the appliance has to log into an account access the Agent Manager, enter the user name for that account here
Click Set Password, enter and confirm the password, and then click
OK
.
If the appliance has to go through a proxy to access the Agent Manager, select the then enter the
Proxy Server Address
and
Proxy Server Port
.
Use Proxy Settings
option, and
Define AccelOps as a Response Object for SNMP Traps
1.
2.
3.
4.
5.
6.
7.
Log in to IBM SiteProtector console.
Go to
Grouping > Site Management > Central Responses > Edit settings
.
Select
Response Objects > SNMP
Click
Add
Enter a
For
For
.
Name
Manager
8.
Community
Click OK.
.
for your AccelOps virtual appliance.
, enter the IP address of your virtual appliance.
, enter public
.
Define a Response Rule to Forward SNMP Traps to AccelOps
1.
2.
3.
4.
5.
6.
Go to
Response Rules
.
Click
Select
.
Enabled
.
Enter a
Name
and
In the
Add
Responses
Click
OK
.
Comment
tab, select
for the response rule.
7.
Select
SNMP
.
Enabled
for the response object that represents your AccelOps virtual appliance.
Refining Rules for Specific IP Addresses
By default, a rule matches on any source or destination IP addresses.
1.
2.
3.
To refine the rule to match on a specific source IP address, select the rule, click
Edit
, and then select the
If you set this option, set the
Mode
to specify that the rule
to define one or more IP addresses.
should either be
From
or
Not From
Source
tab.
Select
Use specific source addresses
to restrict the rule based on IP address of the source.
the IP address.
Click
Add
Sample SNMP trap
Page 531
FortiSIEM Installation Guide FortiSIEM Installation Guide
2013-02-07 16:52:18 100.0.0.218(via UDP: [192.168.64.218]:55545) TRAP,
SNMP v1, community public SNMPv2-SMI::enterprises.2499 Enterprise
Specific Trap (4) Uptime: 0:00:00.15
SNMPv2-SMI::enterprises.2499.1.1.2.1.1.1.1.1 = STRING:
"SiteProtector_Central_Response (Response1)"
SNMPv2-SMI::enterprises.2499.1.1.2.1.1.1.1.2 = STRING: "16:52:18
2013-02-07" SNMPv2-SMI::enterprises.2499.1.1.2.1.1.1.1.3 = STRING: "6"
SNMPv2-SMI::enterprises.2499.1.1.2.1.1.1.1.4 = STRING: "100.0.0.216"
SNMPv2-SMI::enterprises.2499.1.1.2.1.1.1.1.5 = STRING: "100.0.0.218"
SNMPv2-SMI::enterprises.2499.1.1.2.1.1.1.1.6 = ""
SNMPv2-SMI::enterprises.2499.1.1.2.1.1.1.1.7 = ""
SNMPv2-SMI::enterprises.2499.1.1.2.1.1.1.1.8 = STRING: "48879"
SNMPv2-SMI::enterprises.2499.1.1.2.1.1.1.1.9 = STRING: "80"
SNMPv2-SMI::enterprises.2499.1.1.2.1.1.1.1.10 = STRING:
"DISPLAY=WithoutRaw:0,BLOCK=Default:0"
SNMPv2-SMI::enterprises.2499.1.1.2.1.1.1.1.11 = STRING: " SensorName:
IBM-IPS ObjectName: 80 DestinationAddress: 100.0.0.218 AlertName:
HTTP_OracleAdmin_Web_Interface AlertTarget: 100.0.0.218 AlertCount: 1
VulnStatus: Simulated block (blocking not enabled) AlertDateTime:
16:52:17 2013-02-07 ObjectType: Target Port SourceAddress: 100.0.0.216
SensorAddress: 192.168.64.15"
Page 532
FortiSIEM Installation Guide FortiSIEM Installation Guide
Juniper DDoS Secure Configuration
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog DDoS Alerts Security Monitoring
Event Types
In
CMDB > Event Types
device.
, search for "juniper ddos" in the
Device Type
and
Description
columns to see the event types associated with this
Juniper-DDoS-Secure-WorstOffender
Juniper-DDoS-Secure-Blacklisted
Juniper-DDoS-Secure-Generic
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Configure the device to send syslog to AccelOps. Make sure that the event matches the format specified below.
<134>Juniper: End : 117.217.141.32 : IND: Worst Offender: Last Defended
66.145.37.254: TCP Attack - Port Scan (Peak 55/s, Occurred 554)
<134>Juniper: End : 78.143.172.52 : IRL: IP Address Temp Black-Listed
(Valid IP) Exceeds SYN + RST + F2D Count (Peak 114/s, Dropped 83.5K
pkts)
Page 533
FortiSIEM Installation Guide FortiSIEM Installation Guide
Juniper Networks IDP Series Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog
Event Types
In
CMDB > Event Types
, search for "juniper_idp" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Example Syslog from NSM
<25>Oct 11 14:29:27 10.146.68.68 20101011, 58420089, 2010/10/11
18:29:25, 2010/10/11 18:33:12, global.IDP, 1631, par-real-idp200,
10.146.68.73, traffic, udp port scan in progress, (NULL), (NULL), 161.178.223.221, 0, 0.0.0.0,
0, (NULL), (NULL), 10.248.8.110, 0, 0.0.0.0, 0, udp, global.IDP, 1631,
Metro IDP IP / Port Scan Policy, traffic anomalies, 2, accepted, info, yes, 'interface=eth3', (NULL), (NULL), (NULL), 0, 0, 0, 0, 0, 0, 0, 0, no, 25, Not
Page 534
FortiSIEM Installation Guide
McAfee IntruShield Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps handles custom syslog messages from McAfee Intrushield.
1.
2.
Log in to McAfee Intrushield Manager.
Create a customer syslog format with these fields:
AttackName
AttackTime
AttackSeverity
SourceIp
SourcePort
DestinationIp
DestinationPort
AlertId
AlertType
AttackId
AttackSignature
AttackConfidence m. n. o. p. i. j. k. l. e. f. g. h. a. b. c. d. q. r. s. t.
AdminDomain
SensorName:ASCDCIPS01
Interface
Category u. v.
SubCategory
Direction
ResultStatus
DetectionMechanism w.
ApplicationProtocol
NetworkProtocol
3.
Relevance
Set the message format as a sequence of
Attribute:Value
pairs as in this example.
FortiSIEM Installation Guide
Page 535
3.
FortiSIEM Installation Guide FortiSIEM Installation Guide
AttackName:$IV_ATTACK_NAME$,AttackTime:$IV_ATTACK_TIME$,AttackSever ity::$IV_ATTACK_SEVERITY$,SourceIp:$IV_SOURCE_IP$,SourcePort:$IV_SO
URCE_PORT$,
DestinationIp:$IV_DESTINATION_IP$,DistinationPort:$IV_DESTINATION_P
ORT$,AlertId:$IV_ALERT_ID$,AlertType:$IV_ALERT_TYPE$,AttackId$IV_AT
TACK_ID$,
AttackSignature:$IV_ATTACK_SIGNATURE$,AttackConfidence:$IV_ATTACK_C
ONFIDENCE$,AdminDomain:$IV_ADMIN_DOMAIN$,SensorName:$IV_SENSOR_NAME
$,
Interface:$IV_INTERFACE$,Category:$IV_CATEGORY$,SubCategory:$IV_SUB
_CATEGORY$,Direction:$IV_DIRECTION$,ResultStatus:$IV_RESULT_STATUS$
,
DetectionMechanism:$IV_DETECTION_MECHANISM$,ApplicationProtocol:$IV
_APPLICATION_PROTOCOL$,NetworkProtocol:$IV_NETWORK_PROTOCOL$,Releva nce:$IV_RELEVANCE$
4. Set AccelOps as the syslog recipient.
Sample Parsed Syslog Message
Mar 24 16:23:18 SyslogAlertForwarder: AttackName:Invalid Packets detected,AttackTime:2009-03-24 16:23:17
EDT,AttackSeverity:Low,SourceIp:127.255.106.236,
SourcePort:N/A,DestinationIp:127.255.106.252,DistinationPort:N/A,AlertId
:5260607647261334188,AlertType:Signature,AttackId:0x00009300,AttackSigna ture:N/A,
AttackConfidence:N/A,AdminDomain:ASC,SensorName:ASCDCIPS01,Interface:1A-
1B,Category:Exploit,SubCategory:protocol-violation,Direction:Outbound,
ResultStatus:May be successful,DetectionMechanism:signature,ApplicationProtocol:N/A,NetworkP rotocol:N/A,Relevance:N/A,HostIsolationEndTime:N/A
Page 536
FortiSIEM Installation Guide FortiSIEM Installation Guide
McAfee Stonesoft IPS
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog Network IPS alerts Security Monitoring
Event Types
In
CMDB > Event Types
, search for "stonesoft" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps processes events from this device via
CEF formatted syslog
sent by the device. Configure the device to send syslog to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
Example Syslog
<6>CEF:0|McAfee|IPS|5.4.3|70018|Connection_Allowed|0|spt=123 deviceExternalId=STP-NY-FOO01 node 1 dmac=84:B2:61:DC:E1:31 dst=169.132.200.3 cat=System Situations app=NTP (UDP) rt=Apr 08 2016
00:26:13 deviceFacility=Inspection act=Allow deviceOutboundInterface=Interface #5 deviceInboundInterface=Interface #4 proto=17 dpt=123 src=10.64.9.3 dvc=12.17.2.17 dvchost=12.17.2.17
smac=78:DA:6E:0D:FF:C0 cs1Label=RuleId cs1=2097152.6
Page 537
FortiSIEM Installation Guide FortiSIEM Installation Guide
Motorola AirDefense Configuration
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog Wireless IDS logs Security Monitoring
Event Types
About 37 event types covering various Wireless attack scenarios - search for them by entering "Motorola-AirDefense" in CMDB > EventType.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Configure the device to send logs to AccelOps. Make sure that the format is as follows.
Nov 8 18:48:00 Time=2014-10-29T05:39:00,Category=Rogue
Activity,CriticalityLevel=Severe,Desc=Rogue AP on Wired
Network,device=00:22:cf:5d:ee:60(00:22:cf:5d:ee:60),sensor=fc:0a:81:12:7 b:4b(COMP-SENS302EA[a,b,g,n])
Nov 12 13:33:00
Time=2015-11-12T08:47:00,Category=Exploits,CriticalityLevel=Critical,Des c=NAV Attack -
CTS,device=5c:0e:8b:cb:d5:40(5c:0e:8b:cb:d5:40),sensor=fc:0a:81:12:77:3f
(COMP-SENS201EA[a,b,g,n])
Page 538
FortiSIEM Installation Guide FortiSIEM Installation Guide
Snort Intrusion Protection System Configuration
What is Discovered and Monitored
Supported Databases and Snort Database Schemas
SNMP Access to the Database Server
Debugging Snort Database Connectivity
Examples of Snort IPS Events Pulled over JDBC
Viewing Snort Packet Payloads in Reports
Exporting Snort IPS Packets as a PCAP File
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
Syslog
JDBC Generic information: signature ID, signature name, sensor ID, event occur time, signature priority
TCP: packet header, including source IP address, destination IP address, Source Port, Destination
Port, TCP Sequence Number, TCP Ack Number, TCP Offset, TCP Reserved, TCP Flags, TCP
Window size, TCP Checksum, tTCP Urgent Pointer; and packet payload
UDP: packet header, including source IP address, destination IP address, Source Port, Destination
Port, UDP Length, checksum; and packet payload
ICMP: packet header, including source IP address, destination IP address, ICMP Type, ICMP Code,
Checksum, ICMP ID, Sequence Number; and packet payload
SNMP (for access to the database server hosting the Snort database)
Event Types
In
CMDB > Event Types
, search for "snort_ips" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Metrics
Collected
Used
For
Reports
There are no predefined reports for this device.
Configuration
Syslog
Collecting event information from Snort via syslog has two drawbacks:
1.
2.
It is not reliable because it is sent over UDP.
Information content is limited because of UDP packet size limit.
For these reasons, you should consider using JDBC to collect event information from Snort.
These instructions illustrate how to configure Snort on Linux to send syslogs to AccelOps. For further information, you should consult the Snort product documentation .
1.
2.
3.
Log in to your Linux server where Snort is installed.
Navigate to and open the file
/etc/snort/snort.conf
.
Modify alert_syslog
to use a local log facility.
Page 539
FortiSIEM Installation Guide
Example for Outputting Syslog to a Local Facility
output alert_syslog: LOG_LOCAL4 LOG_ALERT
4. Navigate to and open the file
/etc/syslog.conf.
5. Add a redirector to send syslogs to AccelOps.
#Snort log to local4
#local4.* /var/log/snort.log
#local4.*@192.168.20.41
6. Restart the Snort daemon.
Example Parsed Snort Syslog
<161>snort[2242]: [1:206:9] BACKDOOR DeepThroat 3.1 CD ROM Open Client
Request [Classification: Misc activity] [Priority: 3]: {UDP}
192.168.19.1:6555 -> 172.16.2.5:514
<161>snort[5774]: [1:1560:6] WEB-MISC /doc/ access [Classification: access to a potentially vulnerable web application] [Priority: 2]: {TCP}
192.168.20.53:41218 -> 192.168.0.26:80
<161>snort[5774]: [1:466:4] ICMP L3retriever Ping [Classification:
Attempted Information Leak] [Priority: 2]: {ICMP} 192.168.20.49 ->
192.168.0.10
<161>snort[5774]: [1:1417:9] SNMP request udp [Classification: Attempted
Information Leak] [Priority: 2]: {UDP} 192.168.20.40:1061 ->
192.168.20.2:161
JDBC
Supported Databases and Snort Database Schemas
When using JDBC to collect IPS information from Snort, AccelOps can capture a full packet that is detailed enough to recreate the packet via a
PCAP file.
AccelOps supports collecting Snort event information over JDBC these database types:
Oracle
MS SQL
MySql
PostgreSQL
AccelOps supports Snort database schema 107 or higher.
SNMP Access to the Database Server
You will need to set up an SNMP access credential for the server that hosts the Snort database. See the topics under
for information on setting up SNMP for communication with AccelOps for several common types of database servers.
Page 540
FortiSIEM Installation Guide FortiSIEM Installation Guide
Once you have set up SNMP on your database server, you can configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device Discovery
, and then initiate discovery of the device as described in the topics in
Debugging Snort Database Connectivity
Snort IPS alert are pulled over JDBC by a Java agent, which has to join multiple database tables to create the events. An internal log file is created for each pull.
2012-08-07T10:02:27.576777+08:00 AO-foo java:[PH_JAVA_AGENT_INFO]:[eventSeverity]=PHL_INFO,[procName]=phAgentMan ager,[fileName]=AgentSnort,[phLogDetail]=10.1.20.51:ICMP:Max record id:17848444 Total records in one round of pulling:20
At most 1000 database records (IPS Alerts) are pulled at a time. If AccelOps finds more than 1000 new records, then it begins to fall behind and this log is created.
2012-08-07T10:02:27.576777+08:00 AO-foo java:[PH_JAVA_AGENT_INFO]:[eventSeverity]=PHL_INFO,[procName]=phAgentMan ager,[fileName]=AgentSnort,[phLogDetail]=Event count of snort exceeds the threshold in one round of pulling, which means there may be more events need to be pulled.
Examples of Snort IPS Events Pulled over JDBC
UDP Event
<134>Feb 25 14:27:56 10.1.2.36 java:
[Snort-1417]:[eventSeverity]=PHL_INFO,[relayDevIpAddr]=10.1.2.36,[ipsSen sorId]=1,[snortEventId]=10343430,[sensorHostname]=10.1.2.36,[signatureId
]=1417,[eventName]=SNMP request udp,[eventSeverity]=2,[eventTime]=2012-11-07
17:56:51.0,[srcIpAddr]=10.1.2.245,[destIpAddr]=10.1.2.36,[ipVersion]=4,[ ipHeaderLength]=5,[tos]=0,[ipTotalLength]=75,[ipId]=0,[ipFlags]=0,[ipFra gOffset]=0,[ipTtl]=64,[ipProto]=17,[ipChecksum]=8584,[srcIpPort]=35876,[ destIpPort]=161,[udpLen]=55,[checksum]=39621,[dataPayload]=302D020101040
67075626C6963A520...
TCP Event
Page 541
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Aug 08 09:30:59 10.1.20.51
java:
[Snort-1000001]:[eventSeverity]=PHL_INFO,[hostIpAddr]=10.1.20.51,[sensor
Id]=1,[eventId]=17897184,[signatureId]=1000001,[signatureName]=Snort
Alert [1:1000001:0],[signaturePri]=null,[eventTime]=2012-08-08
09:26:24.0,[srcIpAddr]=10.1.2.99,[destIpAddr]=10.1.20.51,[srcIpPort]=523
14,[destIpPort]=80,[seqNum]=967675661,[tcpAckNum]=3996354107,[tcpOffset]
=5,[tcpReserved]=0,[tcpFlags]=24,[tcpWin]=16695,[checksum]=57367,[tcpUrg entPointer]=0,[dataPayload]=474554202F66617669636F6E2E69636F204...
Viewing Snort Packet Payloads in Reports
AccelOps creates an event for each IPS alert in Snort database. You can view the full payload packet associated with a Snort event when you run a report.
1.
2.
Set up a
.
Set these conditions, where
Reporting IP
is an IP belonging to the Snort Application group.
Attribute Operator Value
Reporting IP IN Applications: Network IPS App
3. For
Display Fields
, include
When the query runs, select an event, and the data payload will display at the bottom of the search results in a byte-by-byte ethereal/wireshark format.
Data Payload
.
4.
When you run the query, Data Payload will be one one of the display columns.
Exporting Snort IPS Packets as a PCAP File
After running a report, click the
Export
button and choose the PCAP option.
Settings for Access Credentials
Settings for Snort IPS over JDBC Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your Snort IPS over JDBC, use these settings.
Setting
Name
Device Type
Access Protocol
Value
<database type>-snort-BT
Select the type of database that you are connecting to for Snort alerts
JDBC
Used For Snort Audit
Pull Interval (minutes) 1
Port
Database Name
3306
The name of the database
User Name
Password
The administrative user for the Snort database
The password associated with the administrative user
Page 542
FortiSIEM Installation Guide FortiSIEM Installation Guide
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 543
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sourcefire 3D and Defense Center Configuration
What is Discovered and Monitored
Sample Syslogs from SourceFire3D IPS
Sample Syslogs from SourceFire DefenseCenter
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
Syslog
Event Types
In
CMDB > Event Types
, search for "sourcefire" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps handles SourceFire alerts via syslog either from IPS appliances themselves or from DefenseCenter. Events are classified as Snort event types.
Simply configure SourceFire appliances or DefenseCenter to send syslogs to AccelOps as directed in the device's product documentation, and
AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Sample Syslogs from SourceFire3D IPS
<188>Jul 4 15:07:01 Sourcefire3D Snort: [119:15:1] http_inspect:
OVERSIZE REQUEST-URI DIRECTORY [Impact: Unknown] From
DetectionEngine_IPS_DMZ2/SourcefireIPS at Thu Jul 4 15:07:01 2013 UTC
[Classification: Potentially Bad Traffic] [Priority: 2] {tcp}
10.20.1.12:57689->1.1.1.1:80
Sample Syslogs from SourceFire DefenseCenter
Page 544
FortiSIEM Installation Guide FortiSIEM Installation Guide
<46>Jul 17 16:01:54 DefenseCenter SFAppliance: [1:7070:14] "POLICY-OTHER script tag in URI - likely cross-site scripting attempt" [Impact:
Potentially Vulnerable] From "10.134.96.172" at Wed Jul 17 16:01:52 2013
UTC [Classification: Web Application Attack] [Priority: 1] {tcp}
1.2.3.4:60537->2.3.4.5:80
Page 545
FortiSIEM Installation Guide FortiSIEM Installation Guide
TippingPoint Intrusion Protection System Configuration
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected
SNMP
Syslog
Used For
CPU, memory, Interface utilization Performance and Availability Monitoring
IPS Alerts Security Monitoring
Event Types
Instructions - Remove before Publishing
Provide the prefix or keyword to use in searching for events for this application or device in the CMDB. If there are no specific event types for this device, insert this text: There are no event types defined specifically for this device.
In
CMDB > Event Types
device.
, search for "tippingpoint" in the
Device Type
and
Description
columns to see the event types associated with this
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
1.
2.
3.
4.
5.
6.
Log in to the TippingPoint appliance or the SMS Console.
Go to
System > Configuration > SMS/NMS
.
For
SMS Authorized IP Address/CIDR
Select
Enabled
for
SNMP V2
For
NMS Community String
Click
Apply
.
.
, enter
, make sure public
.
any
is entered.
Syslog
1.
2.
3.
4.
5.
6.
7.
Log in to the TippingPoint appliance or the SMS Console.
Go to
System > Configuration > Syslog Servers
.
Under
System Log
, enter the
IP Address
of the AccelOps virtual appliance.
Select
Enable syslog offload for System Log
.
Under
Select
Aud Log
Click
Apply
.
, enter the
IP Address
of the AccelOps virtual appliance.
Enable syslog offload for Audit Log
.
Configure the Syslog Forwarding Policy (Filter Notification Forwarding)
The filter log can be configured to generate events related to specific traffic on network segments that need to pass through the device. This log includes three categories of events.
Event
Category
Alert
Description
Block
P2P
Alert events indicate that the IPS has detected suspicious activity in the packet, but still permits the packet to pass through
(specific settings are controlled by administrator profile)
Block events are malicious packets not permitted to pass
Refers to peer-to-peer traffic events
In addition, filter events contain a UUID, which is a unique numerical identifier that correlates with the exact security threat defined by Tipping
Point Digital Vaccine Files. The Accelops Virtual Appliance will correlate these with authoritative databases of security threats.
1.
Page 546
FortiSIEM Installation Guide FortiSIEM Installation Guide
1.
2.
3.
4.
Go to
IPS > Action Sets
.
Click
Permit + Notify
.
5.
6.
7.
Under Contacts, click Remote Syslog.
Under
Click
Remote Syslog Information
, enter the
Make sure the
Make sure
Port
is set to
Delimiter
is set to
Add to Table Below
514
.
IP Address
of the Accelops virtual appliance.
.
.
You should now see the IP address of the Accelops virtual appliance appear as an entry in the
Remote Syslogs
table.
Sample parsed syslog messages
Directly from TippingPoint IPS device
<36>Oct 28 13:10:45 9.0.0.1
ALT,v4,20091028T131045+0480,"PH-QA-TIP1"/20.30.44.44,835197,1,Permit,Min or,00000002-0002-0002-0002-000000000089,
"0089: IP: Short Time To Live (1)","0089: IP: Short Time To Live
(1)",ip," ",172.16.10.1:0,224.0.0.5:0,20091028T130945+0480,6," ",0,1A-1B
<37>Nov 5 20:16:19 20.30.44.44
BLK,v4,20091105T201619+0480,"PH-QA-TIP1"/20.30.44.44,70,2,Block,Low,0000
0002-0002-0002-0002-000000004316,
"4316: OSPF: OSPF Packet With Time-To-Live of 1","4316: OSPF: OSPF
Packet With Time-To-Live of 1",ip,"
",172.16.10.1:0,224.0.0.5:0,20091105T201619+0480,1," ",0,1A-1B
<37>Jul 12 15:04:01 SOCIPS01
ALT,v5,20110712T150401-0500,SOCIPS01/192.168.10.122,3225227,1,Permit,Low
,00000002-0002-0002-0002-000000010960,
"10960: IM: Google GMail Chat SSL Connection Attempt","10960: IM: Google
GMail Chat SSL Connection Attempt",tcp,"
",156.63.133.8,10948,72.14.204.189,443,
20110712T150239-0500,3," ",0,6A-6B
From TippingPoint NMS device
<36> 7 2 00000002-0002-0002-0002-000000001919
00000001-0001-0001-0001-000000001919 1919: Backdoor: Psychward 1919 tcp
10.1.1.100 13013 10.1.1.101 1240 3 3 2
207-2400-Jack 33761793 1109876221622
<36> 7 2 00000002-0002-0002-0002-000000001919
00000001-0001-0001-0001-000000001919 1919: Backdoor: Psychward 1919 tcp
10.1.1.100 13013 10.1.1.101 1240 3 3 2
207-2400-Jack 33761793 1109876221622
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Page 547
FortiSIEM Installation Guide
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
FortiSIEM Installation Guide
Page 548
FortiSIEM Installation Guide
Configuring Routers and Switches
AccelOps supports these routers and switches for discovery and monitoring.
Alcatel TiMOS and AOS Switch Configuration
Arista Router and Switch Configuration
Cisco IOS Router and Switch Configuration
How CPU and Memory Utilization is Collected for Cisco IOS
Cisco Meraki Cloud Controller and Network Devices Configuration
Cisco NX-OS Router and Switch Configuration
Dell Force10 Router and Switch Configuration
Dell NSeries Switch Configuration
Dell PowerConnect Switch and Router Configuration
Foundry Networks IronWare Router and Switch Configuration
HP/3Com ComWare Switch Configuration
HP ProCurve Switch Configuration
HP Value Series (19xx) and HP 3Com (29xx) Switch Configuration
Juniper Networks JunOS Switch Configuration
Nortel ERS and Passport Switch Configuration
FortiSIEM Installation Guide
Page 549
FortiSIEM Installation Guide FortiSIEM Installation Guide
Alcatel TiMOS and AOS Switch Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP
(V1, V2c)
Host name, Software version, Hardware model, Network interfaces,
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Hardware status: Power Supply, Fan, Temperature
Used for
Availability and
Performance
Monitoring
Availability SNMP
(V1, V2c)
SNMP
(V1, V2c,
V3)
Layer 2 port mapping: associating switch ports to directly connected host IP/MAC addresses
Identity and location table;
Topology
Event Types
In
CMDB > Event Types
, search for "alcatel" in the
Device Type
and
Description
columns to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 550
FortiSIEM Installation Guide FortiSIEM Installation Guide
Arista Router and Switch Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP (V1,
V2c)
Host name, Serial number, Software version, Hardware model, Network interfaces, Hardware Components
Telnet/SSH Running and Startup configurations
Metrics collected
Uptime, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), CPU utilization, Memory utilization, Flash utilization, Hardware Status
Startup Configuration Change, Difference between Running and Startup configurations
Used for
Availability and
Performance
Monitoring
Change monitoring
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Telnet/SSH
AccelOps uses Telnet/SSH to communicate with this device. Refer to the product documentation for your device to enable Telnet/SSH.
These commands are used for discovery and performance monitoring via SSH. Please make sure that the access credentials you provide in
AccelOps have the permissions necessary to execute these commands on the device.
1.
2. show startup-config show running-config
3.
4. show version show ip route
5.
6. enable terminal pager 0
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Page 551
FortiSIEM Installation Guide
Access Protocol SNMP
Community String <your own>
Telnet Access Credentials for All Devices
These are the generic settings for providing Telnet access to your device from AccelOps
Setting
Name
Device Type
Value
Telnet-generic
<select device type from drop down>
Access Protocol Telnet
Port 23
User Name
Password
A user who has permission to access the device over Telnet
The password associated with the user
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Device Type
Value
ssh-generic
<select device type from drop down>
Access Protocol SSH
Port 22
User Name
Password
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 552
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco IOS Router and Switch Configuration
What is Discovered and Monitored
Performance Monitoring Reports
Settings for Access Credentials
Issue with Generic Serial Numbers in Older Versions of Cisco IOS Routers
AccelOps uses serial numbers to uniquely identify a device. For older routers, the serial number is obtained from the OID
1.3.6.1.4.
.
However, this value is often incorrectly set by default to a generic value like
MSFC 2A common default value, then these routers will be merged into a single entry in the AccelOps CMDB.
. If multiple routers have a
You can check the current value for the serial number in a Cisco router by doing a SNMP walk of the OID.
snmpwalk -v2c -c <cred> <ip> 1.3.6.1.4.1.9.3.6.3.0
If the value is a generic value, then set it to the actual serial number.
Router(config)#snmp-server chassis-id
Router(config)#exit
Router#write memory
Run the snmpwalk again to verify that the serial number is updated, then perform discovery of your Cisco router.
What is Discovered and Monitored
Protocol
SNMP (V1,
V2c, V3)
SNMP (V1,
V2c, V3)
SNMP (V1,
V2c, V3)
Information Discovered
Host name, IOS version, Hardware model, Memory size, Network interface details - name, address, mask and description
Hardware component details: serial number, model, manufacturer, software firmware versions of hardware components such as chassis, CPU, fan, power supply, network cards etc.
Trunk port connectivity between switches and VLANs carried over a trunk port, End host Layer 2 port mapping: switch interface to VLAN id, end host IP/MAC address association
Metrics collected
Uptime, CPU and Memory utilization, Free processor and I/O memory, Free contiguous processor and I/O memory, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths),
Hardware health: temperature, fan and power supply
Used for
Availability and
Performance
Monitoring
Availability
Topology and end-host location
Page 553
FortiSIEM Installation Guide FortiSIEM Installation Guide
SNMP (V1,
V2c, V3)
BGP connectivity, neighbors, state, AS number
SNMP (V1,
V2c, V3)
SNMP (V1,
V2c, V3)
SNMP (V1,
V2c, V3)
SNMP (V1,
V2c, V3)
OSPF connectivity, neighbors, state,
OSPF Area
Telnet/SSH Running and startup configuration,
Syslog
Image file name, Flash memory size,
Running processes
Device type
BGP state change
OSPF state change
IP SLA and VoIP performance metrics: Max/Min/Avg Delay and Jitter - both overall and Source->Destination and Destination->Source, Packets Lost - both overall and
Source->Destination and Destination->Source, Packets Missing in Action, Packets
Late, Packets out of sequence, VoIP Mean Opinion Score (MOS), VoIP Calculated
Planning Impairment Factor (ICPIF) score
Class based QoS metrics (from CISCO-CLASS-BASED-QOS-MIB): For (router interface, policy, class map) tuple:
class map metrics
including Pre-policy rate, post-police rate, drop rate and drop pct; exceeded rate and violated rate;
queue metrics
queue length and discarded packets
police action metrics
including conform rate,
including current queue length, max
NBAR metrics (from CISCO-NBAR-PROTOCOL-DISCOVERY-MIB): For each interface and application, sent/receive flows, sent/receive bytes, sent/receive bits/sec
Startup configuration change, delta between running and startup configuration, Running process CPU and memory utilization
System logs and traffic logs matching acl statements
Routing
Topology,
Availability
Monitoring
Routing
Topology,
Availability
Monitoring
VoIP
Performance
Monitoring
QoS performance monitoring
Performance
Monitoring
Performance
Monitoring,
Security and
Compliance
Availability,
Security and
Compliance
Event Types
Performance Monitoring events
Configuration change events
Syslog events
In
CMDB > Event Types
, search for "cisco_os" in the
Description
column to see the event types associated with this device.
Rules
Performance Monitoring rules
Configuration change rules
Other rules
Reports
Performance Monitoring Reports
Configuration change Reports
Other Reports
Configuration
Telnet/SSH
AccelOps uses SSH and Telnet to communicate with your device. Follow the instructions in the product documentation for your device to enable
SSH and Telnet.
These commands are used for discovery and performance monitoring via SSH. Please make sure that the access credentials you provide in
AccelOps have the permissions necessary to execute these commands on the device.
1. show startup-config
2.
Page 554
FortiSIEM Installation Guide
2.
3. show running-config show version
4.
5. show flash show ip route
6.
7. show mac-address-table or show mac address-table show vlan brief
8.
9. show process cpu show process mem
10.
11. show disk0
12. enable terminal pager 0
SNMP
SNMP V1/V2c
1.
2.
3.
Log in to the Cisco IOS console or telnet to the device.
Enter configuration mode.
Create an access list for AccelOps.
access-list 10 permit <AccelOps IP>
4. Set up community strings and access lists.
snmp-server community <community string> ro 10
5. Exit configuration mode.
SNMP V3
1.
2.
3.
Log in to the Cisco IOS console or telnet to the device.
Enter configuration mode.
Create an access list for AccelOps.
FortiSIEM Installation Guide access-list 10 permit <AccelOps IP>
4. Set up SNMP credentials for Authentication only.
snmp-server group <grpName> v3 auth
#do this for every VLAN for AccelOps to discover per VLAN information such Spanning Tree and VTP MIBs snmp-server group <grpName> v3 auth context vlan-<vlanId> snmp-server user <userName> <grpName> v3 auth md5 <password> access
10
5. Set up SNMP credentials for Authentication and Encryption.
Page 555
5.
FortiSIEM Installation Guide FortiSIEM Installation Guide snmp-server group <grpName> v3 priv
#do this for every VLAN for AccelOps to discover per VLAN information such Spanning Tree and VTP MIBs snmp-server group <grpName> v3 auth context vlan-<vlanId> snmp-server group <grpName> v3 priv context vlan-<vlanId> snmp-server user <userName> <grpName> v3 auth md5 <password> priv des56 <password> access 10
1. Exit configuration mode.
Syslog
1.
2.
3.
Login to the Cisco IOS console or telnet to the device.
Enter configuration mode.
Enable logging with these commands.
logging on logging trap informational logging <AccelOps IP>
4. Make sure that the timestamp in syslog message sent to AccelOps does not contain milliseconds.
no service timestamps log datetime msec service timestamps log datetime
5. To log traffic matching acl statements in stateless firewall scenarios, add the log
keyword to the acl statements.
access-list 102 deny udp any gt 0 any gt 0 log
6. To turn on logging from the IOS Firewall module, use this command.
ip inspect audit-trail
7. Exit configuration mode.
Sample Cisco IOS Syslog Messages
Page 556
FortiSIEM Installation Guide FortiSIEM Installation Guide
<190>109219: Jan 9 18:03:35.281: %FW-6-SESS_AUDIT_TRAIL_START: Start tcp session: initiator (192.168.20.33:1876) -- responder
(192.168.0.10:445)
<190>263951: 2w6d: %SEC-6-IPACCESSLOGP: list permit-any permitted udp
192.168.20.35(0) -> 192.168.23.255(0), 1 packet
<188>84354: Dec 6 08:15:20: %SEC_LOGIN-4-LOGIN_FAILED: Login failed
[user: Admin] [Source: 192.168.135.125] [localport: 80] [Reason: Login
Authentication Failed - BadPassword] at 08:15:20 PST Mon Dec 6 2010
<189>217: May 12 13:57:23.720: %SYS-5-CONFIG_I: Configured from console by vty1 (192.168.29.8)
<189>Oct 27 20:18:43.254 UTC: %SNMP-3-AUTHFAIL: Authentication failure for SNMP request from host 192.168.2.98
NetFlow
Enable NetFlow on the Router
1.
2.
Enter configuration mode.
For
every interface
, run this command.
interface <interface> <interface_number> ip route-cache flow exit
Set Up NetFlow Export
1.
2.
Enter configuration mode.
Run these commands.
ip flow-export version 5|9 ip flow-export destination <Accelops IP> 2055 ip flow-export source <interface> <interface_number> ip flow-cache timeout active 1 ip flow-cache timeout inactive 15 snmp-server ifindex persist
On MLS switches, such as the 6500 or 7200 models, also run these commands.
Page 557
FortiSIEM Installation Guide FortiSIEM Installation Guide mls netflow mls nde sender mls aging long 64 mls flow ip full
Exit configuration mode
You can verify that you have set up NetFlow correctly by running these commands.
#shows the current NetFlow configuration show ip flow export
#summarizes the active flows and gives an indication of how much NetFlow data the device is exporting show ip cache flow or show ip cache verbose flow
Sample Flexible Netflow Configuration in IOS
Page 558
FortiSIEM Installation Guide FortiSIEM Installation Guide flow exporter e1
! destination is the collector address, default port needs to be changed to 2055
destination <accelopsIp>
transport udp 2055
!
flow record r1
! record specifies packet fields to collect
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
collect transport tcp flags
collect interface output
collect counter bytes
collect counter packets
!
flow monitor m1
! monitor refers record configuration and exporter configuration.
record r1
exporter e1
cache timeout active 60
cache timeout inactive 30
cache entries 1000
!
interface GigabitEthernet 2/48
ip flow monitor m1 input
IP SLA
IP SLA is a technology where a pair of routers can run synthetic tests between themselves and report detailed traffic statistics. This enables network administrators to get performance reports between sites without depending on end-host instrumentation.
Cisco provides detailed documents for configuring IP SLA for both general traffic and VoIP .
A variety of IP SLA tests can be run, for example UDP/ICMP Jitter, UDP Jitter for VoIP, UDP/ICMP Echo, TCP Connect, HTTP, etc. You can see the traffic statistics for these these tests by routing appropriate
RTT-MON SNMP MIB.
Show
commands on the router. However, only these IP SLA tests are exported via
UDP Jitter (reported by AccelOps event type PH_DEV_MON_IPSLA_MET)
UDP Jitter for VoIP (reported by AccelOps event type PH_DEV_MON_IPSLA_VOIP_MET)
HTTP performance (reported by AccelOps event type PH_DEV_MON_IPSLA_HTTP_MET)
ICMP Echo (reported by AccelOps event type PH_DEV_MON_IPSLA_ICMP_MET)
UDP Echo (reported by AccelOps event type PH_DEV_MON_IPSLA_UDP_MET)
These are the only IP SLA tests monitored by AccelOps.
Configuring IP SLA involves choosing and configuring a router to initiate the test and a router to respond. The test statistics are automatically reported by the initiating router via SNMP, so no additional configuration is required. Bi-directional traffic statistics are also reported by the initiating router, so you don't need to set up a reverse test between the original initiating and responding routers. AccelOps automatically detects the presence of the IP SLA SNMP MIB (CISCO-RTTMON-MIB) and starts collecting the statistics.
Configuring IP SLA Initiator for UDP Jitter
Page 559
FortiSIEM Installation Guide FortiSIEM Installation Guide ipsla-init>enable ipsla-init#config terminal ipsla-init(config)#ip sla monitor <operation num> ipsla-init(config-sla-monitor)#type jitter dest-ipaddr <responder ip> dest-port <dest port> ipsla-init(config-sla-monitor-jitter)#frequency default ipsla-init(config-sla-monitor-jitter)#exit ipsla-init(config)# ip sla monitor schedule <operation num> start-time now life forever
Configuring IP SLA Initiator for UDP Jitter for VoIP
ipsla-init>enable ipsla-init#config terminal ipsla-init(config)#ip sla monitor <operation num> ipsla-init(config-sla-monitor)#type jitter dest-ipaddr <responder ip> dest-port <dest port> codec <codec type> advantage-factor 0 ipsla-init(config-sla-monitor-jitter)#frequency default ipsla-init(config-sla-monitor-jitter)#exit ipsla-init(config)# ip sla monitor schedule <operation num> start-time now life forever
Configuring IP SLA Initiator for ICMP Echo Operation
Router> enable
Router# configure terminal
Router(config)# ip sla monitor 15
Router(config-sla-monitor)# type echo protocol ipIcmpEcho
<destination-ip-address>
Router(config-sla-monitor-echo)# frequency 30
Router(config-sla-monitor-echo)# exit
Router(config)# ip sla monitor schedule 10 start-time now life forever
Router(config)# exit
Configuring the IP SLA Responder for All Cases ipsla-resp>enable ipsla-resp#config terminal ipsla-resp(config)#ip sla monitor responder
Page 560
FortiSIEM Installation Guide FortiSIEM Installation Guide
Class-Based QoS
CBQoS enables routers to enforce traffic dependent Quality of Service policies on router interfaces for to make sure that important traffic such as
VoIP and mission critical applications get their allocated network resources.
Cisco provides detailed documents for configuring IP SLA for both general traffic and VoIP ,
The CbQoS statistics are automatically reported by the router via SNMP, so no additional configuration is needs. AccelOps detects the presence of valid CBQoS MIBs and starts monitoring them.
NBAR
Cisco provides protocol discovery via NBAR configuration guide.
Make sure that the CISCO-NBAR-PROTOCOL-DISCOVERY-MIB is enabled.
Sample event generated by AccelOps
[PH_DEV_MON_CISCO_NBAR_STAT]:[eventSeverity]=PHL_INFO,[fileName]=deviceC isco.cpp,[lineNumber]=1644,[hostName]=R1.r1.accelops.com,[hostIpAddr]=10
.1.20.59,[intfName]=Ethernet0/0,[appTransportProto]=snmp,[totFlows]=4752
,[recvFlows]=3168,[sentFlows]=1584,[totBytes64]=510127,[recvBytes64]=277
614,[sentBytes64]=232513,[totBitsPerSec]=22528.000000,[recvBitsPerSec]=1
2288.000000,[sentBitsPerSec]=10240.000000,[phLogDetail]=
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Telnet Access Credentials for All Devices
These are the generic settings for providing Telnet access to your device from AccelOps
Setting
Name
Value
Telnet-generic
Device Type <select device type from drop down>
Access Protocol Telnet
Port
User Name
Password
23
A user who has permission to access the device over Telnet
The password associated with the user
Page 561
FortiSIEM Installation Guide
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Value
ssh-generic
Device Type <select device type from drop down>
Access Protocol SSH
Port 22
User Name
Password
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 562
FortiSIEM Installation Guide FortiSIEM Installation Guide
How CPU and Memory Utilization is Collected for Cisco IOS
AccelOps follows the process for collecting information about CPU utlization that is recommended by Cisco .
Monitoring Memory using PROCESS-MIB
Monitoring CPU
The OID is 1.3.6.1.4.1.9.9.109.1.1.1.1.8. The issue there are multiple CPUs – which ones to take? A sample SNMP walk for this OID looks like this
SNMPv2-SMI::enterprises.9.9.109.1.1.1.1.8.1 = Gauge32: 46
SNMPv2-SMI::enterprises.9.9.109.1.1.1.1.8.2 = Gauge32: 22
SNMPv2-SMI::enterprises.9.9.109.1.1.1.1.8.3 = Gauge32: 5
SNMPv2-SMI::enterprises.9.9.109.1.1.1.1.8.4 = Gauge32: 4
Note that there are 4 CPUs – indexed 1-4. We need to identify Control plane CPU and Data plane CPU
The cpu Id -> entity Id mapping from the following SNMP walk
SNMPv2-SMI::enterprises.9.9.109.1.1.1.1.2.1 = INTEGER: 3014
SNMPv2-SMI::enterprises.9.9.109.1.1.1.1.2.2 = INTEGER: 3001
SNMPv2-SMI::enterprises.9.9.109.1.1.1.1.2.3 = INTEGER: 1001
SNMPv2-SMI::enterprises.9.9.109.1.1.1.1.2.4 = INTEGER: 7001
This provides the following cpu Id -> entity Id mapping
1 -> 3014
2 -> 3001
3 -> 1001
4 -> 7001
The following SNMP walk provides the names for each entity Id
SNMPv2-SMI::mib-2.47.1.1.1.1.7.1001 = STRING: "Chassis 1 CPU of Module
2"
SNMPv2-SMI::mib-2.47.1.1.1.1.7.3001 = STRING: "Chassis 1 CPU of
Switching Processor 5"
SNMPv2-SMI::mib-2.47.1.1.1.1.7.3014 = STRING: "Chassis 1 CPU of Routing
Processor 5"
SNMPv2-SMI::mib-2.47.1.1.1.1.7.7001 = STRING: "Chassis 2 CPU of Module
2"
Combining all this information, we finally obtain the CPU information for each object
Page 563
FortiSIEM Installation Guide FortiSIEM Installation Guide
Chassis 1 CPU of Routing Processor 5 -> 46%
Chassis 1 CPU of Switching Processor 5 -> 22%
Chassis 1 CPU of Module 2 -> 5
Chassis 2 CPU of Module 2 -> 4%
AccelOps reports utilization per cpu utilization
[PH_DEV_MON_SYS_PER_CPU_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPerf
Job.cpp,[lineNumber]=9596,[cpuName]=Chassis 1 CPU of Routing Processor
5,[hostName]=UB-CORE-SW,[hostIpAddr]=10.11.1.2,[cpuUtil]=46.000000,[poll
Intv]=176,[phLogDetail]=
[PH_DEV_MON_SYS_PER_CPU_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPerf
Job.cpp,[lineNumber]=9596,[cpuName]=Chassis 1 CPU of Switching Processor
5,[hostName]=UB-CORE-SW,[hostIpAddr]=10.11.1.2,[cpuUtil]=22.000000,[poll
Intv]=176,[phLogDetail]=
PH_DEV_MON_SYS_PER_CPU_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPerfJ ob.cpp,[lineNumber]=9596,[cpuName]=Chassis 1 CPU of Module
2,[hostName]=UB-CORE-SW,[hostIpAddr]=10.11.1.2,[cpuUtil]=5.000000,[pollI ntv]=176,[phLogDetail]=
[PH_DEV_MON_SYS_PER_CPU_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPerf
Job.cpp,[lineNumber]=9596,[cpuName]=Chassis 2 CPU of Module
2,[hostName]=UB-CORE-SW,[hostIpAddr]=10.11.1.2,[cpuUtil]=4.000000,[pollI ntv]=176,[phLogDetail]=
To get the overall system CPU utilization, we average over “Switching and Routing CPUs”- so CPU Util = (46+22)/2 = 34%
PH_DEV_MON_SYS_CPU_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPerfJob.c
pp,[lineNumber]=9611,[cpuName]=RoutingCpu,[hostName]=UB-CORE-SW,[hostIpA ddr]=10.11.1.2,[cpuUtil]=34.0000,[pollIntv]=176,[phLogDetail]=
Monitoring Memory using PROCESS-MIB
The relevant OIDs are
Used memory OID = 1.3.6.1.4.1.9.9.48.1.1.1.6
Free memory OID = 1.3.6.1.4.1.9.9.48.1.1.1.5
Memory Util = (Used memory) / (Used memory + Free memory)
Page 564
FortiSIEM Installation Guide FortiSIEM Installation Guide
SNMPv2-SMI::enterprises.9.9.48.1.1.1.5.1 = Gauge32: 87360992 <-
Processor Memory Used
SNMPv2-SMI::enterprises.9.9.48.1.1.1.5.2 = Gauge32: 10715440 <- IO
Memory Used
SNMPv2-SMI::enterprises.9.9.48.1.1.1.6.1 = Gauge32: 2904976 <-
Processor Memory Free
SNMPv2-SMI::enterprises.9.9.48.1.1.1.6.2 = Gauge32: 1342944 <- IO
Memory Free
Therefore
Used Memory = 98,076,432
Total Memory = 102,324,352
Memory Util = 96%
Page 565
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Meraki Cloud Controller and Network Devices Configuration
What is Discovered and Monitored
Performance (Dynamic threshold based on baselines)
Settings for Access Credentials
What is Discovered and Monitored
Cisco Meraki Devices are discoverable in either of the following ways
SNMP to the Cloud Controller
SNMP to each Network Device
SNMP Traps can be sent from the Cloud Controller. Cisco Meraki Network Devices can also send logs directly to AccelOps.
Protocol
SNMP (V1, V2c) to
Cloud Controller or
Devices
Syslog from Meraki
Firewalls
SNMP Traps from
Cloud Controller
Information Discovered
Host name, Software version,
Hardware model, Network interfaces
Metrics collected
Uptime, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Firewall logs
Health
Used for
Availability and
Performance
Monitoring
Security Monitoring
Availability
Monitoring
Event Types
Interface Utilization: PH_DEV_MON_NET_INTF_UTIL
Rules
Availability (from SNMP Trap)
Meraki Device Cellular Connection Disconnected
Meraki Device Down
Meraki Device IP Conflict
Meraki Device Interface Down
Meraki Device Port Cable Error
Meraki Device VPN Connectivity Down
Meraki Foreign AP Detected
Meraki New DHCP Server
Meraki New Splash User
Meraki No DHCP lease
Meraki Rogue DHCP Server
Meraki Unreachable Device
Meraki Unreachable RADIUS Server
Meraki VPN Failover
Performance (Fixed threshold)
Network Intf Error Warning
Network Intf Error Critical
Network Intf Util Warning
Network Intf Util Critical
Performance (Dynamic threshold based on baselines)
Sudden Increase in Network Interface Traffic
Sudden Increase in Network Interface Errors
Reports
Page 566
FortiSIEM Installation Guide FortiSIEM Installation Guide
None
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 567
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco NX-OS Router and Switch Configuration
What is Discovered and Monitored
Create a Flow Template and Define the Fields to Export
Associate the Record to the Exporter Using a Flow Monitor
Apply the Flow Monitor to Every Interface
Settings for Access Credentials
What is Discovered and Monitored
Protocol
SNMP (V1,
V2c, V3)
Information Discovered
Host name, IOS version, Hardware model,
Memory size, Network interface details name, address, mask and description
SNMP (V1,
V2c, V3)
SNMP (V1,
V2c, V3)
Hardware component details: serial number, model, manufacturer, software and firmware versions of hardware components such as chassis, CPU, fan, power supply, network cards etc.
Trunk port connectivity between switches and
VLANs carried over a trunk port (via CDP
MIB), ARP table
Metrics collected
Uptime, CPU and Memory utilization, Free processor and I/O memory, Free contiguous processor and I/O memory, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Hardware health: temperature, fan and power supply
SNMP (V1,
V2c, V3)
SNMP (V1,
V2c, V3)
SNMP (V1,
V2c, V3)
BGP connectivity, neighbors, state, AS number
OSPF connectivity, neighbors, state, OSPF
Area
Telnet/SSH Running and startup configuration, Image file name, Flash memory size, Running processes
Telnet/SSH End host Layer 2 port mapping: switch interface to VLAN id, end host IP/MAC address association
Syslog Device type
BGP state change
OSPF state change
Topology and end-host location
Routing
Topology,
Availability
Monitoring
Routing
Topology,
Availability
Monitoring
QoS performance monitoring
Class based QoS metrics: For (router interface, policy, class map) tuple: class
map metrics e metrics
packets
including Pre-policy rate, post-police rate, drop rate and drop pct;
lice action metrics
including conform rate, exceeded rate and violated rate;
including current queue length, max queue length and discarded
po queu
Startup configuration change, delta between running and startup configuration,
Running process CPU and memory utilization
Performance
Monitoring,
Security and
Compliance
System logs and traffic logs matching acl statements
Used for
Availability and
Performance
Monitoring
Availability
Availability,
Security and
Compliance
Event Types
In
CMDB > Event Types
, search for "nx-os" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Page 568
FortiSIEM Installation Guide FortiSIEM Installation Guide
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Telnet/SSH
AccelOps uses Telnet/SSH to communicate with this device. Refer to the product documentation for your device to enable Telnet/SSH.
These commands are used for discovery and performance monitoring via SSH. Please make sure that the access credentials you provide in
AccelOps have the permissions necessary to execute these commands on the device.
1.
2. show startup-config show running-config
3.
4. show version show flash
5.
6. show context show ip route
7.
8. show cam dynamic show mac-address-table
9.
10. show mac address-table (for Nexus 1000v) show vlan brief
11.
12. show process cpu show process mem
13.
14. show disk0
15. enable terminal length 0
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
NetFlow
Enable NetFlow on the Router
1.
2.
Enter configuration mode.
Run this command.
feature netflow
Create a Flow Template and Define the Fields to Export
You can can also try using the pre-defined NetFlow template.
Page 569
FortiSIEM Installation Guide FortiSIEM Installation Guide
# show flow record netflow-original
Flow record netflow-original:
Description: Traditional IPv4 input NetFlow with origin ASs
No. of users: 1
Template ID: 261
Fields:
match ipv4 source address
match ipv4 destination address
match ip protocol
match ip tos
match transport source-port
match transport destination-port
match interface input
match interface output
match flow direction
collect routing source as
collect routing destination as
collect routing next-hop address ipv4
collect transport tcp flags
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
Set up Netflow Exporter
Run these commands.
flow exporter AccelOpsFlowAnalyzer description export netflow to AccelOps destination <AccelOpsIp> export Version 9 transport udp 2055 source vlan613
Associate the Record to the Exporter Using a Flow Monitor
In this example the flow monitor is called
AccelOpsMonitoring
.
Run these commands. flow monitor AccelOpsMonitoring exporter AccelOpsFlowAnalyzer record netflow-original
Page 570
FortiSIEM Installation Guide
Apply the Flow Monitor to Every Interface
Run these commands.
FortiSIEM Installation Guide interface Vlan612 ip flow monitor Monitortac7000 input exit interface Vlan613 ip flow monitor Monitortac7000 input exit
You can now check the configuration using the show
commands.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Telnet Access Credentials for All Devices
These are the generic settings for providing Telnet access to your device from AccelOps
Setting
Name
Value
Telnet-generic
Device Type <select device type from drop down>
Access Protocol Telnet
Port
User Name
Password
23
A user who has permission to access the device over Telnet
The password associated with the user
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Device Type
Value
ssh-generic
<select device type from drop down>
Access Protocol SSH
Port 22
Page 571
FortiSIEM Installation Guide
User Name
Password
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 572
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco ONS Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP
(V1, V2c)
SNMP
Trap
Host name, Serial Number, software version,
Hardware model, Network interfaces, Hardware
Components
Metrics collected
Uptime, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Alerts
Used for
Availability and
Performance
Monitoring
Availability and
Performance
Monitoring
Event Types
Over 1800 event types defined - search for "Cisco-ONS" in >
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 573
FortiSIEM Installation Guide FortiSIEM Installation Guide
Dell Force10 Router and Switch Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP (V1,
V2c)
Host name, Serial number, Software version,
Hardware model, Network interfaces, Hardware
Components
Telnet/SSH Running and Startup configurations
Metrics collected
Uptime, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), CPU utilization, Hardware Status
Startup Configuration Change, Difference between Running and Startup configurations
Event Types
In
CMDB > Event Types
, search for "force10" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
TelNet/SSH
AccelOps uses Telnet/SSH to communicate with this device. Refer to the product documentation for your device to enable Telnet/SSH.
These commands are used for discovery and performance monitoring via SSH. Please make sure that the access credentials you provide in
AccelOps have the permissions necessary to execute these commands on the device. To initiate discovery and monitoring of your device over this protocol, follow the instructions in
Setting Access Credentials for Device Discovery .
1.
2. show startup-config show running-config
3.
4. show version show ip route
5.
6. enable terminal pager 0
Settings for Access Credentials
Used for
Availability and
Performance
Monitoring
Change monitoring
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Page 574
FortiSIEM Installation Guide
Access Protocol SNMP
Community String <your own>
Telnet Access Credentials for All Devices
These are the generic settings for providing Telnet access to your device from AccelOps
Setting
Name
Device Type
Value
Telnet-generic
<select device type from drop down>
Access Protocol Telnet
Port 23
User Name
Password
A user who has permission to access the device over Telnet
The password associated with the user
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Device Type
Value
ssh-generic
<select device type from drop down>
Access Protocol SSH
Port 22
User Name
Password
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 575
FortiSIEM Installation Guide FortiSIEM Installation Guide
Dell NSeries Switch Configuration
What is Discovered and Monitored
Performance (Dynamic threshold based on baselines)
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP
(V1, V2c)
Host name, software version,
Hardware model, Network interfaces,
SNMP
(V1, V2c)
SSH
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Hardware Status (Power Supply, Fan)
Configuration
Used for
Availability and
Performance
Monitoring
Availability
Monitoring
Change management
Event Types
CPU Monitoring: PH_DEV_MON_SYS_CPU_UTIL
Memory Monitoring: PH_DEV_MON_SYS_MEM_UTIL
Interface Utilization: PH_DEV_MON_NET_INTF_UTIL
Hardware Status: PH_DEV_MON_HW_STATUS
Configuration Change: PH_DEV_MON_CHANGE_STARTUP_CONFIG
Rules
Availability
Network Device Degraded - Lossy Ping Response
Network Device Down - no ping response
Network Device Interface Flapping
Critical Network Device Interface Staying Down
Non-critical Network Device Interface Staying Down
Network Device Hardware Warning
Network Device Hardware Critical
Performance (Fixed threshold)
Network CPU Warning
Network CPU Critical
Network Memory Warning
Network Memory Critical
Network Intf Error Warning
Network Intf Error Critical
Network Intf Util Warning
Network Intf Util Critical
Performance (Dynamic threshold based on baselines)
Sudden Increase In System CPU Usage
Sudden Increase in System Memory Usage
Sudden Increase in Network Interface Traffic
Sudden Increase in Network Interface Errors
Change
Page 576
FortiSIEM Installation Guide FortiSIEM Installation Guide
Reports
Startup Config Change
Availability
Availability: Router/Switch Ping Monitor Statistics
Performance
Performance: Top Routers Ranked By CPU Utilization
Performance: Top Routers By Memory Utilization
Performance: Top Router Network Intf By Util, Error, Discards
Top Routers/Switches by Business Hours Network Ping Uptime Pct (Achieved Network Ping SLA)
Top Routers/Switches by Business Hours System Uptime Pct (Achieved System SLA)
Top Routers/Switches by Network Ping Uptime Pct (Achieved Network Ping SLA)
Top Routers/Switches by System Uptime Pct (Achieved System SLA)
Top Router Interfaces by Days-since-last-use
Change
Change: Router Config Changes Detected Via Login
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 577
FortiSIEM Installation Guide FortiSIEM Installation Guide
Dell PowerConnect Switch and Router Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP (V1,
V2c)
Host name, Serial number, Software version,
Hardware model, Network interfaces, Hardware
Components
Telnet/SSH Running and Startup configurations
Metrics collected
Uptime, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), CPU utilization, Hardware Status
Startup Configuration Change, Difference between Running and Startup configurations
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Telnet/SSH
AccelOps uses Telnet/SSH to communicate with this device. Refer to the product documentation for your device to enable Telnet/SSH.
These commands are used for discovery and performance monitoring via SSH. Please make sure that the access credentials you provide in
AccelOps have the permissions necessary to execute these commands on the device. To initiate discovery and monitoring of your device over this protocol, follow the instructions in
Setting Access Credentials for Device Discovery .
1.
2. show startup-config show running-config
3.
4. show version show ip route
5.
6. enable terminal pager 0
Settings for Access Credentials
Used for
Availability and
Performance
Monitoring
Change monitoring
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Page 578
FortiSIEM Installation Guide
Access Protocol SNMP
Community String <your own>
Telnet Access Credentials for All Devices
These are the generic settings for providing Telnet access to your device from AccelOps
Setting
Name
Device Type
Value
Telnet-generic
<select device type from drop down>
Access Protocol Telnet
Port 23
User Name
Password
A user who has permission to access the device over Telnet
The password associated with the user
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Device Type
Value
ssh-generic
<select device type from drop down>
Access Protocol SSH
Port 22
User Name
Password
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 579
FortiSIEM Installation Guide FortiSIEM Installation Guide
Foundry Networks IronWare Router and Switch Configuration
What is Discovered and Monitored
Sample Parsed PowerConnect Syslog Message
Settings for Access Credentials
What is Discovered and Monitored
Protocol
SNMP (V1,
V2c)
Information Discovered
Host name, Ironware version, Hardware model, Network interfaces,
Telnet/SSH Running and startup configuration
SNMP (V1,
V2c)
Syslog
Trunk port connectivity between switches and VLANs carried over a trunk port, End host Layer 2 port mapping: switch interface to VLAN id, end host IP/MAC address association
Device type
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Startup configuration change, delta between running and startup configuration
System logs and traffic logs matching acl statements
Used for
Availability and
Performance
Monitoring
Performance
Monitoring,
Security and
Compliance
Topology and end-host location
Availability,
Security and
Compliance
Event Types
In
CMDB > Event Types
, search for "foundry_ironware" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
1.
2.
3.
Log in to the device manager for your switch or router with administrative privileges.
Enter configuration mode.
Run these commands to set the community string and enable the SNMP service.
snmp-server community <community> RO snmp-server enable vlan <vlan id>
4.
5.
Exit config mode.
Save the configuration.
Telnet/SSH
AccelOps uses Telnet/SSH to communicate with this device. Refer to the product documentation for your device to enable Telnet/SSH.
Syslog
1.
Page 580
FortiSIEM Installation Guide FortiSIEM Installation Guide
1.
2.
3.
Log in to the device manager for your switch or router with administrative privileges.
Enter configuration mode.
Run this command to set your AccelOps virtual appliance as the recipient of syslogs from your router or switch.
logging host <AccelOps Ip>
4.
5.
Exit config mode.
Save the configuration.
Sample Parsed PowerConnect Syslog Message
<14>SJ-Dev-A-Fdy-FastIron, running-config was changed from console
<14>SJ-Dev-A11-Fdy-FastIron, startup-config was changed from telnet client 192.168.20.18
<14>SJ-Dev-A-Fdy-FastIron, phoenix_agent login to USER EXEC mode
<14>SJ-Dev-A-Fdy-FastIron, Interface ethernet3, state up
<14>SJ-Dev-A-Fdy-FastIron, Interface ethernet 20/3, state up
<12>SJ-QA-A-Fdy-BigIron, list 100 permitted udp
173.9.142.98(ntp)(Ethernet 2/1 0004.23ce.ba11) -> 172.16.20.121(ntp), 1 event(s)
<14>SJ-Dev-A-Fdy-FastIron, Bridge root changed, vlan 3, new root ID
80000004806137c6, root interface 3
<14>SJ-QA-A-Fdy-BigIron, VLAN 4 Port 2/7 STP State -> DISABLED
(PortDown)
Jun 4 15:51:18 172.16.20.99 Security: telnet logout by admin from src
IP 137.146.28.75, src MAC 000c.dbff.6d00
Jun 4 15:51:12 172.16.20.100 System: Interface ethernet 4/9, state down
Jun 4 03:12:53 172.16.20.100 ACL: ACL: List GWI-in permitted tcp
61.158.162.230(6000)(Ethernet 1/4 0023.3368.f500) -> 137.146.0.0(8082),
1 event(s)
Jun 4 02:54:31 172.16.20.100 ACL: ACL: List XCORE denied udp
137.146.28.75(55603)(Ethernet 1/1 000c.dbde.6000) -> 137.146.3.35(snmp),
1 event(s)
Jun 4 01:49:09 172.16.20.100 STP: VLAN 3104 Port 4/22 STP State ->
LEARNING (FwdDlyExpiry)
Page 581
FortiSIEM Installation Guide FortiSIEM Installation Guide
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Telnet Access Credentials for All Devices
These are the generic settings for providing Telnet access to your device from AccelOps
Setting
Name
Value
Telnet-generic
Device Type <select device type from drop down>
Access Protocol Telnet
Port
User Name
Password
23
A user who has permission to access the device over Telnet
The password associated with the user
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Value
ssh-generic
Device Type <select device type from drop down>
Access Protocol SSH
Port 22
User Name
Password
A user who has access credentials for your device over SSH
The password for the user
Page 582
FortiSIEM Installation Guide FortiSIEM Installation Guide
HP/3Com ComWare Switch Configuration
What is Discovered and Monitored
Example Syslog for ComWare Switch Messages
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP
(V1, V2c)
Host name, software version, Hardware model,
Network interfaces,
SNMP
(V1, V2c,
V3)
Syslog
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Hardware status:
Power Supply, Fan, Temperature
Hardware status: Temperature
System logs
Used for
Availability and
Performance
Monitoring
Availability
Availability,
Security and
Compliance
Event Types
In
CMDB > Event Types
, search for "compare" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Example Syslog for ComWare Switch Messages
Page 583
FortiSIEM Installation Guide FortiSIEM Installation Guide
%Apr 2 11:38:11:113 2010 H3C DEVD/3/BOARD REBOOT:Chasis 0 slot 2 need be rebooted automatically!
%Sep 22 20:38:32:947 2009 H3C DEVD/4/BRD MISPLUG: The board or subcard in slot 1 is not supported.
%Sep 22 20:38:32:947 2009 H3C DEVD/4/BRD MISPLUG: The board type of MR in 1 is different from the Mate MR's, so the MR can't work properly.
%Sep 22 20:38:32:947 2009 H3C DEVD/2/BRD TOO HOT:Temperature of the board is too high!
%Sep 22 20:38:32:947 2009 H3C DEVD/2/ FAN CHANGE: Chassis 1: Fan communication state changed: Fan 1 changed to fault.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 584
FortiSIEM Installation Guide FortiSIEM Installation Guide
HP ProCurve Switch Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol
SNMP (V1,
V2c)
Information Discovered
Host name, version, Hardware model, Network interfaces,
Telnet/SSH Running and startup configuration
SNMP (V1,
V2c)
Trunk port connectivity between switches and VLANs carried over a trunk port, End host Layer 2 port mapping: switch interface to VLAN id, end host
IP/MAC address association
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics
(utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Hardware status: Power
Supply, Fan, Temperature
Startup configuration change, delta between running and startup configuration
Used for
Availability and
Performance
Monitoring
Performance
Monitoring,
Security and
Compliance
Topology and end-host location
Event Types
In
CMDB > Event Types
, search for "procurve" in the
Device Type
and
Description
columns to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
1.
2.
3.
4.
5.
Go to
Configuration > SNMP Community > V1/V2 Community
Enter a
Community Name
For
MIB-View
Click
Add
.
, select
.
Operator
.
For Write-Access, leave the selection cleared.
.
SSH/Telnet
1.
2.
3.
Log into the device manager for your ProCurve switch.
Go to
Security > Device Passwords
.
Create a user and password for
Read-Write Access
.
4.
Although AccelOps does not modify any configurations for your switch, Read-Write Access is needed to read the device configuration.
Go to
Security > Authorized Addresses
This is an optional step.
and add the AccelOps IP to Telnet/SSH.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting Value
Page 585
FortiSIEM Installation Guide
Name
Device Type
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Telnet Access Credentials for All Devices
These are the generic settings for providing Telnet access to your device from AccelOps
Setting
Name
Device Type
Value
Telnet-generic
<select device type from drop down>
Access Protocol Telnet
Port 23
User Name
Password
A user who has permission to access the device over Telnet
The password associated with the user
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Device Type
Value
ssh-generic
<select device type from drop down>
Access Protocol SSH
Port 22
User Name
Password
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 586
FortiSIEM Installation Guide FortiSIEM Installation Guide
HP Value Series (19xx) and HP 3Com (29xx) Switch Configuration
What is Discovered and Monitored
Performance (Dynamic threshold based on baselines)
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP
(V1, V2c)
Host name, software version,
Hardware model, Network interfaces,
SSH
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Configuration
Used for
Availability and
Performance
Monitoring
Change management
Event Types
CPU Monitoring: PH_DEV_MON_SYS_CPU_UTIL
Memory Monitoring: PH_DEV_MON_SYS_MEM_UTIL
Interface Utilization: PH_DEV_MON_NET_INTF_UTIL
Configuration Change: PH_DEV_MON_CHANGE_STARTUP_CONFIG
Rules
Availability
Network Device Degraded - Lossy Ping Response
Network Device Down - no ping response
Network Device Interface Flapping
Critical Network Device Interface Staying Down
Non-critical Network Device Interface Staying Down
Performance (Fixed threshold)
Network CPU Warning
Network CPU Critical
Network Memory Warning
Network Memory Critical
Network Intf Error Warning
Network Intf Error Critical
Network Intf Util Warning
Network Intf Util Critical
Performance (Dynamic threshold based on baselines)
Sudden Increase In System CPU Usage
Sudden Increase in System Memory Usage
Sudden Increase in Network Interface Traffic
Sudden Increase in Network Interface Errors
Change
Startup Config Change
Reports
Page 587
FortiSIEM Installation Guide FortiSIEM Installation Guide
Availability
Availability: Router/Switch Ping Monitor Statistics
Performance
Performance: Top Routers Ranked By CPU Utilization
Performance: Top Routers By Memory Utilization
Performance: Top Router Network Intf By Util, Error, Discards
Top Routers/Switches by Business Hours Network Ping Uptime Pct (Achieved Network Ping SLA)
Top Routers/Switches by Business Hours System Uptime Pct (Achieved System SLA)
Top Routers/Switches by Network Ping Uptime Pct (Achieved Network Ping SLA)
Top Routers/Switches by System Uptime Pct (Achieved System SLA)
Top Router Interfaces by Days-since-last-use
Change
Change: Router Config Changes Detected Via Login
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 588
FortiSIEM Installation Guide FortiSIEM Installation Guide
Juniper Networks JunOS Switch Configuration
What is Discovered and Monitored
Sample JunOS Syslog Messages sFlow
Settings for Access Credentials
What is Discovered and Monitored
Protocol
SNMP (V1,
V2c)
Telnet/SSH Running and startup configuration
SNMP (V1,
V2c, V3)
Syslog
Trunk port connectivity between switches and VLANs carried over a trunk port, End host Layer 2 port mapping: switch interface to VLAN id, end host IP/MAC address association
System logs and traffic logs matching acl statements sflow
Information Discovered
Host name, JunOS version, Hardware model, Network interfaces,
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics
(utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Hardware status: Power Supply,
Fan, Temperature
Startup configuration change, delta between running and startup configuration
Traffic flow
Used for
Availability and
Performance
Monitoring
Performance
Monitoring,
Security and
Compliance
Topology and end-host location
Availability,
Security and
Compliance
Availability,
Security and
Compliance
Event Types
In
CMDB > Event Types
, search for "junos" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
1.
2.
3.
4.
5.
6.
Log in to the device manager for your JunOS switch with administrator privileges.
Go to
Under
Set
Click
Configure > Services > SNMP
Communities
OK
.
to
, click
Enter a
Community Name
Add
.
.
.
.
Syslog
1.
2.
3.
Log in to the device manager for your JunOS switch with administrator privileges.
Go to
Dashboard > CLI Tools > CLI Editor
.
Edit the syslog
section to send syslogs to AccelOps.
Page 589
3.
FortiSIEM Installation Guide FortiSIEM Installation Guide
JunOS Syslog Configuration
system {
....
syslog {
user * {
any emergency;
}
host <AccelOps Ip> {
any any;
explicit-priority;
}
file messages {
any notice;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
time-format year millisecond;
}
....
}
4. Click
Commit
.
Sample JunOS Syslog Messages
190>May 11 13:54:10 20.20.20.20 mgd[5518]: UI_LOGIN_EVENT: User
'phoenix_agent' login, class 'j-super-user' [5518], ssh-connection
'192.168.28.21 39109 172.16.5.64 22', client-mode 'cli'
<38>Nov 18 17:50:46 login: %AUTH-6-LOGIN_INFORMATION: User phoenix_agent logged in from host 192.168.20.116 on device ttyp0
sFlow
Routing the sFlow Datagram in EX Series Switches
According to Juniper documentation, the sFlow datagram
cannot
be routed over the management Ethernet interface ( management interface ( vme0
) i n an EX Series switch implementation me0
) or virtual
. It can only be exported over the network Gigabit Ethernet or
10-Gigabit Ethernet ports using valid route information in the routing table.
1.
2.
3.
4.
5.
6.
Log in to the device manager for your JunOS switch with administrator privileges.
Go to
Configure > CLI Tools > Point and Click CLI
.
Expand
Protocols
and select
Next to
Collector
, click
For
UDP Port
, enter
slow
.
Add new entry
.
Enter the address for your AccelOps virtual appliance.
6343
.
7.
Page 590
FortiSIEM Installation Guide FortiSIEM Installation Guide
7.
8.
9.
10.
11.
Click
Commit
.
Next to
Interfaces
, click
Enter the
Click
Commit
.
Add new entry
Interface Name
You can also disconnect the cable.
.
for all interfaces that will send traffic over sFlow.
To disable the management port, go to
Configure > Management Access
, and remove the address of the management port.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Telnet Access Credentials for All Devices
These are the generic settings for providing Telnet access to your device from AccelOps
Setting
Name
Value
Telnet-generic
Device Type <select device type from drop down>
Access Protocol Telnet
Port 23
User Name
Password
A user who has permission to access the device over Telnet
The password associated with the user
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Device Type
Value
ssh-generic
<select device type from drop down>
Access Protocol SSH
Port 22
User Name
Password
A user who has access credentials for your device over SSH
The password for the user
Page 591
FortiSIEM Installation Guide FortiSIEM Installation Guide
Mikrotek Router Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP
(V1, V2c)
Host name, software version,
Hardware model, Network interfaces
Metrics collected
Uptime, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Used for
Availability and
Performance
Monitoring
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 592
FortiSIEM Installation Guide FortiSIEM Installation Guide
Nortel ERS and Passport Switch Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP
(V1, V2c)
Host name, software version,
Hardware model, Network interfaces,
SNMP
(V1, V2c)
SNMP
(V1, V2c,
V3)
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Hardware status: Temperature
Layer 2 port mapping: associating switch ports to directly connected host IP/MAC addresses
Event Types
There are no event types defined specifically for this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Used for
Availability and
Performance
Monitoring
Identity and location table;
Topology
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 593
FortiSIEM Installation Guide
Configuring Security Gateways
AccelOps supports these security gateways for discovery and monitoring.
Barracuda Networks Spam Firewall Configuration
Blue Coat Web Proxy Configuration
Cisco IronPort Mail Gateway Configuration
McAfee Web Gateway Configuration
Microsoft ISA Server Configuration
Websense Web Filter Configuration
FortiSIEM Installation Guide
Page 594
FortiSIEM Installation Guide FortiSIEM Installation Guide
Barracuda Networks Spam Firewall Configuration
What is Discovered and Monitored
Sample Parsed Barracuda Spam Firewall Syslog Message
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP
Syslog
Host name,
Interfaces, Serial number
Metrics collected
CPU utilization, Memory utilization, Interface Utilization
Used for
Performance
Monitoring
Various syslogs - scenarios include - mail scanned and allowed/denied/quarantined etc; mail sent and reject/delivered/defer/expired; mail received and allow/abort/block/quarantined etc.
Event Types
In
CMDB > Event Types
, search for "barracuda" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Security
Monitoring and compliance
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Sample Parsed Barracuda Spam Firewall Syslog Message
Page 595
FortiSIEM Installation Guide FortiSIEM Installation Guide
<23>inbound/pass1[923]: 127.0.0.1 1300386119-473aa6a90001-sB89EM 0 0
RECV - 1 4D760309475 250 2.6.0
<E6BB7C56C6761D42AEAFBF7FC6E17E920156A38D@USNSSEXC174.us.kworld.kpmg.com
> Queued mail for delivery
<23>scan[9390]: mail.netcontentinc.net[207.65.119.227]
1300386126-4739a8be0001-R6OEVB 1300386126 1300386128 SCAN [email protected] [email protected] - 7 61 -
SZ:34602 SUBJ:How FMLA Leave, ADA and Workers' Compensation Work
Together April 28, 2011
Settings for Access Credentials
Unable to render {include} The included page could not be found.
Page 596
FortiSIEM Installation Guide FortiSIEM Installation Guide
Blue Coat Web Proxy Configuration
What is Discovered and Monitored
Sample Parsed Blue Coat Audit Syslog
Configure an Epilog client in AccelOps
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP
SNMP
Host name,
Interfaces,
Serial number
Metrics collected
CPU utilization, Memory utilization
SFTP
Syslog
Used for
Performance
Monitoring
Proxy performance: Proxy cache object count,
(KBps); Server-to-proxy metrics : HTTP traffic (KBps), Client-to-proxy metrics : HTTP requests, HTTP Cache hit,
HTTP errors, HTTP traffic (KBps);
Proxy-to-server metrics : HTTP errors, HTTP requests, HTTP traffic
Proxy-to-client metrics : HTTP traffic (KBytes)
Proxy traffic: attributes include Source IP, Destination IP, Destination Name, Destination Port, URL, Web category,
Proxy action, HTTP User Agent, HTTP Referrer, HTTP Version, HTTP Method, HTTP Status Code, Sent Bytes,
Received Bytes, Connection Duration
Admin authentication success and failure
Performance
Monitoring
Security
Monitoring and compliance
Security
Monitoring and compliance
Event Types
In
CMDB > Event Types
, search for "blue coat" in the
Device Type
and
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
The following procedures enable AccelOps to discover Bluecoat web proxy.
1.
2.
3.
4.
Log in to your Blue Coat management console.
Go to
Maintenance > SNMP
.
Under
SNMP General
, select
Enable SNMP
.
5.
Under Community Strings, click Change Read Community, and then enter a community string that AccelOps can use to access your device.
Click
OK
.
Syslog
Syslog is used by Blue Coat to send audit logs to AccelOps.
1.
2.
Log in to your Blue Coat management console.
Go to
Maintenance > Event Logging
.
3.
Page 597
FortiSIEM Installation Guide
3.
4.
5.
6.
Under
Under
Select
Click
Level
Syslog
Enable syslog.
Apply.
, select ,
, enter the IP address of your AccelOps virtual appliance for
Sample Parsed Blue Coat Audit Syslog
, and
Informational.
FortiSIEM Installation Guide
<2> Sep 14 19:24:39 ao BluecoatAuthWebLog 0 2010-09-14 14:31:13
36 34.159.60.56 hz13321 - - OBSERVED "Audio/Video Clips" - 200
TCP_NC_MISS POST application/x-fcs http 213.200.94.86 80
/idle/WdPmdz02xSLO2sHS/25136 - - "Shockwave Flash" 34.160.179.201 1087
217 -
SFTP
SFTP is used to send access logs to AccelOps. Access logs includes the traffic that Blue Coat proxies between the client and the server. The access logs are sent via FTP, where Bluecoat is the client and AccelOps is the server. You need to configure SFTP in AccelOps first, and then on your Blue Coat web proxy server.
Configure FTP in AccelOps
1.
2.
Log in to your Supervisor node as root
.
Run the
./phCreateBluecoatDestDir
command to create an FTP user account.
The files sent from Blue Coat will be temporarily stored in this account. The script will create an user called ftpuser
. If the this user already exists, you do not need to create a new one. The script will ask for the IP address of Blue Coat and the password for the user ft puser
, and will then create the directory
/opt/phoenix/cache/bluecoat/<Bluecoat IP>
.
3. Run vi /etc/passwd
to change the home directory for ftpuser
to
/opt/phoenix/cache/bluecoat
.
Change only the home directory as shown in this screenshot, do not change any other value.
Configure an Epilog client in AccelOps
The Epilog client converts each line of the log files in the
/opt/phoenix/cache/bluecoat/<Bluecoat IP>
directory in real time into a syslog, and sends it to the AccelOps parser for processing.
1.
2.
Log in to your Supervisor node as root
.
Update the Epilog configuration in
/etc/snare/epilog/epilog.conf
as shown in this code block, and then restart the epilog daemon with the
/etc/init.d/epilogd restart
command.
Output network=localhost:514 syslog=2
Input log=BluecoatWebLog:/opt/phoenix/cache/bluecoat/172.16.0.141/SG_Acce lOps_bluecoat_main.log
log=BluecoatImLog:/opt/phoenix/cache/bluecoat/172.16.0.141/SG_Accel
Ops_bluecoat_im.log
log=BluecoatImLog:/opt/phoenix/cache/bluecoat/172.16.0.141/SG_Accel
Ops_bluecoat_ssl.log
log=BluecoatP2pLog:/opt/phoenix/cache/bluecoat/172.16.0.141/SG_Acce lOps_bluecoat_p2p.log
Configure FTP in Blue Coat
Page 598
FortiSIEM Installation Guide
1.
2.
3.
4.
5.
Log in to your Blue Coat management console.
Go to
Management Console > Configuration > Access Logging > General.
Select
Enable Access Logging
.
In the left-hand navigation, select
Under
Upload Client
Logs
.
, configure these settings.
Setting
Log
Client Type
Encryption Certificate
Value
main
FTP Client
No Encryption
Keyring Signing
Save the log file as
No Signing text file
Send partial buffer after 1 seconds
Bandwidth Class <none>
6.
7.
Next to
Client Type
, click
Settings
Configure these settings.
.
Setting
Settings for
Host
Value
Primary FTP Server
IP address of your AccelOps virtual appliance
Port
Path
21
/<Blue Coat IP Address>
Username bcFtpUser
Change Primary Password Use the password you created for ftpuser in AccelOps
Filename
SG_AccelOps_bluecoat_main.log
8.
9.
10.
11.
Clear the selections
Use Secure Connections (SSL)
and
Use Local Time
.
Select
Use Pasv
.
Click
OK
.
Follow this same process to configure the settings for im, ssl and p2p.
For each of these, you will refer to a different
Filename
.
For im the file name is
SG_AccelOps_bluecoat_im.log
For ssl the file name is
SG_AccelOps_bluecoat_ssl.log
For p2p the file name is
SG_AccelOps_bluecoat_p2p.log
Sample Parsed Blue Coat Access Syslog
FortiSIEM Installation Guide
<2> Jun 25 11:15:33 SJ-QA-W-FDR-Test-01.prospect-hills.net
BluecoatWebLog 0 2010-06-25 18:13:34 2021 192.168.22.21 200 TCP_TUNNELED
820 1075 CONNECT tcp accelops.webex.com 443 / - - - NONE 172.16.0.141 -
- "WebEx Outlook Integration Http Agent" PROXIED "none" - 25.24.23.22
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Page 599
FortiSIEM Installation Guide
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
FortiSIEM Installation Guide
Page 600
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco IronPort Mail Gateway Configuration
What is Discovered and Monitored
Sample Parsed Ironport Mail Gateway Syslog
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP
Syslog
Metrics collected Used for
Ping Status, SNMP Ping Stat, Uptime, CPU Util, Mem Util, Net Intf Stat, Hardware Status
Mail attributes: attributes include MID, ICID, DCID, Sender address, Receiver Address, Mail Subject, Sent Bytes,
Attachment, Spam indicator, Virus indicator, Quarantine indicator, SMTP delivery failures and failure codes, mail action - pass, block, clean.
Security
Monitoring and compliance
Event Types
In
CMDB > Event Types
, search for "ironport-mail" in the
Display Name
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In
Analytics > Reports
, search for "ironport mail" in the
Name
and
Description
columns to see the reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Syslog
1.
2.
3.
4.
5.
Log in to your Ironport Mail Gateway device manager with administrator privileges.
Edit the Log Subscription settings.
For
For
Log Name
Protocol
, enter
, select
IronPort-Mail.
This identifies the log to AccelOps as originating from an Ironport mail gateway device.
For
Retrieval Method
, select
Syslog Push
.
6.
For
Hostname
, enter the IP address of your AccelOps virtual appliance.
UDP
.
Sample Parsed Ironport Mail Gateway Syslog
Page 601
FortiSIEM Installation Guide FortiSIEM Installation Guide
Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: MID 200257071 ready 24663 bytes from <[email protected]>
Sep 24 11:39:49 18.0.19.8 IronPort-Mail: Info: MID 1347076 ICID 346818
From: <[email protected]>
Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: Message aborted MID
200257071 Dropped by antivirus
Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: Delayed: DCID 5 MID
200257071 to RID 0 - 4.1.0 - Unknown address error ('466', ['Mailbox temporarily full.'])[]
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 602
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco IronPort Web Gateway
What is Discovered and Monitored
Sample Parsed Ironport Web Gateway Syslog
What is Discovered and Monitored
Protocol Information discovered
Syslog
Metrics collected Used for
Squid style web logs: attributes include Source IP Address, Destination Host name, Sent Bytes, Received Bytes,
HTTP User Agent, HTTP Referrer, HTTP Version, HTTP Method, HTTP Status Code, URL, HTTP Content type,
Web Category, HTTP Proxy Action
Security
Monitoring and compliance
Event Types
In
CMDB > Event Types
, search for "ironport-web" in the
Display Name
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
1.
2.
Log in to your Ironport gateway device manager with administrator privileges.
Edit the settings for Log Subscription.
Setting
Log Type
Log Name
Value
Access Logs
IronPort-Web
This identifies the log to AccelOps as originating from an IronPort web gateway device
Squid Log Style
Custom Fields
%L %B %u
Enable Log Compression Clear the selection
Retrieval Method Syslog Push
Hostname
Protocol
The IP address of your AccelOps virtual appliance
UDP
Sample Parsed Ironport Web Gateway Syslog
Page 603
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Oct 09 09:19:25 IronPort-Web: Info: 1349795965.314 92
10.163.154.153 TCP_CLIENT_REFRESH_MISS/200 70798 GET http://forefrontdl.microsoft.com/server/scanengineupdate/x86/Kaspersky/P ackage/1210090007/bases/base1b1d.kdc.cab -
DIRECT/forefrontdl.microsoft.com application/octet-stream
ALLOW_CUSTOMCAT_11-UnAuthenticated_Applications-APU_No_Auth-NONE-NONE-NO
NE-DefaultGroup
<J_Doe,6.9,-,""-"",-,-,-,-,""-"",-,-,-,""-"",-,-,""-"",""-"",-,-,IW_swup
,-,""-"",""-"",""Unknown"",""Unknown"",""-"",""-"",6156.35,0,-,""-"",""-
""> - ""09/Oct/2012:09:19:25 -0600"" 71052
""V3S;{6ADC64A3-11F9-4B04-8257-BEB541BE2975};""
Page 604
FortiSIEM Installation Guide FortiSIEM Installation Guide
McAfee Web Gateway Configuration
What is Discovered and Monitored
Sample Parsed McAffee Web Gateway Syslog Message
What is Discovered and Monitored
Protocol Information discovered
Syslog
Metrics collected Used for
Parsed event attributes: include Source IP, Destination URL, HTTP Method, HTTP User agent, HTTP
Status Code, HTTP Content Type, Blocked Reason, Risk
Security Monitoring and compliance
Event Types
In
CMDB > Event Types
, search for "mcafee_web" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps processes events from this device via syslogs sent by the device. Configure the device to send syslogs to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
For
Syslog Server,
or the server where the syslogs should be sent, enter the IP address of your AccelOps virtual appliance.
For
Port
, enter
514
.
Make sure that the syslog type is
Common Event Format
(CEF). The syslog format should be the same as that shown in the example.
Sample Parsed McAffee Web Gateway Syslog Message
[21/Feb/2012:11:44:19 -0500] """""""""""" ""10.200.11.170 200
""""GET http://abc.com/ HTTP/1.1"""" """"General News"""" """"Minimal
Risk"""" """"text/html"""" 101527 """""""" """""""" """"0""""""
[30/May/2012:10:39:44 -0400] "" 10.19.2.63 200
"GEThttp://abc.com/html.ng/site=cnn&cnn_pagetype=main&cnn_position=126x3
1_spon2&cnn_rollup=homepage&page.allowcompete=no¶ms.styles=fs&Params
.User.UserID=4fc6251c068c9f0aa51475025d0040b8&transactionID=717986062880
5012&tile=4893878838331&domId=135492 HTTP/1.1" "Web Ads, Forum/Bulletin
Boards" "MinimalRisk" "text/html" 1 "" "" "0"
Page 605
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft ISA Server Configuration
What is Discovered and Monitored
Enabling SNMP on Windows Server 2003
Enabling SNMP on Windows 7 or Windows Server 2008 R2
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Sample Microsoft ISA Server Syslog
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
SNMP Application type
WMI
Syslog(via
SNARE)
Application type, service mappings
Application type
Metrics collected
Process level metrics: CPU utilization, memory utilization
Process level metrics: uptime, CPU Utilization, Memory utilization, Read I/O, Write I/O
W3C proxy logs: attributes include Service Instance, Source IP, User, Destination IP, Destination Port, Service
Instance, Sent Bytes, Received Bytes, Connection Duration, HTTP User Agent, HTTP Referrer, HTTP Version,
HTTP Method, HTTP Status Code, URL, Source interface, Destination interface, Proxy action
Used for
Performance
Monitoring
Performance
Monitoring
Security
Monitoring and compliance
Event Types
In
CMDB > Event Types
, search for "isa server" in the
Device Type
and
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
Enabling SNMP on Windows Server 2003
SNMP is typically enabled by default on Windows Server 2003, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you need to make sure that the SNMP Management tool has been enabled for your device.
1.
2.
In the
Start
menu, go to
Administrative Tools > Services
.
Go to
Control Panel > Add or Remove Programs
.
3. Click
Add/Remove Windows Components
.
4. Select
Management and Monitoring Tools
and click
Details
.
Make sure that
Simple Network Management Tool
is selected.
If it isn't selected, select it, and then click
Next
to install.
9.
10.
11.
12.
5.
6.
7.
8.
Go to
Select and open
Click the
Select
Start > Administrative Tools > Services.
SNMP Service
Security
tab.
.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
public
that is set to
read-only.
Select
Accept SNMP packets from these hosts.
Click
Add.
13.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Page 606
FortiSIEM Installation Guide FortiSIEM Installation Guide
13.
14.
15.
Click
Click
Add
Apply
Under
.
.
SNMP Service
, click
Restart service
.
Enabling SNMP on Windows 7 or Windows Server 2008 R2
SNMP is typically enabled by default on Windows Server 2008, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you should check that SNMP Services have been enabled for your server.
1.
2.
3.
4.
9.
10.
11.
12.
5.
6.
7.
8.
13.
14.
15.
Log in to the Windows 2008 Server where you want to enable SNMP as an administrator.
In the
Under
Under
If not, click
Add Feature
, then select
In the
Click
Click
Under
Start
Add
.
Apply
menu, select
Control Panel
.
Programs
Features
Select and open
Click the
Select
.
, click
, see if
Server Manager
SNMP Service
Turn Windows features on/off
SNMP Services
is installed.
SNMP Service
Security
tab.
window, go to
, click
.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
Select
Accept SNMP packets from these hosts.
Click
Add.
public
that is set to
read-only.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Restart service
.
.
SMNP Service
and click
Next
to install the service.
Services > SNMP Services
.
WMI
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the
Domain Admin User
set up instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Page 607
FortiSIEM Installation Guide FortiSIEM Installation Guide
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
Com Security
, and then select
Properties
.
tab, and then under
Access Permissions
, click
Edit Limits
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
7.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Launch and Activation Permissions
, click
Find the user you created for the monitoring account, and make sure that user has the permission
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
Edit Limits
.
Allow
for
11.
12.
In the
Com Security
, and
Remote Activation
.
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
4.
Windows Firewall.
5.
6.
Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
Select
Windows Firewall: Allow remote administration exception.
Run cmd.exe
and enter these commands:
Page 608
6.
FortiSIEM Installation Guide FortiSIEM Installation Guide netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Syslog
Use the
Windows Agent Manager to configure sending syslogs from your device to AccelOps.
Sample Microsoft ISA Server Syslog
<13>Mar 6 20:56:03 ISA.test.local ISAWebLog 0 192.168.69.9 anonymous Mozilla/5.0 (Windows; U; Windows NT 5.2; en-GB; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 Y 2011-03-05
21:33:55 w3proxy ISA - 212.58.246.82 212.58.246.82 80
156 636 634 http TCP GET http://212.58.246.82/rss/newsonline_uk_edition/front_page/rss.xml text/html; charset=iso-8859-1 Inet 301 0x41200100 Local
Machine Req ID: 07c10445; Compression: client=No, server=No, compress rate=0% decompress rate=0% Local Host External 0x400 Allowed
2011-03-05 21:33:55 -
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 609
FortiSIEM Installation Guide FortiSIEM Installation Guide
Squid Web Proxy Configuration
What is Discovered and Monitored
Configure syslogd (or rsyslogd) to Forward the Logs to AccelOps
Sample Parsed Squid Syslog Messages
What is Discovered and Monitored
Protocol Information discovered
SNMP Host name,
Interfaces,
Serial number
Syslog
Metrics collected
CPU utilization, Memory utilization
Proxy traffic: attributes include Source IP, Destination IP, Destination Name, Destination Port, URL, Web category, Proxy action, HTTP User Agent, HTTP Referrer, HTTP Version, HTTP Method, HTTP Status Code,
Sent Bytes, Received Bytes, Connection Duration
Used for
Performance
Monitoring
Security
Monitoring and compliance
Event Types
In
CMDB > Event Types
, search for "squid" in the
Description
and
Device Type
columns to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled on the server where Squid is running, then follow the instructions in
Setting Access Credentials for Device Discovery
device discovery process.
to establish the connection between the device and AccelOps, and to initiate the
Syslog
1. Add this line to the logformat
section in
/etc/squid/squid.conf
.
logformat PHCombined %>a %>p %<A %la %lp %tr %ul %ui %un %us %ue
[%tl] %rm "%ru" HTTP/%rv %Hs %<st %>st "%{Referer}>h"
"%{User-Agent}>h" %Ss:%Sh
2. Add this line to the access_log
section in
/etc/squid/squid.conf
.
access_log syslog:LOG_LOCAL4 PHCombined
3. Restart Squid.
Page 610
FortiSIEM Installation Guide
Configure syslogd (or rsyslogd) to Forward the Logs to AccelOps
1. Modify if running rsyslog
) .
FortiSIEM Installation Guide
Local4.*
@<AccelOpsIp>
2. Restart syslogd (or rsyslogd).
Sample Parsed Squid Syslog Messages
Squid on Linux with syslog locally to forward to Accelops
<166>squid[28988]: 192.168.25.15 51734 65.54.87.157 172.16.10.40 3128
5989 - - - - - [22/Apr/2011:17:17:46 -0700] GET
"http://col.stj.s-msn.com/br/sc/js/jquery/jquery-1.4.2.min.js" HTTP/1.1
200 26141 407 "http://www.msn.com/" "Mozilla/5.0 (Windows; U; Windows NT
6.1; en-US; rv:1.9.2.16) Gecko/20110319 Firefox/3.6.16" TCP_MISS:DIRECT
Squid on Linux with syslog-ng locally to forward to Accelops
<166>Oct 20 09:21:54 QA-V-CentOS-Syslog-ng squid[7082]: 192.168.20.42
1107 74.125.19.100 172.16.10.34 3128 291 - - - - - [20/Oct/2009:09:21:54
-0700] GET "http://clients1.google.com/generate_204" HTTP/1.1 204 387
603 "http://www.google.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows
NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"
TCP_MISS:DIRECT
Squid on Linux with syslog locally and forward to syslog-ng remotely to forward to Accelops
<166>Oct 20 10:21:42 172.16.10.40 squid[26033]: 192.168.20.42 1121
66.235.132.121 172.16.10.40 3128 117 - - - - - [20/Oct/2009:12:05:49
\-0700|] GET
"http://metrics.sun.com/b/ss/sunglobal,suncom,sunstruppdev/1/H.14/s21779
365053734?" HTTP/1.1 200 746 1177 "http://www.sun.com/" "Mozilla/4.0
(compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729)" TCP_MISS:DIRECT
Squid on Linux with syslog-ng locally and forward to syslog-ng remotely to forward to Accelops
Page 611
FortiSIEM Installation Guide FortiSIEM Installation Guide
<166>Oct 20 12:44:12 172.16.10.40 squid[26033]: 192.168.20.42 1125
64.213.38.80 172.16.10.40 3128 117 - - - - - [20/Oct/2009:12:44:12
-0700] GET
"http://www-cdn.sun.com/images/hp5/hp5b_enterprise_10-19-09.jpg"
HTTP/1.1 200 12271 520 "http://www.sun.com/" "Mozilla/4.0 (compatible;
MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152;
.NET CLR 3.5.30729)" TCP_MISS:DIRECT
Squid on Solaris with syslog locally to forward to Accelops
<166>May 6 17:55:48 squid[1773]: [ID 702911 local4.info] 192.168.20.39
1715 72.14.223.18 172.16.10.6 3128 674 - - - - - [06/May/2008:17:55:48
-0700] GET "http://mail.google.com/mail/?" HTTP/1.1 302 1061 568
"http://www.google.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14" TCP_MISS:DIRECT
Squid on Solaris with syslog locally and forward to syslog-ng remotely to forward to Accelops
<166>Oct 20 13:02:19 172.16.10.6 squid[687]: [ID 702911 local4.info]
192.168.20.42 1112 208.92.236.184 172.16.10.6 3128 201 - - - - -
[20/Oct/2009:13:02:19 -0700] GET
"http://m.webtrends.com/dcs4f6vsz99k7mayiw2jzupyr_1s2e/dcs.gif?"
HTTP/1.1 200 685 1604 "http://www.microsoft.com/en/us/default.aspx"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727;
.NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" TCP_MISS:DIRECT
Page 612
FortiSIEM Installation Guide FortiSIEM Installation Guide
Websense Web Filter Configuration
What is Discovered and Monitored
Sample Parsed Websense Web Filter Syslog Message
What is Discovered and Monitored
Protocol Information discovered
Syslog
Metrics collected
Parsed event attributes: include Source IP, Destination Name, Destination URL, HTTP Method, HTTP User agent, HTTP Status Code, HTTP Content Type, Blocked Reason, Website category, HTTP Disposition, Sent
Bytes, Recv Bytes, Duration, File Type etc
Used for
Event Types
In
CMDB > Event Types
, search for "web sense_mail" in the
Display Name
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
AccelOps integrates with Websense Web Filter via syslogs sent in the SIEM integration format as described in the Websense SEIM guide.
See page 22 for instructions on how to install a Websense Multiplexer that integrates with Websense Policy server and creates syslog for consumption by SIEM products such as AccelOps.
Sample Parsed Websense Web Filter Syslog Message
Security
Monitoring and compliance
<159>Feb 28 14:25:32 10.203.28.21 vendor=Websense product=Security product_version=7.7.0 action=permitted severity=1 category=153 user=- src_host=10.64.134.74 src_port=62189 dst_host=mail.google.com
dst_ip=74.125.224.53 dst_port=443 bytes_out=197 bytes_in=76 http_response=200 http_method=CONNECT http_content_type= - http_user_agent=Mozilla/5.0_(Windows;_U;_Windows_NT_6.1;_enUS;_rv:1.9.2.
23)_Gecko/20110920_Firefox/3.6.23 http_proxy_status_code=200 reason=- disposition=1034 policy=- role=8 duration=0 url=https://mail.google.com
Page 613
FortiSIEM Installation Guide FortiSIEM Installation Guide
Fortinet FortiWeb
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information discovered
SNMP Host Name, Vendor, Model, Version,
Hardware Model, hardware
Syslog
Metrics collected
CPU, memory, Disk, Interface, Uptime
System events (e.g. configuration changes), System up/down/restart events,
Performance issues, Admin logon events, Security exploits
Supported Syslog format
Currently FortiSIEM supports FortiWeb native logging format and not CEF format.
Event Types
In
CMDB > Event Types
, search for "fortiweb" to see the event types associated with this device.
Rules
In
Analytics > Rules
, search for "fortiweb" to see the rules associated with this device.
For generic availability rules, see
Analytics > Rules > Availability > Network
For generic performance rules, see
Analytics > Rules > Performance > Network
Reports
In
CMDB > Reports
, search for "fortiweb" to see the reports associated with this device.
Configuration
Syslog
Configure FortiWenb appliance to send logs to FortiSIEM. Make sure the format matches.
Sample FortiWeb Syslog
Used for
Performance monitoring
Security Monitoring and compliance date=2016-02-18 time=10:00:05 log_id=00001002 msg_id=000067508821 device_id=FV400D3A15000010 vd="root" timezone="(GMT+3:00)Baghdad" type=event subtype="admin" pri=information trigger_policy="" user=admin ui=GUI action=edit status=success msg="User admin changed global from
GUI(172.22.6.66)
Page 614
FortiSIEM Installation Guide FortiSIEM Installation Guide
Fortinet FortiMail
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information discovered
Syslog
Metrics collected
System events (e.g. configuration changes), System up/down/restart events, Performance issues,
Admin logon events, malware attachments
Used for
Security Monitoring and compliance
Event Types
In
CMDB > Event Types
, search for "fortimail" to see the event types associated with this device.
Rules
In
CMDB > Rules
, search for "fortimail" to see the rules associated with this device.
For generic availability rules, see
Analytics > Rules > Availability > Network
For generic performance rules, see
Analytics > Rules > Performance > Network
Reports
In
Analytics > Reports
, search for "fortimail" to see the reports associated with this device.
Configuration
Syslog
Configure FortiMail appliance to send logs to FortiSIEM. Make sure the format matches.
Sample Parsed FortiMail Syslog
date=2012-08-17 time=12:26:41 device_id=FE100C3909600504 log_id=0001001623 type=event subtype=admin pri=information user=admin ui=GUI(172.20.120.26) action=login status=success reason=none msg="User admin login successfully from GUI(172.20.120.26)" date=2012-07-16 time=12:22:56 device_id=FE100C3909600504 log_id=0200001075 type=statistics pri=information session_id="q6GJMuPu003642-q6GJMuPv003642" client_name="[172.20.140.94]" dst_ip="172.20.140.92" endpoint="" from="[email protected]" to="[email protected]" subject=""mailer="mta" resolved="OK" direction="in" virus="" disposition="Reject" classifier="Recipient
Verification" message_length="188"
Page 615
FortiSIEM Installation Guide
Configuring Servers
AccelOps supports these servers for discovery and monitoring.
IBM OS400 Server Configuration
Microsoft Windows Server Configuration
Sun Solaris Server Configuration
FortiSIEM Installation Guide
Page 616
FortiSIEM Installation Guide FortiSIEM Installation Guide
HP UX Server Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP
SSH
Host name, generic hardware (cpu, memory, network interface, disk), software (operating system version, installed software, running processes, open
TCP/UDP ports)
Hardware
(cpu details, memory
)
Metrics collected
Uptime, CPU/Memory/Network Interface/Disk space utilization, Network
Interface Errors, Running Process Count, Installed Software change,
Running process CPU/memory utilization, Running process start/stop,
TCP/UDP port up/down
Memory paging rate, Disk I/O utilization
Syslog Vendor, Model General logs including Authentication Success/Failure, Privileged logons,
User/Group Modification
Used for
Performance
Monitoring
Performance
Monitoring
Security
Monitoring and
Compliance
Event Types
In
CMDB > Event Types
, search for "hp_ux" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "hp_ux" in the Name column to see the reports associated with this device.
Configuration
SNMP v1 and v2c
1. Make sure that snmp libraries are installed. Accelops has been tested to work with the default HP UX package that comes with snmpd
2.
3. preinstalled.
Start snmpd deamon with the default configuration by issuing
Make sure that snmpd is running.
/etc/init.d/snmpd restart
.
SSH
1.
2.
Make sure that the vmstat
and iostat
commands are available. If not, install these libraries.
Create a user account that can issue vmstat
and iostat
commands. AccelOps will use that user account to login to the server.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Page 617
FortiSIEM Installation Guide
Community String <your own>
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Device Type
Value
ssh-generic
<select device type from drop down>
Access Protocol SSH
Port
User Name
Password
22
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 618
FortiSIEM Installation Guide FortiSIEM Installation Guide
IBM AIX Server Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, generic hardware (cpu, memory, network interface, disk), software (operating system version, installed software, running processes, open
TCP/UDP ports)
SSH Hardware
(cpu details, memory
)
Metrics collected
Uptime, CPU/Memory/Network Interface/Disk space utilization, Network
Interface Errors, Running Process Count, Installed Software change,
Running process CPU/memory utilization, Running process start/stop,
TCP/UDP port up/down
Memory paging rate, Disk I/O utilization
Syslog Vendor, Model General logs including Authentication Success/Failure, Privileged logons,
User/Group Modification
Used for
Performance
Monitoring
Performance
Monitoring
Security
Monitoring and
Compliance
Event Types
In
CMDB > Event Types
, search for "ibm_aix" in the
Device Type
and
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP v1 and v2c
1. Make sure that snmp libraries are installed. Accelops has been tested to work with the default AIX package that comes with snmpd
2.
3. preinstalled.
Start snmpd deamon with the default configuration by issuing
Make sure that snmpd is running.
/etc/init.d/snmpd restart
.
SSH
1.
2.
Make sure that the vmstat
and iostat
commands are available. If not, install these libraries.
Create a user account that can issue vmstat and iostat
commands. AccelOps will use that user account to log in to the server.
Syslog
1. Makes sure that
/etc/syslog.conf
contains a
*.*
entry and points to a log file.
.
@<SENSORIPADDRESS>
2. Refresh syslogd.
# refresh -s syslogd
Settings for Access Credentials
SNMP Access Credentials for All Devices
Page 619
FortiSIEM Installation Guide FortiSIEM Installation Guide
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Device Type
Value
ssh-generic
<select device type from drop down>
Access Protocol SSH
Port 22
User Name
Password
A user who has access credentials for your device over SSH
The password for the user
Page 620
FortiSIEM Installation Guide FortiSIEM Installation Guide
IBM OS400 Server Configuration
What is Discovered and Monitored
Sample Parsed IBM OS400 Syslog Messages
What is Discovered and Monitored
Protocol Information
Discovered
Syslog
Metrics collected Used for
General logs including Authentication Success/Failure, Privileged logons, User/Group
Modification
Security Monitoring and
Compliance
Event Types
In
CMDB > Event Types
, search for "os400" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
AccelOps parses IBM OS 400 logs received via the PowerTech Agent as described here . The PowerTech agent sends syslogs to AccelOps.
Sample Parsed IBM OS400 Syslog Messages
Page 621
FortiSIEM Installation Guide FortiSIEM Installation Guide
Mar 18 17:49:36 ROBINSON CEF :0|PowerTech|Interact|2.0|UNA0603|A File
Server transaction was allowed for user BRENDAN.|2| src =10.0.1.60 dst
=10.0.1.180 msg=TYPE:JRN CLS :AUD JJOB :QPWFSERVSO JUSER :BRENDAN JNBR
:025355 PGM :PLKR108JEL OBJECT : LIBRARY : MEMBER: DETAIL: OB BRENDAN
*FILESRV CRTSTRMFIL QPWFSERVSO LNS0811 000112 00023
/home/BRENDAN/subfolder
Mar 18 17:48:36 ROBINSON CEF :0|PowerTech|Interact|2.0|UNA0604|A File
Server transaction was allowed for user BRENDAN.|2| src =10.0.1.60 dst
=10.0.1.180 msg=TYPE:JRN CLS :AUD JJOB :QPWFSERVSO JUSER :BRENDAN JNBR
:025355 PGM :PLKR108JEL OBJECT : LIBRARY : MEMBER: DETAIL: OB BRENDAN
*FILESRV DLTSTRMFIL QPWFSERVSO LNS0811 000112 00025
/home/BRENDAN/BoardReport
Mar 18 17:53:00 ROBINSON CEF :0|PowerTech|Interact|2.0|UNA0703|A System i FTP Client transaction was allowed for user BRENDAN.|3| src
=10.0.1.180 dst =10.0.1.180 msg=TYPE:JRN CLS :AUD JJOB :QTFTP00149 JUSER
:BRENDAN JNBR :029256 PGM :PLKR108JEL OBJECT : LIBRARY : MEMBER: DETAIL:
ST BRENDAN *FTPCLIENT DELETEFILE QTFTP00149 LNS0811 000112 00033
/QSYS.LIB/PAYROLL.LIB/NEVADA.FILE
Page 622
FortiSIEM Installation Guide FortiSIEM Installation Guide
Linux Server Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol
SNMP
SSH
Information Discovered
Host name, generic hardware (cpu, memory, network interface, disk), software (operating system version, installed software, running processes, open TCP/UDP ports)
OS type, Hardware
(cpu details, memory
)
Metrics collected
Uptime, CPU/Memory/Network Interface/Disk space utilization, Swap space utilization, Network Interface Errors, Running Process Count,
Installed Software change, Running process CPU/memory utilization,
Running process start/stop, TCP/UDP port up/down
Memory paging rate, Disk I/O utilization
Syslog
Syslog (via
AccelOps
LinuxFileMon agent)
Vendor, Model General logs including Authentication Success/Failure, Privileged logons, User/Group Modification
File or directory change: User, Type of change, directory or file name
Event Types
In
CMDB > Event Types
, search for "linux" in the
Description
column to see the event types associated with this device.
Rules
In
Analytics > Rules
, search for "linux" in the
Name
column to see the rules associated with this device.
Reports
In Analytics > Reports, search for "linux" in the Name column to see the reports associated with this device.
Configuration
SNMP v1 and v2c
1.
2.
3.
Make sure that snmp libraries are installed. AccelOps has been tested to work with net-snmp libraries.
Log in to your server with administrative access.
Make these modifications to the
/etc/snmp/snmpd.conf
file: a. b.
Define the community string for AccelOps usage and permit snmp access from AccelOps IP.
Allow AccelOps read-only access to the mib-2
tree.
c. d.
Allow Accelops read-only access to the enterprise MIB:
UCD-SNMP-MIB
.
4.
Open up the entire tree for read-only view.
Reduce the logging level to avoid per connection logging which may cause resource issues (see here for more details) a. b.
Edit /etc/sysconfig/snmpd (on RedHat/CentOS) or /etc/defaults/snmpd (on Debian/Ubuntu)
Look for the line that passes the command line options to snmpd. On RedHat Enterprise 6 this looks like
Used for
Performance
Monitoring
Performance
Monitoring
Security
Monitoring and
Compliance
Security
Monitoring and
Compliance
# snmpd command line options
OPTIONS="-LS0-6d -Lf /dev/null -p /var/run/snmpd.pid" c. Change the range from 0-6 to 0-5
Page 623
4. c.
FortiSIEM Installation Guide FortiSIEM Installation Guide
# snmpd command line options
OPTIONS="-LS0-5d -Lf /dev/null -p /var/run/snmpd.pid"
5.
6.
7.
Restart the snmpd deamon by issuing
/etc/init.d/snmpd restart
.
Add the snmpd daemon to start from boot by issuing
Make sure that snmpd is running.
chkconfig snmpd on
.
SNMP v3
Configuring rwcommunity/rocommunity or com2sec
1.
2.
Log in to your Linux server.
Stop SNMP.
service snmpd stop
3. Use vi to edit the
/etc/snmp/snmpd.conf
file.
Before you edit this file, make sure you have created a backup, as it is very important to have a valid version of this file so the snap daemon has correct credentials. vi /etc/snmp/snmpd.conf
4.
5.
6.
At the end of the file, add this line, substituting your username for
Save the file.
snmpv3user <> rouser <snmpv3user>.
Use vi to edit the
/var/lib/snmp/snmpd.conf
file.
Before you edit this file, make sure you have created a backup, as it is very important to have a valid version of this file for the SNMP daemon to function correctly. vi /var/lib/snmp/snmpd.conf
7. At the end of the file, add this line, entering the username you entered in step 4, and then passwords for that user for MD5 and DES.
If you want to use SHA or AES, then add those credentials as well.
createUser <snmpv3user> MD5 <snmpv3md5password> DES
<snmpv3despassword>
8.
9.
Save the file.
Reduce the logging level to avoid per connection logging which may cause resource issues (see a. b. here for more details)
Edit /etc/sysconfig/snmpd (on RedHat/CentOS) or /etc/defaults/snmpd (on Debian/Ubuntu)
Look for the line that passes the command line options to snmpd. On RedHat Enterprise 6 this looks like
# snmpd command line options
OPTIONS="-LS0-6d -Lf /dev/null -p /var/run/snmpd.pid"
Page 624
9. b.
FortiSIEM Installation Guide FortiSIEM Installation Guide c. Change the range from 0-6 to 0-5
# snmpd command line options
OPTIONS="-LS0-5d -Lf /dev/null -p /var/run/snmpd.pid"
10. Restart SNMP.
service snmpd start chkconfig auditd on
11. View the contents of the
/var/lib/snmp/snmpd.conf
file.
If this works, restarting snmpd will have no errors, also the entry that you created under
/var/lib/snmp/snmpd.conf
will be removed cat /var/lib/snmp/snmpd.conf.
12. Run snmpwalk -v 3 -u <snmpv3user> -l authpriv <IP> -a MD5 -A <snmpv3md5password> -x DES -X <snmpv3des password>
.
You will see your snmpwalk if this works, if there are any errors after this please reference net-snmp for further instructions.
Configuring net-smnp-devel
If you havenet-snmp-devel on your Linux server/client, follow these steps to configure SNMP v3.
1. Stop SNMP.
service snmpd stop
2. Run net-snmp-config --create-snmpv3-user -ro -A <MD5passwordhere> -X <DESpasswordhere> -x DES -a MD5
<SNMPUSERNAME>.
3. Restart SNMP.
service snmpd start
4. Test by following step 10 from above.
SSH
1.
2.
Make sure that the vmstat
and iostat
Create a user account that can issue
commands are available. If not, install these libraries.
vmstat
and iostat
commands. AccelOps will use that user account to log in to the server.
Syslog
AccelOps uses the LinuxFileMon monitoring agent to detect user activity and create syslogs. When a change as defined in the configuration file is detected, the agent gets the user information from the Audit module and sends a syslog to AccelOps. You will need to install the agent on your
Linux server to send syslogs to AccelOps.
1. Log in to your server as root
.
2.
Page 625
FortiSIEM Installation Guide FortiSIEM Installation Guide
2. Install the audit service.
This is needed for obtaining user information. For more information about Linux audit files, see this blog post .
yum install audit
3. Start the audit service.
service auditd start chkconfig auditd on
4. Copy the
LinuxFileMon
executable from the AccelOps
/opt/phoenix/bin
directory to any location on the server.
This is the agent that monitors the file changes.
5. Edit the LinuxFileMon configuration file linuxFileMon.conf
as shown here.
The file should be in the same directory as the executable.
# destIP is the IP address of AccelOps and must be the first line
[destIP]=127.0.0.1
# directories or files to monitor - path must be absolute
# Monitored Actions are All, Open, Close, Create, Modify, Delete,
Attrib
# Multiple lines must be in different lines
[object]=/tmp/test2/,Open,Delete,Close
[object]=/tmp/test/,All
[object]=/home/bin/LinuxFileMon/test,All
6. Start the LinuxFileMon agent.
Sample Parsed Linux Syslog Message
Mon Oct 18 16:26:25 2010 PowerEdgeSC440A:
[LINUX_FILE_CHANGE|LINUX_FILE_CHANGE]:
[objectType]=Dir,[objectName]=/home/phoenix_dev/projects/phoenix/src/cpp
/extAgents/linuxFileMon/,[objectAction]=ACCESS,[targetObjType]=File,[tar getObjName]="test",[user]=admin
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Page 626
FortiSIEM Installation Guide
Access Protocol SNMP
Community String <your own>
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Device Type
Value
ssh-generic
<select device type from drop down>
Access Protocol SSH
Port 22
User Name
Password
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 627
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft Windows Server Configuration
What is Discovered and Monitored
Enabling SNMP on Windows Server 2003
Enabling SNMP on Windows 7 or Windows Server 2008 R2
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Configuring the Security Audit Logging Policy
Configuring the File Auditing Policy
What is Discovered and Monitored
Metrics in bold are unique to Microsoft Windows Server monitoring.
Installed Software Monitored via SNMP
Although information about installed software is available via both SNMP and WMI, AccelOps uses SNMP to obtain installed software information to avoid an issue in Microsoft's WMI implementation for the Win32_Product WMI class - see indicating that the Windows Installer has reconfigured all installed applications.
Microsoft KB 974524 article for more information. Because of this bug, WMI calls to the Win32_Product class create many unnecessary Windows event log messages
Winexe execution and its effect
AccelOps uses the
winexe
command during discovery and monitoring of Windows servers for the following purposes
1.
2.
3.
Windows domain controller diagnostic (dcdiag) and replication monitoring (repadmin /replsummary)
HyperV Performance Monitoring
Windows Custom performance monitoring – to run a command (e.g. powershell) remotely on windows systems
Note that running the winexe command remotely will automatically install the winexesvc command on the windows server.
Protocol Information Discovered
SNMP Host name, generic hardware (cpu, memory, network interface, disk), software (operating system version,
i nstalled software
, running processes, open
TCP/UDP ports)
SNMP
vendor specific server hardware (hardware model, hardware serial number, fans, power supply, disk, raid battery). Currently supported vendors include HP and Dell
WMI Win32_ComputerSystem: Host name, OS
Win32_WindowsProductActivation: OS Serial
Number
Win32_OperatingSystem: Memory, Uptime
Win32_BIOS: B
ios
Win32_Processor: CPU
Win32_LogicalDisk: Disk info
Win32_NetworkAdapterConfiguration: network interface
Win32_Service: Services
Metrics collected
Uptime, Overall CPU/Memory/Network Interface/Disk space utilization,
Network Interface Errors, Running Process Count,
Installed Software change
, Running process CPU/memory utilization, Running process start/stop,
TCP/UDP port up/down
,
Hardware module status - fan, power supply, thermal status, battery,
disk, memory . Currently supported vendors include HP and Dell
Win32_OperatingSystem: Uptime
Win32_PerfRawData_PerfOS_Processor: Detailed CPU utilization
Win32_PerfRawData_PerfOS_Memory: Memory utilization, paging/swapping metrics
Win32_LogicalDisk: Disk space utilization
Win32_PerfRawData_PerfOS_PagingFile: Paging file utilization
Win32_PerfRawData_PerfDisk_LogicalDisk: Disk I/O metrics
Win32_PerfRawData_Tcpip_NetworkInterface: Network Interface utilization
Win32_Service: Running process uptime, start/stop status
Win32_Process, Win32_PerfRawData_PerfProc_Process: Process
I/O
Used for
Performance
Monitoring
Performance
Monitoring
Win32_QuickFixEngineering: Installed Patches
Page 628
FortiSIEM Installation Guide FortiSIEM Installation Guide
WMI
Snare agent
Correlog agent
AccelOps
Agent
Security, Application and System Event Logs including logon, file/folder edits, network traffic (Win32_NTLogEvent)
Security, Application and System Event Logs including logon, file/folder edits, network traffic (Win32_NTLogEvent)
Security, Application and System Event Logs ncluding logon, file/folder edits, network traffic (Win32_NTLogEvent)
Security, Application and System Event Logs, DNS, DHCP, IIS, DFS logs,
Custom log files, File Integrity Monitoring, Registry Change Monitoring,
Installed Software Change Monitoring, WMI and Powershell output monitoring
Security and
Compliance
Security and
Compliance
Security and
Compliance
Security and
Compliance
Event Types
In
CMDB > Event Types
device.
, search for "windows server" in the
Description
column to see the event types associated with this application or
Rules
In
Analytics > Rules
, search for "windows server"in the
Name
column to see the rules associated with this application or device.
Reports
In Analytics > Reports, search for "windows server" in the Name column to see the reports associated with this application or device.
Configuration
SNMP
Enabling SNMP on Windows Server 2003
SNMP is typically enabled by default on Windows Server 2003, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you need to make sure that the SNMP Management tool has been enabled for your device.
1.
2.
In the
Start
menu, go to
Administrative Tools > Services
.
Go to
Control Panel > Add or Remove Programs
.
3. Click
Add/Remove Windows Components
.
4. Select
Management and Monitoring Tools
and click
Details
.
Make sure that
Simple Network Management Tool
is selected.
If it isn't selected, select it, and then click
Next
to install.
9.
10.
11.
12.
5.
6.
7.
8.
Go to Start > Administrative Tools > Services.
Select and open
SNMP Service
.
Click the
Select
Security
tab.
Send authentication trap
.
Under
Accepted communities
, make sure there is an entry for
public
that is set to
15.
Click
Click
Add
.
Apply
Under
.
SNMP Service
, click
read-only.
13.
14.
Select
Accept SNMP packets from these hosts.
Click
Add.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Restart service
.
Enabling SNMP on Windows 7 or Windows Server 2008 R2
SNMP is typically enabled by default on Windows Server 2008, but you will still need to add AccelOps to the hosts that are authorized to accept
SNMP packets. First you should check that SNMP Services have been enabled for your server.
1.
2.
3.
4.
Log in to the Windows 2008 Server where you want to enable SNMP as an administrator.
In the
Under
Under
Start
menu, select
Control Panel
.
Programs
Features
, click
, see if
Turn Windows features on/off
SNMP Services
is installed.
If not, click
Add Feature
, then select
.
SMNP Service
and click
Next
Services > SNMP Services
.
to install the service.
9.
10.
11.
12.
5.
6.
7.
8.
In the
Select and open
Click the
Select
Under
Server Manager
SNMP Service
Security
tab.
window, go to
Accepted communities
.
Send authentication trap
.
, make sure there is an entry for
Select
Accept SNMP packets from these hosts.
Click
Add.
public
that is set to
read-only.
Page 629
FortiSIEM Installation Guide FortiSIEM Installation Guide
12.
13.
14.
15.
Enter the
IP address
for your AccelOps virtual appliance that will access your device over SNMP.
Click
Click
Add
Under
.
Apply
.
SNMP Service
, click
Restart service
.
WMI
Configuring WMI on your device so AccelOps can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Creating a User Who Belongs to the Domain Administrator Group
Creating a Generic User Who Does Not Belong to the Local Administrator Group
Log in to the machine you want to monitor with an administrator account.
Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups
.
Add User
.
Add to group
.
5.
6.
Right-click
Users
and select
Create a user.
Go to
Groups
, right-click
Distributed COM Users
, and then click
7.
8.
In the
Distributed COM Users Properties
dialog, click
Add
.
Find the user you created, and then click
OK
.
This is the account you will need to use in setting up the Performance Monitor Users group permissions.
Click
OK
in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
Repeat steps 4 through 7 for the Performance Monitor Users group.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
4.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
Select the
My Computer
COM Security
Allowed.
, and then
Properties
.
tab, and then under
Access Permissions
, click
Make sure that the
Distributed COM Users
group and the
Edit Limits
.
Performance Monitor Users
group have
Local Access
and
Remote
5.
6.
7.
Access
set to
Click
OK
.
Under
Access Permissions,
click
EditDefault
.
Make sure that the
Distributed COM Users
group and the
Allowed.
Performance Monitor Users
group have
Local Access
and
Remote
8.
9.
10.
Access
set to
Click
OK.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Limits
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
11.
12.
13.
Click
OK
.
Under
Launch and Activation Permissions
Make sure that the
Distributed COM Users
,
, click group and the
, and
Edit Defaults
.
Performance Monitor Users
Remote Activation
.
group have the permissions
Allow
for
Local
See the sections on
Enabling WMI Privileges
and
Allowing WMI Access through the Windows Firewall
in the
Domain Admin User
set up instructions for the remaining steps to configure WMI.
Creating a User Who Belongs to the Domain Administrator Group
Log in to the Domain Controller with an administrator account.
Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users
.
Right-click
Go to
For
Click
OK
Click .
Users
Groups
and select
, right-click
Add User
.
Create a user for the @accelops.com domain.
For example,
.
Administrators
, and then click
In the Domain Admins Properties dialog, select the
Enter the object names to select
, enter the user you created in step 3. to close the Domain Admins Properties dialog.
OK
Enable the Monitoring Account to Access the Monitored Device
Add to Group
.
Members
tab, and then click
Add
.
Log in to the machine you want to monitor with an administrator account.
Enable DCOM Permissions for the Monitoring Account
1.
2.
3.
Go to
Start > Control Panel > Administrative Tools > Component Services
.
Right-click
My Computer
, and then select
Properties
.
Select the
Com Security
tab, and then under
Access Permissions
, click
Edit Limits
.
4.
Page 630
FortiSIEM Installation Guide FortiSIEM Installation Guide
4. Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
5.
6.
mote Access
.
7.
Click
OK
.
In the
Com Security
tab, under
Access Permissions
, click
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for both
8.
9.
10.
mote Access
.
Click
OK
.
In the
Com Security
tab, under
Launch and Activation Permissions
, click
Find the user you created for the monitoring account, and make sure that user has the permission
, and
Remote Activation
.
tab, under
Launch and Activation Permissions
, click
Edit Limits
.
Allow
for
11.
12.
In the
Com Security
, and
Remote Activation
.
Edit Defaults
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account Privileges in WMI
Local Access
and
Re
Local Access
and
Re
The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.
1.
2.
3.
4.
5.
6.
11.
12.
Go to
Select
Start > Control Panel > Administrative Tools > Computer Management > Services and Applications
WMI Control
, and then right-click and select
Select the
Security
tab.
Expand the
Root
directory and select
Properties
.
.
Select the user you created for the monitoring account, and then click
Edit
.
In the
Apply onto
menu, select
This namespace and subnamespaces
.
Click
OK
Select
Services and Applications
Windows Management Instrumentation
, select
, and then click
Services
Restart
.
.
Click
Security
CIMV2
.
.
Find the user you created for the monitoring account, and make sure that user has the permission
Allow
for
Enable Account
and
Remot
7.
8.
9.
10.
e Enable
.
Click
Advanced
13.
Click
OK
to close the Permission Entry for CIMV2 dialog.
to close the Advanced Security Settings for CIMV2 dialog.
In the left-hand navigation, under
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
.
1.
2.
In the
Start
menu, select
Run gpedit.msc
.
Run
.
3. Go to
Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections >
4.
Windows Firewall.
Select
Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
5.
6.
Select Windows Firewall: Allow remote administration exception.
Run cmd.exe
and enter these commands: netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135" netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP
7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
1.
2.
3.
Go to
Control Panel > Windows Firewall
.
In the left-hand navigation, click
Select
Allow a program or feature through Windows Firewall
Windows Management Instrumentation
, and the click
OK
.
.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Syslog
Use the
Windows Agent Manager to configure sending syslogs from your device to AccelOps.
Sample Windows Server Syslog
Page 631
FortiSIEM Installation Guide FortiSIEM Installation Guide
<108>2014 Dec 17 15:05:47 CorreLog_Win_Agent 1NDCITVWCVLT05.tsi.lan
Login Monitor: Local Console User Login: User Name: weighalll-admin
Configuring the Security Audit Logging Policy
Because Windows generates a lot of security logs, you should specify the categories of events that you want logged and available for monitoring by AccelOps.
1.
2.
3.
4.
Log in the machine where you want to configure the policy as an administrator.
Go to
Programs > Administrative Tools > Local Security Policy
.
Expand
Local Policies
and select
Audit Policy
You will see the current security audit settings.
Selet a policy and edit the
.
Local Security Settings
Recommended settings are:
for the events you want audited.
Policy
Audit account logon
events and Audit
logon events
Description
For auditing logon activity
Audit object access events
For auditing access to files and folders. There is an additional configuration requirement for specifying which files and folders, users and user actions will be audited. See the next section,
C onfiguring the File Auditing Policy
.
Audit system events Includes system up/down messages
Settings
Select
Su ccess
and
Failure
Select
Su
ccess and
Failure
Configuring the File Auditing Policy
When you enable the policy to audit object access events, you also need to specify which files, folders, and user actions will be logged. You should be very specific with these settings, and set their scope to be as narrow as possible to avoid excessive logging. For this reason you should also specify system-level folders for auditing.
1. Log in the machine where you want to set the policy with administrator privileges.
2.
3.
4.
5.
6.
7.
On a domain computer, a Domain administrator account is needed
Open Windows Explorer, select the file you want to set the auditing policy for, right-click on it, and select
In the
Security
Select the
OK
tab, click
Advanced
.
Auditing
when you are done adding users.
Permissions
tab, and then click
Add
.
This button is labeled
Edit
in Windows 2008.
In the
Click
In the
Select User or Group
dialog, click
Advanced
Properties
.
, and then find and select the users whose access to this file you want to monitor.
tab, set the permissions for each user you added.
The configuration is now complete. Windows
will generate audit events when the users you specified take the actions specified on the files or fold ers for which you set the audit policies.
Setting Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 632
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 633
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sun Solaris Server Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP
SSH
Host name, generic hardware (cpu, memory, network interface, disk), software (operating system version, installed software, running processes, open
TCP/UDP ports)
Hardware
(cpu details, memory
)
Metrics collected
Uptime, CPU/Memory/Network Interface/Disk space utilization, Network
Interface Errors, Running Process Count, Installed Software change,
Running process CPU/memory utilization, Running process start/stop,
TCP/UDP port up/down
Memory paging rate, Disk I/O utilization
Syslog Vendor, Model General logs including Authentication Success/Failure, Privileged logons,
User/Group Modification
Used for
Performance
Monitoring
Performance
Monitoring
Security
Monitoring and
Compliance
Event Types
In
CMDB > Event Types
, search for "solaris" in the
Device Type
and
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP v1 and v2c
1.
2.
Check if the netsnmp package installed. Solaris has built-in snmp packages. If the netsnmp is not installed, use
Start snmnp with the default configuration.
pkgadd cmd
to install it.
SSH
1.
2.
Make sure that the vmstat
and iostat
Create a user account that can issue
commands are available. If not, install these libraries.
vmstat
and iostat
commands. AccelOps will use that user account to log in to the server.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 634
FortiSIEM Installation Guide
SSH Access Credentials for All Devices
These are the generic settings for providing SSH access to your device from AccelOps.
Setting
Name
Device Type
Value
ssh-generic
<select device type from drop down>
Access Protocol SSH
Port
User Name
Password
22
A user who has access credentials for your device over SSH
The password for the user
FortiSIEM Installation Guide
Page 635
FortiSIEM Installation Guide
Configuring Storage
AccelOps supports these storage devices for discovery and monitoring.
Brocade SAN Switch Configuration
Dell Compellant Storage Configuration
Dell EqualLogic Storage Configuration
EMC Clarion Storage Configuration
EMC Isilon Storage Configuration
NetApp Filer Storage Configuration
FortiSIEM Installation Guide
Page 636
FortiSIEM Installation Guide FortiSIEM Installation Guide
Brocade SAN Switch Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Operating system version, Hardware model,
Serial number, Network interfaces, Physical Disks,
Components
SNMP
Metrics collected
Uptime, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Hardware Status: Fan, Power Supply, Temperature (AccelOps
Event Type: PH_DEV_MON_HW_STATUS)
Used for
Availability and
Performance
Monitoring
Availability
Monitoring
Event Types
In
CMDB > Event Types
, search for "brocade" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 637
FortiSIEM Installation Guide FortiSIEM Installation Guide
Dell Compellant Storage Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Operating system version, Hardware model,
Serial number, Network interfaces, Physical Disks,
Components
SNMP
SNMP
Metrics collected
Uptime, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Hardware component health: Power, Temperature, Fan
Volume Utilization
Used for
Availability and
Performance
Monitoring
Availability
Monitoring
Performance
Monitoring
Event Types
Ping Monitoring: PH_DEV_MON_ PING_STAT
Interface Utilization: PH_DEV_MON_NET_INTF_UTIL
Hardware Status: PH_DEV_MON_HW_STATUS
Disk Utilization: PH_DEV_MON_DISK_UTIL
Rules
Availability
Storage Hardware Warning
Storage Hardware Critical
Performance (Fixed threshold)
NFS Disk space Warning
NFS Disk Space Critical
Reports
Dell Compellent Hardware Status
Top Dell Compellent Devices By Disk Space Util
Top Dell Compellent Devices By Disk Space Util (Detailed)
Top Dell Compellent modules by fan speed
Top Dell Compellent modules by temperature
Top Dell Compellent modules by voltage
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Page 638
FortiSIEM Installation Guide
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
FortiSIEM Installation Guide
Page 639
FortiSIEM Installation Guide FortiSIEM Installation Guide
Dell EqualLogic Storage Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Operating system version,
Hardware model, Serial number, Network interfaces, Physical Disks, Components
SNMP
SNMP
Metrics collected
Uptime, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Hardware component health: Component name (Disk, Power supply,
Temperature, Fan, RAID health), Component status, Host spare ready disk count
Overall Disk health metrics:
Total disk count, Active disk count, Failed disk count, Spare disk count
Connection metrics: Connection Count, Read request rate (IOPS), Write request rate (IOPS), Read latency, Write latency, Read volume (KBps), Write volume (KBps)
Disk performance metrics:
Disk Name, Disk I/O Utilization, Disk I/O Queue,
Read volume (KBps), Write volume (KBps)
Group level performance metrics:
Total storage, Used storage, Reserved storage, Reserved used storage, Total volumes, Used volumes, Online volumes,
Total snapshot, Used snapshot, Online snapshot
Used for
Availability and
Performance
Monitoring
Availability
Monitoring
Performance
Monitoring
Event Types
In
CMDB > Event Types
, search for "equallogic" in the
Description
column to see the event types associated with this device.
Rules
In
Analytics > Rules
, search for "equallogic" in the
Name
column to see the rules associated with this device.
Reports
In Analytics > Reports, search for "equallogic" in the Name column to see the reports associated with this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 640
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 641
FortiSIEM Installation Guide FortiSIEM Installation Guide
EMC Clarion Storage Configuration
What is Discovered and Monitored
Installing the NaviSecCLI Library in AccelOps
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
NaviSecCLI Host name, Operating system version,
Hardware model, Serial number, Network interfaces* Installed Software, Storage
Controller Ports
Hardware components
: Enclosures, Fan,
Power Supply, Link Control Card, CPU, Disk
RAID Groups and the assigned disks
LUNs and LUN -> RAID Group mappings
Storage Groups and memberships
Port, LUN).
(Host,
Metrics collected
Processor utilization: SP Name, Read request rate (IOPS), Write request rate
(IOPS), Read volume (KBps), Write volume (KBps), Read/Write request rate
(IOPS), Read/Write volume (KBps)
: Port name, Read request rate (IOPS), Write request rate (IOPS), Read
Port I/O
volume (KBps), Write volume (KBps), Read/Write request rate (IOPS),
Read/Write volume (KBps)
RAID Group id, RAID type, Total disk, Read request rate
RAID Group I/O:
(IOPS), Write request rate (IOPS), Read volume (KBps), Write volume (KBps),
Read/Write request rate (IOPS), Read/Write volume (KBps)
: LUN name, LUN id, Total disk, Used disk, Free disk, Disk util, Read
LUN I/O
request rate (IOPS), Write request rate (IOPS), Read volume (KBps), Write volume (KBps), Read/Write request rate (IOPS), Read/Write volume (KBps)
Source IP, Source Name, Source WWN, Dest IP,
Host HBA Connectivity:
Destination Name, SP Port Name, Storage Group, LUN Names, Login Status,
Registration Status
Host HBA Unregistered Host
: Source IP, Source Name, Source WWN, Dest
IP, Destination Name, SP Port Name
Hardware component health
: Component name (Disk, Power supply, LCC,
Fan, Link, Port), Component status, Host spare ready disk count
Overall Disk health:
Total disk count, Total disk size (MB), Active disk count,
Failed disk count, Spare disk count
Used for
Availability and
Performance
Monitoring
Event Types
In
CMDB > Event Types
, search for "clarion" in the
Name
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Installing the NaviSecCLI Library in AccelOps
Changing NaviSecCLI Credentials
If you change the NaviSecCLI credentials on your EMC Clarion device, the certificates may also be changed and naviseccli may prompt you to accept new certificates. This should only happen the first time after a certificate change, however, AccelOps discovery and performance monitoring will fail. You will need to run NaviSecCLI manually on each Supervisor and Worker in your deployment and accept the certificate, and then rediscover your EMC Clarion device for performance monitoring to resume.
Configuration of your EMC Clarion storage device involves installing EMC's NaviSecCLI library in your AccelOps virtual appliance, and then setting the access credentials that the appliance will use to communicate with your device.
1.
2.
3.
Log in to your AccelOps virtual appliance as
Copy the file
Run root
.
NaviCLI-Linux-64-x86-versionxyz.rpm
to the AccelOps directory. rpm --Uvh NaviCLI-Linux-64-x86-versionxyz.rpm
to install the rpm package.
Page 642
3.
FortiSIEM Installation Guide FortiSIEM Installation Guide
[root@Rob-SP-94 tmp]# rpm -Uvh
NaviCLI-Linux-64-x86-en_US-7.30.15.0.44-1.x86_64.rpm
Preparing... ########################################### [100%]
1:NaviCLI-Linux-64-x86-en##########################################
# [100%]
Please enter the verifying level(low|medium|l|m) to set?
m
Setting medium verifying level
[root@Rob-SP-94 opt]# ls -la total 40 drwxr-xr-x 8 root root 4096 Aug 22 16:06 .
drwxr-xr-x 29 root root 4096 Aug 16 16:46 ..
drwxr-xr-x 11 admin admin 4096 Jul 23 18:56 glassfish lrwxrwxrwx 1 root root 16 Aug 16 16:46 Java -> /opt/jdk1.6.0_32
drwxr-xr-x 8 root root 4096 Jun 2 16:35 jdk1.6.0_32
drwxr-xr-x 5 root root 4096 Aug 22 16:06 Navisphere <----Note this directory was created*** drwxrwxr-x 14 admin admin 4096 Jul 24 11:22 phoenix drwxrwxr-x 3 root root 4096 Jun 2 16:36 rpm drwxr-xr-x 8 root root 4096 Jun 18 2010 vmware
[root@Rob-SP-94 opt]#
4. Change the user role to the admin su - admin
and make sure that the user can run the command naviseccli -h -User <user>
-Password <pwd> -Scope global getall -sp
from the directory
/opt/phoenix/bin
.
[root@Rob-SP-94 Navisphere]# cd bin
[root@Rob-SP-94 bin]# su - admin
[admin@Rob-SP-94 ~]$ naviseccli
Not enough arguments
Usage:
[-User <username>] [-Password <password>]
[-Scope <0 - global; 1 - local; 2 - LDAP>]
[-Address <IPAddress | NetworkName> | -h <IPAddress | NetworkName>]
[-Port <portnumber>] [-Timeout <timeout> | -t <timeout>]
[-AddUserSecurity | -RemoveUserSecurity | -DeleteSecurityEntry]
[-Parse | -p] [-NoPoll | -np] [-cmdtime]
[-Xml] [-f <filename>] [-Help] CMD <Optional Arguments>
[security -certificate]
[admin@Rob-SP-94 ~]$ pwd
/opt/phoenix/bin
5. Make sure that the Navisphere Analyzer module is on.
If the module is off, performance metrics will not be available and discovery will fail. This log shows an example of the module being turned off.
Page 643
5.
FortiSIEM Installation Guide FortiSIEM Installation Guide
[admin@accelops ~]$ naviseccli -user admin -password admin*1 -scope
0 -h 192.168.1.100 getall -sp
Server IP Address: 192.168.1.100
Agent Rev: 7.32.26 (0.95)
SP Information
--------------
Storage Processor: SP A
Storage Processor Network Name: A-IMAGE
Storage Processor IP Address: 192.168.1.100
Storage Processor Subnet Mask: 255.255.255.0
Storage Processor Gateway Address: 192.168.1.254
Storage Processor IPv6 Mode: Not Supported
Management Port Settings:
Link Status: Link-Up
Current Speed: 1000Mbps/full duplex
Requested Speed: Auto
Auto-Negotiate: YES
Capable Speeds: 1000Mbps half/full duplex
10Mbps half/full duplex
100Mbps half/full duplex
Auto
System Fault LED: OFF
Statistics Logging: OFF <----- Note: performance statistics are not being collected
<------ so AccelOp can not pull stats and discovery will fail.
<------ See how to turn ON
Statistics Logging below.
SP Read Cache State Enabled
SP Write Cache State Enabled
....
6. If the Navisphere Analyzer module is off, turn it on with the setstats -on
command.
Page 644
6.
FortiSIEM Installation Guide FortiSIEM Installation Guide
[admin@accelops ~]$ naviseccli -user admin -password admin*1 -scope
0 -h 192.168.1.100 setstats -on
[admin@accelops ~]$ naviseccli -user admin -password admin*1 -scope
0 -h 192.168.1.100 getall -sp
Server IP Address: 192.168.1.100
Agent Rev: 7.32.26 (0.95)
SP Information
--------------
Storage Processor: SP A
Storage Processor Network Name: A-IMAGE
Storage Processor IP Address: 192.168.1.100
Storage Processor Subnet Mask: 255.255.255.0
Storage Processor Gateway Address: 192.168.1.254
Storage Processor IPv6 Mode: Not Supported
Management Port Settings:
Link Status: Link-Up
Current Speed: 1000Mbps/full duplex
Requested Speed: Auto
Auto-Negotiate: YES
Capable Speeds: 1000Mbps half/full duplex
10Mbps half/full duplex
100Mbps half/full duplex
Auto
System Fault LED: OFF
Statistics Logging: ON <---NOTE that statistics
Logging is now ON.
SP Read Cache State Enabled
SP Write Cache State Enabled
Max Requests: N/A
Average Requests: N/A
Hard errors: N/A
Total Reads: 1012
Total Writes: 8871
Prct Busy: 6.98
Prct Idle: 93.0
System Date: 10/04/2013
Day of the week: Friday
System Time: 11:23:48
Read_requests: 1012
Write_requests: 8871
Blocks_read: 26259
Blocks_written: 235896
Sum_queue_lengths_by_arrivals: 27398
Arrivals_to_non_zero_queue: 3649
....
Page 645
FortiSIEM Installation Guide FortiSIEM Installation Guide
7. Once this command runs successfully, you are ready to
set the access credentials for your device in AccelOps and
Settings for Access Credentials
Settings for EMC Clarion NaviSecCLI Access Credentials
When setting the these settings.
Access Method Definition
for allowing AccelOps to access your EMC Clarion storage device over NaviSecCLI, use
Setting
Name
Device Type
Value
EMC Clarion
EMC Clarion
Access Protocol Navisec CLI
User Name The user you configured to access naviseccli
Password The password associated with the user
Page 646
FortiSIEM Installation Guide FortiSIEM Installation Guide
EMC Isilon Storage Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Operating system version, Hardware model, Serial number, Network interfaces,
Physical Disks, Components
SNMP
SNMP
Metrics collected
Uptime, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Hardware component health: Component name (Disk, Power supply, Temperature, Fan),
Component status (AO event type: PH_DEV_MON_HW_STATUS)
Environmental:
Temperature (AO event type: PH_DEV_MON_HW_TEMP), Voltage readings
(AO event type: PH_DEV_MON_HW_VOLTAGE)
Cluster membership change: (AO event type:
PH_DEV_MON_ISILON_CLUSTER_MEMBERSHIP_CHANGE)
Node health and performance: Overall health, Overall CPU, User CPU, System CPU, Read
Bytes/sec, Write Bytes/sec, Network Read Bytes/sec, Network Write Bytes/sec (AO event type:
PH_DEV_MON_ISILON_NODE_HEALTH)
Cluster health and performance: Cluster name, Cluster health, Online nodes, Offline nodes,
Total Space, Used Space, Available Space, Overall CPU, System CPU, User CPU, Read
Bytes/sec, Write Bytes/sec, Network Read Bytes/sec, Network Write Bytes/sec (AO event type:
PH_DEV_MON_ISILON_CLUSTER_HEALTH)
Cluster Snapshot: Snapshot name, alias, path, creation date, expiry date, size (AO event type: PH_DEV_MON_ISILON_CLUSTER_SNAPSHOT)
Storage Quota metrics:
Cluster name, Soft Threshold, Hard Threshold, Advisable threshold,
Usage, Usage with Overhead, Inode usage, Grace period (AO event type:
PH_DEV_MON_ISILON_NODE_CLUSTER_QUOTA)
Disk performance metrics: Operations/sec, Read Bytes/sec, Write Bytes/sec (AO event type:
PH_DEV_MON_ISILON_NODE_DISK_PERF)
Protocol Performance: Protocol name, Latency: current, average, min latency and max,
Operations/sec, Read Bytes: current, average, min, max, standard deviation, Write Bytes: current, average, min, max, standard deviation (AO event type:
PH_DEV_MON_ISILON_NODE_PROTO_PERF)
Used for
Availability and
Performance
Monitoring
Availability
Monitoring
Performance
Monitoring
Event Types
In
CMDB > Event Types
, search for "isilon" in the
Description
column to see the event types associated with this device.
Rules
In
Analytics > Rules
, search for "isilon" in the
Name
column to see the rules associated with this device.
Reports
In Analytics > Reports, search for "isilon" in the Name column to see the reports associated with this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
Page 647
FortiSIEM Installation Guide FortiSIEM Installation Guide
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 648
FortiSIEM Installation Guide FortiSIEM Installation Guide
EMC VNX Storage Configuration
Configuring EMC VNX
Like EMC Clarion, AccelOps uses Navisec CLI to discover the device and to collect performance metrics. The only difference is that a slightly different command and XML formatted output is used.
Protocol Information Discovered
Navisec
CLI
Host name, Operating system version,
Hardware model, Serial number, Network interfaces* Installed Software, Storage
Controller Ports
Hardware components
: Enclosures, Fan,
Power Supply, Link Control Card, CPU, Disk
Storage Pools, RAID Groups and the assigned disks
LUNs and LUN -> Storage Pool and RAID
Group mappings
Storage Groups and memberships
(Host,
Port, LUN)
Metrics collected
Processor utilization: SP Name, Read request rate (IOPS), Write request rate
(IOPS), Read volume (KBps), Write volume (KBps), Read/Write request rate
(IOPS), Read/Write volume (KBps)
RAID Group id, RAID type, Total disk, Read request rate
Storage Pool I/O:
(IOPS), Write request rate (IOPS), Read volume (KBps), Write volume (KBps),
Read/Write request rate (IOPS), Read/Write volume (KBps)
: LUN name, LUN id, Total disk, Used disk, Free disk, Disk util, Read
LUN I/O
request rate (IOPS), Write request rate (IOPS), Read volume (KBps), Write volume (KBps), Read/Write request rate (IOPS), Read/Write volume (KBps)
Source IP, Source Name, Source WWN, Dest IP,
Host HBA Connectivity:
Destination Name, SP Port Name, Storage Group, LUN Names, Login Status,
Registration Status
Host HBA Unregistered Host
: Source IP, Source Name, Source WWN, Dest IP,
Destination Name, SP Port Name
Hardware component health
: Component name (Disk, Power supply, LCC,
Fan, Link, Port), Component status, Host spare ready disk count
Overall Disk health:
Total disk count, Total disk size (MB), Active disk count,
Failed disk count, Spare disk count
Used for
Availability and
Performance
Monitoring
Configuration
Installing the NaviSecCLI Library in AccelOps
Changing NaviSecCLI Credentials
If you change the NaviSecCLI credentials on your EMC Clarion device, the certificates may also be changed and naviseccli may prompt you to accept new certificates. This should only happen the first time after a certificate change, however, AccelOps discovery and performance monitoring will fail. You will need to run NaviSecCLI manually on each Supervisor and Worker in your deployment and accept the certificate, and then rediscover your EMC Clarion device for performance monitoring to resume.
Configuration of your EMC Clarion storage device involves installing EMC's NaviSecCLI library in your AccelOps virtual appliance, and then setting the access credentials that the appliance will use to communicate with your device.
1. Log in to your AccelOps virtual appliance as root
.
2. Copy the file
NaviCLI-Linux-64-x86-versionxyz.rpm
to the AccelOps directory.
3. Run rpm --Uvh NaviCLI-Linux-64-x86-versionxyz.rpm
to install the rpm package.
Page 649
3.
FortiSIEM Installation Guide FortiSIEM Installation Guide
[root@Rob-SP-94 tmp]# rpm -Uvh
NaviCLI-Linux-64-x86-en_US-7.30.15.0.44-1.x86_64.rpm
Preparing... ########################################### [100%]
1:NaviCLI-Linux-64-x86-en##########################################
# [100%]
Please enter the verifying level(low|medium|l|m) to set?
m
Setting medium verifying level
[root@Rob-SP-94 opt]# ls -la total 40 drwxr-xr-x 8 root root 4096 Aug 22 16:06 .
drwxr-xr-x 29 root root 4096 Aug 16 16:46 ..
drwxr-xr-x 11 admin admin 4096 Jul 23 18:56 glassfish lrwxrwxrwx 1 root root 16 Aug 16 16:46 Java -> /opt/jdk1.6.0_32
drwxr-xr-x 8 root root 4096 Jun 2 16:35 jdk1.6.0_32
drwxr-xr-x 5 root root 4096 Aug 22 16:06 Navisphere <----Note this directory was created*** drwxrwxr-x 14 admin admin 4096 Jul 24 11:22 phoenix drwxrwxr-x 3 root root 4096 Jun 2 16:36 rpm drwxr-xr-x 8 root root 4096 Jun 18 2010 vmware
[root@Rob-SP-94 opt]#
4. Change the user role to the admin su - admin
and make sure that the user can run the command naviseccli -h -User <user>
-Password <pwd> -Scope global getall -sp
from the directory
/opt/phoenix/bin
.
[root@Rob-SP-94 Navisphere]# cd bin
[root@Rob-SP-94 bin]# su - admin
[admin@Rob-SP-94 ~]$ naviseccli
Not enough arguments
Usage:
[-User <username>] [-Password <password>]
[-Scope <0 - global; 1 - local; 2 - LDAP>]
[-Address <IPAddress | NetworkName> | -h <IPAddress | NetworkName>]
[-Port <portnumber>] [-Timeout <timeout> | -t <timeout>]
[-AddUserSecurity | -RemoveUserSecurity | -DeleteSecurityEntry]
[-Parse | -p] [-NoPoll | -np] [-cmdtime]
[-Xml] [-f <filename>] [-Help] CMD <Optional Arguments>
[security -certificate]
[admin@Rob-SP-94 ~]$ pwd
/opt/phoenix/bin
5. Make sure that the Navisphere Analyzer module is on.
If the module is off, performance metrics will not be available and discovery will fail. This log shows an example of the module being turned off.
Page 650
5.
FortiSIEM Installation Guide FortiSIEM Installation Guide
[admin@accelops ~]$ naviseccli -user admin -password admin*1 -scope
0 -h 192.168.1.100 getall -sp
Server IP Address: 192.168.1.100
Agent Rev: 7.32.26 (0.95)
SP Information
--------------
Storage Processor: SP A
Storage Processor Network Name: A-IMAGE
Storage Processor IP Address: 192.168.1.100
Storage Processor Subnet Mask: 255.255.255.0
Storage Processor Gateway Address: 192.168.1.254
Storage Processor IPv6 Mode: Not Supported
Management Port Settings:
Link Status: Link-Up
Current Speed: 1000Mbps/full duplex
Requested Speed: Auto
Auto-Negotiate: YES
Capable Speeds: 1000Mbps half/full duplex
10Mbps half/full duplex
100Mbps half/full duplex
Auto
System Fault LED: OFF
Statistics Logging: OFF <----- Note: performance statistics are not being collected
<------ so AccelOp can not pull stats and discovery will fail.
<------ See how to turn ON
Statistics Logging below.
SP Read Cache State Enabled
SP Write Cache State Enabled
....
6. If the Navisphere Analyzer module is off, turn it on with the setstats -on
command.
Page 651
6.
FortiSIEM Installation Guide FortiSIEM Installation Guide
[admin@accelops ~]$ naviseccli -user admin -password admin*1 -scope
0 -h 192.168.1.100 setstats -on
[admin@accelops ~]$ naviseccli -user admin -password admin*1 -scope
0 -h 192.168.1.100 getall -sp
Server IP Address: 192.168.1.100
Agent Rev: 7.32.26 (0.95)
SP Information
--------------
Storage Processor: SP A
Storage Processor Network Name: A-IMAGE
Storage Processor IP Address: 192.168.1.100
Storage Processor Subnet Mask: 255.255.255.0
Storage Processor Gateway Address: 192.168.1.254
Storage Processor IPv6 Mode: Not Supported
Management Port Settings:
Link Status: Link-Up
Current Speed: 1000Mbps/full duplex
Requested Speed: Auto
Auto-Negotiate: YES
Capable Speeds: 1000Mbps half/full duplex
10Mbps half/full duplex
100Mbps half/full duplex
Auto
System Fault LED: OFF
Statistics Logging: ON <---NOTE that statistics
Logging is now ON.
SP Read Cache State Enabled
SP Write Cache State Enabled
Max Requests: N/A
Average Requests: N/A
Hard errors: N/A
Total Reads: 1012
Total Writes: 8871
Prct Busy: 6.98
Prct Idle: 93.0
System Date: 10/04/2013
Day of the week: Friday
System Time: 11:23:48
Read_requests: 1012
Write_requests: 8871
Blocks_read: 26259
Blocks_written: 235896
Sum_queue_lengths_by_arrivals: 27398
Arrivals_to_non_zero_queue: 3649
....
Page 652
FortiSIEM Installation Guide FortiSIEM Installation Guide
7. Once this command runs successfully, you are ready to
set the access credentials for your device
in AccelOps and initiate the discovery process
.
Setting the IP Address for Credential Mapping
Enter the
Storage Processor IP address when you associate your device's access credentials to an IP address during the credential set up process. Do not enter any other IP address, such as the
Control Station
IP.
Settings for Access Credentials
Settings for EMC VNX NaviSecCLI Access Credentials
When setting the these settings.
Access Method Definition
for allowing AccelOps to access your EMC VNX storage device over NaviSecCLI, use
Setting
Name
Device Type
Value
EMC VNX
EMC VNX
Access Protocol Navisec CLI
User Name The user you configured to access naviseccli
Password The password associated with the user
Page 653
FortiSIEM Installation Guide FortiSIEM Installation Guide
NetApp Filer Storage Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Operating system version, Hardware model, Serial number,
Network interfaces, Logical volumes, Physical Disks
SNMP
Metrics collected
Uptime, CPU utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Logical Disk Volume utilization
SNMP
ONTAP
API
Hardware component health: Component name (Battery, Disk, Power supply, Temperature, Fan),
Component status, Failed power supply count, Failed Fan Count
Overall Disk health metrics:
Total disk count, Active disk count, Failed disk count, Spare disk count,
Reconstructing disk count, Scrubbing disk count, Add spare disk count
NFS metrics: Cache age, CIFS request rate (IOPS), NFS request rate (IOPS), Disk read rate (IOPS),
Disk write rate (IOPS), Network Sent rate (Kbps), Network received rate (Kbps), RPC Bad calls, NFS
Bad calls, CIFS Bad calls
Detailed NFS V3 metrics: Read request rate (IOPS), Write request rate (IOPS), Read latency, Write latency, Read volume (KBps), Write volume (KBps)
Detailed NFS V4 metrics
: Read request rate (IOPS), Write request rate (IOPS), Read latency, Write latency, Read volume (KBps), Write volume (KBps)
Detailed CIFS metrics
: Total Read/Write rate (IOPS), Latency
Detailed ISCSI metrics:
Read request rate (IOPS), Write request rate (IOPS), Read latency, Write latency, Read volume (KBps), Write volume (KBps)
Detailed FCP metrics:
Read request rate (IOPS), Write request rate (IOPS), Read latency, Write latency, Read volume (KBps), Write volume (KBps)
Detailed LUN metrics:
LUN Name, Read request rate (IOPS), Write request rate (IOPS), Read/Write latency, Read volume (KBps), Write volume (KBps), Disk queue full
Aggregate name, Read request rate (IOPS), Write request rate (IOPS),
Detailed Aggregate metrics:
Transfer rate, CP Read rate
Detailed Volume metrics:
Volume Name, Disk Read request rate (IOPS), Disk Write request rate
(IOPS), Disk read latency, Disk write latency, NFS Read request rate (IOPS), NFS Write request rate
(IOPS), NFS Read latency, NFS Write latency, CIFS Read request rate (IOPS), CIFS Write request rate (IOPS), CIFS Read latency, CIFS Write latency, SAN Read request rate (IOPS), SAN Write request rate (IOPS), SAN Read latency, SAN Write latency
Detailed Disk performance metrics:
Disk Name, Disk Utilization, Read request rate (IOPS), Write request rate (IOPS), Read latency, Write latency, Transfer operations rate
Used for
Availability and
Performance
Monitoring
Availability
Monitoring
Performance
Monitoring
Performance
Monitoring
Event Types
In
CMDB > Event Types
, search for "netapp" in the
Device Type
column to see the event types associated with this device.
Rules
In
Analytics > Rules
, search for "netapp" in the
Name
column to see the rules associated with this device.
Reports
In Analytics > Reports, search for "netapp" in the Name column to see the reports associated with this device.
Configuration
SNMP
1.
2.
3.
4.
5.
Log in to your NetApp device with administrative privileges.
Go to
For
SNMP Enabled
Under
SNMP > Configure
.
Communities
Click
Apply
.
, select
Yes
, create a
. public
community with
Read-Only
permissions.
Page 654
FortiSIEM Installation Guide FortiSIEM Installation Guide
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 655
FortiSIEM Installation Guide FortiSIEM Installation Guide
Nimble Storage Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Operating system version, Hardware model, Serial number,
Network interfaces, Physical
Disks, Components
SNMP
Metrics collected
Uptime, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
Storage Disk Utilization: Disk name, Total Disk, Used Disk, Free Disk, Disk Utilization
SNMP Storage Performance metrics: Read rate (IOPS), Sequential Read Rate (IOPS), Write rate
(IOPS), Sequential Write Rate (IOPS), Read latency, Write latency, Read volume (KBps),
Sequential Read volume (KBps), Sequential Write volume (KBps), Used Volume (MB), Used
Snapshot (MB), Non-Sequential Cache Hit Ratio (AccelOps Event Type:
PH_DEV_MON_NIMBLE_GLOBAL_STAT)
Used for
Availability and
Performance
Monitoring
Availability
Monitoring
Performance
Monitoring
Event Types
In
CMDB > Event Types
, search for "nimble" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 656
FortiSIEM Installation Guide FortiSIEM Installation Guide
Nutanix Storage Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Operating system version, Hardware model, Serial number, Network interfaces, Physical
Disks, Components
SNMP
SNMP
Metrics collected
Uptime, Process count, CPU utilization, Real and virtual memory utilization, Disk utilization, Process CPU/Memory utilization, Network
Interface metrics
Disk Status: Cluster, Controller VM, Disk id, Disk serial, Disk utilization, Total Disk, Used Disk, Free Disk
Disk Temp: Disk Id, disk serial, Controller VM, temperature
Cluster Status: Cluster, Cluster version, storage utilization, total storage, used storage, IOPS, latency
Service Status: Cluster, Controller VM, Cluster VM Status, Zeus
Status, Stargate Status
Storage Pool Info: Cluster, storage pool name, storage utilization, total storage, used storage, IOPS, latency
Container Info: Cluster, Container name, storage utilization, total storage, used storage, IOPS, latency
Used for
Availability and
Performance
Monitoring
Availability
Monitoring
Performance
Monitoring
Event Types
PH_DEV_MON_SYS_CPU_UTIL
[PH_DEV_MON_SYS_CPU_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPer fJob.cpp,[lineNumber]=1468,[cpuName]=Generic
CPU,[hostName]=NTNX-14SM15290052-A-CVM,[hostIpAddr]=10.0.252.20,[cp uUtil]=100.000000,[sysCpuUtil]=0.000000,[userCpuUtil]=0.000000,[wai tCpuUtil]=0.000000,[kernCpuUtil]=0.000000,[contextSwitchPersec]=0.0
00000,[cpuInterruptPersec]=0.000000,[pollIntv]=177,[cpuCore]=8,[loa dAvg1min]=2.500000,[loadAvg5min]=2.500000,[loadAvg15min]=2.390000,[ phLogDetail]=
PH_DEV_MON_SYS_MEM_UTIL
[PH_DEV_MON_SYS_MEM_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPe rfJob.cpp,[lineNumber]=9587,[memName]=Physical
Memory,[hostName]=NTNX-14SM15290052-A-CVM,[hostIpAddr]=10.0.252.20,
[memUtil]=93.210754,[pollIntv]=177,[phLogDetail]=
PH_DEV_MON_SYS_VIRT_MEM_UTIL
Page 657
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_SYS_VIRT_MEM_UTIL]:[eventSeverity]=PHL_INFO,[fileName]
=phPerfJob.cpp,[lineNumber]=9590,[memName]=Virtual memory,[hostName]=NTNX-14SM15290052-A-CVM,[hostIpAddr]=10.0.252.20,
[virtMemUsedKB]=30773124,[virtMemUtil]=93.210754,[pollIntv]=177,[ph
LogDetail]=
PH_DEV_MON_SYS_UPTIME
[PH_DEV_MON_SYS_UPTIME]:[eventSeverity]=PHL_INFO,[fileName]=phPerfJ ob.cpp,[lineNumber]=1065,[hostName]=NTNX-14SM15290052-A-CVM,[hostIp
Addr]=10.0.252.20,[sysUpTime]=1815730,[sysUpTimePct]=100.000000,[sy sDownTime]=0,[pollIntv]=56,[phLogDetail]=
PH_DEV_MON_SYS_DISK_UTIL
[PH_DEV_MON_SYS_DISK_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPe rfJob.cpp,[lineNumber]=9664,[diskName]=/home/nutanix/data/stargatestorage/disks/9XG6R3HG,[hostName]=NTNX-14SM15290052-A-CVM,[hostIpAd dr]=10.0.252.20,[appTransportProto]=SNMP
(hrStorage),[diskUtil]=9.229729,[totalDiskMB]=938899,[usedDiskMB]=8
6658,[freeDiskMB]=852241,[pollIntv]=176,[phLogDetail]=
PH_DEV_MON_NET_INTF_UTIL
[PH_DEV_MON_NET_INTF_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phI ntfFilter.cpp,[lineNumber]=319,[intfName]=eth0,[intfAlias]=,[hostNa me]=NTNX-14SM15290052-A-CVM,[hostIpAddr]=10.0.252.20,[pollIntv]=56,
[recvBytes64]=0,[recvBitsPerSec]=0.000000,[inIntfUtil]=0.000000,[se ntBytes64]=0,[sentBitsPerSec]=0.000000,[outIntfUtil]=0.000000,[recv
Pkts64]=0,[sentPkts64]=0,[inIntfPktErr]=0,[inIntfPktErrPct]=0.00000
0,[outIntfPktErr]=0,[outIntfPktErrPct]=0.000000,[inIntfPktDiscarded
]=0,[inIntfPktDiscardedPct]=0.000000,[outIntfPktDiscarded]=0,[outIn tfPktDiscardedPct]=0.000000,[outQLen64]=0,[intfInSpeed64]=100000000
00,[intfOutSpeed64]=10000000000,[intfAdminStatus]=up,[intfOperStatu s]=up,[daysSinceLastUse]=0,[totIntfPktErr]=0,[totBitsPerSec]=0.0000
00,[phLogDetail]=
PH_DEV_MON_PROC_RESOURCE_UTIL
Page 658
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_PROC_RESOURCE_UTIL]:[eventSeverity]=PHL_INFO,[fileName]
=phPerfJob.cpp,[lineNumber]=4378,[swProcName]=python,[hostName]=NTN
X-14SM15290052-A-CVM,[hostIpAddr]=10.0.23.20,[procOwner]=,[memUtil]
=0.379639,[cpuUtil]=0.000000,[appName]=python,[appGroupName]=,[poll
Intv]=116,[swParam]=/home/nutanix/ncc/bin/health_server.py
--log_plugin_output=true --logtostderr=true,[phLogDetail]=
PH_DEV_MON_SYS_PROC_COUNT
[PH_DEV_MON_SYS_PROC_COUNT]:[eventSeverity]=PHL_INFO,[fileName]=phP erfJob.cpp,[lineNumber]=11378,[hostName]=NTNX-14SM15290052-A-CVM,[h ostIpAddr]=10.0.252.20,[procCount]=327,[pollIntv]=176,[phLogDetail]
=
PH_DEV_MON_NUTANIX_DISK_STATUS
[PH_DEV_MON_NUTANIX_DISK_STATUS]:[eventSeverity]=PHL_INFO,[fileName
]=devNutanix.cpp,[lineNumber]=216,[hostName]=NTNX-14SM15290052-A-CV
M,[hostIpAddr]=10.0.23.20,[cluster]=AmanoxLab01,[diskId]=24,[ntxCon trollerVMId]=7,[hwDiskSerial]=9XG6V4DS,[diskUtil]=35.704633,[totalD iskMB]=916,[freeDiskMBNonRoot]=589,[inodeUsedPct]=0.234492,[inodeMa x]=61054976,[inodeFreeNonRoot]=60911807,[phLogDetail]=
PH_DEV_MON_NUTANIX_CLUSTER_STATUS
[PH_DEV_MON_NUTANIX_CLUSTER_STATUS]:[eventSeverity]=PHL_INFO,[fileN ame]=devNutanix.cpp,[lineNumber]=272,[hostName]=NTNX-14SM15290052-A
-CVM,[hostIpAddr]=10.0.23.20,[cluster]=Lab01,[clusterVersion]=el6-r elease-danube-4.1.2-stable-99e1e2dda7a78989136f39132e1f198989ef03a4
,[clusterStatus]=started,[diskUtil]=32.000000,[totalDiskMB]=1448253
2,[usedDiskMB]=4740567,[diskRWReqPerSec]=3109.000000,[devDiskRWLate ncy]=0.631000,[phLogDetail]=
PH_DEV_MON_NUTANIX_SERVICE_STATUS
Page 659
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_NUTANIX_SERVICE_STATUS]:[eventSeverity]=PHL_INFO,[fileN ame]=devNutanix.cpp,[lineNumber]=287,[hostName]=NTNX-14SM15290052-A
-CVM,[hostIpAddr]=10.0.23.20,[cluster]=Lab01,[ntxControllerVMId]=5,
[ntxClusterVMStatus]=Up,[ntxZeusStatus]=3287, 3310, 3311, 3312,
3389, 3403,[ntxStargateStatus]=5331, 5365, 5366, 5421,
19543,[phLogDetail]=
PH_DEV_MON_NUTANIX_STORAGE_POOL_INFO
[PH_DEV_MON_NUTANIX_STORAGE_POOL_INFO]:[eventSeverity]=PHL_INFO,[fi leName]=devNutanix.cpp,[lineNumber]=239,[hostName]=NTNX-14SM1529005
2-A-CVM,[hostIpAddr]=10.0.23.20,[cluster]=Lab01,[spoolId]=1474,[spo olName]=amanoxlab_sp,[diskUtil]=32.733000,[totalDiskMB]=14482532,[u sedDiskMB]=4740567,[diskRWReqPerSec]=155.000000,[devDiskRWLatency]=
0.631000,[phLogDetail]=
PH_DEV_MON_NUTANIX_CONTAINER_INFO
[PH_DEV_MON_NUTANIX_CONTAINER_INFO]:[eventSeverity]=PHL_INFO,[fileN ame]=devNutanix.cpp,[lineNumber]=257,[hostName]=NTNX-14SM15290052-A
-CVM,[hostIpAddr]=10.0.23.20,[cluster]=Lab01,[ntxContainerId]=1488,
[ntxContainerName]=perflab_ndfs,[diskUtil]=8.357116,[totalDiskMB]=1
4482532,[usedDiskMB]=1210322,[diskRWReqPerSec]=0.000000,[devDiskRWL atency]=0.000000,[phLogDetail]=
Rules
Currently there are no system rules defined.
Reports
Nutanix Cluster Disk Usage
Nutanix Cluster Performance
Nutanix Cluster Service Status
Nutanix Cluster Storage Usage
Nutanix Container Performance
Nutanix Container Storage Usage
Nutanix Storage Pool Performance
Nutanix Storage Pool Usage
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Settings for Access Credentials
Page 660
FortiSIEM Installation Guide FortiSIEM Installation Guide
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 661
FortiSIEM Installation Guide
Configuring Virtualization
AccelOps supports these virtualization servers for discovery and monitoring.
FortiSIEM Installation Guide
Page 662
FortiSIEM Installation Guide FortiSIEM Installation Guide
HyperV Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol
Powershell over WMI
Information discovered Metrics collected Used for
CPU, Memory, Network and Storage metrics both at Guest and Host level . Performance Monitoring
Event Types
PH_DEV_MON_HYPERV_OVERALL_HEALTH: HyperV Machine Health Summary
[PH_DEV_MON_HYPERV_OVERALL_HEALTH]:[hostIpAddr]=172.16.20.180,[host
Name]=WIN-HH2MFBPMHMR,[vmHealthCritCount]=0,[vmHealthOkCount]=10
PH_DEV_MON_HYPERV_OVERALL_SYSINFO: HyperV System Information
[PH_DEV_MON_HYPERV_OVERALL_SYSINFO]:[hostIpAddr]=172.16.20.180,[hos tName]=WIN-HH2MFBPMHMR,[notificationCount]=10,[virtualProcessors]=5
2,[totalPages]=67290,[partitionCount]=6,[logicalProcessors]=16
PH_DEV_MON_HYPERV_CPU_LOGICAL_PROC: HyperV Logical Processor Usage
[PH_DEV_MON_HYPERV_CPU_LOGICAL_PROC]:[hostIpAddr]=172.16.20.180,[ho stName]=WIN-HH2MFBPMHMR,[idleTimePct]=47.30,[guestRunTimePct]=50.88
,[hypervisorRunTimePct]=1.97,[totalRunTimePct]=52.84,[cpuInterruptP erSec]=53390.62,[contextSwitchPerSec]=85516.44
PH_DEV_MON_HYPERV_CPU_ROOT_VIRTUAL_PROC: HyperV Root Virtual Processor Usage
[PH_DEV_MON_HYPERV_CPU_ROOT_VIRTUAL_PROC]:[hostIpAddr]=172.16.20.18
0,[hostName]=WIN-HH2MFBPMHMR,[phyMachIpAddr]=172.16.20.180,[phyMach
Name]=WIN-HH2MFBPMHMR,[guestRunTimePct]=0.19,[hypervisorRunTimePct]
=0.04,[totalRunTimePct]=0.23,[cpuInterruptPersec]=4588.63,[intercep tCost]=1458
PH_DEV_MON_HYPERV_CPU_GUEST_VIRTUAL_PROC: HyperV Guest Virtual Processor Usage
Page 663
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_HYPERV_CPU_GUEST_VIRTUAL_PROC]:[hostIpAddr]=172.16.20.1
85,[hostName]=accelops-reporter-hyperv-4.3.1.1158,[vmName]=accelops
-reporter-hyperv-4.3.1.1158,[phyMachIpAddr]=172.16.20.180,[phyMachN ame]=WIN-HH2MFBPMHMR,[guestRunTimePct]=1.06,[hypervisorRunTimePct]=
0.70,[totalRunTimePct]=1.77,[cpuInterruptPersec]=6474.56,[intercept
Cost]=1086
PH_DEV_MON_HYPERV_MEM_PARTITION: HyperV Memory Partition usage
[PH_DEV_MON_HYPERV_MEM_PARTITION]:[hostIpAddr]=172.16.20.180,[hostN ame]=WIN-HH2MFBPMHMR,[1gGpaPages]=0,[2mGpaPages]=16385,[4kGpaPages]
=9949,[depositedGpaPages]=20946
PH_DEV_MON_HYPERV_MEM_PARTITION_PER_VM: HyperV per-VM Memory Partition usage
[PH_DEV_MON_HYPERV_MEM_PARTITION_PER_VM]:[phyMachIpAddr]=172.16.20.
180,[phyMachName]=WIN-HH2MFBPMHMR,[hostIpAddr]=172.16.20.182,[hostN ame]=accelops-va-hyperv-4.3.1.1158,[vmName]=accelops-va-hyperv-4.3.
1.1158,[1gGpaPages]=0,[2mGpaPages]=4096,[4kGpaPages]=2089,[deposite dGpaPages]=5044
PH_DEV_MON_HYPERV_MEM_ROOT_PARTITION: HyperV Root Partition Total Memory Usage
[PH_DEV_MON_HYPERV_MEM_ROOT_PARTITION]:[hostIpAddr]=172.16.20.180,[ hostName]=WIN-HH2MFBPMHMR,[1gGpa]=0,[2mGpa]=32613,[4kGpa]=9760,[dep ositedGpa]=46344
PH_DEV_MON_HYPERV_MEM_ROOT_PARTITION_ROOT: HyperV Root Partition Root Memory Usage
[PH_DEV_MON_HYPERV_MEM_ROOT_PARTITION_ROOT]:[hostIpAddr]=172.16.20.
180,[hostName]=WIN-HH2MFBPMHMR,[1gGpa]=0,[2mGpa]=32613,[4kGpa]=9760
,[depositedGpa]=46344
PH_DEV_MON_HYPERV_MEM_VID_PARTITION: HyperV VID Partition Memory Usage
[PH_DEV_MON_HYPERV_MEM_VID_PARTITION]:[hostIpAddr]=172.16.20.180,[h ostName]=WIN-HH2MFBPMHMR,[physicalPages]=8398888,[remotePages]=0
PH_DEV_MON_HYPERV_MEM_VID_PARTITION_PER_VM: HyperV per-VM VID Partition Memory Usage
Page 664
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_HYPERV_MEM_VID_PARTITION_PER_VM]:[phyMachIpAddr]=172.16
.20.180,[phyMachName]=WIN-HH2MFBPMHMR,[hostIpAddr]=172.16.20.185,[h ostName]=accelops-reporter-hyperv-4.3.1.1158,[vmName]=accelops-repo rter-hyperv-4.3.1.1158,[physicalPages]=1050632,[remotePages]=0
PH_DEV_MON_HYPERV_MEM_OVERALL: HyperV Root Memory Usage
[PH_DEV_MON_HYPERV_MEM_OVERALL]:[hostIpAddr]=172.16.20.180,[hostNam e]=WIN-HH2MFBPMHMR,[freeMemKB]=27519348,[pageFaultsPersec]=0
PH_DEV_MON_HYPERV_NET_VIRTUAL_SWITCH: HyperV Virtual Switch Network Usage
[PH_DEV_MON_HYPERV_NET_VIRTUAL_SWITCH]:[hostIpAddr]=172.16.20.180,[ hostName]=WIN-HH2MFBPMHMR,[vSwitch]=broadcom bcm5709c netxtreme ii gige [ndis vbd client] _34 - virtual switch,[recvBitsPerSec]=719403.45,[recvPktsPerSec]=323.03,[sentBits
PerSec]=3382443.50,[sentPktsPerSec]=283.90,[totalPktsPerSec]=323.03
[PH_DEV_MON_HYPERV_NET_VIRTUAL_SWITCH]:[hostIpAddr]=172.16.20.180,[ hostName]=WIN-HH2MFBPMHMR,[vSwitch]=broadcom bcm5709c netxtreme ii gige [ndis vbd client] _34 - virtual switch,[recvBitsPerSec]=719403.45,[recvPktsPerSec]=323.03,[sentBits
PerSec]=3382443.50,[sentPktsPerSec]=283.90,[totalPktsPerSec]=323.03
PH_DEV_MON_HYPERV_NET_VIRTUAL_ADAPTER: HyperV Virtual Switch Per Adapter Network Usage
[PH_DEV_MON_HYPERV_NET_VIRTUAL_ADAPTER]:[phyMachIpAddr]=172.16.20.1
80,[phyMachName]=WIN-HH2MFBPMHMR,[hostIpAddr]=172.16.20.182,[hostNa me]=accelops-va-hyperv-4.3.1.1158,[vmName]=accelops-va-hyperv-4.3.1
.1158,[intfName]=adapter_e1eb0a1f-1b36-48fe-be79-fde20d335364--3157
5d2f-5085-45d3-905f-2f3e17342a81,[recvBitsPerSec]=64970.24,[recvPkt sPerSec]=20.86,[sentBitsPerSec]=124741.68,[sentPktsPerSec]=42.61,[t otalPktsPerSec]=20.86
PH_DEV_MON_HYPERV_STORAGE_VIRTUAL_STORAGE: HyperV Virtual Storage Usage
Page 665
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_HYPERV_STORAGE_VIRTUAL_STORAGE]:[hostIpAddr]=172.16.20.
180,[hostName]=WIN-HH2MFBPMHMR,[diskName]=e:-hyperinstance-report43
1-virtual hard disks-accelops-reporter-4.3.1.1158-disk2.vhdx,[diskErrors]=2,[diskF lushes]=1267221,[diskReadKBytesPerSec]=0.00,[diskReadReqPerSec]=0.0
0,[diskWriteKBytesPerSec]=0.00,[diskWriteReqPerSec]=0.00
PH_DEV_MON_HYPERV_STORAGE_LOGICAL_DISK: HyperV Logical Disk Usage
[PH_DEV_MON_HYPERV_STORAGE_LOGICAL_DISK]:[hostIpAddr]=172.16.20.180
,[hostName]=WIN-HH2MFBPMHMR,[diskName]=e:,[ioReadLatency]=0,[ioWrit eLatency]=14
Rules
HyperV Disk I/O Warning
HyperV Disk I/O Critical
HyperV Guest Critical
HyperV Guest Hypervisor Run Time Percent Warning
HyperV Logical Processor Total Run Time Percent Critical
HyperV Logical Processor Total Run Time Percent Warning
HyperV Page fault Critical
HyperV Page fault Warning
HyperV Remainining Guest Memory Warning
Reports
Look in > > > >
HyperV Configuration and Health
Top HyperV Guests By Virtual Processor Run Time Pct
Top HyperV Guests by Large Page Size Usage
Top HyperV Guests by Remote Physical Page Usage
Top HyperV Root Partitions By Virtual Processor Run Time Pct
Top HyperV Root Partitions by Large Page Size Usage
Top HyperV Servers By Logical Processor Run Time Pct
Top HyperV Servers by Disk Activity
Top HyperV Servers by Disk Latency
Top HyperV Servers by Large Page Size Usage
Top HyperV Servers by Memory Remaining for Guests
Top HyperV Servers by Remote Physical Page Usage
Configuration
AccelOps needs WMI credentials to get the HyperV performance metrics. Configure this following the guidelines described in
Settings for Access Credentials
Configure WMI on AccelOps
Page 666
FortiSIEM Installation Guide FortiSIEM Installation Guide
VMware ESX Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information discovered
VMWare
SDK
ESX Server and the Guest hosts running on that server. ESX host clusters. Hardware (CPU, Memory, Disk, network Interface) for all guests, OS vendor and version for all guests. Virtual switch for connecting guest hosts to network interfaces.
VMWare
SDK
Metrics collected
Both ESX level and guest host level performance metrics.
Guest host level metrics
include CPU/memory/disk utilization, CPU Run/Ready/Limited percent, memory swap in/out rate, free memory state, disk read/write rate/latency, network interface utilization, errors, bytes in/out.
ESX level metrics
include physical CPU utilization, ESX kernel disk read/writre latency etc
ESX logs include scenarios like ESX level login sucess/failure, configuration change, Guest host movement, account creation and modification
Used for
Performance
Monitoring
Availability,
Change and
Security
Monitoring
Configuration
AccelOps discovers and monitors VMware ESX servers and guests over the the VMware SDK. Make sure that VMware Tools is installed on all the guests in your ESX deployment, and AccelOps will be able to obtain their IP addresses.
Settings for Access Credentials
User with System View Credentials
Make sure to provide a user with
System View
permissions who can access the entire vCenter hierarchy when setting up the access credentials for your VMware ESX device. See the VMware documentation on how to se tup a user with System View permissions.
Settings for VMware ESX VMSDK Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your <device name> over <protocol>, use these settings.
Setting
Name
Value
vCenter
Device Type VMware VMware
Access Protocol VM SDK
User Name
Password
A user with System View permissions
The password associated with the user
Page 667
FortiSIEM Installation Guide
Configuring VPN Gateways
AccelOps supports these VPN gateways for discovery and monitoring.
Cisco VPN 3000 Gateway Configuration
Juniper Networks SSL VPN Gateway Configuration
Microsoft PPTP VPN Gateway Configuration
FortiSIEM Installation Guide
Page 668
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco VPN 3000 Gateway Configuration
What is Discovered and Monitored
Sample Parsed Cisco VPN 3000 Syslog Messages
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
SNMP
Syslog
Event Types
In
CMDB > Event Types
, search for "cisco_vpn" in the
Name
and
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
1.
2.
3.
4.
Log in to your device with administrative credentials.
Go to
Configuration > System > Management Protocols > SNMP Communities
.
Click
For
Add
.
Community String
, enter public
.
Syslog
1.
2.
3.
4.
Go to
Click
Configuration > System > Events > Syslog Servers
Add
.
.
Enter the IP address of your AccelOps virtual appliance for Syslog Server.
Add a syslog server with AccelOps IP address
Sample Parsed Cisco VPN 3000 Syslog Messages
<189>18174 01/07/1999 20:25:27.210 SEV=5 AUTH/31 RPT=14 User [ admin ]
Protocol [ Telnet ] attempted ADMIN logon. Status: <REFUSED> authentication failure
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Page 669
FortiSIEM Installation Guide
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
FortiSIEM Installation Guide
Page 670
FortiSIEM Installation Guide FortiSIEM Installation Guide
Juniper Networks SSL VPN Gateway Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected Used For
SNMP
Syslog
Event Types
In
CMDB > Event Types
, search for "junos_dynamic_vpn" in the
Name
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
1.
2.
3.
Log into your device with administrative credentials.
Go to
System > Log/Monitoring > SNMP
.
Under
Agent Properties
, enter public
for
Community
.
Syslog
VPN Access Syslogs
1.
2.
3.
4.
Go to
System > Log/Monitoring > User Access > Settings
.
Under
Select Events to Log
, select , and
Network Connect
.
Under
Syslog Servers
, enter the IP address of your AccelOps virtual appliance, and set the
Click
Save Changes
.
Admin Access Syslogs
1.
2.
3.
4.
Go to
System > Log/Monitoring > Admin Access > Settings.
Under
Select Events to Log
, select , and
Administrator logins
.
Under
Syslog Servers
, enter the IP address of your AccelOps virtual appliance, and set the
Click
Save Changes
.
.
.
Sample Parsed Juniper Networks SSL VPN Syslog Messages
Page 671
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Juniper: 2008-10-28 04:34:53 - ive - [192.168.20.82] admin(Users)[]
- Login failed using auth server SteelBelted (Radius Server). Reason:
Failed
<134>Juniper: 2008-10-28 03:12:03 - ive - [192.168.20.82] wenyong(Users)[Users] - Login succeeded for wenyong/Users from
192.168.20.82.
<134>Juniper: 2008-10-28 03:55:20 - ive - [192.168.20.82] wenyong(Users)[Users] - Network Connect: Session ended for user with IP
172.16.3.240
<134>Juniper: 2008-10-28 03:05:25 - ive - [172.16.3.150] admin(Admin
Users)[] - Primary authentication successful for admin/Administrators from 172.16.3.150
<134>Juniper: 2008-10-28 05:33:02 - ive - [172.16.3.150] admin(Admin
Users)[] - Primary authentication failed for admin/Administrators from
172.16.3.150
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Access Protocol SNMP
Community String <your own>
Page 672
FortiSIEM Installation Guide FortiSIEM Installation Guide
Microsoft PPTP VPN Gateway Configuration
Configuring Microsoft PPTP
Windows 2003 Server
1.
2.
Logon with administrative rights
Configure PPTP VPN a. Go to Start | All Programs | Administrative Tools | Configure Your Server Wizard, select the Remote Access/VPN Server role.
The click the next button which runs the the Routing and Remote Access Wizard.
b. On the Routing and Remote Access wizard, follow the following steps: i. Select "Virtual Private Network (VPN) and NAT" and click Next ii. Select the network interface for use by VPN connection and click Next iii. Specify the network that VPN clients should connect to in order to access resources and click Next iv. Select VPN IP Address assignment methodology (DHCP/VPN pool) and click Next v. Specify VPN pool if VPN pool was chosen in step d and click Next vi. Identify the network that has shared access to the Internet and click Next vii. Select if an external RADIUS server is to be used for central authentication and click Next c. Give users VPN access rights. Open the properties page for a user, select that user's Dial-In properties page and select "Allow access" under Remote Access Permissions
3. Configure Server Logging - Enable authentication and accounting logging from the in the
Remote Access Logging
Settings
tab on the properties of the
Local File
stored in a configurable log file or files stored in the
SystemRoot
\System32\LogFiles folder. The log files are saved in Internet
object
folder in the Routing and Remote Access snap-in. The authentication and accounting information is
4.
Authentication Service (IAS) or database-compatible format, meaning that any database program can read the log file directly for analysis.
Configure Snare agent to send logs to Accelops.
Sample syslog messages
<13>Apr 1 09:28:03 dev-v-win03-vc MSPPTPLog 0
192.168.24.11,administrator,04/01/2009,09:28:00,RAS,DEV-V-WIN03-VC,44,29
,4,192.168.24.11,6,2,7,1,5,129,61,5,64,1,65,1,31,192.168.20.38,66,192.16
8.20.38,4108,192.168.24.11,4147,311,4148,MSRASV5.20,4155,1,4154,Use
Windows authentication for all users,4129,DEV-V-WIN03-VC\administrator,4130,DEV-V-WIN03-VC\administrato r,4127,4,25,311 1 192.168.24.11 04/01/2009 16:12:12 3,4149,Connections to Microsoft Routing and Remote Access server,4136,1,4142,0
Page 673
FortiSIEM Installation Guide
PulseSecure Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Information Discovered Metrics Collected
Syslog
Used For
Security and Performance alerts Security and performance monitoring
Event Types
In
CMDB > Event Types
, search for "PulseSecure" to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Syslog
Sample PulseSecure Syslog Messages
FortiSIEM Installation Guide
<134> 2015-12-18T06:30:29-08:00 PulseSecure: 2015-12-18 06:30:29 -
PAL-B4CDC-VPNSSL01 - [1.1.1.1] admin(Varian OKTA Realm)[Varian
Employees] - Host Checker policy 'VMS_Host_Checker_Policy' passed on host '1.1.1.1' address '' for user 'admin'.
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 674
FortiSIEM Installation Guide
Configuring Vulnerability Scanners
AccelOps supports these vulnerability scanners for discovery and monitoring.
McAfee Foundstone Vulnerability Scanner Configuration
Nessus Vulnerability Scanner Configuration
Qualys Vulnerability Scanner Configuration
Rapid7 NeXpose Vulnerability Scanner Configuration
FortiSIEM Installation Guide
Page 675
FortiSIEM Installation Guide FortiSIEM Installation Guide
McAfee Foundstone Vulnerability Scanner Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol
JDBC (SQL
Server)
Metrics collected
Scan name, Scanned Host Name, Host OS, Vulnerability category, Vulnerability name, Vulnerability severity,
Vulerability CVE Id, Vulnerability Score, Vulnerability Consequence
Used for
Security
Monitoring
Event Types
In
CMDB > Event Types
, search for "foundstone" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined rules for this device.
Configuration
JDBC
AccelOps connects to the faultline
database in the McAfee vulnerability scanner to collect metrics. This is a SQL Server database, so you will
Settings for Access Credentials
Settings for McAfee Foundstone Vulnerability Scanner JDBC Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your <device name> over <protocol>, use these settings.
Setting
Name
Device Type
Value
mcafee_jdbc
Microsoft SQL Server
Access Protocol JDBC
Used for McAfee VulnMgr
Pull Interval (minutes) 5
Port
Database name
User Name
Password
1433 faultline
A user with access to the faultline database over JDBC
The password associated with the user
Page 676
FortiSIEM Installation Guide FortiSIEM Installation Guide
Nessus Vulnerability Scanner Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Metrics collected
Nessus
API
Scan name, Scanned Host Name, Host OS, Vulnerability category, Vulnerability name, Vulnerability severity,
Vulerability CVE Id and Bugtraq Id, Vulnerability CVSS Score, Vulnerability Consequence
Used for
Security
Monitoring
Event Types
In
CMDB > Event Types
, search for "nessus" in the
Description
and
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "nessus" in the Description column to see the reports associated with this device.
Configuration
Nessus API
Create a user name and password that AccelOps can use as access credentials for the API. Make sure the user has permissions to view the scan report files on the Nessus device. You can check if your user has the right permissions by running a scan report as that user.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
Settings for Nessus Vulnerability Scanner API Access Credentials
When setting the these settings.
Access Method Definition
for allowing AccelOps to access your Nessus Vulnerability Scanner over the API, use
Setting
Name
Device Type
Value
nessus
Nessus Security Scanner
Access Protocol Nessus API
Pull Interval (minutes) 5
Port
User Name
Password
8834
A user who has permission to access the device over the API
The password associated with the user
Page 677
FortiSIEM Installation Guide FortiSIEM Installation Guide
Qualys Vulnerability Scanner Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol Metrics collected
Qualys
API
Scan name, Scanned Host Name, Host OS, Vulnerability category, Vulnerability name, Vulnerability severity,
Vulerability CVE Id and Bugtraq Id, Vulnerability Consequence
Used for
Security
Monitoring
Event Types
In
CMDB > Event Types
, search for "qualys" in the
Device Type
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "qualys" in the Description column to see the reports associated with this device.
Configuration
Qualys API
Create a user name and password that AccelOps can use as access credentials for the API.
You can now configure AccelOps to communicate with your device by following the instructions in
Setting Access Credentials for Device
Discovery , and then initiate discovery of the device as described in the topics in
.
Settings for Access Credentials
Use Host Name for IP Range in Access Credentials
Enter the host name for your Qualys service rather than an IP address when associating your access credentials to an IP range.
Settings for Qualys Vulnerability Scanner API Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your <device name> over <protocol>, use these settings.
Setting
Name
Device Type
Access Protocol
Pull Interval (minutes) 5
Value
qualys
Qualys QualysGuard Scanner
Qualys API
Port
User Name
Password
443
A user who has access to the vulnerability scanner over the API
The password associated with the user
Page 678
FortiSIEM Installation Guide FortiSIEM Installation Guide
Rapid7 NeXpose Vulnerability Scanner Configuration
What is Discovered and Monitored
Settings for Access Credentials
What is Discovered and Monitored
Protocol
Rapid7
Nexpose
API
Metrics collected
Scan name, Scanned Host Name, Host OS, Vulnerability category, Vulnerability name, Vulnerability severity,
Vulerability CVE Id and Bugtraq Id, Vulnerability CVSS Score, Vulnerability Consequence
Used for
Security
Monitoring
Event Types
In
CMDB > Event Types
, search for "rapid7" in the
Description
and
Device Type
columns to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Rapid7 NeXpose API
1.
2.
3.
4.
Log into the device manger for your vulnerability scanner with administrative credentials.
Go to
Administration > General > User Configuration
, and create a user that AccelOps can use to access the device.
Go to
Reports > General > Report Configuration
Create a report with the Report format set to
AccelOps can only pull reports in this format.
.
Simple XM
L.
Settings for Access Credentials
Settings for Rapid7 Nexpose API Access Credentials
When setting the
Access Method Definition
for allowing AccelOps to access your <device name> over <protocol>, use these settings.
Setting
Name
Device Type
Access Protocol
Value
rapid7
Rapid7 NeXpose Vulnerability Scanner
Rapid7 NeXpose API
Pull Interval (minutes) 5
Port 3780
User Name
Password
A user who can access the device over the API
The password associated with the user
Page 679
FortiSIEM Installation Guide
Configuring WAN Accelerators
AccelOps supports these wide area network accelerators for discovery and monitoring.
Cisco Wide Area Application Server Configuration
Riverbed SteelHead WAN Accelerator Configuration
FortiSIEM Installation Guide
Page 680
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Wide Area Application Server Configuration
What is Discovered and Monitored
Protocol Information Discovered
SNMP Host name, Software version, Hardware model,
Network interfaces
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Disk space utilization,
Process cpu/memory utilization
Used for
Availability and
Performance
Monitoring
Event Types
Regular monitoring events
PH_DEV_MON_SYS_UPTIME
[PH_DEV_MON_SYS_UPTIME]:[eventSeverity]=PHL_INFO,[fileName]=phPerfJ ob.cpp,[lineNumber]=1053,[hostName]=edge.bank.com,[hostIpAddr]=10.1
9.1.5,[sysUpTime]=13256948,[sysUpTimePct]=100.000000,[sysDownTime]=
0,[pollIntv]=56,[phLogDetail]=
PH_DEV_MON_SYS_CPU_UTIL
[PH_DEV_MON_SYS_UPTIME]:[eventSeverity]=PHL_INFO,[fileName]=phPerfJ ob.cpp,[lineNumber]=1053,[hostName]=edge.bank.com,[hostIpAddr]=10.1
9.1.5,[sysUpTime]=13256948,[sysUpTimePct]=100.000000,[sysDownTime]=
0,[pollIntv]=56,[phLogDetail]=
PH_DEV_MON_SYS_MEM_UTIL
[PH_DEV_MON_SYS_MEM_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPer fJob.cpp,[lineNumber]=9822,[memName]=Physical
Memory,[hostName]=edge.bank.com,[hostIpAddr]=10.19.1.5,[memUtil]=93
.438328,[pollIntv]=176,[phLogDetail]=
PH_DEV_MON_SYS_DISK_UTIL
[PH_DEV_MON_SYS_DISK_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPe rfJob.cpp,[lineNumber]=9902,[diskName]=/swstore,[hostName]=edge.ban
k.com,[hostIpAddr]=10.19.1.5,[appTransportProto]=SNMP
(hrStorage),[diskUtil]=56.931633,[totalDiskMB]=992,[usedDiskMB]=565
,[freeDiskMB]=427,[pollIntv]=176,[phLogDetail]=
PH_DEV_MON_SYS_PROC_COUNT
Page 681
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_SYS_PROC_COUNT]:[eventSeverity]=PHL_INFO,[fileName]=phP erfJob.cpp,[lineNumber]=11710,[hostName]=edge.bank.com,[hostIpAddr]
=10.19.1.5,[procCount]=429,[pollIntv]=176,[phLogDetail]=
PH_DEV_MON_NET_INTF_UTIL
[PH_DEV_MON_NET_INTF_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phI ntfFilter.cpp,[lineNumber]=323,[intfName]=GigabitEthernet
1/0,[intfAlias]=,[hostName]=edge.bank.com,[hostIpAddr]=10.19.1.5,[p ollIntv]=56,[recvBytes64]=0,[recvBitsPerSec]=0.000000,[inIntfUtil]=
0.000000,[sentBytes64]=0,[sentBitsPerSec]=0.000000,[outIntfUtil]=0.
000000,[recvPkts64]=0,[sentPkts64]=0,[inIntfPktErr]=0,[inIntfPktErr
Pct]=0.000000,[outIntfPktErr]=0,[outIntfPktErrPct]=0.000000,[inIntf
PktDiscarded]=0,[inIntfPktDiscardedPct]=0.000000,[outIntfPktDiscard ed]=0,[outIntfPktDiscardedPct]=0.000000,[outQLen64]=0,[intfInSpeed6
4]=100000000,[intfOutSpeed64]=100000000,[intfAdminStatus]=,[intfOpe rStatus]=,[daysSinceLastUse]=0,[totIntfPktErr]=0,[totBitsPerSec]=0.
000000,[phLogDetail]=
PH_DEV_MON_PROC_RESOURCE_UTIL
[PH_DEV_MON_PROC_RESOURCE_UTIL]:[eventSeverity]=PHL_INFO,[fileName]
=phPerfJob.cpp,[lineNumber]=4320,[swProcName]=syslogd,[hostName]=ed ge.bank.com,[hostIpAddr]=10.19.1.5,[procOwner]=,[memUtil]=0.038191,
[cpuUtil]=0.000000,[appName]=Syslog Server,[appGroupName]=Unix
Syslog Server,[pollIntv]=116,[swParam]=-s -f
/etc/syslog.conf-diamond,[phLogDetail]=
Rules
Regular monitoring rules
Reports
Regular monitoring reports
Configuration
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
Page 682
FortiSIEM Installation Guide FortiSIEM Installation Guide
Riverbed SteelHead WAN Accelerator Configuration
What is Discovered and Monitored
Protocol Information Discovered
SNMP
SNMP
Host name, Software version, Hardware model,
Network interfaces
SNMP
SNMP
Trap
Metrics collected
Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Disk space utilization,
Process cpu/memory utilization
Hardware status
Used for
Availability and
Performance
Monitoring
Availability and
Performance
Monitoring
Availability and
Performance
Monitoring
Bandwidth metrics: Inbound Optimized Bytes - LAN side, WAN side, Outbound optimized bytes -
LAN side and WAN side
Connection metrics
: Optimized connections, Passthrough connections, Half-open optimized connections, Half-closed Optimized connections, Established optimized connections, Active optimized connections
Top Usage metrics
: Top source (Source IP, Total Bytes), Top destination (Destination IP, Total
Bytes), Top Application (TCP/UDP port, Total Bytes), Top Talker (Source IP, Source Port,
Destination IP, Destination Port, Total Bytes)
Peer status
: For every peer: State, Connection failures, Request timeouts, Max latency
All traps: software errors, hardware errors, admin login, performance issues - cpu, memory, peer latency issues. Around 115 traps defined in CMDB > Event Types. The mapped event types start with "Riverbed-".
Availability,
Security and
Compliance
Event Types
In
CMDB > Event Types
device.
, search for "steelhead" in the
Description
and
Device Type
columns to see the event types associated with this
Rules
In
Analytics > Rules
, search for "steelhead" in the
Name
column to see the rules associated with this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP
AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation,
then follow the instructions in Setting Access Credentials for Device Discovery
to initiate the device discovery process.
to establish the connection between the device and AccelOps, and
SNMP Trap
AccelOps processes events from this device via SNMP traps sent by the device. Configure the device to send send SNMP traps to AccelOps as directed in the device's product documentation, and AccelOps will parse the contents.
Example SNMP Trap
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Value
<set name>
Generic
Page 683
FortiSIEM Installation Guide
Access Protocol SNMP
Community String <your own>
FortiSIEM Installation Guide
Page 684
FortiSIEM Installation Guide
Configuring Wireless LANs
AccelOps supports these wireless local area network devices for discovery and monitoring.
Aruba Networks Wireless LAN Configuration
Cisco Wireless LAN Configuration
Motorola WiNG WLAN AP Configuration
Ruckus Wireless LAN Configuration
FortiSIEM Installation Guide
Page 685
FortiSIEM Installation Guide FortiSIEM Installation Guide
Aruba Networks Wireless LAN Configuration
What is Discovered and Monitored
Sample Aruba Networks Wireless LAN Controller SNMP Trap Messages
Settings for Access Credentials
What is Discovered and Monitored
AccelOps uses SNMP and NMAP to discover the device and to collect logs and performance metrics. AccelOps communicates to the WLAN
Controller only and discovers all information from the Controller. AccelOps does not communicate to the WLAN Access points directly.
Protocol Information Discovered
SNMP
SNMP
Trap
Controller host name, Controller hardware model, Controller network interfaces,
Associated WLAN Access Points
Controller device type
Metrics collected
Controller Uptime, Controller Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths),
Radio interface performance metrics
All system logs: User authentication, Admin authentication, WLAN attacks,
Wireless link health
Used for
Availability and
Performance
Monitoring
Availability,
Security and
Compliance
Event Types
In
CMDB > Event Types
, search for "aruba" in the
Description
and
Device Type
columns to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
In Analytics > Reports, search for "aruba" in the Name column to see the reports associated with this device.
Configuration
SNMP V1/V2c
1.
2.
3.
4.
Log in to your Aruba wireless controller with administrative privileges.
Go to
Configuration > Management > SNMP
.
For
Read Community String
, enter public
.
5.
6.
Select
Enable Trap Generation
.
Next to
Under
Read Community String
, click
Add
, click
Add
and enter the IP address of your AccelOps virtual appliance.
Sample Aruba Networks Wireless LAN Controller SNMP Trap Messages
2008-06-11 11:38:34 192.168.20.7 [192.168.20.7]:SNMPv2-MIB::sysUpTime.0
= Timeticks: (1355400) 3:45:54.00 SNMPv2-MIB::snmpTrapOID.0 = OID:
SNMPv2-SMI::enterprises.14823.2.2.1.1.100.1003
SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.60 = Hex-STRING: 07 D8 06 0B
13 2E 39 00 2D 07 00
SNMPv2-SMI::enterprises.14823.2.2.1.1.2.1.1.2.192.168.180.1 =
Hex-STRING: 00 1E 52 72 AF 4B
Settings for Access Credentials
Page 686
FortiSIEM Installation Guide FortiSIEM Installation Guide
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 687
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco Wireless LAN Configuration
What is Discovered and Monitored
Protocol Information Discovered
SNMP
SNMP
Trap
Controller host name, Controller hardware model, Controller network interfaces,
Associated WLAN Access Points
Controller device type
Metrics collected
Controller Uptime, Controller CPU and Memory utilization, Controller Network
Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths)
All system logs: User authentication, Admin authentication, WLAN attacks,
Wireless link health
Event Types
In
CMDB > Event Types
, search for "cisco wireless" in the
Description
column to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
SNMP V1/V2c and SNMP Traps
9.
10.
11.
12.
5.
6.
7.
8.
1.
2.
3.
4.
Log in to your Cisco wireless LAN controller with administrative privileges.
Go to
MANAGEMENT > SNMP > General
.
Set both
SNMP v1 Mode
Go to
SNMP > Communities
Click
New
and create a
Click
Go to
Click
Apply
and
.
SNMP v2c Mode Enable
Select the event traps you want to sent to AccelOps.
Click
Go to
Apply
SNMP > Trap Controls
Apply
.
. public
.
SNMP > Trap Receivers
Click
New
and enter the IP address of your AccelOps virtual appliance as a trap receiver.
.
.
.
community string with
Read-Only
privileges.
Sample SNMP Trap
Used for
Availability and
Performance
Monitoring
Availability,
Security and
Compliance
Page 688
FortiSIEM Installation Guide FortiSIEM Installation Guide
2008-06-09 08:59:50 192.168.20.9 [192.168.20.9]:SNMPv2-MIB::sysUpTime.0
= Timeticks: (86919800) 10 days, 1:26:38.00
SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.14179.2.6.3.2
SNMPv2-SMI::enterprises.14179.2.6.2.35.0 = Hex-STRING: 00 21 55 4D 66 B0
SNMPv2-SMI::enterprises.14179.2.6.2.36.0 = INTEGER: 0
SNMPv2-SMI::enterprises.14179.2.6.2.37.0 = INTEGER: 1
SNMPv2-SMI::enterprises.14179.2.6.2.34.0 = Hex-STRING: 00 12 F0 0A 3F 15
2010-11-01 12:59:57 0.0.0.0(via UDP: [172.22.2.25]:32769) TRAP2, SNMP v2c, community 1n3t3ng . Cold Start Trap (0) Uptime: 0:00:00.00
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (9165100) 1 day,
1:27:31.00 SNMPv2-MIB::snmpTrapOID.0 = OID:
SNMPv2-SMI::enterprises.9.9.599.0.4
SNMPv2-SMI::enterprises.9.9.599.1.3.1.1.1.0 = Hex-STRING: 00 24 D7 36 A0
00 SNMPv2-SMI::enterprises.9.9.513.1.1.1.1.5.0 = STRING: "AP-2"
SNMPv2-SMI::enterprises.9.9.599.1.3.1.1.8.0 = Hex-STRING: 00 25 45 B7
66 70 SNMPv2-SMI::enterprises.9.9.513.1.2.1.1.1.0 = INTEGER: 0
SNMPv2-SMI::enterprises.9.9.599.1.3.1.1.10.0 = IpAddress: 172.22.4.54
SNMPv2-SMI::enterprises.9.9.599.1.2.1.0 = STRING: "IE\brouse"
SNMPv2-SMI::enterprises.9.9.599.1.2.2.0 = STRING: "IE"
2011-04-05 10:37:42 0.0.0.0(via UDP: [10.10.81.240]:32768) TRAP2, SNMP v2c, community AccelOps . Cold Start Trap (0) Uptime: 0:00:00.00
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (1672429600) 193 days,
13:38:16.00 SNMPv2-MIB::snmpTrapOID.0 = OID:
SNMPv2-SMI::enterprises.9.9.615.0.1
SNMPv2-SMI::enterprises.9.9.599.1.3.1.1.1.0 = Hex-STRING: 00 25 BC 80 E8
77 SNMPv2-SMI::enterprises.9.9.599.1.3.1.1.8.0 = Hex-STRING: 6C 50 4D
7D AC 50 SNMPv2-SMI::enterprises.9.9.599.1.3.1.1.9.0 = INTEGER: 1
SNMPv2-SMI::enterprises.9.9.513.1.1.1.1.5.0 = STRING: "AP03-3.rdu2"
SNMPv2-SMI::enterprises.9.9.615.1.2.1.0 = INTEGER: 1
SNMPv2-SMI::enterprises.9.9.615.1.2.2.0 = INTEGER: 5000
SNMPv2-SMI::enterprises.9.9.615.1.2.3.0 = INTEGER: 1
SNMPv2-SMI::enterprises.9.9.615.1.2.4.0 = INTEGER: 31
SNMPv2-SMI::enterprises.9.9.615.1.2.5.0 = INTEGER: -60
SNMPv2-SMI::enterprises.9.9.615.1.2.6.0 = INTEGER: -90
SNMPv2-SMI::enterprises.9.9.615.1.2.7.0 = STRING:
"0,0,0,0,1,20,24,28,3,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0"
SNMPv2-SMI::enterprises.9.9.615.1.2.8.0 = INTEGER: 2
SNMPv2-SMI::enterprises.9.9.615.1.2.9.0 = STRING:
"6c:50:4d:7d:ac:50,e8:04:62:0b:b5:f0"
SNMPv2-SMI::enterprises.9.9.615.1.2.10.0 = STRING: "-83,-85"
SNMPv2-SMI::enterprises.9.9.615.1.2.11.0 = STRING: "1,1"
SNMPv2-SMI::enterprises.9.9.512.1.1.1.1.11.5 = INTEGER: 1
Page 689
FortiSIEM Installation Guide FortiSIEM Installation Guide
Settings for Access Credentials
SNMP Access Credentials for All Devices
When setting the
Access Method Definition
for allowing AccelOps to communicate with your device over SNMP, use these settings.
Set the
Name
and
Community String
.
Setting
Name
Device Type
Access Protocol
Value
<set name>
Generic
SNMP
Community String <your own>
Page 690
FortiSIEM Installation Guide FortiSIEM Installation Guide
Motorola WiNG WLAN AP Configuration
What is Discovered and Monitored
Protocol Information
Discovered
Syslog
Metrics collected Used for
All system logs: User authentication, Admin authentication, WLAN attacks, Wireless link health
Availability, Security and
Compliance
Event Types
Over 127 event types - In
CMDB > Event Types
, search for "Motorola-WiNG" to see the event types associated with this device.
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Configure devices to send syslog to AccelOps - make sure that the version matches the format below
2015-11-11T13:00:16.720960-06:00 co-ap01 %DOT11-5-EAP_FAILED: Client
'FC-C2-DE-B1-43-81' failed 802.1x/EAP authentication on wlan
'OFFICE-WAREHOUSE-RADIUS-WLAN' radio 'co-ap01:R1'
2015-11-11T12:52:20.437659-06:00 us600001
%SMRT-5-COV_HOLE_RECOVERY_DONE: Radio us-ap10:R2 power changed from 19 to 14
Page 691
FortiSIEM Installation Guide FortiSIEM Installation Guide
Ruckus Wireless LAN Configuration
What is Discovered and Monitored
What is Discovered and Monitored
Protocol Information Discovered
SNMP Controller host name, Controller hardware model, Controller network interfaces, Associated WLAN Access
Points
Metrics collected
Controller Uptime, Controller Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Controller
WLAN Statistics, Access Point Statistics, SSID performance Stats
Used for
Availability and
Performance
Monitoring
Event Types
PH_DEV_MON_RUCKUS_CONTROLLER_STAT
[PH_DEV_MON_RUCKUS_CONTROLLER_STAT]:[eventSeverity]=PHL_INFO,[fileN ame]=deviceRuckusWLAN.cpp,[lineNumber]=555,[hostName]=guest-zd-01,[ hostIpAddr]=172.17.0.250,[numAp]=41,[numWlanClient]=121,[newRogueAP
]=0,[knownRogueAP]=0,[wlanSentBytes]=0,[wlanRecvBytes]=0,[wlanSentB itsPerSec]=0.000000,[wlanRecvBitsPerSec]=0.000000,[lanSentBytes]=16
6848,[lanRecvBytes]=154704,[lanSentBitsPerSec]=7584.000000,[lanSent
BitsPerSec]=7032.000000,[phLogDetail]=
PH_DEV_MON_RUCKUS_ACCESS_POINT_STAT
[PH_DEV_MON_RUCKUS_ACCESS_POINT_STAT]:[eventSeverity]=PHL_INFO,[fil eName]=deviceRuckusWLAN.cpp,[lineNumber]=470,[hostName]=AP-10.20.30
.3,[hostIpAddr]=10.20.30.3,[description]=,[numRadio]=0,[numWlanClie nt]=0,[knownRogueAP]=0,[connMode]=layer3,[firstJoinTime]=1404672517
29776,[lastBootTime]=140467251729776,[lastUpgradeTime]=140467251729
776,[sentBytes]=0,[recvBytes]=0,[sentBitsPerSec]=0.000000,[recvBits
PerSec]=0.000000,[phLogDetail]=
PH_DEV_MON_RUCKUS_SSID_PERF
Page 692
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_RUCKUS_SSID_PERF]:[eventSeverity]=PHL_INFO,[fileName]=d eviceRuckusWLAN.cpp,[lineNumber]=807,[hostName]=c1cs-guestpoint-zd-
01,[hostIpAddr]=172.17.0.250,[wlanSsid]=GuestPoint,[description]=We lcome SSID for not yet authorized APs.,[wlanName]=Welcome
SSID,[authenMethod]=open,[encryptAlgo]=none,[isGuest]=1,[srcVLAN]=5
98,[sentBytes]=0,[recvBytes]=0,[sentBitsPerSec]=0.000000,[recvBitsP erSec]=0.000000,[authSuccess]=0,[authFailure]=0,[assocSuccess]=0,[a ssocFailure]=0,[assocDeny]=0,[disassocAbnormal]=0,[disassocLeave]=0
,[disassocMisc]=0,[phLogDetail]=
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Configuration
Configure the Controller so that AccelOps can connect to via SNMP.
Page 693
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using Virtual IPs to Access Devices in Clustered Environments
AccelOps communicates to devices and applications using multiple protocols. In many instances, access credentials for discovery protocols such as SNMP and WMI will need to be associated to the real IP address (assigned to a network interface) of the device, while application performance or synthetic transaction monitoring protocols (such as JDBC) will need the Virtual IP (VIP) assigned to the cluster. Since AccelOps uses a single access IP to communicate to a device, you need to create an address translation for the Virtual IPs.
1. Log into your AccelOps virtual appliance as root
.
2. Update the mapping in your IP table to map the IP address used in setting up your access credentials to the virtual IP.
iptables -t nat -A OUTPUT -p tcp --destination <access-ip> --dport
<destPort> -j DNAT --to-destination <virtual-ip>:<destPort>'
As an example, suppose an Oracle database server is running on a server with a network address of
10.1.1.1
, which is in a cluster with a VIP of
192.168.1.1
. The port used to communicate with Oracle over JDBC is 1521. In this case, the update command would be: iptables -t nat -A OUTPUT -p tcp --destination 10.1.1.1 --dport 1521 -j
DNAT --to-destination 192.168.1.1:1521
Page 694
FortiSIEM Installation Guide
Configuring Syslog over TLS
To receive syslog over TLS, a port needs to be enabled and certificates need to be defined.
The following configurations are already added to phoenix_config.txt in Super/Worker and Collector nodes.
FortiSIEM Installation Guide listen_tls_port_list=6514 tls_certificate_file=/etc/pki/tls/certs/tls_self_signed.crt
tls_key_file=/etc/pki/tls/private/tls_self_signed.key
Note - the syslog over TLS client needs to be configured to communicate properly with FortiSIEM.
Page 695
FortiSIEM Installation Guide FortiSIEM Installation Guide
Discovering Infrastructure
FortiSIEM can automatically discover the devices, applications, and users in your IT infrastructure and begin monitoring them. You initiate device discovery by providing the credentials that are needed to access the infrastructure component, and from there FortiSIEM is able to discover information about your component such as the host name, operating system, hardware information such as CPU and memory, software information such as running processes and services, and configuration information. Once discovered, FortiSIEM will also begin monitoring your component on an ongoing basis.
Though FortiSIEM is able to automatically manage device discovery, the pulling of event information such as logs and IPS events from your device, and establishing what aspects of your device functionality it can monitor, you can also manually configure the way FortiSIEM interacts with your infrastructure by
creating custom event pulling methods and monitoring profiles for your devices
.
Check Device Configuration Before Initiating Discovery
Before you begin the process of device discovery, you should make sure your devices are properly configured for discovery and
for more information.
WMI or SNMP for Discovery of Windows Devices
Windows servers can be discovered by either SNMP or WMI. or both. SNMP provides installed software information, while WMI provides all application metrics, detailed system metrics, and logs.
Ping-Only Discovery for Basic Up/Down Status
If you only need to monitor a device for up/down status, then select the
Ping Discovery Only
option when setting the
Range
Definition
for discovering the device. The device will be listed in the CMDB and consume one device license.
Additional Information in the Help Center
You can find additional information about setting access credentials and discovering devices in the Device Discovery section of the
Help Center maintained by FortiSIEM Support.
Setting Device Location Information
Discovery for Multi-Tenant Deployments
Setting Access Credentials for Device Discovery
Discovering Amazon Web Services (AWS) Infrastructure
Discovering Microsoft Azure Infrastructure
Approving Newly Discovered Devices
Inspecting Event Pulling Methods for Devices
Inspecting Changes Since Last Discovery
Discovery Range Definition Options
Adding Devices to the CMDB Outside of Discovery
Page 696
FortiSIEM Installation Guide FortiSIEM Installation Guide
Discovery Settings
Before you initiate discovery, you should configure the Discovery Settings in your Supervisor.
1.
2.
3.
Log in to your Supervisor node.
Go to
locations.
.
Configure the settings as required for your deployment.
See
Admin > General Settings > Discovery
Setting Description
Virtual IPs
Often a common virtual IP address will exist in multiple machines for load balancing and failover purposes. When you discover devices, you need to have these virtual IP addresses defined within your discovery settings for two reasons:
Listing the virtual IP addresses ensures that two or more devices with the same virtual IP will not be merged into one device during device discovery, so each of the load-balanced devices will maintain their separate identity in the
CMDB
The virtual IP will not be used as an access IP during discovery, since the identity of the device when accessed via the virtual IP is unpredictable
Click the
Edit +
Excluded
Shared
Device IPs
An enterprise often has servers that share credentials, for example mail servers, web proxies, and source code control servers, and a large number of users will authenticate to these servers to access their services. Providing a list of of the
IP addresses for these servers allows FortiSIEM to exclude these servers from user identity and location calculations in the
Analytics > Identity and Location
report.
For example, suppose user U logs on to server M to retrieve his mail, and server M authenticates user U via Active
Directory. If server M is not excluded, the
Analytics > Identity and Location Report
will contain two entries for user U: one for the workstation that U logs into, and also one for server M. You can eliminate this behavior by adding server M to the list of Server IPs with shared credentials.
Allow
Incident
Firing On
CMDB
Device
Filter
With this setting you can control incident firings based on approved device status. If you select
Approved Devices
Only,
then FortiSIEM will use this logic to determine if an incident is triggered:
If an incident reporting device is not approved, the incident does not trigger
If an incident reporting device is approved, then there are two possible cases: (a) at least one Source, Destination or Host IP is approved and the incident triggers, or (b) none of the Source, Destination or Host IPs are approved and the incident does not trigger
If you select
Approved Devices Only
, then when the discovery process completes, you will need to approve devices, as described in
Approving Newly Discovered Devices
, before incidents are triggered.
This setting allows you to limit the set of devices that the system automatically discovers from logs and netflows. After receiving a log from a device, the system automatically discovers that device, and then adds it to CMDB. For example, when a Netflow analysis detects a TCP/UDP service is running on a server, the server, along with the open ports, are added to CMDB. Sometimes you may not want to add all of these devices to CMDB, so you can create filters to exclude a specific set of devices from being added to CMDB.
Each filter consists of a required
Excluded IP Range
field and an optional
Except
field. A device will not be added to
CMDB if it falls in the range defined in the Excluded IP Range field. For example, if you wanted to exclude the
172.16.
20.0/24
network from CMDB, you would to add a filter with
172.16.20.0-172.16.20.255
in its
Excluded IP
Range
field.
The
Except
field allows you to specify some exceptions in the excluded range. For example, if you wanted to exclude the
172.16.20.0/24
network without excluding the
0.0-172.16.20.255
in the
172.16.20.0/26
network, you would add a filter with
Excluded IP Range
field, and
172.16.2
172.16.20.192-172.16.20.255
in the
Except
field.
Click
Add
to add a new CMDB Device Filter, then click
Apply
.
Page 697
3.
FortiSIEM Installation Guide FortiSIEM Installation Guide
Application
Filtering
This setting allows you to limit the set of applications/processes that the system automatically learns from discovery.
You may be more interested in discovering and monitoring server processes/daemons, rather than client processes, that run on a server. To exclude client processes from being discovered and listed in the CMDB, enter these applications here. An application/process will not be added to CMDB if it matches one of the entries defined in this table.
Click Add, then enter the
Process Name
and any
Parameters
for that process that you want to filter.
Matching is exact and case-insensitive based on Process Name and Parameter. If Parameter is empty, then only Process Name is matched.
Page 698
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Device Location Information
In the
Admin > General Settings > Discovery
screen, you can set device locations based on IP range and organization. You can do this manually for each organization or IP range, or upload a CSV file that contains location information. This information can then be applied to devices already in the CMDB, or during the discovery process, to set their location.
Manually Creating Location Information
Uploading Location Information from a CSV File
Manually Creating Location Information
1.
2.
3.
4.
Log into your Supervisor node.
Go to
Admin > General Settings > Discovery
.
5.
Under
Location
, click
Add
.
For Multi-Tenant deployments, enter the
Organization
you want to associate with the IP range and devices.
Enter the
IP/IP Range
you want to associate with the location.
192.168.64.0-192.168.64.255
.
6.
7.
8.
9.
This can be in either CIDR notation, such as
For example,
Enter any additional location information that is relevant for your location.
Click
In the
OK
.
,
Location Definition
dialog, select
192.168.64.0/24
, or range notation, such as
Enter the
Display Name
you want to use for this location.
, etc.
Update Manual Devices
if you want to update devices that have had their locations set
10. manually in the CMDB.
Click
OK
.
11.
The location information will appear in the
Location
pane.
Select a location in the
Location
pane, and then click
Apply
organization and location.
A dialog will indicate how many devices have been updated.
to associate all devices in the CMDB with that IP/IP range to that
12.
13.
Click
OK
.
Go to CMDB > Devices and check that your device locations have been updated.
Uploading Location Information from a CSV File
Prerequisite
Before you can upload it, you must first create a CSV file with this format.
Comma-separated IP address, Range, or Subnet
Example
Location Display
Name
Update Manual Devices
(False/True)
"10.1.1.1/24,20.1.1.1-20.1.1.10" San Jose
Datacenter
USA true
Geographic Information
("region:;country:;state:;city:;building:;floor:;latitude:;longitude:;")
"30.1.1.10" Fremont
Datacenter
USA true "region:North America;country:United
States;state:California;city:Fremont;building:10;floor:4;latitude:38.1747222;longitude:-121.2775;"
Procedure
1.
2.
3.
4.
5.
Log into your Supervisor node.
Go to
Admin > General Settings > Discovery
.
Under
Click
Location
Upload
.
, click
Import
.
Browse to your CSV file and select it.
Page 699
FortiSIEM Installation Guide FortiSIEM Installation Guide
Discovery for Multi-Tenant Deployments
In multi-tenant deployments with organizations, the discovery process differs depending on whether or not you are using Collectors. This is because of the way in which IP addresses are used to establish the relationship between devices and organizations.
If you are using Collectors, IP address overlap between organizations is allowed
If you are not using Collectors, then each organization must have a unique IP address
These two requirements determine which administrative account you will use for discovery.
For organizations with collectors, you must initiate discovery using the administrative account associated with the organization. Every device discovered by a collector is automatically assigned to the organization that the collector belongs to.
.
For organizations without collectors, you must initiate discovery using the Super/Global administrative account. Devices for all organizations are discovered at the same time, and are assigned to organizations based on the IP address assignments
you set up for the organization
.
If a device matches only one organization's IP address assignment, then it is assigned to that organization
If a device matches multiple organization definitions, then it is assigned to the Super/Global organization. These would typically be devices that are part of the Super/Global organization's network backbone.
Related Links
How Devices are Added to Organizations
Managing Organizations for Multi-Tenant Deployments
Page 700
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting up CyberArk
This section specifies how FortiSIEM can be configured to fetch credentials from CyberArk.
Installing CyberArk Provider in FortiSIEM
Refer to “
Credential Provider and ASCP Implementation Guide
” for more details on CyberArk Credential Provider installation.
1.
2.
Login to FortiSIEM as root
Run the rpm command to begin the installation: rpm -i CARKaim-<version>-<build number>.x86_64.rpm
The installation runs automatically and does not require any interactive response from the user. When the installation is complete, the following message appears: “Installation process completed successfully.”
Configuring CyberArk Provider in FortiSIEM
Refer to “
Credential Provider and ASCP Implementation Guide
” for more details on CyberArk Credential Provider installation.
1.
2.
3.
Login as root
Open the Vault.ini file and specify the parameters of the Vault that will be accessed by the Provider
Run
CreateCredFile
to create a credential file for the administrative user that will create the Vault environment during installation.
Createcredfile <filename> Password -Username <username> -Password
<password>
4. Run the
CreateEnv
utility that was copied to the bin folder during Provider installation
CredFilePath <CredFilePath> -VaultFilePath <VaultFilePath>
-AppProviderUser <ProviderUserName> -LicensedProducts <AIM\OPM\ALL>
[-AppProviderConfSafe <ConfigurationSafeName>]
[-MainAppProviderConfFilePath <MainConfigurationFilePath>]
[-OverrideExistingConfFile <Y\N>] [-PIMConfigurationSafe
<PIMConfigurationSafeName>] [-AppProviderUserLocation
<ApplicationUsersLocation>]
5.
6.
7.
Check the log file
/var/tmp/aim-install-logs/CreateEnv.log
to make sure that the Provider environment was created successfully
Start the CyberArk Application Password Provider service manually as a privileged user
Run
ldconfig
Configuring CyberArk for communication with FortiSIEM
Refer to the Privileged Account Security Implementation Guide for more information about adding and managing privileged accounts.
1.
Page 701
FortiSIEM Installation Guide FortiSIEM Installation Guide
1. Login to CyberArk Password Vault Web Access (PVWA) Interface as an user allowed to managed applications (it requires Manage Users
2. authorization).
Add FortiSIEM as an Application a. b. c. d.
Go to
Applications
and click
Add Application.
Set
Name
to FortiSIEM
In the
Description
, specify a short description of the application that will help you identify it (e.g. FortiSIEM SIEM) e.
In the
Business owner
section, specify contact information about the application’s Business owner.
In the lowest section, specify the
Location
of the application in the Vault hierarchy. If a Location is not selected, the application f. will be added in the same Location as the user who is creating this application.
3. Check
Click
Add
; the application is added and is displayed in the Application Detailspage
4.
Allow extended authentication restrictions
domain OS users for a single application
– this enables you to specify an unlimited number of machines and Windows
Specify the application’s (FortiSIEM) application characteristics before retrieving the application password.
a. b.
Authentication
details. This information enables the Credential Provider to check certain c. d. e.
In the
Authentication
tab, click
Specify the OS user as
Specify the application path as “/opt/phoenix/bin”. Make sure check boxes are checked
Do not specify a hash
Add
; a drop-down list of authentication characteristics is displayed.
“admin”
and Click
Add
Add.
Path is folder
and Allow internal scripts to request credentials...
and specify the IP/host name of the FortiSIEM Supervisor, Workers and Collectors In the
Allowed Machines
tab, click
5. Authorize FortiSIEM to retrieve accounts. a. b. c. d. e. f.
Go to >
For every
Safe
, Click on
Click on
Members
Add Safe Member
Check
Retrieve accounts.
Click
Add
.
Search for FortiSIEM. An entry will already exist. Select that entry.
Now FortiSIEM should be ready to retrieve passwords from CyberArk via Test Connectivity and Discovery.
Page 702
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Access Credentials for Device Discovery
Before you can discover devices, you need to provide the access protocol and credentials associated with the IP address or range where your devices are located. FortiSIEM will then use this information to access your devices, pull information from them, and begin monitoring them.
Access Protocols Required for Discovery
SNMP, VM SDK (for VMware vCenter), or WMI (for Windows devices) must be one of the access protocols for which you provide credentials in order for the devices associated with an IP address or range to be discovered. If your device does not use one of these
send logs and other information to FortiSIEM.
Associate Credentials Only with the IP Address Where They Will be Used
Credentials should only be associated with IP addresses where they can be used. Assigning multiple credentials to IP addresses where they are not used will trigger discovery operations for each credential, and the system will wait for a timeout to occur for each credential before it moves to the next one. This will cause the discovery process to require much more processing time and processing power from the FortiSIEM system.
You can, however, associate the same credential (for example, a generic SNMP access credential) to multiple IP addresses where it will be used to communicate with a device over that protocol.
Before starting the discovery process, credentials need to be defined and then associated to specific IP addresses.
CyberArk configuration
If CyberArk is going to be used for Test Connectivity and Discovery, then first follow the steps defined
.
Define Credentials
1.
2.
3.
4.
Log into your Supervisor node.
Go to
Admin > Setup Wizard > Discovery
.
5.
6.
Under
Enter Credentials
, click
Enter a
Name
for the credential.
Add
.
Select a
Device Type
to associate with the credential.
Select the
Access Protocol
for which you want to enter credentials.
7.
Note that the Device Type selection determines which Access Protocols are available.
Change the default destination ports only if needed
Choose
Password Configuration
method a. b.
Manual - means that you have to define credentials in FortiSIEM
CyberArk - means Accelps will fetch credentials from CyberArk
8.
9.
If you choose
If you choose as
10. Click a. b. c. d. e.
CyberArk
Specify
Save
Database
as
. The match will be case sensitive.
then enter the credentials required for the Access Protocol.
then choose CyberArk parameters
AppID must be set to FortiSIEM
Specify
Safe, Folder, Object
: This is the CyberArk Vault Safe, Folder, Object where the credential is defined.
Specify
User Name
: This is the User Name of the credential
Specify
Platform (Policy ID):
This is the platform related property for the credential. Specify this only if this property is also set in
: This is a property for the database credential. Specify this only if this property is also set in CyberArk . The f. match will be case sensitive.
Check
Include Address for Query
: If checked, FortiSIEM will query the CyberArk credential by IP or host name. Specify this if
CyberArk credential objects are specified by IP.
. The credentials you created will be added to the list.
Specify Device to Credential Mapping
1.
2.
3.
Under
Enter IP Range to Credential Associations
Select the credential you just created from the list.
Enter an , , or
Host Name
, click
Add
.
to associate with the credential.
+
Formats for IP Information
You can provide the IP information in several formats:
A single IP address e.g. 192.168.1.1
A range of IP addresses in the format <IP Address>-<IP Address>
Page 703
3.
FortiSIEM Installation Guide FortiSIEM Installation Guide
A IP subnet specified in CIDR notation <IP Address> /<Maskbits> e.g. 192.168.0.0/16 to specify the IP range
192.168.0.0-192.168.255.255
A combination of the three formats separated by comma, e.g. 192.168.1.1, 192.168.1.2, 10.10.0.0/16, 10.11.0.0-10.11.255.255
A host name
4. Click
OK
.
Test Connectivity
You need to perform a
Test Connectivity
to make sure that the credentials are correct.
1. Select the IP/credential association you just created, and click
Test Connectivity
. A ping will be performed first to make sure that the host is alive. If ping is disabled in your network, then choose
Test Connectivity without ping
.
A dialog will show you the results of your connectivity tests. Note that the connectivity tests can take several minutes, so you may want to use the
Run in Background
option.
Page 704
FortiSIEM Installation Guide FortiSIEM Installation Guide
Discovering Devices
Prerequisites
Make sure you have configured the
Discovery Settings for your deployment
Set up the
Access Credentials for your devices so FortiSIEM can communicate with them
Procedure
discover devices in your IT infrastructure.
1. Log in to your Supervisor node.
Discovering Devices for Multi-Tenant Deployments
If you have a multi-tenant FortiSIEM deployment that uses Collectors and you and want to discover devices for a specific organization, rather than the Global organization, log into your Supervisor node as an admin user for that organization. See
Dis covery for Multi-Tenant Deployments
without Collectors.
for more information about how discovery works for multi-tenant deployments with and
2.
3.
4.
5.
6.
Go to
Admin > Setup Wizard > Discovery
.
Click
See
Click
Add
OK
.
.
You can also schedule single or recurring discovery processes as described in
In the
Range Definition
dialog, set the options for this discovery.
Discovery Range Definition Options
Your range definition will be added to the list.
.
for more information about the options available in this dialog.
Select your range definition, and then click
Discover
.
A discovery dialog will show you the progress of your discovery. For long-running discoveries, you can use the
7. n.
When discovery completes, the results will be displayed in the dialog. Click
Errors
to view any errors.
Run in Background
optio
Possible Causes of Discovery Errors
If there are errors during the discovery process, the Errors screen will inform you of their severity, impact, and potential resolution. Some possible reasons for errors include:
A device is not online or not reachable via ping. FortiSIEM will attempt to ping devices before initiating a full discovery to save time.
A device is not responding to SNMP or WMI requests, or there is a firewall blocking these requests from FortiSIEM
The SNMP/WMI credentials are incorrect
WMI may not have been set up correctly on the server. See the appropriate topic under
Configuring External Systems for Discovery and Monitoring
for how to configure WMI for your device.
Approving Newly Discovered Devices
If you selected
Approved Devices Only
for the discovery setting
Approving Newly Discovered Devices for more information.
Allow Incident Firing On
, as described in
Page 705
FortiSIEM Installation Guide FortiSIEM Installation Guide
Discovering Amazon Web Services (AWS) Infrastructure
Discovering infrastructure in AWS follows the same basic process described in
assignment. The generic
Setting Access Credentials for Device Discovery
AWS SDK
credential is used to discover Amazon Machine Instances (AMIs) and associated information such as host name, instance ID, and instance state, while credentials for generic versions of WMI, SMTP, and other access protocols are used to discover associated devices as you would for any other discovery process.
Setting Access Credentials for AWS Instances
Associating the AWS Host with Credentials
If you have not already configured Access Keys and permissions on AWS, please follow the steps outlined in
AWS Access Key IAM Permissions and IAM Policies
.
Setting Access Credentials for AWS Instances
5.
6.
7.
8.
1.
2.
3.
4.
Log into your Supervisor node.
Go to
Admin > Setup Wizard > Discovery
.
Under
Enter Credentials
, click
Enter a
Name
for the credential.
Add
.
For
For
Device Type
, select
Access Protocol
Amazon AWS SDK
, select
Enter the
Access Key ID
and
AWS SDK
.
.
For
Region
, enter the region where your AWS instance is located.
Secret Access Key
associated with your AWS instance.
9. Click
Save
.
Associating the AWS Host with Credentials
After you've defined all the credentials associated with the access protocols used by devices in your AWS instance, you need to associate those credentials to the AWS host. In other deployment configurations, you would associate credentials with IP addresses corresponding to your device locations, but since AWS uses dynamic IP addressing, you need to associate all your credentials to the same host.
1.
2.
3.
4.
Under
Enter IP Range to Credential Associations
, click
Add
.
For
IP/Host Name
, enter
amazon.com
.
Click , and add the
AWS SDK
credential, as well as any other generic credentials you've created.
5.
Click
Click
OK
.
Test Connectivity
to make sure you can reach your instance and that all credentials are entered correctly before you initiate discovery.
Both the connectivity test and the discovery process will try to connect to the Amazon instances first, and from there will try to connect to
6. the private IPs of discovered instances using the other access protocols.
, but for select
AWS Scan
.
Discovery Type
,
If discovery is successful, your discovered instances and devices will be added to in
CMDB > Devices
, you will see an credentials, the discovered devices will also appear in that directory, as well as under directory.
Admin > Setup wizard > Monitor Change/Performance
, and
Amazon EC2
directory, which will include your discovered instances. If you have defined other access
CMDB > Server
. You can query these devices from either
Page 706
FortiSIEM Installation Guide FortiSIEM Installation Guide
Discovering Microsoft Azure Infrastructure
Discovering Microsoft Azure Cloud infrastructure follows the same basic process described in
Setting Access Credentials for Device Discovery
an d
IP address assignment.
Create a Certificate file for communicating to Azure Management Server
Setting Access Credentials for Microsoft Azure Discovery
Associating Microsoft Azure with Credentials
Discovering Microsoft Azure Compute Nodes
Create a Certificate file for communicating to Azure Management Server
1. Create a pem file openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout azure-cert.pem -out azure-cert.pem
2. Create the cert file openssl x509 -outform der -in azure-cert.pem -out azure-cert.cer
3. Login to the Azure old portal, upload the .cer to the Settings->"Management Certificates" section.
Setting Access Credentials for Microsoft Azure Discovery
5.
6.
7.
8.
1.
2.
3.
4.
Log into your Supervisor node.
Go to
Admin > Setup Wizard > Credentials
.
Under
Enter Credentials
, click
Enter a
Name
for the credential.
Add
.
For
For
Device Type
Upload the
, select
Subscription ID
Microsoft Azure Compute
, enter .
Certificate File
Enter the
Access Key ID
and
Secret Access Key
.
, enter the region where your AWS instance is located.
associated with your AWS instance.
9. Click
Save
.
Associating Microsoft Azure with Credentials
After you've defined all the credentials associated with the access protocols used by devices in your Microsoft Azure instance, you need to associate those credentials.
1.
2.
3.
4.
5.
6.
7.
Log into your Supervisor node.
Go to
Admin > Setup Wizard > Credentials
.
Under
For
Click
Click
+
Enter IP Range to Credential Associations
IP/Host Name
, enter
azure.com
.
Click , and add the
Microsoft Azure Compute
as any other generic credentials you've created.
OK
.
Test Connectivity
discovery.
, click
Add
.
credential created in "Setting Access Credentials for Microsoft Azure Discovery", as well
to make sure you can reach your instance and that all credentials are entered correctly before you initiate
Discovering Microsoft Azure Compute Nodes
Page 707
FortiSIEM Installation Guide FortiSIEM Installation Guide
After you've defined and tested all the credentials, you can proceed to discovery.
1.
2.
3.
4.
5.
6.
Log into your Supervisor node.
Go to
For
Admin > Setup Wizard > Discovery
Click
Add
Discovery Type
, select
Azure Scan.
.
Click
Save.
Select the entry just created and click
Discover.
If discovery is successful, your discovered instances will be added to
Admin > Setup wizard > Monitor Change/Performance
and
CMDB >
Devices > Microsoft Azure Cloud > Azure Compute.
Page 708
FortiSIEM Installation Guide FortiSIEM Installation Guide
Approving Newly Discovered Devices
When devices are discovered by FortiSIEM, monitoring of them begins automatically, and incidents for those devices will trigger automatically based on the rules associated with that device. However, you can configure the
so incidents will be triggered only for devices you approve. If you select
Approved Devices Only
for
Allow Incident Firing On
, then you will need to approve devices before incidents will be triggered for those devices, but they will still be monitored and added to the CMDB.
1.
2.
3.
4.
5.
6.
Log in to your Supervisor node.
Go to
Admin > Discovery Results
.
Select a discovery result.
Click
View Changes
Expand the folder
.
Discovery Delta
.
7.
Expand the folder
New Devices
.
Select the devices you want to approve, and click
Approve Selected
You can approve all the new devices by selecting the
New Devices
.
folder, and then click
Approve All
.
Related Links
Page 709
FortiSIEM Installation Guide FortiSIEM Installation Guide
Inspecting Event Pulling Methods for Devices
Once you have
approved the devices in your IT infrastructure, you should verify that the FortiSIEM
perfMonitor
module is polling them over the correct access protocol and pulling event information from them. If you are having issues collecting performance metrics from your devices, you should begin troubleshooting by first checking the status of the event pulling method for the device.
1.
2.
Go to
Admin > Setup Wizard > Pull Events
.
Review the
Event Pulling Status
for each of your discovered devices.
Status Description
Successful If event information is being pulled from the device, you will see the name of the event pulling method rendered in plain black text.
Added but
Not
Monitored
Paused
If the name of the event pulling method has a device, but the perfMonitor
Star
icon next to it, event information can be successfully pulled from the
module has not yet initiated monitoring.
A
Pause
icon indicates that event information is not being pulled from the device because it failed the verification check at the beginning of the monitoring cycle. This is usually caused by an issue with the credential was valid when discovery succeeded, and so the event pulling method was able to monitor the associated metrics, but the perfMonitor
. The
module failed on the credential at a later time. You should check the access protocol credentials associated with the devices and event pulling methods, and then re-initiate discovery of the device.
Failed
An
Alert
icon and the name of the event pulling method in red indicates that adding that event pulling method for the device failed.
3.
4.
5.
6.
Click
Click
Show Errors
Click
Edit
to view a more detailed description of any errors associated with an event pulling method.
to change any of the event pulling methods associated with a device.
Apply
to apply any changes to your event pulling methods.
Click
Test Pull Events
to test any changes you make.
Page 710
FortiSIEM Installation Guide FortiSIEM Installation Guide
Inspecting Changes Since Last Discovery
After you run discovery for the first time, FortiSIEM keeps track of changes to your discovered devices during subsequent discovery runs, including new devices, changed devices, and failed devices.
1.
2.
3.
4.
5.
6.
Log in to your Supervisor node.
Go to
Admin > Discovery Results
.
Select a discovery result.
Click
View Changes
Expand the folder
Move your mouse cursor over a folder or item until a blue Information icon appears, and then click on the icon to view basic information about the item.
.
Discovery Delta
.
Page 711
FortiSIEM Installation Guide FortiSIEM Installation Guide
Discovery Range Definition Options
When you set the range definition for your discovery processes, several options are available for how you want the discovery process to run.
Option Description
Discovery Type Four types of scans are available for the discovery process:
Smart
Scan
Range
Scan (d efault)
AWS
Scan
L2
Scan
Smart Scan is an optimized search method in which only the live devices in the network are searched. To use
Smart Scan, you first provide a root device (typically the first hop Layer 3 router). FortiSIEM then discovers the root device and learns of its first hop neighbors from the ARP table. These devices are then discovered using existing credentials, and their one hop neighbors are subsequently discovered. This continues until no more devices are discovered. Often a single Layer 3 router, switch, or firewall is sufficient to discover the entire network. However, if a firewall that can block SNMP is installed, then devices on either side of the firewall need to be provided as root devices. Smart Scan is usually faster than Range Scan, but in rare cases discovery can miss a device when it is quiet and not present in the ARP table of adjacent devices.
In contrast to Smart Scan, Range Scan is a brute force method in which FortiSIEM attempts to discover all the devices in the IP ranges you provide. With Range Scan, FortiSIEM will first attempt to ping a device, and if that succeeds, discovery will proceed.
AWS Scan is used to discover devices in Amazon Web Services. See
Discovering Amazon Web Services
(AWS) Infrastructure for more information.
L2 Scan is used to update the Layer 2 connectivity information used in the Identity and Location report. It does not discover system and application monitors, installed and running software, or users and groups, and, in contrast to the other scan methods, it does not update the CMDB and executes more quickly.
Root IPs
Include/Exclude
Domains (AWS
Only)
Include/Exclude
Zones (AWS
Only)
Include/Exclude
Ranges
Include/Exclude
Device Types
Do Not Ping
Before
Discovery
Ping Only
Discovery
Only Discover
Devices not in
CMDB
For Smart Scan only, provide the root IPs from which you want the Smart Scan to start.
Enter the domains you want to include or exclude from the discovery process.
Enter the zones you want to include or exclude from the discovery process.
Enter the IP addresses or host names you want to include or exclude from the discovery process.
Click the
Edit
icon to select devices that you want to include or exclude from the discovery process. Note that if you have entries for both of these option, the discovery process will prioritize included devices over excluded ones.
To save time, FortiSIEM first attempts to reach devices by ping before initiating discovery. You should select this option if ping has been disabled for your network, otherwise discovery will fail.
Select this option if you are only interested in discovering whether a device or service is up or down.
If you select this option, discovery will only find those devices whose IP addresses do not match the address of any device in CMDB. To make an exception to this rule, specify a list of IP addresses in the
By default, only powered on VMs are discovered.
Exclude Ranges
field. The primary use case for this is for indirect device discovery such as VCenter-based VM discovery, or WLAN controller-based access point discovery. By specifying the VCenter IP address in the Exclude Ranges field, new guest VMs can always be discovered even if the VCenter is already in the CMDB.
Include
Powered Off
VMs
Include VM
Templates
Discover
Routes
By default, VM templates are not discovered.
Selected by default, if you clear this option then discovery will not use the route table to find next hop devices. This can be useful if your network includes border routers, which can significantly impact the time required for the discovery process.
Page 712
FortiSIEM Installation Guide FortiSIEM Installation Guide
Scheduling a Discovery
Discovery can be a long-running process when performed on a large network, or over a large IP range, and so you may want to schedule it to occur when there is less load on your network or during off hours. You may also want to set up a schedule for the process to run and discover new devices on a regular basis.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Admin > Setup Wizard > Discovery
.
5.
Click
Schedule
Click the icon.
.
6.
7.
+
Select from the available ranges.
You can select multiple ranges and set the order in which discovery will run on them by using the up and down arrows.
Set the time at which you want discovery to run.
8.
For a one-time scheduled discovery, enter a
Date
for the discovery to run.
9.
For recurring discoveries, select how often (hourly, daily, weekly, monthly), you want discovery to run, and then enter other scheduling options.
Click
OK
.
Page 713
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Devices to the CMDB Outside of Discovery
There are situations in which you may want to add devices to the Configuration Management Database (CMDB) outside of the discovery procedure. For example, FortiSIEM needs access to devices over SNMP or WMI to discover them, but you may have devices in your
may need to incorporate that device. In order to make sure that logs are parsed correctly and rules function as expected, you need to make sure that these undiscovered devices are associated with an IP address. Adding a device directly to the CMDB lets you provide the information necessary for
FortiSIEM to recognize the device, including associating it with an IP address or range.
Adding Devices to Device Groups
When you add a device to the CMDB manually, make sure to choose the group, such
View
where you want to add it. If you only add it to the top-most
Devices
, , or
group, it will not be added to the
Storage
, in the
Device
correctly.
1.
2.
3.
4.
5.
Log into your Supervisor node.
Click
CMDB
.
In the
For
Device View
,
, select
Devices
, then select the sub-category where you want to add the device.
In the summary pane, click
,
New
.
, and
Properties
, enter information for the new device.
Entering Interface Information
When you enter the interface information for the device, make sure to provide the correct IP address and network mask for the interfaces. FortiSIEM will use this network information to generate the
Network Segments
for the device.
6. Click
Save
when you're done adding the device information.
Related Links
Adding a Synthetic Monitoring Test to a Business Service
Page 714
FortiSIEM Installation Guide FortiSIEM Installation Guide
Decommissioning a device
Decommissioning a device lets you re-assign the IP address to a new device but still keep the old device in CMDB for historical purposes.
To decommission a device
1.
2.
3.
4.
5.
Go to >
Select the device.
Click on the menu under
Provide a
Name
and select
and Select to decommission the device
Consequences of decommissioning a. b. c. d.
Reason OK
Device will be moved to >
Decommission
>
.
Device will be removed from maintenance calendars
Performance monitoring will stop
A new device with the same IP can be discovered
folder
To re-commission the device
1.
2.
3.
4.
5.
Go to >
Select the device.
Click on the menu under
Name
and select
Recommission
.
The device will be moved back to the folder where it was when it was decommissioned.
Performance monitoring will resume
Page 715
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring Monitoring
Once FortiSIEM discovers your devices, they will monitored continuously, and you can use the data collected to
when events that meet specific conditions occur in your infrastructure.
You can disable the collection of metrics for specific devices, disable devices for monitoring, and change the polling interval for metric collection.
Some devices need to be configured to send logs to FortiSIEM, as described in the topics under
Configuring External Systems for Discovery and
transaction to make sure that critical services are up and running.
Adding Critical Interfaces to Device Monitoring
Adding Important Ports to Device Monitoring
Adding Important Processes to Device Monitoring
Excluding Disks from Disk Capacity Utilization Monitoring
Managing Monitoring of System and Application Metrics for Devices
Setting Up Synthetic Transaction Monitoring Tests
Protocol Settings for Synthetic Transaction Monitoring Tests
Adding a Synthetic Monitoring Test to a Business Service
Page 716
FortiSIEM Installation Guide FortiSIEM Installation Guide
Device Monitoring Settings
While FortiSIEM constantly monitors and reports on your IT infrastructure, there are several settings you can use to refine reporting on critical interfaces, important processes and ports, and disk utilization.
Adding Critical Interfaces to Device Monitoring
Adding Important Ports to Device Monitoring
Adding Important Processes to Device Monitoring
Excluding Disks from Disk Capacity Utilization Monitoring
Page 717
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Critical Interfaces to Device Monitoring
This setting allows you to always get network interface utilization reports on a set of important network interfaces.
Although FortiSIEM continuously monitors every network interface on every server and network device, reporting on the interface utilization for every network interface can consume a significant amount of resources. To conserve resources, FortiSIEM reports only on those network interfaces where errors or interface utilization exceeds a given threshold. By adding a device and its interface to the list of can make sure that FortiSIEM always reports on these network interfaces, even if utilization or errors are below the threshold. Matching for application of this setting for a device is case-insensitive and based on Device Name, Access IP, and Interface name.
Critical Interfaces
, you
1.
2.
3.
4.
Go to
Admin > General Settings > Monitoring
.
Under
Critical Interfaces
, click
5.
6.
Select either
Device View
or
Add
.
Interface View
.
Select a device to view and select its interfaces, or select an interface.
Click
OK
to add the selected interface to the list of Critical Interfaces.
Click
Apply All
.
Page 718
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Important Ports to Device Monitoring
Always reporting the UP/DOWN status for every TCP/UDP port on every server can consume a significant amount of resources. FortiSIEM will report the UP/DOWN status only for the ports you add to the
Important Ports
list. Matching is exact based on port number and IP protocol.
1.
2.
3.
4.
Go to
Admin > General Settings > Monitoring
.
Under
Important Ports
, click
Enter the
Port Number
Add
.
and select the
Port Type
.
5.
Click
Click
OK
.
Apply All
.
Page 719
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Important Processes to Device Monitoring
Although FortiSIEM continuously monitors every process on every server, always reporting resource utilization and UP/DOWN status for all these processes can consume a significant amount of resources. For this reason, FortiSIEM normally reports only on those processes where resource utilization crosses a threshold. If you add a process to the I mportant Processes list, FortiSIEM always reports on it, even if utilization is below the threshold. UP/DOWN status is also reported only for processes in this list. Matching is exact and case-insensitive based on process name and parameter. If the parameter is empty, then only the process name is matched.
1. Go to
Admin > General Settings > Monitoring
.
2.
3.
Under Important Ports, click
Click
Apply All
.
Add
4.
Enter a
Process Name
and any
.
Parameters
, and then click
OK
.
Page 720
FortiSIEM Installation Guide FortiSIEM Installation Guide
Excluding Disks from Disk Capacity Utilization Monitoring
You can exclude disks from disk capacity utilization monitoring.
Disk capacity utilization events will not be generated for devices matching the device name, access IP, and disk name that you provide. Incidents will not trigger for these events, and the disks will not show up in summary dashboards.
Exclude Stable, Almost-Full Disks
Use this list to exclude read-only disk volumes or partitions that do not grow in size and are almost full. This will prevent from these servers from always showing a
CRITICAL
status in dashboards.
1.
2.
3.
4.
Go to
Admin > General Settings > Monitoring
.
Under
Excluded Disks
Click
OK
Apply All
.
, click
Add
.
5.
Select a device to to view its disks, and then select the disk you want to exclude from monitoring.
Click .
Page 721
FortiSIEM Installation Guide FortiSIEM Installation Guide
Managing Monitoring of System and Application Metrics for Devices
When FortiSIEM discovers devices, it also discovers the system and application metics that can be monitored for each device, and displays these in the
Monitor Change/Performance
tab of the
Setup Wizard
. Here you can also disable the monitoring of specific metrics for devices, disable devices from being monitored, and change the polling interval for specific metrics. See explanation of the different status indicators for
System Monitor
and
Inspecting Event Pulling Methods for Devices
for an
Application Monitor
metrics.
1.
2.
Go to
Admin > Setup Wizard > Monitor Change/Performance
.
Click
Refresh
to make sure you have the latest list of devices.
Single Line Display
Select
Single Line Display
to view each device, along with its list of application and system monitors, on a single line.
3.
4.
To disable monitoring for a device, clear the
Enable
option for it.
To enable or disable monitoring of a specific metrics for a device, click on a device to select it, then click
Monitoring
or
Application Monitoring
Edit
to view the list of metrics associated with that monitor and device.
and select
System
You can also enable or disable the metrics for a device's monitor type by clicking on the
System Monitoring
or
Application
Monitoring
section for the device.
5. To change the polling interval for a metric, in the
More
menu, select
Set Intervals
. Select the
Monitor Type
6. the interval.
When you are done making changes, click
Apply
.
and
Device
, and then set
Page 722
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up Synthetic Transaction Monitoring Tests
A Synthetic Transaction Monitoring (STM) test lets you test whether a service is up or down, and measure the response time. An STM test can range from something as simple as pinging a service, to something as complex as sending and receiving an email or a nested Web transaction.
Setting up an STM test involves defining the type of monitor, associating the monitor definition to a device and testing it, and then deploying the
STM test to a Supervisor or Collector. You can view the results of STM tests in the
Synthetic Transaction Monitoring
page, either by navigating to
Summary Dashboard > Availability/Performance > Application Summary > Synthetic Transaction Monitoring
, or to
Wizard > Synthetic Transaction Monitoring
, and then clicking on reports
Top Applications By Synthetic Transaction Response Time
Detailed view.
for these rules.
Monitoring Status
and
Admin > Setup
. You can also report on the results of STM tests in the
Top Applications By Synthetic Transaction Response Time -
When an STM test fails, three system rules are triggered, and you can receive an email notification of that failure by
System Rule
Service Degraded - Slow
Response to STM
Service Down - No Response to STM
Service Staying Down - No
Response to STM
Description
Detects that the response time of an end-user monitored service is greater than a defined threshold (average over 3 samples in 15 minutes is more than 5 seconds)
Detects a service suddenly went down from the up state and is no longer responding to synthetic transaction monitoring probes.
Detects a service staying down, meaning that it went from up to down and did not come up, and is no longer responding to end user monitoring probes
1.
2.
3.
4.
Go to
Admin > Setup Wizard > Synthetic Transaction Monitoring
.
Click
Add
Enter a
.
Name
and
Description
for the test.
5.
For
Frequency
, enter how often, in minutes, you want the test to run.
Select the
Protocol
for your test.
See
Protocol Settings for Synthetic Transaction Monitoring Tests
for more information about the settings and test results for specific
6. protocols.
Click
Save
.
7.
8.
9.
10.
11.
You now have to associate the STM test with a target host name, IP address, or IP range.
Click
Create and Test
.
For
For
For
Monitoring Definition
Host Name
Port
Click .
+
or
select one of the STM tests you have created.
IP/Range
, enter the information for your STM test target.
, click and enter any ports to use when connecting to the target with this test.
OK
FortiSIEM will run the test and verify if it is successful. If it succeeds, it will be added to the list of tests with a yellow
12. indicating that it has been added but is not yet running.
Click
Apply All
to begin executing your tests at their set frequency.
The yellow Star will be removed from your test after it executes against the target the first time
Star
next to it,
Page 723
FortiSIEM Installation Guide FortiSIEM Installation Guide
Protocol Settings for Synthetic Transaction Monitoring Tests
This table describes the settings associated with the various protocols used for
setting up Synthetic Transaction Monitoring tests
.
Protocol
Ping
LOOP
HTTP(S) -
Selenium
Script
HTTP(S) -
Simple
Description
Checks packet loss and round trip time
This test sends an email to an outbound
SMTP server and then attempts to receive the same email from a mailbox via IMAP or POP.
It also records the end-to-end time.
This test uses a Selenium script to play back a series of website actions in FortiSIEM.
This test connects to a URI over HTTP(s) and checks the response time and expected results
Settings
Maximum Packet Loss PCT: tolerable packet loss
Maximum Average Round Trip Time: tolerable round trip time (seconds) from
FortiSIEM to the destination and back
If either of these two thresholds are exceeded, then the test is considered as failed.
Timeout: the time limit by which the end to end LOOP EMAIL test must complete.
Outgoing Settings
: these specify the outgoing SMTP server account for sending the email.
SMTP Server: name of the
SMTP server
User Name: user account on the SMTP server
Email Subject: content of the subject line in the test email
Incoming Settings
: These specify the inbound IMAP or POP server account for fetching the email.
Protocol Type: choose IMAP or POP
Server: name of the IMAP or
POP server
User Name: user account on the IMAP or POP server
Email Subject: content of the subject line in the test email
Upload: select the java file you exported from Selenium
T
otal Timeout
: the script must complete by this time or the test will be considered failed
Step Timeout
: each step must complete by this time
Notes
Before you set up the test you will need to have
up access credentials for an outbound SMTP
account for sending email, and an inbound
POP/IMAP account for receiving email
URI: the URI to connect to
Authentication: any authentication method to use when connecting to this
URI
Timeout: this is the primary success criterion - if there is no response within the time specified here, then the test fails
Contains: an expected string in the test results
Does Not Contain: a string that should not be contained in the test results
Response Code: an expected HTTP(S) response code in the test results. The default is set to
200 - 204
.
How to export:
Make sure Selenium IDE is installed within
Firefox browser
Open Firefox
Launch Tools > Selenium IDE. From now on,
Selenium is recording user actions
Visit websites
Once done, stop recording
Click File > Export Test case as > Java / Junit
4 /WebDriver
Save the file as .java in your desktop. This file has to be inputted in FortiSIEM.
Page 724
FortiSIEM Installation Guide FortiSIEM Installation Guide
HTTP(S) -
Advanced
This test uses HTTP requests to connect to a
URI over HTTP(s), and checks the response time and expected results
TCP
DNS
SSH
This test attempts to connect to the specified port using TCP
Checks response time and expected IP address
This test issues a command to the remote server over SSH, and checks the response time and expected results
+
against a URI.
URI: the URI to run the test against
SSL: Whether or not to use SSL when connecting to the URI, and the port to connect on
Authentication: the type of authentication use when connecting to the URI
Timeout: this is the primary success criterion - if there is no response within the time specified here, then the test fails
Method Type: the type of HTTP request to use
Send Parameters: click or the
Pencil
ic on to add or edit any parameters for the request
Contains: an expected string in the test results
Does Not Contain: a string that should not be contained in the test results
Response Code: an expected HTTP(S) response code in the test results. The default is set to 200 - 204.
Store Variables as Response Data for
Later Use:
click + or the Pencil icon to add or edit any variable patterns that should be used as data for later tests
Timeout: this is the single success criterion. If there is no response within the time specified here, then the test fails.
Query: the domain name that needs to be resolved
Record Typ
e: the type of record to test against
Result
: specify the expected IP address that should be associated with the DNS entry
Timeout: this is the primary success criterion - if there is no response within the time specified here, then the test fails
Remote Command: the command to run after logging on to the system
Timeout: this is the primary success criterion - if there is no response within the time specified here, then the test fails
Contains: an expected string in the test results
You will need to have set up an SSH credential on the target server
before setting up this test
As an example test, you could set
Raw Command
t o , and then set
Contains
to the name of a file that should be returned when that command executes on the target server and directory
Page 725
FortiSIEM Installation Guide FortiSIEM Installation Guide
LDAP
IMAP
POP
SMTP
JDBC
FTP
TRACE
ROUTE
This test connects to the LDAP server, and checks the response time and expected results
This tests checks connectivity to the IMAP service
This test checks connectivity to the IMAP service
This test checks connectivity to the SMTP service
This test issues a SQL command over JDBC to a target database, and checks the response time and expected results
This test issues a FTP command to the server and checks expected results
This test issues a trace route command to the destination and parses the results to create
PH_DEV_MON_TRACEROUTE events, one for each hop.
Base DN: an LDAP base DN you want to run the test against
Filter: any filter criteria for the Base DN
Scope: any scope for the test
Timeout: this is the primary success criterion - if there is no response within the time specified here, then the test fails
Number of Rows: the expected number of rows in the test results
Contains: an expected string in the test results
Does Not Contain: a string that should not be contained in the test results
Timeout: this is the single success criterion - if there is no response within the time specified here, then the test fails
Timeout: this is the single success criterion - if there is no response within the time specified here, then the test fails
Timeout: this is the single success criterion - if there is no response within the time specified here, then the test fails
JDBC Type: the type of database to connect to
Database Name: the name of the target database
SQL: the SQL command to run against the target database
Timeout: this is the primary success criterion - if there is no response within the time specified here, then the test fails
Number of Rows: the expected number of rows in the test results
Contains: an expected string in the test results
Does Not Contain: a string that should not be contained in the test results
Anonymous Login: choose whether to use anonymous login to connect to the
FTP directory
Remote Directory: the remote directory to connect to
Timeout: this is the primary success criterion - if there is no response within the time specified here, then the test fails
Timeout: If there is no response from the system within the time specified here, then the test fails.
Protocol Type: Specifies the IP protocol over which trace route packets are send current options are UDP, TCP and ICMP
Max TTL: Max time to live (hop) value used in outgoing trace route probe packets.
Wait Time: Max time in seconds to wait for a trace route probe response
You will need to have
set up an access credential for the LDAP server before you can set up this test
For the trace route from AO to destination D via hops H1, H2, H3, FortiSIEM generates 3 hop by hop
PH_DEV_MON_TRACEROUTE events.
First event: Source AO, destination H1,
Min/Max/Avg RTT, Packet Loss for this hop
Second event: Source H1, destination H2,
Min/Max/Avg RTT, Packet Loss for this hop
Third event: Source H2, destination H3,
Min/Max/Avg RTT, Packet Loss for this hop
Fourth event: Source H3, destination D,
Min/Max/Avg RTT, Packet Loss for this hop
Page 726
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding a Synthetic Monitoring Test to a Business Service
You may want to add a Synthetic Transaction Monitoring (STM) test to a Business Service as part of the monitoring infrastructure for that service.
However, in order to enable reporting on that STM, you need to add it to the business service as a device that FortiSIEM can then report on. This topic explains how to create a device for an STM test and add it to your business service report.
1.
2.
3.
4.
5.
6.
7.
Create your STM as described in
Setting Up Synthetic Transaction Monitoring Tests
.
Note the IP address that your STM resolves to in Step 9 of the setup instructions.
In the
Click
CMDB
Save
tab, select
Follow the instructions in
Devices
, and then select a subcategory where you want to add the STM device.
You may want to
create your own group where you manage your STM devices.
In the summary pane for the device subcategory, click
New
.
Complete all relevant information for the STM device, providing the IP address/range from Step 2 in the page.
when you're done entering device information for the STM.
Creating a Report instructions in
Adding Widgets to Dashboards to add it to your dashboard.
Access IP
field of the
Summary
to add information about the STM device to a business service report, and then use the
Related Links
Adding Devices to the CMDB Outside of Discovery
Creating CMDB Groups and Adding Objects to Them
Creating a Report
Page 727
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Business/IT Services
By defining an IT or Business Service, you can create a logical grouping of devices and IT components which can be monitored together.
1.
2.
3.
4.
5.
6.
Log in to your Supervisor node.
Go to
CMDB > Business Services
.
Click
New
.
Enter a
Name
and
Description
for the business service.
Select a
Device/Application Group
o add it to the
, and when the list of associated devices loads into the selection pane, select a device and click
Selected Devices/Applications
for the business service.
Click Save when you're done adding devices to the business service.
>>
t
After you have created a business service, you can select it, and the use the links in the
Analysis
Show Topology
Business Services summary dashboard
option, to view it within overall IT topology. You can also
to find out more information about incidents, device availability,
device and application performance, interface and event status, and real-time and historical search for a selected business service.
Page 728
FortiSIEM Installation Guide FortiSIEM Installation Guide
Data Update Subscription Service
FortiSIEM is constantly developing support for additional IT infrastructure devices. By subscribing to the FortiSIEM Data Update Service, you can receive updates when support for new devices becomes available, rather than waiting for it to be included in a formal release. In addition to devices you can also receive new rules, reports, parser updates etc.
Page 729
FortiSIEM Installation Guide FortiSIEM Installation Guide
Data Update Overview
FortiSIEM data update subscription service updates your FortiSIEM deployment with the latest device support related data as it becomes available, rather than having to wait for it to be included in a formal release.
The following items can be included in an update
New event attribute
New event types
New device type
New parsers or modifications for existing parsers
Performance monitoring templates for new devices or modified ones for existing devices
New rules or modifications for existing rules
New reports or modifications for existing reports - both CMDB report and event based reports
New groups or modifications for existing groups for Event Types, Rules, Reports, Device Groups, Application Groups
Code to handle new devices
Page 730
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring Data Update
Provide a brief (two to three sentence) description of the task or the context for the task.
Configure Data Update Server Setting
Apply Data Update on Supervisor
Apply Data Update on Collectors
Check whether Data Update Installed Successfully
Prerequisites
Contact FortiSIEM support and make sure that your license includes Data Update Service
Make sure you have
Data Update URL -
this is typically that this information has not changed
Make sure you have license credentials
https://images.FortiSIEM.net/upgrade/ds
- contact FortiSIEM to make sure
Procedure
Configure Data Update Server Setting
1.
2.
3.
Log on to FortiSIEM Supervisor with Administrator credentials
Go to > >
Configure Data Update Server Setting
Enter
Data Update URL
(see prerequisites) a. b. c. d.
Enter
Server Username
Specify
Notify Email
Click
Save
and
Server Password
- these are the license credentials
(optional) - you will receive email when new data updates are available
Check Available Data Updates
1.
2.
3.
4.
5.
Log on to FortiSIEM Supervisor with Administrator credentials
Go to
Admin Data Update
Click
Refresh
a. b.
Available data updates are shown on left
Click a version on the left and the contents for that version is shown on the right
Check the current data version from
For example 4.4.1.38 means data version is 38.
Note the data version you would like to upgrade to.
> . The number after 3rd decimal is the data version.
Apply Data Update on Supervisor
1.
2.
3.
4.
SSH to FortiSIEM Supervisor as root
Go to /pbin
Download the data version by running ./phdownloaddata and specify the data version you would like to upgrade to
Install the data version by running ./phinstalldata
Apply Data Update on Collectors
1.
2.
Log on to FortiSIEM Supervisor with Administrator credentials
Go to
Admin Collector Health
a. b. c. d.
Select a Collector
Click
Download Data Update
- this downloads the data files to the collector
Click
Install Data Update
Repeat for all collectors
- this installs the data files on the collector
Check whether Data Update Installed Successfully
1.
2.
3.
Log on to FortiSIEM Supervisor with Administrator credentials
Check
Check
Admin Cloud Health Data Update Version
>
>
>
Page 731
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 732
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Custom Parsers and Monitors for Devices
Creating a custom parser for device logs involves writing an XML specification for the parser, and then using a test event to make sure the logs are parsed correctly. Creating a custom monitor involves defining a performance object that you want to monitor, associating that performance object to a device type, event type, and event attribute type, and then testing to make sure that the monitored metrics are correctly received by
FortiSIEM. You can create custom monitors for system and application performance, command outputs, and file monitoring.
Additional Information in the Help Center
You can find additional information about custom device support, including troubleshooting tips, in the Customer Device Support section of the Help Center maintained by FortiSIEM Support.
Creating Event Attributes, Event Types, and Device Types
Creating Device and Application Types
Creating Event Attribute Types
Event Parser XML Specification
Custom Parser XML Specification Template
Device or Application Type Specification
Format Recognizer Specification
Pattern Definition Specification
Parsing Instructions Specification
Deleting or Disabling a Parser
Creating a Custom Performance Monitor
Monitoring Protocol Configuration Settings
SNMP Configuration Settings for Custom Performance Monitors
Importing OID Definitions from a MIB File
WMI Configuration Settings for Custom Performance Monitors
Mapping Monitoring Protocol Objects to Event Attributes
Exporting a Custom Performance Monitor
Importing a Custom Performance Monitor
Examples of Custom Performance Monitors
Custom JDBC Performance Monitor for a Custom Table
Custom JMX Monitor for IBM Websphere
Custom SNMP Monitor for D-Link HostName and SysUpTime
Custom SNMP Monitor for D-Link Interface Network Statistics
Custom WMI Monitor for Windows Domain and Physical Registry
Creating a Custom SSH Command Output Monitor
Creating a Custom Multi-Line SSH Command Output Monitor
Creating a Custom WINEXE Command Output Monitor
Agent-less File-Integrity Monitoring
Agent-less Target File Monitoring
Page 733
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Event Attributes, Event Types, and Device Types
When you create a custom parser or monitor, you must also specify the device, application, event type, and event attribute to which it applies. If these objects aren't already included in the FortiSIEM CMDB, you can create them as a preliminary step to creating your parser or monitor.
Creating Device and Application Types
Creating Event Attribute Types
Page 734
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Device and Application Types
If the device or application that you want to create a parser or monitor for isn't already listed in
Admin > Device Support > Device/App Types
, you can add it.
1.
2.
3.
Go to
Admin > Device Support > Device/App Types
.
Click
New
, and then choose
New Device Type
or
New Application Type
Enter the information for the new device or application type.
.
Device Type
Application Type
Vendor
Model
Version
Device/App Group
Biz Service group
Description
Vendor
Model
Version
Device/App Group
Biz Service group
Application Package Group
Description
4. Click
Save
.
Page 735
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Event Attribute Types
Event attributes are used to capture parsed information from events. You only have to create a new attribute if the one you want use for your custom parser or monitor is not listed in
Admin > Device Support > Event Attribute Types
.
Creating an Event Attribute Type by Cloning
You can clone an existing event attribute type to use as the basis for a new one. Select the event attribute type you want to use, click
Clone, and then modify as necessary.
1.
2.
3.
4.
Go to
Admin > Device Support > Event Attribute Types
.
Click
New
.
Enter a
Name
and
Display Name
.
5.
6.
Select the
Value Type
to associate with the event attribute type.
Optionally enter a
Click
Save
.
Display Format Type
and
Description
.
Page 736
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Event Types
After parsing an event or log, FortiSIEM assigns a unique event type to that event/log. When you create a new custom parser for device logs, you almost always have to add a new event type to FortiSIEM so the log events can be identified.
Naming Custom Event Types
All custom event types must begin with the prefix
PH_DEV_MON_CUST_ .
1.
2.
3.
4.
Go to
Admin > Device Support > Event Types
.
Click
New
.
Enter a
Name
for the new event type.
Select the
Device Type
to associate with the event type.
If the device type isn't included in the menu options, you can
Select the
Event Type Group
category for this event type.
.
5.
6.
7.
8.
Select a
Severity
Enter an optional
Click
Save
.
to associate with the event type.
Description
.
Page 737
FortiSIEM Installation Guide FortiSIEM Installation Guide
Custom Parsers
To start creating a custom parser for device logs, you should begin by reviewing the
Event Parser XML Specification . Writing the XML
specification is the primary task in creating a custom parser.
Event Parser XML Specification
Custom Parser XML Specification Template
Device or Application Type Specification
Format Recognizer Specification
Pattern Definition Specification
Parsing Instructions Specification
Deleting or Disabling a Parser
Page 738
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event Parser XML Specification
FortiSIEM uses an XML-based parser framework to parse events. These topics describe the parser syntax and include examples of XML parser specifications.
Custom Parser XML Specification Template
Device or Application Type Specification
Format Recognizer Specification
Pattern Definition Specification
Parsing Instructions Specification
Page 739
FortiSIEM Installation Guide FortiSIEM Installation Guide
Custom Parser XML Specification Template
The basic template for a custom parser XML specification includes five sections. Click on the name of any section for more information.
Section
Description
Name of the parser file
The type of device or application associated with the parser
Format Recognizer Specification
Patterns that determine whether an event will be parsed by this parser
Pattern Definition Specification
Defines the parsing patterns that are iterated over by the parsing instructions
Parsing Instructions Specification
Instructions on how to parse events that match the format recognizer patterns
Custom Parser XML Specification Template
<eventParser name="xxx">
<deviceType> </deviceType>
<eventFormatRecognizer> </eventFormatRecognizer>
<patternDefinitions> </patternDefinitions>
<parsingInstructions> </parsingInstructions>
</eventParser>
Page 740
FortiSIEM Installation Guide FortiSIEM Installation Guide
Parser Name Specification
This section specifies the name of the parser, which is used only for readability and identifying the device type associated with the parser.
<eventParser name="CiscoIOSParser">
</eventParser>
Page 741
FortiSIEM Installation Guide FortiSIEM Installation Guide
Device or Application Type Specification
This section specifies the device or the application to which this parser applies. The device and application definitions enable FortiSIEM to detect the device and application type for a host from the received events. This is called
log-based discovery
in FortiSIEM. Once a received event is successfully parsed by this file, a CMDB entry is created with the device and application set from this file. FortiSIEM discovery may further refine the device.
There are two separate subsections for device and application. In each section, vendor, model and version can be specified, but version is not typically needed.
Set Version to Any
In the examples in this topic,
<Version>
is set to
ANY
because events are generally not tied to a particular version of a device or software. You could of course set this to a specific version number if you only wanted this parser to apply to a specific version of an application or device.
Vendor and Model Must Match the AccelOps Version
<Vendor>
and
<Model>
entries must match the spelling and capitalization in the CMDB.
Examples of Specifications for Types of Device and Applications
Software Operating Systems that Specify the Device Type
Applications that Specify Both Device Type and Application
Applications that Specify the Application Type but Not the Device Type
Examples of Specifications for Types of Device and Applications
Hardware Appliances
In this case, the type of event being parsed specifies the device type, for example Cisco IOS, Cisco ASA, etc.
<deviceType>
<Vendor>Cisco</Vendor>
<Model>IOS</Model>
<Version>ANY</Version>
</deviceType>
Software Operating Systems that Specify the Device Type
In this case, the type of events being parsed specifies the device type, for example Microsoft Windows etc. In this case the device type section looks like
<deviceType>
<Vendor>Microsoft</Vendor>
<Model>Windows</Model>
<Version>ANY</Version>
</deviceType>
Applications that Specify Both Device Type and Application
In this case, the events being parsed specify the device and application types because Microsoft SQL Server can only run on Microsoft Windows
OS.
Page 742
FortiSIEM Installation Guide FortiSIEM Installation Guide
<deviceType>
<Vendor>Microsoft</Vendor>
<Model>Windows</Model>
<Version>ANY</Version>
</deviceType>
<appType>
<Vendor>Microsoft</Vendor>
<Model>SQL Server</Model>
<Version>ANY</Version>
<Name> Microsoft SQL Server</Name>
</appType>
Applications that Specify the Application Type but Not the Device Type
Consider the example of an Oracle database server, which can run on both Windows and Linux operating systems. In this case, the device type is set to
Generic
but the application is specific. FortiSIEM depends on discovery to identify the device type.
<deviceType>
<Vendor>Generic</Vendor>
<Model>Generic</Model>
<Version>ANY</Version>
</deviceType>
<appType>
<Vendor>Oracle</Vendor>
<Model>Database Server</Model>
<Version>ANY</Version>
<Name>Oracle Database Server</Name>
</appType>
Page 743
FortiSIEM Installation Guide FortiSIEM Installation Guide
Format Recognizer Specification
In many cases, events associated with a device or application will contain a unique pattern. You can enter a regular expression in the Format
Recognizer section of the parser XML file to search for this pattern, which, if found, will then parse the events according to the parser instructions. After the first match, the event source IP to parser file map is cached, and only that parser file is used for all events from that source
IP. A notable exception is when events from disparate sources are received via a syslog server, but that case is handled differently.
While not a required part of the parser specification, a format recognizer can speed up event parsing, especially when one parsing pattern file among many pattern files must be chosen. Only one pattern check can determine whether the parsing file must be used or not. The other less efficient option would be to examine patterns in every file. At the same time, the format recognizer must be carefully chosen so that it is not so broad to misclassify events into wrong files, and at the same time, not so narrow that it fails at classifying the right file.
Order in Which Parsers are Used
FortiSIEM parser processes the files in the specific order listed in the file parserOrder.csv
.
Format Recognizer Syntax
The specification for the format recognizer section is:
<eventFormatRecognizer><![CDATA[regexpattern]]></eventFormatRecognizer>
In the regexpattern block, a pattern can be directly specified using regex or a previously defined pattern (in the pattern definition section in this file or in the GeneralPatternDefinitions.xml file) can be referenced.
Example Format Recognizers
Cisco IOS
All Cisco IOS events have a
%module name
pattern.
<patternDefinitions>
<pattern name="patCiscoIOSMod" list="begin"><![CDATA[FW|SEC|SEC_LOGIN|SYS|SNMP|]]></pattern>
<pattern name="patCiscoIOSMod" list="continue"><![CDATA[LINK|SPANTREE|LINEPROTO|DTP|PARSER|]]></pattern
>
<pattern name="patCiscoIOSMod" list="end"><![CDATA[CDP|DHCPD|CONTROLLER|PORT_SECURITY-SP]]></pattern>
</patternDefinitions>
<eventFormatRecognizer><![CDATA[:
%<:patCiscoIOSMod>-<:gPatInt>-<:patStrEndColon>:]]></eventFormatRecogniz er>
Cisco ASA
All Cisco ASA events have the pattern
ASA-severity-id
pattern, for example
ASA-5-12345
.
Page 744
FortiSIEM Installation Guide FortiSIEM Installation Guide
<eventFormatRecognizer><![CDATA[ASA-\d-\d+]]></eventFormatRecognizer>
Palo Alto Networks Log Parser
In this case, there is no unique keyword, so the entire message structure from the beginning to a specific point in the log must be considered.
Event
<14>May 6 15:51:04 1,2010/05/06 15:51:04,0006C101167,TRAFFIC,start,1,2010/05/06
15:50:58,192.168.28.21,172.16.255.78,::172.16.255.78,172.16.255.78,rule3,,,icmp,vsys1,untrust,untrust,ether net1/1,ethernet1/1,syslog-172.16.20.152,2010/05/06
15:51:04,600,2,0,0,0,0,0x40,icmp,allow,196,196,196,2,2010/05/06 15:50:58,0,any,0
<eventFormatRecognizer><![CDATA[<:gPatTime>,\w+,(?:TRAFFIC|THREAT|CONFIG
|SYSTEM)]]></eventFormatRecognizer>
Page 745
FortiSIEM Installation Guide FortiSIEM Installation Guide
Pattern Definition Specification
In this section of the parser XML specification, you set the regular expression patterns that that FortiSIEM will iterate through to parse the device logs.
Reusing Pattern Definitions in Multiple Parser Specifications
If there is a pattern definition that you wan to use in multiple parser specification, you need to define it in the file
GeneralPatternDefintions.xml, and then refer to it from your s, then it needs to be defined in the file
GeneralPatternDefinitions.
xml
. The patterns in that file are named with a g prefix, and can be referenced as shown in this example:
<generalPatternDefinitions>
<pattern name="gPatSyslogPRI"><![CDATA[<\d+>]]></pattern>
<pattern name="gPatMesgBody"><![CDATA[.*]]></pattern>
<pattern name="gPatMonNum"><![CDATA[\d{1,2}]]></pattern>
<pattern name="gPatDay"><![CDATA[\d{1,2}]]></pattern>
<pattern name="gPatTime"><![CDATA[\d{1,2}:\d{1,2}:\d{1,2}]]></pattern>
<pattern name="gPatYear"><![CDATA[\d{2,4}]]></pattern>
</generalPatternDefinitions>
Each pattern has a name and the regular expression pattern within the CDATA section. This the basic syntax.
<pattern name="patternName"><![CDATA[pattern]]></pattern>
This is an example of a pattern definition.
<patternDefinitions>
<pattern name="patIpV4Dot"><![CDATA[\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}]]></pattern>
<pattern name="patComm"><![CDATA[[^,]+]]></pattern>
<pattern name="patUpDown"><![CDATA[up|down]]></pattern>
<pattern name="patStrEndColon"><![CDATA[[^:]*]]></pattern>
</patternDefinitions>
You can also write a long pattern definition in multiple lines and indicate their order as shown in this example. The value of the should be begin
in first line and end
in last line. If there are more than two lines, the attribute should be set to list
attribute continue
for the other lines.
<pattern name="patSolarisMod" list="begin"><![CDATA[sshd|login|]]></pattern>
<pattern name="patSolarisMod" list="continue"><![CDATA[inetd|lpstat|]]></pattern>
<pattern name="patSolarisMod" list="end"><![CDATA[su|sudo]]></pattern>
Page 746
FortiSIEM Installation Guide FortiSIEM Installation Guide
Parsing Instructions Specification
This section is the heart of the parser, which attempts to recognize patterns in a log message and populate parsed event attributes.
In most cases, parsing involves applying a regular expression to the log, picking up values, and setting them to event attributes. Sometimes the processing is more involved, for example when attributes need to be stored as local variables and compared before populating the event attributes. There are three key components that are used in parsing instructions: Event attributes and variables, inbuilt functions that perform operations on event attributes and variables, and switch
and choose
branching constructs for logical operations. Values can be collected from both unstructured and structured strings in log messages.
Event Attributes and Variables
Setting an Event Attribute to a Constant
Setting an Event Attribute from Another Variable
Combining Two or More Strings to Produce a Final String
Compare Interface Security Level
Convert Hex Number to Decimal Number
Convert TCP/UDP Protocol String to Port Number
Convert Protocol String to Number
Extract Host from Fully Qualified Domain Name
Replace a String Using a Regular Expression
Collecting Values from Unstructured Strings
Collecting Fields from Structured Strings
Event Attributes and Variables
The dictionary of event attributes are defined in FortiSIEM database and any member not belonging to that list is considered a local variable. For readability, local variables should begin with an _, although this is not enforced.
Setting an Event Attribute to a Constant
<setEventAttribute attr="eventSeverity">1</setEventAttribute>
Setting an Event Attribute from Another Variable
The symbol is used to specify the content of a variable. In the example below, attribute hostMACAddr
_mac
.
gets the value stored in the local variable
<setEventAttribute attr="hostMACAddr">$_mac</setEventAttribute>
Inbuilt Functions
Combining Two or More Strings to Produce a Final String
This is accomplished by using the combineMsgId
function. Here
_evIdPrefix
is the prefix, tring1-_evIdPrefix-_evIdSuffix
.
_evIdSuffix
is the suffix, and the output will be s
Page 747
FortiSIEM Installation Guide FortiSIEM Installation Guide
<setEventAttribute attr="eventType">combineMsgId("string1",
$_evIdPrefix, "-", $_evIdSuffix)</setEventAttribute>
Normalize MAC Address
This is accomplished by using the normalizeMAC
function. The output will be six groups of two nibbles separated by a colon, for example
AA:BB
:CC:DD:EE:FF
.
<setEventAttribute attr="hostMACAddr">normalizeMAC($_mac)</setEventAttribute>
Compare Interface Security Level
This is accomplished by using the compIntfSecVal
function. This primarily applies to Cisco ASA and PIX firewalls. The results returned are:
LESS
if srcIntf
has strictly lower security level than destIntf
GREATER
if srcIntf
has strictly higher security level than destIntf
EQUAL
if srcIntf
and destIntf have identical security levels
<setEventAttribute attr="_result">compIntfSecVal($srcIntf,
$destIntf)</setEventAttribute>
Convert Hex Number to Decimal Number
This is accomplished by using the convertHexStrToInt
function.
<setEventAttribute attr="ipConnId">convertHexStrToInt($_ipConnId)</setEventAttribute>
Convert TCP/UDP Protocol String to Port Number
This is accomplished by using the convertStrToIntIpPort
function.
<setEventAttribute attr="destIpPort">convertStrToIntIpPort($_dport)</setEventAttribute>
Convert Protocol String to Number
This is accomplished by the using the convertStrToIntIpProto
function.
<setEventAttribute attr="ipProto">convertStrToIntIpProto($_proStr)</setEventAttribute>
Page 748
FortiSIEM Installation Guide
Convert Decimal IP to String
This is accomplished by using the converIpDecimalToStr
function.
FortiSIEM Installation Guide
<setEventAttribute attr="srcIpAddr">convertIpDecimalToStr($_srcIpAddr)</setEventAttribute>
Convert Host Name to IP
This is accomplished by using the convertHostNameToIp
function.
<setEventAttribute attr="srcIpAddr">convertHostNameToIp($_saddr)</setEventAttribute>
Add Two Numbers
This is accomplished by using the add
function.
<setEventAttribute attr="totBytes">add($sentBytes,
$recvBytes)</setEventAttribute>
Divide Two Numbers
This is accomplished by using the divide
function.
<setEventAttribute attr="memUtil">divide($_usedMem,
$_totalMem)</setEventAttribute>
Scale Function
This is accomplished by using the scale
function.
<setEventAttribute attr="durationMSec">scale($_durationSec,
1000)</setEventAttribute>
Extract Host from Fully Qualified Domain Name
This is accomplished by using the
extractHostFromFQDN
function. If whole string.
_fqdn .
<setEventAttribute attr="hostName">extractHostFromFQDN($_fqdn)</setEventAttribute>
.
Page 749
FortiSIEM Installation Guide
Replace a String Using a Regular Expression
This is accomplished by using the replaceStringByRegex
function.
FortiSIEM Installation Guide
<setEventAttribute attr="eventType">replaceStringByRegex($_eventType,
"\s+", "_")</setEventAttribute> e.g. _eventType: "Event Type"; eventType: "Event_Type"
Replace String in String
This is accomplished by using the replaceStrInStr
function.
<setEventAttribute attr="computer">replaceStrInStr($_computer, "\\",
"")</setEventAttribute>
Resolve DNS Name
This is accomplished by using the resolveDNSName
function, which converts DNS name to IP address.
<setEventAttribute attr="destIpAddr">resolveDNSName($destName)</setEventAttribute>
Convert to UNIX Time
This is accomplished by using the toDateTime
function.
<setEventAttribute attr="deviceTime">toDateTime($_mon, $_day, $_year,
$_time)</setEventAttribute>
<setEventAttribute attr="deviceTime">toDateTime($_mon, $_day,
$_time)</setEventAttribute>
Trim Attribute
This is accomplished by using the
trimAttribute
function. In the example below, it is used to trim the leading and trailing dots in destName
.
<setEventAttribute attr="destName">trimAttribute($destName,
".")</setEventAttribute>
Branching Constructs
Choose
Construct
The format is:
Page 750
FortiSIEM Installation Guide FortiSIEM Installation Guide
<choose>
<when test='$AttributeOrVariable1 operator Value1'>
...
</when>
<when test='$AttributeOrVariable2 operator Value2'>
...
</when>
<otherwise>
...
</otherwise>
</choose>
Switch
Construct
The format is:
<switch>
<case>
...
</case>
<case>
...
</case>
</switch>
Collecting Values from Unstructured Strings
From a string input source, a regex match is applied and variables are set. The variables can be event attributes or local variables. The input will be a local variable or the default raw message variable. The syntax is:
<collectAndSetAttrByRegex src="$inputString ">
<regex><![CDATA[regexpattern]]></regex>
</collectAndSetAttrByRegex>
The regexpattern is specified by a list of variables and sub-patterns embedded within a larger pattern. Each variable and sub-pattern pair are
<>
Consider an example in which the local variable
172.16.34.3, 1 packet
_body
is set to list 130 permitted eigrp 172.16.34.4(Serial1 ) >
. From this sting we need to set the values to local variables and event attributes.
Value
130 permitted eigrp
172.16.34.4
Set To
_aclName
_action
_proto srcIpAddr
Type
Local Variable
Local Variable
Local Variable
Event Attribute
Page 751
FortiSIEM Installation Guide FortiSIEM Installation Guide
Serial1 srcIntfName
Event Attribute
172.16.34.3
destIpAddr
Event Attribute
1 totPkts
Event Attribute
This is achieved by using this XML. Note that you can use both the collectAndSetAttrByRegex
and collect values from fields. collectFieldsByRegex
functions to
<collectAndSetAttrByRegex src="$_body">
<regex><![CDATA[list <_aclName:gPatStr> <_action:gPatWord>
<_proto:gPatWord> <srcIpAddr:gPatIpV4Dot>(<:srcIntfName:gPatWord>) ->
<destIpAddr:gPatIpV4Dot>, <totPkts:gPatInt> <:gPatMesgBody>]]></regex>
</collectAndSetAttrByRegex>
Collecting Fields from Structured Strings
The are usually two types of structured strings in device logs:
Key=value structured
Value list structured
In each case, two simpler specialized parsing constructs than are provided
Key=Value Structured Data
Certain logs, such as SNMP traps, are structured as
Key1 = value1 <separator> Key2 = value2 lectAndSetAttrByKeyValuePair
XML attribute tag with this syntax.
,.... These can be parsed using the col
<collectAndSetAttrByKeyValuePair sep='separatorString' src="$inputString">
<attrKeyMap attr="variableOrEventAttribute1" key="key1"/>
<attrKeyMap attr="variableOrEventAttribute2" key="key2"/>
</collectAndSetAttrByKeyValuePair>
When a key1
match is found, then the entire string following leOrEventAttribute1
.
key1
up to the separatorString
is parsed out and stored in the attribute variab
As an example, consider this log fragment.
_body =
SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.60 = Hex-STRING: 07 D8 06 0B
13 15 00 00 2D 07 00 SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.11.0
= Hex-STRING: 00 16 B6 DB 12 22
SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.12.0 = Hex-STRING: 00 21 55
4D 66 B0 SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.13.0 = INTEGER: 36
SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.1.0 = Hex-STRING: 00 1A 1E C0
60 7A SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.56.0 = INTEGER: 2
SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.17.0 = STRING:
"00:1a:1e:c0:60:7a"
The corresponding parser fragment is:
Page 752
FortiSIEM Installation Guide FortiSIEM Installation Guide
<collectAndSetAttrByKeyValuePair sep='\t\\| SNMP' src="$_body">
<attrKeyMap attr="srcMACAddr" key="SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.11.0 = Hex-STRING: "/>
<attrKeyMap attr="_destMACAddr" key="SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.12.0 = Hex-STRING: "/>
<attrKeyMap attr="wlanSSID" key="SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.6.0 = STRING: "/>
<attrKeyMap attr="wlanRadioId" key="SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.56.0 = INTEGER: "/>
<attrKeyMap attr="apMac" key="SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.17.0 = STRING: "/>
</collectAndSetAttrByKeyValuePair>
After parsing, the attribute values are set:
Value Attribute
00 16 B6 DB 12 22 srcMACAddr
00 21 55 4D 66 B0 destMacAddr
2 wlanRadioId
00:1a:1e: c0:60:7a apMac
Value List Structured Data
Certain application logs, such as those from Microsoft IIS, are structured as a list of values with a separator. These can be parsed using the coll ectAndSetAttrByPos
XML attribute tag following this syntax.
<collectAndSetAttrByPos sep='separatorString' src="$inputString">
<attrPosMap attr="variableOrEventAttribute1" pos='offset1'/>
<attrPosMap attr="variableOrEventAttribute2" pos='offset2'/>
</collectAndSetAttrByPos>
When the position offset1
is encountered, the subsequent values up to the
separatorString
is stored in
variableOrEventAttribute1
.
As an example, consider this log fragment.
_body =
W3SVC1 ADS-PRI 192.168.0.10 GET /Document/ACE/index.htm - 80 -
192.168.20.55 HTTP/1.1
Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv:1.8.1.11)+Gecko/20071
127+Firefox/2.0.0.11 [http://wwwin/Document/] wwwin 200 0 0 5750 445 15
The parser fragment is:
Page 753
FortiSIEM Installation Guide FortiSIEM Installation Guide
<collectAndSetAttrByPos src="$_body" sep=' '>
<attrPosMap attr="srvInstName" pos='1'/>
<attrPosMap attr="destName" pos='2'/>
<attrPosMap attr="relayDevIpAddr" pos='2'>
<attrPosMap attr="destIpAddr" pos='3'/>
<attrPosMap attr="httpMethod" pos='4'/>
<attrPosMap attr="uriStem" pos='5'/>
<attrPosMap attr="uriQuery" pos='6'/>
<attrPosMap attr="destIpPort" pos='7'/>
<attrPosMap attr="user" pos='8'/>
<attrPosMap attr="srcIpAddr" pos='9'/>
<attrPosMap attr="httpVersion" pos='10'/>
<attrPosMap attr="httpUserAgent" pos='11'/>
<attrPosMap attr="httpReferrer" pos='13'/>
<attrPosMap attr="httpStatusCode" pos='15'/>
<attrPosMap attr="httpSubStatusCode" pos='16'/>
<attrPosMap attr="httpWin32Status" pos='17'/>
<attrPosMap attr="recvBytes" pos='18'/>
<attrPosMap attr="sentBytes" pos='19'/>
<attrPosMap attr="durationMSec" pos='20'/>
</collectAndSetAttrByPos>
For structured strings, techniques in this section are more efficient than in the previous section since, the expression is simpler and ONE tag can be used to parse regardless of the order in which the keys or values appear in the string.
Page 754
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Custom Parser
Cloning New Parsers
You can clone an existing parser and then use it as the basis for creating a new one. Select the parser you want to clone, and then click
Clone
. Modify the parser as necessary, and then make sure you use the and point at which is should be applied.
Up Down
buttons to place it in the list of parsers at the
Creating Custom Parsers for Multi-Tenant Deployments
Custom parsers can only be created from the Super/Global account in multi-tenant FortiSIEM deployments.
Prerequisites
You should have examples of the logs that you want to parse
You should have created any new device/application types, event attribute types, or event types
specification
You should already have written
the XML specification for your parser
You should have prepared a test event that you can use to validate the parser
that you want to use in your XML
Parsers Applied in Order
Parsers are applied in the order they are listed in
Admin > Device Support > Parsers
, so it is important to add your custom parser to the list in relation to any other parsers that may be applied to your device logs. If you click
Fix Order
, this will arrange the parsers with system-defined parsers at the top of the list in their original order, and user-defined parsers at the bottom. By sure to click make sure the change in order is picked up by the back-end module.
Apply
to
Procedure
1.
2.
3.
4.
Go to
Admin > Device Support > Parsers
.
Select a parser that is above the location in the list where you want to add your parser, and then click
Enter a
Name
for the parser.
Select a
Device Type
to which the parser should apply.
5.
6.
If the device type doesn't appear in the menu, you should
Enter a
New
.
7.
Test Event
containing an example of an event that you want to use to validate the parser.
Enter the
Parser XML
.
Click
Validate
.
8.
This will validate the XML.
Click
Test
.
9.
This will send the test event to the parser to make sure it is parsed correctly, and will also test the parsers above and below yours in the list to make sure they continue to parse logs correctly.
Save
10.
11.
If the XML for your parser validates and the test event is correctly parsed, select
If you need to continue working on your parser, you can
Click
Enable
.
it without selecting Enable.
Click
Save
.
Apply
to have the backend module pick up your parser and begin applying it to device logs.
You should now validate that events are being parsed by creating some activity that will cause a log to be generated, and then run a query against the new device IP address and validate the parsed results.
Page 755
FortiSIEM Installation Guide
Deleting or Disabling a Parser
Deleting User-Defined Parsers
You can only delete user-defined parsers, but both system and user-defined parsers can be disabled.
1.
2.
3.
4.
Go to
Admin > Device Support > Parsers
.
Select the parser you want to delete or disable.
Click
Click
Delete
Yes
or
Disable
.
to confirm that you want to delete or disable the parser.
FortiSIEM Installation Guide
Page 756
FortiSIEM Installation Guide FortiSIEM Installation Guide
Exporting a Custom Parser
To export a parser, you must also export XML files for the device/app types, event attribute types, event types, and then the parser specification file used by your parser.
1.
2.
3.
4.
5.
6.
7.
8.
Go to
Admin > Device Support > Device/App Types
.
Select the device/application types used in your parser, and then click
Export
.
Go to
Go to
Go to
Admin > Device Support > Event Attribute Types
Admin > Device Support > Event Types
Admin > Device Support > Parsers
.
.
Select the event types used in your parser, and then click
.
Select the event attribute types used in your parser, and then click
Export
Select the parser specification for your parser, and then click
.
Export
Export
.
.
Page 757
FortiSIEM Installation Guide FortiSIEM Installation Guide
Importing a Custom Parser
Importing a custom parser involves importing four XML files: the XML files containing any device/app types, event attribute types, or event types that you have created for this parser, followed by the parser specification XML file.
1. For each device/app type, event attribute type, or event type XML file that is required for your parser, go to the appropriate tab in
Admin
2.
3.
4.
5.
> Device Support
Go to
, and then click
Follow the instruction in
position in the list of parsers.
Import
.
Browse to the location of your XML file, and then click
Admin > Device Support > Parsers
Upload
, and then click
.
Import
.
Browse to the location of your parser specification XML file, and then click
Upload
.
to validate your XML and test the parser, and to make sure it appears in the correct
Page 758
FortiSIEM Installation Guide
Parser Examples
FortiSIEM Installation Guide
Page 759
FortiSIEM Installation Guide
Cisco IOS Syslog Parser
The objective is to parse this syslog message:
FortiSIEM Installation Guide
<190>91809: Jan 9 02:38:47.872: %SEC-6-IPACCESSLOGP: list testlog permitted tcp 192.168.20.33(3438) -> 69.147.86.184(80), 1 packet
Creating the appropriate parser requires these steps.
Create the Parser Specification and Add Local Patterns
Add Device Type
Create a file
CiscoIOSParser.xml
with this content.
<eventParser name="CiscoIOSParser">
<deviceType>
<Vendor>Cisco</Vendor>
<Model>IOS</Model>
<Version>ANY</Version>
</deviceType>
</eventParser>
Create the Parser Specification and Add Local Patterns
Create the parser XML file with this content, and add the pattern definition patCiscoIOSMod
for detecting IOS modules such as SEC.
Page 760
FortiSIEM Installation Guide FortiSIEM Installation Guide
<eventParser name="CiscoIOSParser">
<deviceType>
<Vendor>Cisco</Vendor>
<Model>IOS</Model>
<Version>ANY</Version>
</deviceType>
<patternDefinitions>
<pattern name="patCiscoIOSMod" list="begin">
<![CDATA[FW|SEC|SEC_LOGIN|SYS|SNMP|]]></pattern>
<pattern name="patCiscoIOSMod" list="continue">
<![CDATA[LINK|SPANTREE|LINEPROTO|DTP|PARSER|]]></pattern>
<pattern name="patCiscoIOSMod" list="end"><![CDATA[CDP|DHCPD|CONTROLLER|PORT_SECURITY-SP]]></pattern>
<pattern name="patStrEndColon"><![CDATA[[^:]*]]></pattern>
<pattern name="patComm"><![CDATA[[^,]+]]></pattern>
</patternDefinitions>
</eventParser>
Define the Format Recognizer
Add this format recognizer for detecting
%SEC-6-IPACCESSLOGP, which is a signature of Cisco IOS syslog messages.
<eventParser name="CiscoIOSParser">
<deviceType>
<Vendor>Cisco</Vendor>
<Model>IOS</Model>
<Version>ANY</Version>
</deviceType>
<patternDefinitions>
<pattern name="patCiscoIOSMod" list="begin">
<![CDATA[FW|SEC|SEC_LOGIN|SYS|SNMP|]]></pattern>
<pattern name="patCiscoIOSMod" list="continue">
<![CDATA[LINK|SPANTREE|LINEPROTO|DTP|PARSER|]]></pattern>
<pattern name="patCiscoIOSMod" list="end"><![CDATA[CDP|DHCPD|CONTROLLER|PORT_SECURITY-SP]]></pattern>
<pattern name="patStrEndColon"><![CDATA[[^:]*]]></pattern>
<pattern name="patComm"><![CDATA[[^,]+]]></pattern>
</patternDefinitions>
<eventFormatRecognizer>
<![CDATA[: %<:patCiscoIOSMod>-<:gPatInt>-<:patStrEndColon>:]]>
</eventFormatRecognizer>
</eventParser>
Parse the Syslog Header
Page 761
FortiSIEM Installation Guide FortiSIEM Installation Guide
A syslog message consists of a syslog header, and a body. For better organization, we first parse the syslog header and event type. Subsequent code will include event type specific parsing, which is why event type is extracted in this step. In this example, the header is in boldface.
<190>91809: Jan 9 02:38:47.872: %SEC-6-IPACCESSLOGP
: list testlog permitted tcp 192.168.20.33(3438) ->
69.147.86.184(80), 1 packet
The XML code for parsing the header does the following:
1.
2.
3.
4.
5.
Matches the pattern
Sets the eventType
Sets deviceTime
.
<190>91809: Jan 9 02:38:47.872: %SEC-6-IPACCESSLOGP:
attribute to
IOS-SEC- IPACCESSLOGP
.
Sets event severity (1-7 scale in Cisco IOS, 1=> most severe, to normalized 1-10 scale in FortiSIEM where 10=>most severe)
Saves the event variable
_body
.
list testlog permitted tcp 192.168.20.33(3438) -> 69.147.86.184(80), 1 packet
in a temporary
Note that the patterns , ,
GeneralPatternDefinitions.xml file:
, , , are global patterns that are defined in the
<generalPatternDefinitions>
<pattern name="gPatSyslogPRI"><![CDATA[<\d+>]]></pattern>
<pattern name="gPatMesgBody"><![CDATA[.*]]></pattern>
<pattern name="gPatMon">
<![CDATA[Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec|\d{1,2}]]></pat tern>
<pattern name="gPatDay"><![CDATA[\d{1,2}]]></pattern>
<pattern name="gPatTime"><![CDATA[\d{1,2}:\d{1,2}:\d{1,2}]]></pattern>
<pattern name="gPatInt"><![CDATA[\d+]]></pattern>
</generalPatternDefinitions>
This parser file XML fragment for parsing the example syslog message looks like this:
Page 762
FortiSIEM Installation Guide FortiSIEM Installation Guide
<parsingInstructions>
<collectFieldsByRegex src="$_rawmsg">
<regex><![CDATA[<:gPatSyslogPRI>?<:gPatMon>\s+<:gPatDay>\s+<:gPatTime>
%<_evIdPrefix:patCiscoIOSMod>-<_severity:gPatInt>-<_evIdSuffix:patStrEnd
Colon>: <_body:gPatMesgBody>]]></regex>
</collectFieldsByRegex>
<setEventAttribute attr="eventType">combineMsgId("IOS-",
$_evIdPrefix, "-", $_evIdSuffix)</setEventAttribute>
<choose>
<when test='$_severity IN "6, 7"'>
<setEventAttribute attr="eventSeverity">1</setEventAttribute>
</when>
<when test='$_severity = "1"'>
<setEventAttribute attr="eventSeverity">10</setEventAttribute>
</when>
<when test='$_severity = "2"'>
<setEventAttribute attr="eventSeverity">8</setEventAttribute>
</when>
<when test='$_severity IN "3, 4"'>
<setEventAttribute attr="eventSeverity">5</setEventAttribute>
</when>
<when test='$_severity = "5"'>
<setEventAttribute attr="eventSeverity">2</setEventAttribute>
</when>
</choose>
<parsingInstructions>
Parse the Syslog Body
The parsing is done on an eventType by eventType basis, since the formats are eventType specific. Parsing the syslog body involves three steps:
1. Parsing the action string. Based on the action staring value ( permit
or denied
), modify the eventType
by appending the action string
2.
3. value at the end, and also modify the eventSeverity
values.
Parsing the protocol, source and destination IP, port, and totalPackets.
Converting the protocol string to a protocol integer.
Page 763
FortiSIEM Installation Guide FortiSIEM Installation Guide
Final Parser
<choose>
<when test='$eventType IN "IOS-SEC-IPACCESSLOGP,
IOS-SEC-IPACCESSLOGDP, IOS-SEC-IPACCESSLOGRP"'>
<collectAndSetAttrByRegex src="$_body">
<regex><![CDATA[list
<_aclName:gPatStr>\s+<_action:gPatWord>\s+<_proto:gPatWord>\s+<srcIpAddr
:gPatIpV4Dot>\(<srcIpPort:gPatInt>\)<:gPatMesgBody>->\s+<destIpAddr:gPat
IpV4Dot>\(<destIpPort:gPatInt>\),\s+<totPkts:gPatInt> <:gPatMesgBody>]]>
</regex>
</collectAndSetAttrByRegex>
<choose>
<when test='$_action = "permitted"'>
<setEventAttribute attr="eventType">combineMsgId("IOS-",
$_evIdPrefix, "-", $_evIdSuffix, "-PERMITTED")</setEventAttribute>
<setEventAttribute attr="eventSeverity">1</setEventAttribute>
</when>
<when test='$_action = "denied"'>
<setEventAttribute attr="eventType">combineMsgId("IOS-",
$_evIdPrefix, "-", $_evIdSuffix, "-DENIED")</setEventAttribute>
<setEventAttribute attr="eventSeverity">3</setEventAttribute>
</when>
</choose>
<setEventAttribute attr="ipProto">convertStrToIntIpProto($_proto)</setEventAttribute>
</when>
</choose>
<eventParser name="CiscoIOSParser">
<deviceType>
<Vendor>Cisco</Vendor>
<Model>IOS</Model>
<Version>ANY</Version>
</deviceType>
<patternDefinitions>
<pattern name="patCiscoIOSMod" list="begin">
<![CDATA[FW|SEC|SEC_LOGIN|SYS|SNMP|]]></pattern>
<pattern name="patCiscoIOSMod" list="continue">
<![CDATA[LINK|SPANTREE|LINEPROTO|DTP|PARSER|]]></pattern>
<pattern name="patCiscoIOSMod" list="end"><![CDATA[CDP|DHCPD|CONTROLLER|PORT_SECURITY-SP]]></pattern>
<pattern name="patStrEndColon"><![CDATA[[^:]*]]></pattern>
<pattern name="patComm"><![CDATA[[^,]+]]></pattern>
Page 764
FortiSIEM Installation Guide FortiSIEM Installation Guide
</patternDefinitions>
<parsingInstructions>
<!—parse header -->
<collectFieldsByRegex src="$_rawmsg">
<regex><![CDATA[<:gPatSyslogPRI>?<:gPatMon>\s+<:gPatDay>\s+<:gPatTime>
%<_evIdPrefix:patCiscoIOSMod>-<_severity:gPatInt>-<_evIdSuffix:patStrEnd
Colon>: <_body:gPatMesgBody>]]></regex>
</collectFieldsByRegex>
<setEventAttribute attr="eventType">combineMsgId("IOS-",
$_evIdPrefix, "-", $_evIdSuffix)</setEventAttribute>
<choose>
<when test='$_severity IN "6, 7"'>
<setEventAttribute attr="eventSeverity">1</setEventAttribute>
</when>
<when test='$_severity = "1"'>
<setEventAttribute attr="eventSeverity">10</setEventAttribute>
</when>
<when test='$_severity = "2"'>
<setEventAttribute attr="eventSeverity">8</setEventAttribute>
</when>
<when test='$_severity IN "3, 4"'>
<setEventAttribute attr="eventSeverity">5</setEventAttribute>
</when>
<when test='$_severity = "5"'>
<setEventAttribute attr="eventSeverity">2</setEventAttribute>
</when>
</choose>
<!—parse body -->
<choose>
<when test='$eventType IN "IOS-SEC-IPACCESSLOGP,
IOS-SEC-IPACCESSLOGDP, IOS-SEC-IPACCESSLOGRP"'>
<collectAndSetAttrByRegex src="$_body">
<regex><![CDATA[list
<_aclName:gPatStr>\s+<_action:gPatWord>\s+<_proto:gPatWord>\s+<srcIpAddr
:gPatIpV4Dot>\(<srcIpPort:gPatInt>\)<:gPatMesgBody>->\s+<destIpAddr:gPat
IpV4Dot>\(<destIpPort:gPatInt>\),\s+<totPkts:gPatInt> <:gPatMesgBody>]]>
</regex>
</collectAndSetAttrByRegex>
<choose>
<when test='$_action = "permitted"'>
<setEventAttribute attr="eventType">combineMsgId("IOS-", $_evIdPrefix, "-", $_evIdSuffix,
"-PERMITTED")</setEventAttribute>
<setEventAttribute attr="eventSeverity">1</setEventAttribute>
</when>
<when test='$_action = "denied"'>
<setEventAttribute
Page 765
FortiSIEM Installation Guide FortiSIEM Installation Guide attr="eventType">combineMsgId("IOS-", $_evIdPrefix, "-", $_evIdSuffix,
"-DENIED")</setEventAttribute>
<setEventAttribute attr="eventSeverity">3</setEventAttribute>
</when>
</choose>
<setEventAttribute attr="ipProto">convertStrToIntIpProto($_proto)</setEventAttribute>
Page 766
FortiSIEM Installation Guide
</when>
</choose>
<parsingInstructions>
FortiSIEM Installation Guide
Parsed Output
Input syslog:
<190>91809: Jan 9 02:38:47.872: %SEC-6-IPACCESSLOGP: list testlog permitted tcp 192.168.20.33(3438) ->
69.147.86.184(80), 1 packet
Parsed fields:
9.
10.
11.
12.
5.
6.
7.
8.
1.
2.
3.
4.
phRecvTime: the time at which the event was received by FortiSIEM
phDeviceTime: Jan 9 02:38:47 2010
eventType: SEC-IPACCESSLOGP-PERMITTED
eventSeverity: 3
eventSeverityCategory: LOW
aclName: testlog
ipProto: 6
srcIpAddr: 192.168.20.33
destIpAddr: 69.147.86.184
srcIpPort: 3438
destIpPort: 80
totPkts: 1
The master list of event attributes supported by FortiSIEM is
Page 767
FortiSIEM Installation Guide FortiSIEM Installation Guide
Custom Performance Monitors
Creating a custom performance monitor involves creating a performance object that specifies the monitoring access protocol to use, maps event attributes available for that protocol to FortiSIEM event attribute types, and then associates those attributes to an event type. You can use system or user-defined device types, event attribute types, and event types when creating the performance object.
Creating a Custom Performance Monitor
Monitoring Protocol Configuration Settings
SNMP Configuration Settings for Custom Performance Monitors
Importing OID Definitions from a MIB File
WMI Configuration Settings for Custom Performance Monitors
Mapping Monitoring Protocol Objects to Event Attributes
Exporting a Custom Performance Monitor
Importing a Custom Performance Monitor
Examples of Custom Performance Monitors
Custom JDBC Performance Monitor for a Custom Table
Custom JMX Monitor for IBM Websphere
Custom SNMP Monitor for D-Link HostName and SysUpTime
Custom SNMP Monitor for D-Link Interface Network Statistics
Custom WMI Monitor for Windows Domain and Physical Registry
Page 768
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Custom Performance Monitor
You create custom performance monitors by defining the performance object that you want to monitor, including the relationship between the performance object and FortiSIEM events and event attributes, and then associating the performance object to a device type.
Creating Custom Performance Monitors for Enterprise and Multi-Tenant Deployments
In multi-tenant FortiSIEM deployments, custom performance performance have to be created by the Super/Global account, and apply to all organizations. In enterprise deployments, custom performance monitors can be created by any user who has access to the
Admin
ab.
t
Creating the Performance Object and Applying it to a Device
Testing the Performance Monitor
Prerequisites
You should review the configuration settings for the monitoring protocols
that you will use in your monitor, and be ready to provide the appropriate OIDs, classes, or database table attributes for the access protocol.
You should have created any new device/application types, event attribute types, or event types that you want to use in your performance monitor
You should have the IP address and access credentials for a device that you can use to test the monitor
Procedure
Creating the Performance Object and Applying it to a Device
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
Go to
Admin > Device Support > Performance Monitoring
.
Click
New
.
Enter a
Name
for the performance monitor.
For
Type
For
Method
Select the
Enter the
Enter a
Event Type
Polling Frequency
Description
.
System
or
Application
Monitoring Protocol Objects to Event Attributes
that will be monitored.
for the monitor.
.
See the topics under Monitoring Protocol Configuration Settings
monitoring protocol.
Click
New
next to
Note that the Method you select will determine the name of this mapping and the configuration options that are available. See
Click
In
, select either
Save
, select the monitoring protocol for the performance monitor.
List of Attributes
, and create the mapping between the performance object and FortiSIEM event attributes.
Admin > Device Support > Performance Monitoring
Enter a
.
Name
for the mapping.
for more information about the configuration settings for each type of
, under
Enter Device Type to Performance Object Mapping
, click
New
.
14.
15.
In the top pane of the dialog, select the
Device Type
to which you want to apply the monitor.
Whenever a device belonging to the selected device type is discovered, FortiSIEM will attempt to apply the performance monitor to it.
In the bottom pane of the dialog, select the custom performance monitor.
Click
Save
.
Testing the Performance Monitor
1.
2.
3.
4.
Go to
Admin > Device Support > Performance Monitoring.
Select the performance monitor.
Click
Test
.
Testing for Multi-Tenant Deployments
If you have a multi-tenant FortiSIEM, select the Supervisor or Collector where the device is monitored.
5. Click Test.
If the test succeeds, click Close, and then click Apply to register the new monitor with the backend module.
, and then
.
Page 769
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 770
FortiSIEM Installation Guide FortiSIEM Installation Guide
Monitoring Protocol Configuration Settings
These topics describe the configuration settings for monitoring protocols such as SNMP, WMI, and JDBC that are used for creating custom performance monitors.
SNMP Configuration Settings for Custom Performance Monitors
Importing OID Definitions from a MIB File
WMI Configuration Settings for Custom Performance Monitors
Page 771
FortiSIEM Installation Guide FortiSIEM Installation Guide
JDBC Configuration Settings
Field
Method
Database
Type
SQL
Query
List of
Columns
Where
Clauses
Setting/Notes
JDBC
Select the type of database to connect to
The SQL Query to execute when connecting
This creates the mapping between columns in the database and AccelOps event attributes. See
Objects to Event Attributes for more information.
This indicates whether the database table being queried has a fixed set of rows, or whether it is growing over time. An example of this would be a table containing logs, in which case AccelOps would keep track of the last entry and only pull the new ones. There are three options here:
1. There is a fixed set of rows and all rows are needed.
2.
Leave all options cleared.
3.
There is a fixed set of rows and a fixed number of rows are needed.
Select
Fixed Records
and enter the number of required rows.
The table is growing and only new values are needed.
Select
Retrieve all new values since last retrieve time of column
the next polling interval.
, and enter the name of the column that represents time in the database. AccelOps will keep track of the largest value in this column and only pull entries greater than that value during
Page 772
FortiSIEM Installation Guide FortiSIEM Installation Guide
JMX Configuration Settings
When configuring JMX as the monitoring protocol for a custom performance monitor, use these settings. You may also want to review the topic
C ustom JMX Monitor for IBM Websphere as an example of creating a custom JMX performance monitor.
Field Setting/Notes
Method JMX
MBean Enter the MBean interface that you want to monitor, or click the downward arrow to browse the JMX tree and select it. Note that the option you select here will determine the objects that are available when you select an
See the next section in this topic for information on how to find
Object Attribute
for the
List of Attributes
.
Identifying MBean Names and Attributes for Custom Applications
This section discusses how to get MBean names and attributes for custom J2EE based applications.
1.
2.
3.
4.
Launch JConsole on your workstation and connect to the application.
Select the
MBeans
tab.
Browse to the application you want to monitor, and select it.
In the right pane you will see the
MBeanInfo
. Note the
ObjectName
, while the attributes for the application will be listed in the tree view.
Page 773
FortiSIEM Installation Guide FortiSIEM Installation Guide
SNMP Configuration Settings for Custom Performance Monitors
When configuring SNMP as the access protocol for a custom performance monitor, use these settings. You may also want to review the topics
Cu stom SNMP Monitor for D-Link Interface Network Statistics
to set up a custom performance monitor using SNMP.
and
Custom SNMP Monitor for D-Link HostName and SysUpTime
as example of how
Field Settings/Notes
Method SNMP
Parent
OID
The parent Object Identifier (OID) is used to optimize the number of SNMP GETs required for pulling the various individual OIDs.
You can enter this directly, or click the downward arrow to select it from an MIB file. Several different MIB files are available to select from, see
Importing OID Definitions from a MIB File
for more information.
Parent
ID is table
List of
OIDs
Select
is table
if the OIDs you want to monitor are in a table with at least one row. An example would be interface metrics, such as fInOctets
and ifOutOctets
, since there is an interface metric for each interface.
i
The OIDs you want to monitor mapped to AccelOps event attributes. The selection you make for available in the
OID
menu when you select
New
.
Parent OID
determines the options
Page 774
FortiSIEM Installation Guide FortiSIEM Installation Guide
Importing OID Definitions from a MIB File
Many devices include MIB files that you can then use to create a custom performance monitor for the device. This involves creating a configuration file based on information in the MIB file, using that file as input for the mib2xml
executable, and then placing the resulting output file in the
/data/mibXml
directory of your Supervisor. Once placed in this directory, you can select the file from the
MIB File List
menu to select the parent OID, which will then also affect which OIDs you can select for the OID to event attribute mapping.
Procedure
1.
2.
Collect the device OID files you want to use and place them in a directory where the mib2XML
Create the input config file with these fields, and name it with the
.cfg
file designation.
See the attached alcatel.cfg
file for an example.
Field
group mibFile vendor model
Description
This is the number of MIB file group. MIB files need to be analyzed as a group because of cross-references within them. The group attribute specifies an ID for each group and needs to be unique for every group.
The name of the MIB file being analyzed. There can be multiple entries. Be sure to specify the path to the MIB files.
The name of the device vendor for the MIB file
The model name or number for the device evtPrefix
As SNMP trap notification definitions in the MIB file are parsed, an event file is generated for each SNMP trap. This field specifies the event type prefix.
enterpriseId
The enterprise ID number for this vendor, which is used for generating the SNMP trap parser
3. Run mib2XML <filename>.cfg
.
4. Move the resulting
.mib.xml
file to the
/data/mibXml
directory of your Supervisor.
Example
In this example, a set of MIB files from an Alcatel 7x50 device are used to generate the XML output file.
1. Sample MIB files:
TIMETRA-CHASSIS-MIB.mib
TIMETRA-GLOBAL-MIB.mib
2.
TIMETRA-SYSTEM-MIB.mib
TIMETRA-TC-MIB.mib
Information in these files, and the paths to them, are then used to create this config file.
3. alcatel.cfg
Running mib2xml alcatel.cfg
generates both an output and an mib2XML file. alcatel.out
TIMETRA-TC-MIB.mib.xml
Page 775
FortiSIEM Installation Guide FortiSIEM Installation Guide
WMI Configuration Settings for Custom Performance Monitors
as example of how to set up a custom performance monitor using WMI.
Field Settings
Method WMI
Parent
Class
WMI metrics are defined in the form of a parent class having multiple attributes. For example, the parent class stem
has the attributes
Domain
and
TotalPhysicalMemory
.
Win32_ComputerSy
Is Table If the parent WMI class is a table with one or more rows, select this option.
Page 776
FortiSIEM Installation Guide FortiSIEM Installation Guide
Mapping Monitoring Protocol Objects to Event Attributes
When you select a monitoring protocol for your custom performance monitor, you must also establish the relationship between the objects used by that protocol and event attributes in FortiSIEM. For example, creating a performance monitor that uses SNMP to monitor a device requires that you create a mapping between the SNMP OIDs that you want to monitor, and set of event attributes. This topic describes the configuration settings that you will use to create these object-to-event attribute relationships.
Procedure
1. When
creating your custom performance monitor , after you have selected the
2.
Depending on the monitoring protocol that you select, this table may be named
Your options depend on the monitoring protocol you selected for Method.
Method
, click
List of OIDs
New
next to
(SNMP), or
List of Attributes
List of Columns
In the first field, enter or select the monitoring protocol object that you want to map to an FortiSIEM event attribute.
.
(JDBC).
Monitoring
Protocol
SNMP
Field
Name
OID
Settings/Notes
WMI
JMX
JDBC
Attribute
Object
Attribute
Column
Name
Select an MIB file from the
MIB File List
, and then select the OID that you want to create the mapping for.
Enter an attribute of the WMI class you entered for
Parent Class
.
The
MBean
you select determines the attributes you can select. You will also have to enter a nd
Private Key
for the MBean attribute.
Name
a
Enter the name of the column in the
SQL Query
that you are using to monitor the database.
3. Select the
Format
for the object attribute.
4.
5.
Your options will depend on the monitoring protocol you selected for Method.
For
Type
, select
Raw Value
For
Event Attribute
or
Counter
.
, select the FortiSIEM event attribute that the monitoring protocol object should map to.
6.
If you need to create a new event attribute, see Creating Event Attribute Types .
of the values returned for the monitoring protocol object.
7.
Create any
Transforms
See the next section for more information how to configure transforms.
Click
Save
when you are done creating the mappings, and then complete the configuration of your custom performance monitor.
Creating Transforms
You can use a transform to convert the value returned for your monitoring project object into a more physically meaningful or usable metric. You an create multiple transforms, and they will be evaluated in the order shown in the table. Multiple transforms can be selected – they are evaluated in sequential order as shown in the display table
1.
2.
3.
Next to
For
Transforms
Type
, select
, click
System
Custom
.
New
.
or
Custom
.
, either select a system-defined transformation formula from the menu if you selected
System
for
Type
, or enter a formula if
4.
For
Formula
you selected
Click
Save
.
Page 777
FortiSIEM Installation Guide FortiSIEM Installation Guide
Exporting a Custom Performance Monitor
To export a parser, you must also export XML files for the device/app types, event attribute types, event types, and then the monitor.
5.
6.
7.
8.
1.
2.
3.
4.
Go to
Admin > Device Support > Device/App Types
.
Select the device/application types used in your monitor, and then click
Export
.
Go to
Admin > Device Support > Event Attribute Types
.
Select the event attribute types used in your monitor, and then click
Export
.
Go to
Go to
Admin > Device Support > Event Types
Select the monitor, and then click
Export
.
.
Select the event types used in your monitor, and then click
Export
Admin > Device Support > Performance Monitoring
.
.
Page 778
FortiSIEM Installation Guide FortiSIEM Installation Guide
Importing a Custom Performance Monitor
Importing a custom performance monitor involves importing four XML files: the XML files containing any device/app types, event attribute types, or event types that you have created for this parser, followed by the custom performance monitor file.
1. For each device/app type, event attribute type, or event type XML file that is required for your monitor, go to the appropriate tab in
Admin
> Device Support
, and then click
2.
3.
4.
5.
Go to
Follow the instructions in
Import
.
Browse to the location of your XML file, and then click
Upload
Admin > Device Support > Performance Monitors
.
, and then click
Browse to the location of your performance monitor file, and then click
Creating a Custom Performance Monitor
Import
Upload
.
.
to test and apply your performance monitor.
Page 779
FortiSIEM Installation Guide
Examples of Custom Performance Monitors
Custom JDBC Performance Monitor for a Custom Table
Custom JMX Monitor for IBM Websphere
Custom SNMP Monitor for D-Link HostName and SysUpTime
Custom SNMP Monitor for D-Link Interface Network Statistics
Custom WMI Monitor for Windows Domain and Physical Registry
FortiSIEM Installation Guide
Page 780
FortiSIEM Installation Guide FortiSIEM Installation Guide
Custom JDBC Performance Monitor for a Custom Table
Creating New Device Types, Event Attribute Types, and Event Types
Adding New JDBC Performance Objects
Performance Object Configuration for Static Table HEALTH_STATIC_DEMO
Performance Object Configuration for Dynamic Table HEALTH_DYNAMIC_DEMO
Associating Device Types to Performance Objects
Edit Device to Performance Object
Testing the Performance Monitor
Enabling the Performance Monitor
Writing Queries for the Performance Metrics
Planning
Examining the Table Structure
For this example, consider two custom Oracle tables that you want to monitor.
1. A table called
HEALTH_STATIC_DEMO olumn is updated by the application.
that does not have time stamp as a column. The table does not grow with time, and the
HEALTH
c create table HEALTH_STATIC_DEMO
{
ID VARCHAR2 (200) not null,
HOST_NAME NVARCHAR2 (200) not null,
HEALTH NVARCHAR2 (50)
}
2. A table called
HEALTH_DYNAMIC_DEMO
that has a time-stamp in the column create_time
. Only records with a more recent time-stamp than previous ones have to be pulled in, and every time a new record is written, it includes a time stamp. create table HEALTH_DYNAMIC_DEMO
{
ID VARCHAR2 (200) not null,
HOST_NAME NVARCHAR2 (200) not null,
HEALTH NVARCHAR2 (50),
CREATE_TIME DATE not null
}
Creating New Device Types, Event Attribute Types, and Event Types
In this case, you only need to
create two new event types to handle the contents of the two tables.
Naming Custom Event Types
All custom event types must begin with the prefix
PH_DEV_MON_CUST_ .
Event Types
Name Device Type Severity
PH_DEV_MON_CUST_JDBC_PERFORMANCE_STATIC
Generic Low
Page 781
FortiSIEM Installation Guide FortiSIEM Installation Guide
PH_DEV_MON_CUST_JDBC_PERFORMANCE_DYNAMIC
Generic Low
Adding New JDBC Performance Objects
Each table requires its own performance object for monitoring.
Performance Object Configuration for Static Table HEALTH_STATIC_DEMO
Field
Name
Type
Method
Database Type
SQL Query
List of Columns
Setting
jdbc_static_perfObj
Application
JDBC
Oracle Database Server select * from health_static_demo
Column Name Name Format Event Attribute
host_name STRING hostName health STRING health
Where Clauses
Event Type
Not applicable, since the table doesn't grow over time
PH_DEV_MON_CUST_JDBC_PERFORMANCE_STATIC
Polling Frequency 180 seconds
Performance Object Configuration for Dynamic Table HEALTH_DYNAMIC_DEMO
Field
Name
Type
Method
Database Type
SQL Query
List of Columns
Setting
jdbc_dynamic_perfObj
Application
JDBC
Oracle Database Server select * from health_dynamic_demo
Column Name Name Format
host_name
Event Attribute
STRING hostName cpu_util DOUBLE cpuUtil mem_util create_time
DOUBLE memUtil
STRING createTime
Where Clauses
Event Type
retrieve all new values since last retrieve time of column create_time
PH_DEV_MON_CUST_JDBC_PERFORMANCE_STATIC
Polling Frequency 180 seconds
Associating Device Types to Performance Objects
In this example, the Oracle database runs on Microsoft Windows, so you would need to associate Microsoft Windows device types to the two performance objects. Because the discovered device type has to exactly match one of device types in this association in order for the discovery module to initiate monitoring, you would need to add other device types, such as Linux, if you also wanted to monitor Oracle databases over
JDBC on those devices.
Edit Device to Performance Object
Field Settings
Page 782
FortiSIEM Installation Guide FortiSIEM Installation Guide
Name
Device Types
Perf Objects
windows_oracle_perf_association
Microsoft Windows
Microsoft Windows 7
Microsoft Windows 98
Microsoft Windows ME
Microsoft Windows NT
Microsoft Windows Server 2000
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP jdbc_static_perfObj(JDBC) - Default Interval:3mins jdbc_dynamic_perfObj(JDBC) - Default Interval:3mins
Testing the Performance Monitor
Before testing the monitor, make sure you have defined the access credentials
mapping, and tested connectivity to the server.
for the database server, created the IP address to credentials
1.
2.
Go to
Admin > Device Support > Performance Monitoring
.
3.
Select one of the performance monitors you created, and then click
Test
.
4.
IP
information for this monitor.
Click Test.
You should see succeed
under Result, and a parsed event attributes in the test result pane.
5. When the test succeeds, click
Close
, and then click
Apply
to register the new monitor with the backend module.
Enabling the Performance Monitor
1.
2.
Discover or re-discover the device
you want to monitor.
Once the device is successfully discovered,
make sure that the monitor is enabled and pulling metrics.
Writing Queries for the Performance Metrics
You can now use a simple query to make sure that that the metrics are pulled correctly. The search results should display the metrics for the event attributes you defined.
1.
Create a structured historical search , and in the
Filter Criteria
, enter
Event Type =
2.
"PH_DEV_MON_CUST_JDBC_PERFORMANCE_STATIC"; Group by:
[None]
This should show the entries in the
HEALTH_STATIC_DEMO
table
Create a structured historical search , and in the
Filter Criteria
, enter
Event Type =
"PH_DEV_MON_CUST_JDBC_PERFORMANCE_SDynamic"; Group by:
[None]
This should show the entries in the
HEALTH_DYNAMIC_DEMO
table .
Page 783
FortiSIEM Installation Guide FortiSIEM Installation Guide
Custom JMX Monitor for IBM Websphere
Creating New Device Types, Event Attribute Types, and Event Types
Adding New IBM WebSphere Performance Objects
Performance Object Configuration for Event Type PH_DEV_MON_CUST_WEBSPHERE_HEAPMEMORY
Performance Object Configuration for Event Type PH_DEV_MON_CUST_WEBSPHERE_THREAD
Transform Formula for websphere_threadPCT Event Attribute
Performance Object Configuration for Event Type PH_DEV_MON_CUST_WEBSPHERE_NON_HEAPMEMORY
Associating Device Types to Performance Objects
Edit Device to Performance Object
Testing the Performance Monitor
Enabling the Performance Monitor
Writing Queries for the Performance Metrics
This example illustrates how to write a custom performance monitor for retrieving IBM Websphere thread, heap memory, and non-heap memory metrics.
Planning
Creating New Device Types, Event Attribute Types, and Event Types
In this case, the IBM Websphere device type is already supported by FortiSIEM, but you need to
create new event attributes and
the metrics you want to retrieve.
Event Attribute Types
Name Display Name Value Type Display Format Type
websphere_heapPCT websphere_numThreads websphere_maxThreads websphere_threadPct websphere_numClass websphere_heapUsed websphere_heapMax
WebSphere HeapPct
WebSphere NumThreads
WebSphere MaxThreads
WebSphere ThreadPct
WebSphere NumClass
WebSphere HeapUsed
WebSphere HeapMax websphere_heapCommitted websphere_nonHeapUsed
WebSphere HeapCommitted
WebSphere NonHeapUsed
INT64
INT64 websphere_nonHeapMax
WebSphere NonHeapMax INT64 websphere_nonHeapCommitted
WebSphere NonHeapCommitted INT64
INT64
INT64
INT64
INT64
INT64
INT64
INT64
Bytes
Bytes
Bytes
Bytes
Bytes
Bytes
Event Types
Naming Custom Event Types
All custom event types must begin with the prefix
PH_DEV_MON_CUST_ .
Name
PH_DEV_MON_CUST_WEBSPHERE_HEAPMEMORY
Device Type Severity
IBM WebSphere App Server Low
PH_DEV_MON_CUST_WEBSPHERE_NON_HEAPMEMORY
IBM WebSphere App Server Low
PH_DEV_MON_CUST_WEBSPHERE_THREAD
IBM WebSphere App Server Low
Adding New IBM WebSphere Performance Objects
Each of the event types requires creating a performance object for monitoring.
Performance Object Configuration for Event Type PH_DEV_MON_CUST_WEBSPHERE_HEAPMEMORY
Page 784
FortiSIEM Installation Guide
Field
Name
Type
Method
MBean
List of Attributes
Setting
websphere_heapMemory_perfObj
Application
JMX java.lang:type=Memory
Object Attribute Private Key Name
HeapMemoryUsage committed
Format Event Attribute
committed Long websphere_heapCommitted
HeapMemoryUsage used used Long websphere_heapUsed
HeapMemoryUsage max max Long
Long websphere_heapMax websphere_heapPCT
Event Type
PH_DEV_MON_CUST_WEBSPHERE_HEAPMEMORY
Polling Frequency 180 seconds
Performance Object Configuration for Event Type PH_DEV_MON_CUST_WEBSPHERE_THREAD
For the
webSphere_threadPct
Event Attribute
, you will enter
a transform as shown in the second table.
Field
Name
Type
Method
MBean
List of Attributes
Setting
websphere_thread_perfObj
Application
JMX java.lang:type=Threading
Object Attribute Private Key Name
ThreadCount ThreadCount
PeakThreadCount
Format Event Attribute
Long
PeakThreadCount Long
Long websphere_numThreads websphere_maxThreads websphere_threadPCT
Event Type
PH_DEV_MON_CUST_WEBSPHERE_THREAD
Polling Frequency 180 seconds
Transform Formula for websphere_threadPCT Event Attribute
Click
New
next to
Transforms
in the dialog to enter the formula.
Field Settings
Object Attribute <blank>
Name
Private Key
<blank>
<blank>
Format
Long
Event Attribute
websphere_threadPct
Transforms
Type Formula
custom ThreadCount*100/PeakThreadcount
FortiSIEM Installation Guide
Performance Object Configuration for Event Type PH_DEV_MON_CUST_WEBSPHERE_NON_HEAPMEMORY
Page 785
FortiSIEM Installation Guide FortiSIEM Installation Guide
Field
Name
Type
Method
MBean
List of Attributes
Setting
websphere_nonHeapMemory_perfObj
Application
JMX java.lang:type=Memory
Object Attribute Private Key Name Format Event Attribute
NonHeapMemoryUsage used Long websphere_nonHeapUsed
NonHeapMemoryUsage committed Long websphere_nonHeapCommitted
NonHeapMemoryUsage max Long websphere_nonHeapMax
Event Type
PH_DEV_MON_CUST_WEBSPHERE_NON_HEAPMEMORY
Polling Frequency 180 seconds
Associating Device Types to Performance Objects
In this example, IBM WebSphere runs on Microsoft Windows, so you would need to associate Microsoft Windows device types to the three performance objects. Because the discovered device type has to exactly match one of device types in this association in order for the discovery module to initiate these monitors, you would need to add other device types, such as Linux, if you also wanted to monitor IBM Websphere over
JMX on those devices.
Edit Device to Performance Object
Field
Name
Device Types
Settings
windows_oracle_perf_association
Perf Objects
Microsoft Windows
Microsoft Windows 7
Microsoft Windows 98
Microsoft Windows ME
Microsoft Windows NT
Microsoft Windows Server 2000
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP websphere_thread_perfObj(JMX) - Default Interval:3mins websphere_thread_perfObj(JMX) - Default Interval:3mins websphere_nonHeapMemory_perfObj(JMX) - Default Interval:3mins
Testing the Performance Monitor
Before testing the monitor, make sure you have defined the access credentials
tested connectivity.
for the server, created the IP address to credentials mapping, and
1.
2.
Go to
Admin > Device Support > Performance Monitoring
.
3.
Select one of the performance monitors you created, and then click
Test
.
4.
IP
information for this monitor.
5.
Click Test.
You should see succeed
under Result, and the parsed event attributes in the test result pane.
When the test succeeds, click
Close
, and then click
Apply
to register the new monitor with the backend module.
Enabling the Performance Monitor
1.
2.
Discover or re-discover the device
you want to monitor.
Once the device is successfully discovered,
make sure that the monitor is enabled and pulling metrics.
Writing Queries for the Performance Metrics
Page 786
FortiSIEM Installation Guide FortiSIEM Installation Guide
You can now use a simple query to make sure that that the metrics are pulled correctly. The search results should display the metrics for the event attributes you defined.
Create a structured historical search with these settings:
Filter Criteria
Structured
Reporting IP IN <IP Range> AND Event Type CONTAIN
"ph_dev_mon_cust_web"; Group by: [None]
Display Columns Time
Event Receive Time,Reporting
IP, Event
Last 60
Minutes
For
Organizations
All
Page 787
FortiSIEM Installation Guide FortiSIEM Installation Guide
Custom SNMP Monitor for D-Link HostName and SysUpTime
Although D-link switches and routers are not supported in this release of AccelOps, you can still use the custom monitor feature to create a system uptime event that will collect basic performance metrics like hostName
and
SysUpTime
.
Planning
Mapping SNMP OIDs to AccelOps Event Attribute Types
If you run the command snmpwalk -v 1 -c <community> <ip> .1.3.6.1.2.1.1
similar to this:
against the D-Link switch, you should see an output
SNMPv2-MIB::sysDescr.0 = STRING: DGS-1210-48 2.00.011
SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.171.10.76.11
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (157556100) 18 days,
5:39:21.00
SNMPv2-MIB::sysContact.0 = STRING:
SNMPv2-MIB::sysName.0 = STRING: SJ-Test-Lab-D-Link
SNMPv2-MIB::sysLocation.0 = STRING: San Jose
SNMPv2-MIB::sysServices.0 = INTEGER: 72
SNMPv2-MIB::sysORLastChange.0 = Timeticks: (157555949) 18 days,
5:39:19.49
To get sysU ptime
, you would run snmpwalk -v 1 -c <community> <ip> .1.3.6.1.2.1.1.3
:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (157577770) 18 days,
5:42:57.70
To get hostname
, you run snmpwalk -v 1 -c <community> <ip> .1.3.6.1.2.1.1.5
:
SNMPv2-MIB::sysName.0 = STRING: SJ-Test-Lab-D-Link
From these outputs you can see that if you want to create a performance monitor for D-Link switch uptime, you need to:
1.
2.
3.
, since D-Link switches are not supported in this release
,
PH_DEV_MON_CUST_DLINK_UPTIME
, that will contain the event attribute types which are already part of the AccelOps event attribute type library.
Create the mapping between the SNMP OIDs and the event attributes: a. OID
.1.3.6.1.2.1.1.5
and hostName
.
hostName
and
SysUpTime
, b. OID
.1.3.6.1.2.1.1.5
and
SysUpTime
.
Creating New Device Types, Event Attribute Types, and Event Types
Device Type
with these attributes:
Field
Vendor
Model
Version
Setting
D-Link
DGS
Any
Page 788
FortiSIEM Installation Guide FortiSIEM Installation Guide
Device/App Group Devices > Network Devices > Router Switch
Biz Service Group <no selection>
Description D-Link Switch
Event Attribute Types and Event Types
Both sysUptime
and hostName
are included in the
DLINK_UPTIME
, that will contain them.
Event Attribute Types
, so you only need to
PH_DEV_MON_CUST_
Naming Custom Event Types
All custom event types must begin with the prefix
PH_DEV_MON_CUST_ .
Name Device Type Severity Description
PH_DEV_MON_CUST_DLINK_UPTIME
D-Link DGS 0 - Low D-Link Uptime
Adding the D-Link SNMP Performance Object
In this case, you will create one performance object that will map the SNMP OIDs to the AccelOps event attribute types hostName
and
SysUpti me
, and then associate them with the
PH_DEV_MON_CUST_DLINK_UPTIME
event type. When you create the
SysUpTime
mapping you will also
to convert system time to centiseconds to seconds as shown in the second table.
Performance Object Configuration for Event Type PH_DEV_MON_CUST_DLINK_UPTIME
Field
Name
Type
Method
Parent OID
Setting
D-LinkUptime
System
SNMP
.1.3.6.1.1.2.1.1
Parent OID is Table <left cleared>
List of OIDs
Object Attribute Name Format
.1.3.6.1.1.2.1.1.5 Host Name String
.1.3.6.1.1.2.1.1.3 Uptime
Type
RawValue
Event Attribute
hostName
Timeticks RawValue
SysUpTime
Event Type
PH_DEV_MON_CUST_DLINK_UPTIME
Polling Frequency
10 seconds
Transform Formula for SysUptime Event Attribute
Type Formula
custom uptime/100
Associating Device Types to Performance Objects
In this case you would only need to make one association with the D-Link DGS device you created.
Field
Name
Device Types
Perf Objects
Settings
D-LinkPerfObj
D-Link DGS
D-LinkUptime(SNMP) - Default Interval:0.17mins
Testing the Performance Monitor
Page 789
FortiSIEM Installation Guide FortiSIEM Installation Guide
Before testing the monitor, make sure you have defined the access credentials
mapping, and tested connectivity.
for the D-Link device, created the IP address to credentials
1.
2.
3.
4.
Go to
Admin > Device Support > Performance Monitoring
.
Select the performance monitor you created, and then click
IP
monitor.
Click
Test
.
5.
You should see succeed
under
Result
Test
.
, and the parsed event attributes in the test result pane.
When the test succeeds, click
Close
, and then click
Apply
to register the new monitor with the backend module.
Enabling the Performance Monitor
1.
2.
Discover or re-discover the device
you want to monitor.
Once the device is successfully discovered,
make sure that the monitor is enabled and pulling metrics.
Writing Queries for the Performance Metrics
You can now use a simple query to make sure that that the metrics are pulled correctly. The search results should display the metrics for the event attributes you defined.
Create a structured historical search with these settings:
Filter Criteria
Structured
Reporting IP IN <IP Range> AND Event Type = "PH_DEV_MON_CUST_DLINK_UPTIME";
Group by: [None]
Display
Columns
Event
Time
Last 10
Minutes
For
Organizations
All
Page 790
FortiSIEM Installation Guide FortiSIEM Installation Guide
Custom SNMP Monitor for D-Link Interface Network Statistics
This example shows how to create a custom performance monitor for network interface statistics for D-link switches. In this case, the result is a table, with one set of metrics for each interface.
Matching SNMP OIDs to AccelOps Event Attribute Types
Creating New Device Types, Event Attributes, and Event Types
Adding the D-Link SNMP Performance Object
Performance Object Configuration for Event Type PH_DEV_MON_CUST_INTF_STAT
Transform Formula for recvBitsPerSec and sentBitsPerSec Event Attributes
Associating Device Types to Performance Objects
Testing the Performance Monitor
Enabling the Performance Monitor
Writing Queries for the Performance Metrics
Planning
Matching SNMP OIDs to AccelOps Event Attribute Types
If you run the command snmpwalk -v 1 -c <community> <ip> .1.3.6.1.2.1.2.2.1
against the D-Link switch, you should see an output similar to this:
IF-MIB::ifIndex.1 = INTEGER: 1
IF-MIB::ifIndex.2 = INTEGER: 2
IF-MIB::ifIndex.3 = INTEGER: 3
IF-MIB::ifIndex.4 = INTEGER: 4
IF-MIB::ifIndex.5 = INTEGER: 5
...
To get the interface index, you would run snmpwalk -v 1 -c <community> <ip> .1.3.6.1.2.1.2.2.1.1
:
IF-MIB::ifIndex.1 = INTEGER: 1
IF-MIB::ifIndex.2 = INTEGER: 2
IF-MIB::ifIndex.3 = INTEGER: 3
IF-MIB::ifIndex.4 = INTEGER: 4
IF-MIB::ifIndex.5 = INTEGER: 5
...
To get interface queue length (the outQLen
.1.3.6.1.2.1.2.2.1.21
:
event attribute in AccelOps), you would run snmpwalk -v 1 -c <community> <ip>
IF-MIB::ifOutQLen.1 = Gauge32: 0
IF-MIB::ifOutQLen.2 = Gauge32: 0
IF-MIB::ifOutQLen.3 = Gauge32: 0
IF-MIB::ifOutQLen.4 = Gauge32: 0
IF-MIB::ifOutQLen.5 = Gauge32: 0
...
Page 791
FortiSIEM Installation Guide
To get interface speed, you would run snmpwalk -v 1 -c <community> <ip> .1.3.6.1.2.1.2.2.1.5
:
FortiSIEM Installation Guide
IF-MIB::ifSpeed.1 = Gauge32: 1000000000
IF-MIB::ifSpeed.2 = Gauge32: 1000000000
IF-MIB::ifSpeed.3 = Gauge32: 1000000000
IF-MIB::ifSpeed.4 = Gauge32: 1000000000
IF-MIB::ifSpeed.5 = Gauge32: 1000000000
...
To get received bytes (the recvBitsPerSec
event attribute in AccelOps), you would run snmpwalk -v 1 -c <community> <ip>
.1.3.6.1.2.1.2.2.1.10
:
IF-MIB::ifInOctets.1 = Counter32: 0
IF-MIB::ifInOctets.2 = Counter32: 1247940872
IF-MIB::ifInOctets.3 = Counter32: 0
IF-MIB::ifInOctets.4 = Counter32: 0
IF-MIB::ifInOctets.5 = Counter32: 0
...
Finall,y to get sent bytes (the sentBitsPerSec
event attribute in AccelOps ), you would run snmpwalk -v 1 -c <community> <ip>
.1.3.6.1.2.1.2.2.1.16
:
IF-MIB::ifOutOctets.1 = Counter32: 0
IF-MIB::ifOutOctets.2 = Counter32: 1271371281
IF-MIB::ifOutOctets.3 = Counter32: 0
IF-MIB::ifOutOctets.4 = Counter32: 0
IF-MIB::ifOutOctets.5 = Counter32: 0
...
From these outputs you can see that if you want to create a performance monitor for D-Link switch uptime, you need to:
1.
2.
, since D-Link switches are not supported in this release.
,
PH_DEV_MON_CUST_DLINK_INTF_STAT
, that will contain the event attribute types outQLen
, recvBitsPerSec
, and sentBitsPerSec
, which are already part of the AccelOps event attribute library, and hostNameSnmpIndx
and intfSpeed
3.
Create the mapping between the SNMP OIDs and the event attributes: a. b. c. d. e.
OID
OID
.1.3.6.1.2.1.2.2.1.5
and intfSpeed
OID
OID
.
.1.3.6.1.2.1.2.2.1.1
and
.1.3.6.1.2.1.2.2.1.21
.1.3.6.1.2.1.2.2.1.10
hostNameSnmpIndx
and
and outQLen recvBitsPerSec
OID .1.3.6.1.2.1.2.2.1.16 and sentBitsPerSec
Creating New Device Types, Event Attributes, and Event Types
Device Type
with these attributes:
Field
Vendor
Model
Setting
D-Link
DGS
Page 792
FortiSIEM Installation Guide FortiSIEM Installation Guide
Version Any
Device/App Group Devices > Network Devices > Router Switch
Biz Service Group <no selection>
Description D-Link Switch
Event Attribute Types
Create these
:
Name Display Name Value Type Display Format Type
hostSnmpIndex
Host Interface SNMP Index INT64 intfSpeed
Interface Speed in bits/sec INT64
<left blank>
<left blank>
Event Types
Naming Custom Event Types
All custom event types must begin with the prefix
PH_DEV_MON_CUST_ .
Name Device Type Severity
PH_DEV_MON_CUST_INTF_STAT
D-Link DGS Low
Adding the D-Link SNMP Performance Object
In this case, you will create one performance object that will map the SNMP OIDs to the AccelOps event attribute types, and then associate them with the
PH_DEV_MON_CUST_INTF_STAT
event type. When you create the recvBitsPerSec
and sentBitsPerSec
Performance Object Configuration for Event Type PH_DEV_MON_CUST_INTF_STAT
Field Setting
Name
Type
Method
Parent OID
D-LinkIntStat
System
SNMP
.1.3.6.1.2.1.2.2.1
Parent OID is Table Selected
List of OIDs
Object Attribute
.1.3.6.1.1.2.1.2.2.1.1
Name
IntfIndex
Format Type Event Attribute
INTEGER RawValue hostSnmpIndex
.1.3.6.1.1.2.1.1.2.1.5
intfSpeed Gauge32 RawValue intfSpeed
.1.3.6.1.1.2.1.1.2.1.10 recvBitsPerSec Counter32 Counter recvBitsPerSec
.1.3.6.1.1.2.1.1.2.1.16 sentBitsPerSect Counter32 Counter
.1.3.6.1.1.2.1.1.2.1.21 outInftQ Gauge32 sentBitsPerSect
RawValue OutQLen
Event Type
PH_DEV_MON_CUST_INTF_STAT
Polling Frequency
60 seconds
Transform Formula for recvBitsPerSec and sentBitsPerSec Event Attributes
Type Formula
system toRate system BytesPerSecToBitsPerSec
Page 793
FortiSIEM Installation Guide FortiSIEM Installation Guide
Associating Device Types to Performance Objects
In this case you would only need to make one association with the D-Link DGS device you created.
Field
Name
Device Types
Perf Objects
Settings
D-LinkPerfObj
D-Link DGS
D-LinkIntfStat(SNMP) - Default Interval:1mins
Testing the Performance Monitor
Before testing the monitor, make sure you have defined the access credentials
mapping, and tested connectivity.
for the D-Link device, created the IP address to credentials
1.
2.
3.
4.
Go to
Admin > Device Support > Performance Monitoring
.
Select the performance monitor you created, and then click
IP
monitor.
Click
Test
.
5.
You should see succeed
under
Result
Test
.
, and the parsed event attributes in the test result pane.
When the test succeeds, click
Close
, and then click
Apply
to register the new monitor with the backend module.
Enabling the Performance Monitor
1.
2.
Discover or re-discover the device
you want to monitor.
Once the device is successfully discovered,
make sure that the monitor is enabled and pulling metrics.
Writing Queries for the Performance Metrics
You can now use a simple query to make sure that that the metrics are pulled correctly. The search results should display the metrics for the event attributes you defined.
Create a structured historical search with these settings:
Filter Criteria Display Columns
Structured
Reporting IP IN <IP Range> AND Event Type ="PH_DEV_
MON_CUST_INTF_STAT "; Group by: Host Name, Host
Interface
Host Name,Host Interface SNMP Index,MAX(Out Intf
Queue), AVG(Intf Speed), AVG(Sent Bit Rate),
AVG(Received Bit Rate)
Time
Last 10
Minutes
For
Organizations
All
Page 794
FortiSIEM Installation Guide FortiSIEM Installation Guide
Custom WMI Monitor for Windows Domain and Physical Registry
Planning
Mapping Windows WMI Classes to FortiSIEM Event Attribute Types
If you run the command wmic -U <domain>/<user>%<pwd> //<ip> "select * from Win32_ComputerSystem
against a Windows server, you will see an output similar to this:
CLASS: Win32_ComputerSystem
AdminPasswordStatus::SEP::AutomaticManagedPagefile::SEP::AutomaticResetB ootOption::SEP::AutomaticResetCapability::SEP::BootOptionOnLimit::SEP::B ootOptionOnWatchDog::SEP::BootROMSupported::SEP::BootupState::SEP::Capti on::SEP::ChassisBootupState::SEP::CreationClassName::SEP::CurrentTimeZon e::SEP::DaylightInEffect::SEP::Description::SEP::DNSHostName::SEP::Domai n::SEP::DomainRole::SEP::EnableDaylightSavingsTime::SEP::FrontPanelReset
Status::SEP::InfraredSupported::SEP::InitialLoadInfo::SEP::InstallDate::
SEP::KeyboardPasswordStatus::SEP::LastLoadInfo::SEP::Manufacturer::SEP::
Model::SEP::Name::SEP::NameFormat::SEP::NetworkServerModeEnabled::SEP::N umberOfLogicalProcessors::SEP::NumberOfProcessors::SEP::OEMLogoBitmap::S
EP::OEMStringArray::SEP::PartOfDomain::SEP::PauseAfterReset::SEP::PCSyst emType::SEP::PowerManagementCapabilities::SEP::PowerManagementSupported:
:SEP::PowerOnPasswordStatus::SEP::PowerState::SEP::PowerSupplyState::SEP
::PrimaryOwnerContact::SEP::PrimaryOwnerName::SEP::ResetCapability::SEP:
:ResetCount::SEP::ResetLimit::SEP::Roles::SEP::Status::SEP::SupportConta ctDescription::SEP::SystemStartupDelay::SEP::SystemStartupOptions::SEP::
SystemStartupSetting::SEP::SystemType::SEP::ThermalState::SEP::TotalPhys icalMemory::SEP::UserName::SEP::WakeUpType::SEP::Workgroup
1::SEP::True::SEP::True::SEP::True::SEP::3::SEP::3::SEP::True::SEP::Norm al boot::SEP::WIN2008-ADS::SEP::3::SEP::Win32_ComputerSystem::SEP::-420::SE
P::True::SEP::AT/AT
COMPATIBLE::SEP::WIN2008-ADS::SEP::FortiSIEM.net::SEP::5::SEP::True::SEP
::3::SEP::False::SEP::NULL::SEP::(null)::SEP::3::SEP::(null)::SEP::VMwar e, Inc.::SEP::VMware Virtual
Platform::SEP::WIN2008-ADS::SEP::(null)::SEP::True::SEP::1::SEP::1::SEP:
:NULL::SEP::([MS_VM_CERT/SHA1/27d66596a61c48dd3dc7216fd715126e33f59ae7],
Welcome to the Virtual
Machine)::SEP::True::SEP::3932100000::SEP::0::SEP::NULL::SEP::False::SEP
::0::SEP::0::SEP::3::SEP::(null)::SEP::Windows
User::SEP::1::SEP::-1::SEP::-1::SEP::(LM_Workstation,LM_Server,Primary_D omain_Controller,Timesource,NT,DFS)::SEP::OK::SEP::NULL::SEP::0::SEP::NU
LL::SEP::0::SEP::X86-based
PC::SEP::3::SEP::4293496832::SEP::FortiSIEM\Administrator::SEP::6::SEP::
(null)
From this output you can see that the
Win32_ComputerSystem
WMI class has two attributes:
1.
Domain
2.
Page 795
FortiSIEM Installation Guide FortiSIEM Installation Guide
2.
TotalPhysicalMemory
From these outputs you can see that if you want to create a performance monitor for Windows Domain and Physical Registry, you need to
1.
,
PH_DEV_MON_CUST_WIN_MEM,
that will contain the event attribute types
Domain
and memTotalMB
, both of
2. which are already contained in the FortiSIEM event attribute types library.
Create the mapping between the WMI class attributes and the FortiSIEM event attribute types: a. b.
WMI class attribute
WMI class attribute
Domain
and
Domain
.
TotalPhysicalMemory
(Bytes) and memTotalMB
(type INT64). Because s in bytes, and memTotalMB
is in
INT64
, a transform will be required to convert the metrics.
TotalPhysicalMemory
return
Creating New Device Types, Event Attributes, and Event Types
Device Type
Since Microsoft Windows is supported by FortiSIEM, you don't need to create a new device type.
Event Attribute Types and Event Types
Both
Domain
and memTotalMB
are included in the FortiSIEM event attribute type library, so you only need to
MON_CUST_WIN_MEM
, that will contain them. create a new event type ,
PH_DEV_
Naming Custom Event Types
All custom event types must begin with the prefix
PH_DEV_MON_CUST_ .
Name
Device Type
Severity Description
PH_DEV_MON_CUST_WIN_MEM
Microsoft Windows 0 - Low Windows Domain and Memory
Adding the Microsoft Windows WMI Performance Object
In this case, you will create one performance object that will map the WMI Class attributes to the FortiSIEM event attribute types
Domain
and
TotalMB
, and then associate them with the
PH_DEV_MON_CUST_WIN_MEM
event type. When you create the memTotalMB
to convert bytes to INT64 as shown in the second table. mapping you will mem
Performance Object Configuration for Event Type PH_DEV_MON_CUST_DLINK_UPTIME
Field Setting
Name
Type
Method
Parent Class
WinMem
System
WMI
Win32_ComputerSystem
Parent Class is Table <left cleared>
List of Attributes
Attribute
Domain
Format Type
String RawValue
Event Attribute
domain
TotalPhysicalMemory Integer RawValue memTotalMB
Event Type
Polling Frequency
PH_DEV_MON_CUST_WIN_MEM
20 seconds
Transform Formula for TotalPhysicalMemory Event Attribute Type
Type Formula
custom TotalPhysicalMemory/1024/1024
Associating Device Types to Performance Objects
In this example, you would need to associate Microsoft Windows device types to the performance object.
Edit Device to Performance Object
Page 796
FortiSIEM Installation Guide FortiSIEM Installation Guide
Field
Name
Device Types
Settings
WinMisc
Perf Objects
Microsoft Windows
Microsoft Windows NT
Microsoft Windows Server 2000
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
WinMem(WMI) - DefaultInterval:0.33mins
Testing the Performance Monitor
Before testing the monitor, make sure you have defined the access credentials
tested connectivity.
for the server, created the IP address to credentials mapping, and
1.
2.
Go to
Admin > Device Support > Performance Monitoring
.
3.
Select one of the performance monitors you created, and then click
Test
.
4.
IP
information for this monitor.
Click
Test
.
5.
You should see succeed
under
When the test succeeds, click
Result
Close
, and the parsed event attributes in the test result pane.
, and then click
Apply
to register the new monitor with the backend module.
Enabling the Performance Monitor
1.
2.
Discover or re-discover the device
you want to monitor.
Once the device is successfully discovered,
make sure that the monitor is enabled and pulling metrics.
Writing Queries for the Performance Metrics
You can now use a simple query to make sure that that the metrics are pulled correctly. The search results should display the metrics for the event attributes you defined.
Create a structured historical search with these settings:
Filter Criteria Display Columns Time
Host IP = <IP> AND Event Type = "PH_DEV_MON_CUST_WIN_MEM
";
Group by:
[None]
Event Receive Time,Reporting IP,Domain,Total
Memory (MB)
Last 10
Minutes
For
Organizations
All
Page 797
FortiSIEM Installation Guide FortiSIEM Installation Guide
Custom Command Output Monitor
You may already have commands or scripts for your devices that collect important metrics or perform some useful function. By creating a custom command output monitor, you can import the output of those commands into the AccelOps event database, where it can be used to
,
write rules to alert against anomolies
, or
output from the command, and then creating a performance object that uses regex to parse the command output, maps the output event attributes to AccelOps event attribute types, and then associates those to an event type.
Creating a Custom SSH Command Output Monitor
Creating a Custom Multi-Line SSH Command Output Monitor
Creating a Custom WINEXE Command Output Monitor
Device Types Supported for Custom SSH Command Output Monitors
Linux variants
Unix variants - IBM AIX, HP UX
Microsoft Windows (with Cygwin tools installed that allows SSH)
Cisco IOS, NX-OS, ASA, CatOS
Juniper JunOS, SSG, ISG
PaloAlto PANOS
Fortinet FortiGate
HP Procurve, H3C
Extreme Ntwork XOS
Foundry BigIron
Avaya ERS
Device Types Supported for Custom WINEXE Command Output Monitors
Microsoft Windows
Page 798
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Custom SSH Command Output Monitor
Mapping SSH Command Outputs to FortiSIEM Event Attribute Types
Creating New Event Attribute Types and Event Types
Adding the iostat Command Output Performance Object
Performance Object Configuration for Event Type PH_DEV_MON_CUST_CMD
Associating Device Types to Performance Objects
Testing the Performance Monitor
Enabling the Performance Monitor
Writing Queries for the Performance Metrics
In this example, the regular expression is used to parse a single line of the command output.
Planning
Mapping SSH Command Outputs to FortiSIEM Event Attribute Types
In this example, you want to monitor the output of the iostat
command. On a Linux machine, the output would look similar to this:
This is the event log that you will want to produce in FortiSIEM:
[PH_DEV_MON_CUST_CMD]:[hostIpAddr]=10.1.20.52,[hostName]=centos6-yu.Fort
iSIEM.net,[readBytes]=17292116.00,
[readRate]=5.71,[tps]=1.49,[writtenBytes]=147500688.00,[writtenRate]=48.
73,[diskName]="sda2"
From this example, you can see that to create a monitor for the iostat command output, you would need to:
1.
2.
Create the event attribute types
, s,
,
, , , and
,
Device
,
from the command output.
PH_DEV_MON_CUST_CMD
, that will contain the event attribute types
and
PH_DEV_MON_CUST_CMD
.
diskName
, to correspond to
,
Blk_
and diskName
,
3.
attribute types, and then associate those event attribute types and values to
Creating New Event Attribute Types and Event Types
Event Attributes
Create these
Page 799
FortiSIEM Installation Guide FortiSIEM Installation Guide
Name Display Name Value Type Display Format Type
diskName tps readRate readBytes
Disk Name
Transactions/s
Read Rate
Read Bytes writtenBytes
Written Bytes writtenRate
Written Rate
Rawvalue
Rawvalue
Rawvalue
Rawvalue
Rawvalue
Rawvalue
STRING
DOUBLE
DOUBLE
INTEGER
INTEGER
DOUBLE
Event Types
Naming Custom Event Types
All custom event types must begin with the prefix
PH_DEV_MON_CUST_ .
Name Device Type Severity
PH_DEV_MON_CUST_CMD
Centos IOS Low
Adding the iostat Command Output Performance Object
In this case, you will create one performance object that will use a regular expression to parse the command output, match value positions in the command output against FortiSIEM event attributes, and then associate those with the event type
PH_DEV_MON_CUST_CMD
.
Performance Object Configuration for Event Type PH_DEV_MON_CUST_CMD
Field
Name
Setting
cmd-iostat
Type
Method
Used For
Application
Login
Command Output Monitoring
Command
iostat
Regular
Expression
Matched
Attribute
Count
List of
Attributes
(^[^]+)\s+([0-9]+\.?[0-9]+|\d+)\s+([0-9]+\.?[0-9]+|\d+)\s+([0-9]+\.?[0-9]+|\d+)\s+([0-9]+\?[0-9]+|\d+)\s+([0-9]+\.?[0-9]+|\d+)
6
5
6
4
2
3
Matched Position Format
1 STRING
Type
RawValue
DOUBLE RawValue
DOUBLE RawValue
Event Attribute
diskName tps readRate
INTEGER RawValue
INTEGER RawValue
DOUBLE RawValue readBytes writtenBytes writtenRate
Event Type
PH_DEV_MON_CUST_CMD
Polling
Frequency
60 seconds
Associating Device Types to Performance Objects
Field Settings
Page 800
FortiSIEM Installation Guide FortiSIEM Installation Guide
Name
Device Types
Perf Objects
cmd-iostat
Centos Linux cmd-iostat(SSH)- Default Interval:1mins
Testing the Performance Monitor
Before testing the monitor, make sure you have defined the access credentials
mapping, and tested connectivity.
for the D-Link device, created the IP address to credentials
1.
2.
3.
4.
Go to
Admin > Device Support > Performance Monitoring
.
Select the performance monitor you created, and then click
IP
monitor.
Click
Test
.
5.
You should see succeed
under
Result
Test
.
, and the parsed event attributes in the test result pane.
When the test succeeds, click
Close
, and then click
Apply
to register the new monitor with the backend module.
Enabling the Performance Monitor
1.
2.
Discover or re-discover the device
you want to monitor.
Once the device is successfully discovered,
make sure that the monitor is enabled and pulling metrics.
Writing Queries for the Performance Metrics
You can now use a simple query to make sure that that the metrics are pulled correctly. The search results should display the metrics for the event attributes you defined.
Create a structured historical search with these settings:
Filter Criteria
Structured
Reporting IP IN <IP Range> AND Event Type
="PH_DEV_MON_CUST_CM"; Group by:[None]
Display Columns
Disk Name,Transactions/s,Read Rate,Read Bytes,
Written Bytes,Written Rate
Time
Last 10
Minutes
For
Organizations
All
Page 801
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Custom Multi-Line SSH Command Output Monitor
In some cases, the output from a command may run over several lines. An example, as shown in the code block below, is the show interfaces
command for Cisco IOS routers. Here the information for each interface, such as Vlan1, Vlan2, etc., needs to be consolidated into a single FortiSIEM event. This topic will show you how to configure a performance object for multi-line SSH command outputs, including an example of the regular expression you would use to parse the example output.
Mapping a Multi-Line SSH Command Output to FortiSIEM Event Attribute Types
Creating New Event Attribute Types and Event Types
Adding the show interfaces Command Output Performance Object
Performance Object Configuration for Event Type PH_DEV_MON_CUST_SHOW_INTF
Associating Device Types to Performance Objects
Testing the Performance Monitor
Enabling the Performance Monitor
Writing Queries for the Performance Metrics
Planning
Mapping a Multi-Line SSH Command Output to FortiSIEM Event Attribute Types
In this example, you want to monitor the output of the ' show interfaces'
command, which would look similar to this for a Cisco IOS router:
Vlan1 is up, line protocol is up
Hardware is EtherSVI, address is 00d0.055b.5000 (bia 00d0.055b.5000)
Description: DevNet
Internet address is 192.168.20.1/22
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not supported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 1/75/12681/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 3583000 bits/sec, 1726 packets/sec
5 minute output rate 3118000 bits/sec, 1064 packets/sec
L2 Switched: ucast: 2060202231 pkt, 586057481378 bytes - mcast:
62824587 pkt, 9271104426 bytes
L3 in Switched: ucast: 43940778993 pkt, 16358818361299 bytes - mcast:
0 pkt, 0 bytes mcast
L3 out Switched: ucast: 37329069590 pkt, 18769383194932 bytes mcast: 0 pkt, 0 bytes
44460046444 packets input, 16420615020121 bytes, 0 no buffer
Received 52655932 broadcasts (0 IP multicasts)
0 runts, 0 giants, 146 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
37746681819 packets output, 18872504999045 bytes, 0 underruns
0 output errors, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
Vlan2 is up, line protocol is up
Page 802
FortiSIEM Installation Guide FortiSIEM Installation Guide
Hardware is EtherSVI, address is 00d0.055b.5000 (bia 00d0.055b.5000)
Description: ServerNet
Internet address is 192.168.0.1/24
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not supported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:01, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/16/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 1652000 bits/sec, 367 packets/sec
5 minute output rate 258000 bits/sec, 177 packets/sec
L2 Switched: ucast: 3422947811 pkt, 2275729058787 bytes - mcast:
4291290 pkt, 528654887 bytes
L3 in Switched: ucast: 17926721335 pkt, 14810495462969 bytes - mcast:
0 pkt, 0 bytes mcast
L3 out Switched: ucast: 13822525718 pkt, 7788778830975 bytes mcast: 0 pkt, 0 bytes
19067733427 packets input, 15044884652941 bytes, 0 no buffer
Received 4283101 broadcasts (0 IP multicasts)
0 runts, 0 giants, 2 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
13850959642 packets output, 7791605865261 bytes, 0 underruns
0 output errors, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
Vlan3 is up, line protocol is up
Hardware is EtherSVI, address is 00d0.055b.5000 (bia 00d0.055b.5000)
Description: newbuildnet
Internet address is 192.168.24.1/24
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not supported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:04, output 00:00:01, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 23000 bits/sec, 1 packets/sec
5 minute output rate 1000 bits/sec, 1 packets/sec
L2 Switched: ucast: 319623039 pkt, 321540971691 bytes - mcast: 6427637 pkt, 563598014 bytes
L3 in Switched: ucast: 9237477530 pkt, 10166398798345 bytes - mcast: 0 pkt, 0 bytes mcast
L3 out Switched: ucast: 5881512921 pkt, 4457997315264 bytes mcast: 0 pkt, 0 bytes
Page 803
FortiSIEM Installation Guide FortiSIEM Installation Guide
9289735817 packets input, 10171188457635 bytes, 0 no buffer
Received 6427548 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
Page 804
FortiSIEM Installation Guide FortiSIEM Installation Guide
5939896982 packets output, 4471143181770 bytes, 0 underruns
0 output errors, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
From this example, you can see that to create a monitor for the 'show interfaces' command output, you would need to:
1.
,
PH_DEV_MON_CUST_SHOW_INTF
, that will contain the event attribute types
, and sentPacketsPerSec,
, all of which are already contained in the FortiSIEM event attribute
2. types library.
containing the regular expression that will parse the command output and match values against the event attribute types, and then associate those event attribute types and values to
PH_DEV_MON_CUST_CMD
.
Creating New Event Attribute Types and Event Types
Event Types
Naming Custom Event Types
All custom event types must begin with the prefix
PH_DEV_MON_CUST_ .
Name Device Type Severity
PH_DEV_MON_CUST_SHOW_INTF
Cisco IOS Low
Adding the show interfaces Command Output Performance Object
In this case, you will create one performance object that will use a regular expression to parse the command output, match value positions in the command output against FortiSIEM event attributes, and then associate those with the event type
PH_DEV_MON_CUST_SHOW_INTF
.
Performance Object Configuration for Event Type PH_DEV_MON_CUST_SHOW_INTF
Field
Name
Type
Method
Used For
Command
Regular
Expression
Matched
Attribute Count
List of
Attributes
Setting
ssh-multiline-CiscoIOS
System
Login
Command Output Monitoring show interfaces
\n(\S*?) is [administratively down|up|down](?!\n\S.)*5 minute input rate\s+(\d+)\s+bits\/sec.*?5 minute output rate\s+(\d+)\s+bits\/sec,\s+(\d+)\s+packets\/sec
5
3
4
5
Matched Position Format
1 STRING
2
Type
RawValue
Event Attribute
intfName
INTEGER RawValue recvBitsPerSec
INTEGER RawValue recvPacketsPerSec
INTEGER RawValue sentBitsPerSec
INTEGER RawValue sentPacketsPerSec
Event Type
Polling
Frequency
PH_DEV_MON_CUST_SHOW_INTF
60 seconds
Page 805
FortiSIEM Installation Guide FortiSIEM Installation Guide
Associating Device Types to Performance Objects
Field
Name
Device Types
Perf Objects
Settings
ssh-Cisco-Intf-Status
Cisco IOS ssh-multiline-CiscoIOS(SSH)-Default Interval:1mins
Testing the Performance Monitor
Before testing the monitor, make sure you have defined the access credentials
mapping, and tested connectivity.
for the Cisco IOS device, created the IP address to credentials
1.
2.
3.
4.
Go to
Admin > Device Support > Performance Monitoring
.
Select the performance monitor you created, and then click
IP
monitor.
Click
Test
.
5.
You should see succeed
under
Result
Test
.
, and the parsed event attributes in the test result pane.
When the test succeeds, click
Close
, and then click
Apply
to register the new monitor with the backend module.
Enabling the Performance Monitor
1.
2.
Discover or re-discover the device
you want to monitor.
Once the device is successfully discovered,
make sure that the monitor is enabled and pulling metrics.
Writing Queries for the Performance Metrics
You can now use a simple query to make sure that that the metrics are pulled correctly. The search results should display the metrics for the event attributes you defined.
Create a structured historical search with these settings:
Filter Criteria
Structured
Event Type = " PH_DEV_MON_CUST_SHOW_INTF" ; Group by:[None]
Display Columns Time
Event Receive
For Organizations
Last 10 Minutes All
Page 806
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Custom WINEXE Command Output Monitor
There may be times when you want the output of a PowerShell command from a Microsoft server as an input for FortiSIEM. Because PowerShell commands can't be sent via SSH, you need to configure a WINEXE performance object to send the command, parse the output, and associate values to FortiSIEM event attribute types.
Often there is a need to have powershell command output from Microsoft servers into FortiSIEM. These commands cannot be run on Windows systems via SSH. The equivalent way of remotely running a command on Windows systems is Winexe. FortiSIEM will run the Winexe command on Windows systems, collect the output and parse the output into fields for use in FortiSIEM analytics.
Planning
For this example, assume you want to monitor disabled users in Microsoft Active Directory. You would use this command:
./winexe -U '<user>%<pwd>' //10.1.2.11 'powershell -NonInteractive
-InputFormat none -OutputFormat text -Command "& {Import-Module
ActiveDirectory;Get-ADUser -LDAPFilter
{(useraccountcontrol:1.2.840.113556.1.4.803:=2)}}"' which would have an output similar to this:
Page 807
FortiSIEM Installation Guide FortiSIEM Installation Guide
DistinguishedName : CN=Guest,CN=Users,DC=sh-FortiSIEM,DC=com
Enabled : False
GivenName :
Name : Guest
ObjectClass : user
ObjectGUID : dfe5eb21-557f-4550-9cea-5db4ee74317f
SamAccountName : Guest
SID : S-1-5-21-2731518400-1375262604-1712717995-501
Surname :
UserPrincipalName :
DistinguishedName : CN=krbtgt,CN=Users,DC=sh-FortiSIEM,DC=com
Enabled : False
GivenName :
Name : krbtgt
ObjectClass : user
ObjectGUID : 13a3703b-185c-4208-98b5-0e65ff638593
SamAccountName : krbtgt
SID : S-1-5-21-2731518400-1375262604-1712717995-502
Surname :
UserPrincipalName :
DistinguishedName : CN=sshd,CN=Users,DC=sh-FortiSIEM,DC=com
Enabled : False
GivenName :
Name : sshd
ObjectClass : user
ObjectGUID : aec0ab40-647a-48ae-ba61-9cf31c08794d
SamAccountName : sshd
SID : S-1-5-21-2731518400-1375262604-1712717995-1225
Surname :
UserPrincipalName :
DistinguishedName : CN=ywang12,DC=sh-FortiSIEM,DC=com
Enabled : False
GivenName :
Name : ywang12
ObjectClass : user
ObjectGUID : df694fd2-cf44-49d1-9ecc-42d8a87102c3
SamAccountName : ywang12
SID : S-1-5-21-2731518400-1375262604-1712717995-1253
Surname :
UserPrincipalName :
From this example, you can see that to create a monitor for the iostat command output, you would need to:
1.
,
PH_DEV_MON_CUST_DISABLED_USERS
, that will contain the event attribute types distName, samAccount
, and sid, all of which are already contained in the FortiSIEM event attribute types library, and which match to amAccountName
, and
SID
in the command output.
2.
Page 808
FortiSIEM Installation Guide FortiSIEM Installation Guide
2.
containing the regular expression that will parse the command output and match values against the event attribute types, and then associate those event attribute types and values to
PH_DEV_MON_CUST_CMD
.
After enabling the WIINEXE output monitor, you should see an event similar to this in FortiSIEM:
[PH_DEV_MON_CUST_DISABLED_USERS]:[hostIpAddr]=10.1.2.11,[hostName]=WIN2
K8-SHRPNT,[distName]="CN=krbtgt,CN=Users,DC=sh-FortiSIEM,DC=com",[samAcc ount]="krbtgt",[sid]="S-1-5-21-2731518400-1375262604-1712717995-502"
Creating New Event Attribute Types and Event Types
Event Types
Naming Custom Event Types
All custom event types must begin with the prefix
PH_DEV_MON_CUST_ .
Name Device Type Severity
PH_DEV_MON_CUST_DISABLED_USERS
Cisco IOS Low
Adding the show interfaces Command Output Performance Object
In this case, you will create one performance object that will use a regular expression to parse the command output, match value positions in the command output against FortiSIEM event attributes, and then associate those with the event type
PH_DEV_MON_CUST_DISABLED_USERS
.
Performance Object Configuration for Event Type PH_DEV_MON_CUST_DISABLED_USERS
Name
Type
Method
Used For
Command
Regular Expression
Matched Attribute
Count
List of Attributes
WINEXE-AD-Disabled-Users-Output
System
WINEXE
Command Output Monitoring
Import-Module ActiveDirectory:Get-ADUser
-LDAPFilter{(useraccountcontrol:1.2.840.113556.1.4.803:2)}
\nDistinguishedName\s+:\s+(.*?)\n.*?SamAccountName\s+:\s+(.*?)\nSID\s+(.*?)\n
3
2
3
Matched Position Format Type
1 STRING RawValue
Event Attribute
disName
STRING RawValue
STRING RawValue samAccount sid
Event Type
Polling Frequency
PH_DEV_MON_CUST_DISABLED_USERS
60 seconds
Associating Device Types to Performance Objects
Field
Name
Settings
DiscoverDisabledUsers
Page 809
FortiSIEM Installation Guide FortiSIEM Installation Guide
Device Types
MIcrosoft Windows Server 2008
MIcrosoft Windows Server 2008 R2
MIcrosoft Windows Server 2012
MIcrosoft Windows Server 2012 R2
WINEXE-AD-Disabled-Users-Output(WINEXE)-Default Interval:1mins
Perf Objects
Testing the Performance Monitor
Before testing the monitor, make sure you have defined the access credentials
mapping, and tested connectivity.
for the D-Link device, created the IP address to credentials
1.
2.
3.
4.
Go to
Admin > Device Support > Performance Monitoring
.
Select the performance monitor you created, and then click
IP
monitor.
Click
Test
.
5.
You should see succeed
under
Result
Test
.
, and the parsed event attributes in the test result pane.
When the test succeeds, click
Close
, and then click
Apply
to register the new monitor with the backend module.
Enabling the Performance Monitor
1.
2.
Discover or re-discover the device
you want to monitor.
Once the device is successfully discovered,
make sure that the monitor is enabled and pulling metrics.
Writing Queries for the Performance Metrics
You can now use a simple query to make sure that that the metrics are pulled correctly. The search results should display the metrics for the event attributes you defined.
Create a structured historical search with these settings:
Filter Criteria
Structured
Event Type = PH_DEV_MON_CUST_DISABLED_USERS ; Group by:[None]
Display Columns Time
Event Receive
For Organizations
Last 10 Minutes All
Page 810
FortiSIEM Installation Guide FortiSIEM Installation Guide
Custom File Monitor
You can create custom file monitors to monitor changes to directories and specific files, and also to trigger incidents when the content of a monitored file is changed from a target gold file.
Agent-less File-Integrity Monitoring
Agent-less Target File Monitoring
Page 811
FortiSIEM Installation Guide FortiSIEM Installation Guide
Agent-less File-Integrity Monitoring
You can use file integrity monitoring to make sure that critical files and directories on servers are not modified. When you enable a file integrity monitor for a specific file or directory, the monitor will:
1.
2.
3.
4.
Log in to the system using SSH.
Compute the checksums of the files or a directory, including all files in the directory.
Periodically verify the computed checksums.
Create an event when a change to the checksums is detected.
A Directory is Modified by Adding a File
Permissions or Ownership of a Specific File or Any File in a Directory is Changed
Adding the File Integrity Monitoring Performance Object
Performance Object Configuration for File Integrity Monitoring
Performance Object Configuration for Directory Integrity Monitoring
Associating Device Types to Performance Objects
Testing the Performance Monitor
Enabling the Performance Monitor
Writing Queries for the Performance Metrics
Change: Audited File Added/Deleted
Change: Audited File Content Modifications
Change: Audited File Attribute Modifications
Supported Servers
File and directory integrity monitoring is supported for these servers:
Linux variants
Unix variants
Windows (with Unix tools installed that allow SSH)
Example Events
These are examples of events that are generated by FortiSIEM when a file or directory is modified, deleted, or has its permissions changed.
File Monitors and Event Types
Unlike other custom monitors, you don't need to set the event type to associate with the monitor. When you select
File Monitor
for the
Used For
option, this automatically associates the event types with the file or directory you specify for monitoring. These examples include the event type associated with each monitoring event.
A Directory is Modified by Adding a File
Event Type:
PH_DEV_MON_CUST_FILE_CREATE
Thu Mar 27 16:33:27 2014 CO228SP222 FortiSIEM-FimLog file="/home/admin/DirectoryMon/file4.txt" hash="d41d8cd98f00b204e9800998ecf8427e" user="root" group="root" access="rw-r--r--" size="0" type="create" hostIp="192.168.64.228"
A Specific File is Modified
Event Type:
PH_DEV_MON_CUST_FILE_CHANGE_CONTENT
Page 812
FortiSIEM Installation Guide FortiSIEM Installation Guide
Thu Mar 27 16:37:50 2014 CO228SP222 FortiSIEM-FimLog file="/home/admin/TargetFileMon/tartget1.txt" prehash="3c9d4de73e30f41eabaef892d507894c" hash="3c9d4de73e30f41eabaef892d507894c" user="root" group="root" access="rw-r--r--" size="26" targetfilehash="cc3d5ed5fda53dfa81ea6aa951d7e1fe" type="modify" hostIp="192.168.64.228"
A Specific File is Deleted
Event Type:
PH_DEV_MON_CUST_FILE_DELETE
Thu Mar 27 16:33:52 2014 CO228SP222 FortiSIEM-FimLog file="/home/admin/DirectoryMon/file3.txt" hash="cc3d5ed5fda53dfa81ea6aa951d7e1fe" user="root" group="root" access="rw-r--r--" size="18" type="delete" hostIp="192.168.64.228"
Permissions or Ownership of a Specific File or Any File in a Directory is Changed
Event Type:
PH_DEV_MON_CUST_FILE_CHANGE_ATTRIB
.
For permissions changes, look for the preaccess
and access
attributes.
For ownership changes, look for the , , , and group
attributes.
Thu Mar 27 16:33:10 2014 CO228SP222 FortiSIEM-FimLog file="/home/admin/FileMon/file1.txt" hash="cc3d5ed5fda53dfa81ea6aa951d7e1fe" preuser="root" user="admin" pregroup="root" group="admin" preaccess="rw-r--r--" access="rwxrwxrwx" size="18" type="change" hostIp="192.168.64.228"
File Scan Event
Event Type:
PH_DEV_MON_CUST_FILE_SCAN
When FortiSIEM scans a file or a directory, this event is generated and can be reported against.
Thu Mar 27 13:59:26 2014 CO228SP222 FortiSIEM-FimLog file="/home/admin/TargetFileMon/tartget1.txt" hash="cc3d5ed5fda53dfa81ea6aa951d7e1fe" user="root" group="root" access="rw-r--r--" size="18" targetfilehash="cc3d5ed5fda53dfa81ea6aa951d7e1fe" type="scan" hostIp="192.168.64.228"
Page 813
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding the File Integrity Monitoring Performance Object
In multi-tenant deployments, the performance object should be created by the Super/Global account, and will apply to all organizations. For both multi-tenant and enterprise deployments, the performance object can be created for an organization by any user who has access to the
Admin
ta b.
In this case, you will create one performance object for each file or directory you want to monitor. You don't need to create a new event type or event attribute type, as these are automatically associated with the performance object when you select
File Monitoring
for the
Used For
field.
Performance Object Configuration for File Integrity Monitoring
Field
Name
Type
Setting
LinuxFileMon
Method
Used For
Application
Login
File Monitor
File Path
home/admin/FileMon/file.txt
Polling Frequency 30 seconds
Performance Object Configuration for Directory Integrity Monitoring
Field
Name
Type
Setting
LinuxDirMon
Application
Method
Used For
Login
File Monitor
File Path
home/admin/DirectoryMon
Polling Frequency 30 seconds
Associating Device Types to Performance Objects
You should associate the performance object to the Linux, Unix, or SSH-capable Windows device type that contains the file or directory path you want to monitor.
Testing the Performance Monitor
Before testing the monitor, make sure you have defined the access credentials
tested connectivity.
for the device, created the IP address to credentials mapping, and
1.
2.
3.
4.
Go to
Admin > Device Support > Performance Monitoring
.
Select the performance monitor you created, and then click
IP
monitor.
Click
Test
.
5.
You should see succeed
under
Result
Test
.
, and the parsed event attributes in the test result pane.
When the test succeeds, click
Close
, and then click
Apply
to register the new monitor with the backend module.
Enabling the Performance Monitor
1.
2.
Discover or re-discover the device
you want to monitor.
Once the device is successfully discovered,
make sure that the monitor is enabled and pulling metrics.
Writing Queries for the Performance Metrics
You can now use a simple query to make sure that that the metrics are pulled correctly.
Change: Audited File Added/Deleted
Page 814
FortiSIEM Installation Guide FortiSIEM Installation Guide
Create a structured historical search with these settings:
Filter Criteria
Structured
Event Type IN ("PH_DEV_MON_CUST_FILE_CREATE","PH_DEV_MON_CUST_FILE_DELETE")
Group by:[None]
Display
Columns
Event Receive
Time
Time
Last 1
Day
For
Organizations
All
Change: Audited File Content Modifications
Create a structured historical search with these settings:
Filter Criteria
Structured
Event Type ="PH_DEV_MON_CUST_FILE_DELTA" Group by:[None]
Display Columns Time For Organizations
Event Receive Time, Host Last 1 Day All
Change: Audited File Attribute Modifications
Create a structured historical search with these settings:
Filter Criteria
Structured
Event Type =" PH_DEV_MON_CUST_FILE_CHANGE_ATTRIB " Group by:[None]
Display Columns Time For Organizations
Event Receive Time, Host Last 1 Day All
Page 815
FortiSIEM Installation Guide FortiSIEM Installation Guide
Agent-less Target File Monitoring
You can use target file monitoring to make sure that a specific file, for example a device configuration file, is always identical in content to a gold standard target file that you import into FortiSIEM. When you enable a target file monitor, it will:
1.
2.
3.
Pre-compute the checksum of the gold standard target file imported into FortiSIEM.
Periodically, log in to the system using SSH and compute the checksum of the file.
Create an event when the content of the monitored file is different than the gold standard target file.
Adding the File Integrity Monitoring Performance Object
Performance Object Configuration for File Integrity Monitoring
Associating Device Types to Performance Objects
Testing the Performance Monitor
Enabling the Performance Monitor
Checking the Difference between Versions of Monitored Files
Supported Servers
Target file monitoring is supported for these servers:
Linux variants
Unix variants
Windows (with Unix tools installed that allow SSH)
Example Events
Two events that are generated by FortiSIEM when the target file is modified.
File Monitors and Event Types
Unlike other custom monitors, you don't need to set the event type to associate with the monitor. When you select
File Monitor
for the
Used For
option, this automatically associates the event types with the file or directory you specify for monitoring. These examples include the event type associated with each monitoring event.
Event Type:
PH_DEV_MON_CUST_TARGET_FILE_CHANGE
This indicates that content of the target file has changed. You can see that the values for prehash
and hash
are different.
Thu Mar 27 16:37:50 2014 CO228SP222 FortiSIEM-FimLog file="/home/admin/TargetFileMon/tartget1.txt" prehash="3c9d4de73e30f41eabaef892d507894c" hash="3c9d4de73e30f41eabaef892d507894c" user="root" group="root" access="rw-r--r--" size="26" targetfilehash="cc3d5ed5fda53dfa81ea6aa951d7e1fe" type="modify" hostIp="192.168.64.228"
Event Type:
PH_DEV_MON_CUST_TARGET_FILE_DELTA
This indicates what was changed, as you can see with the , , and newSVNVersion
attributes.
Page 816
FortiSIEM Installation Guide FortiSIEM Installation Guide
<14>Mar 27 14:02:28 VA223_TestaThon phPerfMonitor[3740]:
[PH_DEV_MON_CUST_TARGET_FILE_DELTA]:[eventSeverity]=PHL_INFO,
[procName]=phPerfMonitor,[fileName]=phSvnUpdate.cpp,[lineNumber]=205,[ph
CustId]=1,[hostName]=CO228SP222,
[hostIpAddr]=192.168.64.228,[fileName]=/home/admin/TargetFileMon/tartget
1.txt,[oldSVNVersion]=15,[newSVNVersion]=20,
[deletedItem]=(none),[addedItem]=newline;,[phLogDetail]=
Adding the File Integrity Monitoring Performance Object
In multi-tenant deployments, the performance object should be created by the Super/Global account, and will apply to all organizations. For both multi-tenant and enterprise deployments, the performance object can be created for an organization by any user who has access to the b.
Admin
ta
In this case, you will create one performance object in which you will upload the gold target file and enter the path to the file you want to monitor.
You don't need to create a new event type or event attribute type, as these are automatically associated with the performance object when you select
File Monitoring
for the
Used For
field.
Performance Object Configuration for File Integrity Monitoring
Field
Name
Type
Method
Used For
Setting
LinuxTargetFileMon
Application
Login
File Monitor
File Path
home/admin/FileMon/file.txt
Target File Click
Upload
and browse to the location of the file that you want to use as the gold target
Associating Device Types to Performance Objects
You should associate the performance object to the Linux, Unix, or SSH-capable Windows device type that contains the file or directory path you want to monitor.
Testing the Performance Monitor
Before testing the monitor, make sure you have defined the access credentials
tested connectivity.
for the device, created the IP address to credentials mapping, and
1.
2.
3.
4.
Go to
Admin > Device Support > Performance Monitoring
.
Select the performance monitor you created, and then click
IP
monitor.
Click
Test
.
5.
You should see succeed
under
Result
Test
.
, and the parsed event attributes in the test result pane.
When the test succeeds, click
Close
, and then click
Apply
to register the new monitor with the backend module.
Enabling the Performance Monitor
1.
2.
Discover or re-discover the device
you want to monitor.
Once the device is successfully discovered,
make sure that the monitor is enabled and pulling metrics.
Checking the Difference between Versions of Monitored Files
When the monitor detects a difference between the files, it will trigger the rule
Audited target file content modified
, and the rule will continue to trigger and generate incidents until the checksums of the files match. You can compare the original monitored file against the new
Page 817
FortiSIEM Installation Guide version in the CMDB.
1.
2.
Go to
CMDB > Devices
.
3.
Select the device where the monitored filed is located
Click the
Configuration
tab.
4.
In the left pane you will see a list of all the files, and their versions, on the device.
To compare files, select one, CNTRL/select the other, and then click
Diff
.
FortiSIEM Installation Guide
Page 818
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring Event Handling
This section describes certain event handling operations that happen at the moment events are received in AccelOps.
Page 819
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event Dropping
Some devices and applications generate a significant number of logs, which may be very verbose, contain little valuable information, and consume storage resources. You can configure Event Dropping rules that will drop events just after they have been received by FortiSIEM, preventing these event logs from being collected and processed. Implementing these rules may require some thought to accurately set the event type, reporting device type, and event regular expression match, for example. However, dropped events do not count towards licensed Events per
Second (EPS), and are not stored in the Event database. Dropped event also do not appear in reports, and do not trigger rules. You can also specify that events should be dropped but stored, so event information will be available for searches and reports, but will not trigger rules. And example of an event type that you might want to store but not have trigger any rules would be an IPS event that is a false positive.
Procedure
1. Log in to your Supervisor node.
For multi-tenant deployments you should log in to the Super/Global account if you want to set a system-wide event dropping rule. If you want to set an event-dropping rule for a specific organization, either log in as an administrator for that organization, or or log in using the
2.
3.
Super/Global Account and then select the organization to which the rule should apply when you are creating it.
Go to
4.
Under
Admin > General Settings > Event Handling
.
Event Dropping Rule
, click
Add
.
5.
Next to
Reporting Device
, click
Edit
, and use the CMDB Browser to find device group or individual device that you want to create the rule for.
Next to
Event Type
, click
Edit
, and use the Event Type Browser to find the group of event types, or a specific event type, that you want
6. to create the rule for.
If the event type you select has an
Source IP
or
Destination IP
attribute, you can enter specific IP addresses to which the rule should
7. apply.
For
Regex Filter
, enter any regular expressions you want to use to filter the log files.
If any matches are made against your regular expression, then the event will be dropped.
For multi-tenant deployments, select the
Organization
to which the rule should apply. 8.
9.
10.
11.
Select the
Enter any
Click
Save
.
Action
that should be taken when the event dropping rule is triggered.
Description
for the rule.
Implementation Notes
1.
2.
3.
4.
All matching rules are implemented by FortiSIEM, and inter-rule order is not important. If you create a duplicate of an event dropping rule, the first rule is in effect.
If you leave a rule definition field blank, then that field is not evaluated. For example, leaving
Event Type
left blank is the same as selecting
All Event Types
.
FortiSIEM drops the event at the first entry point. If your deployment uses Collectors, events are dropped by the Collectors. If your deployment doesn't use Collectors, then the event will be droppedby the Worker or Supervisor where the event is received.
You can use the report System Event Processing Statistics to view the statistics for dropped events. When you run the report, select AVG(Policy Dropped Event Rate(/sec) as one of the dimensions for Chart For to see events that have been dropped to this policy.
Page 820
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event Forwarding
n systems management, many servers may need access to forward logs, traps and Netflows from network devices and servers, but it is often resource intensive for network devices and servers to forward logs, traps and netflows to multiple destinations. For example, most Cisco routers can forward Netflow to two locations at most. However, FortiSIEM can forward/relay specific logs, traps and Netflows to one or more destinations.
If you want to send a log to multiple destinations, you can send it to FortiSIEM, which will use an event forwarding rule to send it to the desired locations.
1.
2.
3.
4.
5.
6.
7.
Log in to your Supervisor node.
Go to
Admin > General Settings > Event Handling
.
Under
Event Forwarding Rule
, for multi-tenant deployments, select the organization for which the rule will apply.
Click
For
For
Add
Select the
.
Sender IP
Severity
, enter the IP address of the device that will be sending the logs.
, select an operator and enter a severity level that must match for the log to be forwarded.
Traffic Type
to which the rule should apply.
The
Forward To > Port
field will be populated based on your selection here.
8.
9.
For
Forward to > IP
Click
OK.
, enter the IP address to which the event should be forwarded.
Multiple Destinations from the Same Sender IP
If you want the same sender IP to forward events to multiple destinations, create a rule for each destination.
Duplicate Rules Create Duplicate Logs
FortiSIEM will implement all rules that you create and enable, so if you create a duplicate of an event forwarding rule, two copies of the same log will be sent to the destination IP.
Page 821
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event Organization Mapping
FortiSIEM can handle reporting devices that are themselves multi-tenant and hence have organization names in events that they send. This section describes how you can map organization names in external events to those on FortiSIEM so that those events have the correct FortiSIEM organizations.
Adding Organization Mapping Rules
1.
2.
3.
4.
Go to > > >
Click
Add
to add a rule
Select
Enabled
if this rule is to be enforced
5.
Select the
Device Type
of the sender. This has to be a device that FortiSIEM understands and able to parse events.
that contains the external organization name. FortiSIEM will map the value in this field to an FortiSIEM
6.
7. down if needed. This field is optional.
8.
Select the
Event Attribute
organization.
Select the
Collectors
that are going to receive the events. By default any collectors would be able to do this but it is possible to scope
Specify the
Reporting IP/Range
of the multi-tenant devices that are sending events. Format of this field is a comma separated list of IP addresses intermixed with IP ranges, e.g. 10.1.1.1,10.1.1.2,10.10.1.1-10.10.1.250.
Specify the a. b. c.
Org Mapping.
Click
Edit
Select the
Click the
Event Organization
9.
OK
column
Click to Save.
System (FortiSIEM) organization
on the left column
and enter the external Organization name corresponding to the System Organization on the left
Implementation Notes
Do not define overlapping rules - make sure no overlaps in (Collector, Reporting IP/Range,Event Attribute) between multiple rules.
Page 822
FortiSIEM Installation Guide
Managing FortiSIEM
FortiSIEM Installation Guide
Page 823
FortiSIEM Installation Guide FortiSIEM Installation Guide
General System Administration
Topics in this section contain information on monitoring the health of your FortiSIEM deployment, general system settings such as language, date format, and system logos, and how to add devices to a maintenance calendar.
Additional Information in the Help Center
You can find additional information about system administration for your FortiSIEM deployment, including troubleshooting tips, in the Sy stem Administration section of the Help Center maintained by FortiSIEM Support.
Creating Maintenance Window for Devices
Creating Maintenance Window for Synthetic Transaction Monitoring jobs
Creating Reverse SSH Tunnels to Debug Collector Issues
Managing System Date Format and Logos
Viewing Cloud Health and System Information
Viewing License Information and Adding Nodes to a License
Using Beaconing to Communicate with AccelOps Support
AccelOps Event Categories and Handling
Installing OS Security Patches
Page 824
FortiSIEM Installation Guide FortiSIEM Installation Guide
FortiSIEM Backend Processes
This topic provides a brief description of FortiSIEM backend system processes, and the nodes (Supervisor, Collector, Worker) that use them.
Process
phMonitor phDiscover phPerfMonitor phAgentManager phCheckpoint phEventPackage phParser phDataManager phRuleMaster phRuleWorker phQueryMaster phQueryWorker phReportMaster
Aggregates data for rules
Merges data from QueryWorker
Executes a query task
Merge data from ReportWorker phReportWorker Aggregates data for reports phIPIdentityMaster Merges IP identity information phIdentityWorker
Apache
Function
Monitoring other processes
Pulling basic data from target
Execute performance job
Execute event pulling job
Execute checkpoint monitoring
Uploading event/SVN file to Supervisor/Worker
Used by Supervisor Used by Worker Used by Collector
X X X
X
X
X
X
X
X
X
X
X
X
X
X
Parsing event to shared store (SS)
Save event from SS to Event DB
Determines if a rule should trigger
X
X
X
X
X
X
X
X
Collects IP identity information
Receives event/SVN files from the Collector
X
X
X
X
X
X
X
X
X
X
X
Page 825
FortiSIEM Installation Guide FortiSIEM Installation Guide
Administrator Tools
This topic describes administration tools and scripts that are included with your FortiSIEM deployment, along with information on where to find and how to use them.
Tool phTools
TestSegmentReader Test Segment Reader is used to quickly read data segments in the eventdb through the command line. You can use this to manually inspect data integrity and parsed event attributes.
phExportEvent
TestDBPurger
Description
phTools is a simple tool for starting and stopping backend processes, and for getting change log information. When you
example, you would use phTools to stop all backend processes.
Used to export event information to a CSV file
A script to selectively delete event data per org and time interval
Use Only to Delete Data for a Single Date
You should only use this script to delete data for a single date and organization. If you try to delete data for multiple dates, the script will fail.
How to Use It
Log in to the FortiSIEM host machine as root
.
Usage
[root@FortiSIEM]# phtools
Commands:
--change-log
, -
-st
,
Target: ALL
--change-log
also supports
, ,
Log into the FortiSIEM host machine as root
.
Usage
[root@FortiSIEM]# TestSegment
Reader <segmentDir>
You can find the script at
/opt/phoeni x/bin/TestDBPurger
. Run it in terminal mode and follow the instructions.
Page 826
FortiSIEM Installation Guide FortiSIEM Installation Guide
Managing User Activity
In the User Activity page you can view the users who are logged into your system, user query activity, and locked out users. You can also log users out of the system, stop active user queries, and lock or unlock users from being able to log in. Click the corner of the FortiSIEM web interface to access user activity information.
User Activity
icon in the upper-right
Page 827
FortiSIEM Installation Guide FortiSIEM Installation Guide
Managing Logged In Users
In the
Logged In Users
tab of the
User Activity
page you can see the users who are currently logged in to your system. You can also log users out of the system, with an option to lock them out as well.
1.
2.
Log in to your Supervisor node.
In the upper-right corner of the FortiSIEM web interface, click the
User Activity
icon.
3. Click the
Logged In Users
tab.
4.
5.
You will see a list of all the users who are currently in your system.
If you want to log a user out of the system, select the user and click
Log Out
.
If you want to lock a user out of the system, select the user and click
Log Out and Lock Out
.
Page 828
FortiSIEM Installation Guide FortiSIEM Installation Guide
Managing Locked Out Users
In the
Locked Users
tab of the
User Activity
page you can see the users who are currently locked out of your system, and also unlock them.
1.
2.
Log in to your Supervisor node.
In the upper-right corner of the FortiSIEM web interface, click the
User Activity
icon.
3. Click the
Locked Users
tab.
4.
You will see a list of all users who are locked out of the system.
To unlock a user, select the user and then click
Unlock
.
Page 829
FortiSIEM Installation Guide FortiSIEM Installation Guide
Managing Active User Queries
In the
User Queries
tab of the
User Activity
page you can see the user queries that are running in your system, and also stop queries.
1. In the upper-right corner of the FortiSIEM web interface, click the
User Activity
icon.
2. Click the
User Queries
tab.
3.
You will see a list of all the queries that are currently running in your system.
To stop a query, select it and then click
Stop Query
.
Page 830
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Maintenance Window for Devices
You can add a device to a maintenance window. During this period, the device is not monitored, and alerts for the device are not triggered. If you have an FortiSIEM multi-tenant deployment and you log in as a Super/Global user, you can schedule maintenance events for single organizations, the Super/Global organization, or add devices from multiple organizations to the same maintenance event.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Admin > Maintenance Calendar
.
5.
Click
Add
Enter a
.
Name
and
Description
for the maintenance event.
Set the
Time Range
and
Date Range
for the maintenance event.
Recurring Maintenance Events
Select
From start date on
to set up recurring maintenance events.
6.
7.
Under
Groups and Devices
, click
Edit
.
If you have an FortiSIEM multi-tenant deployment, select the calendar.
Organization
that has the devices you want to add to the maintenance
Multiple Organizations, One Maintenance Event
If you are the Super/Global user, it is possible to add devices from different organizations to the same maintenance event.
8. Add
Folders
or
Items
9.
10. the selection pane.
Click
OK
Select
to the maintenance event by selecting them, and then using the
Folder >>
and
Item >>
buttons to move them into
when you're done selecting Folders and Items.
Generate incidents for devices under active maintenance
if you want incidents for devices that are part of this maintenance
11.
12. event to be triggered.
Click
OK
.
You will now see your maintenance event listed on the calendar. Mouse over any calendar entry to view details of the maintenance event.
Page 831
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Maintenance Window for Synthetic Transaction Monitoring jobs
You can add a Synthetic Transaction Monitoring (STM) job to a maintenance event. During the maintenance event, the STM job is not executed and hence related alerts do not trigger.
If you have an FortiSIEM multi-tenant deployment and you log in as a Super/Global user, you can schedule maintenance events for single organizations, the Super/Global organization, or add devices from multiple organizations to the same maintenance event.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Admin > Maintenance Calendar
.
5.
Click
Add
Enter a
.
Name
and
Description
for the maintenance event.
Set the
Time Range
and
Date Range
for the maintenance event.
Recurring Maintenance Events
Select
From start date on
to set up recurring maintenance events.
6.
7.
Under
Groups and Devices
, click
Edit
.
If you have an FortiSIEM multi-tenant deployment, select the calendar.
Organization
that has the devices you want to add to the maintenance
Multiple Organizations, One Maintenance Event
If you are the Super/Global user, it is possible to add devices from different organizations to the same maintenance event.
8.
9.
10.
11.
Click
Synthetic Transaction Monitor
Select the Items from the bottom left and then click
Click
OK
Select
to Save the configuration.
(STM) to see all the STM jobs under
Item >>
Items
in the windows below.
to move them into the selection pane.
Generate incidents for devices under active maintenance
if you want incidents for devices that are part of this maintenance
12.
13. event to be triggered.
Click
OK
.
You will now see your maintenance event listed on the calendar. Mouse over any calendar entry to view details of the maintenance event.
Page 832
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Reverse SSH Tunnels to Debug Collector Issues
Using SSH Tunnels to Connect to Managed Endpoints
Browser Plugins and Connectivity Protocol Support
Using Role-Based Access Control to Limit Access to Tunnel Creation, Viewing, and Closing
Using SSH Tunnels to Connect to Managed Endpoints
When you want to quickly debug an issue, you often need to connect to a managed endpoint directly from a browser using protocols such as
Telnet/SSH, RDP, or VNC to HTTP(S), depending on the operating system of the endpoint. However, in a multi-tenant deployment, the managed endpoint could be behind a firewall and across the Internet. To further complicate matters, the firewall may not permit an inbound connection for management protocols for security reasons, and also may not allow quick policy changes.
The FortiSIEM solution to this situation is to build a reverse SSH tunnel between the Collector and the Supervisor. The firewall already allows
HTTP(S) sessions from Collector to Supervisor. After also being configured to also allow SSH connections from Collector to Supervisor,
FortiSIEM builds an on-demand reverse SSH Tunnel initiated by the Collector. You can then use the tunnel to open a remote management session from your browser to the remote managed endpoint. This blog post on The Geek Stuff tunnels on Linux, and provides some additional technical details.
describes the process for setting up reverse SSH
If the managed endpoint is directly accessible from your browser, FortiSIEM can open a direct session. The devices and based on this information, FortiSIEM can determine whether to launch a direct or Collector-based session.
If the device is discovered by the Supervisor, then it opens a direct session
If the device is discovered by a Collector, then it opens a reverse SSH tunnel from the collector, and then initiates a session over this tunnel
FortiSIEM has several features for managing SSH tunnels, including:
You can define the port of the reverse SSH tunnel. By default it is set to
19999,
but it can be changed to any port.
FortiSIEM automatically times out each tunnel after a day, although you can manually delete a tunnel at any time
FortiSIEM provides full tunnel management auditing, such as a reporting on who creates and deletes a tunnel
FortiSIEM supports a broad group of connectivity protocols protocols. You can can launch any connectivity application by specifying the port, and FortiSIEM will create the tunnel.
RBAC is supported at the Collector level - if the user can visit the Collector health page, then the user can open a remote collector tunnel.
Browser Plugins and Connectivity Protocol Support
Since FortiSIEM runs from a browser, some integrations are possible if certain browser plugins are installed. The best use case is:
Using the Firefox browser to connect to FortiSIEM
The FireSSH browser plugin is already installed in Firefox
You launch a remote session to the managed endpoint over SSH
FortiSIEM launches the FireSSH browser plugin and passes the managed endpoint IP
You type in your user name and password, and if the authentication succeeds, then the shell appears
This table lists the browsers, and the protocols supported by their plugins, that you can use to connect to the managed endpoint.
Always type the end host/device credentials for direct connections over a reverse tunnel even though the displayed IP/port belongs to the Supervisor.
Web
Browser
Firefox
Connectivity
Protocol
SSH
Telnet
Supported
Browser
Plugin
FireSSH
None
HTTP(S)
Integration
The plugin launches. You need to provide your user name and password for the end host/device
A dialog shows the Supervisor's port/tunnel endpoint to connect to. Use your favorite external telnet client to telnet to <Supervisor-IP> and the port.
Another tab opens. You will need to provide your user name and password if the endpoint device requires it.
RDP
None required
None
VNC None
A dialog shows the Supervisor's port/tunnel endpoint to connect to. Use your favorite client to connect to <Supervisor-IP> and the port.
external r emote desktop
A dialog shows the Supervisor's port/tunnel endpoint to connect to.
Use your favorite connect to <Supervisor-IP> and the port.
external VNC client to
Page 833
FortiSIEM Installation Guide FortiSIEM Installation Guide
Chrome
Other
SSH
Telnet
RDP
HTTP(S)
VNC
Other
Safari (on
OSX only)
SSH
Telnet
RDP
None
FireSSH
None
Chrome
RDP
None required
None
None
Mac
Terminal
Mac
Terminal
None
HTTP(S)
VNC
None required
None
Other None
Internet
Explorer
SSH, Telnet,
RDP,
HTTP(S),
VNC, Other
No plugin integration
A dialog shows the Supervisor's port/tunnel endpoint to connect to.
Use your favorite connect to <Supervisor-IP> and the port.
external application client to
The plugin launches. You need to provide your user name and password for the end host/device.
A dialog shows the Supervisor's port/tunnel endpoint to connect to. Use your favorite external telnet client to telnet to <Supervisor-IP> and the port.
A dialog opens for the Chrome RDP plugin. Make sure your popup blocker is disabled, or that you allow popups from this site. Click endpoint to connect to. favorite RDP client.
Launch App
to launch the plugin in a new tab. A dialog shows the Supervisor's port/tunnel
Enter <Supervisor-IP>:<Supervisor Port> to connect. Alternatively, you can use your
Another tab opens. You will need to provide your user name and password if the endpoint device requires it.
A dialog shows the Supervisor's port/tunnel endpoint to connect to. Use your favorite external VNC client to connect to <Supervisor-IP> and the port.
A dialog shows the Supervisor's port/tunnel endpoint to connect to. Use your favorite external application client to connect to <Supervisor-IP> and the port.
A new terminal window launches and connects via SSH to <Supervisor-IP> and <Supervisor-port>. Enter your user name and password for the end host/device.
A new terminal window launches and connects via telnet to <Supervisor-IP> and <Supervisor-port>. Enter your user name and password for the end host/device.
A dialog opens for the Chrome RDP plugin. Make sure your popup blocker is disabled, or that you allow popups from this site. Click Launch App to launch the plugin in a new tab. A dialog shows the Supervisor's port/tunnel endpoint to connect to. Enter <Supervisor-IP>:<Supervisor Port> to connect. Alternatively, you can use your favorite RDP client.
Another tab opens. You will need to provide your user name and password if the endpoint device requires it.
A dialog shows the Supervisor's port/tunnel endpoint to connect to. Use your favorite external VNC client to connect to <Supervisor-IP> and the port.
A dialog shows the Supervisor's port/tunnel endpoint to connect to. Use your favorite external application client to connect to <Supervisor-IP> and the port.
Create the tunnel and then connect to the <Supervisor-Port> that is displayed using an external application.
Firewall Configuration
If there is a firewall between the Collector and the Supervisor, the firewall needs to allow SSH from the Collector to the Supervisor. The default setting uses a non-standard port,
TCP connections on port 19999.
19999
, so make sure you configure the firewall between the Collector and the Supervisor to allow outbound
Using Role-Based Access Control to Limit Access to Tunnel Creation, Viewing, and Closing
For security and management reasons, you may want to limit the ability of users to create tunnels. The easiest way to do this is through
that have defined access capabilities. For example
To prevent the creation of
any
tunnels for a role, disallow access to the
CMDB
tab for that role, or disallow access to the particular device or device group. This second option lets you create fine-grained controls for tunnel creation, for example:
Admins who are able to view Network devices can only open tunnels to Network devices
Admins who are able to view Servers can only open tunnels to Servers
Admins who are able to view a custom-created device group can only open tunnel to that specific custom group
To prevent viewing and closing existing tunnels, disallow access to the
Admin > Collector Health
page
Related Links
Page 834
FortiSIEM Installation Guide FortiSIEM Installation Guide
Auditing the Creation and Deletion of SSH Tunnels
FortiSIEM includes a
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Analytics > Reports > System Audit
.
Select the
SSH Tunnel Open/Close History
Run the report as described in
report.
Running System and User-Defined Reports and Baseline Reports
.
Page 835
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Remote Tunnel to a Device Monitored by a Collector
Prerequisites
You should review the browsers and plugins that are supported
for the connectivity protocol you want to use to connect to the device.
Procedure
1.
2.
3.
4.
5.
6.
Search for or browse to the device you want to establish the connection to.
In the
IP Address
column for that device, click on the IP address associated with it to open the
Options
Port
Port 22
.
you want to use to connect to the device.
7.
Log in to your Supervisor node.
Go to
CMDB > Devices
.
In the Options menu, select
Enter the
For
SSH
Protocol
this is
and
Connect To...
.
menu.
8.
Select
Create Tunnel
.
A tunnel will be established between the Supervisor and the Collector that is monitoring the device.
Use your browser and plugins to establish remote connectivity to the device as described in
.
Creating Reverse SSH Tunnels to Debug
Page 836
FortiSIEM Installation Guide FortiSIEM Installation Guide
Managing Remote Tunnels to Collector Devices
After you have created tunnels to collector devices, you can view and manage those tunnels in the
Collector Health
page.
1.
2.
3.
Log in to your Supervisor node.
Go to
Admin > Collector Health
.
Click
Tunnels
.
The existing tunnels will be displayed in a table with these columns:
Column
Name
Host IP
Description
The IP address of the managed endpoint
Super
Port
Sessions are opened on this port on the Supervisor to connect to the managed endpoint. This ensures that the Supervisor will use the correct tunnel to reach the managed endpoint.
Protocol
The protocol used to establish the connection to the endpoint
Collector The Collector that monitors the endpoint
PID
The process ID of the tunnel. If you kill this process, it will kill the tunnel
Opened
Time
The time when the tunnel was opened
4. You can close a tunnel by selecting it and then clicking
Close
, or you can close all tunnels at the same time by clicking
Close All
.
Page 837
FortiSIEM Installation Guide FortiSIEM Installation Guide
Managing System Date Format and Logos
The page under
Admin > General Setting
s contains fields that you can use to change the date format for your FortiSIEM user interface, and to upload logos to be used within the user interface and on PDF reports.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Admin > General Settings > UI
.
Select the
Date Format
you want to use to display dates in the user interface, and then click
Change
.
Click
Change
to choose a
UI Logo
that will be displayed alongside the main application tabs for your FortiSIEM deployment.
5.
The logo file must be in in PNG format, and should not be more than 200 pixels wide or 60 pixels high (54 pixels is the ideal height).
Click
Change
to choose a
Report Logo
that will be used in the header of reports you export to PDF.
The logo file must be in SVG format, 160 pixels wide and 40 pixels high, or other dimensions with a 4:1 width/height ratio.
For Service Provider installs, UI Logos can also be set on a per organization basis.
1.
2.
3.
4.
5.
SSH to Supervisor via root
Change user to admin 'su admin'
Change directory by running 'cd /opt/glassfish3/glassfish/domains/domain1/applications/phoenix/phoenix-web-1.0_war/resources/header'
Create a logo per organization a. b. c. mkdir org cd org
Create Organizations IDs as directories. Eg: ‘mkdir 2001’ (To find Org ids, Goto Admin > Setup Wizard > Organizations > ID)
Copy PNG files to respected Organizations as logo.png. For example:
6.
/opt/glassfish3/glassfish/domains/domain1/applications/phoenix/phoenix-web-1.0_war/resources/header/org/2001/logo.png
Logon to Organization e.g: Org1 (id: 2001) and make sure that UI logo is updated
STEPS TO CONVERT JPEG, GIF and PNGs to SVG FORMAT
Note - FortiSIEM only accepts SVG formatted logo. All other formats must be converted to SVG formats first.
1.
2.
3.
Upload 160 x 40 JPEG/GIF/PNG logo to http://vectormagic.com
Download SVG formatted logo from converter
Upload converted SVG formatted logo on FortiSIEM UI (Admin > General Settings > UI)
Page 838
FortiSIEM Installation Guide FortiSIEM Installation Guide
Viewing Cloud Health and System Information
The
Admin > Cloud Health
page shows you the status of the nodes in your deployment, as well as the processes running on them.
1.
2.
3.
Go to
Admin > Cloud Health
.
Click on any node to view its
Process Details
.
See
for more information about the system role played by each process.
You can access other information about your FortiSIEM deployment by clicking the
Alert
icon in the upper-right corner of the user interface, which will show you
Alerts
and
Tasks
for the system within the last 24 hours.
Viewing System Errors
You can view system errors from any page in the FortiSIEM user interface by clicking on the address window in your browser.
System Errors
link directly under the URI
Page 839
FortiSIEM Installation Guide FortiSIEM Installation Guide
Viewing Collector Health
If your FortiSIEM deployment
, you can monitor the status of the Collectors in the
Admin > Collector Health
also upgrade Collectors from this page, as described in
Setting Up the Image Server for Collector Upgrades .
page. You can
1.
2.
3.
Log in to your Supervisor node.
Go to
Admin > Collector Health
.
Select a Collector and click
Show Processes
4.
See
You can also
Stop
or
Start
to see the processes running on that Collector.
for more information about the processes that run on Collectors.
a Collector by selecting it and clicking the appropriate button.
Properties associated with Collector Health include:
Collector
Property
Org Name
Collector
Name
IP Address
Status
Health
Build Date
Upgrade
Version
Install
Status
Download
Status
Allocated
EPS
Incoming
EPS
Up Time
Last
Performance
Data
Last Status
Update
Last Event
Data
CPU
Utilization
Memory
Utilization
Version
Description
Name of the organization to which the Collector belongs
The name of the Collector
The IP address of the Collector
The status of the Collector as either or
Down
Displays the health of the Collector based on the health of the modules running on it. If Health is
Critical
, it means that one of the modules is not running on the Collector.
Total time that the Collector has been up
The time when the collector last reported its performance status to the cloud
The time when the collector last reported its status to the cloud
The time when the collector last reported events to the cloud
Overall CPU utilization of the Collector
Overall memory utilization of the Collector
Which version of FortiSIEM the Collector is running on
The date on which the version of FortiSIEM the Collector is running on was built
If the Collector has been upgraded, the version it was upgraded to
If you upgrade the Collector, the status of the upgrade is shown here as either
Success
or
Failed
the download is shown here as
Success
or
Failed
The number of events per second (EPS) dynamically allocated by the system to this collector. See
The EPS that the Collector is currently seeing
Page 840
FortiSIEM Installation Guide FortiSIEM Installation Guide
Viewing License Information and Adding Nodes to a License
The
License Management
page in the
Admin
tab shows information associated with your current FortiSIEM license, and allows you to add virtual appliances and Report Servers to your deployment as your license allows.
1.
2.
3.
5.
Log in to your Supervisor node.
Go to
Under
Click
Admin > License Management
.
License Information
Add
Under
you will see detailed information about both
Report Server Information
IP address for other Report Servers that you want to add to your license.
Allowed
and
Current Usage
for the number of virtual
4. appliances, EPS, number of devices, and other attributes associated with you FortiSIEM license.
Under
VA Information
you will see the name and IP address of the virtual appliances, and their roles, in your FortiSIEM deployment.
, and then enter an IP address for other nodes that you want to add to your license.
you will see the IP address of any Report Servers in your deployment. Click
Add
, and then enter an
Calculations for License Usage Statistics
Statistic Calculation Notes
EPS AccelOps calculates the EPS for your system using a counter that records the total number of received events in a three minute time interval. Every second, a thread wakes up and checks the counter value. If the counter is less than 110% of the license limit (using the calculation 1.1 x EPS License x 180) , then AccelOps will continue to collect events. If you exceed 110% of your licensed EPS, events are dropped for the remainder of the three minute window, and an email notification is triggered. At the end of the three minute window the counter resets and resumes receiving events.
Number of
Devices
Each entry in
CMDB > Devices
counts as one device. Exceptions to this are:
Workstations
Mobile Devices
VoIP Phones
These devices are not counted against the number of devices that are licensed for your deployment.
Page 841
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using Beaconing to Communicate with AccelOps Support
Your FortiSIEM virtual appliance includes a beaconing feature that periodically transmits information about the functioning of your FortiSIEM deployment to FortiSIEM support. This information includes the health of your FortiSIEM virtual appliances, performance data, and summary information about the configuration of your deployment. This information is used exclusively by FortiSIEM support for forensic analysis of your system, and is never shared with anyone.
The basic version of the beaconing feature is included with your FortiSIEM license, but you can opt out of the service at any time by going to
Adm in > License Management
and clearing the
Enable Beaconing Data Upload
option. You can also purchase the advanced version of the beaconing service, which includes added support services. Contact FortiSIEM Sales or Support for more information.
To find the level of beaconing support on your deployment, go to the
License Information
table under scroll down the
License Attribute
column to look for the row labeled
Beaconing Support.
Admin > License Management
, and
Basic Beaconing Support
Basic Beaconing periodically uploads health and usage information from FortiSIEM instance. This includes
Customer Name
Organization Name (for Service Provider installations)
Organization Collector Name
Number of devices discovered by category (Network, Server, Storage) and their types
Performance Monitoring Jobs and their status
Discovery Error Types, Event parsing errors, Operational errors
Incident names, severity and count
Event rate
Event Type
FortiSIEM system incidents and license issues
IP address and host name are not transmitted to the cloud.
For specific details, see these rules and reports which contain data periodic sent to the cloud.
Beaconing Reports and Rules
CMDB >
CMDB Reports
> Beaconing
Analytics >
Reports
Customer
> Beaconing Reports > Beaconing
Analytics >
Rules
> Beaconing
Summary Information Uploaded
1.
2.
3.
4.
5.
6.
CMDB Device Types
CMDB Network Device Count
CMDB Server Count
CMDB Storage Device Count
PING Monitored Device Count
Performance Monitor Status
5.
6.
7.
8.
1.
2.
3.
4.
Beaconing Customer: System Operational Errors
Beaconing Customer: Discovery Errors
Beaconing Customer: Event Parsing Errors
Beaconing Customer: Failed or falling behind monitoring jobs
Beaconing Customer: Incidents By Severity, Count
Beaconing Customer: Incidents Dropped
9.
Beaconing Customer: System Event Processing Statistics
Beaconing Customer: Top CMDB Device Types By Count
10.
11.
Beaconing Customer: Top Customers, Collectors By Unknown Event
Types
Beaconing Customer: Top Event Types By Count
Beaconing Customer: Top Internal Modules By Log Count
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
FortiSIEM Report Server license about to expire
FortiSIEM Report Server license expired
Device License Exceeded - Device Not Added To CMDB
Excessive Clock Skew Between Collector and Supervisor nodes
Excessive External Event Dropped By License
System Collector Down
System Collector Event Delayed
System License Warning: Max Number of Devices Exceeded License
System Report Server Down
System Worker Down
Page 842
FortiSIEM Installation Guide FortiSIEM Installation Guide
Advanced Beaconing Support
In advanced beaconing support,
system logs
and
audit logs
from your FortiSIEM deployment are uploaded to FortiSIEM support in addition to the information listed under basic beaconing support. This allows FortiSIEM support to closely monitor your FortiSIEM deployment for errors and problems remotely without the risk of system log rollover, and to provide an accelerated path to problem resolution.
Advanced beaconing support can be enabled via a license change. You will need to re-register your FortiSIEM deployment after FortiSIEM Sales has enabled advanced beaconing on the license server. During re-registration, FortiSIEM services will continue to run except for a restart of the
p hMonitor
service.
Page 843
FortiSIEM Installation Guide FortiSIEM Installation Guide
AccelOps Event Categories and Handling
This topic provides a brief description of various types of event categories in FortiSIEM
Event Categories
6
7
4
5
8
99
0
1
2
3
System Event
Category
Description
External events and not flow events (e.g. syslog, SNMP Trap, Event pulling)
Incidents (events that begin with PH_RULE)
FortiSIEM Audit Events (events that begin with PH_AUDIT)
FortiSIEM Internal system logs, free format
External flow events (Netflow, Sflow)
FortiSIEM Internal health events for summary dashboards
FortiSIEM Performance Monitoring events (events that begin with PH_DEV_MON)
AO Beaconing events
FortiSIEM Real Time Performance Probe Events
FortiSIEM Internal Rule Engine
Counted in
EPS License
Yes
No
No
No
Yes
No
Yes
No
No
No
phstatus -a outout Stored in DB?
EPS
EPS INTERNAL
EPS INTERNAL
EPS INTERNAL
EPS
EPS INTERNAL
EPS PERF
EPS INTERNAL
EPS INTERNAL
EPS INTERNAL
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
No
No
Event handling at various nodes
Running "phstatus -a" command at various nodes provides the events handled by that node.The output shows the statistics at 3min, 15min and
30 min averages.
EPS: 3 Min: 26.19 15 Min: 30.36 30 Min: 28.85
EPS INTERNAL: 3 Min: 0.35 15 Min: 0.38 30 Min: 0.35
EPS PERF: 3 Min: 0.00 15 Min: 0.00 30 Min: 0.00
If you run "phstatus -a" at a Collector, the output shows the events handled by that collector
If you run "phstatus -a" at a Worker, the output shows the events handled by that Worker - includes events sent by devices directly to that
Worker or events sent by Collectors
If you run "phstatus -a" at a Supervisor, you get the aggregated view across all nodes
Reported EPS by events
The following events report eps which includes EPS (EXTERNAL) and EPS PERF - to be measured against license
1.
2.
3.
4.
5.
PH_SYSTEM_EVENTS_PER_SEC: this reports eps at a organization level
PH_SYSTEM_PERF_EVENTS_PER_SEC: this reports performance monitoring related eps (counted against license)
PH_SYSTEM_INTERNAL_EVENTS_PER_SEC: this reports internal eps (not counted against license)
PH_SYSTEM_IP_EVENTS_PER_SEC: this reports eps reported by a device level
PH_SYSTEM_DEVAPP_EVENTS_PER_SEC: his reports eps reported by a device level but also has vendor, model info
Page 844
FortiSIEM Installation Guide FortiSIEM Installation Guide
Changing Dashboard Theme
The page under
Admin > General Setting
s contains fields that you can use to change the theme for widget dashboards
My Dashboard
Availability/Performance > Avail/Perf Widgets
Biz Svc Dashboard
Dashboards By Function
To do this
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Admin > General Settings > UI
.
Select the
Dashboard Theme
Refresh the browser.
you want to use, and then click
Change
.
Global Setting
Currently the dark theme setting is a global setting - so all users would have the same theme.
Page 845
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installing OS Security Patches
You may want to install OS level security patches to fix some recently found vulnerabilities.
First check whether the CVEs you are interested in have already been patched by the current FortiSIEM version. You can do this by running the following command.
rpm --changelog -q httpd
To upgrade OS packages on Super, Workers, or Collectors, run the following command as root
/opt/phoenix/phscripts/bin/phUpdateSystem.sh
We use a headless chrome browser for STM but chrome is not supported by Google on CentOS6 or 7 platforms. To upgrade that package to the latest version, we use a third party system.
Run the following commands as root on Super/Worker/Collector sed --in-place -e 's/\(.*phsetosaccelops\)/#\1/' /var/spool/cron/root yum reinstall -y centos-release wget http://chrome.richardlloyd.org.uk/install_chrome.sh
chmod u+x install_chrome.sh
./install_chrome.sh
sed --in-place -e 's/^#\(.*phsetosaccelops\)/\1/' /var/spool/cron/root
Page 846
FortiSIEM Installation Guide FortiSIEM Installation Guide
Working with the Configuration Management Database (CMDB)
The Configuration Management Database (CMDB) contains:
Discovered information about your IT infrastructure such as devices, networks, applications, and users
Information derived from your discovered infrastructure, including network topology and inter-device relationships such as the relationship of WLAN Access Points to Controller, and Virtual Machines to ESX Hosts.
Information about system objects such as rules, reports, business services, event types, networks, and ports/protocols
You can find and manage all this information under the
CMDB
tab.
CMDB Categorization of Devices and Applications
Overview of the CMDB User Interface
Setting Up an External Data Source for Anonymity Networks
Updating System Defined Blocked Domain Groups
Manually Creating Blocked Domains and Groups
Setting Up Custom External Data Sources for Blocked Domains
Updating System-Defined Blocked IP Groups
Manually Creating Blocked IP Addresses and Groups
Setting Up an External Data Source for Blocked IPs
Updating System-Defined Blocked URL Group
Manually Creating Blocked URLs
Setting Up an External Data Source for Blocked URLs
Creating CMDB Groups and Adding Objects to Them
Setting Up External Data Sources for Malware Hashes
Running, Saving, and Exporting a CMDB Report
Creating and Modifying CMDB Reports
Importing and Exporting CMDB Report Definitions
Page 847
FortiSIEM Installation Guide FortiSIEM Installation Guide
CMDB Categorization of Devices and Applications
Categorization of Devices and Applications
From Discovery - Network Devices
Categorizing a Cisco IOS Router/Switch
Categorizing Fortinet Firewalls
Categorization of Devices and Applications
FortiSIEM uses four methods to identify and categorize devices and applications in the CMDB.
From Discovery - Network Devices
When FortiSIEM discovers a device, it looks for keywords in the SNMP sysDescr
attribute and also probes for the SNMP e. Internal tables are then used to map a discovered device to one or more CMDB device groups based on these attributes.
sysObjectID
attribut
Keywords from the sysDescr
attribute are matched against the system table
Device Vendor and Model
Keywords from the sysObjectID
attribute are matched against the system table
Device Vendor and Model
Matches from the Device Vendor and Model table are then matched against the
ApprovedDeviceVendor.csv
table that is used to create the categories in the CMDB Devices/Applications.
From Discovery - Applications
FortiSIEM discovers applications by discovering the processes that are running on a server. The table
AppMapping.csv
maps process names to
Applications, Application Groups, and application folders in the CMDB.
From Logs
FortiSIEM includes a large number of log parsers, each of of which is associated with a Device Vendor/Model and Application Vendor/Model.
When the log is parsed by FortiSIEM, the Device/Application/Vendor information is matched against the table which then assigns the application or device to the appropriate CMDB Device/Application folder.
ApprovedDeviceVendor.csv
,
Special Cases
There are some special cases that cannot be categorized using discovery or log information. An example is Microsoft Active Directory. It is an application, but there is no explicit process for i.t as it is part of the kernel or big system service. In this case, specific logs are used: Windows
Security logs 672, 673 to detect Microsoft Domain Controller 2000, 2003, and Windows Security logs 4768, 4769 to detect Microsoft Windows
Domain Controller 2008, 2012.
Examples
Categorizing a Cisco IOS Router/Switch
This is an example of categorizing a device using discovery. In this case, the detect a Cisco IOS device,
Cisco IOS
substring in the SNMP sysDescr
attribute is used to
Page 848
FortiSIEM Installation Guide FortiSIEM Installation Guide
[desktop]$ snmpwalk -v 2c -c public 192.168.20.1 sysDescr
SNMPv2-MIB::sysDescr.0 = STRING: Cisco IOS Software, s72033_rp Software
(s72033_rp-ADVIPSERVICESK9_WAN-M), Version 12.2(33)SXI1, RELEASE
SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Sat 28-Mar-09 10:29 by pr
Then this entry in
ApprovedDeviceVendor.csv
maps the Device Vendor/Model
Cisco IOS
to the
SYS_DEVICE_ROUTER_SWITCH
is the internal ID of the category.
Router/Switch
category in the CMDB.
PH_
#id,Vendor,ModelOS,Version,Type,CMDB Folder Id,,Biz Service,Access
Protocol,Parsed,Priority
301,Cisco,IOS,ANY,Appliance,PH_SYS_DEVICE_ROUTER_SWITCH,,,"TELNET,SSH",1
,10
Categorizing Fortinet Firewalls
This is also an example of categorizing a device by discovery. In this case, the
SNMPv2-SMI::enterprises.12356
substring in the SNMP sy sObjectId
attribute is used to detect a Fortinet Firewall device.
[desktop]$ snmpwalk -v 2c -c public 172.16.255.82 sysObjectID
SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.12356.101.1.502
Then this entry in the
ApprovedDeviceVendor.csv
table maps the Device Vendor/Model
Fortinet FortiOS
to the
IOS
categories in the CMDB, since Fortinet is a UTM device.
IDs of the categories.
PH_SYS_DEVICE_FIREWALL
and
Firewall
PH_SYS_DEVICE_NETWORK_IPS
and
are
Network
the internal
#id,Vendor,ModelOS,Version,Type,CMDB Folder Id,,Biz Service,Access
Protocol,Parsed,Priority
21,Fortinet,FortiOS,ANY,Appliance,"PH_SYS_DEVICE_FIREWALL,PH_SYS_DEVICE_
NETWORK_IPS,PH_SYS_DEVICE_SEC_GW",,PH_SYS_BizSrvc_FW,"TELNET,SSH",1,10
Categorizing Microsoft IIS
This is an example of categorizing an application based on a running process. In this case, SNMP discovers a process svchost.exe
with the path
-k iissvcs
.
[desktop]$ snmpwalk -v 2c -c public 192.168.0.10 | grep 1148
HOST-RESOURCES-MIB::hrSWRunIndex.1148 = INTEGER: 1148
HOST-RESOURCES-MIB::hrSWRunName.1148 = STRING: "svchost.exe"
HOST-RESOURCES-MIB::hrSWRunParameters.1148 = STRING: "-k iissvcs"
Page 849
FortiSIEM Installation Guide FortiSIEM Installation Guide
This entry in the
AppMapping.csv
table is then used to map the process name
IIS application.
svchost.exe
with the path name
-k iissvcs
to a Microsoft
#Application group name,package signature,process name,process parameter,process Description,Priority,Ports,Group
Microsoft IIS,,svchost.exe,"-k iissvcs",Microsoft
IIS,10,"http,https",PH_SYS_APP_WEB_SERVER,
Categorizing Cisco ASA
This is an example of categorizing a device based on logs. The Cisco ASA parser has has a Device Vendor/Model associated with it, and when a log from the Cisco ASA device is parsed by FortiSIEM, this entry in to the
Firewall
and
VPN Gateway
categories in the CMDB.
PH_SYS_DEVICE_FIREWALL
and
Cisco ASA
PH_SYS_DEVICE_VPN_GATEWAY
are the internal
IDs of these categories.
ApprovedDeviceVendor.csv
maps the Device Vendor/Model
#id,Vendor,ModelOS,Version,Type,CMDB Folder Id,,Biz Service,Access
Protocol,Parsed,Priority
11,Cisco,ASA,ANY,Appliance,"PH_SYS_DEVICE_FIREWALL,PH_SYS_DEVICE_VPN_GAT
EWAY",,"PH_SYS_BizSrvc_FW,PH_SYS_BizSrvc_VPN","TELNET,SSH",1,10
Categorizing Microsoft IIS
This is an example of categorizing an application based on logs. The Microsoft IIS (via Snare) parser has a Device Vendor/Model associated with it, and when a log from Microsoft IIS is processed by FortiSIEM, this entry in crosoft
to the
Windows Server
and
Web Server
categories in the CMDB.
ApprovedDeviceVendor.csv
maps the Device Vendor/Model
PH_SYS_DEVICE_WINDOWS_SERVER
and
PH_SYS_APP_WEB_SER
VER
are the internal IDs of these categories.
Mi
the following entry in
#id,Vendor,ModelOS,Version,Type,CMDB Folder Id,,Biz Service,Access
Protocol,Parsed,Priority
901,Microsoft,IIS,ANY,Application,"PH_SYS_DEVICE_WINDOWS_SERVER,PH_SYS_A
PP_WEB_SERVER",Microsoft IIS,,None,1,10
Page 850
FortiSIEM Installation Guide FortiSIEM Installation Guide
Overview of the CMDB User Interface
CMDB
view provides more in-depth detail about devices, applications, users, and other IT infrastructure components as they are listed in the
CMDB, as well as the ability to manage these objects.
Inventory Management and Edit Details Controls
User Interface Controls for Device View
Tab Overview
This screenshot shows the
Device
view of the
CMDB
tab with type of object you select in the hierarchy, the CMDB will load a
Devices
selected in the
Summary
Device View
of the IT infrastructure hierarchy. For any
view of the objects in the top pane, and
Details
for any individual object you select from the summary in the bottom pane. While the available details will change depending on the type of object you select, all objects in the CMDB view will have
Inventory Management
controls in the summary pane, and an
Edit Details
control in the Details pane.
Inventory Management and Edit Details Controls
UI
Control
New
Description
Add a new object to the CMDB
Manually Adding Devices to the CMDB
In most cases you will want to add devices to the CMDB through
the device discovery process , but there are some
situations in which you may want to add them manually, as described in
Adding Devices to the CMDB Outside of
and
Adding a Synthetic Monitoring Test to a Business Service .
Delete
Delete a selected object from the CMDB
Page 851
FortiSIEM Installation Guide FortiSIEM Installation Guide
Edit
Edit details about the selected object. You can also use the
Edit Details
button in the
Details
also set device-specific properties to use in
defining per-device thresholds .
pane for the same purpose. You can
User Interface Controls for Device View
The view of devices in the CMDB provides you with a number of ways to access information about a device. Some of the device user interface controls in the CMDB view you can also find in the
Analysis
device.
view of devices, such as the menu and the
Quick Info
view of a
UI Control
Views
IP
Management
More
Approve
Analysis
Description
Inventory
A summary of all devices of that type in the CMDB
Topo
Shows all devices of the selected type in a topology view
Performance
Shows a Performance Summary dashboard
for all devices of that type
Hover your mouse cursor over the IP address associated with a device to open the IP Management menu
Quick Info
Loads the
Quick Info
for the device, which you can also see by selecting
Quick Info
in the
Analysis
menu
Topology
Shows the device's location in the network topology, which you can also see by clicking the
Topology
button in the device
Details
pane
Show Real-Time events on this IP
Loads a
Real Time Search with the selected IP address in the search criteria
Show Events on this IP for the Past 5 Minutes
Loads and Historial search with the selected IP address in the search criteria and the
Add to WatchList
Add that IP address to a
Time
filter set to
Last 5 Mins
Location
Displays any
location information associated with the device
Change Org
For multi-tenant deployments, change the organization associated with the device
Impacted Org
Shows organizations that device is associated with
Maintenance
Displays the maintenance schedule
for the device
Export General Info
Exports a summary view of selected devices, or a detailed view of information for a specific device, in PDF or CSV format
Approve any
over the component's Device IP menu until the blue Quick Info icon appears, and then clicking the icon.
Page 852
FortiSIEM Installation Guide FortiSIEM Installation Guide
Quick Info
Device Info
Topology
Edit Details
The the
Quick Info
Device IP
view of a device, which you can also access through the
column, displays
General and Health information
Analysis
menu or hovering your mouse cursor over
for the device, and when appropriate,
Identity and Location
information. It also contains links to additional information about the device:
Incidents
An exportable summary of incidents associated with the device
Health
Availability,
Performance
, and health information for the device You can also access this information by clicking the
Device Health
user interface control, or by selecting
Services
in the
Analysis
menu.
Security .
Device Health
in the
Analysis
menu.
BizService
Any business services impacted by the device. You can also access this information by selecting
Impacted Business
Applications
Displays a report on the top 10 applications associated with the device by
Average CPU Utilization
over the past hour
Vulnerability and IP Status (Not used in the
Dashboard
view)
Displays the vulnerability status reports that are also available by selecting
Vulnerability and IPS Status
in the
Analysis
menu
Hardware Health (Used only for the
CMDB/Storage
view)
Displays health information for the hardware being used for storage
Interfaces
Displays a report on the top 10 interfaces associated with the device by average throughput
Topology
Shows the device's location in the network topology You can also access this information by selecting
Topology
in the
A nalysis
menu.
The Quick Info view also contains two links,
, which links to
Goto Config Item
, which links to the device entry in the CMDB, and
Analytics > Identity and Location Report
, where you can edit this information for the device.
Goto Identity
Each tab contains information about a specific aspect of the device, as well as an
Edit
button to change information:
Summary
General organizational and operational information about the device
Health
Availability, Performance, and Security health reports for the device. You can also access this information by selecting after selecting the device .
a device in the Summary dashboard, and then click
Health,
or by going to
Quick Info > Health
If any
Incidents are displayed, click the number to view the Incident Summary. Depending on the reported metric, you can zoom in for a closer look at graphs and reports by clicking the
Magnifying Glass
icon that appears when you hover your mouse cursor over them.
Monitor
Shows Event Receive Status and Performance Monitor Status - when data was last collected and status
Contact
Contact information for the device
Interfaces
Interfaces connected to the device
Software
Software running on the device. Categories include
Installed Patches
. In the
Installed Software
category you can use the software you've installed.
Hardware
,
Diff... button
,
to compare different versions of
, and
Information about the hardware associated with the device. Categories include , , ,
, , , , and
Storage Groups
.
Configuration
Configuration files associated with the device. You can compare configuration files by selecting two or more, and then clicking
Diff...
Relationships
Other devices that this device interacts with
Shows the selected device in the
view
Click to edit the , , , and
Properties
for the device
Data Collection Status
Real time data collection status is shown for each device
Performance Monitor Status
Normal - if every performance monitor job status for this device is Normal
Warning - if at least one performance monitor job status for this device is Warning and none is critical
Critical - if at least one performance monitor job status for this device is Critical
Page 853
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event Receive Status
Normal - if the event receive status of every protocol for this device is Normal
Warning - if the event receive status of at least one protocol for this device is Warning and none is critical
Critical - if the event receive status of at least one protocol for this device is Critical
Performance Monitor Job Status is computed as follows. Two
global
constants are defined in
Admin > Device Support > Custom Properties.
1.
2.
Performance Monitoring Time Gap Warning Threshold - multiples of polling interval (default 3)
Performance Monitoring Time Gap Critical Threshold - multiples of polling interval (default 5)
Event Receive Job Status is computed as follows. Two
global
constants are defined in
Admin > Device Support > Custom Properties.
1.
2.
Event Receive Time Gap Warning Threshold in minutes (default 10)
Event Receive Time Gap Critical Threshold in minutes (default 20)
These constants can also be specified at a per device level from > > thresholds in the edit box and click
Save.
> Write new values for these
Metric
Performance Monitor Job
Status
Performance Monitor Job
Status
Performance Monitor Job
Status
Event Receive Job Status
Event Receive Job Status
Event Receive Job Status
Status
Normal Performance Monitoring Time Gap
LESS
THAN Performance Monitoring Time Gap old
Warning Performance Monitoring Time Gap
GREATER
THAN Performance Monitoring Time Gap hreshold BUT
Warning
T
Critical
Condition
LESS THAN Performance Monitoring Time Gap
Critical
Threshold
Warning
Thresh
Performance Monitoring Gap
GREATER
THAN Performance Monitoring Time Gap d
Critical
Threshol
Normal Event Receive Time Gap
LESS
THAN Event Receive Time Gap Warning Threshold
Warning Event Receive Time Gap
GREATER
THAN Event Receive Time Gap
Warning
Threshold BUT
LESS THAN Event Receive Time Gap Critical Threshold
Critical Event Receive Time Gap
GREATER
THAN Event Receive Time Gap
Critical
Threshold
The following table shows how the various job types are classified into Performance Monitor or Event Received types
Job Type
Jobs defined in Admin > Setup wizard > Monitor Change/performance
Jobs defined in Admin > Setup wizard > Pull Events (e.g.
Protocols via which data is pushed to us - syslog, SNMP Trap, Netflow, SFlow, Windows Agents etc
Classification in CMDB > Device >
Monitor
Performance Monitor
Event Receive
Event Receive
The following rules trigger when certain data collection exceptions happen.
Rule
Missing specific performance metric from a device
No performance metrics from a device
FortiSIEM Performance
Monitoring Relay Not Working -
All Devices delayed
No logs from a device
When does it trigger?
Triggers when
Triggers when
Triggers when
Performance Monitor
is Critical for one job for a monitored device
Performance Monitor
is Critical for a monitored device
Performance Monitor
monitored by a Worker/Collector (that is acting as a
Performance Monitoring Relay)
Triggers when ce
ALL jobs for all
Event Receive Job Status
is Critical for one devi
When does it clear?
Clears when
Performance Monitor
is
Normal for that job from that device
Clears when
Performance Monitor
is
Clears when
Performance Monitor
is
Normal for all devices from that
Worker/Collector
Clears when
Event Receive Job
Status
is Normal for that device
Page 854
FortiSIEM Installation Guide FortiSIEM Installation Guide
FortiSIEM Log Relay Not
Working - All Devices delayed
Triggers when
Event Receive Job Status
is Critical for devic es to a specific Worker/collector (that is acting as a Log Relay)
Clears when
Event Receive Job
Status
is Normal for all devices from that Worker/Collector
Page 855
FortiSIEM Installation Guide FortiSIEM Installation Guide
Managing CMDB Objects
CMDB objects include discovered devices and their network relationships, as well as system objects like rules and events. You can find the full list of these objects in the
Device View
of the
CMDB
tab, and you can add objects to the database or edit ones that are already there.
Setting Up an External Data Source for Anonymity Networks
Updating System Defined Blocked Domain Groups
Manually Creating Blocked Domains and Groups
Setting Up Custom External Data Sources for Blocked Domains
Updating System-Defined Blocked IP Groups
Manually Creating Blocked IP Addresses and Groups
Setting Up an External Data Source for Blocked IPs
Updating System-Defined Blocked URL Group
Manually Creating Blocked URLs
Setting Up an External Data Source for Blocked URLs
Creating CMDB Groups and Adding Objects to Them
Setting Up External Data Sources for Malware Hashes
Page 856
FortiSIEM Installation Guide FortiSIEM Installation Guide
Anonymity Networks and Groups
An anonymity network is used to hide one's network identity, and is typically used by malware to hide its originating IP address. Enterprise network traffic should not be originating from or destined to Anonymity network.
When FortiSIEM discovers traffic destined to or originating from anonymity networks, it triggers these rules:
Inbound Traffic from Tor Network
Outbound Traffic to Tor Network
Inbound Traffic from Open Proxies
Outbound Traffic to Open Proxies
Adding an Anonymity Network
1.
2.
3.
Log into your Supervisor node.
Go to
CMDB > Anonymity Networks
.
Create a group to add the new network to if you are not adding it to an existing group.
System-Defined Anonymity Network Groups
FortiSIEM provides two default groups for Anonymity Networks:
Open Proxies: A set of open proxies in the internet. This is a static group.
Tor Nodes: This group is dynamically updated from https://check.torproject.org/exit-addresses . You can schedule regular updates for this group by clicking on the group name, then click Update and provide update scheduling information.
4.
5.
6.
7.
8.
9.
Click
Anonymity Network
.
Select the group where you want to add the anonymity network.
Click
New
.
Click the
Click
Calendar
Save
.
, and
Country
information about the anonymity network.
icon to enter the date you created or updated this entry.
Adding Anonymity Networks to a Group with a CSV File
Instead of manually adding anonymity networks to a group individually, you can upload a CSV file with multiple entries to the group by selecting the group and then clicking
Upload
. You will need to format the file with these fields:
IP Address,Port,Country,Last Update Time and Date
For example:
99.99.99.99,,USA,10:00:00 10/02/2014
Adding Anonymity Networks to Watch Lists
You can easily add an anonymity network IP address to your watch lists. Hover you mouse cursor over the anonymity network IP address until the icon for the
Options
menu appears, and then select
Add to Watchlist.
Page 857
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up an External Data Source for Anonymity Networks
This topic describes how to import anonymity networks information into FortiSIEM from external threat feed websites. Anonymity networks are used by malware to hide their own identity. Two prominent examples of anonymity networks are Open Proxies and TOR Nodes.
Websites with built in support
Custom websites - CSV data - one-time manual import
Custom websites - CSV data - programmatic import
New Websites - non-CSV data - programmatic import
Prerequisites
Before proceeding gather the following information about a threat feed web site.
The website URL
Credentials required to access the website (optional)
If the website is not supported by FortiSIEM, you may need to understand the format of the data returned by the URL.
if the data is in the comma separated value format (the separator need not be a comma but could be any separator, then a simple integration is possible.
If the data is any other format, e.g. XML, then some code needs to be written for integration using the FortiSIEM provided framework
Procedure
Websites with built in support
The following websites are supported
Threat Stream Open Proxy ( https://api.threatstream.com)
Threat Stream TOR Node ( https://api.threatstream.com)
To import data from these websites, follow these steps
1.
2.
3.
4.
5.
6.
7.
In the
Click
CMDB > Anonymity Network
Select the folder.
Update
.
, find the website you need to import data from.
Select
Update via API
. The link should show in the edit box.
Enter a schedule by clicking on the "+" icon.
Enter the schedule parameters - when to start and how often to import. FortiSIEM recommends no more frequent than hourly.
Select the type of template you want to create.
Custom websites - CSV data - one-time manual import
This requires that the data to be imported is already in a file in comma separated value format. The required format is
IP, Port, Malware Type, Confidence, Severity, Asn, Org, Country,
Description, Data Found(MM/DD/YYYY), Last Seen(MM/DD/YYYY)
Although many fields are possible, only IP is required
1.
2.
3.
4.
5.
6.
7.
Select
CMDB>Anonymity Network
.
Enter
Group
and add
Description
Select the folder just created.
Select
Import from a file.
Click
Browse
. Click
OK
; enter the file name and click
Upload
The imported data will show on the right pane.
.
Create New Anonymity Network Group
to create the folder under
Anonymity Network s
.
dialog.
Custom websites - CSV data - programmatic import
This requires that the web site data is
Page 858
FortiSIEM Installation Guide FortiSIEM Installation Guide file in comma separated value format (separator can be any special character such as space, tab, hash, dollar etc.) one entry is in one line
Although many fields are possible, only the IP is required.
Follow these steps.
1.
2.
3.
4.
5.
6.
7.
Select
For
+
Anonymity Network
and add
Select the folder just created.
Select
Update via API
Website,
Click
s
.
Click on the " " button on the left navigation tree to bring up the
Enter
Group
In the
CMDB >
Data Mapping
a. b. c.
Enter
Description
. Click to create the folder under
Add
.
dialog:
Enter the
URL
of the website
OK
Create New Anonymity Network Group
dialog.
Anonymity Network s
.
User Name
and
Password
(optional)
For
Plugin class
, the default class
com.AccelOps.service.threatfeed.impl.ThreatFeedWithMappingPolicyService
is shown.
8. d. e. f. g.
Do not modify this for this case.
Enter the correct
Select CSV as the
Data Format
Enter the
Data Mapping
by choosing the mapped field and the corresponding position in the website data. For example if the IP is in third position, then choose 3 in the
Click
Save
Field separator
(by default it is a comma)
Select a import schedule by clicking on the
Position
column.
Schedule Summary
9. data from the website.
The imported data will show on the right pane after some time.
. Select when to start the import and how often to import to get new
New Websites - non-CSV data - programmatic import
This is the most general case where the website data format does not satisfy the previous conditions. In this case, user has to write a Java plugin class by modifying the default system provided one. After the class has been written and fully tested for correctness, follw these steps.
1.
2.
3.
4.
5.
6.
7.
Select
For
CMDB >
In the
Data Mapping
e. f.
Description
Select the folder just created.
Select
Update via API
Website,
Click a. b. c. d.
+
Anonymity Network
and add
Add
.
dialog:
Enter the
URL
of the website
Enter
User Name
and
Password
(optional)
For
Plugin class
, the custom Java class for this case.
Enter the correct
Field separator
(by default it is a comma)
Enter the
Data Mapping s
.
Click on the " " button on the left navigation tree to bring up the
Enter
Group
. Click to create the folder under
Select CSV as the
Data Format
OK
Create New Anonymity Network Group
dialog.
Anonymity Network
Position
column.
s
.
by choosing the mapped field and the corresponding position in the website data. For example if the IP
8. g. address is in third position, then choose 3 in the
Click
Save
Select a import schedule by clicking on the
Schedule Summary
9. data from the website.
The imported data will show on the right pane after some time.
. Select when to start the import and how often to import to get new
Page 859
FortiSIEM Installation Guide FortiSIEM Installation Guide
Applications
Applications in the CMDB are grouped at the highest level by categories.
Infrastructure
and
User
apps, with further sub-categorization in each of those two
Adding an Application
1.
2.
3.
4.
5.
6.
Log in to your Supervisor node.
Go to
CMDB > Applications
.
Create a new application group or select an existing one.
Click
New
Enter an
.
Application Name
Click
Save
.
and
Process
.
7.
Enter any other information for the application.
Page 860
FortiSIEM Installation Guide FortiSIEM Installation Guide
Blocked Domains
The CMDB
Blocked Domains
page lists domains that are known to generate spam, host botnets, create DDoS attacks, and generally contain malware. The three default groups included in your FortiSIEM deployment,
MalwareDomainList, Zeus Domains,
malware domains that are derived from the websites ,
and
SANS Domains
, contain
, and isc.sans.edu
. Because malware domains are constantly shifting, FortiSIEM recommends maintaining a dynamically generated list of IP addresses provided by services such as these that is updated on a regular schedule, but you can also add or remove blocked IP addresses from these system-defined groups, and create your own groups based on manual entry of IP addresses or file upload.
Page 861
FortiSIEM Installation Guide FortiSIEM Installation Guide
Updating System Defined Blocked Domain Groups
System defined groups are
MalwareDomainList, Zeus Domains,
and
SANS Domains
, which are updated by their corresponding services. You can set these to update automatically on a schedule, or add or remove individual IP addresses from them.
5.
6.
7.
8.
1.
2.
3.
4.
Log in to your Supervisor node.
Click
CMDB
.
Select a system-defined group.
Click
Update
.
Select
Update Automatically
to open the update scheduler and verify the URI of the update service.
Set the schedule for how often you want the list to update from the service.
Click
Save
.
If you want to remove a domain or set of domains from the group, clear the
Enable
selection next to the domain name, and then click
Co
9.
ntinue
to confirm.
The domain will still be listed in the group, but it will no longer be blocked. Select address.
Enable
If you want to add a blocked domain to the group, make sure the group is selected, click
to resume blocking it.
New
, and enter information about the blocked IP
Page 862
FortiSIEM Installation Guide FortiSIEM Installation Guide
Manually Creating Blocked Domains and Groups
1.
2.
3.
Create a group under Blocked Domains as described in
Creating CMDB Groups and Adding Objects to Them .
Select the group you created and click
New
.
Enter information for the Blocked Domain you want to add, and then click
Save
.
Adding Blocked Domains to a Group with a CSV File
Instead of manually adding a blocked domain to a user-defined or system group individually, you can upload a CSV file with multiple entries to the group by selecting the group, clicking
Update
, and then selecting these fields:
Import Manually
. You will need to format the file with
#domain,malware name,date(MM/DD/YYYY),IP,Reverse IP lookup,ASN
For example: t3tr.co.cc
,Blackhole exploit kit,1/23/2011,173.201.33.90,ip-173-201-33-90.
ip.secureserver.net
.,26496 sq2s.co.cc
,Blackhole exploit kit,1/23/2011,173.201.33.90,ip-173-201-33-90.
ip.secureserver.net
.,26496
Page 863
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up Custom External Data Sources for Blocked Domains
This topic describes how to import malware domain information into FortiSIEM from external threat feed websites.
Websites with built in support
Custom websites - CSV data - one-time manual import
Custom websites - CSV data - programmatic import
Custom Websites - non-CSV data - programmatic import
Prerequisites
Before proceeding gather the following information about a threat feed web site.
The website URL
Credentials required to access the website (optional)
If the website is not supported by FortiSIEM, you may need to understand the format of the data returned by the URL.
if the data is in the comma separated value format (the separator need not be a comma but could be any separator, then a simple integration is possible.
If the data is any other format, e.g. XML, then some code needs to be written for integration using the FortiSIEM provided framework
Procedure
Websites with built in support
The following websites are supported
Malware domain list ( http://www.malwaredomainlist.com)
Zeus domains ( https://zeustracker.abuse.ch)
SANS Domains ( https://isc.sans.edu/feeds/ )
Threat Stream Domains ( https://api.threatstream.com)
For Threat Stream the following malware domain types are included
Command and Control Domain
Compromised Domain
Malware Domain
Dynamic DNS Domain
APT Domain
To import data from these websites, follow these steps
1.
2.
3.
4.
5.
6.
7.
In the
Click
CMDB > Blocked Domains
Select the folder.
Update
.
, find the website you need to import data from.
Select
Update via API
. The link should show in the edit box.
Enter a schedule by clicking on the "+" icon.
Enter the schedule parameters - when to start and how often to import. FortiSIEM recommends no more frequent than hourly.
Select the type of template you want to create.
Custom websites - CSV data - one-time manual import
This requires that the data to be imported is already in a file in comma separated value format. The required format is
Domain Name, IP, Reverse Lookup, Malware Type, Confidence, Severity,
ASN, Org, Country,Description, Date Found(MM/DD/YYYY),Last
Seen(MM/DD/YYYY)
Although many fields are possible, only the Domain Name is required
1.
2.
Select
CMDB>Blocked Domains
.
3.
Create New Malware Domain Group
dialog.
Page 864
FortiSIEM Installation Guide FortiSIEM Installation Guide
3.
4.
5.
6.
7.
Enter
Group
and add
Select the folder just created.
Select
Import from a file.
Click
Browse
Description
. Click
OK
to create the folder under
; enter the file name and click
Upload
.
The imported data will show on the right pane.
Blocked Domains
.
Custom websites - CSV data - programmatic import
This requires that the web site data is file in comma separated value format (separator can be any special character such as space, tab, hash, dollar etc.) one entry is in one line
Although many fields are possible, only the Domain Name is required.
Follow these steps.
1.
2.
3.
4.
5.
6.
7.
Select
CMDB > Blocked Domains
.
Enter
Group
and add
For
Website,
In the
Data Mapping
a. b. c.
Enter
Click
Description
Select the folder just created.
Select
Update via API
Add
.
dialog:
. Click
Enter the
URL
of the website
OK
Create New Malware Domain Group
dialog.
to create the folder under
Blocked Domains
.
8. d. e. f. g.
User Name
and
Password
(optional)
For
Plugin class
, the default class
com.FortiSIEM.service.threatfeed.impl.ThreatFeedWithMappingPolicyService
is shown.
Do not modify this for this case.
Enter the correct
Click
Save
Field separator
(by default it is a comma)
Select CSV as the
Data Format
Enter the
Data Mapping
by choosing the mapped field and the corresponding position in the website data. For example if the domain name is in third position, then choose 3 in the
+
9. data from the website.
The imported data will show on the right pane after some time.
Position
Schedule Summary
column.
. Select when to start the import and how often to import to get new
Custom Websites - non-CSV data - programmatic import
This is the most general case where the website data format does not satisfy the previous conditions. In this case, user has to write a Java plugin class by modifying the default system provided one. Follow instructions in the FortiSIEM ServiceAPI available at FortiSIEM support portal
FortiSIEM ServiceAPI section. After the class has been written and fully tested for correctness, follow these steps.
under
1.
2.
3.
4.
5.
6.
7.
Select
CMDB > Blocked Domains
.
Enter
Group
and add
For
Website,
In the
Data Mapping
a. b. c. d. e. f.
Click
Add
.
dialog:
Enter the
URL
of the website
Enter
User Name
and
Password
(optional)
For
Plugin class
, the custom Java class for this case.
Enter the correct
Field separator
(by default it is a comma)
Enter the
Description
Select the folder just created.
Select
Update via API
Data Mapping
. Click
Select CSV as the
Data Format
OK
Create New Malware Domain Group
dialog.
to create the folder under
Position
Blocked Domains
.
by choosing the mapped field and the corresponding position in the website data. For example if the
8. g. domain name is in third position, then choose 3 in the
Click
Save
Select a import schedule by clicking on the
Schedule Summary
9. data from the website.
The imported data will show on the right pane after some time.
column.
. Select when to start the import and how often to import to get new
Page 865
FortiSIEM Installation Guide FortiSIEM Installation Guide
Blocked IP Addresses
The CMDB
Blocked IP Addresses
page lists IP addresses that are known to generate spam, host botnets, create DDoS attacks, and generally contain malware. The two default groups included in your FortiSIEM deployment, derived from the websites rules.emergingthreats.net
and
Emerging Threats
and
Zeus
, contain IP addresses that are zeustracker.abuse.ch
. Because malware IP addresses are constantly shifting, FortiSIEM recommends maintaining a dynamically generated list of IP addresses provided by services such as these that is updated on a regular schedule, but you can also add or remove blocked IP addresses from these system-defined groups, and create your own groups based on manual entry of
IP addresses or file upload.
Page 866
FortiSIEM Installation Guide FortiSIEM Installation Guide
Updating System-Defined Blocked IP Groups
System defined groups are
Emerging Threats
and
Zeus
, which are updated by their corresponding services. You can set these to update automatically on a schedule, or add or remove individual IP addresses from them.
5.
6.
7.
8.
1.
2.
3.
4.
Log in to your Supervisor node.
Click
CMDB
.
Select a system-defined group.
Click
Update
.
Select
Set the schedule for how often you want the list to update from the service.
Click
Update Automatically
Save
.
to open the update scheduler and verify the URI of the update service.
If you want to remove an IP address or set of IP addresses from the group, clear the click
Continue
to confirm.
9.
The IP address will still be listed in the group, but it will no longer be blocked. Select blocked IP address.
Enable
Enable
If you want to add a blocked IP address to the group, make sure the group is selected, click
selection next to the IP address, and then
to resume blocking it.
New
, and enter information about the
Page 867
FortiSIEM Installation Guide FortiSIEM Installation Guide
Manually Creating Blocked IP Addresses and Groups
1.
2.
3.
Create a group under Blocked IPs as described in
Creating CMDB Groups and Adding Objects to Them .
Select the group you created and click
New
.
Enter information for the Blocked IP address you want to add, and then click
Save
.
Adding Blocked IP Addresses to a Group with a CSV File
Instead of manually adding blocked IP address to a user-defined or system group individually, you can upload a CSV file with multiple entries to the group by selecting the group, clicking
Update
, and then selecting these fields:
Import Manually
. You will need to format the file with
Name,Low IP,High IP
For example:
ENet-103.11.74.6-103.11.74.6,103.11.74.6,103.11.74.6
Page 868
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up an External Data Source for Blocked IPs
This topic describes how to import Malware IP information into FortiSIEM from external threat feed websites.
Websites with built in support
Custom websites - CSV data - one-time manual import
Custom websites - CSV data - programmatic import
Custom Websites - non-CSV data - programmatic import
Prerequisites
Before proceeding gather the following information about a threat feed web site.
The website URL
Credentials required to access the website (optional)
If the website is not supported by FortiSIEM, you may need to understand the format of the data returned by the URL.
if the data is in the comma separated value format (the separator need not be a comma but could be any separator, then a simple integration is possible.
If the data is any other format, e.g. XML, then some code needs to be written for integration using the FortiSIEM provided framework
Procedure
Websites with built in support
The following websites are supported
Emerging threat ( http://rules.emergingthreats.net)
Zeus ( https://zeustracker.abuse.ch)
Threat Stream Blocked IP ( https://api.threatstream.com)
For Threat Stream Blocked IP, the following Malware types are imported
Bot IP
Actor IP
APT Email
APT IP
Bruteforce IP
Compromised IP
Malware IP
DDoS IP
Phishing email IP
Phish URL IP
Scan IP
Spam IP
To import data from these websites, follow these steps
1.
2.
3.
4.
5.
6.
7.
In the
CMDB > Blocked IPs
, find the website you need to import data from.
Select the folder.
Click
Update
.
Select
Update via API
. The link should show in the edit box.
Enter a schedule by clicking on the "+" icon.
Enter the schedule parameters - when to start and how often to import. FortiSIEM recommends no more frequent than hourly.
Select the type of template you want to create.
Custom websites - CSV data - one-time manual import
This requires that the data to be imported is already in a file in comma separated value format. The required format is
Name, Low IP, High IP, Malware Type, Confidence, Severity, ASN, Org,
Country ,Description,Data Found(MM/DD/YYYY),Last Seen(MM/DD/YYYY)
Although many fields are possible, only Low IP is required. If High IP is not provided, then it is set to Low IP.
Page 869
FortiSIEM Installation Guide FortiSIEM Installation Guide
1.
2.
3.
4.
5.
6.
7.
Select
CMDB > Blocked IP
s.
Enter
Group
and add
Select the folder just created.
Select
Import from a file.
Click
Browse
Description
. Click
OK
; enter the file name and click
Upload
The imported data will show on the right pane.
.
Create New Malware IP Group
dialog.
to create the folder under
Blocked IPs
.
Custom websites - CSV data - programmatic import
This requires that the web site data is file in comma separated value format (separator can be any special character such as space, tab, hash, dollar etc.) one entry is in one line
Although many fields are possible, only Low IP is required. If High IP is not provided, then it is set to Low IP.
Follow these steps.
1.
2.
3.
4.
5.
6.
7.
Select
CMDB > Blocked IPs
.
Enter
Group
and add
For
Website,
In the
Data Mapping
a. b. c.
Enter
Click
Description
Select the folder just created.
Select
Update via API
Add
.
dialog:
. Click
Enter the
URL
of the website
OK
Create New Malware IP Group
dialog.
to create the folder under
Blocked IPs
.
8. d. e. f. g.
User Name
and
Password
(optional)
For
Plugin class
, the default class
com.AccelOps.service.threatfeed.impl.ThreatFeedWithMappingPolicyService
is shown.
Do not modify this for this case.
Enter the correct
Click
Save
Field separator
(by default it is a comma)
Select CSV as the
Data Format
Enter the
Data Mapping
by choosing the mapped field and the corresponding position in the website data. For example if the IP is in third position, then choose 3 in the
+
Position
column.
Schedule Summary
9. data from the website.
The imported data will show on the right pane after some time.
. Select when to start the import and how often to import to get new
Custom Websites - non-CSV data - programmatic import
This is the most general case where the website data format does not satisfy the previous conditions. In this case, user has to write a Java plugin class by modifying the default system provided one. Follow instructions in the FortiSIEM ServiceAPI available at
FortiSIEM ServiceAPI section.
FortiSIEM support portal under
After the class has been written and fully tested for correctness, follow these steps.
1.
2.
3.
4.
5.
6.
7.
Select
CMDB>Blocked IPs
.
Enter
Group
and add
For
Website,
In the
Data Mapping
a. b. c. d. e. f.
Click
Add
.
dialog:
Enter the
URL
of the website
Enter
User Name
and
Password
(optional)
For
Plugin class
, the custom Java class for this case.
Enter the correct
Field separator
(by default it is a comma)
Enter the
Description
Select the folder just created.
Select
Update via API
Data Mapping
. Click
Select CSV as the
Data Format
OK
Create New Malware IP Group
dialog.
to create the folder under
Position
column.
Blocked IPs
.
by choosing the mapped field and the corresponding position in the website data. For example if the
8. g.
Low IP is in first position, then choose 1 in the
Click
Save
Select a import schedule by clicking on the
Schedule Summary
9. data from the website.
The imported data will show on the right pane after some time.
. Select when to start the import and how often to import to get new
Page 870
FortiSIEM Installation Guide
Blocked URLs
The CMDB
Blocked URLs
page lists URLs that are known to host malware.
The
Threat Stream Blocked URL
group is included in your FortiSIEM deployment.
FortiSIEM Installation Guide
Page 871
FortiSIEM Installation Guide FortiSIEM Installation Guide
Updating System-Defined Blocked URL Group
System defined groups are
Threat Stream Blocked URL
, which are updated by its own service. You can set these to update automatically on a schedule.
1.
2.
3.
4.
5.
Log in to your Supervisor node.
Click
CMDB
.
Select
Threat Stream Blocked URL
.
Click
Update
Set Schedule a. b. c. d.
.
Select
Update Automatically
to open the update scheduler and verify the URI of the update service.
Set the
schedule
for how often you want the list to update from the service.
Click
OK
.
6.
Click
Save
Set user name and password a. b. c. d. e.
Select the link (
Click
Enter
Set
Edit
Click
Save
https://api.threatstream.com/api/v1/intelligence/)
User Name
and
Password
Data Format Custom
and
Incremental
Page 872
FortiSIEM Installation Guide FortiSIEM Installation Guide
Manually Creating Blocked URLs
1.
2.
3.
Create a group under Blocked URLs as described in
Select the group you created and click
Creating CMDB Groups and Adding Objects to Them
.
New
.
Enter information for the Blocked URL you want to add, and then click
Save
.
Adding Blocked URLs to a Group with a CSV File
Instead of manually adding a blocked domain to a user-defined or system group individually, you can upload a CSV file with multiple entries to the group by selecting the group, clicking
Update
, and then selecting these fields:
Import from a file
. You will need to format the file with
#URL,Malware Type,Confidence,Description,Last Seen(MM/DD/YYYY)
Page 873
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up an External Data Source for Blocked URLs
This topic describes how to import Malware URL information into FortiSIEM from external threat feed websites.
Websites with built in support
Custom websites - CSV data - one-time manual import
Custom websites - CSV data - GUI import
Custom Websites - non-CSV data - programmatic import
Prerequisites
Before proceeding gather the following information about a threat feed web site.
The website URL
Credentials required to access the website (optional)
If the website is not supported by FortiSIEM, you may need to understand the format of the data returned by the URL.
If the data is in comma separated value (CSV) format, then a simple integration is possible. Note that the separator need not be a comma but could be any separator.
If the data is any other format, e.g. XML, then some code needs to be written for integration using the FortiSIEM provided framework
Procedure
Websites with built in support
The following websites are supported
Threat Stream Blocked IP ( https://api.threatstream.com)
To import data from these websites, follow these steps
1.
2.
3.
4.
5.
6.
In the
CMDB > Blocked IPs
, find the website you need to import data from.
Select the folder.
Click
Update
.
Select
Update via API
. The link should show in the edit box.
Enter a schedule by clicking on the "+" icon.
Enter the schedule parameters - when to start and how often to import. FortiSIEM recommends no more frequent than hourly.
Custom websites - CSV data - one-time manual import
This requires that the data to be imported is already in a file in comma separated value format. The required format is
URL, Malware Type, Confidence, Description,Last Seen(MM/DD/YYYY)
1.
2.
3.
4.
5.
6.
7.
Select
CMDB > Blocked URL
s.
Enter
Group
and add
Select the folder just created.
Select
Import from a file.
Click
Browse
Description
. Click
OK
; enter the file name and click
Upload
The imported data will show on the right pane.
.
Create New Blocked IP Group
dialog.
to create the folder under
Blocked IPs
.
Custom websites - CSV data - GUI import
This requires that the web site data has the following structure.
The file in comma separated value format (separator can be any special character such as space, tab, hash, dollar etc.)
One line has only one entry
Follow these steps.
1.
2.
3.
4.
Select
CMDB > Malware URLs
.
Enter
Group
and add
Description
. Click
OK
Create New Malware URL Group
dialog.
to create the folder under
Blocked URLs
.
Page 874
FortiSIEM Installation Guide FortiSIEM Installation Guide
4.
5.
6.
7.
Select the folder just created.
Select
Update via API
For
Website,
a. b.
Click
Add
In the
Data Mapping
.
dialog:
Enter the
URL
of the website c.
Enter
User Name
and
Password
(optional)
For
Plugin class
, the default class
com.AccelOps.service.threatfeed.impl.ThreatFeedWithMappingPolicyService
is shown.
d. e. f.
Do not modify this for this case.
Enter the correct
Set
Data Format
Enter the
Field separator
(by default it is a comma)
Position
column.
8. g. Click
Save
to CSV
Data Mapping
by choosing the mapped field and the corresponding position in the website data. For example if the IP is in third position, then choose 3 in the
+ Schedule Summary
9. data from the website.
The imported data will show on the right pane after some time.
. Select when to start the import and how often to import to get new
Custom Websites - non-CSV data - programmatic import
This is the most general case where the website data format is not CSV. In this case, user has to write a Java plugin class by modifying the default system provided one. Follow instructions in the FortiSIEM ServiceAPI available at section.
FortiSIEM support portal under FortiSIEM ServiceAPI
After the class has been written and fully tested for correctness, follow these steps.
1.
2.
3.
4.
5.
6.
7.
8.
Select
CMDB>Blocked URLs
.
Enter
Group
and add
Click
Save
Description
Select the folder just created.
Select
Update via API
For
Website,
Click
Add
In the
Data Mapping
a. b. c. d. e.
.
dialog:
Enter
User Name
and
. Click
Enter the
URL
of the website
For
Plugin class
Password
, the custom Java class for this case
Select Custom as the
+
OK
Data Format
.
9. data from the website.
The imported data will show on the right pane after some time.
Create New Blocked URL Group
dialog.
to create the folder under
(optional)
Schedule Summary
Blocked URLs
.
. Select when to start the import and how often to import to get new
Page 875
FortiSIEM Installation Guide
Blocked Processes
FortiSIEM Installation Guide
Page 876
FortiSIEM Installation Guide FortiSIEM Installation Guide
Country Groups
The Country Groups page contains a list of all the country names in the FortiSIEM geolocation database. You can also create folders that represent different organizations of countries for use in Analytics.
Adding a New Country or Country Group
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
CMDB > Country Groups
.
5.
6.
Select an existing country group, or create a new one
.
Click
New
.
Enter a name and description for the new country.
Click
Save
.
Page 877
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating CMDB Groups and Adding Objects to Them
In the CMDB browser pane you will see several categories, or groups, for each type of CMDB object. For example, under
Applications
, you will see the groups , , and your own groupings and add CMDB objects to them.
Ungrouped
, with additional subcategorization within each of those groups. You can create
1.
2.
3.
4.
Log in to your Supervisor node.
Click
CMDB
.
5.
In the CMDB browser pane, select the type of CMDB object you want to create a group for, and then click .
Enter a
Group
name and
Description
.
Under
Select Group Members
, select any existing groups from which you would like to add objects to your new group.
6.
7.
The group containing all the CMDB objects of this type is selected by default.
Select the objects you want to add to the group, and then click
Click
OK
.
>>
to add them to the group.
Your new group, and the objects it contains, will be listed under that CMDB object type in the CMDB browser pane. You can add objects directly to the group by selecting it in the CMDB browser pane, and then following the process for adding a new object.
Page 878
FortiSIEM Installation Guide FortiSIEM Installation Guide
Default Passwords
The CMDB Default Password page contains a list of default vendor credentials. These well-known credentials should never be used in production. During device discovery FortiSIEM checks if the device credentials are still set to default , and the system rule
Default Password
Detected by System
triggers an incident if they are.
A sample raw event log for a default password incident:
<174>Oct 20 22:50:03 [PH_AUDIT_DEFAULT_PWD_MATCH]:[phEventCategory]=2,[appTransportProto]=SNMP,[reptModel]=Firewall-1 SPLAT,[srcIpAddr]=192.168.19.195,[phCustId]=1,[sessionId]=0f8bdee2b6a265c4bd075fc777ed,[procName]=AppServer,[reptVendor]=Checkpoint,[hostIpAddr]=172.16.0.1,[hostName]=SJ-QA-F-Lnx-CHK,[eventSeverity]=PHL_INFO,[user]=,[phLogDetail]=Default password matches for the same composite key (Vendor, Model, Access method, User Name, Password)
Adding a New Default Password
5.
6.
7.
8.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Select a group where you want to add the default password, or
Click
CMDB > Default Passwords
New
Select the
Select the
.
Click
Save
.
Vendor
and
Access Protocol
Enter the default
User Name
.
that is used to connect to the device.
and
Password
for the device.
Model
of the device for which you want to enter a default password.
Adding Default Passwords to a Group with a CSV File
You can upload a CSV file with multiple entries to the a default password group by selecting the group, clicking browsing to a CSV file. You will need to format the file with these fields:
Import
, and then
Vendor,Model,Access Protocol,User Name,Password
For example:
Microsoft,Windows,WMI,Administrator,Administrator
Page 879
FortiSIEM Installation Guide FortiSIEM Installation Guide
Devices
You would typically add devices to the CMDB through the
process. However, there may be situations in which you want to add devices to the CMDB manually. For example, you may not have access credentials for a device but still want to be able to include network information about it so that logs received by FortiSIEM can be parsed properly. These topics describe those situations and provide instructions for how to successfully add a device to the CMDB:
Adding Devices to the CMDB Outside of Discovery
Adding a Synthetic Monitoring Test to a Business Service
Page 880
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event Types
The CMDB
Event Types
page lists the types of events that are collected for supported devices.
Adding a New Event Type
5.
6.
7.
8.
1.
2.
3.
4.
9.
Log in to your Supervisor node.
Go to
CMDB > Event Types
.
Select a group to add the new event to, or
.
Click
New
.
Enter a
Name, Display Name,
and
Description
for the event type.
Select the
Device
to associate with this event type.
Select the level of
Severity
associated with this event type.
For
CVE IDs
, enter links to any vulnerabilities associated with this event type as cataloged by the
Click
Save
.
National Vulnerability Database .
Page 881
FortiSIEM Installation Guide FortiSIEM Installation Guide
Malware Hashes
The CMDB
Malware Hash
page can be used to define a list of malware files and their hash functions. generates these directory events:
When FortiSIEM monitors a directory, it
Directory Event
PH_DEV_MON_CUST_FILE_CREATE
PH_DEV_MON_CUST_FILE_SCAN
Generated by
New file creation
Directory is scanned
PH_DEV_MON_CUST_FILE_CHANGE_CONTENT
Changes in file content
When FortiSIEM scans a file and collects its hash, it uses the system rule
Malware Hash Check
to check the list of malware hashes, and triggers an alert if a match is found.
Adding a New Malware Hash
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
CMDB > Malware Hash
.
5.
6.
Select a group where you want to add the malware hash, or
Click
New
.
Enter information for the malware hash.
Click
Save
.
Adding Malware Hashes to a Group with a CSV File
You can upload a CSV file with multiple entries to the a default password group by selecting the group, clicking browsing to a CSV file. You will need to format the file with these fields:
Import
, and then
BotNet name, Algorithm, Hash Code, Controller IP, Country, Confidence, Last Seen Time
For example:
MyBotnet,SHA,aaecdrgt0987995dae567812,101.1.1.2,87,China,100,10/20/2014
Page 882
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up External Data Sources for Malware Hashes
This topic describes how to import Malware Hash information into FortiSIEM from external threat feed websites.
Websites with built in support
Custom websites - CSV data - one-time manual import
Custom websites - CSV data - programmatic import
Custom Websites - non-CSV data - programmatic import
Prerequisites
Before proceeding gather the following information about a threat feed web site.
The website URL
Credentials required to access the website (optional)
If the website is not supported by FortiSIEM, you may need to understand the format of the data returned by the URL.
if the data is in the comma separated value format (the separator need not be a comma but could be any separator, then a simple integration is possible.
If the data is any other format, e.g. XML, then some code needs to be written for integration using the FortiSIEM provided framework
Procedure
Websites with built in support
The following websites are supported
ThreatStream Malware Hash ( https://api.threatstream.com)
To import data from these websites, follow these steps
1.
2.
3.
4.
5.
6.
7.
In the
CMDB > Malware Hash
, find the website you need to import data from.
Select the folder.
Click
Update
.
Select
Update via API
. The link should show in the edit box.
Enter a schedule by clicking on the "+" icon.
Enter the schedule parameters - when to start and how often to import. FortiSIEM recommends no more frequent than hourly.
Select the type of template you want to create.
Custom websites - CSV data - one-time manual import
This requires that the data to be imported is already in a file in comma separated value format. The required format is
Botnet Name, Algorithm, Hash Code, Controller IP, Malware Type,
Confidence, Severity, Asn, Org, Country, Description, Data
Found(MM/DD/YYYY), Last Seen(MM/DD/YYYY), High IP, Malware Type,
Confidence, Severity, ASN, Org, Country ,Description,Data
Found(MM/DD/YYYY),Last Seen(MM/DD/YYYY)
Although many fields are possible, only Botnet Name and Hash Code are required.
1.
2.
3.
4.
Select
CMDB > Malware Hash
Click on the " " button on the left navigation tree to bring up the "Create New Malware Hash Group" dialog.
Enter
Group
and add
Description
. Click
OK
to create the folder under
Malware Hash
.
5.
6.
Select the folder just created.
Select
Import from a file.
; enter the file name and click
Upload
.
7.
Click
Browse
The imported data will show on the right pane.
Custom websites - CSV data - programmatic import
Page 883
FortiSIEM Installation Guide FortiSIEM Installation Guide
This requires that the web site data is file in comma separated value format (separator can be any special character such as space, tab, Hash, dollar etc.) one entry is in one line
Although many fields are possible, only Botnet Name and Hash Code are required.
Follow these steps.
1.
2.
3.
4.
5.
6.
Select
CMDB > Malware Hash
.
Click on the " " button on the left navigation tree to bring up the "Create New Malware Hash Group" dialog.
Enter
Group
and add
Description
. Click to create the folder under
Select the folder just created.
Select
Update via API
7.
For
Website,
Click
In the
Data Mapping
a. b.
Add
.
dialog:
OK Malware Hash
.
c.
Enter the
URL
of the website
Enter
User Name
and
Password
(optional)
For
Plugin class
, the default class
com.AccelOps.service.threatfeed.impl.ThreatFeedWithMappingPolicyService
is shown.
d. e.
Do not modify this for this case.
Enter the correct
8. f. g.
Select CSV as the
Data Format
Enter the
Data Mapping
by choosing the mapped field and the corresponding position in the website data. For example if the
Hash is in third position, then choose 3 in the
Click
Save
Field separator
(by default it is a comma)
Select a import schedule by clicking on the
Position
9. data from the website.
The imported data will show on the right pane after some time.
column.
Schedule Summary
. Select when to start the import and how often to import to get new
Custom Websites - non-CSV data - programmatic import
This is the most general case where the website data format does not satisfy the previous conditions. In this case, user has to write a Java plugin class by modifying the default system provided one. Follow instructions in the FortiSIEM ServiceAPI available at FortiSIEM support portal
FortiSIEM ServiceAPI section. After the class has been written and fully tested for correctness, follow these steps.
under
1.
2.
3.
4.
5.
6.
7.
Select
CMDB>Malware Hash
.
Click on the " " button on the left navigation tree to bring up the "Create New Malware Hash Group" dialog.
Enter
For
Group
and add
Website,
Click
Description
. Click to create the folder under
Select the folder just created.
Select
Update via API
In the a. b. c. d. e. f. g.
Enter the
Enter
For
Add
Data Mapping
URL
.
dialog:
of the website
User Name
Plugin class
Enter the correct
and
Password
Field separator
+
OK
(optional)
, the custom Java class for this case.
(by default it is a comma)
Low Hash is in first position, then choose 1 in the
Schedule Summary
9. data from the website.
The imported data will show on the right pane after some time.
Malware Hash
.
Select CSV as the
Data Format
Enter the
Data Mapping
by choosing the mapped field and the corresponding position in the website data. For example if the
Position
column.
8.
Click
Save
Select a import schedule by clicking on the . Select when to start the import and how often to import to get new
Page 884
FortiSIEM Installation Guide
Networks
The CMDB
Networks
page lists the defined networks in your IT infrastructure
Adding a New Network
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
CMDB > Networks
.
5.
6.
7.
Click
New
.
Enter an
Network Name
and
Click
Save
.
the Low IP address of the network IP range.
Enter any other information about the network.
FortiSIEM Installation Guide
Page 885
FortiSIEM Installation Guide FortiSIEM Installation Guide
Protocols
The CMDB
Protocols
page lists the protocols used by applications and devices to communicate with the FortiSIEM virtual appliance.
Adding a Protocol
5.
6.
7.
8.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
CMDB > Protocols
.
or select an existing one.
Click
New
.
Enter an
Name
Click
Save
.
and
+
Select or create an
Description
for the protocol.
Click to select a protocol and associate it with a port
Apps Group
to associate with the protocol.
Page 886
FortiSIEM Installation Guide FortiSIEM Installation Guide
User Agents
The CMDB User Agent page lists common and uncommon user agents in HTTP communications. The traditional use case for a user agent is to detect browser types so the server can return an optimized page. However, user agents are often misused by malware, and are used to communicate the identity of the client to the BotNet controller over HTTP(S). FortiSIEM monitors HTTP(S) logs and the system rule
Blacklist
User Agent Match
uses regular expression matching to detect blacklisted user agents.
Adding User Agents
1.
2.
3.
4.
5.
6.
Log in to your Supervisor node.
Go to
CMDB > User Agents
.
Select the User Agent group where you want to add the new user agent.
Click
Enter the
User Agent
using regular expression notation
Click
New
Save
.
.
.
Adding User Agents to a Group with a CSV File
Instead of manually adding user agents to a user-defined or system group individually, you can upload a CSV file with multiple entries to the group by selecting the group, clicking
Update
, and then selecting password with regular expression notation:
Import Manually
. You will need to format the user agent
^Really\s+Bad\s+User\s+Agent
Page 887
FortiSIEM Installation Guide FortiSIEM Installation Guide
Users
.
Page 888
FortiSIEM Installation Guide FortiSIEM Installation Guide
Watch Lists
A Watch List is a smart container of similar items such as host names, IP addresses, or user names, that are of significant interest to an administrator and need to be watched. Examples of
watch lists that are already set up in FortiSIEM are
Frequent Account Lockouts - users who are frequently locked out
Host Scanners - IP addresses that scan other devices
Disk space issues - hosts with disks that are running out of capacity
Denied countries - countries with an excessive number of access denials at the firewall
Blacklisted WLAN endpoints - Endpoints that have been blacklisted by Wireless IPS systems
Typically items are added to a watch list dynamically when a rule is triggered, but you can also add items to a watch list manually . When you define a rule, you can also choose a watch list that will be populated with a specific incident attribute, as described in
Rule , and you can use watch lists as conditions when creating reports, as described in
Using Watch Lists as Conditions in Rules and Reports . Yo
u can also define when an entry leaves a watch list. Typically this is time based. For example, if the rule does not trigger for that attribute for defined time-period, then the entry is removed from the watch list. Watch lists are also multi-tenant aware, with organization IDs tracked in relation to watch list items.
Related Links
Using Watch Lists as Conditions in Rules and Reports
Overview of the CMDB User Interface
Page 889
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Watch List
5.
6.
7.
8.
1.
2.
3.
4.
9.
Log in to your Supervisor node.
Go to
CMDB > Watch Lists
.
Click +.
Choose an
Organization
name and
to associate with the watch list.
Enter a
Group Description
for the watch list.
Select an object
Type
for the incident attribute that will be saved to the watch list.
Select
Case Sensitive
if the object type is
String
and you want to use case sensitivity to compare strings.
For
Values Expire in
Click
OK
.
, set the time period in which items will expire from the watch if there is no activity for that time.
You can now add your new watch list to a rule, so that when the rule is triggered, items will be added to the watch list. You can also use your watch list as a condition in historical search. See more information.
Adding a Watch List to a Rule and
Using Watch Lists as Conditions in Rules and Reports
for
Related Links
Using Watch Lists as Conditions in Rules and Reports
Page 890
FortiSIEM Installation Guide
System-Defined Watch Lists
FortiSIEM includes several pre-defined watch lists that are populated by system-defined rules.
Watch list Description
Accounts
Locked
Domain accounts that are locked out frequently
FortiSIEM Installation Guide
Attribute
Type
User
(STRING)
Triggering Rules
Account Locked: Domain
Page 891
FortiSIEM Installation Guide
Application
Issues
Applications exhibiting issues
Page 892
FortiSIEM Installation Guide
Host Name
(STRING)
IIS Virtual Memory Critical
SQL Server Low Buffer Cache
Hit Ratio
SQL Server Low Log Cache
Hit Ratio
SQL Server Excessive
Deadlock
SQL Server Excessive Page
Read/Write
SQL Server Low Free Pages
In Buffer Pool
SQL Server Excessive
Blocking
Database Server Disk Latency
Critical
SQL Server Excessive Full
Scan
SQL Server scheduled job failed
High Oracle Table Scan
Usage
High Oracle Non-System
Table Space Usage
Oracle database not backed up for 1 day
Exchange Server SMTP
Queue High
Exchange Server Mailbox
Queue High
Exchange Server RPC
Request High
Exchange Server RPC
Latency High
Oracle DB Low Buffer Cache
Hit Ratio
Oracle DB Low Library Cache
Hit Ratio
Oracle DB Low Row Cache
Hit Ratio
Oracle DB Low Memory Sorts
Ratio
Oracle DB Alert Log Error
Excessively Slow Oracle DB
Query
Excessively Slow SQL Server
DB Query
Excessively Slow MySQL DB
Query
FortiSIEM Installation Guide FortiSIEM Installation Guide
Availability
Issues
Servers, networks or storage devices or Applications that are exhibiting availability issues
DNS Violators Sources that send excessive DNS traffic or send traffic to unauthorized DNS gateways
Host Name
(STRING)
Source IP
Network Device Degraded -
Lossy Ping Response
Network Device Down - No
Ping Response
Server Degraded - Lossy Ping
Response
Server Down - No Ping
Response
Server Network Interface
Staying Down
Network Device Interface
Flapping
Server Network Interface
Flapping
Important Process Staying
Down
Important Process Down
Auto Service Stopped
Critical network Interface
Staying Down
EC2 Instance Down
Storage Port Down
Oracle Database Instance
Down
Oracle Listener Port Down
MySQL Database Instance
Down
SQL Server Instance Down
Service Staying Down - Slow
Response To STM
Service Down - No Response to STM
Service Staying Down - No
Response to STM
Excessive End User DNS
Queries to Unauthorized DNS servers
Excessive End User DNS
Queries
Excessive Denied End User
DNS Queries
Excessive Malware Domain
Name Queries
Excessive uncommon DNS
Queries
Excessive Repeated DNS
Queries To The Same
Domain
Page 893
FortiSIEM Installation Guide
Denied
Countries
Countries that are seeing a high volume of denials on the firewall
Denied Ports Ports that are seeing a high volume of denies on the firewall
Environmental
Issues
Environmental Devices that are exhibiting issues
Hardware
Issues
Servers, networks or storage devices that are exhibiting hardware issues
Host
Scanners
Hosts that scan other hosts
FortiSIEM Installation Guide
Destination
Country
(STRING)
Destination
Port (INT)
Host name
(String)
Host Name
(String)
Source IP
Excessive Denied
Connections From An
External Country
Excessive Denied Connection
To A Port
UPS Battery Metrics Critical
UPS Battery Status Critical
HVAC Temp High
HVAC Temp Low
HVAC Humidity High
HVAC Humidity Low
FPC Voltage THD High
FPC Voltage THD Low
FPC Current THD High
FPC ground current high
NetBoz Module Door Open
NetBotz Camera Motion
Detected
Warning APC Trap
Critical APC Trap
Network Device Hardware
Warning
Network Device Hardware
Critical
Server Hardware Warning
Server Hardware Critical
Storage Hardware Warning
Storage Hardware Critical
Warning NetApp Trap
Critical Network Trap
Heavy Half-open TCP Host
Scan
Heavy Half-open TCP Host
Scan On Fixed Port
Heavy TCP Host Scan
Heavy TCP Host Scan On
Fixed Port
Heavy UDP Host Scan
Heavy UDP Host Scan On
Fixed Port
Heavy ICMP Ping Sweep
Multiple IPS Scans From The
Same Src
Page 894
FortiSIEM Installation Guide FortiSIEM Installation Guide
Mail Violators
Malware
Found
Malware
Likely
End nodes that send too much mail or send mail to unauthorized gateways
Hosts where malware found by Host IPS /AV based systems and the malware is not remediated
Hosts that are likely to have malware - detected by network devices and the determination is not as certain as host based detection
Host Name
(String)
Source IP or
Destination
IP
Excessive End User Mail to
Unauthorized Gateways
Excessive End User Mail
Virus found but not remediated
Malware found but not remediated
Phishing attack found but not remediated
Rootkit found
Adware process found
Excessive Denied
Connections From Same Src
Suspicious BotNet Like End host DNS Behavior
Permitted Blacklisted Source
Denied Blacklisted Source
Permitted Blacklisted
Destination
Denied Blacklisted Destination
Spam/malicious Mail
Attachment found but not remediated
Spyware found but not remediated
DNS Traffic to Malware
Domains
Traffic to Emerging Threat
Shadow server list
Traffic to Emerging Threat
RBN list
Traffic to Emerging Threat
Spamhaus list
Traffic to Emerging Threat
Dshield list
Traffic to Zeus Blocked IP list
Permitted traffic from
Emerging Threat Shadow server list
Permitted traffic from
Emerging Threat RBN list
Permitted traffic from
Emerging Threat Spamhaus list
Permitted traffic from
Emerging Threat Dshield list
Permitted traffic from Zeus
Blocked IP list
Page 895
FortiSIEM Installation Guide FortiSIEM Installation Guide
Port Scanners Hosts that scan ports on a machine
Policy
Violators
Resource
Issues
End nodes exhibiting behavior that is not acceptable in typical Corporate networks
Source IP
Source IP
Servers, networks or storage devices that are exhibiting resource issues: CPU, memory, disk space, disk I/O, network I/O, virtualization resources - either at the system level or application level
Host Name
(STRING)
Heavy Half-open TCP Port
Scan: Single Destination
Heavy Half-open TCP Port
Scan: Multiple Destinations
Heavy TCP Port Scan: Single
Destination
Heavy TCP Port Scan:
Multiple Destinations
Heavy UDP Port Scan: Single
Destination
Heavy UDP Port Scan:
Multiple Destinations
P2P Traffic detected
IRC Traffic detected
P2P Traffic consuming high network bandwidth
Tunneled Traffic detected
Inappropriate website access
Inappropriate website access
- multiple categories
Inappropriate website access
- high volume
Inbound clear text password usage
Outbound clear text password usage
Remote desktop from Internet
VNC From Internet
Long lasting VPN session
High throughput VPN session
Outbound Traffic to Public
DNS Servers
High Process CPU: Server
High Process CPU: Network
High Process Memory: Server
High Process Memory:
Network
Server CPU Warning
Server CPU Critical
Network CPU Warning
Network CPU Critical
Server Memory Warning
Server Memory Critical
Page 896
FortiSIEM Installation Guide
Page 897
FortiSIEM Installation Guide
Network Memory Warning
Network Memory Critical
Server Swap Memory Critical
Server Disk space Warning
Server Disk space Critical
Server Disk Latency Warning
Server Disk Latency Critical
Server Intf Util Warning
Server Intf Util Critical
Network Intf Util Warning
Network Intf Util Critical
Network IPS Intf Util Warning
Network IPS Intf Util Critical
Network Intf Error Warning
Network Intf Error Critical
Server Intf Error Warning
Server Intf Error Critical
Virtual Machine CPU Warning
Virtual Machine CPU Critical
Virtual Machine Memory
Swapping Warning
Virtual Machine Memory
Swapping Critical
ESX CPU Warning
ESX CPU Critical
ESX Memory Warning
ESX Memory Critical
ESX Disk I/O Warning
ESX Disk I/O Critical
ESX Network I/O Warning
ESX Network I/O Critical
Storage CPU Warning
Storage CPU Critical
NFS Disk space Warning
NFS Disk space Critical
NetApp NFS Read/Write
Latency Warning
NetApp NFS Read/Write
Latency Critical
NetApp CIFS Read/Write
Latency Warning
FortiSIEM Installation Guide
Routing
Issues
Network devices exhibiting routing related issues
Scanned
Hosts
Hosts that are scanned
Vulnerable
Systems
Wireless LAN
Issues
Systems that have high severity vulnerabilities from scanners
Wireless nodes triggering violations
FortiSIEM Installation Guide
NetApp CIFS Read/Write
Latency Critical
NetApp ISCSI Read/Write
Latency Warning
NetApp ISCSI Read/Write
Latency Critical
NetApp FCP Read/Write
Latency Warning
NetApp FCP Read/Write
Latency Critical
NetApp Volume Read/Write
Latency Warning
NetApp Volume Read/Write
Latency Critical
EqualLogic Connection
Read/Write Latency Warning
EqualLogic Connection
Read/Write Latency Critical
Isilon Protocol Latency
Warning
OSPF Neighbor Down Host Name
(STRING)
EIGRP Neighbor down
OSPF Neighbor Down
Half-open TCP DDOS Attack Destination
IP
TCP DDOS Attack
Host Name
(STRING)
Excessive Denied
Connections to Same
Destination
Scanner found severe vulnerability
MAC Address
(String)
Rogue or Unsecure AP detected
Wireless Host Blacklisted
Excessive WLAN Exploits
Excessive WLAN Exploits:
Same Source
Page 898
FortiSIEM Installation Guide FortiSIEM Installation Guide
Reporting on CMDB Objects
All of the information in the CMDB can be reported on. FortiSIEM includes a number of pre-defined reports that you can run and export to PDF, and you can also create your own reports.
Running, Saving, and Exporting a CMDB Report
Creating and Modifying CMDB Reports
Importing and Exporting CMDB Report Definitions
Page 899
FortiSIEM Installation Guide FortiSIEM Installation Guide
CMDB Report Types
You can find all system-defined reports in
CMDB > CMDB Reports
. The reports are organized into folders as shown in this table. Click on a report to view
Summary
information about it, including the report conditions and the columns included in the report.
Report and Organization Associations for Multi-Tenant Deployments
If you have an FortiSIEM multi-tenant deployment, the Organization column in the CMDB report table will show whether the report is defined for a specific organization. If it is, then that report is available for both the organization and Super/Global users.
CMDB Report Folder Object to Report On
Overall Device Approval Status
Network
Server
Users
Rules
Reports
Performance Monitors
Task
Business Service
Inventory
Ports
Relationship
Inventory
Ports
Running Services
Report Name
Approved Devices
Not Approved Devices
Discovered Users
Externally Authenticated FortiSIEM Users
Locally Authenticated FortiSIEM Users
Manually Defined Users
Active Rules
Rules with Exceptions
Scheduled Reports
Active Performance Monitors
All Existing Tasks
Business Service Membership
Network Device Components with Serial Number
Network Interface Report
Router/Switch Inventory
Router/Switch Image Distribution
Network Open Ports
WLAN-AP Relationship
Server Inventory
Server OS Distribution
Server Hardware: Processor
Server Hardware: Memory and Storage
Server Open Ports
Windows Auto Running Services
Windows Auto Stopped Services
Windows Exchange Running Services
Windows IIS Running Services
Windows Manual Running Services
Windows Manual Stopped Services
Windows SNMP Running Services
Windows VNC Running Services
Windows WMI Running Services
Page 900
FortiSIEM Installation Guide
Virtualization
Installed Software / Patches Windows Installed Software
Windows Installed Patches
Windows Installed Software Distribution
Relationship VM-ESX Relationship
FortiSIEM Installation Guide
Page 901
FortiSIEM Installation Guide FortiSIEM Installation Guide
Running, Saving, and Exporting a CMDB Report
1.
2.
3.
4.
5.
Log in to your Supervisor node.
Go to
CMDB > CMDB Reports
, and select the report you want to run.
Click
Run
.
If you have a multi-tenant deployment, you will be prompted to select the organizations for which you want to run the report.
Click Save if you want to save the report.
Reports are only saved for the duration of your login session, and you can view saved reports by clicking Report Results. Each saved report will be listed as a separate tab, and you can delete them by clicking the X that appears when you hover your mouse over the report name in the tab. You can save up to 5 reports per login session
Page 902
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating and Modifying CMDB Reports
There are two ways you can create new CMDB reports: you can create a new report from scratch, or you can clone and modify an existing system or user-defined report.
Creating a New Report
1.
2.
3.
4.
5.
6.
Log in to your Supervisor node.
Go to
CMDB > CMDB Reports
.
Create a group to add the new report to if you are not adding it to an existing group.
Click
New
.
Enter a
Name
and
Description
for the report.
Select the
Conditions
for the report.
7.
You can use parentheses to give higher precedence to evaluation conditions.
Select the
Display Columns
.
8.
The Display Column attributes contain an implicit "group by" command. You can change the order of the columns with the
Move Row:
Up
and
Down
buttons.
Click
Save
.
Cloning and Modifying a Report
You can modify user-defined reports by selecting the report and clicking
Edit
. However, you cannot directly edit a system-defined report. Instead, you have to clone it, then save it as a new report and modify it.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
CMDB > CMDB Reports
.
Select the system-defined you want to modify, and then click
Enter a name for the new report, and then click
Save
.
Clone
5.
6.
The cloned report will be added to the folder of the original report.
Select the new report, and then click Edit.
Edit the report, and then click
Save
.
.
Page 903
FortiSIEM Installation Guide FortiSIEM Installation Guide
Importing and Exporting CMDB Report Definitions
Instead of using the user interface to define a report, you can import report definitions, or you can export a definition, modify it, and import it back into your FortiSIEM virtual appliance. Report definitions follow an XML schema.
Importing a Report Definition
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
CMDB > CMDB Reports
.
5.
Select the folder where you want to import the report definition, or
Click
Import
.
Copy your report definition into the text field, and then click
Import
.
Exporting a Report Definition
1.
2.
3.
4.
5.
Log in to your Supervisor node.
Go to
CMDB > CMDB Reports
.
Select the report you want to export, and then click
Click
Copy to Clipboard
.
Export
.
Paste the report definition into a text editor, modify it, and then follow the instructions for importing it back into your virtual appliance.
XML Schema for Report Definitions
The XML schema for the report definition is:
<cmdbReports>
<cmdbReport>
<name></name>
<naturalid></naturalid>
<description></description>
<selectClause></selectClause>
<orderByClause></orderByClause>
<whereClause></whereClause>
</cmdbReport>
</cmdbReports>
This is an example for the
Active Rules
report:
<cmdbReports>
<cmdbReport>
<name>Active Rules</name>
<naturalId>PH_CMDB_Report_Overall_8</naturalId>
<target>com.ph.phoenix.model.query.Rule</target>
<description>This report captures active rules on a per organization basis</description>
<selectClause>ph_drq_rule.ph_incident_category,ph_drq_rule.name,ph_sys_d omain.name</selectClause>
<orderByClause>ph_drq_rule.ph_incident_category ASC</orderByClause>
<whereClause>ph_drq_rule.active = true</whereClause>
</cmdbReport>
</cmdbReports>
Page 904
FortiSIEM Installation Guide
Importing a CMDB Report Definition
1. Go to Report listing page and select the CMDB Report folder where the report is to be imported.
2. Click Import and paste the report into the window
3. Click Import and see the report showing up in the correct folder.
Exporting a CMDB Report Definition
1. Go to Report listing page
2.
3.
Select a CMDB Report and click Export
Click "Copy to clipboard" and paste it into a file. Click Close after done.
FortiSIEM Installation Guide
Page 905
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Event Database Archives
Setting Purge and Archive Policies
Online v. Offline Storage
The FortiSIEM event database, eventDB, is for near-to-intermediate term storage and querying of events. As an online database, eventDB has fast query performance, but this performance comes with a limited storage capacity, and is expensive in terms of resource consumption. For these reasons, data needs to be periodically purged from eventDB and moved into offline storage, but still be available for querying for forensic analysis. FortiSIEM checks the capacity of the online EventDB storage every 30 minutes, and when approaches capacity, begins to move event information, in daily increments, into the offline storage location.
The FortiSIEM virtual appliance includes a data archiving function that enables you to define an offline storage location, and a policy for the number of days that events will be kept in online or offline storage. This archiving function also includes the ability for compliance auditors to validate logs to ensure that they haven't been tampered with in the offline storage. The data is cryptographically signed (SHA256) at the point of entry, and the checksums are stored in the database. The check sums can be re-verified on demand at any point of time, and if the data has been tampered with, then the check sums will not match. The data integrity reports can be exported in PDF format. If the events in offline storage need to be queried at some point in the future, they can be restored to the FortiSIEM virtual appliance.
Checking Online and Offline Storage Storage Consumption
You can check the amount of storage required for both your online data and your offline archive under the
Event DB Management >
Data Manager
tab.
Setting Purge and Archive Policies
Online data is only moved to the archive location when online storage reaches capacity. When you set the archive policy as described in
Up an Event Data Archive and Archive Policy
example, if you set the
, you are setting the amount of time that archived data will be retained before it is purged. For
Data Management Policy
for your deployment or an organization to
90 days
, then maintenance will run every day to purge data that is over 90 days old. If there is not enough offline storage for 90 days, then archived events will be purged from offline storage to create more capacity. If there is enough storage for the 90 days, then events will only be purged after 90 days. For this reason it is very important that you set an archive location that has sufficient capacity to store the amount of data for the number of days that you specify.
For multi-tenant deployments, you can set archive policies for each organization. If one organization requires 30 days of storage, and another customer requires 90 days of storage, then FortiSIEM will attempt to enforce these policies in relation to the amount of storage available. For the first organization, events will be deleted from the archive storage location on the 31st day to free up capacity for the organization that has longer storage requirements.
As with the online EventDB data, every 30 minutes FortiSIEM will check the capacity of the offline archive storage, and when the remaining storage capacity reaches a 20GB threshold, it will begin to purge data from the archive location, beginning with the oldest data, and purging it in daily increments, until the remaining storage capacity is above 20GB.
Archive and Purge Alerts
There are several system alerts that are related to eventDB capacity and the archiving function:
Alert
Online event database close to full (below 20GB)
Event Archive started
Event Archive failed
Event Archive purged because of archive purging policy
Event Archive purged because it is full
Description
When the database reaches a point where the remaining storage capacity is below 20GB, its contents will be purged or archived, depending on whether an archive storage location has been defined
The archive process has been initiated
The archive process has failed, likely due to a lack of capacity in the offline storage location
The contents of the event archive have been purged from offline storage according to the archive purging policy
The contents of the event archive have been purged from offline storage due to capacity issues
Setting Up an Event Data Archive and Archive Policy
Page 906
FortiSIEM Installation Guide
FortiSIEM Installation Guide
Page 907
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up an Event Data Archive and Archive Policy
Prerequisites
Make sure you read the section on
Setting Archive and Purge Policies
in the topic
Creating Event Database Archives before you set
up your policy. It is very important that you understand how FortiSIEM moves data into the archive, and purges archived data when the archive destination storage reaches capacity, before you create your policy.
Make sure that your
Archive Destination
has sufficient storage for your event data + 20GB. When the archive storage reaches 20GB of capacity, FortiSIEM will begin to purge archived data, in daily increments, starting with the oldest data, to maintain a 20GB overhead.
Procedure
1.
2.
3.
Log in to your Supervisor node.
Go to Admin > Event DB Management.
4.
Click Archive Policy.
For
Archive Destination, enter the full path of the file system directory where you want your event data to be archived, and then click Ap
ply.
Offline Storage Capacity for Multi-Tenant Deployments
Note that all organizations will share the same
Archive Destination
. For this reason, you should make sure that the archive destination has enough capacity to hold the event data for both the number of organizations and the archive retention period that you set for each. If the archive destination does not have enough storage capacity, the archive operation may fail.
5.
6.
Under Data Management Policies, click New.
7.
For multi-tenant installations, select the Organization for which this policy will apply.
8.
For Time Period, enter the number of days that event data should be held in the offline storage archive before it is purged.
Click
Save.
9. You can view the storage consumption of your online data, as well as the size of your offline data archive, under the Data Manager tab.
Page 908
FortiSIEM Installation Guide FortiSIEM Installation Guide
Restoring Archived Data
Once your event data has been moved to an offline archive, you can no longer query that data from within FortiSIEM. However, you can restore it to your virtual appliance, and then proceed with any queries or analysis.
1.
2.
3.
Log in to your Supervisor node.
Go to
Admin > Event DB Management > Data Manager
.
Under
Reserved Restore Space (GB)
, enter the amount of storage space that will be reserved for the restored data.
4.
5.
This should be equal to or larger than the size of the archive to be restored.
Under
Click
Archived Data
Restore
.
, select the archive that you want to restore.
The archive data will be moved to the restore space and can be queried in the usual ways.
Page 909
FortiSIEM Installation Guide FortiSIEM Installation Guide
Validating Log Integrity
1. Security auditors can validate that archived event data has not been tampered with by using the
Management
.
2.
3.
4.
5.
Log in to your Supervisor node.
Go to
Admin > Event DB Management > Event Integrity
Select the
Begin Time
and
End Times
.
Click Show.
You will see a table of all the logs that are available for the specified time period
Event Integrity
for the time period during which log integrity needs to be validated.
function of
Event DB
6. Use
Validation Status
to filter the types of logs you want to validate.
7. Select the log you want to validate, and click
Validate
.
A table showing the validation status of logs will be displayed.
Column
Start Time
Description
The earliest time of the messages in this file. The file does not contain messages that were received by FortiSIEM before this time.
End Time
Category
File Name
The name of the log file
Event Count The number of events in the file
The checksum algorithm used for computing message integrity
Checksum
Algorithm
Message
Checksum
The value of the checksum
Validation
Status
File
Location
The latest time of the messages in this file. The file does not contain messages that were received by FortiSIEM after this time.
Internal: these messages were generated by FortiSIEM for its own use. This includes FortiSIEM system logs and monitoring events such as the ones that begin with
PH_DEV_MON
.
External: these messages were received by FortiSIEM from an external system
Incident: these corresponds to incidents generated by FortiSIEM
Not Validated: the event integrity has not been validated yet
Successful: the event integrity has been validated and the return was success. This means that the logs in this file were not altered.
Failed: the event integrity has been validated and the return was failed. This means that the logs in this file were altered.
Archived: the events in this file were archived to offline storage
Local: local to Supervisor node
External: means external to Supervisor node, for example on NFS storage
8. Click
Export
to create a PDF version of the validation results.
Page 910
FortiSIEM Installation Guide
Integrating with External CMDB and Helpdesk Systems
Topics in this section include
FortiSIEM Integration Framework Overview
Creating Outbound Policies for Exporting CMDB Devices to External Helpdesk Systems
Creating Outbound Policies for Creating Tickets in External Helpdesk Systems
Creating Inbound Policies for Updating Ticket Status from External Ticketing Systems
Creating Inbound Policies for Importing Devices from an External System
Creating the CSV File for Importing Devices from External Systems
Searching for Tickets from or to External Systems
Setting Schedules for Receiving Information from External Systems
Using the AccelOps API to Integrate with External Systems
Exporting Events to External Systems via Kafka
FortiSIEM Installation Guide
Page 911
FortiSIEM Installation Guide FortiSIEM Installation Guide
FortiSIEM Integration Framework Overview
The FortiSIEM integration framework provides a way for you create two-way linkages between workflow-based Help centers like ServiceNow and
Connectwise, as well as external CMDBs.
The integration framework is based on creating policies for inbound and outbound communications with other systems, including sharing of incident and ticket information, and CMDB updates. Support is provided for creating policies to work with selected vendor systems, while the integration API lets you build modules to integrate with proprietary and other systems. Once you've created your integration policies, you can set them to execute once on a defined date and time, or on a regular schedule.
Page 912
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Outbound Policies for Exporting CMDB Devices to External Helpdesk Systems
You can populate an external CMDB from FortiSIEM CMDB. Currently, ServiceNow CMDB population is natively supported. For other CMDB, you need to write a Java class and add some mapping files.
FortiSIEM has out of the box support for ServiceNow, ConnectWise and Salesforce. For other vendors, you need to build support using
FortiSIEM Service API as specified in "Populating custom CMDB or extending current integration"
Creating an integration policy
Updating external CMDB automatically after FortiSIEM discovery
Updating external CMDB automatically on a schedule
Updating external CMDB on-demand (one-time)
Populating custom CMDB or extending current integration
Prerequisites
Make sure you have the URL and the credentials for connecting to external help desk systems. The credentials must have sufficient permission to make changes to the CMDB.
Procedure
Creating an integration policy
1.
2.
3.
4.
5.
6.
Log into your Supervisor node with administrator credentials.
Go to
Admin > General Settings > Integration
.
Click
Add
For
For
Type
a.
.
, select
Direction
For
Vendor
Device
.
, select
Outbound
.
, select the vendor of the system you want to connect to. ServiceNow is supported out of the box.
When you select the Vendor: b.
An
Instance
is created - this is the unique name for this policy. For example if you had 2 ServiceNow installations, each would have different Instance names.
A default
Plugin Name
is populated - this is the Java code that implements the integration including connecting to the external help desk systems and synching the CMDB elements. The plugin is automatically populated for ServiceNow and ConnectWise.
For other vendors, you have to create your own plugin and type in the plugin name here
7.
8.
9.
10.
For
Host/URL
, enter the host name or URL of the external system.
For
User Name
and
Password
, enter a user name and password that the system can use to authenticate with the external system.
Enter the
Maximum
number of devices to send to the external system.
For
Org Mapping
, click
Edit
to create mappings between the organizations in your FortiSIEM deployment and the names of the
11. organization in the external system.
For ConnectWise, it is possible to define a
Content Mapping
a. Enter
Column Mapping
i. ii. iii. iv.
To add a new mapping, Click on the button
Choose an FortiSIEM CMDB attribute as the
Source Column
Enter external (ConnectWise) attribute as the
Destination Column
Specify
Default Mapped Value
as the value assigned to the v.
Data Mapping definitions.
Destination Column
if the i. ii.
Select
Put to a Question
is the Destination Column is a custom column in ConnectWise b.
Enter Data Mapping
iii.
Choose the (Destination)
Column Name
Enter
From
as the value in FortiSIEM
Source Column
is not found in
12.
13.
For
Groups
Enter as the value in ConnectWise
, click
Edit
if you want the policy to only apply to a specific group of CMDB devices.
Select
Run after Discovery
if you want this export to take place after you have run discovery in your system. This is the only way to
14. push automatic changes from FortiSIEM to the external system.
Click
Save
.
Updating external CMDB automatically after FortiSIEM discovery
1.
2.
3.
Create an integration policy
Make sure
Click
Save
Run after Discovery
is checked.
Page 913
FortiSIEM Installation Guide FortiSIEM Installation Guide
Updating external CMDB automatically on a schedule
1.
2.
3.
Log into your FortiSIEM Supervisor with administrator credentials.
Go to
Admin > General Settings > Integration
.
Click
Schedule
and then click a. b. Select a schedule
+
Select the integration policies
Updating external CMDB on-demand (one-time)
1.
2.
3.
Log into your FortiSIEM Supervisor with administrator credentials.
Go to
Admin > General Settings > Integration
.
Select a specific integration policy and Click
Run
Populating custom CMDB or extending current integration
Create a new plugin by following instructions in the FortiSIEM ServiceAPI. The document is available at FortiSIEM support portal under FortiSIEM
ServiceAPI section.
Page 914
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Outbound Policies for Creating Tickets in External Helpdesk Systems
This section explains how to configure FortiSIEM to create tickets in external help desk systems.
FortiSIEM has out of the box support for ServiceNow, ConnectWise and Salesforce. For other vendors, you need to build support using
FortiSIEM Service API as specified in "Populating custom CMDB or extending current integration"
Creating an integration policy
Creating tickets automatically when incident triggers
Creating tickets automatically on a schedule
Creating tickets on-demand (one-time)
Populating custom CMDB or extending current integration
Prerequisites
Make sure you have the URL and the credentials for connecting to external help desk systems. The credentials must have sufficient permission to make changes to the Incident view.
Procedure
Creating an integration policy
1.
2.
3.
4.
5.
6.
Log into your FortiSIEM Supervisor with administrator credentials.
Go to
Admin > General Settings > Integration
.
Click
Add
For
For
Type
a.
.
, select
Direction
For
Vendor
Incident
.
, select
Outbound
.
, select the vendor of the system you want to connect to. ServiceNow and ConnectWise is supported out of the box.
When you select the Vendor: b.
An
Instance
is created - this is the unique name for this policy. If you had 2 ServiceNow or ConnectWise installations, each would have different Instance names. You can change this instance name.
A default
Plugin Name
is populated - this is the Java code that implements the integration including connecting to the external help desk systems and creating/updating the ticket. The plugin name is automatically populated for ServiceNow and
ConnectWise. For other vendors, you have to create your own plugin and type in the plugin name here.
7.
8.
9.
10.
For
Host/URL
, enter the host name or URL of the external system.
For
User Name
and
Enter the
For
Maximum
Password
, enter a user name and password that the system can use to authenticate with the external system.
number of incidents to be synched with the external system at a time.
Incident Comment Template,
click
Edit
to format a string using Incident Attributes. This formatted string will be written in the ticket
11. comment field in the external ticketing system. It works similarly as a custom email notification.
For
Org Mapping
, click
12.
13. Click
Save
.
Edit
to create mappings between the organizations in your FortiSIEM deployment and the names of the organization in the external system.
ConnectWise specific field:
ServiceBoard
: Enter the name of the ServiceBoard where the incidents would be posted
Creating tickets automatically when incident triggers
1.
2.
3.
4.
Create an integration policy
Go to Analytics > Incident Notification Policy and create a
For
Actions
, check
Click
Save
Notification Policy
.
Invoke a Notification Policy.
Then Click
Edit Policy
and select an integration policy created in Step 1.
The following fields in an FortiSIEM incident are updated after a ticket has been created in external ticketing system
External Ticket ID
External Ticket State
External User (optional)
Creating tickets automatically on a schedule
1.
2.
3.
Log into your FortiSIEM Supervisor with administrator credentials.
Go to
Click
Admin > General Settings > Integration
.
Schedule
a. and then click
+
Select the integration policies b.
Page 915
FortiSIEM Installation Guide
3.
FortiSIEM Installation Guide b. Select a schedule
The following fields in an FortiSIEM incident are updated after a ticket has been created in external ticketing system
External Ticket ID
External Ticket State
External User (optional)
Creating tickets on-demand (one-time)
1.
2.
3.
Log into your FortiSIEM Supervisor with administrator credentials.
Go to
Admin > General Settings > Integration
.
Select a specific integration policy and Click
Run
The following fields in an FortiSIEM incident are updated after a ticket has been created in external ticketing system
External Ticket ID
External Ticket State
External User (optional)
Populating custom CMDB or extending current integration
Create a new plugin by following instructions in the FortiSIEM ServiceAPI. The document is available at FortiSIEM support portal under FortiSIEM
ServiceAPI section.
Page 916
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Inbound Policies for Updating Ticket Status from External Ticketing Systems
Once a ticket has been opened in an external ticketing system, the status of the ticket is maintained in external system. This section shows how to synchronize the external ticket status back in FortiSIEM.
FortiSIEM has out of the box support for ServiceNow, ConnectWise and Salesforce. For other vendors, you need to build support using
FortiSIEM Service API as specified in "Populating custom CMDB or extending current integration"
Updating FortiSIEM external ticket state and incident status automatically on a schedule
Populating custom CMDB or extending current integration
Creating a integration policy
Create an integration policy for updating FortiSIEM external ticket state and incident status.
1.
2.
3.
4.
5.
6.
Log into your FortiSIEM Supervisor with administrator credentials.
Go to
Admin > General Settings > Integration
.
Click
Add
For
For
Type
a.
.
, select
Direction
For
Vendor
Incident
.
, select
Inbound
.
, select the vendor of the system you want to connect to. ServiceNow and ConnectWise is supported out of the box.
When you select the Vendor: b.
An
Instance
is created - this is the unique name for this policy. If you had 2 ServiceNow or ConnectWise installations, each would have different Instance names. You can change this instance name.
A default
Plugin Name
is populated - this is the Java code that implements the integration including connecting to the external help desk systems and creating/updating the ticket. The plugin name is automatically populated for ServiceNow and
ConnectWise. For other vendors, you have to create your own plugin and type in the plugin name here.
7.
8.
9.
For
Host/URL
, enter the host name or URL of the external system.
For
User Name
and
Password
, enter a user name and password that the system can use to authenticate with the external system.
Enter the
Time Window
- external ticket state for tickets closed in the external help desk/workflow system during the time window
10. specified here will be synched back.
Click
Save
.
Updating FortiSIEM external ticket state and incident status automatically on a schedule
1.
2.
3.
Log into your FortiSIEM Supervisor with administrator credentials.
Go to
Admin > General Settings > Integration
.
Click
Schedule
and then click a. b. Select a schedule
+
Select the integration policy
The following fields in an FortiSIEM incident are updated
External Ticket State
Ticket State
External Cleared Time
External Resolve Time
Populating custom CMDB or extending current integration
Create a new plugin by following instructions in the FortiSIEM ServiceAPI. The document is available at FortiSIEM support portal under FortiSIEM
ServiceAPI section.
Page 917
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Inbound Policies for Importing Devices from an External System
You can import the contents of other help desk and external system device databases into the FortiSIEM CMDB.
Prerequisites
You will need to have created a CSV file for mapping the contents of the external database to a location on your FortiSIEM Supervisor, which will be periodically updated based on the schedule you set. See
Creating the CSV File for Importing Devices from External
Procedure
5.
6.
7.
8.
1.
2.
3.
4.
Log into your Supervisor node with administrator credentials.
Go to
Admin > General Settings > Integration
.
Click
Add
.
, select For
Type
For
Direction
Device
.
, select
Inbound
.
Select the
Vendor
of the external system you want to connect to.
Enter the
File Path
to the CSV file.
For
Column Mapping
, click and enter the mapping between columns in the
Source
CSV file and the
Destination
CMDB.
For example, if the source CSV has a column , and you want to map that to the column
Device IP
Source Column
, and select
Device IP
for
Destination Column
.
Creating Custom Properties
You also have the option to create a property for devices in the destination CMDB if it doesn't already exist, and to overwrite the values of entries in the CMDB for that property if it does.
1. Select
Create a New Property if it Doesn't Exist.
2. Enter a name for the
Destination Column
of the property in the CMDB.
3. Select a
Property type
.
4. Enter the
Display Name
for the property.
5. Select
Overwrite Existing Value
if the property exists in the CMDB, but you want to overwrite its current value.
You can view and edit any custom properties you create by going to
Admin > Device Support > Custom Properties
.
9.
10.
11.
12.
When you are finished creating column mappings, click
OK
.
For
Data Mapping
, click and enter the mapping between data values in the external system and the destination CMDB.
For example, if you wanted to change all instances of destination CMDB, you would select the
State
California
in the entries for the
attribute, enter
When you are done creating your data mappings, click
OK
.
Click
Save
.
California
for
From
State
attribute in the external system to
CA
in the
. and
CA
for .
Page 918
FortiSIEM Installation Guide
Creating the CSV File for Importing Devices from External Systems
FortiSIEM Installation Guide
Page 919
FortiSIEM Installation Guide FortiSIEM Installation Guide
Searching for Tickets from or to External Systems
This should not be client accessible!
Provide a brief (two to three sentence) description of the task or the context for the task.
Prerequisites
Optional, list any information the user needs to complete the task, or any tasks they need to complete before this task.
Prerequisite 1
Prerequisite 2
Procedure
1. A step should be a single sentence telling the user what to do. Use
bold
for interface elements, monospace
for system messages, file names, etc.
Write any results of the step or notes to the user on the line below the step. You can also insert any of the info boxes here.
2. A step should be a single sentence telling the user what to do. Use bold for interface elements, monospace
for system messages, file names, etc.
Write any results of the step or notes to the user on the line below the step. You can also insert any of the info boxes here.
3. A step should be a single sentence telling the user what to do. Use
bold for interface elements, monospace
for system messages, file names, etc.
Write any results of the step or notes to the user on the line below the step. You can also insert any of the info boxes here.
Use the {info} macro to provide the user with additional information that could be useful in completing the task or step.
Use the {tip} macro for helpful hints for the step or task
Use the {note} macro to alert the user to any potential issues or problems with a step or task
Use the {warning} macro to alert the user to possible data corruption or other failure issues associated with a step or task
Post-Requisites
Optional, list anything the user should do after completing the task.
Post-requisite
Post-requisite
Related Links
List any related topics. Do not include topics that are in the same hierarchy as this topic, as the relationship is implied by the hierarchy.
Page 920
FortiSIEM Installation Guide
Related link 1
Related link 2
FortiSIEM Installation Guide
Page 921
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Schedules for Receiving Information from External Systems
You can set schedules for when your inbound external integration policies will run and update your incidents or CMDB.
Prerequisites
You should already have created
an inbound policy for importing a device from an external system
or an an inbound policy for receiving Incidents
.
Procedure
1. Log in to your Supervisor node.
2. Go to
Admin > General Settings > Integration
.
3.
4.
5.
6.
Click
Schedule
Click .
.
Select the notification policy you want to create a schedule for, and use the arrow buttons to add it to the
Set the parameters for one-time, , , or
Monthly
scheduled updates.
Selected
list.
7. Click
OK
.
Page 922
FortiSIEM Installation Guide
Using the AccelOps API to Integrate with External Systems
FortiSIEM Installation Guide
Page 923
FortiSIEM Installation Guide FortiSIEM Installation Guide
Exporting Events to External Systems via Kafka
This section describes procedures for exporting FortiSIEM events to an external system via the Kafka message bus.
Prerequisites
Make sure you have set up a Kafka Cloud ( here ) with a specific Topic for FortiSIEM events.
Make sure you have identified a set of Kafka brokers that FortiSIEM is going to send events to.
Make sure you have configured Kafka receivers which can parse FortiSIEM events and store in a database. An example would be
Logstash receiver (see here ) that can store in a Elastic Search database.
Supported Kafka version: 0.8
Procedure
Go to > >
Select
Enable Kafka
Select a
Topic
Add
Brokers
by clicking on icon
+
Enter IP address or Host name of the broker
Enter Broker port (default 9092)
Click
Save
Enter multiple broker addresses for redundancy. If one broker is not available, FortiSIEM is going to try the next broker in the list. The full list of brokers does not need to be specified.
Page 924
FortiSIEM Installation Guide
Backing Up and Restoring FortiSIEM Directories and Databases
Backing Up and Restoring the CMDB
Backing Up and Restoring the Event Database
FortiSIEM Installation Guide
Page 925
FortiSIEM Installation Guide
Backing Up and Restoring SVN
Backup and restore SVN
FortiSIEM uses an inbuilt SVN to store network device configuration and installed software versions.
Backup
The SVN files are stored in
/data/svn
. Copy the entire directory to another location.
# cd /data
# cp -r svn /<another>/<mount>/<point>
Restore
Copy the entire
/data/svn
from the backup location and rename the directory to
/data/svn
.
# cd /<another>/<mount>/<point>
# cp -r svn /data
FortiSIEM Installation Guide
Page 926
FortiSIEM Installation Guide FortiSIEM Installation Guide
Backing Up and Restoring the CMDB
The FortiSIEM Configuration Management Database (CMDB) contains discovered information about devices, servers, networks and applications.
You should create regular backups of the CMDB that you can use to restore it in the event of database corruption.
Backup
The database files are stored in
/data/cmdb/data
. FortiSIEM automatically backs up this data twice daily and the backup files are stored in
/data/archive/cmdb. To perform a backup, move these files to another location. For example:
[root@SaaS-Sup cmdb] #cd /data/archive/cmdb
[root@SaaS-Sup cmdb] #cp phoenixdb* /<another>/<mount>/<point>
If your
/data
disk is on an external NFS mount then your CMDB backup is already separate from the VM infrastructure.
[root@SaaS-Sup cmdb]# pwd
/data/archive/cmdb
[root@SaaS-Sup cmdb]# ls -lt total 1213952
-rw-rw-rw- 1 root root 95559457 Apr 20 03:02 phoenixdb_2011-04-20T03-00-01
-rw-rw-rw- 1 root root 93010144 Apr 19 13:04 phoenixdb_2011-04-19T13-00-02
-rw-rw-rw- 1 root root 91142941 Apr 19 03:02 phoenixdb_2011-04-19T03-00-01
-rw-rw-rw- 1 root root 89686080 Apr 18 13:03 phoenixdb_2011-04-18T13-00-02
Restore
If your database becomes corrupted, restore it from backup by performing these steps on you Supervisor node.
1. Stop all processes with this phTools command:
#phtools --stop all
2. Check that all processes have stopped.
#phstatus
These processes will continue to run, which is expected behavior:
Page 927
2.
FortiSIEM Installation Guide FortiSIEM Installation Guide phMonitor 1-01:55:17 0 992m 540m
Apache 1-01:56:45 0 236m 9720
AppSvr 1-01:56:35 0 3908m 758m
DBSvr 1-01:57:06 0 383m 6656
3.
4.
5.
6.
Copy the latest phoenixdb_<timestamp>
file to a directory like
/tmp
on the Supervisor host.
Go to
Run
/opt/phoenix/deployment.
db_restore /tmp/phoenixdb_<timestamp>
When this process completes, reboot the system.
.
#reboot
Page 928
FortiSIEM Installation Guide FortiSIEM Installation Guide
Backing Up and Restoring the Event Database
Backup
The event data is stored in
/data/eventdb
. Since this data can become very large over time, you should use a program such as rsync to incrementally move the data to another location. From version 4.2.1 the rsync program is installed on FortiSIEM by default.
Use this command to back up the eventdb.
#rsync -a --status /data/eventdb /<another>/<mount>/<point>
Restore
To restore eventdb there are two options:
Mount the directory where the event database was backed up.
Copy the backup to the
/data/eventdb
directory.
These instructions are for copying the backup to the
/data/eventdb
directory.
1. Stop all running processes.
#phtools --stop all
2. Check that all processes have stopped.
#phstatus
You will see that these processes are still running, which is expected behavior.
phMonitor 1-01:55:17 0 992m 540m
Apache 1-01:56:45 0 236m 9720
AppSvr 1-01:56:35 0 3908m 758m
DBSvr 1-01:57:06 0 383m 6656
3. Copy the the event DB to the event DB location
/data/eventdb
#cp -a /backup/eventdb /data/eventdb
Alternatively you can use rsync
and display the process status.
Page 929
3.
FortiSIEM Installation Guide
#rsync -a --status /backup/eventdb /data/eventdb
4. Once complete, restart all processes.
#phtools --start all
Check that all processes have started.
#phstatus
FortiSIEM Installation Guide
Page 930
FortiSIEM Installation Guide
Monitoring Operations with FortiSIEM
FortiSIEM Installation Guide
Page 931
FortiSIEM Installation Guide FortiSIEM Installation Guide
Operational and Infrastructure Monitoring
FortiSIEM includes several different types of dashboards and views to monitor your IT infrastructure. Topics in this section provide an overview of the
General
and
VM View
dashboards available in the
Dashboard
tab, along with their user interface controls and customization options.
User Interface Overview for FortiSIEM Dashboards
Overview of the Summary Dashboard User Interface
Overview of the VM Dashboard User Interfaces
Overview of the Widget Dashboard User Interface
The Network Topology View of Devices
How Values in Dashboard Columns are Derived
Adding Custom Columns to Dashboards
Creating a Customized Dashboard
Dynamic Population of Location, User, and and Geolocation Information for Events
Monitoring Custom Applications
Exporting and Importing Dashboards
Page 932
FortiSIEM Installation Guide FortiSIEM Installation Guide
User Interface Overview for FortiSIEM Dashboards
FortiSIEM includes two types of component dashboards:
General
, which are used to monitor IT infrastructure components, and
VM View
, which focus specifically on information about virtual machines in your infrastructure. These two types of component dashboards also include two types of dashboads for collecting different types of information:
Summary
dashboards
that provide single-line entries for IT infrastructure components based on their system status (
Warning All
Widget-based dashboards that provide metrics and analytics for functional areas using historical data
In addition to the summary and widget-based dashboards, FortiSIEM also includes a specialized
Incident dashboard
, with features that are detailed in the
Incidents - Flash version section.
Topics in this section provide an overview of the Summary and Widget dashboards, as well as how to use the Analysis menu to gain more information about your IT infrastructure components.
Overview of the Summary Dashboard User Interface
Overview of the VM Dashboard User Interfaces
Overview of the Widget Dashboard User Interface
The Network Topology View of Devices
How Values in Dashboard Columns are Derived
Page 933
FortiSIEM Installation Guide FortiSIEM Installation Guide
Overview of the Summary Dashboard User Interface
Dashboard Overview
Summary dashboards are best used for gathering information about individual infrastructure components in operational time. Summary dashboards include the
Exec Summary
of the
Dashboards > General
pane. In the
ESX Hosts
and
Standalone ESX Hosts
of ten minute intervals. dashboard, and all the dashboards in the
Dashboards > VM View pane
Summary Dashboards
and
, summary dashboards include the
Availability/Performance
folders
ESX Host Type
dashboards (
All
, for example). Metrics for these dashboards are displayed either on a real-time basis, or as an average
This screenshot shows an example of a
Biz Service Summary dashboard for a multi-tenant deployment. It contains all the standard user interface controls found in summary dashboard, though some additional UI controls are found in other summary dashboards as described in the table
Columnar Dashboard UI Controls
. Selecting a business service in the top pane loads all the components associated with that service into the panes below.
Summary Dashboard UI Controls
UI Control
Status Filter
Organizations
Filter
Service Info
Analysis
Menu
Description
Filters the view of the components based on component status: ,
For multi-tenant deployments, filter components based on the organization they belong to
,
For the
Business Services
summary dashboard, shows the
Quick Info
for the business service. For other components, an
nfo
link is provided in the same location in the UI.
I
The Analysis menu contains a number of options for component analytics, depending on the component selected. See
over the component's Device IP menu until the blue Quick Info icon appears, and then clicking the icon.
Page 934
FortiSIEM Installation Guide FortiSIEM Installation Guide
Customize
Columns
Performance
Summaries
Incident
Summary
Quick Info
The
Custom Columns
control lets you change the columns that are displayed in the dashboard. See
for more information.
Most columns contain a summary or trend view of their display information. Hover your mouse over the metric until a trend line icon appears, and then click to view the summary or trend information. Note that many of these summary pop-ups have their own navigational controls, for example to set the time interval for the summary.
The incident summary shows the number and type of incidents associated with the component. Hover over the number to view a quick summary of the incidents, click on the incident number to view incident details.
The
Quick Info
view of a device, which you can also access through the the
Device IP
column, displays
Location
General and Health information
Analysis
menu or hovering your mouse cursor over
for the device, and when appropriate,
information. It also contains links to additional information about the device:
Identity and
Incidents
An exportable summary of incidents associated with the device
Health
Availability,
Performance
clicking the
Device Health
, and
Security
health information for the device You can also access this information by
user interface control, or by selecting
.
Device Health
in the
Analysis
menu.
BizService
Any business services impacted by the device. You can also access this information by selecting
Impacted Business
Services
in the
Applications
Analysis
menu.
Displays a report on the top 10 applications associated with the device by
Vulnerability and IP Status (Not used in the
Dashboard
view)
Average CPU Utilization
over the past hour
Displays the vulnerability status reports that are also available by selecting
Vulnerability and IPS Status
menu
Hardware Health (Used only for the
CMDB/Storage
view)
Displays health information for the hardware being used for storage
Interfaces
in the
Analysis
Displays a report on the top 10 interfaces associated with the device by average throughput
Topology
Shows the device's location in the network topology You can also access this information by selecting
Topology
in the
Analysis
menu.
The Quick Info view also contains two links,
Identity
, which links to
Goto Config Item
, which links to the device entry in the CMDB, and
Goto
Analytics > Identity and Location Report
, where you can edit this information for the device.
Component
Health
Availability, Performance, and Security health reports for the device. You can also access this information by selecting a device in the Summary dashboard, and then click
Health,
in for a closer look at graphs and reports by clicking the cursor over them. or by going to
Quick Info > Health
Magnifying Glass
after selecting the device . If any
Incidents are displayed, click the number to view the Incident Summary. Depending on the reported metric, you can zoom
icon that appears when you hover your mouse
Location
Selection
Time View and Refresh
Interval
The Time View has two options for whether you want to view and for the interval and which you want them to refresh.{to
Real Time
or
Average-10 mins
metrics for your component,
Page 935
FortiSIEM Installation Guide FortiSIEM Installation Guide
Overview of the VM Dashboard User Interfaces
The
Dashboard > VM View
provides a complete overview of your virtual infrastructure, including Data Centers, Standalone ESX Hosts, Resource
Pools, Clusters, ESXs, and VMs. Over 400 VMs can be discovered, and their metrics pulled via VCenter in under three minutes during initial discovery. As you navigate the
Virtual Infrastructure
view for , , and
Standalone ESX Hosts
similar to those in the
General > Dashboard
widget dashboards that provide performance metrics for CPU
Utilization, Memory, Network Interface, Disk I/O and Data Store Utilization are available at the level of , , and
Cluster
.
VM Summary Dashboards Overview
UI Controls for Virtual Infrastructure Summary Dashboards
VM Summary Dashboards Overview
This screenshot shows the
All ESX Hosts
summary dashboard, which includes a summary pane for All ESXs at the top, and a summary pane for individual VM instances for selected ESXs at the bottom. The user interface controls for the Virtual Infrastructure summary dashboards are very similar to those in the
General
summary dashboards.
UI Controls for Virtual Infrastructure Summary Dashboards
Ui Control
Organizations
Filter
Description
For multi-tenant deployments, filter components based on the organization they belong to
Page 936
FortiSIEM Installation Guide FortiSIEM Installation Guide
Quick Info
The
Quick Info
view of a device, which you can also access through the the
Device IP
column, displays
Location
General and Health information
Analysis
menu or hovering your mouse cursor over
for the device, and when appropriate,
information. It also contains links to additional information about the device:
Identity and
Incidents
An exportable summary of incidents associated with the device
Health
Availability,
Performance
clicking the
Device Health
, and
Security
health information for the device You can also access this information by
user interface control, or by selecting
.
Device Health
in the
Analysis
menu.
BizService
Any business services impacted by the device. You can also access this information by selecting
Impacted Business
Services
in the
Applications
Analysis
menu.
Displays a report on the top 10 applications associated with the device by
Vulnerability and IP Status (Not used in the
Dashboard
view)
Average CPU Utilization
over the past hour
Displays the vulnerability status reports that are also available by selecting
Vulnerability and IPS Status
menu
Hardware Health (Used only for the
CMDB/Storage
view)
Displays health information for the hardware being used for storage
Interfaces
in the
Analysis
Displays a report on the top 10 interfaces associated with the device by average throughput
Topology
Shows the device's location in the network topology You can also access this information by selecting
Topology
in the
Analysis
menu.
The Quick Info view also contains two links,
Identity
, which links to
Goto Config Item
, which links to the device entry in the CMDB, and
Goto
Analytics > Identity and Location Report
, where you can edit this information for the device.
Device Health Availability, Performance, and Security health reports for the device. You can also access this information by selecting a device in the Summary dashboard, and then click
Health,
in for a closer look at graphs and reports by clicking the cursor over them. or by going to
Quick Info > Health
Magnifying Glass
after selecting the device . If any
Incidents are displayed, click the number to view the Incident Summary. Depending on the reported metric, you can zoom
icon that appears when you hover your mouse
Analysis
Menu
Locations
Customize
Columns
The Analysis menu contains a number of options for component analytics, depending on the component selected. See
over the component's Device IP menu until the blue Quick Info icon appears, and then clicking the icon.
The
Custom Columns
control lets you change the columns that are displayed in the dashboard. See
for more information.
The ESX Hosts View
When you select an individual ESX Host in the Virtual Infrastructure hierarchy, the ESX Health tab will be selected and you will see a widget dashboard with reports for , , , and
Disk Rate
. Additional tabs are
Summary
and
Top VMs
.
VM
Tab
Name
ESX
Health
Description
A widget dashboard with reports for , ,
Rate
A summary dashboard for VMs on the ESX host.
, , and
VM
Summary
Top VMs
A widget dashboard with reports for
, and
,
Top VMs by Disk Read Request Rate
,
, all updated hourly
Disk
The ESX and VM View
When you select an ESX or VM in the Virtual Infrastructure hierarchy, you will see a widget dashboard that contains reports for
tive Incidents
, and
Performance Metrics
.
Page 937
FortiSIEM Installation Guide FortiSIEM Installation Guide
Overview of the Widget Dashboard User Interface
Widget dashboards are best for viewing aggregated metrics based on historical search, which are generally presented in the form of a graph or chart. From the widget view of information, you can drill down to view and modify the underlying historical search. Examples of widget dashboards include
Availability/Performance > Avail/Perf Widgets
, the
Widgets,
and all the dashboards listed under
Dashboards by Function
.
, and
Security
This screenshot shows an edited view of the controls found in widget dashboards.
Availability/Performance >Avail/Perf
widgets dashboard. It contains all the standard user interface
This screenshot shows the
Event Info
menu that you open by hovering your mouse cursor over an event within a widget until the menu icon appears.
Widget Dashboard UI Controls
UI
Control
Resize
Drill
Down
Description
You can resize the widget by clicking on this control, and then indicating how many tile spaces you want that widget to use in the dashboard
Hover your mouse cursor over the right upper corner of the widget to access this control. Select a line displayed in the widget to drill down to the historical search associated with that metric. You can then run or modify the search. See
Historical Search for more information. This is also the same functionality as the
Drill Down
option in the
Event Info
menu.
Page 938
FortiSIEM Installation Guide FortiSIEM Installation Guide
Edit
Settings
Hover your mouse cursor over the right upper corner of the widget to access this control. Edit the settings associated with the widget. These include:
Title - the title of the report
Description - a summary description of the report
Condition - filters within the report. Look up the report in
CMDB > CMDB Reports
to view the filter conditions it uses.
Display - select the type of chart you would like the widget to display
Time - the time interval to use in gathering data
Refresh Interval - how often the data should be refreshed
Result Limit - how many results should be included in the report
Run report for - for multi-tenant deployments, select the organization that the widget should report on
Remove Hover your mouse cursor over the right upper corner of the widget to access this control. Click this control to remove the widget from the dashboard
Event
Info
Add
Report
Hover your mouse cursor over a line in a report to view the
Quick Info
for the associated Event Type, or select
At the bottom of each widget dashboard is a button to add more widgets to the dashboard.
Drill Down
edit, and run the associated historical search. See
Refining the Results from Historical Search
for more information.
to view,
Related Links
Refining the Results from Historical Search
Page 939
FortiSIEM Installation Guide FortiSIEM Installation Guide
The Network Topology View of Devices
FortiSIEM provides two ways to view the topology of your IT infrastructure, one at the CMDB level that shows all devices, and another at the level of device groups and individual devices.
How is Network Topology Discovered and Visualized?
CMDB All Devices User Interface Controls
Device Group and Device View User Interface Controls
Viewing Device Information in the Topological Map
How is Network Topology Discovered and Visualized?
FortiSIEM discovers network topology at two levels, layer 3 and layer 2. Layer 3 connectivity involves IP addresses, while Layer 2 connectivity
The layer 3 topology is discovered by obtaining network interface IP address and masks for all devices via SNMP (RFC 1213). The local networks e.g. loopback (127.0.0.0/8), link local addresses (169.254.0.0/16) are filtered out and the distinct networks segments are identified.
A layer 3 topology is visualized on the FortiSIEM Topology map by drawing:
Network segment and devices as node and
Srawing line segments from the network segment nodes to every device node that have an interface with IP address in that network segment.
The devices are represented by vendor specific icons and the network nodes are represented by a line and labeled as “Net-<net>/<maskbits>”.
For visual clarity:
Only the network devices are drawn by default. A network device is one that belongs to row Network Device tab in the CMDB.
Only those networks are drawn that have devices discovered by FortiSIEM (and are in CMDB). There is a “” button next to those networks. Clicking on the “ ” button displays those hosts in the topology graph. Clicking on the “-“ button hides those hosts.
When an enterprise network has Layer 2 switches and hubs, a layer 3 topology misses the connectivity between servers to layer 2 switches and the trunk port connectivity between layer 2/3 switches. Layer 2 discovery is difficult and, more importantly, vendor dependent as vendors have different implementations of the Spanning Tree Protocol (STP).
For Cisco switches, the layer 2 topology is obtained via SNMP (IEEE spanning tree MIB as found in RFC1493 and CISCO-VTP-MIB) as follows:
For every switch,
1.
2.
Identify all active VLANs on that switch
For every active VLAN: a) Get MAC forwarding table b) Get STP table to identify trunk ports and directly connected trunk port on adjacent switches
The MAC forwarding table obtained in Step 2a provides the server to switch port connectivity (after eliminating the trunk port entries obtained in step 2b). The trunk port connectivity between switch ports is directly obtained from Step 2b.
The Layer 2 topology is visualized on the FortiSIEM topology diagram by choosing the layer 2 mode. Then by clicking the “+” next to a device, the
VLANs on that switch are displayed. Also, the trunk port connectivity is shown in an orange color and a tool tip provides the VLANs over this trunk link.
Then by clicking on the “+” of a VLAN, the hosts belonging to that VLAN and also the switch ports they connect to are displayed.
The host to switch port connectivity can also be seen in a tabular form by first clicking the switch and then clicking the “Port Mapping Table”.
CMDB All Devices View
This screenshot shows the
CMDB
tab selected, and in the
Device View Topology
is selected. This topology map shows all the devices for the selected organization, and provides controls for editing the topology views that will be available to users from that organization.
Page 940
FortiSIEM Installation Guide FortiSIEM Installation Guide
CMDB All Devices User Interface Controls
UI Control
Zoom
Organizations
Filter
View
Search
View Options
Layout Options
Save and Update
Description
Use the slider to increase or decrease the zoom level of the map
For multi-tenant deployments, filter devices based on the organization they belong to
Select the layers, connection types, and number of hops from the host to display in the map
Search for specific devices based on name, IP, or Business Service
Set the display options, including severity levels, for the map
Set the type of topological map to display, as well as the length of links between devices
Refresh
When you make a change to the map settings, click Refresh to see them reflected in the map
Save
Save your
Layout
Sync
If you make changes to your infrastructure or add devices to the CMDB, click Sync to see them reflected in the map
and
View Options
to use them in other topographical maps associated with this organization
Device Group and Device View
You can access the device group view of the topological map by selecting a group of devices in the Device View, and then clicking the n in the Summary pane. Select an individual device, and then click the Topo button in the Details pane to view that device within the topological map.
Topo
butto
Page 941
FortiSIEM Installation Guide FortiSIEM Installation Guide
Device Group and Device View User Interface Controls
UI
Control
Zoom
View
Controls
Map
Explorer
Description
Use the slider to increase or decrease the zoom level of the map
Click on the arrow icon in the upper-right corner of the map to open these controls. Options to enable/disable node dragging, incident display, connection layer display, and the number of hops from the host to display.
Click o the arrow icon in the lower-right corner of the map to open the Map Explorer. As you zoom into the map, the map explorer will show you the area that you are currently viewing. You can move to another area by clicking and dragging the highlighted section of the map explorer to that area.
Viewing Device Information in the Topological Map
Devices within the topological map have additional icons to represent information about the device.
Icon Name
Show
Connected
Hosts
Description
+
click on that icon to see hosts that are connected to that device
Show
Incident
Details
Incidents for a device are displayed as a number in a circle to the right of the device icon, with the color of the circle (red, yellow, green) indicating the severity of the incidents. Click the number to view the
Incident Summary
for the device, and then click on individual incident to view the
Incident Details
in the
Overview of the Incident Dashboard
. In the Incident
Summary you can also view and apply a subset of options from
the Analysis Menu by having your mouse cursor over the
Incident Source
or
Incident Target
entries for the incident.
Page 942
FortiSIEM Installation Guide FortiSIEM Installation Guide
Show
Device
Details
Click on the name of the device to view details about it. The kind of information displayed will depend the type of device you select.
Page 943
FortiSIEM Installation Guide FortiSIEM Installation Guide
How Values in Dashboard Columns are Derived
The values in Summary dashboard columns are either derived from system information (for example, the IP address for a device), or are metrics associated with events and their attributes. This topic uses the example of the
CPU Util
column in many summary dashboards to explain the relationship between event attributes and display columns, and how values in those columns are calculated.
1.
2.
3.
Log into you your Supervisor node.
Go to
Dashboard > Device View > All Devices
.
Click
Select Columns
.
You will see a list of all the columns used in this dashboard under
Selected Columns
. Under Selected Columns you'll see
CPU Util
, and next to it, in parentheses, you will see three event types listed, whose attributes are used to create this calculation:
PH_DEV_MON_SYS_C
, , and
4.
5.
PH_DEV_MON_CLARION_SP_UTIL
. The metrics associated with these attributes are displayed in the CPU Util column, but how are metrics collected over time represented as a single value? To answer this question, you need to examine the column settings and Aggregation Method in the
Go to
Admin > Device Support > Dashboard Columns
.
Find
System CPU Utilization
in the list of dashboard columns.
6.
CPU Util
is part of the System CPU Utilization set of metric.
Each dashboard column has the same set of attributes:
Device Support > Dashboard Columns
page.
Column
Attribute
Name
Description
The metric collected
Event Type The type of event that provides the attributes for the metric
Column
Name
The display name in the Summary dashboard for the metric
Value for System CPU Utilization
System CPU Utilization
PH_DEV_MON_SYS_CPU_UTIL
PH_DEV_MON_EC2_METRIC
PH_DEV_MON_CLARION_SP_UTIL
CPU Name
Storage Processor
CPU Utilization
Host IP Address
Most events include a
Host
IP address, however there is no Column Name for this metric as FortiSIEM generates the column name the metric.
Device IP
in relation to
Column
Attribute
Column
Type
The specific attribute used for each Column Name
The type of information that will be displayed in the column for each attribute
Aggregator For readings, the mathematical aggregator that will be used to calculate the metric. Options are: AVG, SUM, MAX, MIN, LAST. Using a pipe between time, and the second over the object.
|
two operators indicates that the first operation should be aggregated over
Device IP (system generated name) - hostIpA ddr
CPU Name
- cpuName
Storage Processor
- spName
CPU Util
- cpuUtil
Device IP
dr
- Host
(system generated name) - hostIpAd
CPU Name
- cpuName
Storage Processor
- spName
CPU Util
- cpuUtil
- Object
-Object
- Reading
CPU Util - cpuUtil
- Reading - AVG|AVG
With this information, you can see that
CPU Util
metric is derived from the cpuUtil
attribute of the
PH_DEV_MON_SYS_CPU_UTIL
event, and that the display column is a reading that uses the calculation Average over time and then Average over the object being reported on. Now apply this to the event reports for a host with two CPUs, and you can see how the calculation works.
Page 944
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_SYS_CPU_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPerfJob.
cpp,[lineNumber]=3137,
[cpuName]=CPU x
1,[hostName]=win2k8.FortiSIEM.net,[hostIpAddr]=192.168.0.40,
[cpuUtil]=2.000000,[pollIntv]=176,[phLogDetail]=
[PH_DEV_MON_SYS_CPU_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPerfJob.
cpp,[lineNumber]=3137,
[cpuName]=CPU x
1,[hostName]=win2k8.FortiSIEM.net,[hostIpAddr]=192.168.0.40,
[cpuUtil]=4.000000,[pollIntv]=176,[phLogDetail]=
PH_DEV_MON_SYS_CPU_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPerfJob.c
pp,[lineNumber]=3137,
[cpuName]=CPU x
2,[hostName]=win2k8.FortiSIEM.net,[hostIpAddr]=192.168.0.40,
[cpuUtil]=20.000000,[pollIntv]=176,[phLogDetail]=
[PH_DEV_MON_SYS_CPU_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPerfJob.
cpp,[lineNumber]=3137,
[cpuName]=CPU x
2,[hostName]=win2k8.FortiSIEM.net,[hostIpAddr]=192.168.0.40,
[cpuUtil]=40.000000,[pollIntv]=176,[phLogDetail]=
This output shows two samples of cpuUtil
taken over three minutes for each CPU running on the host
192.168.0.40
. According to the
gator
for the host. The average for the CPU 1 is
3.000000
, and the average for CPU 2 is again to get the overall metric for the host, which is
16.500000
.
30.000000
. These values are combined and averaged
Aggre
for this column, FortiSIEM should first average the samples over time for each CPU, and then average those together to derive the metric
Page 945
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using the Analysis Menu
The
Analysis
menu located in the address of the device until the blue
dashboard. You can also access the Analysis menu items by selecting a line in a summary dashboard, and hovering your mouse over the IP
Analysis
menu option appears.
Analysis Menu Options
Editing Settings for Displayed Reports
You can edit the settings for any of the reports displayed from Analysis menu options. See
Widget Dashboard UI Controls > Edit
Settings
in the topic
Overview of the Widget Dashboard User Interface
for more information about widget settings options.
Menu
Option
Quick Info
Description
The the
Quick Info
Device IP
view of a device, which you can also access through the
column, displays
General and Health information
Analysis
menu or hovering your mouse cursor over
for the device, and when appropriate,
Identity and Location
information. It also contains links to additional information about the device:
Incidents
An exportable summary of incidents associated with the device
Health
Availability,
Performance
, and
Security
health information for the device You can also access this information by
user interface control, or by selecting clicking the
Device Health
Analysis
menu.
Device Health
in the
Analysis
menu.
BizService
Any business services impacted by the device. You can also access this information by selecting
Impacted Business
Services
in the
Applications
Displays a report on the top 10 applications associated with the device by
Average CPU Utilization
over the past hour
Vulnerability and IP Status (Not used in the
Dashboard
view)
Displays the vulnerability status reports that are also available by selecting
Vulnerability and IPS Status
in the
Analysis
menu
Hardware Health (Used only for the
CMDB/Storage
view)
Displays health information for the hardware being used for storage
Interfaces
Displays a report on the top 10 interfaces associated with the device by average throughput
Topology
Shows the device's location in the network topology You can also access this information by selecting
Topology
in the
A nalysis
menu.
The Quick Info view also contains two links,
, which links to
Goto Config Item
, which links to the device entry in the CMDB, and
Analytics > Identity and Location Report
, where you can edit this information for the device.
Goto Identity
Topology
Device
Health
Incidents
Summary
Device
Availability
Device
Performance
Shows the device location within the network topology
Availability, Performance, and Security health reports for the device. You can also access this information by selecting a device in the Summary dashboard, and then click
Health,
or by going to
Quick Info > Health
after selecting the device for a closer look at graphs and reports by clicking the
Magnifying Glass
icon that appears when you hover your mouse cursor over them.
. If any
I
ncidents are displayed, click the number to view the Incident Summary. Depending on the reported metric, you can zoom in
A summary of incidents associated with the device. Select an incident and then hover your mouse cursor over the
Incident
Name
to open the topics under including:
View Incident Details
mouse cursor over the
option, which will load the selected incident into the
Incident Dashboard
. See the
for more information about working with the Incident Dashboard. If you hover your
Incident Target
for an incident in the Incident Summary screen, you will see some additional options,
Add to Watch List - add the incident target to a watch list. See
Watch Lists for more information.
Show Related Real Time Search - opens a real time search using the Host IP and Name for the incident target
Show Related Historical Search - opens an historical search using the Host IP and Name for the incident target
Displays reports for , , and
Ping Packet Loss
hour, and
Device Uptime
for the device over the past thirty minutes
for the device over the past
Displays reports for , , er the past hour for the device
, and
Avg Disk Utilization
ov
Page 946
FortiSIEM Installation Guide FortiSIEM Installation Guide
Interface
Status
Application
Performance
Displays reports for
Count
over the past hour for the device
Displays reports for
Utilization
, and
Application Memory Utilization
,
,
over the past hour for the device
,
,
, and
Interface Error
Event Status Displays reports for , , r the past hour for the device
Opens an Historial Search for the selected device using these criteria
All Events by Group for the Last 10
Minutes
Traffic
Status
Vulnerability and IPS
Status
Displays reports for
All Permitted Traffic Sourced From or Destined to
Sourced from or Destined to
the selected device over the previous hour
, and
the selected device, and
Top TCP/UDP Ports
All Denied Traffic
ove
Displays reports for
All Vulnerabilities for Last 1 Day
and hours
All Warning + Critical IPS Events
for the device over the past 24
Business services that contain the selected device
Impacted
Biz Services
Real-time
Events
Historical
Events for
Last 5 Mins
Opens a Real-Time Search for the selected device
Opens an historical search for all events associated with the device over the past five minutes
Page 947
FortiSIEM Installation Guide FortiSIEM Installation Guide
Customizing Dashboards
FortiSIEM includes several dashboards for device types and IT functional areas, but you can also customize and create new dashboards and widgets.
Adding Custom Columns to Dashboards
Creating a Customized Dashboard
Page 948
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Custom Columns to Dashboards
columns using the example of a hardware temperature readout, and then add them to a dashboard.
Prerequisites
Read the topic
How Values in Dashboard Columns are Derived
Procedure
1. Find the event that contains the attribute you want to use.
In this case, you want to create a hardware temperature reading. The event
PH_DEV_MON_HW_TEMP
C
.
contains the attribute envTempDeg
[[PH_DEV_MON_HW_TEMP]:[eventSeverity]=PHL_INFO,[fileName]=deviceJun
OS.cpp,[lineNumber]=619,[hostName]=JunOS-3200-1,
[hostIpAddr]=172.16.5.64,[hwComponentName]=FPC- EX3200-24T- 8 POE @
0/*/*,[envTempDegC]=33,[phLogDetail]=
2.
3.
4.
Go to
Admin > Device Support > Dashboard Columns
.
Click
New
.
5.
For
Name
, enter the display name for the new metric you want to collect.
For this example, enter the name e, click the
Edit
Temperature Reading
.
icon and select the event you want to use.
6.
For
Event Typ
For this example, select
PH_DEV_MON_HW_TEMP
.
Click the icon to add a column. As you complete each column, click
For each event type, you will typically create three columns: a
Host
OK
olumn that includes information about the object being reported on, and a
, then click + to add more columns.
column that contains IP information for associated hosts, an
Reading
column that contains the metric you want to report on.
Note that you could create additional Reading columns for other attributes contained in your event.
Object
c
Column Type Example Settings
Host
Attributes: hostIpAddr
Aggregator: N/A
Display Name: N/A
Format: N/A
Trend Chart: N/A
Type: Host
Object
Reading
Attributes: hwComponentName
Aggregator: N/A
Display Name: N/A
Format: N/A
Trend Chart: N/A
Type: Object
Attributes: envTempDegC
Aggregator: AVG|MAX
Display Name: Temp
Format: DegreeC
Trend Chart: Health
Type: Reading
8.
9.
10.
11.
7. When you're finished adding columns, click
OK
.
The new column you created will appear in the
Admin > Device Support > Dashboard Columns.
Select your new column in the list, and then click
Apply
.
To add your column to a dashboard, navigate to the dashboard
.
In the dashboard, click
Under
Event Types
Select Columns
.
, select the event type you used to create the new column.
The columns associated with that event type will be listed under
Columns
, and the
Attribute Name
will list the attribute you used to
Page 949
FortiSIEM Installation Guide
11.
FortiSIEM Installation Guide
12.
13.
14. create the column.
Under
Click
Columns
OK
.
, select your column and use the button to move it into the
Your new column will appear in the dashboard.
Selected Columns
.
Use the up and down position buttons to place the column in the order where you want it to appear in the dashboard.
Page 950
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Widgets to Dashboards
1.
2.
3.
4.
5.
6.
Navigate to the
widget dashboard where you want to add the widget.
At the bottom of the dashboard click
Add Reports to Dashboard
.
For multi-tenant deployments, select the
Select a
Under
Click
OK
Category
.
for the type of report you want to add.
Available Reports
Organization
that you want to have access to the report.
>> Selected Reports
.
Page 951
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Customized Dashboard
You can create both
and
custom dashboards.
1.
2.
3.
4.
5.
6.
7.
8.
In the
Dashboard
tab, select
My Dashboard
in the
At the top of the
Enter a
Group
Select a
Click
OK
.
General
view, click the icon.
to categorize the dashboard, and a
The dashboard will be added under
My Dashboard
.
Select the dashboard.
For a
Dashboard Type
.
Device Summary Dashboard
For a
Widget Dashboard
, click
, click
Devices
General
view.
Description
.
at the top of the dashboard and select the devices you want to add to the dashboard.
Add Reports to Dashboard
, and then select the reports you want to add.
Page 952
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting a Dashboard to Home
You can set any system or user-defined dashboard to be your home page when you log into FortiSIEM.
1.
2.
In the
Dashboard
view, select the dashboard you want to set for your home page.
At the top of the
General
view of the dashboards, click the
Home
icon.
The Home icon will be filled in rather than greyed out, and the next time you log into FortiSIEM, the page you selected will be your home page.
Page 953
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Dashboard Slideshow
Go to
Dashboard
Click on Slideshow icon on top left.
A check box appears next to each dashboard in the dashboard tree under the
For each folder, expand the folder to see the check box for each dashboard
Select the dashboards for slideshow
Select the
Interval
for switching between dashboards
Click
Start
to enter Slideshow mode. Click
Cancel
General
tab
to not save the current slideshow configuration
Once in Slideshow mode, click
Escape
button to stop the slideshow
Slideshow configuration is saved on a per user basis. When the user logs back on, same slideshow can be used.
Page 954
FortiSIEM Installation Guide FortiSIEM Installation Guide
Exporting Events to Files
You can run the phExportEvent tool from a Supervisor or Worker node to export events to CSV files. The file will contain these fields:
Customer Id (applicable to SP license)
Reporting Device IP
Reporting Device Name
Event Received Time
Raw Message
This code block shows the commands that you can use with phExportEvent, followed by a table that describes them in more detail.
phExportEvent {--dest DESTINATION_DIR} {--starttime START_TIME |
--relstarttime RELATIVE_START_TIME} {--endtime END_TIME | --relendtime
RELATIVE_END_TIME} [--dev DEVICE_NAME] [--org ORGANIZATION_NAME] [-t
TIME_ZONE]
phExportEvent
Command
DESTINATION_DIR
START_TIME
RELATIVE_START_TIME
Description
Destination directory where the exported event files are saved
Starting time of events to be exported. The format is YYYY-MM-DD HH:MM:SS {+|-} TZ. If TZ is not given, local time zone of the machine where the script is running will be used. Example:
2010-03-10 23:00:00 -8
means
Pacific Standard Time, 23:00:00 03/10/2010.
2010-07-29 10:20:00 +5:30
means India Standard Time
10:20:00 07/29/2010.
Must be used together with
END_TIME
Starting time of events to be exported relative backward to the end time as specified using
--endtime END_TIME
. The format is
{NUM}{d|h|m}
END_TIME
RELATIVE_END_TIME where
NUM
is the number of days or hours or minutes. For example, time is 5 days prior to the ending time.
--relstarttime 5d
means the starting
Ending time of events to be exported. The format is the same as
START_TIME
.
Must be used together with
START_TIME
DEVICE_NAME
ORGANIZATION_NAME
TIME_ZONE
Ending time of events to be exported relative forward to the start time as specified using START_TIME. The format is same as RELATIVE_START_TIME.
Host name or IP address of the device with the events to be exported. Use a comma-separated list to specify multiple IPs or host names, for example, case insensitive
--dev 10.1.1.1,10.10.10.1,router1,router2
. Host name is
Used only for multi-tenant deployments. The name of the organization with the events to be exported. To specify multiple organizations, enter a commandeach for one organization, for example,
--org "Public Bank" --org
"Private Bank"
. The organization name is case insensitive.
Specifies the time zone used to format the event received time in the exported event files. The format is
-8 +5:30
means India Standard Time.
{+|-}TZ
,
Page 955
FortiSIEM Installation Guide FortiSIEM Installation Guide
Dynamic Population of Location, User, and and Geolocation Information for Events
In most cases, network logs only contain IP address information, but to investigate incidents involving that IP, you need additional context for that
IP address such as host name, user, and geolocation information. Because FortiSIEM collects detailed IT infrastructure information in the CMDB, it is able to correlate that information to the IP address to create a context for the event, and insert that context information into events in real time as parsed attributes. This topic describes the way in which this context information is populated into events.
Assigning Attributes to Events
Dynamic Updating of Attribute Information
Correlating Event Information
Event information is derived from several different sources.
1. During
2. them in the CMDB. If any IP address other than the
Access IP
changes, then running a rediscovery will update the CMDB with the right information.
FortiSIEM collates information from various authentication logs and forms a time-based
Identity and Location Report containing the IP
3. address, MAC address, Host Name, Domain, User, Network Access Point, and Network Access Point Port for the event.
The geolocation database maps IP addresses to Country, State, City, Organization, Longitude, and Latitude information.
Assigning Attributes to Events
When FortiSIEM parses an event, attributes are assigned to it following this process:
Host Name Attribute
For each IP address ( , , , ):
1.
2.
FortiSIEM checks the CMDB for an associated host name, and if one is found, then the host name is added to the event.
If the host name is not found in then CMDB, then FortiSIEM checks the Identity and Location Report for the host name, and if one is
3. found, then it is added to the event.
If the host name is not found in either the CMDB or Identity and Location Report, then FortiSIEM runs DNS lookup for the host name, and if one is found, then it is added to the event. For performance reasons the DNS result is cached, and because excessive DNS lookups can cause event processing delays, FortiSIEM has an algorithm to dynamically bypass DNS lookup if it begins falling behind in event processing.
User Name Attribute
For
Source IP
, FortiSIEM checks for user information in the Identity and Location Report, and if anything is found, it is added to the event.
Geolocation Attribute
For each IP address ( , , , ), FortiSIEM checks the geolocation database. If geolocation information is found for that IP, then Country, State, City, Organization, Longitude, and Latitude information is added to it.
Dynamic Updating of Attribute Information
For any of these attributes, when there is a change in the infrastructure (for example, a network device has a new IP or a new user logs on to the system), the change is populated into the CMDB and/or Identity and Location Report, and the event parsing module learns of the change and starts populating events with the new metadata.
Because the FortiSIEM approach to populating event attributes is dynamic and change driven, it is always able to map the right IP address to host names and users in the face of dynamic changes in the IT infrastructure.
Attributes Added to Events
IP Type Attributes
Page 956
FortiSIEM Installation Guide
Source IP
Destination IP
Host IP
Reporting IP
PostNAT (Network Address Translation) IP
5.
6.
7.
8.
1.
2.
3.
4.
Source Host Name
User (corresponding to Source IP)
Source Country
Source State
Source City
Source Organization
Source Longitude
Source Latitude
1.
2.
3.
4.
5.
6.
7.
Destination Host Name
Destination Country
Destination State
Destination City
Destination Organization
Destination Longitude
Destination Latitude
1.
2.
3.
4.
5.
6.
7.
Host Name
Host Country
Host State
Host City
Host Organization
Host Longitude
Host Latitude
1.
2.
3.
4.
5.
6.
7.
Reporting Host Name
Reporting Country
Reporting State
Reporting City
Reporting Organization
Reporting Longitude
Reporting Latitude
1.
2.
3.
4.
5.
6.
PostNAT Country
PostNAT State
PostNAT City
PostNAT Organization
PostNAT Longitude
PostNAT Latitude
FortiSIEM Installation Guide
Page 957
FortiSIEM Installation Guide FortiSIEM Installation Guide
Monitoring Custom Applications
While FortiSIEM provides support for many applications, there may also be situations in which you have a custom application running in your infrastructure that you want to monitor. This topic explains how to set up FortiSIEM to monitor that application, and add it to a business service.
5.
6.
7.
8.
1.
2.
3.
4.
9.
10.
11.
Log in to your Supervisor.
Go to
Go to
General Settings > Monitoring > Important Processes
Click
Add
Click
CMDB > Applications
, and either select a group where you want to add the application, or
Click
New
, and enter an
Click
Save
.
Click the
Software
Application Name
and a
Process Name
of the server where the application is running.
Go to
CMDB > Devices
and select the server.
.
.
tab and make sure the application has been discovered.
.
and enter the name of the process that the application is running on.
Apply All
.
Run a structured historical search using these attributes to make sure the process utilization metrics are being received by FortiSIEM.
Attribute
Reporting IP
Event Type
Value
The IP address of the server where the application is running
PH_DEV_MON_PROC_RESOURCE_UTIL
Application Name The name of the application
12.
Add your application to a business service.
You should now be able to go
Dashboard > Summary Dashboards > Biz Service Summary
Monitored Processes
when you select the associated business service.
and see your process running under
Top
Page 958
FortiSIEM Installation Guide
Exporting and Importing Dashboards
It is possible to export and then import the following types of widget dashboards
My Dashboard
Availability/Performance > Avail/Perf Widgets
Biz Svc Dashboard
Dashboards By Function
To export a dashboard
Go to a specific dashboard folder
Click
Export
on top right portion
An XML file will be created and saved.
To import a dashboard, first have the XML file ready
Go to a specific dashboard folder
Click
Import
on top right portion
Provide the dashboard file in XML format
FortiSIEM Installation Guide
Page 959
FortiSIEM Installation Guide FortiSIEM Installation Guide
Link Usage Dashboard
For perimeter network devices such as firewalls and routers, it is important to know which interfaces are busy and which traffic is consuming the most resources. This special dashboard provides this view and enables users to determine which router interfaces are overly utilized, which applications are using them and what is the QoS statistics.
Go to or
The default is
Inventory View
. Click
CMDB > Devices >
Link Usage
Router/Switch
to change to this special view
A three level panel appears on right
Top pane: Device level view: System level metrics such as CPU, Memory, Connections, Sent/Receive Traffic, Received EPS.
Source is SNMP.
Middle pane: For the selected device in Top pane, it shows metrics for each interface. Source is SNMP.
Bottom pane: For the selected device in Top pane and interface in middle pane, it shows
Application Usage: Top Applications, Top Sources, Top Connections. Source is Netflow.
QoS Statistics: QoS statistics. Source is SNMP - Fortinet only
Slideshow configuration is saved on a per user basis. When the user logs back on, same slideshow can be used.
Page 960
FortiSIEM Installation Guide FortiSIEM Installation Guide
Analytics
FortiSIEM Analytics has three components:
Search
FortiSIEM search functionality includes real time and and historical search of information that has been collected from your IT infrastructure. With real time search, you can see events as they happen, while historical search is based on information stored in the event database. Both types of search include simple keyword searching, and structured searches that let you search based on specific event attributes and values, and then group the results by attributes.
Rules
, and, in some cases, sends a notification .
Reports
Reports are pre-defined search queries. FortiSIEM includes a large catalog of reports for common devices and IT analysis tasks that you can use and customize, and you can also save searches that you've run as reports to use again later.
Additional Information in the Help Center
You can find additional information about analytics, including troubleshooting tips, in the d by FortiSIEM support.
Analytics section of the Help Center maintaine
Overview of the Historical Search User Interface
Example of How a Structured Historical Search is Processed
Creating a Simple Historical Search
Creating a Structured Historical Search
Using System-Defined Reports for Historical Search
Overview of Historical Search Results and Charts
Refining the Results from Historical Search
Charting a Specific Row from Historical Search Results
Charting Multiple Aggregation Attributes on the Same Historical Search Results Chart
Drilling Down on Search Results by Time Interval
Using Search Results to Refine Historical Searches
Using Tabs to View Multiple Search Results
Converting an Historical Search to a Real Time Search
Converting an Historical Search to a Rule
Overview of the Real Time Search User Interface
Creating a Simple Real Time Search
Creating a Structured Real Time Search
Viewing and Refining Real Time Search Results
Selecting Attributes for Structured Searches, Display Fields, and Rules
Using Expressions in Structured Searches and Rules
Keywords and Operators for Simple Searches
Using Geolocation Attributes in Searches and Search Results
Creating Filter Criteria and Display Column Sets
Example of a Rule with a Single Condition Sub-Pattern
Example of a Rule with Multiple Sub-Patterns
Defining the Incident Generated by a Rule
Activating and Deactivating Rules
Page 961
FortiSIEM Installation Guide
Running Historical Searches to Test Rule Sub Patterns
Setting Rules for Event Dropping
Setting Rules for Event Forwarding
Setting Global and Per-Device Threshold Properties
Using Geolocation Attributes in Rules
Using Watch Lists as Conditions in Rules and Reports
System-Defined Baseline Reports
Creating a Report or Baseline Report
Running System and User-Defined Reports and Baseline Reports
AccelOps Visual Analytics Architecture
Installation and Configuration of AccelOps Visual Analytics
Requirements for Visual Analytics Report Server
Hypervisor Installations for Report Server
Installing and Registering AccelOps Report Server in Amazon Web Services
Installing and Registering AccelOps Report Server in KVM
Installing and Registering AccelOps Report Server in Microsoft Hyper-V
Installing and Registering AccelOps Report Server in VMware ESX
Syncing with the Report Server
Working with the Report Server
Report Server Architecture: phoenixdb and reportdb
Working with CMDB Data in AccelOps Report Server
Viewing phoenixdb Organization
Querying Incident Data in AccelOps Report Server
Reference: Attribute Columns in the ph_incident_view Table
Querying Other CMDB Tables in AccelOps Report Server
Querying Device Vendor and Model Distribution for Discovered Devices
Working with Event Data in AccelOps Report Server
Syncing an AccelOps Report with Report Server
Deleting a Report from AccelOps Report Server
Modifying an Existing Report in AccelOps Report Server
Installing and Configuring Tableau Server
Creating and Managing Workbooks
Creating and Publishing Workbooks
Creating a Single Sheet Workbook
Creating a Multiple Sheet Workbook
Using AccelOps Workbooks with Tableau Visual Analytics Desktop and Server
FortiSIEM Installation Guide
Page 962
FortiSIEM Installation Guide FortiSIEM Installation Guide
Search
Historical and Real Time search is the core functionality of FortiSIEM analytics, enabling you to analyze, report on, and further improve your IT infrastructure.
Overview of the Historical Search User Interface
Example of How a Structured Historical Search is Processed
Creating a Simple Historical Search
Creating a Structured Historical Search
Using System-Defined Reports for Historical Search
Overview of Historical Search Results and Charts
Refining the Results from Historical Search
Charting a Specific Row from Historical Search Results
Charting Multiple Aggregation Attributes on the Same Historical Search Results Chart
Drilling Down on Search Results by Time Interval
Using Search Results to Refine Historical Searches
Using Tabs to View Multiple Search Results
Converting an Historical Search to a Real Time Search
Converting an Historical Search to a Rule
Overview of the Real Time Search User Interface
Creating a Simple Real Time Search
Creating a Structured Real Time Search
Viewing and Refining Real Time Search Results
Selecting Attributes for Structured Searches, Display Fields, and Rules
Using Expressions in Structured Searches and Rules
Keywords and Operators for Simple Searches
Using Geolocation Attributes in Searches and Search Results
Creating Filter Criteria and Display Column Sets
Page 963
FortiSIEM Installation Guide FortiSIEM Installation Guide
Historical Search
With the Historical Search feature, you can go back in time and retrieve events from the event database. By using either a simple keyword-based search or a more detailed structured search, you can get quick and valuable insights into events that have occurred over any selected time period.
Overview of the Historical Search User Interface
Example of How a Structured Historical Search is Processed
Creating a Simple Historical Search
Creating a Structured Historical Search
Using System-Defined Reports for Historical Search
Overview of Historical Search Results and Charts
Refining the Results from Historical Search
Charting a Specific Row from Historical Search Results
Charting Multiple Aggregation Attributes on the Same Historical Search Results Chart
Drilling Down on Search Results by Time Interval
Using Search Results to Refine Historical Searches
Using Tabs to View Multiple Search Results
Converting an Historical Search to a Real Time Search
Converting an Historical Search to a Rule
Page 964
FortiSIEM Installation Guide FortiSIEM Installation Guide
Overview of the Historical Search User Interface
You can run two types of historical searches on FortiSIEM data: simple searches, in which you use a keyword search, and structured searches, in which you can specify search conditions and how the results should be grouped.
Simple Historical Search User Interface Controls
Simple Historical Search
When you use simple historical search, you enter a keyword to search for in the logs collected by FortiSIEM, specify any filter criteria, and then run the search, which will produce a chart and a list of results matching your search criteria. You can then use additional user interface controls to change the chart display, filter or find more information about events in the result list, and export or share results.
This screenshot shows the results of simple search using the keyword
TCP
.
Simple Historical Search User Interface Controls
UI Control
Search
Criteria
List Display
Columns
Filters
Description
For simple historical search, use the search box to find keywords in raw event logs. You can also load an
existing historical search report to use for your search criteria, or
create a rule from your search results .
Select which columns will be displayed in the search results
Set the time interval over which you want to search, and, for multi-tenant deployments, which organization's logs you want to search
Page 965
FortiSIEM Installation Guide FortiSIEM Installation Guide
Report
Management
Chart Displa
y
Event Filter
Event
Information
Save
Saves the report to Generated Reports where it will be retained for the time period you specify. You can also select whether you want the search criteria to be saved as a report that you can use in the future.
Export
Export the report, with the option of including the chart, as a PDF or CSV file
Email the report as a CSV or PDF file, with the option of including the chart
Copy to a new tab
Load the search into a new tab within FortiSIEM
You can set both the data you want to display, and how it should be displayed. See
Overview of Historical Search Results and
for more about the different chart types.
Select an event from the results, and add its attributes to structured search conditions.
Select an event, and view
Quick Info
about it, or view
Location
information about it such as source or destination IPs.
Structured Historical Search
With historical structured search, you can enter conditions for your search based on event attributes, and set which attributes will be used to group the search results in a way that is similar to the use of the of the Group By command in SQL
This screenshot shows a structured historical search for
All Non-Reporting Modules
screenshot below it shows a close-up of the the
Conditions and Group By
for more information about these options.
selected from the system
Reports > Event Status
. The
options dialog. See Creating a Structured Historical Search and
Page 966
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 967
FortiSIEM Installation Guide FortiSIEM Installation Guide
Example of How a Structured Historical Search is Processed
When you run a structured historical search, all events within the specified time window are examined and added to the result set following these steps:
1. The system fetches the next event within the search time window and applies the filtering criteria. If the event does not pass the filtering
2. criteria, the system fetches the next event.
If the event passes the filtering criteria, the system then compares the attributes of this event against the other entries in the result set. If the current event contains an attribute that is included in the Group By attribute set, then the results for that attribute are updated.
3.
Otherwise, a new entry is created in the result set.
After all the events in the search time window are processed, the system sorts the results to produce the final result set.
As an example, consider these events in the event database, and running a search for
Top Firewall Recorded Conversations Ranked By Total
Connections (Descending) and Total Bytes (descending)
over them
.
5
6
7
3
4
1
2
Event id Time Reporting Device
1/1/2010 10.1.1.1
1/2/2010 10.1.1.1
1/3/2010 10.1.1.1
1/4/2010 10.1.1.1
1/4/2010 10.1.1.1
1/5/2010 10.1.1.1
1/5/2010 10.1.1.2
Source IP Destination IP
192.168.1.1 192.168.10.4
192.168.1.2 192.168.10.4
192.168.1.1 192.168.10.4
192.168.1.2 192.168.10.5
192.168.1.1 192.168.10.4
192.168.1.2 192.168.10.6
192.168.1.1 192.168.10.4
Protocol
TCP
TCP
TCP
TCP
TCP
TCP
TCP
Source Port
2033
3000
2034
3001
2035
3002
9000
Destination Port
80
443
80
443
80
443
80
Total Bytes
1024
4096
1024
2048
1024
2048
1024
Search
Top Firewall Recorded Conversations Ranked By Total
Connections (Descending) and Total Bytes (descending)
Search Criteria
Filtering criteria: Reporting Device IP IN Firewall AND Event Type IN
Permit Traffic
Group-By attributes:
Source IP, Destination IP, IP Protocol, Destination
Port
Display attributes:
Source IP, Destination IP, IP Protocol, Destination Port,
SUM(Matched Events) DESC, SUM(Total Bytes) DESC
Query window:
Between 1/2/10 and 1/5/10
Result
Source IP
192.1.1.1
192.1.1.2
192.1.1.2
192.1.1.2
Destination IP Protocol Destination Port COUNT (Matched Events) SUM(Total Bytes)
202.1.1.4
TCP 80 3 3072
202.1.1.4
202.1.1.5
202.1.1.6
TCP
TCP
TCP
80
443
443
1
1
1
4096
2048
2048
You could then run another search over these results:
Search
Top Destination IPs Ranked By Total Connections (Descending) and
Total Bytes (descending)
Search Criteria
Filtering criteria: Reporting Device IP IN Firewall AND Event Type
IN Permit Traffic
Group-By attributes:
Display attributes:
Destination IP
Destination IP, SUM(Matched Events) DESC,
SUM(Total Bytes) DESC
Query window:
Between 1/2/10 and 1/5/10
Result
Destination IP COUNT (Matched Events) SUM(Total Bytes)
202.1.1.4
4 7 KB
202.1.1.5
1 2 KB
202.1.1.6
1 2KB
Page 968
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sample Historical Searches
Sample Filter Criteria
Filter criteria
Raw Event Log CONTAINS "login AND failed"
Raw Event Log CONTAINS "denied"
Reporting Device IP = 10.1.1.1
Reporting Device IP IN Firewall
Type
Simple
(keyword) search
Simple
(keyword) search
Structured search
Structured search
Structured search
Structured search
Meaning
Only events that contain both the keywords "logon" and "failed" are part of report
Only events that contain the keyword "denied" are part of report
Only events from the device that is reporting with IP address
10.1.1.1 are part of the report
Only events from firewall devices in CMDB are part of the report
Reporting Device IP IN Firewall AND
Event Type IN Deny Traffic
Reporting Device IP IN Firewall AND
Event Type IN Deny Traffic AND (Source IP =
192.1.1.1 OR Dest IP = 192.1.1.1)
Reporting Device IP IN Domain Controller AND
Event Type IN User/Group Change AND user NOT
IN Domain Admins
Raw Event Log REGEXP "faddr\s+\d+.\d+\d+\d+"
Structured search
Only firewall deny events from firewall devices in CMDB are part of the report
Denied traffic from 192.1.1.1 or to 192.1.1.1 reported by firewall devices in CMDB are part of the report
Domain Controller User/Group Changes not performed by users in the Domain Admin group
Structured search
Only events that contains strings like "faddr 10.1.1.1", "faddr
192.168.29.1" are included in the report.
Sample Structured Searches
The following examples illustrate how to write a search using the AccelOps GUI.
Search Specification in AccelOps GUI
Top Reporting Firewalls ranked by event count in the last hour Filter Criteria: Reporting Device IP IN Firewall
Group By attributes:
Display attributes:
Query window:
Reporting Device IP
Reporting IP, COUNT(Matched Events) DESC
1 hour
Top Reporting Firewalls and Event Types ranked by event count in the last hour
Top Firewall Denied Source IPs ranked by the total number of attempts in the last hour
Top Firewall Recorded Conversations Ranked By Sent Bytes
(descending), Received Bytes (descending)
Filte Criteria: Reporting Device IP IN Firewall
Group By attributes:
Display attributes:
Events) DESC
Reporting Device IP, Event Type
Reporting IP, Event Type, Severity, COUNT(Matched
Query window:
1 hour
Filter Criteria: Reporting Device IP IN Firewall AND Event Type IN Deny
Traffic
Group By attributes:
Source IP
Display attributes:
Source IP, COUNT(Matched Events) DESC
Query window:
1 hour
Filter Criteria: Reporting Device IP IN Firewall AND Event Type IN Permit
Traffic
Group By attributes:
Source IP, Destination IP, IP Protocol, Destination Port
Display attributes:
Source IP, Destination IP, IP Protocol, Destination Port,
SUM(Sent Bytes) DESC, SUM(Received Bytes) DESC
Query window:
1 hour
Page 969
FortiSIEM Installation Guide FortiSIEM Installation Guide
All unauthorized domain user/group changes in the last week Filter Criteria: Reporting Device IP IN Domain Controller AND
Event Type IN User/Group Change AND user NOT IN Domain Admins
Group By attributes:
none
Display attributes:
Time, event type, user, computer, domain, target user, target domain
Query window:
1 week
Page 970
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Simple Historical Search
Prequisites
If you need to familiarize yourself with how historical search works or the historical search interface, you should read these topics:
Overview of the Historical Search User Interface
Example of How a Structured Historical Search is Processed
Procedure
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Analytics > Historical Search
.
For
Filter Criteria
, select
Simple
.
Enter the keywords you want to search for in the raw event logs.
5.
See
Keywords and Operators for Simple Searches for information on keyword searching.
6.
7.
Under
Display Fields
, select the attributes you want to use as the columns in your results list.
See
Selecting Attributes for Structured Searches, Display Fields, and Rules and
options for selecting display field attributes and sets.
For
Creating Filter Criteria and Display Column Sets
8.
Time
, set the interval over which you want the search to run.
For multi-tenant deployments, select the
Click
Run
Organization
you want to run the search against.
.
The results of your search will be displayed in the chart and search results list.
Page 971
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Structured Historical Search
Prequisites
If you need to familiarize yourself with how historical search works or the historical search interface, you should read these topics:
Overview of the Historical Search User Interface
Example of How a Structured Historical Search is Processed
Procedure
1.
2.
3.
4.
5.
Log in to your Supervisor node.
Go to
For
The
Analytics > Historical Search
.
Filter Criteria
, select
Structured
.
Conditions and Group By
search window will open.
Click the downward arrow in the search window to open the
Alternatively you can click to use a saved
Conditions and Group By
options.
Under
Conditions
, set the
... Filter Criteria Set
.
, and
Value
for your condition.
for more information, and
6.
Selecting Attributes for Structured Searches, Display Fields, and Rules
for more information about using attributes in conditions.
Paren
.
7.
Click under
Row
to add another condition, and set the
Next Operator
to use for that condition.
You can give precedence to conditions by setting parentheses around them with the button under
Under
Group By
, set the event attributes that you want to use to group the results, as described in
8.
Historical Search is Processed
Click
OK
.
9.
You can also click
Save as Filter Criteria Set
, and these conditions and group by attributes will be available for future historical searches by clicking next to the search window.
Under
Display Fields
, select the attributes you want to use as the columns in your results list.
See
10.
11.
12. and events to use as display fields.
For multi-tenant deployments, select the
For
Time
, set the interval over which you want the search to run.
Click
Run
.
Organization
you want to run the search against.
The results of your search will appear in the chart and results list.
Page 972
FortiSIEM Installation Guide
Using System-Defined Reports for Historical Search
FortiSIEM includes a number of pre-defined reports that you can use as the basis for historical searches.
Using System-Defined Reports in Historical Searches
Viewing Available Reports
1.
2.
3.
Log in to your Supervisor node.
Go to
Analytics > Reports
.
Select a report group in the navigation pane, and then a report.
Each report includes four information tabs:
Tab Description
Summary Includes name, description, and all the criteria used in constructing the historical search for the report
Schedule Any scheduled runs for the report. See
Scheduling Reports for more information.
Results
Any saved results from running the report
Defintion The XML definition of the report
Using System-Defined Reports in Historical Searches
1.
2.
3.
4.
5.
Log in to your Supervisor node.
Go to
Analytics > Historical Search
.
Click
Load Report
.
Select the report you want to use, and then click
Follow the same steps that you would for
OK
.
Creating a Structured Historical Search
.
FortiSIEM Installation Guide
Page 973
FortiSIEM Installation Guide FortiSIEM Installation Guide
Overview of Historical Search Results and Charts
When your search runs, you will see both a
Results List
in the bottom pane of the screen, and a chart in the middle pane. The types of charts that are displayed depend both on the data being analyzed, and whether or not you have specified any can also add dimensions to your search results and change the chart display type for further analysis.
Group By
conditions in your search. You
Non-Aggregated Search Results
Non-aggregated searches are searches that don't use any Group By conditions to process the results. These types of searches produce two views of the results:
View Description
Shows the trend over time for search results
Screen Example Notes
Trend
Results List
Shows the results of the search based on the Search Display fields you selected
Aggregated Search Results
Aggregated searches are those that use a Group By condition to process the results.
View
Results
List
Description
Shows the results of the search based on the Group By and
Display fields you selected
Screen Example Notes
This example shows the search results for
Top Event Types by Count
Filter Condition: Empty
Group By Condition: Event Type
Selected Display Fields: Event Type and COUNT(Matched Events)
Trend
Shows the time trend of aggregated fields
(one at a time)
There are two trend views of results for aggregated searches, the line chart, shown here as the first chart, and the stack chart, shown as the second chart.
In this example, the line chart illustrates when the events occurred. The stacked display avoids line crossings, but the values have to be read off as the height and not the absolute value. For example, the event count for
PIX-302015 at 9:00 hours is 20,000-14000 = 6000.
Pie
Chart
Shows the proportion for the
COUNT(Matched
Events) attribute
For any set of results where you are charting
Count (Matched Events)
, click the
Pie Chart
icon to view a proportional representation of the results.
Page 974
FortiSIEM Installation Guide
Bar
Chart
Shows the distribution of aggregated fields
Scatter
Plot
Shows the correlation between two aggregated fields
FortiSIEM Installation Guide
For any set of results where you are charting Count (Matched Events), click the Bar Chart icon to view the distribution of events for your results.
Scatter plots can show the correlation between two aggregated dimensions, effectively converting a one dimensional chart into a two dimensional one. In this case, a report is run with these parameters:
Filter Condition: Event Types
PH_DEV_MON_SYS_CPU_UTIL
and
PH_D
EV_MON_SYS_MEM_UTIL
Group By attribut: Host Name
Display Fields: AVG(CPU Utilization) and AVG(Memory Utilization)
The results are first presented as a stacked trend and bar chart. When you click on the
Scatter Plot Chart
icon, you can now see the display fields as two dimensions, which shows that most devices use more memory than CPU.
Hovering your mouse cursor over an item in the chart displays the values for the selected host.
A bubble pot is a scatter plot with a third dimension field added to indicate size. In this example, the same type of search that was used to generate the scatter plot example is run, though the display field
Last (System Uptime)
ha s been added as a
Size
indicator.
Bubble
Plot
Shows the correlation between two aggregated fields with a third dimension as size
Tree
Map
A hierarchical tree-structured visualization that can be used to analyze dominating components of multidimensional data
Page 975
A tree map is a hierarchical tree-structured visualization that you can use to analyze dominant components of multi-dimensional data. A classic example is an attempt to understand Top Talkers in a network.
In this example, a search is run with these parameters:
Filter Conditions: Group:Permit Traffic
Group by attributes: Destination TCP/UDP Port, Destination IP, Source
IP
Display Fields: Destination TCP/UDP Port, Destination IP, Source IP,
COUNT(Matched Events)
The results, which run to 400 pages with approximately 10,000 entries, do not provide any information about:
The proportion of the Top Destination Port
The proportion of Top Source IPs for a given Destination Port
The proportion of Top Destination IPs for a given Destination Port and
Source IP
By switching to a Tree chart, you can now see:
Top ports are 161 (SNMP) and 53 (DNS) - with SNMP taking roughly 1.5
times the connections
The top destinations for DNS are:
192.168.0.10 (Internal DNS)
208.67.222.222 (External DNS)
The top sources going to 192.168.0.10 on the DNS port are
192.168.20.116, 192.168.65.125
The top sources going to 208.67.222.222 on DNS port are 192.168.0.10
You can now drill down on port 53 for a closer view by clicking 53.00 in the tree map, which results in the third screenshot in this example.
FortiSIEM Installation Guide
Heat
Map
visualizes calculated measures in two dimensions using a color grade that helps users to understand intensity
FortiSIEM Installation Guide
A heat map visualizes two display fields using a color gradient that indicates intensity. A classic example is an attempt to understand which host is talking on which network port.
In this example, a search is run with these parameters:
Filter Conditions: Group:Permit Traffic
Group By attributes: Destination TCP/UDP Port, Source IP
Display Fields: Destination TCP/UDP Port, Source IP, COUNT(Matched
Events)
The first screenshot shows the results as a stacked trend chart. The second shows the results as a heat map with the
Sample
set to 1000. You can now hover your mouse cursor over indicators of higher intensity to view specific information. In this case 192.168.0.10, which appears as a small red bar in the lower left corner, is a heavy contributor to traffic on Port 53. In addition , vertica l lines indicate multiple hosts communicating on the same port, for example ports 22, 53, 80, 443, while horizontal lines indicate same host talking across multiple ports.
Page 976
FortiSIEM Installation Guide FortiSIEM Installation Guide
Refining the Results from Historical Search
Overview of Historical Search Results and Charts
describes the charts that you can use to visualize historical search results, but there are also a variety of methods you can use to drill down into search results and refine your queries.
Charting a Specific Row from Historical Search Results
Charting Multiple Aggregation Attributes on the Same Historical Search Results Chart
Drilling Down on Search Results by Time Interval
Using Search Results to Refine Historical Searches
Using Tabs to View Multiple Search Results
Page 977
FortiSIEM Installation Guide FortiSIEM Installation Guide
Charting a Specific Row from Historical Search Results
When your chart loads, the top five items are displayed as color-coded stack charts, as show in the example of this screenshot. However, you may want to remove results from the chart to get a clearer view of what is happening with a specific result. Here, for example, there are spikes for
192.168.19.65 that are clearly visible at various intervals, but the chart results for the other IPs obscure much of what is happening with this source IP.
The solution is to remove the other Source IPs from the chart. In the
Chart
column of the
Results List,
click on the items you want to remove from or add to the chart. In this example, all four of the other IPs have been removed from the chart to obtain a clearer visualization of the activity for 192.168.19.65.
Page 978
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 979
FortiSIEM Installation Guide FortiSIEM Installation Guide
Charting Multiple Aggregation Attributes on the Same Historical Search Results Chart
When you run a query, the resulting chart typically displays the first aggregated attribute in the
Results List
. However, if there are other aggregated attribute values in the search results, you can add those to the chart as a second dimension.
This screenshot shows the results for the report
Top Router Network Intf By Util, Error, Discards
, which includes the values for a single aggregated attribute,
AVG(In Intf Util)
, for incoming interface utilization.
In this case, it could also be informative to understand more about the outbound interface utilization. In the second
Chart For
menu,
Intf Util)
is selected, and this is added as a second dimension to the chart beneath the line, as shown in this screenshot.
AVG(Out
Page 980
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 981
FortiSIEM Installation Guide FortiSIEM Installation Guide
Drilling Down on Search Results by Time Interval
When you run a search, the chart displays results for the time interval you set in your original query. However, you can also drill down to 5 minute,
10 second, and 1 second time intervals for a closer inspection of the results.
1. Hover your mouse cursor over the result and time interval you want to drill down on until the information pop-up appears, as shown in the
2.
3. first example screenshot.
Click to drill down and view the results for a 5 minute interval.
Follow the same process to drill down to the 10 second and one second intervals.
This series of screenshots illustrates starting from the original search results, and then drilling down to the 5 minute interval.
Page 982
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using Search Results to Refine Historical Searches
In this screenshot of search results you can see a small but sudden spike in the period of interest, and use these as filter criteria for a deeper investigation.
SUM(Total Bytes)
for
Destination TCP/UDP Port 20756
, which is represented by the color purple in the chart. In order to understand what is happening in this time interval, you can select this port and the time
1.
2.
In the
Results List
, select the row containing the item of interest.
3.
Click the
Filter
menu, and you will see the attributes of the selected item as filter options.
Select the attribute you want to use for your filter.
In this case, you would select
Destination TCP/UDP Port = 20756
.
Adding a Specific Attribute Value to a Filter
You can also click in the cell of the
Results List
that contains the attribute value you want to use in your filter, and then select
Add to Filter
from the pop-up menu that appears when you hover your mouse cursor over the attribute value.
4.
5.
In the
Show
menu select
Raw Messages.
This will include the raw event logs in the
Incident Details
.
6.
7.
In the
Display Fields
menu, add or remove any display fields you want for the refined search results.
In this case two fields are added,
Run
.
This screenshot shows the results for the selected port and time period, indicating that two events originating from Seattle WA were responsible for the spike.
Destination TCP/UDP Port
and
Total Bytes.
In the chart, click on the time period that is of interest to add it to the search criteria.
Click
Page 983
7.
FortiSIEM Installation Guide FortiSIEM Installation Guide
8. Click in the
Raw Event Log
column for an event to view the event details.
See
reported events and add them to the display fields for your results.
Page 984
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using Tabs to View Multiple Search Results
There may be occasions when you want to be able to run and compare the results of multiple searches.
1.
2.
Run your first search.
+
3.
A new tab will open up in the Analytics Window.
Run your second search in the new tab.
New Tabs for Drill-Down and Refined Searches
refine an existing search zoom in on a time period
, or use the time interval drill-down to examine search results, new tabs are automatically generated for each level of drill down, and for each refined search. When you select an attribute to use in a refined search, you can also select
Add to Filter in New Tab
from the
Options
menu.
Page 985
FortiSIEM Installation Guide FortiSIEM Installation Guide
Converting an Historical Search to a Real Time Search
In the course of running an historical search, you may produce results that you want to examine in real time. For example, suppose that an historical search shows that yesterday there was an excessive amount of outgoing traffic from your home country or countries that you do business with. You may want to know if this same traffic pattern is happening right now, in real time. You can answer this question from within the same historical search that raised your suspicions.
1. In the historical search window, click
2.
Real Time Search
.
The historical search criteria are loaded into a Real Time Search window and begin to execute.
You can now refine your Real Time Search results to reflect your current interest, for example by adding a Destination County attribute to the display results and running the search again.
Page 986
FortiSIEM Installation Guide FortiSIEM Installation Guide
Converting an Historical Search to a Rule
Example
While using historical search, you may observe a pattern that you want to use as a rule so if the pattern recurs, it will trigger an alert. For example, in an historical search you may notice excessive traffic going outside your country or the countries you do business with. You can generate a rule to watch for this traffic pattern from within the historical search.
These screenshots show the conditions and results for the example of an historical search for excessive outgoing traffic.
Page 987
FortiSIEM Installation Guide FortiSIEM Installation Guide
Following this example, you may now want to create a rule that will send you an alert when a particular source sends more than 1000 connections, or more that 5MB of traffic, in five minutes.
Procedure
1. In the historical search that you want to use as the basis for your rule, click
Create Rule
.
The
Rule Editor
will load, with most information for the rule auto-populated from the search. You can also read the topics under
for
2.
3.
4.
5. more information about creating rules.
Enter a
Rule Name
and
Set the
Severity
Description
.
to associate with incidents generated by this rule.
Set the
Incident Category
to associate with incidents generated by this rule.
Set the number of seconds for the
Time Window
that this rule should apply to.
6.
In the example of excessive outgoing traffic over a five minute period, this would be set to
Under the
Conditions
, click the
Edit
icon for
300
.
7.
8. Click
Save
when you're done editing the rule.
Filter_1
.
You will see that all your filter conditions for the search have been populated into this sub pattern.
You can now edit the Filter and Aggregate conditions for your original search, or change the Group By conditions.
This screenshot show editing the rule sub pattern
Events)
and
SUM(Total Bytes
) to r changed to
OR.
1000
and
Filter_1
5242880
from the original rule conditions, with the
Aggregate Conditions
for
COUNT(Matched
to match the new alert conditions from the example historical search, and the
AND
operato
Page 988
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 989
FortiSIEM Installation Guide FortiSIEM Installation Guide
Real Time Search
You can use Real Time search to view events as they are occurring in real time within your IT infrastructure. You can use both simple and structured search criteria, as you would with historical search, but instead of the results displayed in a report like you would see with an historical search, real time search results are displayed as a rolling graph and summary of events that you can drill down into.
Overview of the Real Time Search User Interface
Creating a Simple Real Time Search
Creating a Structured Real Time Search
Viewing and Refining Real Time Search Results
Page 990
FortiSIEM Installation Guide FortiSIEM Installation Guide
Overview of the Real Time Search User Interface
The real time search interface is very similar to the interface for historical search, with the exception that real time search doesn't have an option to set a search time period. As with historical search, you can also run simple or structured search queries. The main difference between historical and real time search is that real time search displays your results as they are occurring in your IT infrastructure, with a scrolling chart and summary of the results.
Simple Real Time Search Interface Controls
Simple Real Time Search
When you use simple real time search, you enter a keyword to search for in the logs collected by AccelOps, set any columns you want to display in the Raw
Event Log Results Summary
, and, for multi-tenant deployments, select any organizations you want to filter the results for. You can then select results in the real time chart to use for historical searches, or you can select results in the Raw Event Log Results Summary to learn more information about them or use them as filters in refining your search.
This screenshot shows the results for searching the raw event logs for occurrences of
TCP
.
Simple Real Time Search Interface Controls
Ui Control Description
Filter Criteria
For simple real time search, use the search box to find keywords in raw event logs. You can also
create a rule from your search results
.
Select which columns will be displayed in the
Raw Event Log Results Summary Set Summary
Display
Columns
Organizations
Filter
For multi-tenant deployments, select which organizations you would like to filter the results for
Page 991
FortiSIEM Installation Guide FortiSIEM Installation Guide
Real Time
Chart
Raw Event
Log Results
Summary
Displays results as they occur in real time. Use the Pause, Fast Forward, Stop, and Clear buttons to control the display.
Displays a summary of the raw event logs for your search results in real time. Click
Pause
in the real time chart and then select an item in the summary results to view attributes such as Reporting and Destination IP, add an IP address to a watch list , add an attribute as a search filter, or get topological information about network devices. Selecting a result from the summary list also enables the , and
Locations
buttons.
Structured Real Time Search
For structured real time search, you only enter the filter conditions that you want to use, instead of having to also specify aggregation and group
by conditions as you would in a structured historical search .
This screenshot shows the
Conditions
dialog for structured real time search. You can structured real time search the same way you would in structured historical search.
to use in
This screenshot shows the
Conditions
dialog after having selected
Structured
in the search controls, with two search conditions set.
Page 992
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Simple Real Time Search
1.
2.
3.
4.
Log into your Supervisor node.
Go to
Analytics > Real Time Search
.
5.
In
Filter Criteria
, select
Simple
.
Enter the keywords you want to search for in the raw event logs collected by AccelOps.
See
Keywords and Operators for Simple Searches for more information about keyword searching.
Select the
Display Fields
for the results summary.
See
Selecting Attributes for Structured Searches and Display Fields
for more information about selecting attributes that can be displayed
6.
7. for reported events.
For multi-tenant deployments, select any
Click
Search
.
Organizations
that you want to filter the results for.
Related Links
Keywords and Operators for Simple Searches
Selecting Attributes for Structured Searches, Display Fields, and Rules
Page 993
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Structured Real Time Search
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
For
The
Analytics > Real Time Search
.
Filter Criteria
, select
Structured
.
Conditions
search window will open.
Click the downward arrow in the search window to open the
Conditions
options.
5.
Alternatively you can click to use a saved
6.
7.
Under
Conditions
, set the
...
Selecting Attributes for Structured Searches, Display Fields, and Rules
Click under
Row
to add another condition, and set the
Next Operator
to use for that condition.
You can give precedence to conditions by setting parentheses around them with the button under
Click
OK
.
Filter Criteria Set
.
, and
Value
for your condition.
for more information, and
for more information about using attributes in conditions.
+ Paren
.
You can also click
Save as Filter Criteria Set ...
8. window.
Under
Display Fields
, select the attributes you want to use as the columns in your results list.
9.
10.
See
and events to use as display fields.
For multi-tenant deployments, select the
Click
Search
.
Organization
you want to run the search against.
The results of your search will appear in the real time chart and results list.
Page 994
FortiSIEM Installation Guide FortiSIEM Installation Guide
Viewing and Refining Real Time Search Results
When your real time search runs, you will see the results represented as a scrolling chart across the top of the search results window, and as a scrolling list in the bottom of the window that include the raw event log information for events matching your search criteria. You can select items in the scrolling chart to use in historical search, view more information about individual items in the results list, and add attributes from your search results to your search filters or display fields.
Selecting Results for Historical Search
Viewing Information about Real Time Search Results
Adding Search Results to Search Filters. Watch Lists, or Display Fields
Selecting Results for Historical Search
1.
2.
When you see a time interval of events that you want to use for historical search appear in the scrolling chart, click
Pause
or
Stop
.
Hover your mouse cursor over the bar that represents the time interval until you see the time interval information appears, and then
3. double-click on the bar.
The time interval and Event Type will be added to the criteria for an historical search.
Complete the other criteria you want to use for the search as described in
.
Viewing Information about Real Time Search Results
1.
2.
3.
When you see an event appear in the search results list that you want more information about, click
Pause or Stop
.
Select the event row and click
To view information about specific attributes of an event, click in the attribute display field and click
For attributes associated with devices, this will open the
Quick Info
view of the device as described
4.
Quick Info
to view the , and
Destination IP
Quick Info
.
for that event.
. For events types, it will show info such as the severity and device associated with the even type.
To view information about a device's location in the network topology, select it in the display field and then select
Topology
.
Adding Search Results to Search Filters. Watch Lists, or Display Fields
With a search result selected in the results list, click
In the expanded
Filter
to select event attributes to add to the search filter.
Raw Events Log
, click on items in the text string to include or exclude them as search filter criteria.
To add a specific result to the search criteria, in the results list, click on an item in a display field to open the options menu, and then select
Add to Filter
.
To add an IP address to a watch list, click on it to open the options menu, and then select
See
Watch Lists for more information.
Add to Watch List
.
See the section on
Selecting Attributes from the Raw Event Log Column in the Results Lists
for Structured Searches and Display Fields
as search filters or display fields from the real time search results list.
in the topic Selecting Attributes
for information on how you can view and select the attributes associated with events to use
Page 995
FortiSIEM Installation Guide FortiSIEM Installation Guide
Structured Search Operators
Operator
=, !=
>, >=, <, <=
IN, NOT IN
BETWEEN,
NOT
BETWEEN
Determines whether an attribute is between a range of values
REGEXP,
NOT
REGEXP
Meaning
Compares whether an attribute is exactly identical or not identical to a specified value
Compares whether an attribute is less or greater than a specified value
Determines whether an attribute belongs or does not belong to a set of values. For string valued attributes, the match is case insensitive.
Determines whether a string valued attribute matches a specified pattern. Raw message needs to be UTF-8 encoded.
Allowed on
Event Attribute
Types or CMDB
Group
All except DATE types
Numeric types:
UINT16, UINT32,
UINT64, DOUBLE
All except DATE type
Allows CMDB
Groups
All except STRING types
IS (NULL),
IS NOT
(NULL)
CONTAINS,
NOT
CONTAINS
Determines whether an attribute is present or not
Determines whether a string valued attribute contains a specified sub-string.
For Raw Event Log - the sub-string has to contain the beginning of every word
For all other string type attributes: the sub-string can be in any position
All types
STRING
STRING
Example as seen in GUI
Event Type = "PH_DEV_MON_SYS_CPU_UTIL"
Source IP != 10.1.1.1
CPU Util > 10
System Event Category IN (3,6)
Event Type IN
("PH_DEV_MON_SYS_CPU_UTIL","PH_DEV_MON_SYS_MEM_UTIL")
Event Type IN ("PH_DEV_MON_SYS_CPU_UTIL",Event Types:Login
Failure)
Source IP IN Devices:Windows, Devices:Unix
Destination IP IN Networks:VPN Pool
Source IP BETWEEN (10.1.1.1, 10.1.1.255)
CPU Util BETWEEN (20.0, 30.0)
Event Receive Time BETWEEN (18:35 03/17/2014, 18:35 03/26/2014)
Host Name IS NOT NULL
Event Type CONTAINS "DEV_MON" matches "PH_DEV_MON_CPU"
Event Type NOT CONTAINS "DEV_MON" does not matche
"PH_DEV_MON_CPU"
Reporting Model CONTAINS "dows" matches "Microsoft Windows"
Reporting Model CONTAINS "soft win" matches "Microsoft Windows"
Raw Event Log CONTAINS "dows" does not match "Microsoft Windows"
Raw Event Log CONTAINS "microsoft win" matches "Microsoft Windows
2003"
(For more general patterns use regular expressions)
Raw Event Log REGEXP "\d+.\d+\d+.\d+"
Event Type NOT REGEXP "PH_DEV_MON_.*" - match events with event types not beginning with PH_DEV_MON
Page 996
FortiSIEM Installation Guide FortiSIEM Installation Guide
Selecting Attributes for Structured Searches, Display Fields, and Rules
For both Real Time and Historical structured searches you have the option to to select event attributes to use in both your search and
Group By
lters, and as display fields in your result lists. Since AccelOps recognizes over 130,000 event attributes, the documentation and user interface
fi provides several ways to find the attributes you want to use. These instructions show how to access the
Common Attributes
menu and the
CMDB attribute browser through the
Raw Event Logs
Attributes
in search conditions, but you can access the same functionality in the
column of results lists.
Display Fields
menu for searches, and when you create a new rule. They also contain information on how you can access the attributes associated with reported events through the
The Event Dictionary and Master Attribute List
Selecting Attributes in the Common Attributes Menu
Selecting Event Attributes from the CMDB
Selecting Attributes from the Raw Events Log Column of the Results Lists
The Event Dictionary and Master Attribute List
This documentation includes an returned.
that describes events and their attributes, and an attribute master list , which lists the primary event attributes and their data type, along with a brief description of what values AccelOps expects to see when that attribute information is
Selecting Attributes in the Common Attributes Menu
This screenshot shows the
Common Attributes
menu open in the Conditions Builder for an Historical search. Open the menu by clicking the downward arrow next to an
Attribute
text field. You can scroll through the list of event attributes to select the one you want, or begin typing an attribute name and the menu will sort based on your entry.
Selecting Event Attributes from the CMDB
You also have the option to browse all the attributes listed in the CMDB to find the one that you want. These two screenshots show the CMDB
...
Attribute
text field.
The first screenshot illustrates browsing the CMDB attributes based on
Device Type
and
curity All Security
has been selected for
Feature Type
the security attributes associated with the Cisco IOS into the Attribute List.
, and
Cisco IOS
has been selected for
, ,
Device Type
,
. This loads all
Page 997
FortiSIEM Installation Guide FortiSIEM Installation Guide
The second screenshot illustrates browsing the CMDB Event Types to find an event attribute. In this example,
Cisco ASA
Type
. Clicking in the Event Type window opens an Event Browser for the CMDB. Select any group in the browser, and you will see the event types within that group that are applicable to the Device Type you selected.
is selected for
Device
Selecting Attributes from the Raw Events Log Column of the Results Lists
All
real time search results lists include a Raw Event Log column, and you can
searches add a a Raw Event Log column to the list of results for historical
Page 998
FortiSIEM Installation Guide with a reported event and add them to the display fields in your results list or to your filters for structured searches.
1. Cilck in the
2.
Raw Event Log
column of your results list to collapse the view.
The raw event log text will collapse into an information icon with a blue .
Click on the blue icon to open the
Event Details
.
+
3.
4.
You will see the raw event log text and list of all the attributes associated with that event type.
Select
X
Filter
or
Display
to add an attribute to the search filters or display fields for that search.
Click to close the Event Details window when you're done making your selections.
FortiSIEM Installation Guide
Page 999
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using Expressions in Structured Searches and Rules
An expression can contain a single event attribute, multiple attributes, or functions that contain an event attribute as their argument. You can also use parentheses and arithmetic operators to form complex expressions.
You can enter an expression manually, paste it in, or build it dynamically using the Expression Builder. If you use the Expression Builder, you will have to enter parentheses or arithmetic operators in the expression.
Aggregation Condition Functions
The Expression Builder
You can access the Expression Builder by clicking the icon next to the
Attribute
or
Value
field when creating a structured search or rule.
This screenshot shows the Expression Builder open for creating a rule.
Creating Expressions
Adding a Function
To add a function to the expression, select it from the
Add Function +
you are are creating an expression to use as part of a filter condition for a search or rule, or as part of the
aggregation conditions for a rule .
Selecting Function-Specific Attributes
When you select any type of function, the function and a set of parentheses will be added to the expression. If you place your cursor within the parentheses and then open the
Event Attribute
menu, you will see event attributes that are relevant for that function. For example, if you select COUNT as the function, (MATCHED ITEMS) will automatically appear between the parentheses, and will be selected in the Event Attribute menu. If you select a function like
AVG
for an aggregation condition, you will see options such as
UTIL
and
nerable Since
cting Attributes for Structured Searches, Display Fields, and Rules
attributes.
Apache Uptime
. If you select a function like
HourOfDay
for a filter condition, you will see options like
Access Time
CPU
and
. You can search through the options in either situation by beginning to type a keyword in the Event Attribute menu.
has more information about ways to search for and select event
Vul
Filter Condition Functions
If you select HourOfDay or DayOfWeek for the function, the
Event Attributes
menu will contain date and time-related event attributes, while if you select
DeviceToCMDBAttr
, it will contain device-related attributes.
Function
HourOfDay
DayOfWeek
Description
Specify an hour of the day in the condition
Specify a day of the week in the condition
Page 1000
FortiSIEM Installation Guide FortiSIEM Installation Guide
DeviceToCMDBAttr If you add the
DeviceToCMDBAttr()
function to the expression, the first argument must be an event attribute, and the second argument must be a CMDB attribute, which you can select using the
DeviceToCMDBAttr function is used to create expressions for
CMDB Attribute
menu. The
This screenshot shows the beginning of creating an expression to use as the
Attribute
in a condition for an historical search.
HourOfDay
is selected as the
Function
, and
Access Time
is selected as the
Event Attribute
.
Aggregation Condition Functions
You use these functions to perform operations on numerical event attributes such as
Utilization
.
, , , or
Memory
Function
Count
Description
Count the number of items returned
Count Distinct
Count the number of distinct items returned
Sum
Average
Min
Add the numbers
Average the numbers
The lowest number
Max
Last
First
Pctile95
The highest number
The last number
The first number
The 95th percentile
PctChange
STAT_AVG
Percentage change
Statistical average. This function is used in conjunction with creating baseline reports
.
This screenshot shows the beginning of creating an expression to use as an aggregation condition in rule.
Max
is selected as the
CPU Util
is selected as the
Event Attribute
.
Function
, and
Page 1001
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 1002
FortiSIEM Installation Guide FortiSIEM Installation Guide
Keywords and Operators for Simple Searches
Both historical and real time searches have a simple search option that searches for keywords in the raw ASCII tex of event logs. You can use operators in your keyword searches to combine terms or create simple search filters.
Examples of Using Keyword Search Operators
Quotes and Backslash Characters in Search Terms
Keyword Operators
You can use the operators , , between keywords. If you enter more than one keyword, then
AND
is assumed as the operator
Examples of Using Keyword Search Operators
Search String
TCP
Results
Finds all events with
TCP
in the event logs
TCP 80
Finds all events with
TCP 80
TCP AND (80 OR 443) Finds all events with
TCP 80 40
TCP AND NOT 80
Finds all events with
TCP
but not
80
Quotes and Backslash Characters in Search Terms
If the search string contains quotation marks or back-slash characters, you must escape them by prefixing them with a backslash character. For example, if you wanted to search for your search string.
[location]="United States"
then you would need to enter
[location]=\"United States\"
as
Page 1003
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using Geolocation Attributes in Searches and Search Results
When you view the results of a search, you will see that IP address fields in the results, such as attributes, and provides examples of how to use this information in searches and search results.
Source IP
or Destination IP, often have a flag added to them to indicate the geolocation of that IP address. This topic describes the geolocation information that is associated with event
Event and Geolocation Attributes
Using Geolocation Attributes in Searches
Viewing Geographic Locations from Search Results
Event and Geolocation Attributes
The event attributes
ent Target
, as display fields in search results. In
,
Incident Reports
, and
you may also see country flags included with IP addresses for
, which have the same geolocation attributes as
Reporting IP
Source IP
and
include geolocation attributes that you can use in search queries and
Destination IP.
Incident Source
and
Incid
Event Attribute Geolocation Attributes
Source IP
Source Country
Source City
Source State
Source Organization
Source Longitude
Source Latitude
Destination IP
Destination Country
Destination City
Destination State
Destination Organization
Destination Longitude
Destination Latitude
Host IP
Reporting IP
Host Country
Host City
Host State
Host Organization
Host Longitude
Host Latitude
Reporting Country
Reporting City
Reporting State
Reporting Organization
Reporting Longitude
Reporting Latitude
Using Geolocation Attributes in Searches
You can use geolocation attributes in both real time and historical structured searches. For example, setting a search attribute to
Source Country
!= United States
will remove all Source IPs with a geolocation of United States from the search results.
This screenshot shows the results of using
Source Country != United States
and
Event Severity = 1
as the search criteria. The Source IP display field contains only IP addresses associated with countries other than the United States, as indicated by the national flags next to each IP address in the Source IP column.
Page 1004
FortiSIEM Installation Guide FortiSIEM Installation Guide
If you use a geolocation attribute such as Source Country as a
Display Field
or
Group By
information for that attribute, rather than a national flag.
condtion, then the results will include name
This screenshot shows the results of the same query used previously, but with
Group By = Source Country
.
Page 1005
FortiSIEM Installation Guide FortiSIEM Installation Guide
Viewing Geographic Locations from Search Results
If your search results contain geographic information, click the
Locations
button to view that information on a map.
This screenshot shows the results for the first example query presented in a map. Clicking on a number in the map will provide you with an overview of incidents for that location.
Page 1006
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Filter Criteria and Display Column Sets
When you create searches, you have the option to select saved filter criteria and column sets to use. This topic describes how to create those sets.
1.
2.
3.
4.
Log in to your Supervisor node.
In the tab, select either
Display Column Sets
or
Filter Criteria Sets
, depending the type of set you want to create.
Click
Analytics
New
.
Add the filter criteria or display columns that you want to the set.
See
Using Expressions in Structured Searches
and
Selecting Attributes for Structured Searches and Display Fields
for more information
5. about building searches and display columns.
Click
Save
.
You set will be saved to the list of sets, and you will be able to use it in searches by clicking the button next to the
Filter Criteria
text field in structured searches or the
Display Columns
menu for both structured and simple searches.
Saving Sets from Searches
Whenever you create a set of filter criteria for a structured search, or a set of display columns for both simple and structured search, you can save it by clicking the
Save as Filter Criteria Set
or
Save As Display Column Set
button.
Related Links
Using Expressions in Structured Searches and Rules
Selecting Attributes for Structured Searches, Display Fields, and Rules
Page 1007
FortiSIEM Installation Guide FortiSIEM Installation Guide
Rules
FortiSIEM continuously monitors your IT infrastructure and provides you with information you can use to analyze performance, availability, and security. There may also be situations in which you want to receive alerts when exceptional, suspicious, or potential failure conditions arise. You can accomplish this by using rules that define the conditions to watch out for, and which trigger an incident when those conditions arise. This incident will appear on the
Incident Summary dashboard , and you can also configure
that will send email and SNMP alerts that the incident has occurred. FortiSIEM includes over 500 system-defined rules, which you can see in
Analytics > Rules
, but you can also create your own rules as described in the topics in this section.
Additional Information in the Help Center
You can find more information about rules and incidents, including troubleshooting tips, in the Rules and Incidents section of the Help
Center maintained by FortiSIEM Support.
Example of a Rule with a Single Condition Sub-Pattern
Example of a Rule with Multiple Sub-Patterns
Defining the Incident Generated by a Rule
Activating and Deactivating Rules
Running Historical Searches to Test Rule Sub Patterns
Setting Rules for Event Dropping
Setting Rules for Event Forwarding
Setting Global and Per-Device Threshold Properties
Using Geolocation Attributes in Rules
Using Watch Lists as Conditions in Rules and Reports
Page 1008
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Rules
FortiSIEM constantly monitors your IT infrastructure for events and collects information about them, but you can also set rules that will trigger incidents from events and send notifications when they occur. These topics describe the concepts and processes for creating rules.
Example of a Rule with a Single Condition Sub-Pattern
Example of a Rule with Multiple Sub-Patterns
Defining the Incident Generated by a Rule
Page 1009
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Rule
Creating a new rule involves defining the attributes of the incident that is triggered by the rule, as well as the triggering conditions and any exceptions or clear conditions.
Creating New Rules from Clones
You can also create a rule by cloning an existing rule
and editing it.
Restriction on names
Do not use certain keywords in subpattern names regexp
1.
2.
3.
4.
5.
6.
Log in to your Supervisor node.
Go to
Analytics > Rules
.
Select the group where you want to add the new rule.
Click
Enter a
Rule Name
and
For
New
.
Status
Description
, keep the rule
Inactive
.
.
after you're finished creating and testing it.
7. Select an
Incident Category
You can click
Add
for the incident triggered by the rule.
and enter a custom incident category.
8. Select a
Severity
to associate with the incident triggered by the rule.
9. Select
Update the Perf Status column on summary dashboard
if you want the incident to display in the of the
Exec Summary
dashboard.
10. For
Attributes
, enter the functional area, such as
Security
, that you want to associate the rule with.
Performance Status
column
11.
12.
Enter a Notification Frequency for how often you want notifications to be sent when an incident is triggered by this rule.
Under
Conditions
, click
Add Subpattern
to create the rule conditions.
See
examples of rules with
and
13. Enter the time interval during which the rule conditions will apply.
The minimal interval is
120
seconds.
14. Next to Actions, click Edit to define the incident that will be generated by this rule.
See
Defining the Incident Generated by a Rule
for more information.
One Incident Definition Required to Save
You must have at least one incident defined before you can save your rule.
15. Next to
See
Watch Lists
, click
Edit
to add a
watch list to the rule.
16. If you want to define any Exceptions for the rule, click
Edit
.
17.
See
Defining Rule Exceptions for more information.
18.
If you want to define any
See
Click
Save
.
Clear Conditions
for the rule, click
Defining Clear Conditions for more information.
Edit
.
Your new rule will be saved to the group you selected in an inactive state. Before you
.
Page 1010
FortiSIEM Installation Guide FortiSIEM Installation Guide
Defining Rule Conditions
Rule conditions define the event attributes and thresholds that will trigger an incident. Rule conditions are built from sub-patterns of event attribute filters and aggregation functions. You can specify more than one subpattern and the relationships and constraints between them.
Setting the Relationship between Subpatterns
Setting Inter-subpattern Constraints
Examples of inter-subpattern relationships and constraints
Specifying a Subpattern
A subpattern defines the characteristics of events that will cause a rule to trigger an incident. A subpattern involves defining event attributes that will be monitored, and then defining the threshold values for aggregations of event attributes that will trigger an incident.
Example of a rule with a single subpatten
This screenshot shows an example of a subpattern with a single event filter and a single event aggregation condition. Expressed as a sentence, this rule would be "When there are more than three events on a single Host IP where average CPU utlization is equal to 95%, trigger an incident."
Event Filters
Event filter criteria determine which event attributes and values will be monitored by the rule, and are set in a way that is similar to the way you set
event attributes for structured historical searches and
. See
Selecting Attributes for Structured Searches, Display Fields, and
Rules for more information on finding attributes to use in your event filters.
Event Aggregation
While you could have a rule that triggers an incident on a single instance of a particular event, it is more likely that you will want your rule to trigger an incident when some number of events have been found that meet your event filter criteria.
Group By Attributes
This determines which event attributes will be used to group the events before the group constraints are applied, in a way that is similar to the way
Page 1011
FortiSIEM Installation Guide FortiSIEM Installation Guide the Group By attribute is used to aggregate the results of structured searches.
Aggregate Conditions
The group aggregation conditions set the threshold at which some aggregation of events will trigger a rule to create an incident. You create an aggregation condition by using the
Expression Builder
to set a function, and then enter the
Examples of Group By and Aggregate Conditions Settings
Operator
and
Value
for the aggregation condition.
Scenario Aggregate Conditions
10 or more events
Connections to 100 or more distinct destination IPs from the same source
IP
Connections to 100 or more distinct destination IPs from the same source
IP on the same destination port
Average CPU Utilization on the same server > 95% over 3 samples
Logins from the same source workstation to 5 or more accounts on the same target server
Group By
Attributes
none
Source IP
Source IP, Destina
tion Port
Host IP
Source IP, Destina
tion IP
COUNT(Matched events) >= 10
COUNT (DISTINCT Destination IP) >=
100
COUNT (DISTINCT destination IP) >=
100
COUNT (Matched Events) >= 3 AND
AVG(CPU Util) > 95
COUNT(DISTINCT user) >= 5
Setting the Relationship between Subpatterns
Example of a rule with multiple subpatterns
If you have more than one sub-pattern, you must specify the relationship between them with these operators.
Operator
AND
OR
Meaning
Sub-pattern P1 AND Sub-pattern P2 means both sub-patterns P1 and P2 have to occur
Sub-pattern P1 OR Sub-pattern P2 means either P1 or P2 have to occur
FOLLOWED-BY
AND-NOT
Sub-pattern P1 FOLLOWED-BY Sub-pattern P2 means P1 has to be followed by P2 in time
Sub-pattern P1 AND-NOT Sub-pattern P2 means P1 must occur while P2 must not; the time order between P1 and
P2 is not important
NOT-FOLLOWED-BY Sub-pattern P1 NOT-FOLLOWED-BY P2 means P1 must occur and P2 must not occur after P1
Setting Inter-subpattern Constraints
You may want to relate attributes of a sub-pattern to the corresponding attributes of another sub-pattern, in a way that is similar to a JOIN operation in an SQL, by using the relationship operators , , , , , .
Examples of inter-subpattern relationships and constraints
Scenario
5 login failures from the same source to a server not followed by a successful logon from the same source to the same server
An security attack to a server followed by the server scanning the network, that is, attempting to communicate to 100 distinct destination IP addresses in 5 minute time windows
Average CPU > 95% over 3 sample on a server AND Ping loss
> 75%
Sub-pattern
P1 - filter
Event type =
Login
Success
Event type =
Attack
Event Type =
CPU_Stat
P1 -
Group-by attribute set
Source IP,
Destination
IP
Destination
IP
Host IP
P1 Group constraint
COUNT
(Matched Event)
>= 5
COUNT
(Matched Event)
> 0
COUNT(Matched
Event) >= 3 AND
AVG(cpuUtil) >
95
Sub-pattern
P2 filter
Event type =
Login failure
Event Type =
Connection
Attempted
Event Type =
PING Stat
P2-group-by attribute
Source IP,
Destination IP
Source IP
Host IP
P2 group constraint
Inter-P1-P2 relationships
COUNT
(DISTINCT
Destination IP) >
100
P1 FOLLOWED_BY
P2 pingLossPct > 75 P1 AND P2
Inter-P1-P2 constraints
COUNT(Matched
Event) > 0
P1
NOT_FOLLOWED_BY
P2
P1's Source
IP = P2's
Source IP
P1's
Destination IP
= P2's Source
IP
P1's Host IP
= P2's Host
IP
Page 1012
FortiSIEM Installation Guide FortiSIEM Installation Guide
Example of a Rule with a Single Condition Sub-Pattern
This topic shows an example of how to create a rule with a single sub-pattern based on the condition that Average CPU on a server is more than
95% over 3 sample measurements.
Attribute Group By Attribute Aggregate Conditions
Avg CPU Util Host IP COUNT (Matched Event) >= 3
1.
2.
3.
4.
5.
6.
7.
8.
For
Rule Name
, enter
For
Description
enter
For
Severity
, select
For
Attributes
Set the
All
Notification Frequency
for
Next to
Conditions
, click
Add Subpattern
.
For
9 - High
, select .
Subpattern Name
Hi Avg CPU
.
Average CPU on a server is more than 95% over 3 sample measurements
.
, enter
Pattern 1
.
Under Filters, set these options:
1 Hour
.
.
Option Setting
Attribute Avg CPU Util
Operator >=
Value
95
9. Under
Aggregate Conditions
, click the
Attribute
field, select
COUNT(Matched Events)
from the
10.
Add Function
Under
Aggregate Conditions
11. Under
Group By
, select
Host IP
.
12. Click
Save
.
menu, and then click
OK
=
.
, select for
Operator 3 Value
.
13.
14.
Enter for the time interval during which the conditions will apply.
You would now complete the rule by
Defining the Incident Generated by a Rule
, and any
or
. You could also
a ssociate it with a notification policy .
This screenshot shows the subpattern settings for this example.
Page 1013
FortiSIEM Installation Guide FortiSIEM Installation Guide
The following steps describe how to create a rule that matches the above example 1 :
1.
2.
3.
4.
Enter a name for the rule in the 'Rule Name' text box.
Enter a description for the rule in the 'Description' text box.
Use the drop down menu to choose a 'Severity' for the rule.
Click on the '+ Add Condition' button.
5.
6.
7. a. b. c. d.
Chose the 'Function' for the rule. In this case 'AVG' is chosen.
Choose the 'Attribute' for the rule. In this case 'CPU Util' is chosen.
Chose the 'Operator' for the rule. In this case '>=' is chosen.
Enter the 'Value' for the rule. In this case '95' is entered.
Select the devices to apply the rule to.
Enter the number of events that must occur for the rule to fire. In this case '3' is used.
Enter the time frame for the rule. In this case '600' seconds is used.
Page 1014
FortiSIEM Installation Guide FortiSIEM Installation Guide
Example of a Rule with Multiple Sub-Patterns
This topic provides an example of a rule with two sub-patterns, and also how to use the
Event Type
attribute as a filter.
Defining the Relationship Between Patterns
Defining the Incident to be Generated by the Rule
Rule Conditions
The purpose of this rule is to trigger an incident when five login failures from the same source to a server are not followed by a successful login from the same source to the same server within one hour. This requires two sub-patterns, the first one to detect "five login failures from the same source to a server," and a second one to detect "a successful logon from the same source to the same server." The two sub-patterns need to be interrelated to make the complete rule.
Sub-pattern 1 (P1)
Event Filter Attribute Group By Attributes Aggregate Conditions
Event type = Logon Failure Source IP, Destination IP COUNT (Matched Event) >= 5
Sub-pattern 2 (P2)
Event Filter Attribute Group By Attributes Aggregate Conditions
Event type = Logon Success Source IP, Destination IP COUNT(Matched Event) > 0
P1/P2 Interrelationships and Constraints
Interrelationships Constraints
P1 NOT_FOLLOWED_BY P2 P1's Source IP = P2's Source IP, P1's Destination IP = P2's Destination IP
Creating Sub-Pattern P1
The following steps describe how to create a rule that matches the above example 2 :
5.
6.
7.
8.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Analytics > Rules
.
Click
New
.
For
Rule Name
, enter
Suspicious Login Failure
.
For
Description
, enter the rule conditions stated in the introduction to this topic.
For
Severity
, select
10 - High
.
For
Attributes
, select .
Next to
Conditions
, click
Add Subpattern
.
9.
You will now create the first subpattern for "five login failures from the same source to a server.".
10.
11.
12.
13.
For
Subpattern Name
, enter
LogonFailures
.
To create this sub pattern you will want to specify that all types of logon failures should be monitored. For this reason, you will want to specify an entire folder of event types as the rule condition, rather than a single attribute of a event.
For
Attribute
, select
For
Operator
For
Value
Event Type
.
, select .
, click to open the
14.
15.
16.
17.
In the CMDB Browser, go to
Under
For
For
...
Event Types > Security > Logon Failure
Aggregate Conditions
Operator
Value
, enter .
>=
18.
19.
Under
Group By
5
, enter
Enter
Destination IP
.
Click
Save
.
CMDB Browser
.
, click the
, and click
Attribute
Folder >>
and select
Group By
to select the
attribute.
Logon Failure
COUNT(Matched Events)
.
events group.
Your filter condition, as shown in the screenshot, can be read as "For any type of event in the Logon Failure event group . . ."
This screenshot shows the complete entry for sub-pattern P1.
Page 1015
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Sub-Pattern P2
1.
2.
3.
4.
In your rule, next to
Conditions
, click
Add Subpattern
.
For
Subpattern Name
For
Attribute
, select
, enter
LogonSuccess
.
Event Type
.
5.
6.
For
For
Operator
Value
, select .
, click to open the
CMDB Browser
This button only becomes active if you select
.
Event Type
as an attribute.
In the CMDB Browser, go to
Event Types > Security > Logon Failure
, and click
Folder >>
to select the
7.
8.
9.
10.
11.
12.
Your filter condition, as shown in the screenshot, can be read as "For any type of event in the Logon Failure event group . . ."
Under
For
For
Operator
Value
Under
Group By
Enter
Click
Aggregate Conditions
, enter .
, enter .
, enter
Destination IP
Save
.
.
, click the
Expression Builder icon next to
Attribute
, and then click to add another
and select
Group By
attribute.
Logon Failure
events group.
COUNT(Matched Events)
.
This screenshot shows the complete entry for sub-pattern P2.
Page 1016
FortiSIEM Installation Guide FortiSIEM Installation Guide
Defining the Relationship Between Patterns
You will now see both of your sub-patterns listed under the
Conditions
for your rule definition.
1. Makes sure that
LogonFailures
is selected as the first pattern under
If this Pattern occurs
, and under
Next Op
, select
2.
3.
4.
5.
6.
7.
8.
ED_BY
.
Select
LoginSuccess
as the second subpattern.
Click
AddSubpattern Relationship
.
For the first relationship definition, select
For the second subpattern, select
Under
Row
, click .
For the second relationship definition, for the first subpattern, select r
Operator
.
For the second subpattern, select
LogonFailures
LogonSuccess
for
for
Subpattern Source IP
Subpattern Source IP
for
LogonFailure
for
Attribute
Attribute
, and
for
AND
,
LogonSuccess for Subpattern, and Destination IP for Attribute.
=
for
Operator
Next Op.
for
.
NOT_FOLLOW
Attribute =
This screenshot shows the full pattern and relationship definition for the two subpatterns.
Defining the Incident to be Generated by the Rule
1.
2.
3.
4.
5.
6.
Attribute
.
7.
In your rule definition, click
Edit
next to
Generate Incident
.
For
Incident Name
, enter
Under
Incident Attributes
, select
Under , click .
For the second incident attribute, select the
Row +
Selected Attributes
.
Click
OK
.
Suspicious_Login_Failure
Source IP
for
Under
Triggered Event Attributes
, make sure that
.
,
Destination IP
for ,
This screenshot shows the complete Incident Definition.
for
Subpattern
, and
Source IP
for
Filter Attribute
.
,
for
Subpattern
, and
Destination IP
for
Filter
, and
Raw Event Log
are listed in
Page 1017
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 1018
FortiSIEM Installation Guide FortiSIEM Installation Guide
Defining the Incident Generated by a Rule
Defining an incident involves setting attributes for the incident based on the subpatterns you created
, and then setting attributes for the incident that will be used in
and
.
One Incident Definition Required to Save
You must have at least one incident defined before you can save your rule.
1.
2.
3.
In the rule you want to define an incident for, click
Edit
next to
Enter an
Under
Incident Name, Display Name
Incident Attributes
, and
Description
.
Actions: Generate Incident
.
, you will define attributes for the incident based on the set for your sub patterns. Typically you will set the Incident attributes to be the same as the Group by attributes in the subpattern.
a. b. c. d.
Select the
Select a
Event Attribute
you want to add to Incident.
Subpattern
In the
Filter
.
This will populate values from the
Group By
Group By
and
Aggregate Conditions
attributes you
attributes in the subpattern to the
Filter Attribute
menu.
menu, select the attribute you want to set as equivalent to the
Event Attribute
.
Incident Definition Settings for the Single Subpattern Example
In the
Pattern1
has the
Group By
attribute set to
Conditions
attribute set to shown in this screenshot.
COUNT(Matched Events)
Host IP
, and the
Aggregate
. You can then select these to set as the incident attributes as
4. Under
Triggered Event Attributes
, select the attributes from the triggering events that you want to include in dashboards and analytics
5. for this event.
This is pre-populated with typical attributes you would want included in an incident report.
Click
OK
.
Page 1019
FortiSIEM Installation Guide FortiSIEM Installation Guide
Defining Rule Exceptions
Once you activate a rule, it continuously monitors your IT infrastructure for conditions that would trigger an event. However, you may also want to define exceptions to those conditions. For example, you may know that a server will be going down for maintenance during a specific time period and you don't want your
Server Down - No Ping Response
rule to trigger an incident for it.
1.
2.
3.
In
Analytics > Rules
, select the rule you want to add the exception to, and click
Next to
Exceptions
, click
Select an
Attribute
and
Edit
.
Operator
, and enter a
Edit
.
4.
5.
6.
The values in the Attribute menu are from the
Enter any
Click
OK
.
Notes
about the exception.
Value
, for the conditions that will prevent an incident from being generated.
Event Attributes
associated with the incident definition .
Click the + icon to set an effective time period for the exception.
You can set effective time periods for single and recurring events, and for durations of time from hours to days.
Exception Condition for the Single Subpattern Example
This screenshot shows the exception conditions for the single sub-pattern example
, where a specific server is set as an exception to the
Host IPs that will trigger incidents during the maintenance period from March 9 to March 16 2015, starting at 14:00 Pacific Time for every day during that period, and lasting for 8 hours each day. The two
Attribute
options are populated from the attributes associated with the incident definition for the example .
Page 1020
FortiSIEM Installation Guide FortiSIEM Installation Guide
Defining Clear Conditions
Clear conditions specify conditions in which incidents will have their status changed from
Active Cleared
. You can set the time period that must elapse for the clear condition to occur, and then set the conditions based on the triggering of the original rule, or on a sub pattern based on
1.
2.
3.
4.
In
Analytics > Rules
, select the rule you want to add the clear condition to, and click
Edit
.
Next to
Clear Condition
, click
Edit
.
Set the
Time Period
that should elapse for the clear condition to go into effect.
If you want the clear condition to go into effect based on the firing of the original rule, select t
he Original Rule Does Not Trigger
5.
For example, if you wanted the clear condition to change the status of triggered for ten minutes, you would set
Active
Cleared Within 10 Minutes
incidents to
If you want to base the clear condition on a sub-pattern of the incident attributes, select
Cleared
and select this option.
.
after the original rule had not been
6.
7. Click
Save
.
Edit
icon next to the clear sub pattern.
the following conditions are met
.
The incident attributes from your rule will load and the clear condition attributes will be set to match.
Define the pattern to use by clicking the
Clear Condition for the Single Subpattern Example
This screenshot shows the exception condition settings for
the example of a rule with a single subpattern
. In the original rule, an incident was generated if there were three events over 10 seconds where
Avg CPU Util
exceeded 95% on a single host. In this example, those incidents will change status from from
Util
is under 100%
to if there are three events over 10 seconds where
Avg CPU
Page 1021
FortiSIEM Installation Guide FortiSIEM Installation Guide
Testing a Rule
After you've created or a edited a rule, you should test it to see if behave as expected before you activate it. This topic describes how to test a rule using synthetic events.
Troubleshooting for Rule Testing
Procedure
1. Go to
Analytics > Rules
you want to test.
Cloning Active Rules for Testing
You cannot test an active rule. If you can't deactivate a rule for testing, you can
clone an inactive version of it
.
2. Select the rule, and then click
Test Rule
.
3.
This will open the
Enter a
Rule Debugger
.
Reporting IP
where the synthetic event should originate from.
Reporting IP Group Membership
If the rule you're testing specifies that the
Reporting IP
Reporting IP you enter here is in that group.
should be a member of a group, you should make sure that the
4.
5.
6.
Under
Raw Event
, enter the raw event log text that contains the triggering conditions for the rule.
Under
Pause
, enter the number of seconds before the next test event will be sent, and then click under events.
You will need to create as many events as are necessary to trigger the rule conditions.
Click
Run Test
.
If the test succeeds you are now ready to
+ Action
to enter additional test
Test Results
The test will run through a four stage process, which you can observe in the
us
column for the rule to indicate that the test is running.
Test Results
tab of the rule. A yellow icon will also appear in the
Stat
1.
2.
Rules are checked for syntax errors.
Events are parsed and sent to Rule Workers.
If there are errors in the rule syntax or event parsing errors, see the examples under Troubleshooting for Rule Testing for suggestions on how to correct them. As events are being parsed, you can view their
Event Details
by clicking on the event.
Raw Event Log
icon next to the
3. Rule Worker nodes evaluate the events against the rule conditions, and if they match, they are sent to the Rule Master.
4. The Rule Master creates incidents, which then appear in the Incidents dashboards.
When the test successfully completes, a green icon will appear in the
Status
column next to the rule name.
Test Example
This screenshot shows the example of a test for the rule the
Multiple Admin Login Failures: Net Devices
. The conditions for this rule are that the
Reporting IP
must belong to a network device, and there must be 3 login failure events from the same IP and user.
Page 1022
FortiSIEM Installation Guide FortiSIEM Installation Guide
Troubleshooting for Rule Testing
If the test fails, a red icon will appear under the
Status
column next to the rule name, and you will see the error message in the for the rule.
Test Results
tab
Rule Syntax Error
The rule is changed to introduce the following error
Rule testing fails as shown below
Page 1023
FortiSIEM Installation Guide FortiSIEM Installation Guide
Rule Semantics Error
This means that the conditions of the rule were not met by the event. For example, if five events were required to meet the condition, but only one was sent.
Event Parsing Error
This means that some text in the raw event log did not pass the event parser. For example, if "denied" is the term expected by the parser in the test example, but the raw event log contains the term "deny," then the event will not pass the parser.
Page 1024
FortiSIEM Installation Guide FortiSIEM Installation Guide
Activating and Deactivating Rules
When you create a new rule, you must activate it before it will start to monitor events. You may also want to deactivate a rule, for example to
, instead of deleting it from the system.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Analytics > Rules
.
Browse or search to find the rule that you want to activate or deactivate.
Select
Active
for the rule you want to activate, or clear the Active option if you want to deactivate a rule.
Activating Rules for Multi-Tenant Deployments
For multi-tenant deployments you can activate or deactivate rules for individual organizations, and also set default rules for all organizations.
1.
2.
3.
4.
5.
6.
Navigate to the rule that you want to activate, deactivate, or set as default.
In the
Summary
tab of the rule, click
Next to
Status
, click
Edit
.
Edit
.
To set this rule as a default rule for all organizations, select
Save
.
Activation Default
.
7.
Select an organization to activate the rule for, or clear its selection to deactivate the rule.
Click
Click
OK
.
Page 1025
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding a Watch List to a Rule
1.
2.
3.
4.
5.
Go to
Analytics > Rules
.
Select the rule you want to add the watch list to, and then click
Edit
.
Next to
Watch Lists
, click
Edit
.
Select the watch list you want to add, and use the
For
Incident Attribute
Add >>
button to add it to the rule.
, select the incident information you want to add to the watch list.
Watch List Attribute Type Must Match Incident Attribute
The
Type
that you set for the watch list must match the
Incident Attribute Types
for the rule. For example, if your watch list
Type is , and the Incident Attribute Type for the rule is
string
, you will not be able to associate the watch list to the rule.
6. Click
OK
Next to
.
Watch Lists
, you will see
Watch List has been defined
.
Page 1026
FortiSIEM Installation Guide
Cloning a Rule
You can clone a rule to use it as the basis for
creating another rule , or to use in
.
1.
2.
3.
4.
5.
Log in to your Supervisor node.
Go to
Analytics > Rules
.
Search or browse to select the rule you want to clone.
Click
Clone
.
Enter a new name for the cloned rule and click
OK
.
The cloned rule will be added to the same group as the original rule but will be inactive.
FortiSIEM Installation Guide
Page 1027
FortiSIEM Installation Guide FortiSIEM Installation Guide
Running Historical Searches to Test Rule Sub Patterns
If you are trying to analyze why a rule is triggering an excessive number of incidents, or why it isn't triggering any, you can run an historical search with the rule sub patterns to see how the sub pattern behaves in relation to past events. If the search has interesting results, you can then
.
1.
2.
3.
4.
5.
6.
Go to
Analytics > Rules
.
Select a rule and then click
Edit
.
Click
Edit
next to the sub pattern you want to use in the search.
Click
Run as Query
.
Enter information for the time period you want to search.
Click OK.
An historical search will run based on the sub pattern filters, aggregate conditions, and group by conditions.
Using a Sub Pattern in a Report
If the search includes results that you want to share or investigate further, you can save the rule as a report.
1. In the sub pattern you want to save, click
Save as Report
.
2.
The report will be saved in
Select the report and click
Analytics > Reports
Run Now
, and will have the phrase
From Rule
to generate a report from the sub pattern.
in the report name.
Page 1028
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Rules for Event Dropping
Some devices and applications generate a significant number of logs, which may be very verbose, contain little valuable information, and consume storage resources. You can configure Event Dropping rules that will drop events just after they have been received by AccelOps, preventing these event logs from being collected and processed. Implementing these rules may require some thought to accurately set the event type, reporting device type, and event regular expression match, for example. However, dropped events do not count towards licensed Events per
Second (EPS), and are not stored in the Event database. Dropped event also do not appear in reports, and do not trigger rules. You can also specify that events should be dropped but stored, so event information will be available for searches and reports, but will not trigger rules. And example of an event type that you might want to store but not have trigger any rules would be an IPS event that is a false positive.
Procedure
1. Log in to your Supervisor node.
For multi-tenant deployments you should log in to the Super/Global account if you want to set a system-wide event dropping rule. If you want to set an event-dropping rule for a specific organization, either log in as an administrator for that organization, or or log in using the
2.
3.
Super/Global Account and then select the organization to which the rule should apply when you are creating it.
Go to
4.
Under
Admin > General Settings > Event Handling
.
Event Dropping Rule
, click
Add
.
5.
Next to
Reporting Device
, click
Edit
, and use the CMDB Browser to find device group or individual device that you want to create the rule for.
Next to
Event Type
, click
Edit
, and use the Event Type Browser to find the group of event types, or a specific event type, that you want
6. to create the rule for.
If the event type you select has an
Source IP
or
Destination IP
attribute, you can enter specific IP addresses to which the rule should
7. apply.
For
Regex Filter
, enter any regular expressions you want to use to filter the log files.
If any matches are made against your regular expression, then the event will be dropped.
For multi-tenant deployments, select the
Organization
to which the rule should apply. 8.
9.
10.
11.
Select the
Enter any
Click
Save
.
Action
that should be taken when the event dropping rule is triggered.
Description
for the rule.
Notes
1. All matching rules are implemented by AccelOps, and inter-rule order is not important. If you create a duplicate of an event dropping rule,
2.
3. the first rule is in effect.
If you leave a rule definition field blank, then that field is not evaluated. For example, leaving selecting
All Event Types
.
Event Type
left blank is the same as
AccelOps drops the event at the first entry point. If your deployment uses Collectors, events are dropped by the Collectors. If your deployment doesn't use Collectors, then the event will be droppedby the Worker or Supervisor where the event is received.
4. You can use the report System Event Processing Statistics to view the statistics for dropped events. When you run the report, select
AVG(Policy Dropped Event Rate(/sec) as one of the dimensions for Chart For to see events that have been dropped to this policy.
Page 1029
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Rules for Event Forwarding
In systems management, many servers may need access to forward logs, traps and Netflows from network devices and servers, but it is often resource intensive for network devices and servers to forward logs, traps and netflows to multiple destinations. For example, most Cisco routers can forward Netflow to two locations at most. However, AccelOps can forward/relay specific logs, traps and Netflows to one or more destinations.
If you want to send a log to multiple destinations, you can send it to AccelOps, which will use an event forwarding rule to send it to the desired locations.
1.
2.
3.
4.
5.
6.
7.
Log in to your Supervisor node.
Go to
Admin > General Settings > Event Handling
.
Under
Event Forwarding Rule
, for multi-tenant deployments, select the organization for which the rule will apply.
Click
For
For
Add
Select the
.
Sender IP
Severity
, enter the IP address of the device that will be sending the logs.
, select an operator and enter a severity level that must match for the log to be forwarded.
Traffic Type
to which the rule should apply.
The
Forward To > Port
field will be populated based on your selection here.
8.
9.
For
Forward to > IP
Click OK.
, enter the IP address to which the event should be forwarded.
Multiple Destinations from the Same Sender IP
If you want the same sender IP to forward events to multiple destinations, create a rule for each destination.
Duplicate Rules Create Duplicate Logs
AccelOps will implement all rules that you create and enable, so if you create a duplicate of an event forwarding rule, two copies of the same log will be sent to the destination IP.
Page 1030
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Global and Per-Device Threshold Properties
Defining a Global Threshold Property
Defining Per-Device Threshold Properties
Using the DeviceToCMDBAttr Function in a Rule
Overview
In many cases when you create a rule, you set values for device thresholds that should trigger an incident. The example of
be triggered. This is an example of setting an
absolute value
for the threshold in the rule itself.
Instead of setting an absolute value for the threshold, you can define global threshold properties that you can use as functions within a rule, and also define these threshold properties on a per-device basis. The advantage of this approach is that if you want to change the threshold values in a rule, you can edit the threshold property, rather than having to edit the rule. This is accomplished by using the
DeviceToCMDBAttr
function to return the value set for that device in the rule.
This table illustrates the difference between using an absolute value, shown in the first column, and threshold property, shown in the second column, in the aggregation conditions for a rule. For the threshold property, the function takes the form of
DeviceToCMDBAttr(Host IP,
Threshold Property)
, while it takes the form of the second example.
DeviceToCMDBAttr(Host IP, Component, Threshold)
for devices with components as shown in
Rule Name Aggregate Condition based on
Absolute Value
Server CPU Critical AVG(CPU Utilization) > 95
Aggregate Condition based on Threshold Property Value
Server Disk Space
Critical
AVG(Disk Utilization) > 99
AVG(CPU Utilization) > DeviceToCMDBAttr (Host IP,Server CPU Util Critical
Threshold)
AVG(Disk Utilization) > DeviceToCMDBAttr(Host IP,Disk Name,Disk Space
Util Critical Threshold)
In the first example, when the rule evaluates the function, the
Threshold
if the
Server CPU Critical
rule will return the value of
Server CPU Util Critical
for the host IP if that has been defined for the reporting device, otherwise the global threshold value will return. In the second example,
Disk Space Util Critical Threshold
is defined for a (Host IP,Disk Name) tuple, then the function returns that value, otherwise the global threshold value returns. This is an example of a
Map
threshold, in which there is one threshold value for each component, and which apply only to disk and interface components.
Defining a Global Threshold Property
AccelOps includes over 30+ pre-defined global threshold properties that you can edit and use in rules, but you can also create custom threshold properties.
1.
2.
3.
4.
5.
6.
Go to
Admin > Device Support.
Click the
Click
Add
Enter a
Custom Properties
.
Name
and
tab.
Display Name
for the new threshold property.
Enter the
Default Value
for the threshold.
Select the
Type
of threshold value.
For most global threshold values you will select
Double
. For
Map
thresholds, which apply to disks and interfaces, select the
Item Type
fo
7. r the threshold value, and then select the
Click
Save
.
Component Type
to which it applies.
Defining Per-Device Threshold Properties
1.
2.
3.
4.
5.
Go to
CDMB > Devices
.
Select a device.
In the
Device Details
Click the
pane, click
Edit
.
Properties
tab.
For any of the threshold properties, enter a value.
If you want to edit a
Map
property, click
Edit
next to the property name, and then enter the value. If that device does not have any
6. components to which that property could apply, you will see an error message.
Click
OK
.
Using the DeviceToCMDBAttr Function in a Rule
Using the example of the Server CPU Critical rule, you would use the DeviceToCMDB function to set a threshold for the aggregation conditions of the rule in this way:
1.
Page 1031
FortiSIEM Installation Guide FortiSIEM Installation Guide
9.
10.
11.
12.
5.
6.
7.
8.
1.
2.
3.
4.
In the sub pattern of the rule, under
Aggregation Conditions
, click the
In the expression builder, under
Add Function
In the
Click
For
Add Event Attribute
OK
.
Operator
, select .
field, select
Click the expression builder icon next to the
In the
Add Function
menu, select
Value
field.
DeviceToCMDBAttr
.
In the
Select Function Pattern
dialog, select
DeviceToCMDBAttr(EventAttr,CMDBAttr)
.
Under
Add Event Attribute
, select
Host IP
.
, select
AVG
CPU Utilization
.
.
The expression builder will close, and you will see the function and event attribute you selected listed as the Attribute for the Aggregate
Conditions.
Under
Click
Click
Add CMDB Attribute
OK
.
Save
.
, select
expression builder icon next to the
Attribute
field.
Server CPU Util Critical Threshold
.
Page 1032
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using Geolocation Attributes in Rules
In the same way that you can use
includes four system-level rules based on geolocation attributes:
Failed VPN Logon from Outside My Country
Successful VPN Logon from Outside My Country
Large Inbound Transfer From Outside My Country
Large Outbound Transfer To Outside My Country
This screenshot shows the sub pattern for
Failed VPN Logon from Outside My Country
as an illustration of the way you can use geolocation attributes in a rule.
Page 1033
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using Watch Lists as Conditions in Rules and Reports
You may want to create a rule that refers to the attributes in a watch list, for example if you want to create a condition in which a
Source IP
in your
DNS Violators
watch list will trigger an incident.
listed
1.
2.
Go to the rule or report where you want to use the watch list.
Under
Conditions
for the report, or under
Filters
in your rule subpattern, enter the watch list attribute you want to filter for in the
Attribut
3.
4.
e
field.
For example,
For
Operator
Source IP
, select .
.
Click next to
Value
IN
to find and select the watch list you want to use.
For example,
DNS Violators
.
5.
6.
Click
Folder >>
to select the watch list, and then click OK.
Continue with creating your search criteria or rule sub pattern as you normally would.
Page 1034
FortiSIEM Installation Guide FortiSIEM Installation Guide
Viewing Rules
AccelOps includes a large set of rules for Availability, Performance, Change, and Security incidents in addition to the rules that you can define for your system.
1.
2.
To view all system and user-defined rules,
go to Analytics > Rules
.
menu in the upper-right corner of the Rules List pane to filter rules by organization.
3.
For multi-tenant deployments, use the
Organizations
Select any rule in the Rules List to view information about it.
All rules have three information tabs:
Tab
Summary
Definition
Description
This tab provides an overview of the rule's logic, its status, and its notification settings.
An XML definition of the rule. This is what will be copied to your clipboard if you
Export
a rule.
Test Results If you are testing a rule
, you can view the results here.
Page 1035
FortiSIEM Installation Guide FortiSIEM Installation Guide
Reports
You can think of reports as saved or pre-defined versions of pre-defined reports that you can access in
that you can load and run at any time. AccelOps includes over 2000
Analytics > Reports
. Topics in this section describe how to access and view information about reports, how to create baseline reports, and how to use specialized reports like the your reports in the same way that you would
Identity and Location
report. You can refine the results of
refine the results of an historical search or
.
System-Defined Baseline Reports
Creating a Report or Baseline Report
Running System and User-Defined Reports and Baseline Reports
Page 1036
FortiSIEM Installation Guide FortiSIEM Installation Guide
Baseline Reports
Evaluating Rules and Detecting Deviations
When you are setting up AccelOps to monitor your IT infrastructure, you may want to define what is "normal" activity within your systems, and have incidents triggered when a a deviation from that normal activity occurs. For example, you can always assume that there will be some logon failures to a server on a daily basis. Rather than creating a rule that will trigger an incident when a certain hard-coded number of failures occurs, you can set up baseline reports that will trigger an incident when the total number of logon failures over a time period is twice the average over the same time period, or when the deviation from the average is threee times the standard deviation over a specific time period.
By creating a baseline report, you can set mean and standard deviations for any metric and use them in rule, and AccelOps will evaluate the current monitored values against the mean and standard deviation for that time period.
How AccelOps Sets Baselines
Establishing a baseline means recognizing that data center resource usage is time dependent:
Usage is different during weekdays and weekends, and may also be different depending on the day of the week or month
Usage is dramatically higher during business hours, typically 8am-5pm
AccelOps maintains distinct baselines for weekdays, weekends and for each hour of day - a total of 24*2 = 48 buckets. Baselines for days of the week or month are not maintained to save memory usage, as this would require 31*24 = 1764 buckets, a 15 fold-increase of memory.
A baseline report is a set of
Keys
that represent the baselined metrics, and a collection of
Values
. You can see examples of these Keys and
Values in the
System-Defined Baseline Reports . These are then used in this process to build the report:
1. During the current hour, the Supervisor and any Worker nodes operate in parallel to save a baseline report in memory by analyzing the
2. report events as a stream.
When the hour finishes: a. b. c. d. e.
The report is written to disk (on NFS for AccelOps cluster).
The Supervisor module summarizes individual baseline reports from all nodes and forms the baseline for the current hour.
The baselines are stored in a SQLite database on a local Supervisor.
The Supervisor module reads the previous baseline for the current time interval from the SQLite database Then it combines the previous values with the current values to create a new baseline.
3.
The new baseline is then stored in SQLite database.
For the new hour, a new baseline is created following this process
As this process illustrates, baselining is continuous in AccelOps, and new baseline values are learned adaptively.
Evaluating Rules and Detecting Deviations
A baseline rule contains expressions that involve using the functions
STAT_AVG()
and
STAT_STDDEV()
to set dynamic thresholds.
These examples show how
STAT_AVG()
and introduction to this topic.
STAT_STDDEV()
would be used to evaluate the conditions for the example of logon failures in the
Condition Statement
Current value of X is more than 2 times the statistical average of X for the current hour
Deviation of X from its statistical average is more than 3 times its standard deviation for the current hour
How the Baseline is Evaluated
Baseline evaluated using Baseline Report with ID X > 2 *
STAT_AVG(X:ID)
All baselines evaluated using Baseline Report with ID ABS(X -
STAT_AVG(X:ID) > 3 * STAT_STDDEV(X:ID)
When AccelOps processes these rules:
1.
2.
Rule engine computes the current values in memory.
Every 5 minutes: a. b. c.
It looks for
STAT_AVG(X:ID)
and
STAT_STDDEV(X:ID)
in memory
If it fails, it retrieves them from the SQLite database and caches them for future use during the hour.
Evaluates the rule conditions
A sample rule condition involving statistical functions is shown below with (X = AVG(fwConnCount); ID = 112).
Page 1037
FortiSIEM Installation Guide FortiSIEM Installation Guide
<PatternClause window="1800">
<SubPattern id="3238092" name="StatHighConn">
<SingleEvtConstr>eventType =
"PH_DEV_MON_FW_CONN_UTIL"</SingleEvtConstr>
<GroupEvtConstr>
(AVG(fwConnCount)-STAT_AVG(AVG(fwConnCount):112))/STAT_STDDEV(AVG(fwConn
Count):112) >= 3 AND
STAT_STDDEV(AVG(fwConnCount):112) > 0
</GroupEvtConstr>
<GroupByAttr>hostName,hostIpAddr</GroupByAttr>
</SubPattern>
</PatternClause>
Setting Sample Points for Baselines
Two sample points are needed to avoid premature triggering of a rule before a baseline is set and becomes active.
If the first data is received for a subject on Monday, then the rules will start triggering for that subject for that baseline starting
Wednesday
If the first data is received for a subject on Saturday, then the rules will start triggering for that subject for that baseline starting next Saturday
Page 1038
FortiSIEM Installation Guide FortiSIEM Installation Guide
System-Defined Baseline Reports
The following system provided baseline reports are continuously running in the system.
Performance / Availability Monitoring
Network Traffic Analysis
Report
DNS Request
Profile
DNS Traffic
Profile
Destination
Traffic Profile
Source Traffic
Profile
Firewall
Connection
Count Profile
Firewall Denied
Aggregate
Traffic Profile
ICMP Traffic
Profile
Inbound
Firewall Denied
TCP/UDP Port
Profile
Inbound
Firewall Permitt ed TCP/UDP
Port Usage
Profile
Outbound
Firewall Denied
TCP/UDP Port
Profile
Outbound
Firewall Permitt ed TCP/UDP
Port Usage
Profile
Description
This report baselines DNS requests on a per client basis: the number of requests and distinct destinations it attempted to resolve
This report baselines DNS traffic characteristics on a per client basis: sent and receive bytes and packets.
This report baselines traffic destined to a server. The data is reported by network flow
(Netflow, Sflow) and firewall logs. For each destination IP, the number of distinct peers, the number of distinct ports opened on the server and the total number of flows are tracked.
This report baselines traffic generated by a source. The data is reported by network flow
(Netflow, Sflow) and firewall logs. For each source IP, the number of distinct peers, the number of distinct ports opened by the source, the total number of flows and total bytes exchanged are tracked.
This report provides baseline of permitted firewall connection count typically gathered by
SNMP.
This profile baselines denied firewall traffic from firewall logs - volume of denied traffic, distinct attacker count, distinct target IP and port.
This report baselines generated ICMP traffic by each source: number of ICMP packets and number of distinct destinations
This report provides baseline of denied inbound TCP/UDP port usage as reported by firewall logs. For every port, the number of denied attempts and the number of distinct source are profiled.
This report provides baseline of permitted inbound TCP/UDP port usage. The data is reported by firewall logs. For every inbound destination port and protocol combination, the total number of unique sources, destinations and the total bytes and flows are profiled
This report provides baseline of denied outbound TCP/UDP port usage as reported by firewall logs. For every port, the number of denied attempts and the number of distinct destinations are profiled.
This report provides baseline of permitted inbound TCP/UDP port usage. The data is reported by firewall logs. For every inbound destination port and protocol combination, the total number of unique sources, destinations and the total bytes and flows are profiled
ID Fields
113 Key: Source IP
Values: Number of Requests, Distinct
Destination Count - means and standard deviation for each
113 Key: Source IP
Values: Sent Bytes, Received Bytes, Total
Bytes - mean and standard deviation for each
126 Key: Destination IP
Values: Distinct Source IP, Distinct
Destination Ports, Total Flows - mean and standard deviation for each
125 Key: Source IP
Values: Distinct Destination IP, Distinct
Destination Ports, Total Flows, Total Bytes
- mean and standard deviation for each
112 Key: Firewall Name, Firewall IP
Values: Firewall Connection Count - mean and standard deviation for each
108 Key: Firewall Name, Firewall IP
Values: Denied Flows, Distinct Denied
Source IP, Distinct Denied Destination IP,
Distinct Denied Destination Port - mean and standard deviation for each
114 Key: Source IP
Values: Distinct Destinations, Total Flows,
Total Bytes - mean and standard deviation for each
106 Key: Destination Protocol, Port
Values: Distinct Source IP, Total Flows - mean and standard deviation for each
104 Key: Destination Protocol, Port
Values: Distinct Source IP, Distinct
Destination IP, Total Flows, Total Bytes - mean and standard deviation for each
107 Key: Destination Protocol, Port
Values: Distinct Destination IP, Total
Flows - mean and standard deviation for each
105 Key: Destination Protocol, Port
Values: Distinct Source IP, Distinct
Destination IP, Total Flows, Total Bytes - mean and standard deviation for each
Performance / Availability Monitoring
Page 1039
FortiSIEM Installation Guide FortiSIEM Installation Guide
Report
Device CPU,
Memory
Usage Profile
Device Disk
I/O Profile
Network
Interface
Traffic Profile
Network
Interface Error
Profile
Server
Process
Count profile
Reporting
EPS Profile
Reported
Event Type
Profile
Reported
Error Log
Profile
STM
Response
Time Profile
Description ID Fields
This report provides baselines cpu, memory usage - the data is collected by SNMP or
WMI. For every host, CPU, real and virtual memory utilization are profiled
This report provides baselines disk I/O usage for servers, VMs and ESX - the data is collected by SNMP or WMI or VCenter API. For every host and disk combination, read and write volumes are profiled
109 Key: Host Name
Values: CPU Utilization, Memory Utilization,
Virtual Memory Utilization - mean and standard deviation for each
121 Key: Host Name, Datastore Name, Disk
Name
Values: Disk Read KBps, Disk Write KBps - mean and standard deviation for each
This report provides baselines network interface traffic. The data is collected by SNMP.
For each network interface, the total sent and received bytes are profiled.
This report provides baselines network interface errors and discards. The data is collected by SNMP. For each network interface, the total errors and discards are profiled.
This report baselines the number of processes running at a server. The data is collected by SNMP.
This report baselines the rate at which devices sends events to AccelOps.
110 Key: Host Name, Interface name
Values: Sent Bytes, Received Bytes - mean and standard deviation for each
111 Key: Host Name, Interface name
Values: Errors, Discards - inbound and outbound - mean for each
123 Key: Host name
Values: Process Count - mean and standard deviation
116 Key: Host Name, Host IP
Values: Events/sec - mean and standard deviation
This report provides baselines for distinct event types reported by a device.
119 Key: Host Name, Host IP
Values: Distinct Event Type - mean and standard deviation
This report baselines the number of system errors reported in logs on a per device basis. 120 Key: Host Name, Host IP
Values: Number of events classified as system errors - mean
This report baselines Synthetic Transaction Monitoring response times 123 Key: Host Name, Monitor Name
Values: Response Time - mean and standard deviation
Logon Activity
Report
Successful
Logon Profile
Failed Logon
Profile
Privileged Logon
Profile
Description
This report baseline successful log on activity at a host. The data is collected from logs.
This report baseline failed log on activity at a host. The data is collected from logs.
This report baseline successful log on activity at a host. The data is collected from logs.
ID Fields
115 Key: Host Name, Host IP
Values: Successful Logons, Distinct Source IP, Distinct Users - mean and standard deviation
Key: Host Name, Host IP
Values: Failed Logons, Distinct Source IP, Distinct Users - mean and standard deviation
118 Key: Host Name, Host IP
Values: Privileged Logons - mean and standard deviation
Page 1040
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Report or Baseline Report
Creating a report or baseline report is like creating a structured historical search
, because you set the will be used to process the report data, and specify
Display Fields
to use in the report summary.
Conditions
and
Group By
attributes that
Cloning an Existing Rule
You can clone an existing rule to use as the basis for a new rule by selecting the existing rule, and then click
Clone
.
1.
2.
3.
4.
5.
6.
Log in to your Supervisor node.
Go to
Analytics > Reports
, and select the category for your new report.
Select
Baseline
for baseline reports.
Click
New
.
Enter a report
Name
and
Description
.
For baseline reports, select
Anomaly Detection Baseline
.
Enter the
Conditions
to use in your report.
See
Selecting Attributes for Structured Searches, Display Fields, and Rules and
Using Expressions in Structured Searches and Rules
for
7.
more information on setting conditions. For creating baseline reports, see Baseline Reports
for information on how to use the and
STAT_STDDEV
functions in creating expressions for baseline reports.
Select the
Group By
attribute to use in processing the search results.
STAT_AVG
8.
The topic
Example of How a Structured Historical Search is Processed
explains how the Group By attribute is used in search results.
Set the
Display Fields
to use in your search results.
See
9. fields.
Click
Save
.
Your report will be saved into the selected category, and you can now run it or
Related Links
Creating a Structured Historical Search
Selecting Attributes for Structured Searches, Display Fields, and Rules
Example of How a Structured Historical Search is Processed
Using Expressions in Structured Searches and Rules
Page 1041
FortiSIEM Installation Guide FortiSIEM Installation Guide
Identity and Location Report
The Identity and Location Report Display Fields
Report Information and Event Types
Overview
The Identity and Location report is constructed by associating a network identity like an IP address, or MAC address, to a user identity like a user name, computer name, or domain, and tying that to a location, like a wired switch port, a wireless LAN controller, or VPN gateway. When any element of these associations changes, a new entry is created in the report.
The associations between IP addresses, users, and locations are obtained by combining Windows Active Directory events, DHCP events, and
WLAN and VPN logon events, with discovery results to produce a report combining all of this information into a comprehensive listing of users and machines by their identity and location.
The Identity and Location Report Display Fields
The Identity and Location Report contains these display fields:
Display
Field
IP
Address
MAC
Address
User
Description
IP adress of a host whose identity and location is recorded in this result. You can view IP addresses with country flags in a map by clicking
Locations
.
MAC address of the host
User associated with this IP Address. Obtained from one of these event types: ,
. See the section on Report Information and Event Types on this topic for more information.
,
Host
Name
Obtained from the
Windows Domain Logon
and
WLAN Authentication
event types.
Domain
Information displayed here depends on the logon event type it was obtained from:
Windows Domain Logon
: the Domain name
VPN Logon: the reporting IP address of the VPN gateway
WLAN Logon: the reporting IP address of the WLAN controller
AAA Logon: the reporting IP of the AAA server
VLAN ID For hosts directly attached to a switch, this is the VLAN ID of the switch port
Location For hosts attached to a switch port, this is the switch name, reporting IP address, and interface name
First
Seen
The time at which this entry was first created in the AccelOps Identity and Location table
Last
Seen
The time at which some attribute of this entry was last updated. If there is a conflict, for example a host acquiring a new IP address because of DHCP, then the original entry is closed and a new entry is created. A closed entry will never be updated.
Report Information and Event Types
This table lists the events and event types that contribute to information in the Identity and Location Report, as well as what information is collected for each type of event.
DHCP Renew Events
AD Successful Login
Events
AAA Successful Login
Events
x x x
IP
x
MAC Host Name
x (resolvable by DNS or in
AccelOps CMDB)
User
x (if in
Event) x
Domain VLAN Location
x x
Contributing Event Types
WIN-DHCP-IP-LEASE-RENEW
WIN-DHCP-IP-ASSIGN
Linux_DHCPACK
Generic_DHCPACK
Win-Security-540
Win-Security-4624
Win-IAS-PassedAuth
CisACS_01_PassedAuth
Page 1042
FortiSIEM Installation Guide FortiSIEM Installation Guide
VPN Successful Login
Events
x
WLAN Successful
Login Events
WLAN Discovery
Events
VoIP Call Manager
Discovery Events
AccelOps L2 discovery
Events
x x (if in
Event) x (if in
Event) x x x x x x x x (if resolvable by DNS or in
AccelOps CMDB) x (if in
Event) x (if in
Event) x x x x x x
Cisco-VPN3K-IKE/25
ASA-722022
ASA-713228
ASA-713049-Client-VPN-Logon-success
Cisco-WLC-53-bsnDot11StationAssociate
PH_DISCOV_CISCO_WLAN_HOST_LOCATION
PH_DISCOV_ARUBA_WLAN_HOST_LOCATION
PH_DISCOV_VOIP_PHONE_ID
PH_DISCOV_HOST_LOCATION
Creating New Identity Events
There may be a situation in which a new event type is added to AccelOps, and you want to use the parsed attributes of that event in the Identity and Location report. Once you have made sure that the event will parse correctly, you will need to edit the identityDef.xml file for your Supervisor and any Worker nodes in your deployment.
1.
2.
3.
Log in to your Supervisor host machine as admin.
Change the directory to /opt/phoenix/config/xml.
Logon to AccelOps Super as admin
4. Edit the
identityDef.xml
file: a. b. c.
Create a new
<identityEvent>
.
For
<eventType>
, enter the ID of the event containing the identity attribute.
For
<eventAttributes>
, enter the name of the event attribute and its corresponding identity attribute. For reqd
, enter he event must have this event attribute for use in the identity and location report.
Possible location attributes include: ipAddr macAddr computerName domain domainUser aaaUser vpnUser geoCountry geoState geoCity geoLatitude vlanId
2.
3. netEntryPt netEntryPort
Restart identityMaster and identityWorker
Repeat for any Worker nodes.
yes
if t
This code sample is an example of a new
<identityEvent>
entry in the
identityDef.xml
file
Page 1043
FortiSIEM Installation Guide FortiSIEM Installation Guide
<identityEvent>
<eventType>PH_DISCOV_CISCO_WLAN_HOST_LOCATION,PH_DISCOV_ARUBA_WLAN_HOST_
LOCATION</eventType>
<eventAttributes>
<eventAttribute name="hostIpAddr" identityAttrib="ipAddr" reqd="no"/>
<eventAttribute name="hostMACAddr" identityAttrib="macAddr" reqd="no"/>
<eventAttribute name="user" identityAttrib="domainUser" reqd="no"/>
<eventAttribute name="domain" identityAttrib="domain" reqd="no"/>
<eventAttribute name="nepDevName" identityAttrib="netEntryPtName" reqd="yes"/>
<eventAttribute name="nepDevIpAddr" identityAttrib="netEntryPt" reqd="yes"/>
<eventAttribute name="nepDevPort" identityAttrib="netEntryPort" reqd="yes"/>
<eventAttribute name="wlanContrIpAddr" identityAttrib="wlanContrIpAddr" reqd="yes"/>
<eventAttribute name="wlanContrHostName" identityAttrib="wlanContrHostName" reqd="yes"/>
<eventAttribute name="hostGeoCountry" identityAttrib="geoCountry" reqd="no"/>
<eventAttribute name="hostGeoState" identityAttrib="geoState" reqd="no"/>
<eventAttribute name="hostGeoCity" identityAttrib="geoCity" reqd="no"/>
<eventAttribute name="hostGeoLatitude" identityAttrib="geoLatitude" reqd="no"/>
<eventAttribute name="hostGeoLongitude" identityAttrib="geoLongitude" reqd="no"/>
</eventAttributes>
</identityEvent>
Page 1044
FortiSIEM Installation Guide FortiSIEM Installation Guide
Report Bundles
Report bundles are groups of reports for common IT infrastructure analytics, such as
Windows Server Health
. Be defining a bundle and placing reports into it, you can run all the reports at the same time, and apply the same filter conditions to all reports. You can view system and user-defined report bundles under
Analytics > Report Bundles
.
Page 1045
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Report Bundle
Creating a report bundle involves naming and describing the bundle, adding reports to the bundle, and then setting what you want to include in the report results.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Analytics > Reports > Report Bundles
.
5.
Click the icon at the top of the Analytics navigation pane.
For
Group
, enter the name of the bundle, and then enter a
Description
.
Under
Select Group Members
, select the report category that contains the report you want to add to the bundle.
6.
7.
8.
9.
When you select a category, all the reports in that category will be added to the selection window.
Select a report and use the button to add it to the bundle.
Select Show Table if you want all reports to include tables by default.
You can set individual reports to show tables by selecting the report under
Show Reports
, clicking
Enter the number of
Click
OK
.
Rows per Table
.
Edit,
and then selecting
Show Table
.
Page 1046
FortiSIEM Installation Guide FortiSIEM Installation Guide
Running a Report Bundle
1.
2.
3.
4.
5.
6.
Select a report bundle to run.
At the top of the Analytics navigation pane, click the blue
Arrow
icon.
Organization
for which the reports should apply.
7.
Log in to your Supervisor node.
Go to
Analytics > Reports > Report Bundles
.
For multi-tenant deployments, select the
Select the
Time Range
for the results.
8.
Set any
Data Conditions
to use in filtering the results.
The most common use cases for setting data conditions involves imposing additional restrictions on the reporting devices, for example reporting devices IN a particular device group. These conditions are AND-ed to the filter conditions in every report of the bundle.
Click Export.
The reports will run in the background, and when ready, you will see a dialog to save or download the PDF files.
Scheduling Report Bundles to Run
You can also schedule report bundles to run once or on recurring occasions in the future. Select a report bundle as you would to run it, and then click the
Clock
icon in the top-right corner of the Analytics navigation pane. Follow the steps described in to schedule the report bundles.
This screenshot shows the UI controls for working with report bundles.
Page 1047
FortiSIEM Installation Guide FortiSIEM Installation Guide
Running System and User-Defined Reports and Baseline Reports
can also create your own reports. This topic describes how to run a system-generated or user-defined baseline report.
1.
2.
3.
4.
5.
Log in to your Supervisor node.
Go to
Analytics > Reports
and select the subcategory containing the report you want to run
For baseline reports, select
Baseline
.
Select the report to run.
Click
Run Now
to run the report immediately, or
Run Later
to
If you chose
Run Now
and have a multi-tenant deployment, select the then click
OK
.
The report will run and the results will be displayed.
.
Organization
.
for which you want to run the baseline report, and
For baseline results, the values in the
Profile Date Type
(Saturday and Sunday) - 0
or
Workday - 1
column indicate whether the baseline date type is a
. The values in
Weekend
, column indicate the time on which the baseline is based.
For baseline reports, you can create scatter plots of the report results charts and
Quick Info
menu to get more information about items in the report results, and also
about the results. For other types of reports you can use all the
other methods of refining results that are related to historical search.
Related Links
Using Search Results to Refine Historical Searches
System-Defined Baseline Reports
Overview of Historical Search Results and Charts
Using Geolocation Attributes in Rules
Refining the Results from Historical Search
Page 1048
FortiSIEM Installation Guide FortiSIEM Installation Guide
Scheduling Reports
You can schedule reports to run once or on recurring periods in the future. When the test runs, the results will be saved to the report, and in
Analytics > Generated Reports
.
Results
tab for the
Prerequisites
When you schedule a report, you can specify notifications that should be sent for that report. In addition, you should make sure that the
d efault settings for notifications for all scheduled reports
have been set up.
Procedure
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Analytics > Reports
.
Select the report you want to schedule.
Click
Run Later
.
The Schedule Tab
You can also schedule a report by going to the this topic.
Schedule
5.
6.
7.
8.
9.
10.
Select
Schedule this report for
:
For multi-tenant deployments, select the
Select the
Select the
Report Time Range
Schedule Settings
Select the
Output Format,
.
.
Organization
for which this report should apply. whether you want to include the
Chart
in the output, and the
Specify the
Notifications
that should be sent when the report runs.
Maximum Rows to Display
.
Click
Specify custom notifications
if you want to send notifications to specific email addresses.
To copy the report to a remote directory, first define the remote location in
Admin > General Settings > Analytics > Report to be copied to this remote location when scheduler runs any report
. and then select
Copy to a remote directory
option.
11.
12.
Specify the amount of time the report should be retained after it has run.
Click
OK
.
The report will run at the time you scheduled.
Related Links
Setting Up Email Alert Routing for Scheduled Reports
Page 1049
FortiSIEM Installation Guide FortiSIEM Installation Guide
Viewing Available Reports
The Synced Reports Group
The Synced Reports group contains the reports that can be synched
with Report Server for use in Visual Analytics .
1.
2.
3.
4.
5.
Log in to your Supervisor node.
Go to
Analytics > Reports
.
For multi-tenant deployments, select the
Expand the
Select the report you want to view information about.
Each report has four information tabs:
Organization
for which you want to view the available reports.
Reports
list, and select the subcategory of report you want to view.
Report
Tab
Description
Summary Includes the
Filter
and
Group By
conditions for the report, and the report's
Display
attributes
Schedule Information about when the report is scheduled to run. See Scheduling Reports
for more information. You can click the + icon to set a schedule for the report to run.
Results
The results from any scheduled runs of the report, or results you have saved from running the report.
Definition The XML definition of the report.
Page 1050
FortiSIEM Installation Guide FortiSIEM Installation Guide
Audit
Audit Reports can be used to determine if a device is running the recommended OS and installed software versions, performance metrics are within bounds and harmful events have not triggered.
Page 1051
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Audit Report
To create an Audit Report
1.
2.
Go to
Analytics
tab
3.
4.
Expand
Audit
node on the left tree and go to the folder to which the new report will belong. You can also create a new folder first by clicking on the on top of the left tree.
Click
New
.
Enter the following information for an Audit Report a. b.
Name: Name of the Audit Report c.
Description: Description of the Audit Report d.
Vendor: Select a specific device vendor from the drop down list. The Audit Report will be specific to the chosen device vendor and model e.
Model: Select a vendor specific model from the drop down list. The Audit Report will be specific to the chosen device vendor and model
Specify i.
Failed Criteria
for the Audit Report. A device will fail the audit if
any
of the specified criteria is matched.
OS Version Condition:
1.
2.
Choose an
operator
: possible choices are IN, NOT IN, CONTAINS, NOT CONTAINS
Specify
value
to be matched: this can be a comma separated list ii. Install Software Condition:
1.
2.
Specify Condition
name
. This is just for reference purposes.
Specify
Install software name
- the name has to be exactly identical to the discovered installed software in
3.
4.
CMDB > Devices > Installed Software > Name
Choose an
operator
: possible choices are IN, NOT IN, CONTAINS, NOT CONTAINS
Specify
value
to be matched: this can be comma separated list iii. Rules Condition:
1.
2.
...
Select the appropriate Rule folder from the left most tree. If you do not know the specific folder, then choose the
3. top level Rules folder.
4.
5.
Select the rules from the middle section. You can also type a search string. You can expand the window and shrink the left most section to see more of the rule descriptions. The rules in the selected folder will appear in the middle section.
Click iv.
Click
OK.
Report Condition:
1.
2.
Items >>
to place the selected rules on the rightmost section
3. the top level Reports folder. The reports in the selected folder will appear in the middle section.
4.
5.
...
Select the appropriate Report folder from the left most tree. If you do not know the specific folder, then choose
Select the reports from the middle section. You can also type a search string. You can expand the window and shrink the left most section to see more of the report descriptions.
Click
Click
Items >>
OK
.
to place the selected reports on the rightmost section
Audit Policy Criteria Matching Notes
1.
2.
3.
4.
For each criteria, only devices in CMDB with vendor and model specified in the Audit Report is considered
If any of the criteria matches, then the device fails the audit
IN and NOT IN are exact match while CONTAINS and NOT CONTAINS are case insensitive sub-string match
5.
6.
For OS Version match, the entered value is compared with the Version column in CMDB > Device.
For Installed Software Version match, the entered value is compared with the Version column in CMDB > Device > Installed
Software
7.
For Rule match, the specified rule must trigger during the time interval specified in the Audit Report. Organization id and access IP of the device is compared to the Organization Id and Host IP in an incident.
For Report match, the specified reports run for the time duration specified in Audit Report must have data.
Page 1052
FortiSIEM Installation Guide FortiSIEM Installation Guide
Running an Audit
To run an Audit,
1.
2.
3.
Select an Audit Policy
Click
Run Now
In the follow up dialog, a. b. c.
Select the organizations for which to run the audit (meaningful for Service Provider version)
Choose a time window - absolute or relative
Click
OK
The Audit Policy check results are displayed in the right bottom pane.
Summary tab shows a high level overview of the Audit Policy check.
Audit Result Distribution chart shows the device pass/fail distribution for every selected organization.
Failed Criteria distribution chart shows the contribution of each audit criteria to the devices that failed the audit.
Detail tab shows the Audit Policy check for each device matching the vendor, model specified in the policy.
Organization specifies the entity to which the device belongs
Device Name is the host name of the device in CMDB
Audit Status is the Pass/Fail flag
Details specifes the reasons for Audit Policy check failure
Page 1053
FortiSIEM Installation Guide
Exporting Audit Results
To export an Audit Report,
1.
2.
3.
Select an Audit Policy
Run the Audit Policy Check. The results will be shown in the bottom right pane.
Click
Export
a. b. c.
Add
User Notes
Choose
Output Format
- PDF or CSV
Click
Generate Report
- the PDF file will be stored in local disk
FortiSIEM Installation Guide
Page 1054
FortiSIEM Installation Guide FortiSIEM Installation Guide
Scheduling an Audit
To schedule a report to run at a later time
2.
3.
4.
5.
1. Choose between one of two options a. Run this report for - If the 'Run this report for' button is selected, a report will be scheduled for the super user, containing data from the organizations selected. The super user will be the owner of the report. The recipients of the report may be defined in the b.
'Send Notifications' section below or in Admin -> General Settings -> Analytics.
Schedule this report for - If the 'Schedule this report for' button is selected, multiple reports will be scheduled -- one for each selected organization -- and containing only that organization's data. The reports will be owned by the respective organizations.
The recipients of the report are taken from Admin -> General Settings -> Analytics. When multiple reports are run in this way the notification recipients cannot be indicated in the 'Send Notifications' section below.
Select all the
Organizations
for which to run the Audit Report
6.
Select the
Report time range
Specify
Schedule settings
- when to run this report
Choose
Output Format
- PDF or CSV
Select
notification
- report recipients and method a. If you choose
Send default notification
, then the settings in
Admin > General Settings > Analytics > Alerts to be sent when
b. c.
scheduler runs any REPORT,
is used
If you choose
Specify custom notifications
, then you can specify email addresses
If you choose
Copy to a remote directory
, then the settings in
Admin > General Settings > Analytics > Reports to be copied to this remote location when scheduler runs any REPORT,
is used
Page 1055
FortiSIEM Installation Guide FortiSIEM Installation Guide
Visual Analytics
Visual Analytics is an add-on for AccelOps that lets you create custome visualizations of AccelOps report data, as well as dashboards containing multiple visualization charts. AccelOps Visual Analytics has three components:
1.
2.
3.
The AccelOps Report Server, which syncs with and replicates AccelOps reports in near-real time.
Tableau Server from Tableau Software, which enables the publication and distribution of your visualizations.
Tableau Desktop, also from Tabeleau Software, which is your primary tool for creating visualizations.
See
Installation and Configuration of AccelOps Visual Analytics
for information about setting up AccelOps Report Server. For more detailed information about Tableau Server and Desktop, including installation, configuration, and examples of creating sheets and workbooks, you should consult the Product Support section of the Tableau Software website .
Additional Information in the Help Center
You can find additional information about working with AccelOps Visual Analytics in the tained by AccelOps Support.
Visual Analytics section of the Help Center main
AccelOps Visual Analytics Architecture
Installation and Configuration of AccelOps Visual Analytics
Working with the Report Server
Installing and Configuring Tableau Server
Creating and Managing Workbooks
Page 1056
FortiSIEM Installation Guide FortiSIEM Installation Guide
AccelOps Visual Analytics Architecture
Overview and Report Server Architecture
Using AccelOps Report Server with Tableau Software
Overview and Report Server Architecture
With AccelOps Visual Analytics, you can now create visual representations of the data that is stored in AccelOps. This includes:
Structured data stored in the AccelOps CMDB relational PostgreSQL database, such as:
Discovered information about devices, systems, applications and users
Identity and location information
Incidents and notifications
Unstructured data such as logs, events, performance metrics etc. that are monitored by AccelOps and stored in the EventDB NoSQL database, which is accessible by Supervisors and Workers over NFS.
In order to provide near real-time visual analytics without compromising the performance of your AccelOps deployment, both structured and unstructured data is exported to a separate virtual machine, the databases that are queried by AccelOps Visual Analytics:
AccelOps Report Server
, running PostgreSQL. The Report Server contains two
phoenixdb
This database contains the entire AccelOps CMDB and is populated via asynchronous PostgreSQL replication (slony) in near-real time.
reportdb
This database contains the results of event queries
You can find more information about AccelOps Report Server in the topic topics.
Report Server Architecture: phoenixdb and reportdb and its related
Using AccelOps Report Server with Tableau Software
AccelOps Report Server integrates with Tableau Software to provide the interface for creating and publishing your data visualizations. Workbooks containing visualizations based on AccelOps data are created using Tableau Desktop, and then are published to Tableau server, where they can be accessed on any Windows or OS X device by users how have been granted permission for viewing or editing them. AccelOps provides some workbooks for visualizations, but you can construct others for custom analytics. You can find more information about workbooks in the section
Cre ating and Managing Workbooks .
Page 1057
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 1058
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installation and Configuration of AccelOps Visual Analytics
Installation and configuration of AccelOps Visual Analytics involves setting up AccelOps Report Server, and then integrating it with Tableau
Server and Desktop from Tableau Software. Topics in this section contain setup and configuration instructions for Report Server. For information on setting up and configuring Tableau Server and Desktop, see the online Tableau Software documentation .
Requirements for Visual Analytics Report Server
Hypervisor Installations for Report Server
Syncing with the Report Server
Page 1059
FortiSIEM Installation Guide FortiSIEM Installation Guide
Requirements for Visual Analytics Report Server
You install Visual Analytics Report Server as an AccelOps node, and these requirements assume that you have already set up and installed
AccelOps. If you are working with a fresh install of AccelOps that includes Report Server, see the topics under
for complete requirements and installation instructions for the AccelOps Virtual Appliance.
Dedicated Machine for Report Server
You must install Visual Analytics Report Server on a dedicated machine.
Hardware Requirements for Report Server Nodes
Component
Quantity Host
SW
Report
Server
1 ESX
Processor
8 Core 3
GHz, 64 bit
Memory OS/App Storage
16 GB 200GB (80GB OS/App, 60GB
CMDB, 60GB SVN)
Reports Data Storage (1 year)
See recommendations under Hardware Requirements for
Supervisor and Worker nodes
Page 1060
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Up Visual Analytics
There are three components to Accelops Visual Analytics:
1.
2.
3.
Accelops Report Server
Tableau Server
Tableau Desktop
Setting up Visual Analytics involves setting up each of those components in order, and establishing the relationship between them.
1.
2.
You must first install Report Server as described in
Installing and Registering AccelOps Report Server in VMware ESX
.
After installing Tableau Server on a Windows server, and installing Tableau Desktop on a Windows or Mac OS X device, you then
Tableau Software product documentation .
3. connect the two systems as described in the
When this connection is established, it automatically triggers the remote registration and configuration of the AccelOps Report Server, including replication of the CMDB and EventDB data from the AccelOps Cluster to the AccelOps Report Server, as well as the user account required for access to the original databases.
Registration of the Report Server and replication of the AccelOps database data may take some time depending on the size of the original CMDB.
Registration is complete when the replication process catches up with the latest data in the system. From that point on, replication from the CMDB to Accelops Report Server takes place in near real time, letting you run Visual Analytics queries against CMDB data that has been replicated to the Report Server's phoenixdb.
You can find full information about setting up all components of AccelOps Visual Analytics in the section
Installation and Configuration of
Page 1061
FortiSIEM Installation Guide
Hypervisor Installations for Report Server
These topics cover the installation of Report Server in various hypervisor enviroments.
Installing and Registering AccelOps Report Server in Amazon Web Services
Installing and Registering AccelOps Report Server in KVM
Installing and Registering AccelOps Report Server in Microsoft Hyper-V
Installing and Registering AccelOps Report Server in VMware ESX
FortiSIEM Installation Guide
Page 1062
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installing and Registering AccelOps Report Server in Amazon Web Services
Follow the instructions for setting up an AccelOps virtual appliance as described in
Setting Up Supervisor, Worker and Collector Nodes in AWS
,
Page 1063
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installing and Registering AccelOps Report Server in KVM
Follow the instructions for installing an AccelOps virtual appliance as described in and then register the Report Server with the Supervisor as described in
Importing a Supervisor, Collector, or Worker Image into KVM
,
Installing and Registering a Report Server Node in ESX
.
Page 1064
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installing and Registering AccelOps Report Server in Microsoft Hyper-V
Follow the virtual appliance installing instructions in as described in
Installing in Microsoft Hyper-V , and then register the Report Server node with the Supervisor
Installing and Registering AccelOps Report Server in VMware ESX
.
Page 1065
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installing and Registering AccelOps Report Server in VMware ESX
These instructions are for installing Report Server on VMWare ESX, and assume that you have already installed and configured an AccelOps
environment. For instructions for a complete AccelOps install, see the topics under Installation .
Installing Report Server
Follow the instructions for installing an AccelOps virtual appliance as described in the topics under
Installing a Supervisor, Worker, or Collector
Configuring the Supervisor, Worker, or Collector from the VM Console
.
Registering Report Server
1.
2.
In the
Admin
tab, select
License Management
Under Report Server Information, click
Add
.
.
3. Enter the
Report Server IP Address
, and the
Database Usernam
e and
Password
you want to use to administer Report Server.
These are also the credentials that you will use when you set up the Visual Analytics Server to read data from Report Server.
4. Click
Run in Background
if you want Report Server registration to run in the background for larger installations.
When CMDB size is under 1GB, registration takes approximately 3 minutes to complete.
5. When registration completes, click
OK
in the confirmation dialog.
6. Under the
Admin
tab, select
Cloud Health
and make sure Report Server is up and running.
Page 1066
FortiSIEM Installation Guide FortiSIEM Installation Guide
Syncing with the Report Server
Using AccelOps Visual Analytics involves first syncing reports contained in the primary AccelOps application to the AccelOps Report Server.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Analytics > Reports > Synced Reports
.
Select a report.
Currently only reports that contain a as the contain a Group By condition.
Select
Sync
.
Group By
condition can be synced. Both system and user-created reports can be synched as long
When the sync process initiates, the Supervisor node dynamically creates a table within the Report Server reportdb database. When the sync is established, it will run every five minutes, and the last five minutes of data in the synced report will be pushed to the corresponding table. This lets you run Visual Analytics on event data stored in the Report Server reportdb database.
Page 1067
FortiSIEM Installation Guide FortiSIEM Installation Guide
Working with the Report Server
This section contains information on AccelOps Report Server architecture, viewing and querying CMDB and Event data in contained in the Report
Server databases, and database maintenance.
Report Server Architecture: phoenixdb and reportdb
Working with CMDB Data in AccelOps Report Server
Viewing phoenixdb Organization
Querying Incident Data in AccelOps Report Server
Reference: Attribute Columns in the ph_incident_view Table
Querying Other CMDB Tables in AccelOps Report Server
Querying Device Vendor and Model Distribution for Discovered Devices
Working with Event Data in AccelOps Report Server
Syncing an AccelOps Report with Report Server
Deleting a Report from AccelOps Report Server
Modifying an Existing Report in AccelOps Report Server
Page 1068
FortiSIEM Installation Guide FortiSIEM Installation Guide
Report Server Architecture: phoenixdb and reportdb
AccelOps Report Server contains two databases:
phoenixdb
This database contains the entire AccelOps CMDB and is populated via asynchronous PostgreSQL replication (slony) in near-real time.
reportdb
This database contains the results of event queries.
Topics in this section describe how to view the tables in these databases, and how those tables are organized. For viewing the tables, we recommend using the pgAdmin PostgreSQL database utility, which you can download from the pgAdmin website.
Page 1069
FortiSIEM Installation Guide FortiSIEM Installation Guide
Working with CMDB Data in AccelOps Report Server
Data from the AccelOps CMDB database is populated to the AccelOps Report Server and stored in the Report Server phoenixdb. This section contains information on how to view the organization of phoenixdb, and write queries against the data it contains.
Viewing phoenixdb Organization
Querying Incident Data in AccelOps Report Server
Reference: Attribute Columns in the ph_incident_view Table
Querying Other CMDB Tables in AccelOps Report Server
Querying Device Vendor and Model Distribution for Discovered Devices
Page 1070
FortiSIEM Installation Guide FortiSIEM Installation Guide
Viewing phoenixdb Organization
This database contains the contents of the entire AccelOps CMDB database, including incidents.
1.
2.
In the pgAdmin utility , go to
File > Add Server
.
In the
New Server Registration
dialog, enter connection details for AccelOps Report Server.
For
3.
For
Maintenance DB
Username
and
, select
phoenixdb
.
Password
, use the read-only user name and password that you created when you provisioned the Report Server.
4.
5.
Click
OK
.
When the connection to the AccelOps Report Server is established, phoenixdb will load in the Object browser. There are approximately
197 tables in phoenixdb, which are replicated from the AccelOps cluster.
Select a table to view, then right-click to open the
Options
menu.
In the Options menu, select View Data, and then select an option for which rows you want to view.
For example, to view the contents of the ph_device
table, which contains CMDB information about discovered devices, you would select and then right click on ph_device
, then select View Data > View All Rows.
You can also use this method to examine Views and other objects in the phoenixdb database.
Page 1071
FortiSIEM Installation Guide FortiSIEM Installation Guide
Querying Incident Data in AccelOps Report Server
There are two ways to look at the incident data inside AccelOps Report Server:
Incident Tables ( ph_incident
and ph_incident_detail
Contains the incidents
Incident View ( ph_incident_view
)
)
This is a database view that adds other context to the incident tables by joining with other tables in the database. Added information includes location and business service. Some information is parsed out for easier query, such as host names and IP address fields from incident_source,
and incident_target
fields in ph_incident
are parsed out as separate fields in ph_incident_view
.
This topic describes how to view the data contained in
Incident View
.
1.
2.
Follow the instructions in
Viewing phoenixdb Organization to access the phoenixdb database in AccelOps Report Server.
3.
Go to
Views > ph_incident_view > Columns
to view the table columns.
Go to
Views > ph_incident_view > View Data >
View Last 100 Rows to view the incidents.
Page 1072
FortiSIEM Installation Guide FortiSIEM Installation Guide
Reference: Attribute Columns in the ph_incident_view Table
Column Name
incident_id cust_org_id first_seen_time last_seen_time
Format Description
integer Unique id for an incident integer Customer Id (for AO-SP) integer The time when the incident was first seen. The format is UNIX time but with milliseconds granularity. It is defined as the number of milliseconds that have elapsed since 00:00:00 Coordinated Universal Time
(UTC), Thursday, 1 January 1970 integer The time when the incident was last seen. The format is UNIX time but with milliseconds granularity. It is defined as the number of milliseconds that have elapsed since 00:00:00 Coordinated Universal Time
(UTC), Thursday, 1 January 1970 incident_et incident_status incident_count string Incident event type id e.g. PH_RULE_SERVER_HW_CRITICAL integer 0: Active 1: Auto Cleared 2: Manually Cleared 3: System Cleared integer The number of times this exact incident (with the same parameters: source, destination etc has happened) biz_name severity severity_cat orig_device_ip string Associated business service name integer Numerical severity of the incident - range 0-10 string string ph_incident_category
string
Incident severity category: 0-4: LOW, 5-8: MEDIUM and 9-10: HIGH
IP address of the device that reported the incident incident_src string
Category of infrastructure affected by this incident: possible valies: Network, Server, Storage,
Virtualization, Application, Internal
Incident Source string formatted as a list of <Attribute>:Value; e.g.
srcIpAddr:10.1.1.1,srcName:JoeLaptop src_ip_addr src_name src_state string string src_device_location string src_country string string src_building src_floor src_latitude src_longitude incident_target string string double double string dest_ip_addr dest_name dest_device_location string dest_country dest_state dest_building dest_floor dest_latitude string string string string string string double
Source IP parsed out from incident_src field
Source Name parsed out from incident_src field
(Geo) Location display name string for the object specified in incident_src
(Geo) Country name string for the object specified in incident_src
(Geo) State name for the object specified in incident_src
(Geo) Building name for the object specified in incident_src
(Geo) Floor for the object specified in incident_src
(Geo) Latitude for the object specified in incident_src
(Geo) Latitude for the object specified in incident_src
Incident Destination string formatted as a list of <Attribute>:Value; e.g.
"destIpAddr:10.1.1.1,destName:JoeLaptop" or "hostIpAddr:10.1.1.1,hostName:JoeLaptop"
Destination IP parsed out from incident_target field
Destination Name parsed out from incident_target field
(Geo) Location display name string for the object specified in incident_target
(Geo) Country name string for the object specified in incident_target
(Geo) State name for the object specified in incident_target
(Geo) Building name for the object specified in incident_target
(Geo) Floor for the object specified in incident_target
(Geo) Latitude for the object specified in incident_target
Page 1073
FortiSIEM Installation Guide FortiSIEM Installation Guide dest_longitude host_ip_addr double string host_name string host_device_location string host_country host_state host_building host_floor host_latitude host_longitude vm_name user_attr target_user_attr ldap_domain computer target_computer incident_details string string string string double double string string string string string string string
(Geo) Longitude for the object specified in incident_target
Host IP address parsed out from incident_target field
Host Name parsed out from incident_target field
(Geo) Location display name string for the object specified in incident_target - populated if incident_target contains hostIpAddr
(Geo) Country name string for the object specified in incident_target - populated if incident_target contains hostIpAddr
(Geo) State name for the object specified in incident_target - populated if incident_target contains hostIpAddr
(Geo) Building name for the object specified in incident_target - populated if incident_target contains hostIpAddr
(Geo) Floor for the object specified in incident_target - populated if incident_target contains hostIpAddr
(Geo) Latitude for the object specified in incident_target - populated if incident_target contains hostIpAddr
(Geo) Longitude for the object specified in incident_target - populated if incident_target contains hostIpAddr
VM Name if incident involves a Virtual machine - populated if incident_target contains vmName
User name if incident involves user, i.e. incident_target contains user
Target user name if incident involves user, i.e. incident_target contains targetUser
Domain if incident involves user, i.e. incident_target contains domain
Computer name incident_target contains computer
Target Computer name incident_target contains targetComputer
Incident Details containing evidence on why the incident triggered e.g. Triggered Event Count = 90 or
AVG(CPUUtil) = 90 etc
Page 1074
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sample Incident Queries
Show Incident Categories with Severity and Frequency Occurrence
Show Incident Categories with Severity and Frequency Occurrence
This query will show which parts of the infrastructure are triggering events.
1.
2.
3.
4.
Follow the instructions in Viewing phoenixdb Organization to access the phoenixdb in AccelOps Report Server.
Under
Views
, select
In pgAdmin
Enter this SQL query: ph_incident_view
.
, click on the
SQL
icon in the menu bar to open the SQL query window.
SELECTph_incident category, incident_et, severity_cat, src_ip_addr, host_name, COUNT(*)
FROMph_incident_view
GROUPBYph_incident category, incident_et, severity_cat, src_ip_addr, host_name
ORDERBYCOUNT(*) DESC;
5. When the query executes, you will see a list of matching incidents in the Output Pane.
Show Incident Location
1.
2.
3.
4.
Follow the instructions in Viewing phoenixdb Organization to access the phoenixdb in Accelops Report Server.
Under
Views
, select
In pgAdmin
Enter this SQL query: ph_incident_view
.
, click on the
SQL
icon in the menu bar to open the SQL query window.
SELECT host_device_location, severity_cat, ph_incident_category, COUNT(*)
FROM ph_incident_view
GROUP BY host_device_location, ph_incident_category, severity_cat
ORDER BY host_device_location ASC, severity_cat ASC COUNT(*) DESC;
5. When the query executes, you will see a list of incidents and their locations in the Output Pane.
Page 1075
FortiSIEM Installation Guide
Querying Other CMDB Tables in AccelOps Report Server
Querying Device Vendor and Model Distribution for Discovered Devices
FortiSIEM Installation Guide
Page 1076
FortiSIEM Installation Guide
Querying Device Vendor and Model Distribution for Discovered Devices
FortiSIEM Installation Guide
Page 1077
FortiSIEM Installation Guide
Querying Discovered Devices
FortiSIEM Installation Guide
Page 1078
FortiSIEM Installation Guide FortiSIEM Installation Guide
Working with Event Data in AccelOps Report Server
Data from the AccelOps EventDB database is populated to the AccelOps Report Server and stored in the Report Server reportdb. This section contains information on how to view the organization of reportdb, and write queries against the data it contains.
Syncing an AccelOps Report with Report Server
Deleting a Report from AccelOps Report Server
Modifying an Existing Report in AccelOps Report Server
Page 1079
FortiSIEM Installation Guide FortiSIEM Installation Guide
Viewing reportdb Organization
This database contains the reports that are synched from the AccelOps cluster.
1.
2.
In the pgAdmin utility , go to
File > Add Server
.
In the
New Server Registration
dialog, enter connection details for AccelOps Report Server.
For
Maintenance DB
For the
Port
enter
3.
For
Username
and
, select
30000 reportdb
(default port used for the reported).
Password
.
, use the read-only user name and password that you created when you provisioned the Report Server.
4.
5.
Click
OK
.
When the connection to the Report Server is established, reports will load in the Object browser.
Select a table to view, then right-click to open the
Options
menu.
In the Options menu, select View Data, and then select an option for which rows you want to view.
Page 1080
FortiSIEM Installation Guide FortiSIEM Installation Guide
Syncing an AccelOps Report with Report Server
1.
2.
3.
4.
Log in to AccelOps.
Go to
Analytics > Reports
.
Select a report.
Any reports with a
Sync
checkbox can be synced. Run the report to make sure it contains some data.
For each report you want to sync, select the
Sync
checkbox.
AO-SP
In the
Sync Details
dialog, select the organizations whose data needs to be synced.
5.
6.
7.
Click
OK
.
After several minutes, follow the instructions in
Under Tables, you should now see the synced reports.
to view the reportdb database.
Table Structure for Synced Reports
When you sync an AccelOps report to AccelOps Report Server, two pairs of tables are created in reportdb , one pair for each organization in the case of AO-SP. For each organization, multiple tables are created:
1. A
parent table
containing data for all months: the table name is of the form
<Report Name>_<ID>_<custId>
2. A child table for the current month:
<Report Name>_<ID>_<custId>_<yYYYYmMM>
where
YYYY
is the year and
MM
is the month.
Queries should be written using the parent table. To see data in the parent table , follow the instructions in
Viewing reportdb Organization . The
re portdb database fields are generated from the display fields in AccelOps report definitions. Only the field report_time
is added to the Report
Server table definitions to capture the time when the particular report is generated. For example, if you synced the report
Network Devices by
CPU, Memory, you would see these fields:
Field Description
report_time
UNIX time at which the report is generated.
January 1970 not counting leap seconds.
Unix time
(or
POSIX time
or
Epoch time
) is a system for describing instants in time, defined as the number of seconds that have elapsed since 00:00:00 Coordinated Universal Time (UTC), Thursday, 1 hostName
Host Name of the device for which CPU and memory are being measured hostIpAddr
Access IP of the device for which CPU and memory are being measured
AVG(cpuUtil)
Average of all the CPU utilization metrics within the last 5 minutes ending with report_time
AVG(memUtil)
Average of all the CPU utilization metrics within the last 5 minutes ending with report_time
Page 1081
FortiSIEM Installation Guide FortiSIEM Installation Guide
Deleting a Report from AccelOps Report Server
1.
2.
3.
4.
5.
Log in to AccelOps.
In
Analytics > Reports > Synced Reports
In the
Sync Details
dialog, clear the
Sync
, select the report you want to delete.
option for the report, and then click .
The report will no longer be synced with Report Server. You can verify this by making sure the on the
Analytics > Reports > Synced Reports
page. You can now delete the report from AccelOps Report Server.
Log in to AccelOps Report Server via SSH and navigate to the directory
Run the phreportdbmanager.py
OK
Sync
option is not selected for the report
/opt/phoenix/deployment/jumpbox.
command, along with the table name and date as arguments, to delete the report.
phreportdbmanager.py --remove tablenames='"Network Devices By CPU,
Memory_1278492569_1"'reporttimes=2014-10
Viewing the Names of Reports in Report Sever
Use the pgAdmin utility to view the names of all tables and reports in Report Server, as described in
When the deletion process completes, you will see a command line output like this:
6. After you have deleted the table containing the report information, you will need to delete the parent table, which will now be empty of content, using the same phreportdbmanager.py
command.
Page 1082
FortiSIEM Installation Guide FortiSIEM Installation Guide
Modifying an Existing Report in AccelOps Report Server
Suppose a system report is synced and exported to AccelOps Report Server. When you modify that report in AccelOps, you must rename it, at which point it becomes a user report. When you then sync that report for Accelops Report Server, a new table is created on the AccelOps Report
Server.
Suppose now that you have a user-defined report that is already synced to the AccelOps Report Server, but you modify it inline in AccelOps, which means that you have changed the report conditions without changing the report name. This will cause a change in the table, but a new table will not be created. Here are some examples of inline modifications, and how they affect the structure of the table as well as the data collected in the table:
Modification Effect
GROUP BY field added The corresponding table has the new GROUP BY field, but only newer data populates the field
There is no change in the corresponding table, and newer data does not populate the field GROUP BY field removed
GROUP BY field changed
For example, the field estlpAddr
.
srclpAddr
is changed to destlpAddr
. Both fields are retained, but newer data populates d
The corresponding table has the new field, but only newer data populate that field Aggregated fields added
Aggregated field removed
Aggregated Field
Changed
There is no change in the corresponding table, and newer data does not populate the field
For example,
X(cpuUtil)
.
AVG(cpUutil)
is changed to
MAX(cpuUtil)
. Both fields are retained, but newer data populates
MA
Page 1083
FortiSIEM Installation Guide FortiSIEM Installation Guide
Installing and Configuring Tableau Server
Prerequisites
Before you begin installing Tableau Server, make sure you have read the section on
Tableau Server
in Requirements for Visual Analytics Report
. This contains information on the Administrator Account and Ports that you will need during the configuration process. You may want to also consult the Tableau Server Administration Guide before you begin the installation process.
Installation
5.
6.
7.
8.
1.
2.
3.
4.
Download the installation file from Tableau Software .
Double-click the installation file to launch the Setup Wizard.
When the Setup Wizard launches, click
Next
to begin the installation process.
Enter a
Destination Location
where you want to install the server files, and then click
Next
.
When the system verification process completes, click
Click
Click
Install
Next
to complete the installation process.
to begin the server activation process.
Next
.
Enter a location for the Start Menu folder, or use the default location, and then click
Next
.
Activation
1.
2.
3.
If you are evaluating Tableau Server, click
If you enter a license key, click
Activate
.
Start trial now
. Otherwise, click
Activate the product
to enter a license key.
Click Continue to launch the Tableau Server configuration process.
Configuration
1. In the Configuration dialog, enter a
User Name
and
Password
for the domain admin account that you will use to administer the Tableau
2.
3.
Server.
If necessary, enter a
Gateway
port through which you will connect to the server over HTTP.
4.
5.
6.
7.
8.
Click
OK
.
The initialization process will launch and complete within several minutes.
Click
Finish
Launch the Tableau Server user interface by entering the URI for the server in a browser window.
The URI will be be in the format of http://<Windows_Server_IP_Address>:<Port_Number_Used_In_Step_2>
Sign in to the server by entering the credentials for the domain admin account that you created in Step 1, and then click
Click the
to complete the configuration process.
Admin
Under
Status
tab and select
Maintenance
.
, check to make sure that all systems are up and running.
Sign In
.
You are now ready to install Tableau Desktop. After you have completed the Desktop installation process and connect to Report Server for the first time to create a sheet, as described in
Server and Tableau Server.
Creating a Single Sheet Workbook , you will also establish the connection between AccelOps Report
Page 1084
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating and Managing Workbooks
This section contains information on using Visual Analytics Desktop to create sheets and workbooks that are based on AccelOps reports, and then publishing them for others to use.
Creating and Publishing Workbooks
Creating a Single Sheet Workbook
Creating a Multiple Sheet Workbook
Using AccelOps Workbooks with Tableau Visual Analytics Desktop and Server
Page 1085
FortiSIEM Installation Guide FortiSIEM Installation Guide
Viewing Workbooks
1.
2.
3.
Log in to Visual Analytics Server.
Click the
Content
tab and select
Click on a workbook.
Workbooks
.
4.
5.
The workbook along with the various worksheets are displayed.
Select a workbook or worksheet.
6.
You will be prompted for credentials that will allow the workbook or worksheet to access database information. Enter the Admin credential that you used to set up Accelops Report Server and click
OK
.
When your credential is accepted, the chart associated with the selected workbook or worksheet will be displayed.
Page 1086
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating and Publishing Workbooks
Workbooks are collections of AccelOps reports that have been synced to AccelOps Report Server, and which are then the basis for charts and dashboards that can be published to Visual Analytics Server for access by other users. Information in this section describes how to create single and multiple sheets of report information, and then make them accessible to other users.
Creating a Single Sheet Workbook
Creating a Multiple Sheet Workbook
Using AccelOps Workbooks with Tableau Visual Analytics Desktop and Server
Page 1087
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Single Sheet Workbook
These instructions demonstrate how to create a single-sheet workbook that will chart the CPU and memory utilization trend for various servers.
This example uses the
Servers by CPU, Memory
report and its associated table, but any report with a table in the reportdb database can also be used. The Tableau Desktop online Help also contains extensive information about building sheets and workbooks with the Tableau Desktop editor, which powers the AccelOps Visual Analytics Desktop.
Prerequisites
Follow the instructions in
Syncing an AccelOps Report with Report Server to sync the report you want to use for your worksheet.
the table that corresponds to your report.
Procedure
Create the Sheet
1.
2.
Launch Tableau Visual Analytics Desktop.
Connect to AccelOps Report Server with the
For
Database
, enter
reportdb
.
For
Port
, enter
30000
.
Username
and
Password
that you used during Report Server installation.
Connecting to Port 30000
It's important to make sure you enter the correct port to connect to the reportdb database. If you leave this option blank you will connect to the default PostgreSQL database port, which will connect you with phoenixdb instead of reportdb. For more
.
3. Under
Tables
, select the parent table for your report.
4.
5.
6.
For the steps following, we will use the
The data in the table will load into the pane below. Note that the table columns match closely to the Report Display Columns in
AccelOps.
Live
.
Servers by CPU, Memory
table and its associated columns.
Drag the table to the
View
pane and click
Update Now
.
7.
8.
For
Connection
, select
Click
Go to Worksheet
.
In the worksheet view you will see that a set of
Dimensions
and
Measures
are populated for the table.
Under
Measures
, select
Report Time
Under
Dimensions
, right-click on
and drag it to the
Report Time
Dimensions
section to create Report Time as a calculated measurement.
to edit the calculation formula and convert it to a human-readable format from UNIX time.
The formula should look like
DATEADD('second',INT([Report Time]),#1969-12-31 16:00:00#)
You may also want to rename to to make it easier to read on the resulting chart.
9.
10.
11.
12.
Drag
Report Time
Under
Columns
from
Dimensions Columns
, right-click on
Report Time
.
and select
Under
Measures
, select and drag
AVG(cpuUtil)
and
Exact Date
.
You should now see dates and time increments in your chart as the X-axis.
Set the aggregation of both
AVG(cpuUtil)
and
AVG(memUtil) Rows
to .
.
13.
For example,
AVG(AVG(cpuUtil))
and
AVG(AVG(memUtil)).
You should now see both measures on the Y-axis of your chart.
Under
Dimensions
, drag
Host Name
to the
14.
You can now edit the
Title
and
Color
section under
Each host will be assigned a color and added to the chart.
Marks
.
Change the chart display name for AVG(cpuUtil) and AVG(memUtil) by clicking on each in the Y-axis to launch the Edit Y-Axis dialog.
15.
16.
Under
Data
Range
, as well as other attributes, for each measure.
, click on the data source to open the Options menu, then click
Refresh
.
Rename the sheet by clicking on the data source to open the Options menu, then select
Rename and enter a new name.
Your sheet is now complete. Hover your mouse over a trend line to view information about a specific host.
Create the Workbook
1. Click the
Dashboard
tab
2.
on the bottom of the Sheet editor to open the
Dashboard
editor.
Page 1088
FortiSIEM Installation Guide FortiSIEM Installation Guide
2.
3.
4.
Under
Under
Dashboard
, select an appropriate
Size
and screen resolution.
Dashboard
, select the sheet and drag it into the display pane.
Open the
Dashboard
options menu and select
Rename
.
5.
Change the name of the dashboard from
In the File menu, select Save.
Publish the Workbook
.
1.
2.
3.
4.
5.
6.
In the
Server
Enter the
In the
See
Username
and
Server
.
Password
for the Visual Analytics Server admin user, and then click
.
Enter attributes for the workbook, such the associated
Click
menu, select
Sign In...
Enter the IP address and port number for the Visual Analytics Server.
Publish
Sign In
.
menu, select
Publish Workbook
, , and
for more information about user permissions for workbooks.
Views to Share
.
Page 1089
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Multiple Sheet Workbook
These instructions demonstrate how to create a multiple-sheet workbook that will contain a set of charts related to Network Health. This example uses the
Network Devices by Ping RTT
,
Network Interfaces By Utilization
, and
Network Devices By CPU, Memory
reports, but any report with an associated table and views in the reportdb database could be used.
The Tableau Desktop online Help also contains extensive information about building sheets and workbooks with the Tableau Desktop editor, which powers the AccelOps Visual Analytics Desktop.
Create a Workbook that Uses the View
Prerequisites
Follow the instructions in
You will need to know the name of the parent table for your synced reports. Follow the instructions in find the table that corresponds to your report.
Viewing reportdb Organization to
Procedure
Create a View
Each report you want to include in your workbook corresponds to a table in the AccelOps reportdb. These tables need to be joined to cross-link the information that will appear in your workbook. In the case of a Network Health workbook that includes the sheets Network Devices by Ping
RTT, Network Interfaces By Utilization, and Network Devices By CPU, Memory, the joining keys are
host name
and
time
.
1. Follow the instructions in
Viewing reportdb Organization to find the parent tables for the reports you want to join.
2.
For each report there is one parent table and multiple child tables containing data for a particular month.
Create a SQL statement in pgAdmin to join the tables.
In this example data is captured for one day. This enables quick generation of the data visualization.
Page 1090
2.
FortiSIEM Installation Guide FortiSIEM Installation Guide
SELECT cpu.report_time, cpu."hostName", cpu."hostIpAddr", cpu."AVG(cpuUtil)", cpu."AVG(memUtil)",
uptime."SUM(sysDownTime)", uptime."AVG(avgDurationMSec)", uptime."LAST(sysUpTime)",
uptime."SUM(pollIntv)", util."intfName", util."intfAlias",
util."AVG(inIntfUtil)" AS "totalAvgInIntfUtil", util."AVG(outIntfUtil)" AS "totalAvgOutIntfUtil",
util."AVG(recvBitsPerSec)" AS "totalAvgRecvBitsPerSec",
util."AVG(sentBitsPerSec)" AS "totalAvgSentBitsPerSec",
util."AVG(outQLen)", util."AVG(intfSpeed64)"
FROM "Network Devices By CPU, Memory_1278492569_1" cpu,
"Network Devices by Ping RTT_2021056235_1" uptime,
"Network Interfaces By Utilization_382117475_1" util
WHERE ((cpu.report_time * 1000)::double precision *
'00:00:00.001'::interval + '1969-12-31 16:00:00-08'::timestamp with time zone) >= (now() - 1::double precision * '1 day'::interval)
AND ((uptime.report_time * 1000)::double precision *
'00:00:00.001'::interval + '1969-12-31 16:00:00-08'::timestamp with time zone) >= (now() - 1::double precision * '1 day'::interval)
AND ((util.report_time * 1000)::double precision *
'00:00:00.001'::interval + '1969-12-31 16:00:00-08'::timestamp with time zone) >= (now() - 1::double precision * '1 day'::interval)
AND cpu.report_time = uptime.report_time AND cpu."hostName" = uptime."hostName" AND uptime.report_time = util.report_time AND uptime."hostName" = util."hostName";
3. Click the Play icon in pgAdmin to execute the query.
Make sure the output pane contains data that is the result of the query execution.
4. Modify the SQL statement to create a view.
Add this command at the top of the SQL statement:
CREATE OR REPLACE VIEW ph_network_health_view AS
Add this command at the bottom of the SQL statement:
grant select on ph_network_health_view TO public;
Your complete SQL statement should look like this:
Page 1091
4.
FortiSIEM Installation Guide FortiSIEM Installation Guide
CREATE OR REPLACE VIEW ph_network_health_view AS
SELECT cpu.report_time, cpu."hostName", cpu."hostIpAddr", cpu."AVG(cpuUtil)", cpu."AVG(memUtil)",
uptime."SUM(sysDownTime)", uptime."AVG(avgDurationMSec)", uptime."LAST(sysUpTime)",
uptime."SUM(pollIntv)", util."intfName", util."intfAlias",
util."AVG(inIntfUtil)" AS "totalAvgInIntfUtil", util."AVG(outIntfUtil)" AS "totalAvgOutIntfUtil",
util."AVG(recvBitsPerSec)" AS "totalAvgRecvBitsPerSec",
util."AVG(sentBitsPerSec)" AS "totalAvgSentBitsPerSec",
util."AVG(outQLen)", util."AVG(intfSpeed64)"
FROM "Network Devices By CPU, Memory_1278492569_1" cpu,
"Network Devices by Ping RTT_2021056235_1" uptime,
"Network Interfaces By Utilization_382117475_1" util
WHERE ((cpu.report_time * 1000)::double precision *
'00:00:00.001'::interval + '1969-12-31 16:00:00-08'::timestamp with time zone) >= (now() - 1::double precision * '1 day'::interval)
AND ((uptime.report_time * 1000)::double precision *
'00:00:00.001'::interval + '1969-12-31 16:00:00-08'::timestamp with time zone) >= (now() - 1::double precision * '1 day'::interval)
AND ((util.report_time * 1000)::double precision *
'00:00:00.001'::interval + '1969-12-31 16:00:00-08'::timestamp with time zone) >= (now() - 1::double precision * '1 day'::interval)
AND cpu.report_time = uptime.report_time AND cpu."hostName" = uptime."hostName" AND uptime.report_time = util.report_time AND uptime."hostName" = util."hostName"; grant select on ph_network_health_view TO public;
5. In pgAdmin, click the
Play
icon to execute the statement.
6. Using pgAdmin, navigate to the
Views
and make sure the ph_network_health_view
has been created.
7. Right-click on ph_network_health_view
to open the
Options
menu, then select
View Data > View Last 100 Rows
to make sure the view contains data.
Create a Workbook that Uses the View
1.
2.
Launch AccelOps Visual Analytics Desktop.
Connect to AccelOps Report Server with the
For
Database
, enter
reportdb
.
For
Port
, enter
30000
.
Username
and
Password
that you used during Report Server installation.
Page 1092
2.
FortiSIEM Installation Guide FortiSIEM Installation Guide
3. Under
Tables
, enter the name of the view you created in the search box to locate the view.
4. Drag the view into the
Join
pane and click
Update Now
The data in the view will load into the pane below.
.
5.
6.
For
Connection
, select
Live
.
Click
Go to Worksheet
.
In the worksheet view you will see that a set of
Dimensions
and
Measures
are populated for the view.
Page 1093
6.
FortiSIEM Installation Guide FortiSIEM Installation Guide
7.
An example worksheet showing CPU and Memory Utilization with several Dimensions and Measures populated from the original table.
For each report in your workbook you can now create an individual sheet, as described in
Create the Workbook
Creating a Single Sheet Workbook
.
1.
2.
Click the
Dashboard
tab on the bottom of the Sheet editor to open the
Drag each sheet you've created into the
Join
pane.
Dashboard
editor.
3.
4.
An example of three worksheets loaded into the Dashboard Join pane.
Under
Dashboard
, select an appropriate
Size
and screen resolution.
Rename
.
5.
Open the Dashboard
In the File menu, select Save.
Publish the Workbook
Options
menu and select
1.
2.
3.
4.
In the
Server
Enter the
menu, select
Sign In...
Enter the IP address and port number for the Visual Analytics Server.
Username
and
Password
for the Visual Analytics Server admin user, and then click
5.
In the
Server
.
Enter attributes for the workbook, such the associated
See Adding Users to Workbooks
Sign In
.
menu, select
Publish Workbook
, , and
for more information about user permissions for workbooks.
Views to Share
.
Page 1094
FortiSIEM Installation Guide
5.
6. Click
Publish
.
FortiSIEM Installation Guide
Page 1095
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using AccelOps Workbooks with Tableau Visual Analytics Desktop and Server
You can use any of the workbooks provided by AccelOps, which are attached to this page, to create visualizations of AccelOps data.
1.
2.
3.
4.
Download a workbook attached to this page to your local device where Tableau Visual Analytics Desktop is installed.
In Visual Analytics Desktop, go to
File > Open....
Browse to the file you downloaded and open it.
You can make any changes you want to the workbook, but you can upload it to the server and start using it as is. Follow the instructions in the
Publish the Workbook
section of Creating a Single Sheet Workbook
to publish to the Tableau Visual Analytics Sever, and add user permissions as described in
Accelops Incidents.twbx
Dec 08, 2014 by Phil
Gochenour
Drag and drop to upload or browse for files
Page 1096
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Users to Workbooks
Only the workbook publisher can give access to specific users during report creation time. As the AccelOps Visual Analytics Server Administrator, you can add users to the system and view which workbooks users can access.
Adding Users to Visual Analytics Server
Viewing User Access to Workbooks
Adding Users to Visual Analytics Server
1.
2.
3.
4.
5.
6.
Log in to AccelOps Visual Analytics Server.
In the
Admin
Click
Add
.
tab click
Users
.
Enter the user name as it appears in Active Directory.
Select the
Click OK.
License Level
for the user and assign
User Rights
as necessary.
Viewing User Access to Workbooks
1.
2.
3.
Log in to Visual Analytics Server.
In the
Admin
tab click
Users
.
Select a user name to see the workbooks that the user can access.
Page 1097
FortiSIEM Installation Guide FortiSIEM Installation Guide
Real Time Performance Probe
This section describes how to probe monitored devices for real time performance metrics.
Example - Real time Interface Statistics Display
Available metrics
CPU utilization
Memory utilization
Network interface statistics
Uptime
Disk utilization
SNMP Ping Statistics
Process Utilization
GUI launch locations
Real time Performance Metrics option is available from the following GUI locations
CMDB > Device > IP Address > Right click
CMDB > Device > Interfaces > Name > Right click
Incident > Incident Source and Incident Target > Right click
Running a real time probe
From any of the above locations, select
Real Time Performance Metrics
Select the parameters
Select
Job Name
as the metric of interest
Select polling
Frequency
in seconds
Select the number of
Runs
as the number of times the device will be polled
Select the
Collector
which should communicate to the device
Depending on the job name, you may also need to select a Filter. For example, select Interface Name for Network Interface
Statistics.
Click
Start
The data will start to be displayed in the chart below
You can select two fields to be displayed side-by-side by selecting one attribute in the
Left Chart
drop down selecting another attribute in the
Right Chart
drop down and selecting Right Chart
The probe will stop after the device has been probed for the specified number of
Runs.
To stop a probe, click
Probe.
Implementation Note
AccelOps uses the same event framework to collect data from the devices and display them in the GUI. However these events are neither stored in the database, nor do they trigger incidents.
Example - Real time Interface Statistics Display
Page 1098
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 1099
FortiSIEM Installation Guide FortiSIEM Installation Guide
Incidents - Flash version
Incidents are a category of events that are are triggered when a set of
the
Dashboard > Incident Dashboard
have set. You can also
and in the
Incidents
rule conditions have been met. When an incident occurs, it appears in both
tab, and, in some cases, a notification is sent based on the notification policies
from AccelOps incidents. Topics in this section cover the incident information that is available in the
dashboard, how to create incident notification policies, how to create tickets for AccelOps and other ticket-handling systems, and how to manage the IPS Vulnerability Map.
Overview of the Incident Dashboard
The Calendar View of Incidents
The Fishbone View of Incidents
Using Group By Attributes to View Incidents
Searching for Incidents by Incident Attributes
Adding Entries to the IPS Vulnerabilities Map
Creating an Incident Notification Policy
Sending Email and SMS Notifications for Incidents
Customizing Email Templates for Notifications
Setting Scripts as Notification Actions
Example of a Windows Restart Script as a Notification Action
Viewing Incident Notification History
Configuring Remedy to Accept Tickets from AccelOps Incident Notifications
Creating a Ticket from an Incident
Using Incidents in Searches and Rules
Creating an Historical Search from an Incident
Creating a Real Time Search from an Incident
Page 1100
FortiSIEM Installation Guide FortiSIEM Installation Guide
Incident Information
The Incident Dashboard displays incident information for your IT infrastructure based on the filter conditions you set. You can also view incidents grouped by incident attributes, use values in incident attributes to refine your searches, view information about
rules that triggered incidents, and
use incident information to create
Overview of the Incident Dashboard
The Calendar View of Incidents
The Fishbone View of Incidents
Using Group By Attributes to View Incidents
Searching for Incidents by Incident Attributes
Page 1101
FortiSIEM Installation Guide FortiSIEM Installation Guide
Overview of the Incident Dashboard
There are two ways you can view the incidents that are occurring in your IT infrastructure.
The
Incidents
tab, shown in the screenshot for this topic, where you can view incidents and incident details
Dashboard > Incident Dashboard, which includes the same incident summary and user interface controls found in the Incidents tab, but
which also provides other views of incidents, including a fishbone view
and severity of incidents overlaid on devices, a calendar view, and
of incidents in your infrastructure,
with the number
that includes both a summary view of incident source and target IP locations and a map view, along with the number and severity of incidents for that location overlaid on the map.
In both locations you can filter the incidents in the dashboard, find out more information about sources and targets of incidents, customize the dashboard layout, and manage the rules associated with incidents.
Incident Dashboard User Interface Controls
Incident Dashboard Filter Controls
Incident Dashboard User Interface Controls
This screenshot shows the Incidents tab with the major user interface controls outlined in red.
Incident Dashboard Filter Controls
The filter controls let you control which incidents are shown in the dashboard.
Filter
Control
Description
Page 1102
FortiSIEM Installation Guide FortiSIEM Installation Guide
Filter
Criteria
You have three options for the filter conditions:
ID
Search for an incident by ID
IP
Search for an incident based on an IP address
Advanced
Use this option to set filter conditions based on event attributes as described in
See Selecting Attributes for Structured Searches, Display Fields, and Rules
search filters.
Creating a Structured Real Time Search .
for more information about using attributes in
Group By
Use these options to group incidents in the dashboards based on incident attributes. See
Using Group By Attributes to View
Incidents for more information.
Use these options to only see incidents with the selected severity level
Severity
Function
Incident
Status
Use these options to view incidents related to a specific infrastructure functional area, such as
Filter incidents to view according to their status
Performance
Ticket
Status
Time
Selection
Filter incidents based on the status of their associated tickets. See
Select the time interval during which incidents should have occurred. The default is
Organization For multi-tenant deployments, select the organization you want to view incidents for.
for more information.
Last 2 Hours
.
or
Security
.
Impacts
For multi-tenant deployments, select an organization to view the incidents that are impacting it
Incident Management Controls
Filter
Control
Refresh
Edit Rule
Description
Refresh the dashboard view
Edit the rule associated with the incident. See the topics under
for more information.
Exception
Create an exception to the rule associated with the incident. See
Defining Rule Exceptions for more information.
Ticket
Create a ticket from the incident. See Creating Tickets for more information.
History
Clear
View the ticket history associated with an incident.
Clear the incident. See Defining Clear Conditions
for more information on how to set rule conditions that will automatically clear incidents. All non-security related incidents are cleared from the system every night at midnight local time, and will show a status of
System Cleared
. A status of
Manual Clear
means it was cleared by a rule condition.
means that a user cleared the incident from the Incident Dashboard, while
Clear
Comments Add comments to the incident
Columns
Change the columns displayed in the summary table. to the Incident Dashboard.
describes all the columns that can be added
Export
Export the incident information to a PDF or CSV file
Locations
View
geolocation information about the incidents. Pin colors on the map indicate incident severity:
Red: HIGH Severity
Yellow: MEDIUM Severity
Green: LOW Severity
Black: Incidents with multiple severity levels at the same location
Contextual Menus
Clicking on an item within a column of the incident summary will open a contextual menu, with options depending on whether the incident attribute you selected includes an IP address (
Source IP
or
Target IP
are an
Add to Filter
, for example), or some other kind of incident attribute. Shared between both menus
option, which enables you to select a result attribute and add it to the
Filter By
conditions. Both menus also include most of
Page 1103
FortiSIEM Installation Guide FortiSIEM Installation Guide the same options available in the Incident Management controls to edit and add exceptions to rules. The IP address contextual menu provides options to view more information about the associated device, with many of the same options you would find in the summary dashboards.
used in search
This screenshot shows the IP contextual menu open after selecting an IP address in the
Incident Source
column of the
Incidents
tab.
Incident Summary in the Dashboard > Incident Dashboard Contextual Menu
The
Dashboard > Incident Dashboard
contextual menu includes an option not found in the
Incident
tab view of incidents. Click in any column for an incident in the Incident Dashboard to open the contextual menu, and you will see the option
Show incident details
. If you select this option the
Incidents
tab view of incidents will load, and you will see detailed information about the incident you selected in the
Incident Details
pane.
Incident Details
The Incident Details pane at the bottom of the Incidents Dashboard provides you with information about a selected incident in three areas:
Incide
, , and
Related Incidents
.
Incident Details
The Incident Details include the ID of the incident, specific details about the event that triggered the incident, and the definition of the rule associated with the incident.
Triggered Events
The list of events that triggered the incident. For columns containing an event type, or host or IP information, click on an item to open a contextual menu and view more information about it.
Selecting Sub Patterns
If the rule that triggered the incident has multiple sub patterns, you can select a sub pattern to see which events met its conditions.
Related Incidents
Use this menu to view related incidents based on the , , , or
Reporting IP
associated with the selected incident.
Page 1104
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 1105
FortiSIEM Installation Guide FortiSIEM Installation Guide
Incident Dashboard Columns
This topic describes all the columns that can be used to create views in the Incident Dashboard. You can add or remove columns from the dashboard by clicking the
Columns
icon.
Column Name Description
Event Severity Category The severity of the incident, , , or
Low
Last Seen Time
First Seen Time
The last time that the incident was triggered
The first time that the incident was triggered
Incident Name
Incident ID
Incident Source
Incident Target
The name of the rule that triggered the incident
The unique ID assigned to the incident
The source IP or host name that triggered the incident
The IP or host name where the incident occurred
Event attributes that triggered the incident Incident Detail
Status
Cleared Reason
Cleared Time
Cleared User
Comments
Ticket Status
Ticket ID
The status of the incident, ,
The time an incident was cleared
The person who cleared the incident
,
Any comments that users have entered for the incident
Status of
associated with the incident
The ID number of any tickets generated by the incident
,
For manually cleared incidents, this displays the reason the incident was cleared
Ticket User
External User
External Cleared Time
External Resolved Time
External Ticket ID
External Ticket State
External Ticket Type
Organization
Impacts
Business Service
Incident Notification
Status
Notification Recipients
Incident Count
The person assigned to any tickets generated by the event
If the ticket was cleared in an external ticket-handling system, this lists the name of the person the ticket was assigned to
If the ticket was cleared in an external ticket-handling system, this lists the time it was cleared
If the ticket was resolved in an external ticket-handling system, this lists the time it was resolved
The ID of the incident in an external ticket-handling system
The state of the incident ticket in an external ticket-handling system
The type assigned to the incident ticket in an external ticket-handling system
The organization reporting the event
Organizations impacted by the event
Business services impacted by the incident
Status of
any notifications that were sent because of the incident
Who received notification of the incident
How many times the incident has occurred during the selected time interval
Page 1106
FortiSIEM Installation Guide FortiSIEM Installation Guide
The Calendar View of Incidents
The calendar view of incidents provides a summary view of the number of incidents that have occurred on a calendar day, grouped by severity.
Clicking a group loads a summary of those incidents.
This screenshot shows the calendar view of incidents for the month of February 2015.
Page 1107
FortiSIEM Installation Guide FortiSIEM Installation Guide
The Fishbone View of Incidents
The fishbone view of incidents presents a view of networks and devices in those networks, along with the incidents triggered for those devices over the last 24. This view is derived from the
in the CMDB, with the devices associated with those segments overlaid. The numbers and colors for each device indicate the number and severity of incidents associated with that device.
Clicking on an incident number will show you a summary of those incidents. Clicking on , ,
ent Details
in that summary will let you select
Incident Details
to view more information. the device will open a contextual menu that will let you find out more information about that device.
, or
Incid
Clicking on any IP addresses associated with
Clicking on an IP number or hostname in the fishbone view will let you view the
for that device, or you can select Topology to
view it within the context of your network topology.
Hovering your mouse cursor over a device or incident number will show you the IP address and host name for that device, as well as the type of device.
This screenshot shows an example fishbone view of network segments, devices, and associated incidents.
Page 1108
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using Group By Attributes to View Incidents
The Incident Dashboard presents a view of all incidents based on the filter conditions you select. However, there may be situations in which you want to view incidents grouped on incident attributes like , . Once incidents are grouped by their attributes, you can view
Incident Details
,
for the entire group.
, or
Incident Name
1.
2.
3.
4.
5.
Log in to your Supervisor node.
Go to
In the
Incidents
.
Group By
The Incident Dashboard will refresh and display incidents grouped according to the attributes you selected, with a
COUNT(Matched
Events)
menu, select the attributes you want to use to group the incidents, and then click column that indicates how many incidents are in each group.
Select a group and then click on it to open the
In the Options menu, select
Options
menu.
Show Incident Details for This Group
out more information about them.
.
Refresh
.
The Incident Dashboard will refresh to show all incidents in the selected incident group, and you can use the
to find
Page 1109
FortiSIEM Installation Guide FortiSIEM Installation Guide
Searching for Incidents by Incident Attributes
As your review incidents in your dashboard, you may want to build searches based on attributes from selected incidents. For example, you may want to use the value for the
Incident Target
conditions based on the results of that search.
attribute in an incident as a filter condition to find similar or related incidents, and then add more
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Incidents
.
In the Incident Dashboard, select an incident.
Click on the attribute value for the selected incident that you want to add to the
Filter By
condition to open the
Options
Click in the Filter By Conditions field to open the Conditions Builder and add other incident attributes.
Click
Refresh
when you're done creating filter conditions to see the results.
menu, and then
5.
6. select
Add to Filter
.
The type of search will change to
Advanced
, and the attribute value you selected will be added to the Filter By conditions.
Page 1110
FortiSIEM Installation Guide FortiSIEM Installation Guide
The IPS Vulnerability Map
The IPS Vulnerability Map lists devices that have a known vulnerability. You can view the IPS Vulnerability Map by going to
Incidents > IPS
Vunerability Map
, and you can also add new devices to the map.
The IPS Vulnerability Map includes these columns.
Column
IPS Event Types
Vendor Vulnerability ID
Description
The event types associated with the vulnerability
The vulnerability ID provided by the device vendor
CVE IDs
The vulnerability ID provided by Common Vulnerabilities and Exposures
Vulnerability Description A brief description of the device's vulnerability
Found in Device Type
Found in Version
Fixed in Version
Specific devices or applications that have the vulnerability
The version of the device or application that has the vulnerability
The version in which the vulnerability was fixed
Fixed via Patches
The patch version in which the vulnerability was fixed
Adding Entries to the IPS Vulnerabilities Map
Page 1111
FortiSIEM Installation Guide FortiSIEM Installation Guide
Adding Entries to the IPS Vulnerabilities Map
Updating IPS Vulnerability Map Entries
You can update existing entries, for example when a patch is released to fix a vulnerability, by selecting an entry in the IPS
Vulnerabilities Map and clicking
Edit
.
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Incidents > IPS Vulnerability Map
.
5.
6.
Click
Add
Select the
.
IPS Event Type
associated with the vulnerability.
Enter any
Vendor Vulnerability ID
s.
7.
8.
9.
10.
Enter any
CVE ID
s.
See the Common Vulnerability and Exposures website for CVE IDs. Separate multiple IDs with commas.
Enter a
Vulnerability Description
.
For
Affected Software
, click
Add
, and then select the affected devices or applications from the
Found in Device Type
menu.
11.
12.
Enter any
Found in Version
information for the affected software.
Enter any fix information for the vulnerability.
Click
Click
OK
.
Save
.
Page 1112
FortiSIEM Installation Guide FortiSIEM Installation Guide
Incident Notifications
The sending of notifications when an incident occurs is handled by Notification Policies, which you can see listed in the
Analytics > Incident
Notification Policies
page. Instead of having notifications set for each rule, you can create a policy and have it apply to multiple rules.
When viewing the notification policies, think of the columns on the page as representing a series of "If ... and ... then" statements that lead to the notification action. For example, you could read the table columns as a sentence:
"IF
Incident Severity
is X1 AND
Rule
is X2 AND
Time Range
is X3 AND
Affected Items
includes X4 AND
Affected Organizations
is X5,
THEN take the actions specified in the
ACTION
column."
When AccelOps evaluates whether a notification action should be triggered based on the notification conditions, it evaluates all notification policies, and will trigger the actions of all policies that meet the condition, instead of just the first policy that meets the conditions. This means that the order of policies in the list doesn't matter, and that you can write policies with overlapping conditions that could also, for example, include different actions.
See also the topics under
for more information about the methods that are available for sending notifications from AccelOps, including the AccelOps API.
Creating an Incident Notification Policy
Sending Email and SMS Notifications for Incidents
Customizing Email Templates for Notifications
Setting Scripts as Notification Actions
Example of a Windows Restart Script as a Notification Action
Viewing Incident Notification History
Page 1113
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating an Incident Notification Policy
Prerequisites
Make sure you have enabled the settings for sending email or other notification actions as described in
Setting Up Routing Information for
Reports and Incident Notifications
You should read t
.
he introductory topic on incident notifications to understand how policy conditions are processed..
Procedure
1.
2.
3.
4.
5.
6.
7.
Log in to your Supervisor node.
Go to
Analytics > Incident Notification Policy
.
Click
New
.
Select the
Incident Severity
.
Only incidents matching the severity level you select will trigger a notification.
For
Rules
Set a
, click and select the rule or rules you want to trigger this notification.
Time Range
during which this notification will be in effect.
Notifications will be sent only if an incident occurs during the time range you set here.
For
Affected Items
, click and use the CMDB Browser to select the devices or applications for which this policy should apply.
Instead of individual devices or groups, you can apply the notification policy to an IP address or range by clicking
Add
under
IP/Range
.
You can also select a group, and then select the
Not
option to explicitly exclude that group of applications or devices from the notification
8.
9. policy.
For multi-tenant deployments, select the
Organizations
to which the notification policy should apply.
Notifications will be sent only if the triggering incidents affect the selected organization.
Select the
Actions
to take when the notification is triggered.
Setting Scripts as Notification Actions
for more information about notification actions.
10.
11.
12.
Status from External Ticketing Systems
Enter any
Comments
about the policy.
When you are finished creating the notification policy, select
Click
Save
.
Enabled
to make it active in your deployment.
Page 1114
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sending Email and SMS Notifications for Incidents
When you set actions for an incident notification, one option is to send an email or SMS message to groups or individuals, and you also have an option to specify a template that should be used in the email.
Prerequisites
Make sure the email gateway has been configured for your deployment.
You should also have set up any
email templates that you want to use for notifications.
Procedure
1.
2.
3.
4.
5.
6.
Log in to your Supervisor node.
Go to
Analytics > Incident Notification Policy
.
Select the policy that you want to set up the email or SMS notification for.
Under
Under
In the
7.
In the
Actions
Folders
Folders
Items
, next to the email/sms notification table, click .
For multi-tenant deployments, select the
Organization
that contains the individuals or groups you want notified.
, you will see the user groups for that organization listed.
pane, select a group
Select a group and click
.
pane, you will see a list of users for that group.
Folder >>
to add a group to the
Notification Actions
list, or select individual users and click
Items >>
.
Adding Individual Email Addresses
If you want to set up notifications for individual email addresses without selecting from a user group, click
Add
Addr
and enter the addresses separated by commas.
under
8.
9.
Under
Notification
Actions, select the
Select an
Email Template
if you are sending an email notification.
10.
If you leave this blank, the
Click Save.
Method
, Email or SMS, that you want to use sending the notification.
will be used.
Run On
The
Run On
column only applies if your notification action is to
auto-populated with
Super
.
. For email and SMS notification actions, it will be
Related Links
Setting Scripts as Notification Actions
Page 1115
FortiSIEM Installation Guide FortiSIEM Installation Guide
Customizing Email Templates for Notifications
Email templates for incident notifications are based on incident variables that you put into the subject and body of the template, which are then populated with the actual attribute values in the incident.
Incident Attribute Variables
These are the incident attribute variables you can use for your email template.
$organization
$status
$hostName
$incidentId
$incidentTime
$firstSeenTime
$lastSeenTime
$incident_severityCat
$incident_severity
$incident_incidentCount
$ruleName
$ruleDescription
$incident_source
$incident_target
$incident_detail
$affectedBizService
Example Email Template
This example first shows a template with the incident attribute variables, and then an email based on this template with the variables populated from an incident.
Template
Email Subject:
$ruleName was triggered at $incidentTime
Email Body:
The host, $incident_target, was being scanned by $incident_source starting at $firstSeenTime and ending at $lastSeenTime. There were
$incident_incidentCount hits.
Please investigate and report as necessary.
Generated Email
Subject: Server Memory Warning was triggered at Jan 10 22:43 UTC
Body: The host, Host IP: 192.168.1.23 Host Name: QA-V-WIN03-ORCL, was being scanned by 10.1.1.1 starting at Jan 10 22:05 UTC and ending at Jan 10 22:11 UTC. There were 2 hits.
Please investigate and report as necessary.
Creating an Email Template
1.
2.
3.
4.
5.
6.
Log in to your Supervisor node.
Go to
Admin > General Settings > Incident Email Templates
.
Click
Add
For multi-tenant deployments, select the organization for which you are creating the email template.
Enter a
.
Name
Enter the
7. Click
OK
.
for the template.
Email Subject
and
Email Body
You can select attribute variables from the
.
Insert Content
menu to enter into your template, rather than having to type them out by hand.
Setting a Default Template
When you are creating a notification policy and need to select an email template, if you leave the option blank, the default template will
Page 1116
FortiSIEM Installation Guide FortiSIEM Installation Guide be used. To set an email template as default, select the template in the list on the
as Default
default email template for that organization.
Incident Email Templates page,
and then click
Set
. For multi-tenant deployments, to select a template as default for an organization, first select the organization, then set the
Page 1117
FortiSIEM Installation Guide FortiSIEM Installation Guide
Setting Scripts as Notification Actions
One of the actions you can specify for an incident notification is to execute a script. For example, suppose you are monitoring Windows services that are in Auto mode, and you have rules that will trigger an incident if one of those services is stopped. The notification action for that incident can include the running of a script by AccelOps that will re-start the service, as shown in the example scripts in this topic.
How Script Notification Actions are Processed
1. When you specify the notification action as a script, you must provide the full path to the script in the notification policy settings, for
2. example
/tmp/Myscript.py
.
You must write the script so it expects the incident XML file to be located in the same directory as the script, for example
/tmp
if the
3. script location is
/tmp/Myscript.py
.
4.
5.
When a notification policy is triggered by an incident, the policy actions are handled in sequential order, so if there are multiple script actions, the first one will be processed before the second one.
When the script action is processed, the AccelOps notification module will first generate an incident XML file and put it in the same directory as the script. AccelOps will then call the script with the XML file name as an argument.
When the script returns, the incident XML file that was created by AccelOps is deleted, so there is no confusion with the next script action which involves a new incident XML file and is processed only after the previous script action is complete.
Setting a Script Notification Action
1.
2.
3.
4.
Log in to your Supervisor node.
Go to
Analytics > Incident Notification Policy
.
Select the notification policy where you want to add the script action.
Under
Actions
, next to the
Methods ...
5.
6.
7.
Under
For
Script Name
, enter the name of the script and the absolute directory path to it.
Click
Run Script
OK
.
, click
Add
.
The script will be added to the
Notification Actions
.
Selecting the Collector Where the Script Will Run
If your deployment includes Collectors, you can specify the Collector where the script will run.
1.
2.
Prepare the script on the Collector(s) and make sure they run properly
When incident triggers, Collector will download the incident XML from the Supervisor and run the script with incident XML as
3. argument
The Collector will then return the results to the Supervisor.
In the
Notification Actions
table, select the Collector from the list in the notification actions.
Run On
menu after you have added the script to the
Page 1118
FortiSIEM Installation Guide FortiSIEM Installation Guide
Example of a Windows Restart Script as a Notification Action
This topic provides an example of a script that could be used as a notification action, following the example of re-starting a Windows service that
has stopped an triggered an incident as described in Setting Scripts as Notification Actions
.
This example requires two scripts: one located on the Windows server that hosts the service, and a script on the AccelOps Supervisor host machine that will be triggered by the incident notification and will execute the Windows server script.
Windows Script
1. Create a script named installWinexeSvc.bat
for starting the remote winexe
provider service.
sc create AoWinexeSvc binPath= C:\WINDOWS\WINEXESVC.EXE start= auto
DisplayName= AoWinexeSvc sc description AoWinexeSvc "Remote command provider for AccelOps monitoring" sc start AoWinexeSvc
2. Run installWinexeSvc.bat
on the monitored Windows server and make sure that the
AoWinexeSvc
service starts.
C:\>installWinexeSvc.bat
You should see an output similar to this as Windows installs the service and verifies that it is running.
C:\>sc create AoWinexeSvc binPath= C:\WINDOWS\WINEXESVC.EXE start= auto
DisplayName= AoWinexeSvc
[SC] CreateService SUCCESS
C:\>sc description AoWinexeSvc "Remote command provider for AccelOps monitoring"
[SC] ChangeServiceConfig2 SUCCESS
C:\>sc start AoWinexeSvc
SERVICE_NAME: AoWinexeSvc
TYPE : 10 WIN32_OWN_PROCESS
STATE : 2 START_PENDING
(NOT_STOPPABLE, NOT_PAUSABLE,
IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x7d0
PID : 1580
FLAGS :
AccelOps Script
This script, restartWinService.py
to restart the service.
, parses out the target IP and stopped service, and issues a winexe
command
Page 1119
FortiSIEM Installation Guide FortiSIEM Installation Guide
#!/usr/bin/python importos, re, sys, time importxml.dom.minidom
iflen(sys.argv) != 2:
print "Usage: parseTargetIP.py incident.xml"
exit() else:
fileName = sys.argv[1] print "parsing incident xml file : ", fileName
#os.system("cp "+ fileName + " "+ fileName + ".txt")
# /incident/incidentTarget/entry[@attribute='hostIpAddr'] doc = xml.dom.minidom.parse(fileName) nodes = doc.getElementsByTagName('incidentTarget') ifnodes.length < 1:
print "no incident Target found!" else:
targeNode = nodes[0] targetIP = "" fornode in targeNode.childNodes :
ifnode.nodeType == node.ELEMENT_NODE:
ifnode.getAttribute("attribute") == "hostIpAddr":
targetIP = node.firstChild.data
iftargetIP == "":
print "no incident target found!"
# trim IP, e.g. 10.1.20.189(SH-Quidway-SW1) targetIP = re.sub(r'\(.+\)', "", targetIP) print "restart service for target IP: ", targetIP
# parse process name nodes = doc.getElementsByTagName('incidentDetails') ifnodes.length < 1:
print "no incidentDetails found!" else:
targeNode = nodes[0] fornode in targeNode.childNodes :
ifnode.nodeType == node.ELEMENT_NODE:
ifnode.getAttribute("attribute") == "serviceName":
targetService = node.firstChild.data
########################################################################
########################
# NOTE: You need to replace the user and password with an account on your Windows server that #
# has permissions to run thiswindows command.
#
########################################################################
########################
# stop the service stopCmd = "winexe --user Administrator --password ProspectHills! //"+ targetIP + " 'sc stop "+ targetService + "'" ret = os.system(stopCmd)
Page 1120
FortiSIEM Installation Guide FortiSIEM Installation Guide print "stop service with return code ,", ret print "waiting service stop" time.sleep(10)
########################################################################
########################
# NOTE: You need to replace the user and password with an account on your Windows server that #
# has permissions to run thiswindows command.
#
########################################################################
########################
## start the service startCmd = "winexe --user Administrator --password ProspectHills! //"+ targetIP + " 'sc start "+ targetService + "'"
Page 1121
FortiSIEM Installation Guide print "start command: ", startCmd ret = os.system(startCmd) print "start service with return code ,", ret
FortiSIEM Installation Guide
Page 1122
FortiSIEM Installation Guide
Incident XML File Format
This topic includes an example of the XML file that is generated for incidents, and descriptions of its contents.
XML Tag and Attribute Definitions
Example Incident XML File
FortiSIEM Installation Guide
<?xml version="1.0" encoding="UTF-8" ?>
<incident incidentId="5672" ruleType="PH_RULE_AUTO_SRVC_DOWN" severity="10" repeatCount="1" organization="Super" status="Cleared">
<name>Auto Service Stopped</name>
<description>Detects that an automatically running service stopped.
Currently this works for windows servers and is detected via
WMI.</description>
<displayTime>Fri Jun 29 15:51:10 PDT 2012</displayTime>
<incidentSource>
</incidentSource>
<incidentTarget>
<entry attribute="hostIpAddr" name="Host IP">172.16.10.15</entry>
<entry attribute="hostName" name="Host Name">QA-V-WIN03-ADS</entry>
</incidentTarget>
<incidentDetails>
<entry attribute="serviceName" name="OS Service
Name">Spooler</entry>
<entry attribute="servicePath" name="OS Service
Path">C:\WINDOWS\system32\spoolsv.exe</entry>
</incidentDetails>
<affectedBizSrvc>Auth Service</affectedBizSrvc>
<identityLocation>
</identityLocation> <rawEvents>
[SrvcDown]
[PH_DEV_MON_AUTO_SVC_START_TO_STOP]:[eventSeverity]=PHL_INFO,[fileName]= phPerfJob.cpp,[lineNumber]=6005,[hostName]=QA-V-WIN03-ADS,[hostIpAddr]=1
72.16.10.15,[serviceName]=Spooler,[servicePath]=C:\WINDOWS\system32\spoo lsv.exe,[serviceDesc]=Manages all local and network print queues and controls all printing jobs. If this service is stopped, printing on the local machine will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.,[phLogDetail]=
</rawEvents>
</incident>
XML Tag and Attribute Definitions
XML Tag
<incident>
Attributes
incidentID
Description
Unique id of the incident in AccelOps. You can search for the incident by using this ID.
Page 1123
FortiSIEM Installation Guide FortiSIEM Installation Guide
<name>
<description>
<displayTime>
<incidentSource>
<incidentTarget>
<incidentDetails>
<affectedBizSrvc> ruleType severity
Unique id of the rule in AccelOps
The severity of the incident, HIGH MEDIUM LOW repeatCount
How many times this incident has occurred organization
In multi-tenant deployments, the organization affected by the incident status
The status of the incident
The name of the rule that triggered the incident
The description of the rule that triggered the incident
The time when the incident occurred
The source of the incident. It includes the event attributes associated with the source presented as name:value pairs. Common attributes for source and target tributes here are srcIpAddr
, de stIpAddr
, hostIpAddr
.
Where the incident occurred, or the target of an IPS alert. It includes the event attributes associated with the target presented as name:value pairs. Common attributes for source and target tributes here are srcIpAddr
, destIpAddr
, hostIpAddr
.
The event attributes associated with the rule definition that triggered the incident
Any business services impacted by the event
<identityLocation>
<rawevents>
Information associated with the Identity and Location Report
The contents of the raw event log for the incident.
Page 1124
FortiSIEM Installation Guide FortiSIEM Installation Guide
Viewing Incident Notification History
There are two ways you can view the notification history for an incident.
1.
2.
In the
Incident Notification Status
Click on an incident in the
Incident Name
column of the Incident Dashboard, and then select
s
menu.
.
View Notification History
from the
Option
Page 1125
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating Tickets
AccelOps includes a feature that will let you create and assign tickets for IT infrastructure tasks, and create tickets directly from incidents. You can see all tickets that have been created by going to Incidents > Tickets, and then use the filter controls to view tickets by assignee, organization, priority, and other attributes. You can also configure AccelOps and you Remedy system so that Remedy will take tickets created by incident notification actions.
Configuring Remedy to Accept Tickets from AccelOps Incident Notifications
Creating a Ticket from an Incident
Page 1126
FortiSIEM Installation Guide FortiSIEM Installation Guide
Configuring Remedy to Accept Tickets from AccelOps Incident Notifications
This topic describes how to configure Remedy to accept tickets as notification actions from AccelOps.
Incident Attributes for Defining Remedy Forms
Prerequisites
Make sure you have configured the
Remedy server settings in AccelOps.
Procedure
1. In Remedy, create a new form,
AccelOps_Incident_Interface
, with the incident attributes listed in the table at the end of this topic as the
2.
3.
4.
5. form fields.
When you have defined the fields in the form, right-click on the field and select the
Data Type
that corresponds to the incident attribute.
After setting the form field data type, click in the form field again to set the
When you are done creating the form, go to
For
Label
Servers > localhost > Web Service
AccelOps_Incident_Interface
.
for the field.
in Remedy, and select
New Web Service
.
6.
7.
8.
9.
Base Form
, enter
Click the
For the
Click the
WSDL
Permissions
Click
Save.
tab.
WSDL Handler URL
nterface
.
, enter http://<midtier_server>/arsys/WSDL/public/<servername>/AccelOps_Incident_I
tab and select
Public.
You can test the configuration by opening a browser window and entering the WSDL handler URL from step 7, substituting the Remedy Server IP address for
<midtier_server>
and localhost
for
<servername>
. If you see an XML page, your configuration was successful.
Incident Attributes for Defining Remedy Forms
Incident Attribute biz_service cleared_events cleared_reason cleared_time cleared_user comments cust_org_id first_seen_time last_seen_time incident_count incident_detail incident_et incident_id incident_src incident_status incident_target integer text notif_recipients text notification_action_status text text text bigint text text bigint bigint bigint integer
Data Type text text text bigint character varying(255)
Description
Name of the business services affected by this incident
The reason for clearing the incident if it was cleared,
The time at which the incident was cleared
The user who cleared the incident
Comments
The organization id to which the incident belongs
Time when the incident occurred for the first time
Time when the incident occurred for the last time
Number of times the incident triggered between the first and last seen times
Incident Detail attributes that are not included in incident_src and incident_target
Incident Event type
Incident Id
Incident Source
Incident Status
Incident Target
Incident Notification recipients
Page 1127
FortiSIEM Installation Guide FortiSIEM Installation Guide orig_device_ip ph_incident_category rule_id severity severity_cat ticket_id ticket_status ticket_user view_status view_users text character varying(255) bigint integer character varying(255) character varying(2048) integer character varying(1024) integer text
AccelOps defined category to which the incident belongs: Network, Application, Server, Storage,
Environmental, Virtualization, Internal, Other
Rule id
Incident Severity 0 (lowest) - 10 (highest)
LOW (0-4), MEDIUM (5-8), HIGH (9-10)
Id of the ticket created in AccelOps
Status of ticket created in AccelOps
Name of the user to which the ticket is assigned to in AccelOps
Page 1128
FortiSIEM Installation Guide
Creating a Ticket
1.
2.
3.
Go to
Incidents > Tickets
.
Click
New
.
Enter a
Summary
and
Description
for the ticket.
Both of these fields are required.
For
Assigned To
, select a user from the menu. 4.
5.
6.
7.
Set any
Select a
Due Date
Priority
Click
Save
.
for the ticket.
for the ticket.
FortiSIEM Installation Guide
Page 1129
FortiSIEM Installation Guide
Creating a Ticket from an Incident
1.
2.
In the Incident Dashboard, select the incident you want to create a ticket for.
Click
Ticket
.
The ,
3.
4.
5.
6.
Enter a
and
Description
for the ticket will be populated from the incident information.
Select the person you want to assign the ticket to.
Due Date
for the ticket.
Set a
Priority
for the ticket.
Click
Save
.
FortiSIEM Installation Guide
Page 1130
FortiSIEM Installation Guide
Using Incidents in Searches and Rules
Creating an Historical Search from an Incident
Creating a Real Time Search from an Incident
FortiSIEM Installation Guide
Page 1131
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating an Historical Search from an Incident
When you are viewing an incident, you may want to about other events related to the source or target of the incident. This topic describes how to
from an incident.
1.
2.
In the Incident Dashboard, select the incident you want to use.
Select the Incident Source or Incident Target you want to use, and then select
Show Related Historical Events
.
The Historical Search interface will load, with the IP address of the selected incident attribute loaded in the
Filter By
conditions, and the
3.
4.
Display Fields
set to the incident attributes.
Click
Run
.
You will see a list of events for the Incident Source or Target, which you can further analyze as described in
Page 1132
FortiSIEM Installation Guide FortiSIEM Installation Guide
Creating a Real Time Search from an Incident
When you are viewing an incident, you may want to about other events related to the source or target of the incident. This topic describes how to create a
from an incident.
1.
2.
In the Incident Dashboard, select the incident you want to use.
Select the
Incident Source
or
Incident Target
you want to use, and then select
Show Related Real Time Events
.
3.
4.
The real time search interface will load, with the IP address of the selected incident attribute loaded in the
Filter By
conditions, and the
Di splay Fields
set to the incident attributes.
Click
Run
.
You will see a list of events for the Incident Source or Target, which you can further analyze as described in
.
Page 1133
FortiSIEM Installation Guide
Editing Rules from Incidents
If you need to edit the rule associated with an incident, you can do so directly from the Incident Dashboard.
1.
2.
3.
In the Incident Dashboard, select an incident based on the rule you want to edit.
Click in any column of the selected incident to open the
Edit the rule as necessary, and then click
Save
.
Options
menu, and then select
Edit Rule
.
FortiSIEM Installation Guide
Page 1134
FortiSIEM Installation Guide
Incidents - HTML5 version
Incident tab allows users to view and manage incidents.
FortiSIEM Installation Guide
Page 1135
FortiSIEM Installation Guide FortiSIEM Installation Guide
Incident Attributes
This topic describes all the columns that can be used to create views in the Incident Dashboard. You can add or remove columns from the dashboard by clicking the
Columns
icon.
Column Name
Severity
Last Occurred
First Occurred
Incident
Incident ID
Source
Target
Detail
Status
Cleared Reason
Cleared Time
Cleared User
Comments
Ticket Status
Ticket ID
Ticket User
External User
External Cleared Time
External Resolved Time
External Ticket ID
External Ticket State
External Ticket Type
Organization
Impacts
Business Service
Incident Notification
Status
Notification Recipients
Incident Count
Description
The severity of the incident, , , or
Low
The last time that the incident was triggered
The first time that the incident was triggered
The name of the rule that triggered the incident
The unique ID assigned to the incident
The source IP or host name that triggered the incident
The IP or host name where the incident occurred
Event attributes that triggered the incident
The status of the incident, , , ,
For manually cleared incidents, this displays the reason the incident was cleared
The time an incident was cleared
The person who cleared the incident
Any comments that users have entered for the incident
Status of
associated with the incident
The ID number of any tickets generated by the incident
The person assigned to any tickets generated by the event
If the ticket was cleared in an external ticket-handling system, this lists the name of the person the ticket was assigned to
If the ticket was cleared in an external ticket-handling system, this lists the time it was cleared
If the ticket was resolved in an external ticket-handling system, this lists the time it was resolved
The ID of the incident in an external ticket-handling system
The state of the incident ticket in an external ticket-handling system
The type assigned to the incident ticket in an external ticket-handling system
The organization reporting the event
Organizations impacted by the event
Business services impacted by the incident
Status of
any notifications that were sent because of the incident
Who received notification of the incident
How many times the incident has occurred during the selected time interval
Page 1136
FortiSIEM Installation Guide FortiSIEM Installation Guide
Viewing Incidents
List view of all incidents
This is the default view when user clicks the Incident tab. On a fresh install,
Active Incidents over the last 2 hours are displayed
The following incident attributes are shown
Severity - High, Medium, Low - shown by colored icons
Last Occurred - the last time the Incident happened
Reporting Device Name - names of devices that reported the events that led to the incident
Incident - rule name
Source - incident source
Target - incident target
Detail - incident parameters other than source and target
Count - number of times the same incident has triggered
To show incidents over a different time interval
Click
Time Range
Button
A search window appears
To choose a relative time window
Choose
Time Range
Operator as
LAST.
Specify the number of Minutes/Hours/Days/Weeks.
Click
Check
button.
The Incident page will automatically refresh to show all the incidents over the time window.
To choose an absolute time window
Choose
Time Range
Operator as
Specify the starting and end times.
FROM.
Click
Check
button.
The Incident page will automatically refresh to show all the incidents over the time window
An incident can be in any of the following states
Active
Cleared
Cleared Manually
System Cleared
By default only Active Incidents are shown. To show Incidents in other states
Click
Incident Status
Button
A search window appears
To add a new value, click on the white space next to the selected value. A menu appears. Select the needed values one by one.
Click
Check
button
The Incident page will automatically refresh to show all the incidents in selected state(s)
To select a different set of Incident attributes
Click
Choose columns
icon
In the popup, select the columns you want to display by moving them to the right. You can re-order the position of the columns.
Click
OK.
To force a refresh of the incident view, click the
Refresh
icon
Incidents may be displayed over multiple pages. To see incidents on a different page,
Select the
Page Selector
icon
Either enter the page number or click on the Next or Previous icon to go to the right page
To view incidents for a different organization (Service Provider version),
Click the
User icon
on top right
Choose the right organization
Click
Change View
Viewing incident details
In the default view, an incident is shown in a single line. To see the details of the incident,
Page 1137
FortiSIEM Installation Guide FortiSIEM Installation Guide
Click anywhere on the incident line
Basic incident attributes are shown immediately below the incident
More advanced incident attributes are shown in a bottom pane
To revert to the single line incident view, click anywhere on the incident line. Detailed views will disappear.
To view the rule that triggered the incident,
Click anywhere on the incident line in the single line incident view
In the bottom pane, Click
Rule
tab Rule details are displayed.
To view the events that triggered the incident
Click anywhere on the incident line in the single line incident view
In the bottom pane, Click
Events
tab Basic Event attributes are displayed in a single line.
To see the raw events, click on the Basic Event line. Raw events are displayed.
Grouped View of all incidents
Sometimes user may need a grouped view of incidents to get an overview of what incidents have triggered and involves which devices. The following grouped views are provided
Severity - Ranks Incident Severities By Count
Name - Ranks the Incidents By Count
Name, Target - Ranks Incident Name and Incident Target By Count
Name, Source - Ranks Incident Name and Incident Source By Count
Name, Source, Target - Ranks Incident Name, Incident Source and Incident Target By Count
Name, Source, Target, Business Service - Ranks Incident Name, Incident Source, Incident Target and Business Services By Count
Name, Source, Target, Business Service, Organizations - Ranks Incident Name, Incident Source, Incident Target, Business Services and Organizations By Count
To get a grouped view
Choose the desired view from
Group By
drop down
Group view works with Search
Grouped view works with Search filters. In other words, Grouped view includes the incidents where the search conditions are satisfied.
To get to a un-grouped view from grouped view,
Choose
None i
n the
Group By
selector
Page 1138
FortiSIEM Installation Guide FortiSIEM Installation Guide
Searching Incidents
Searchable Incident Attributes
Searchable Incident Attributes
ID
IP
Incident Attribute Description
Time Range In
Incident ID
Incident Source IP or Incident Target IP
Host
User
Severity
Function
Incident Status
Host name associated with Incident Source IP or Incident Target IP
User field specified in Incident Target or Incident Details
Incident Severity category - High, Medium or Low
Security, Availability, Performance or Change. This is a property of an Incident.
Possible values are Active, Cleared, Cleared Manually, System Cleared
Ticket Status
Incident
Biz Service
Organization
Possible values are New, Open, Closed, External, reopened, None. External means opened in an external system.
Rule name
Business Service name
Organization name
Constructing Search Condition
To construct a Search condition from a displayed Incident,
Mouse over the cell containing the specific Incident attribute
Right click and choose
Add to filter
The condition will be added to existing search string
Matching incidents will be displayed
To construct a Search condition from scratch
Click on the
Add filter
edit area. Three fields are displayed
Incident Attribute
Operator
Value
Select one of the
Incident Attributes
from the drop down
Select an
Operator
from =, != IN, NOT IN, CONTAINS, NOT CONTAINS
Select one or more
Values
from the displayed choices
Click the Check button.
Matching incidents will be displayed
Page 1139
FortiSIEM Installation Guide FortiSIEM Installation Guide
Managing Incidents
Exporting Incidents to a PDF document
Adding Comments
Click on an Incident in the un-grouped view
From
Actions
drop down, select
Write the comment and click
OK.
Add Comments
Clearing Incidents
Click on an Incident in the un-grouped view
If you have more incidents to clear, then press Shift and click on the second incident. This will will select all incidents between the first one and this one. To get this approach to work effectively,
Create a filter to get all the incidents to be cleared in view
From
Select the first incident
Press Shift and click on the last incident - all incidents are now selected
Actions
Click
OK
drop down, select
Clear
Exporting Incidents to a PDF document
Click on an Incident in the un-grouped view
If you have more incidents to export, then press Shift and click on the second incident. This will will select all incidents between the first one and this one. To get this approach to work effectively,
Create a filter to get all the incidents to be exported in view
From
Select the first incident
Press Shift and click on the last incident - all incidents are now selected
Actions
Click
OK
drop down, select
Export
Page 1140
FortiSIEM Installation Guide
Reference
FortiSIEM Installation Guide
Page 1141
FortiSIEM Installation Guide
Event Dictionary
FortiSIEM Installation Guide
Page 1142
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event Attribute Master List
This section describes the master list of event attributes. Events are parsed into these attributes and used in Accelops analytics. There are 4 broad categories of event attributes
Generic Attributes
Name Id
Event Type
Event Name
Event Severity
Event Severity
Category
IPS Event Risk
Rating
IPS Event Threat
Rating
Event ID
Event Receive
Time
Device Time
Event Action
Reporting IP eventType eventName eventSeverity eventSeverityCat ipsEvRR ipsEvTR eventId phRecvTime deviceTime eventAction reptDevIpAddr
Reporting Device
Name
Relaying IP reptDevName relayDevIpAddr
Relaying Device
Name
Raw Event Log
Poll Interval
Customer ID
Customer Name
Agent ID relayDevName rawEventMsg pollIntv phCustId customer phAgentId
Event Rate (/sec) eventsPerSec
Peak Event Rate
(/sec) peakEventsPerSec eventParsedOK Event Parse
Status
Incident Source incidentSrc
Incident Target
Incident Reporting
IP
Incident Trigger
Attribute List
Incident Detail incidentTarget incidentRptIp triggerAttrList
Incident ID
Incident Status
Incident First
Occurrence Time incidentDetail incidentId incidentStatus incidentFirstSeen
Type Description
string Event type set to PH_DEV_MON_SYS_CPU_UTIL string uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
Date uint16
Date string
IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Date string
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address. string Raw event containing all attributes in comma separated "[Attribute] = value" format. uint32 Polling interval in seconds
Page 1143
FortiSIEM Installation Guide
Incident Last
Occurrence Time incidentLastSeen
Incident Ticket ID incidentTicketId incidentTicketStatus Incident Ticket
Status
Incident Ticket
User
Incident
Comments incidentTicketUser incidentComments
Incident View
Status
Incident View
Users
Incident Cleared
Time
Incident Cleared
User incidentViewStatus incidentViewUsers incidentClearedTime incidentClearedUser
Incident Cleared
Reason
Incident
Notification
Recipients incidentClearedReason incidentNotiRecipients
Network Attributes
Name Id
Source IP
Source Host Name
Host IP
Host Name
Dest IP
Dest Name
Source MAC
Dest MAC
Host MAC
IP Protocol
Source TCP/UDP Port
Dest TCP/UDP Port
ICMP Type
ICMP Code
IP Type of Service
Sent TCP flags
Received TCP flags
Source Intf SNMP Index
Dest Intf SNMP Index srcSnmpIntfIndex destSnmpIntfIndex
Source Intf name
Dest Intf Name srcIntfName destIntfName
Host Intf Name intfName
Source Autonomous System Number srcASNum srcIpAddr srcName hostIpAddr hostName destIpAddr destName srcMACAddr destMACAddr hostMACAddr ipProto srcIpPort destIpPort icmpType icmpCode tos srcDestTCPFlags destSrcTCPFlags
Type Description
IP
IP
IP
Source IP address of the flow
Destination IP address of the flow uint16 IP protocol e.g. TCP/UDP/GRE/ICMP etc uint16 Source TCP/UDP port uint16 Destination TCP/UDP port uint16 ICMP type uint16 ICMP code uchar IP Type of Service uchar OR-ed TCP Flags from Source to Destination uchar OR-ed TCP Flags from Destination to Source uint16 Source SNMP interface index uint16 Destination SNMP interface index uint16 Source Autonomous number
Page 1144
FortiSIEM Installation Guide
FortiSIEM Installation Guide
In Packet Discard
Out Packet Discard
In Packet Discard Pct
Out Packet Discard Pct
Source Firewall Zone
Dest Firewall Zone
Min Jitter
Max Jitter
Avg Jitter
Min SD Jitter
Max SD Jitter
Avg SD Jitter
Min DS Jitter
Max DS Jitter
Avg DS Jitter
Packets Lost
Packets SD Lost
Packets DS Lost
Packets Missing
Packets Late
Packets Out-of-Seq
VoIP MOS Score
VoIP ICPIF Score
VoIP Codec
VoIP Phone Status
Calling Party Number
Original Called Party Number
Dest Autonomous System Number
Source VLAN
Dest VLAN
Host VLAN
Sent Bytes
Sent Packets
Sent Bytes Rate (/sec)
Received Bytes
Received Packets
Received Bytes Rate (/sec)
Total Bytes
Total Packets
Total Byte rate (/sec)
Total Packet Rate (/sec)
Duration
Intf Out Queue Length
In Packet Error
Out Packet Error
In Packet Error Pct
Out Packet Error Pct
In Intf Util
Out Intf Util destASNum srcVLAN destVLAN hostVLAN sentBytes sentPkts sentBytesPerSec recvBytes recvPkts recvBytesPerSec totBytes totPkts totBytesPerSec totPktsPerSec durationMsec outQlen inIntfPktErr outIntfPktErr inIntfPktErrPct outIntfPktErrPct inIntfUtil outIntfUtil inIntfPktDiscarded outIntfPktDiscarded inIntfPktDiscardedPct outIntfPktDiscarded srcFwZone destFwZone minJitterMs maxJitterMs avgJitterMs minJitterSDMs maxJitterSDMs avgJitterSDMs minJitterDSMs maxJitterDSMs avgJitterDSMs pktLost pktLostSD pktLostDS pktMIA pktLate pktOutSeq mosScore icpifScore codec voIPPhoneStatus callingPartyNumber originalCalledPartyNumber uint16 Destination Autonomous number uint32 Sent Bytes in this flow uint32 Sent Packets in this flow uint32 Received Bytes in this flow uint32 received Packets in this flow double double
Page 1145
FortiSIEM Installation Guide
FortiSIEM Installation Guide
Final Called Party Number
Call Connect Time
Call Disconnect Time
Call Duration
CBQoS Policy Name
CBQoS Class Name
CBQoS Conform KBps
CBQoS Exceeded KBps
CBQoS Violated KBps
CBQoS PrePolice KBps
CBQoS PostPolice KBps
CBQoS Drop KBps
CBQoS Drop Pct
CBQoS Curr Queue Length
CBQoS Max Queue Length
CBQoS Discarded Pkt
OSPF State
BGP State
OSPF Area Id
Source FiberChannel WWN Id
Dest FiberChannel WWN Id finalCalledPartyNumber dateTimeConnect dateTimeDisconnect callDuration qosPolicy qosClass qosConformRate qosExceedRate qosViolateRate qosPrePoliceRate qosPostPoliceRate qosDropRate qosDropPct qosCurrQueue qosMaxQueue qosDiscardPkt ospfState bgpState ospfAreaId srcWWN destWWN wlanSsid wlanControllerIp wlanContrHostName wlanUserCount wlanSuppChannels wlanSendutil wlanRecvUtil wlanChannelUtil wlanPoorSNRUserCount ifLoadProfile ifIntefProfile ifCoverageProfile ifNoiseProfile wlanRssi wlanSnr wlanMobilityStatus wlanProtocol wlanAssocUpTime wlanMaxHostTxmitRate ifCoverageIndx ifNoseIndx ifIntefIndex
System Attributes
Name
Computer
Target Computer
Id
computer targetComputer
Type Description
Page 1146
FortiSIEM Installation Guide
FortiSIEM Installation Guide FortiSIEM Installation Guide
Domain
Target Domain
Source Domain
Destination Domain
Operating System Type osType
Operating System
Version osVersion
File Name
Object Type
Object Name
Target Object Type
Target Object Name
Object Handle
Object Access Type
Object Action
System Uptime
System Uptime Pct
System Downtime
CPU Name
CPU utilization
User CPU Utilization
System CPU Utilization
Memory Name
Memory Utilization domain targetDomain srcDomain destDomain fileName osObjType osObjName targetOsObjType targetOsObjName osObjHandleID osObjAccessType osObjAction sysUpTime sysUpTimePct sysDownTime cpuName cpuUtil userCpuUtil sysCpuUtil memName memUtil
Free memory (KB) freeMemKB
Buffer Memory (KB)
Cache Memory (KB) bufMemKB cacheMemKB
Swap Memory Utilization swapMemUtil
Free Swap Memory (KB) freeSwapMemKB
Minimum Swap Memory
(KB)
Swap Memory Error
Message memMinimumSwap swapMemErrorString
Swap Read (Pages/sec) swapInRate uint32 uint32 string double
Swap Write (Pages/sec) swapOutRate
Total Swap (Pages/sec) swapRate
Swap Read (KBps)
Swap Write (KBps)
Total Read I/O Rate
(KBps)
Total Write I/O Rate
(KBps)
Disk Name
Disk Utilization
Free Disk (MB)
Total Disk (MB)
Used Disk (MB)
Disk Queue Length swapReadKBytesPerSec swapWriteKBytesPerSec ioReadKBytesPerSec ioWriteKBytesPerSec diskName diskUtil freeDiskMB totalDiskMB usedDiskMB diskQLen double double double string double Overall CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. double User CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Available
for Linux (via SNMP) only.
double System CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Available
for Linux (via SNMP) only.
string double uint32 uint32 uint32 double
Page 1147
FortiSIEM Installation Guide
Current Daily Disk
Growth
Current Weekly Disk
Growth
Current Monthly Disk
Growth
Average Daily Disk
Growth
Average Weekly Disk
Growth
Average Monthly Disk
Growth
Days To Disk Full
RAID Group Id
RAID Type diskGrowthMBDaily diskGrowthMBWeekly diskGrowthMBMonthly avgDiskGrowthMBDaily avgDiskGrowthMBWeekly avgDiskGrowthMBMonthly timeToDiskFull raidGrpId raidType
Application Attributes
Name Id Type Description
Application Name appName
Application Group Name appGroupName string Short descriptive name of the process, e.g. "Microsoft IIS" string Name of the application group to which the process belongs; e.g. "Microsoft IIS"
Software Name
Software Param
CPU utilization
Memory utilization swProcName swParam cpuUtil memUtil string Process/Executable name; e.g. svchost.exe string Process/Executable parameters, e.g. "-k iissvc" double Process CPU utilization (between 0-100). double Process memory utilization (between 0-100) .
Real Peak Memory (KB) realMemPeakKBytes uint32 Peak real memory usage (KBytes).
Disk Read Rate (KBps) diskReadKBytesPerSec double Process disk read rate (KBytes/sec).
Disk Write Rate (KBps) diskWriteKBytesPerSec double Process disk write rate (KBytes/sec).
Environmental Attributes
Name Id
Hardware Status
Hardware Battery Status
Hardware Disk Status
Hardware Power Supply Status
Hardware Temp Sensor Status
Hardware Fan Status
Hardware Amp Status
Hardware Voltage Status
Hardware Memory Status
Hardware Log Status
Hardware Processor Status
Hardware Power Chord Status
Hardware Storage Controller Status
HardwareStorage Channel Status
Hardware Storage Enclosure Status hwStatusCode hwBatteryStatus hwDiskStatus hwPowerSupplyStatus hwTempSensorStatus hwFanStatus hwAmpStatus hwVoltageStatus hwMemoryStatus hwLogStatus hwProcStatus hwPowerChordStatus hwStorageControllerStatus hwStorageChannelStatus hwStorageEnclosureStatus
Type Description
string
Page 1148
FortiSIEM Installation Guide
FortiSIEM Installation Guide
Hardware Power Supply Status hwStoragePowerSupplyStatus
Hardware Storage Fan Status
Hardware Storage Temp Status
Hardware EMM Status
Hardware Log Disk Status
Failed Power Supply Count hwStorageFanStatus hwStorageTempStatus hwStorageEMMStatus logDiskStatus hwFailedPowerSupplyCount
Storage LLC Status
Storage Link Status
Storage Port Status
Hardware Misc Component Status hwLLCStatus hwLinkStatus hwPortStatus hwMiscCompStatus
Host Spare Disk Count
UPS Battery Status hwHotSpareDiskCount upsBatteryStatus
UPS Remaining Battery Charge (Pct) upsRemainBatteryChargePct
UPS Replace Battery Indicator upsReplaceBatteryIndicator
UPS Time On Battery (sec)
UPS Output Status
UPS Output Load
UPS Output Voltage (V)
UPS Output Frequency (Hz)
UPS Battery Current (Amp)
UPS Battery Temperature (C)
UPS Battery Voltage upsTimeOnBattery upsBasicOutputStatus upsAdvOutputLoad upsAdvOutputVoltage upsAdvOutputFreq upsBatteryCurrent upsBatteryTempC upsBatteryVoltage
UPS Estimated Time Remaining (sec) upsEstSecRemain
Temperature (C)
High Temperature Threshold (C)
Low Temperature Threshold (C)
Temperature Offset High (C)
Temperature Offset Low (C)
Temperature (F)
High Temperature Threshold (F)
Low Temperature Threshold (F)
Temperature Offset High (F)
Low Temperature Threshold (F)
Relative Humidity
High Relative Humidity Threshold
Low Relative Humidity Threshold
Humidity Offset High envTempDegC envTempHighThreshDegC envTempLowThreshDegC envTempOffHighDegC envTempOffLowDegC envTempDegF envTempHighThreshDegF envTempLowThreshDegF envTempOffHighDegF envTempOffLowDegF envHumidityRel envHumidityRelHighThresh envHumidityRelLowThresh envHumidityOffHigh
Humidity Offset Low
Liebert HVAC System State
Liebert HVAC Cooling State
Liebert HVAC Heating State envHumidityOffLow lgpSystemState lgpCoolingState lgpHeatingState
Liebert HVAC Humidifying State
Liebert HVAC Dehumidifying State lgpHumidState lgpDehumidState
Liebert HVAC Economy Cycle State lgpEconCycle
Liebert HVAC Fan State lgpFanState
Liebert HVAC Cooling capacity
Liebert HVAC Heating Capacity envCoolCap envHeatCap outputVoltageXNVolts
Page 1149
FortiSIEM Installation Guide
FortiSIEM Installation Guide FortiSIEM Installation Guide
Page 1150
FortiSIEM Installation Guide FortiSIEM Installation Guide
AccelOps Generated Event Format
AccelOps Generated Events
AccelOps is an event based analytics system. When it monitors systems and applications, it produces events containing the collected metrics this section describes details of such events. This can used to write custom queries, reports and rules.
System Performance Monitoring Events
Availability Monitoring Events
Network Flow Monitoring Events
Security Information Management
Page 1151
FortiSIEM Installation Guide FortiSIEM Installation Guide
System Performance Monitoring Events
System Performance Monitoring Events
AccelOps generates the following events related to system monitoring events
CPU Monitoring
Event Type: PH_DEV_MON_SYS_CPU_UTIL
Description: Event containing CPU utilization metrics
Source:
Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve
Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS
Cisco IPS (SNMP), Tippingpoint IPS (SNMP)
NetApp DataONTAP
Microsoft Windows (SNMP, WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP)
Key Attributes:
Name Id Type Description
Event Type eventType
Event
Severity eventSeverity
Event
Severity
Category string eventSeverityCat string
Event type set to PH_DEV_MON_SYS_CPU_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr
Date
Date
Time at which AccelOps generated this event
Relaying IP relayDevIpAddr rawEventMsg
Date string
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address hostName hostIpAddr string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
CPU utilization
User CPU
Utilization cpuUtil sysCpuUtil
System
CPU
Utilization userCpuUtil
Poll Interval pollIntv double Overall CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system.
double User CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Av
ailable for Linux (via SNMP) only.
double System CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system.
Available for Linux (via SNMP) only.
uint32 Polling interval in seconds
Memory Monitoring
Event Type: PH_DEV_MON_SYS_MEM_UTIL
Description: Event containing system memory utilization metrics
Source:
Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve
Page 1152
FortiSIEM Installation Guide FortiSIEM Installation Guide
Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS
Cisco IPS (SNMP), Tippingpoint IPS (SNMP)
Microsoft Windows (SNMP, WMI), Linux (SNMP,SSH), Solaris (SNMP), HP-UX (SNMP,SSH), IBM AIX (SNMP,SSH)
Key Attributes:
Name Id Type Description
Event Type eventType
Event Severity eventSeverity
Event Severity
Category string Event type set to PH_DEV_MON_SYS_MEM_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) eventSeverityCat string phRecvTime Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to
Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event Event Receive
Time
Reporting IP reptDevIpAddr Date
Relaying IP relayDevIpAddr Date
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng
IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP
Address.
Raw Event Log rawEventMsg
Host name hostName hostIpAddr Host IP
Address
Memory utilization memUtil bufMemKB string string
IP
Raw event containing all attributes in comma separated "[Attribute] = value" format.
Host name (as in AccelOps CMDB) of the device whose memory utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose memory utilization is being reported double Overall system physical memory utilization (between 0-100).
uint32 Size of buffered memory. Available for Linux (via SNMP) only. Buffer Memory
(KB)
Cache Memory
(KB)
Swap memory
Utilization
Free Swap
Memory (KB) cacheMemKB swapMemUtil uint32 Size of cached memory. Available for Linux (via SNMP) only. double Swap Memory Utilization.
Available for Linux (via SNMP) only.
freeSwapMemKB uint32 Free Swap Memory. Available for Linux (via SNMP) only.
Swap Read
Rate
(Pages/sec)
Swap Write
Rate
(Pages/sec)
Poll Interval swapInRate swapOutRate pollIntv double Rate at which pages are swapped in. Available for Windows (WMI), Linux (SSH), HP-UX (SSH), IBM
AIX (SSH).
double Rate at which pages are swapped out. Available for Windows (WMI), Linux (SSH), HP-UX (SSH),
IBM AIX (SSH).
uint32 Polling interval in seconds.
Disk space Monitoring
Event Type: PH_DEV_MON_SYS_DISK_UTIL
Description: Event containing disk utilization metrics
Source:
Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP)
NetApp DataONTAP (SNMP)
Key Attributes:
Name Id
Event Type eventType eventSeverity Event
Severity
Event
Severity
Category
Event
Receive
Time phRecvTime
Type
string
Description
Event type set to PH_DEV_MON_SYS_DISK_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) eventSeverityCat string
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Page 1153
FortiSIEM Installation Guide FortiSIEM Installation Guide
Reporting IP reptDevIpAddr
Relaying IP relayDevIpAddr
Date
Date string
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address
Disk Name
Disk
Capacity Util
Free Disk
(MB)
Total Disk
(MB) rawEventMsg hostName hostIpAddr diskName diskUtil freeDiskMB totalDiskMB
Used Disk
(MB) usedDiskMB
Poll Interval pollIntv string
IP string
Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk name double Disk utilization for a specific disk name (between 0-100).
uint32 Size of free disk available in MBytes uint32 Size of total disk in MBytes uint32 Size of used disk in MBytes uint32 Polling interval in seconds.
Disk I/O Monitoring
Event Type: PH_DEV_MON_DISK_IO_UTIL
Description: Event containing disk utilization metrics
Source:
Microsoft Windows (WMI), Linux (SSH), HP-UX (SSH), IBM AIX (SSH)
NetApp DataONTAP (SNMP)
Key Attributes:
Name Id
Event Type eventType
Event
Severity eventSeverity eventSeverityCat Event
Severity
Category
Event
Receive
Time phRecvTime
Reporting
IP reptDevIpAddr
Relaying IP relayDevIpAddr
Type Description
string Event type set to PH_DEV_MON_DISK_IO_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address
Disk Name
Disk Read
Rate (KBps)
Disk Write
Rate (KBps)
Disk Read
Rate (/sec) rawEventMsg hostName hostIpAddr string
IP
Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported diskName string Disk name diskReadKBytesPerSec double Disk read rate in KBytes/sec.
diskWriteKBytesPerSec double Disk write rate in KBytes/sec.
diskReadReqPerSec double Disk read rate in read IO per sec.
Page 1154
FortiSIEM Installation Guide FortiSIEM Installation Guide
Disk Write
Rate (/sec) diskWriteReqPerSec
Disk IO Util diskIOUtil
Disk Read
Latency
(ms) devDiskRdLatency
Disk Write
Latency
(ms) devDiskWrLatency
Disk Queue
Length diskQLen
Poll Interval pollIntv double Disk write rate in write IO per sec.
double Disk I/O utilization double Disk Read Latency - for Windows (WMI) only double Disk Write latency
- for Windows (WMI) only
uint32 Disk Queue Length - for Windows (WMI) only uint32 Polling interval in seconds.
Network Interface Monitoring
Event Type: PH_DEV_MON_NET_INTF_UTIL
Description: Event containing network interface utilization metrics
Source - almost all devices via SNMP:
Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve
Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS
Cisco IPS (SNMP), Tippingpoint IPS (SNMP)
NetApp DataONTAP (SNMP)
Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP)
Sample event
[PH_DEV_MON_NET_INTF_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phIn tfFilter.cpp,[lineNumber]=275,[intfName]=GigabitEthernet4/41,[intfA lias]=Connection to
Internet,[hostName]=SJ-Main-Cat6500,[hostIpAddr]=192.168.0.1,[pollI ntv]=177,[recvBytes]=0,[recvBitsPerSec]=0.000000,[inIntfUtil]=0.000
000,[sentBytes]=0,[sentBitsPerSec]=0.000000,[outIntfUtil]=0.000000,
[recvPkts]=0,[sentPkts]=0,[inIntfPktErr]=0,[inIntfPktErrPct]=0.0000
00,[outIntfPktErr]=0,[outIntfPktErrPct]=0.000000,[inIntfPktDiscarde d]=0,[inIntfPktDiscardedPct]=0.000000,[outIntfPktDiscarded]=0,[outI ntfPktDiscardedPct]=0.000000,[outQLen]=0,[intfSpeed64]=1000000000,[ intfAdminStatus]=up,[intfOperStatus]=down,[daysSinceLastUse]=487,[p hLogDetail]=
Key Attributes:
Name Id
Event Type
Event
Severity eventType eventSeverity
Event
Severity
Category
Event
Receive
Time eventSeverityCat phRecvTime
Reporting IP reptDevIpAddr
Relaying IP relayDevIpAddr
Type Description
string Event type set to PH_DEV_MON_NET_INTF_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
Page 1155
FortiSIEM Installation Guide FortiSIEM Installation Guide
In Packet
Error
In Packet
Error Pct
In Packet
Discards
In Packet
Discard Pct
Out Intf Util
Sent Bytes
Sent Byte
Rate (/sec)
Raw Event
Log
Host name
Host IP
Address
Host Intf
Name
In Intf Util
Received
Bytes
Received
Byte Rate
(/sec)
Received
Packets rawEventMsg hostName hostIpAddr intfName inIntfUtil recvBytes recvBytesPerSec recvPkts inIntfPktErr inIntfPktErrPct inIntfPktDiscarded inIntfPktDiscardedPct outIntfUtil sentBytes sentBytesPerSec string string
IP string
Raw event containing all attributes in comma separated "[Attribute] = value" format.
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
The name of the network interface for which this statistics applies double Inbound (or received) network utilization (between 0-100).
uint32 Inbound (or received) bytes during this interval double Inbound (or received) byte rate during this interval uint32 Inbound (or received) packets received during this interval uint32 Inbound (or received) packet errors double Inbound (or received) packet error as a percentage of total packets uint32 Inbound (or received) packet discarded double Inbound (or received) packet discarded as a percentage of total packets double Outbound (or sent) network utilization (between 0-100). uint32 Outbound (or sent) bytes during this interval double Inbound (or received) byte rate during this interval
Sent Packets sentPkts
Out Packet
Error outIntfPktErr outIntfPktErrPct Out Packet
Error Pct
Out Packet
Discards outIntfPktDiscarded
Out Packet
Discard Pct
Out Queue
Length
Poll Interval uint32 Outbound (or sent) packets sent during this interval double Outbound (or sent) packet errors double Outbound (or sent) packet error as a percentage of total packets uint32 Outbound (or sent) packet discarded outIntfPktDiscardedPct double Outbound (or sent) packet discarded as a percentage of total packets outQLen pollIntv uint32 Length of output queue uint32 Polling interval in seconds
Disk Growth Trend - Daily
Event Type: PH_DEV_MON_SYS_DISK_TREND_DAY
Description: Event containing disk usage growth trend - daily view
Source:
Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP)
NetApp DataONTAP (SNMP)
Key Attributes:
Name
Event Type
Event Severity
Id
eventType eventSeverity
Type Description
string Event type set to PH_DEV_MON_SYS_DISK_TREND_DAY uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Page 1156
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event Severity
Category
Event Receive
Time
Reporting IP eventSeverityCat phRecvTime string
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP reptDevIpAddr relayDevIpAddr
Raw Event Log rawEventMsg
Host name hostName
Host IP
Address
Disk Name hostIpAddr
Disk Capacity
Util diskName diskUtil
Free Disk (MB) freeDiskMB
Total Disk (MB) totalDiskMB
Date
Date string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
IP string
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk name double Disk utilization for a specific disk name (between 0-100).
uint32 Size of free disk available in MBytes uint32 Size of total disk in MBytes
Used Disk (MB) usedDiskMB
Current Daily
Disk Growth
(MB) diskGrowthMBDaily uint32 Size of used disk in MBytes double Disk growth (MB) for the current day avgDiskGrowthMBDaily double Running avg of daily disk growth (MB) overall previous days Avg Daily Disk
Growth (MB)
Days To Disk
Full
Poll Interval timeToDiskFull pollIntv uint32 Number of days until disk is full (from daily growth statistics) uint32 Polling interval in seconds.
Disk Growth Trend - Weekly
Event Type: PH_DEV_MON_SYS_DISK_TREND_WEEK
Description: Event containing disk usage growth trend - weekly view
Source:
Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP)
NetApp DataONTAP (SNMP)
Key Attributes:
Name
Event Type
Event Severity
Event Severity
Category
Event Receive
Time
Reporting IP
Id
eventType eventSeverity eventSeverityCat phRecvTime reptDevIpAddr
Type
string
Description
Event type set to PH_DEV_MON_SYS_DISK_TREND_DAY uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Date
Relaying IP relayDevIpAddr
Raw Event Log rawEventMsg
Host name hostName hostIpAddr Host IP
Address
Disk Name diskName
Date string string
IP string
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw event containing all attributes in comma separated "[Attribute] = value" format.
Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk name
Page 1157
FortiSIEM Installation Guide FortiSIEM Installation Guide
Disk Capacity
Util
Free Disk (MB) diskUtil freeDiskMB
Total Disk (MB) totalDiskMB double Disk utilization for a specific disk name (between 0-100).
Used Disk (MB) usedDiskMB
Current Week
Disk Growth
(MB) diskGrowthMBWeekly
Avg Weekly
Disk Growth
(MB) uint32 Size of used disk in MBytes double Disk growth (MB) for the current week avgDiskGrowthMBWeekly double Running avg of weekly disk growth (MB) overall previous days
Days To Disk
Full
Poll Interval timeToDiskFull pollIntv uint32 Size of free disk available in MBytes uint32 Size of total disk in MBytes uint32 Number of days until disk is full (from weekly growth statistics) uint32 Polling interval in seconds.
Disk Growth Trend - Monthly
Event Type: PH_DEV_MON_SYS_DISK_TREND_MONTH
Description: Event containing disk usage growth trend - monthly view
Source:
Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP)
NetApp DataONTAP (SNMP)
Key Attributes:
Name Id Type Description
Event Type
Event Severity
Event Severity
Category
Event Receive
Time
Reporting IP
Relaying IP
Raw Event Log
Host name eventType eventSeverity eventSeverityCat phRecvTime reptDevIpAddr relayDevIpAddr rawEventMsg hostName
Host IP Address hostIpAddr string Event type set to PH_DEV_MON_SYS_DISK_TREND_DAY uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw event containing all attributes in comma separated "[Attribute] = value" format.
string string
IP
Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported string Disk name double Disk utilization for a specific disk name (between 0-100).
Disk Name
Disk Capacity
Util
Free Disk (MB) diskName diskUtil
Total Disk (MB) freeDiskMB totalDiskMB
Used Disk (MB) usedDiskMB
Current Monthly
Disk Growth
(MB)
Avg Monthly
Disk Growth
(MB) diskGrowthMBMonthly uint32 Size of free disk available in MBytes uint32 Size of total disk in MBytes uint32 Size of used disk in MBytes double Disk growth (MB) for the current month avgDiskGrowthMBMonthly double Running avg of monthly disk growth (MB) overall previous months
Days To Disk
Full
Poll Interval timeToDiskFull pollIntv uint32 Number of days until disk is full (from monthly growth statistics) uint32 Polling interval in seconds.
Page 1158
FortiSIEM Installation Guide
Availability Monitoring Events
Availability Monitoring Events
AccelOps generates the following events related to availability monitoring
Ping Stat Monitoring Events
Event Type: PH_DEV_MON_PING_STAT
Description: Event containing ping stat metrics
Source: All
Sample event:
FortiSIEM Installation Guide
[PH_DEV_MON_PING_STAT]:[eventSeverity]=PHL_INFO,[fileName]=phPerfMo nitor.cpp,[lineNumber]=2565,[hostName]=SJ-QA-S-Sun-Spc01,[hostIpAdd r]=172.16.10.6,[avgDurationMSec]=0,[minDurationMSec]=0,[maxDuration
MSec]=1,[pktLossPct]=0.000000,[sysDownTime]=0,[sysDegradedTime]=0,[ pollIntv]=120,[phLogDetail]=
Key Attributes:
Name Id
Event Type eventType
Event
Severity
Event
Severity
Category
Event
Receive
Time eventSeverity eventSeverityCat phRecvTime
Reporting IP reptDevIpAddr
Type
string
Description
Event type set to PH_DEV_MON_SYS_PING_STAT uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to
Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP relayDevIpAddr
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng
IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP
Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address
Avg Round
Trip Time
Max Round
Trip Time
Min Round
Trip Time
Packet Loss
Pct
System
Down Time rawEventMsg hostName hostIpAddr string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported avgDurationMSec uint32 Average Round trip time from the ping tests done during this interval maxDurationMSec uint32 Max Round trip time from the ping tests done during this interval minDurationMSec uint32 Min Round trip time from the ping tests done during this interval pktLossPct sysDownTime double Packet loss percentage from the ping tests done during this interval uint32 Amount of time during this polling interval that there was 100% ping loss
Page 1159
FortiSIEM Installation Guide FortiSIEM Installation Guide
System
Degraded
Time sysDegradedTime uint32 Amount of time during this polling interval that there was 50%+ ping loss
Poll Interval pollIntv uint32 Polling interval in seconds
Synthetic Transaction Monitoring Success
Event Type: PH_DEV_MON_EUM_SUCCESS
Description: Successful Synthetic transaction monitoring test
Source: All
Key Attributes:
Name
Event Type
Event Severity
Event Severity
Category
Event Receive
Time
Reporting IP
Id
eventType eventSeverity eventSeverityCat phRecvTime reptDevIpAddr
Type Description
string Event type set to PH_DEV_MON_SYS_EUM_SUCCESS uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
Relaying IP
Raw Event Log
Host name
Host IP Address
Synthetic
Transaction
Monitor Name
Synthetic
Transaction
Monitor Step
Application
Protocol
Application Port
Application
Response Time
Poll Interval relayDevIpAddr rawEventMsg hostName hostIpAddr endUserMonitorName endUserMonitorStep appTransportProto appPort string Port number such as 443 appResponseTimeMSec uint32 Synthetic transaction response time (ms) pollIntv
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported string Name of the Synthetic Transaction Monitor string Particular step of the Synthetic Transaction Monitor, in case the transaction monitor involves multiple steps.
string Application protocol such as HTTP uint32 Polling interval in seconds
Synthetic Transaction Monitoring Failure
Event Type: PH_DEV_MON_EUM_FAIL
Description: Failed Synthetic transaction monitoring test
Source: All
Key Attributes:
Name
Event Type
Event Severity
Event Severity
Category
Event Receive
Time
Reporting IP
Id
eventType eventSeverity eventSeverityCat phRecvTime reptDevIpAddr
Type Description
string Event type set to PH_DEV_MON_SYS_EUM_SUCCESS uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
Date IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
Page 1160
FortiSIEM Installation Guide FortiSIEM Installation Guide
Relaying IP
Raw Event Log
Host name
Host IP Address
Synthetic
Transaction
Monitor Name
Synthetic
Transaction
Monitor Step
Application
Protocol
Application Port
Reason for Error
Poll Interval relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
rawEventMsg hostName hostIpAddr string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported endUserMonitorName string Name of the Synthetic Transaction Monitor test endUserMonitorStep appTransportProto appPort errReason pollIntv string Particular step of the Synthetic Transaction Monitor, in case the transaction monitor involves string string multiple steps.
Application protocol such as HTTP
Port number such as 443 uint32 Reason for failed Synthetic Transaction Monitor test uint32 Polling interval in seconds
Page 1161
FortiSIEM Installation Guide FortiSIEM Installation Guide
Hardware Monitoring Events
AccelOps generates the following events related to hardware monitoring
Individual Hardware Component Status
Ampere Measurement
Dry Contact Measurement
Camera Motion Measurement
Power Supply Measurement
Chassis Component Measurement
Overall Hardware Status Event
This event is generated by AccelOps as a overall hardware status. Sometimes this overall status is provided the device. In other times, AccelOps derives the overall health from that of the individual hardware components.
Event Type: PH_DEV_MON_HW_STAT
Description: Event containing overall hardware status as detected by AccelOps
Source:
Cisco IOS (SNMP),Cisco Nx-OS (SNMP), Juniper JunOS (SNMP), Juniper SRX JunOS (SNMP), Alcatel TiMOS (SNMP), Alcatel
AOS (SNMP),Avaya/Nortel ERS (SNMP), Huawei VRP (SNMP), H3C Comware,
EMC Clariion (NavisecCli), NetApp DataONTAP Filer (SNMP), Dell EqualLogic (SNMP)
F5 Big-IPOS (SNMP), Riverbed Steelhead (SNMP), InfoBlox NiOS (SNMP)
Virtual Machines on VMWare ESX (VMSDK), Windows/Linux Servers on Dell hardware with OpenManage installed (SNMP),
Windows/Linux Servers on HP hardware with HP Insight Manager installed (SNMP),
APC NetBotz (SNMP)
Cisco UPS (UCS API)
HP BladeSystem (SNMP)
Key Attributes: Varies depending on the source. The global set of attributes is shown below
Name
Event Type
Event Severity
Event Severity
Category
Event Receive
Time
Reporting IP
Id
eventType eventSeverity eventSeverityCat phRecvTime reptDevIpAddr
Type Description
string Event type set to PH_DEV_MON_HW_STAT uint16 0 if the event attribute hwStatusCode is 0 (Normal), 5 if hwStatusCode is 1 (Warning) and 10 if hwStatusCode is 2 (Critical) string Set to Low. In general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to
Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
Relaying IP relayDevIpAddr
Raw Event Log rawEventMsg
Host name hostName
Host IP Address hostIpAddr
Hardware Status hwStatusCode
Hardware Power
Supply Status hwPowerSupplyStatus hwBatteryStatus Hardware
Battery Status
Hardware Disk
Status hwDiskStatus
Hardware RAID
Status hwRaidStatus
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string Host name (as in AccelOps CMDB) of the device whose overall hardware health is being reported
IP Access IP (as in AccelOps CMDB) of the device whose overall hardware health is being reported uint16 Overall hardware status: 0 for Normal, 1 for Warning and 2 for Critical uint16 Overall hardware status: 0 for Normal, 1 for Warning and 2 for Critical uint16 Battery status: 0 for Normal, 1 for Warning and 2 for Critical uint16 Disk status: 0 for Normal, 1 for Warning and 2 for Critical uint16 Hardware RAID status: 0 for Normal, 1 for Warning and 2 for Critical
Page 1162
FortiSIEM Installation Guide FortiSIEM Installation Guide
Hot Spare Disk
Count
Hardware
Memory Status hwHotSpareDiskCount hwMemoryStatus uint16 Number of hot spare disks uint16 Memory status: 0 for Normal, 1 for Warning and 2 for Critical
Hardware Status hwPowerSupplyStatus
Failed Power
Supply Count uint16 Power supply status: 0 for Normal, 1 for Warning and 2 for Critical hwFailedPowerSupplyCount uint16 Number of failed power supplies
Hardware Temp
Sensor Status hwTempSensorStatus uint16 Temperature sensor status: 0 for Normal, 1 for Warning and 2 for Critical
Hardware Status hwFanStatus
Failed Fan
Count
Hardware Amp
Status hwFailedFanCount hwAmpStatus hwVoltageStatus uint16 Fan status: 0 for Normal, 1 for Warning and 2 for Critical uint16 Failed fan count uint16 Current (Amp) status: 0 for Normal, 1 for Warning and 2 for Critical uint16 Voltage status: 0 for Normal, 1 for Warning and 2 for Critical Hardware
Voltage Status
Storage LCC
Status
Storage Link
Status
Storage Port
Status hwLCCStatus hwLinkStatus hwPortStatus uint16 Hardware LCC status: 0 for Normal, 1 for Warning and 2 for Critical uint16 Hardware link status: 0 for Normal, 1 for Warning and 2 for Critical uint16 Hardware port status: 0 for Normal, 1 for Warning and 2 for Critical hwRelHumidStatus uint16 Relative humidity status: 0 for Normal, 1 for Warning and 2 for Critical Relative
Humidity Status
Dew Point
Status
Audio Status
Air Flow Status hwDewPtStatus hwAudioStatus hwAirFlowStatus uint16 Dew Point status: 0 for Normal, 1 for Warning and 2 for Critical uint16 Audio status: 0 for Normal, 1 for Warning and 2 for Critical uint16 AIr flow status: 0 for Normal, 1 for Warning and 2 for Critical hwGenNumericSensorStatus uint16 Generic Numeric sensor status: 0 for Normal, 1 for Warning and 2 for Critical Generic
Numeric Sensor
Status
Dry Contact
Status
Door Switch
Status
Camera Motion
Status
Generic State
Sensor Status hwDryContactStatus hwDoorSwitchStatus hwCameraMotionStatus hwGenStateSensorStatus uint16 Dry Contact status: 0 for Normal, 1 for Warning and 2 for Critical uint16 Door switch status: 0 for Normal, 1 for Warning and 2 for Critical uint16 Camera motion status: 0 for Normal, 1 for Warning and 2 for Critical uint16 Generic state sensor status: 0 for Normal, 1 for Warning and 2 for Critical
The following table indicates sources of various hardware status events.
Device
Type
(Method)
Cisco IOS
(SNMP)
Cisco Nx-OS
(SNMP)
Juniper
JunOS
(SNMP),
Juniper SRX
JunOS
(SNMP)
Alcatel
TiMOS
(SNMP)
Alcatel AOS
(SNMP)
Huawei VRP
(SNMP)
H3C
Comware
(SNMP)
EMC Clariion
(NavisecCli) x x x x x x x x
Overall
x x
Temp
x x
Power
Supply
x x
Fan
x
Chassis Memory Disk RAID Battery Amp Voltage LCC Storage
Link
Storage
Port
Humidity Air flow
Dew
Point
Audio Gen
Numeric
Sensor
Dry
Contact
Door
Switch
x x x x x x x x x x x x x x
Page 1163
FortiSIEM Installation Guide FortiSIEM Installation Guide
NetApp
DataONTAP
Filer (SNMP)
Dell
EqualLogic
(SNMP)
F5 Big-IPOS
(SNMP)
Riverbed
Steelhead
(SNMP)
InfoBlox NiOS
(SNMP) x x x x x
VMs on ESX
(VMSDK)
Dell Servers
HP Servers
APC NetBotz
Cisco UCS
HP
BladeSystem x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x
Individual Hardware Component Status
This event is generated by AccelOps for every component that is not on normal state. The device indicates whether a specific hardware component is in warning or critical state. AccelOps captures this information and generates an event. Note that this event is only generated when at least component is in warning or critical date. When the status is normal, then this event is not generated. Also, this event is generated every poll and not just during state transitions - this makes it easy for AccelOps to trend a hardware component health. Since all the events have the same format, only one description is provided for this event family.
Event Type: PH_DEV_MON_HW_STATUS_DISK_CRIT (Individual disk status critical)
Event Type: PH_DEV_MON_HW_STATUS_DISK_WARN (Individual disk status warning)
Event Type: PH_DEV_MON_HW_STATUS_TEMP_CRIT (Individual temperature status critical)
Event Type: PH_DEV_MON_HW_STATUS_TEMP_WARN (Individual temperature status warning)
Event Type: PH_DEV_MON_HW_STATUS_FAN_CRIT (Individual fan status critical)
Event Type: PH_DEV_MON_HW_STATUS_FAN_WARN (Individual fan status warning)
Event Type: PH_DEV_MON_HW_STATUS_BATTERY_CRIT (Individual battery status critical)
Event Type: PH_DEV_MON_HW_STATUS_BATTERY_WARN (Individual battery status warning)
Event Type: PH_DEV_MON_HW_STATUS_POWERSUPPLY_CRIT (Individual power-supply status critical)
Event Type: PH_DEV_MON_HW_STATUS_POWERSUPPLY_WARN (Individual power-supply status warning)
Event Type: PH_DEV_MON_HW_STATUS_VOLTAGE_CRIT (Individual voltage status critical)
Event Type: PH_DEV_MON_HW_STATUS_VOLTAGE_WARN (Individual voltage status warning)
Event Type: PH_DEV_MON_HW_STATUS_AMP_CRIT (Individual amp/current status critical)
Event Type: PH_DEV_MON_HW_STATUS_AMP_WARN (Individual amp/current status warning)
Event Type: PH_DEV_MON_HW_STATUS_MEMORY_CRIT (Individual memory status critical)
Event Type: PH_DEV_MON_HW_STATUS_MEMORY_WARN (Individual memory status warning)
Event Type: PH_DEV_MON_HW_STATUS_LCC_CRIT (Individual EMC CLariion LCC status critical)
Event Type: PH_DEV_MON_HW_STATUS_LCC_WARN (Individual EMC Clariion LCC status warning)
Event Type: PH_DEV_MON_HW_STATUS_LINK_CRIT (Individual EMC Clariion storage link status critical)
Event Type: PH_DEV_MON_HW_STATUS_LINK_WARN (Individual EMC Clariion storage link status warning)
Event Type: PH_DEV_MON_HW_STATUS_PORT_CRIT (Individual EMC Clariion storage port status critical)
Event Type: PH_DEV_MON_HW_STATUS_PORT_WARN (Individual EMC Clariion storage port status warning)
Event Type: PH_DEV_MON_HW_STATUS_HUMIDITY_CRIT (Individual humidity status critical)
Event Type: PH_DEV_MON_HW_STATUS_HUMIDITY_WARN (Individual humidity status warning)
Event Type: PH_DEV_MON_HW_STATUS_DEWPT_CRIT (Individual dew point status critical)
Event Type: PH_DEV_MON_HW_STATUS_DEWPT_WARN (Individual dew point status warning)
Event Type: PH_DEV_MON_HW_STATUS_AUDIO_CRIT (Individual audio status critical)
Event Type: PH_DEV_MON_HW_STATUS_AUDIO_WARN (Individual audio status warning)
Event Type: PH_DEV_MON_HW_STATUS_AIRFLOW_CRIT (Individual airflow status critical)
Event Type: PH_DEV_MON_HW_STATUS_AIRFLOW_WARN (Individual airflow status warning)
Event Type: PH_DEV_MON_HW_STATUS_DRYCONTACT_CRIT (Individual dry contact status critical)
Event Type: PH_DEV_MON_HW_STATUS_DRYCONTACT_WARN (Individual dry contact status warning)
Event Type: PH_DEV_MON_HW_STATUS_DOOR_SWITCH_CRIT (Individual door switch status critical)
Event Type: PH_DEV_MON_HW_STATUS_DOOR_SWITCH_WARN (Individual door switch status warning)
Event Type: PH_DEV_MON_HW_STATUS_CAMERAMOTION_CRIT (Individual camera motion status critical)
Event Type: PH_DEV_MON_HW_STATUS_CAMERAMOTION_WARN (Individual camera motion status warning)
Description: Event containing individual hardware component status as detected by AccelOps
Source: Varies - see table above
Key Attributes: Same for all event types above as show below
Name Id
Event Type eventType
Event Severity eventSeverity
Type Description
string Event type set to PH_DEV_MON_HW_STAT uint16 0 if the event attribute hwStatusCode is 0 (Normal), 5 if hwStatusCode is 1 (Warning) and 10 if hwStatusCode is 2 (Critical) x x
Page 1164
FortiSIEM Installation Guide FortiSIEM Installation Guide
Raw Event
Log
Host name
Host IP
Address
Hardware
Status
Hardware
Component
Name
Hardware
Component
Status
Event Severity
Category
Event Receive
Time
Reporting IP
Relaying IP eventSeverityCat phRecvTime reptDevIpAddr relayDevIpAddr string Set to Low. In general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to
Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
rawEventMsg hostName hostIpAddr hwStatusCode string
IP
Host name (as in AccelOps CMDB) of the device whose overall hardware health is being reported
Access IP (as in AccelOps CMDB) of the device whose overall hardware health is being reported uint16 Overall hardware status: 0 for Normal, 1 for Warning and 2 for Critical hwComponentName string Name of the component that is in warning or critical state - name may indicate rack, bay or location or some sort of id to uniquely specify the component hwComponentStatus string Detailed status of the component - e.g Disk rebuilding, that caused the component to be in warning or critical state
Temperature Measurement Event
This event is generated when the device provides actual per component or sensor temperature readings.
Event Type: PH_DEV_MON_HW_TEMP
Description: Event capturing temperature readings for network devices and environmental monitors
Source:
Cisco IOS (SNMP),Cisco Nx-OS (SNMP), Juniper JunOS (SNMP), Juniper SRX JunOS (SNMP), Alcatel AOS
(SNMP),Avaya/Nortel ERS (SNMP), H3C Comware,
Dell EqualLogic (SNMP)
F5 Big-IPOS (SNMP), APC NetBotz (SNMP)
Cisco UCS (UCS API)
Key Attributes: Varies depending on the source - see portions in bold below.
Name
Event Type
Event Severity
Event Severity
Category
Event Receive Time
Reporting IP
Relaying IP
Raw Event Log
Host name
Host IP Address
Hardware
Component Name
Temperature
(Celsius)
Temperature
(Fahrenheit)
Id
eventType eventSeverity eventSeverityCat phRecvTime reptDevIpAddr relayDevIpAddr rawEventMsg hostName hostIpAddr hwComponentName envTempDegC envTempDegF
Type Description
string Event type set to PH_DEV_MON_HW_TEMP uint16 1 set to INFO string Set to Low. In general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date
Date
Time at which AccelOps generated this event
Date
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string Host name (as in AccelOps CMDB) of the device whose overall hardware health is being reported
IP Access IP (as in AccelOps CMDB) of the device whose overall hardware health is being reported
String Name of the temperature sensor uint32 Temperature in Celsius uint32 Temperature in Fahrenheit
Page 1165
FortiSIEM Installation Guide FortiSIEM Installation Guide
High Temperature
Threshold (Celsius)
Temp Offset High
(Celsius)
High Temperature
Threshold
(Fahrenheit)
Temp Offset High
(Fahrenheit)
Env Sensor Id
Env Sensor Label
Env Sensor
Enclosure Id envTempHighThreshDegC uint32 High temperature threshold in Celsius (only for Cisco IOS, H3C Comware, Alcatel AOS,APC
NetBotz
) envTempOffHighDegC uint32 Offset from high threshold in Celsius, set to envTempHighThreshDegC - envTempDegC (only fo
r Cisco IOS, H3C Comware, Alcatel AOS,APC NetBotz
) envTempHighThreshDegF uint32 High temperature threshold in Fahrenheit (
only for Cisco IOS, H3C Comware, Alcatel
AOS,APC NetBotz
) envTempOffHighDegF envSensorId envSensorLabel envSensorEnclosureId uint32 Offset from high threshold in Fahrenheit, set to envTempHighThreshDegF - envTempDegF (only
for Cisco IOS, H3C Comware, Alcatel AOS,APC NetBotz
) string Temperature sensor id (
only for APC NetBotz
) string Temperature sensor label (
only for APC NetBotz
) string Temperature sensor enclosure id (
only for APC NetBotz
)
Raw Event
Log
Host name
Host IP
Address
Env Sensor
Id
Env Sensor
Label
Env Sensor
Enclosure Id
Relative
Humidity
Humidity Measurement Event
This event is generated when the device provides actual per component or sensor temperature readings.
Event Type: PH_DEV_MON_HW_HUMIDITY
Description: Event specifying relative humidity settings
Source: APC NetBotz (SNMP)
Key Attributes: Varies depending on the source - see portions in bold below.
Name Id
Event Type
Event
Severity
Event
Severity
Category eventType eventSeverity eventSeverityCat
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr
Type Description
string Event type set to PH_DEV_MON_HW_HUMIDITY uint16 1 set to INFO string Set to Low. In general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
Relaying IP relayDevIpAddr rawEventMsg
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
hostName hostIpAddr envSensorId envSensorLabel string Host name (as in AccelOps CMDB) of the device whose overall hardware health is being reported
IP Access IP (as in AccelOps CMDB) of the device whose overall hardware health is being reported envSensorEnclosureId string Humidity sensor enclosure id envHumidityRel string Humidity sensor id string Humidity sensor label uint32 Relative Humidity
Airflow Measurement Event
This event is generated when the device provides actual per component or sensor temperature readings.
Page 1166
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event Type: PH_DEV_MON_HW_AIRFLOW
Description: Event specifying relative humidity readings
Source: APC NetBotz (SNMP)
Key Attributes: Varies depending on the source - see portions in bold below.
Name Id Type Description
Event Type eventType
Event Severity eventSeverity
Event Severity
Category eventSeverityCat
Event Receive
Time
Reporting IP phRecvTime reptDevIpAddr string
Date
Event type set to PH_DEV_MON_HW_HUMIDITY uint16 1 set to INFO string Set to Low. In general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP relayDevIpAddr
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address rawEventMsg hostName hostIpAddr string
IP
Host name (as in AccelOps CMDB) of the device whose overall hardware health is being reported
Access IP (as in AccelOps CMDB) of the device whose overall hardware health is being reported
Env Sensor Id envSensorId
Env Sensor
Label
Env Sensor
Enclosure Id envSensorLabel string string envSensorEnclosureId string
Humidity sensor id
Humidity sensor label
Humidity sensor enclosure id
Air Flow
(0.1meter/min) envAirFlow uint32 Air flow in 0.1 meters/minute
Dew point Measurement Event
This event is generated when the device provides actual per component or sensor temperature readings.
Event Type: PH_DEV_MON_HW_DEWPT
Description: Event specifying relative dew point temperature readings
Source: APC NetBotz (SNMP)
Key Attributes: Varies depending on the source - see portions in bold below.
Name
Event Type
Event
Severity
Event
Severity
Category
Event
Receive Time
Reporting IP
Id
eventType eventSeverity eventSeverityCat phRecvTime reptDevIpAddr
Type Description
string Event type set to PH_DEV_MON_HW_DEWPT uint16 1 set to INFO string Set to Low. In general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
Relaying IP relayDevIpAddr rawEventMsg
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address hostName hostIpAddr string Host name (as in AccelOps CMDB) of the device whose overall hardware health is being reported
IP Access IP (as in AccelOps CMDB) of the device whose overall hardware health is being reported
Page 1167
FortiSIEM Installation Guide FortiSIEM Installation Guide
Env Sensor Id envSensorId
Env Sensor
Label envSensorLabel string string
Humidity sensor id
Humidity sensor label envSensorEnclosureId string Humidity sensor enclosure id Env Sensor
Enclosure Id
Temperature
(Celsius)
Temperature
(Fahrenheit) envTempDegC envTempDegF uint32 Dew point temperature in Celsius uint32 Dew point temperature in Fahrenheit
Audio Level Measurement Event
This event is generated when the device provides actual per component or sensor temperature readings.
Event Type: PH_DEV_MON_HW_AUDIO
Description: Event specifying audio level readings
Source: APC NetBotz (SNMP)
Key Attributes: Varies depending on the source - see portions in bold below.
Name
Event Type
Event
Severity
Event
Severity
Category
Id
eventType eventSeverity eventSeverityCat
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr
Type
string
Description
Event type set to PH_DEV_MON_HW_AUDIO uint16 1 set to INFO string
Date
Set to Low. In general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP relayDevIpAddr
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address
Env Sensor
Id
Env Sensor
Label
Env Sensor
Enclosure Id
Audio Sensor
Level rawEventMsg hostName hostIpAddr envSensorId envSensorLabel envAudioLevel string
IP string string
Host name (as in AccelOps CMDB) of the device whose overall hardware health is being reported
Access IP (as in AccelOps CMDB) of the device whose overall hardware health is being reported
Humidity sensor id
Humidity sensor label envSensorEnclosureId string Humidity sensor enclosure uint32 Audio Sensor Level
Page 1168
FortiSIEM Installation Guide FortiSIEM Installation Guide
VMware Monitoring Events
AccelOps generates the following events VMware related system monitoring events
VM level events
VM State Monitoring
VM Datastore Utilization Monitoring
Disk Growth Trend - Daily
Disk Growth Trend - Weekly
Disk Growth Trend - Monthly
ESX level events
ESX Datastore Utilization Monitoring
Cluster and resource pool events
VM Cluster Datastore I/O Utilization
VM Resource pool CPU Utilization
VM Resource pool Memory Utilization
VM State Monitoring
Event Type: PH_DEV_MON_VM_STATE
Description: Event containing VM State
Source: All
Key Attributes:
Name Id
Event Type eventType
Event
Severity eventSeverity
Event
Severity
Category
Event
Receive
Time
Reporting
IP eventSeverityCat phRecvTime reptDevIpAddr
Relaying IP relayDevIpAddr rawEventMsg
Type Description
string Event type set to PH_DEV_MON_SYS_PING_STAT uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
VM Name
Host name
Host IP
Address vmName hostName hostIpAddr string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Page 1169
FortiSIEM Installation Guide
Physical
Machine
Name
Physical machine IP phyMachName phyMachIpAddr string
IP vmPowerState vmPowerStateCode vmConnectionState vmConnectionStateCode uint32 status
Poll Interval pollIntv string uint32 string string uint32 Poll interval in seconds
Sample event:
FortiSIEM Installation Guide
<134>Feb 08 18:22:16 10.1.2.11 java:
[PH_DEV_MON_VM_STATE]:[eventSeverity]=PHL_INFO, [vmName]=CO159,
[phyMachName]=HOST-10.1.2.51,
[phyMachIpAddr]=10.1.2.51, [pollIntv]=180, [hostName]=CO159,
[hostIpAddr]=10.1.2.159, [vmPowerState]=poweredOn,
[vmPowerStateCode]=0, [vmConnectionState]=connected,
[vmConnectionStateCode]=0, [status]=green
VM Uptime Monitoring
Event Type: PH_DEV_MON_VM_UPTIME
Description: Event containing VM Uptime
Source: All
Key Attributes:
Name Id
Event Type eventType
Type Description
string Event type set to PH_DEV_MON_SYS_PING_STAT
Event
Severity
Event
Severity
Category
Event
Receive
Time eventSeverity eventSeverityCat string phRecvTime
Reporting IP reptDevIpAddr uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP
Raw Event
Log relayDevIpAddr rawEventMsg
Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Host name
Host IP
Address vmName hostName hostIpAddr phyMachName string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Page 1170
FortiSIEM Installation Guide phyMachIpAddr sysUpTime sysDownTime
Poll Interval pollIntv uint32 Polling interval in seconds
Sample event:
FortiSIEM Installation Guide
<134>Feb 08 18:22:16 10.1.2.11 java:
[PH_DEV_MON_VM_UPTIME]:[eventSeverity]=PHL_INFO,
[phyMachName]=HOST-10.1.2.51,
[phyMachIpAddr]=10.1.2.51, [pollIntv]=180, [vmName]=CO159,
[morId]=vm-194, [hostName]=CO159, [hostIpAddr]=10.1.2.159,
[sysUpTime]=1132030, [sysDownTime]=0
VM CPU Monitoring Event
Event Type: PH_DEV_MON_VM_CPU_UTIL
Description: Event containing VM CPU metrics
Source: All
Key Attributes:
Name Id Type Description
Event Type eventType
Event
Severity eventSeverity string uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event
Severity
Category
Event
Receive
Time eventSeverityCat string phRecvTime
Reporting IP reptDevIpAddr
Date
Date
Event type set to PH_DEV_MON_SYS_PING_STAT
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP relayDevIpAddr rawEventMsg
Date string
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address vmName hostName hostIpAddr phyMachName phyMachIpAddr processors string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported uint32 Average Round trip time from the ping tests done during this interval Avg Round
Trip Time
Max Round
Trip Time
Min Round
Trip Time vCpus cpuUtil uint32 Max Round trip time from the ping tests done during this interval uint32 Min Round trip time from the ping tests done during this interval cpuRunPct cpuMlmtedPct
Page 1171
FortiSIEM Installation Guide cpuReadyPct phyCpuUtil cpuSysPct
Packet Loss
Pct pktLossPct
Poll Interval pollIntv
Sample event: double Packet loss percentage from the ping tests done during this interval uint32 Polling interval in seconds
FortiSIEM Installation Guide
<134>Feb 08 18:22:16 10.1.2.11 java:
[PH_DEV_MON_VM_CPU_UTIL]:[eventSeverity]=PHL_INFO,[phyMachName]=HOS
T-10.1.2.51,
[phyMachIpAddr]=10.1.2.51, [pollIntv]=180, [vmName]=CO159,
[morId]=vm-194, [hostName]=CO159, [hostIpAddr]=10.1.2.159,
[processors]=8, [cpuUtil]=20.96, [cpuMlmtedPct]=0.0, [vCpus]=2,
[cpuSysPct]=0.17, [cpuRunPct]=20.789999,
[cpuReadyPct]=0.25, [phyCpuUtil]=5.24
VM Per CPU Monitoring Event
Event Type: PH_DEV_MON_VM_PER_CPU_UTIL
Description: Event containing VM per CPU metrics
Source: All
Key Attributes:
Name Id Type Description
Event Type eventType
Event
Severity
Event
Severity
Category eventSeverity string eventSeverityCat string
Event type set to PH_DEV_MON_SYS_PING_STAT uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr Date
Relaying IP relayDevIpAddr rawEventMsg
Date string
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address vmName hostName hostIpAddr string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported phyMachName phyMachIpAddr cpuName cpuSysPct cpuUtil uint32 Average Round trip time from the ping tests done during this interval uint32 uint32
Page 1172
FortiSIEM Installation Guide cpuReadyPct phyCpuUtil cpuRunPct
Poll Interval pollIntv
Sample event: double double double uint32 Polling interval in seconds
FortiSIEM Installation Guide
<134>Feb 08 18:22:16 10.1.2.11 java:
[PH_DEV_MON_VM_PER_CPU_UTIL]:[eventSeverity]=PHL_INFO,
[phyMachName]=HOST-10.1.2.51,
[phyMachIpAddr]=10.1.2.51, [pollIntv]=180, [vmName]=CO159,
[morId]=vm-194, [hostName]=CO159,[hostIpAddr]=10.1.2.159,
[cpuName]=0, [cpuSysPct]=0.25, [cpuReadyPct]=0.26,
[phyCpuUtil]=20.95, [cpuRunPct]=20.7
VM Memory Monitoring
Event Type: PH_DEV_MON_VM_MEM_UTIL
Description: Event containing VM Memory utilization metrics
Source: All
Key Attributes:
Name Id
Event Type eventType
Event
Severity
Event
Severity
Category eventSeverity eventSeverityCat
Event
Receive
Time phRecvTime
Reporting
IP reptDevIpAddr
Relaying IP relayDevIpAddr
Type
string
Description
Event type set to PH_DEV_MON_SYS_PING_STAT uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event phyMachName phyMachIpAddr phyMemUtil actvMemPct
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address rawEventMsg vmName hostName hostIpAddr string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported swapReadKBytesPerSec swapWriteKBytesPerSec
Poll Interval pollIntv uint32 Polling interval in seconds
Page 1173
FortiSIEM Installation Guide
Sample event:
FortiSIEM Installation Guide
<134>Feb 08 18:22:16 10.1.2.11 java:
[PH_DEV_MON_VM_MEM_UTIL]:[eventSeverity]=PHL_INFO,
[phyMachName]=HOST-10.1.2.51,
[phyMachIpAddr]=10.1.2.51, [pollIntv]=180, [vmName]=CO159,
[morId]=vm-194, [hostName]=CO159, [hostIpAddr]=10.1.2.159,
[swapReadKBytesPerSec]=144.0, [swapWriteKBytesPerSec]=159.1,
[actvMemPct]=3.08, [phyMemUtil]=8.5
VM Disk I/O Monitoring
Event Type: PH_DEV_MON_VM_DISK_IO
Description: Event containing VM Disk I/O performance metrics
Source: All
Key Attributes:
Name Id Type Description
Event Type eventType
Event
Severity eventSeverity
Event
Severity
Category eventSeverityCat
Event
Receive
Time
Reporting
IP phRecvTime reptDevIpAddr
Relaying IP relayDevIpAddr string Event type set to PH_DEV_MON_SYS_PING_STAT uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to
Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Raw Event
Log
Host name
Host IP
Address rawEventMsg vmName hostName hostIpAddr
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported phyMachName phyMachIpAddr diskName datastore diskReadKBytesPerSec diskWriteKBytesPerSec diskReadReqPerSec diskWriteReqPerSec
Poll Interval pollIntv uint32 Polling interval in seconds
Sample event:
Page 1174
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Feb 08 18:22:16 10.1.2.11 java:
[PH_DEV_MON_VM_DISK_IO]:[eventSeverity]=PHL_INFO,
[phyMachName]=HOST-10.1.2.51,
[phyMachIpAddr]=10.1.2.51, [pollIntv]=180, [vmName]=CO159,
[morId]=vm-194, [hostName]=CO159, [hostIpAddr]=10.1.2.159,
[diskName]=t10.ATA_\__\__ST3500418AS_\_6VM7Y9KB,
[datastore]=LocalHD_2.51, [diskReadKBytesPerSec]=83.333,
[diskWriteKBytesPerSec]=278.111, [diskReadReqPerSec]=20.567,
[diskWriteReqPerSec]=14.283
VM Datastore Utilization Monitoring
Event Type: PH_DEV_MON_VM_DISK_UTIL
Description: Event containing VM Datastore utilization metrics
Source: All
Key Attributes:
Name Id Type Description
Host IP
Address
Event Type eventType
Event
Severity eventSeverity
Event
Severity
Category string Event type set to PH_DEV_MON_SYS_PING_STAT uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr
Date Time at which AccelOps generated this event
Relaying IP relayDevIpAddr rawEventMsg
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name vmName hostName hostIpAddr string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported phyMachName phyMachIpAddr datastore datastoreType diskUtil totalDiskMB freeDiskMB usedDiskMB
Poll Interval pollIntv uint32 Polling interval in seconds
Sample event:
Page 1175
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Feb 08 18:24:48 10.1.2.11 java:
[PH_DEV_MON_VM_DISK_UTIL]:[eventSeverity]=PHL_INFO, [vmName]=CO159,
[phyMachName]=HOST-10.1.2.51, [phyMachIpAddr]=10.1.2.51,
[pollIntv]=182, [hostName]=CO159, [hostIpAddr]=10.1.2.159,
[datastore]=LocalHD_2.51, [datastoreType]=VMFS, [diskUtil]=11.18,
[totalDiskMB]=471808.0, [freeDiskMB]=41298.0,
[usedDiskMB]=52737.0
VM Datastore I/O Monitoring
Event Type: PH_DEV_MON_VM_STATE
Description: Event containing VM CPU metrics
Source: All
Key Attributes:
Name Id Type Description
Event Type eventType
Event
Severity eventSeverity
Event
Severity
Category eventSeverityCat
Event
Receive
Time
Reporting
IP phRecvTime reptDevIpAddr
Relaying IP relayDevIpAddr string Event type set to PH_DEV_MON_SYS_PING_STAT uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Raw Event
Log
Host name
Host IP
Address rawEventMsg vmName hostName hostIpAddr
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported phyMachName phyMachIpAddr datastore diskReadReqPerSec diskWriteReqPerSec string
IP string double double diskReadKBytesPerSec double diskWriteKBytesPerSec double
Poll Interval pollIntv uint32 Polling interval in seconds
Sample event:
Page 1176
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Feb 08 18:23:49 10.1.2.11 java:
[PH_DEV_MON_VM_DATASTORE_IO]:[eventSeverity]=PHL_INFO,[phyMachName]
=HOST-10.1.2.51,
[phyMachIpAddr]=10.1.2.51, [pollIntv]=180, [hostName]=CO159,
[hostIpAddr]=10.1.2.159, [vmName]=CO159, [morId]=vm194,
[datastore]=LocalHD_2.51, [diskReadReqPerSec]=20.567,
[diskWriteReqPerSec]=14.283, [diskReadKBytesPerSec]=83.333,
[diskWriteKBytesPerSec]=278.111
VM Network IO Monitoring
Event Type: PH_DEV_MON_VM_STATE
Description: Event containing VM CPU metrics
Source: All
Key Attributes:
Name Id
Event Type eventType
Event
Severity
Event
Severity
Category eventSeverity
Type
string
Description
Event type set to PH_DEV_MON_SYS_PING_STAT uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr
Date Time at which AccelOps generated this event
Relaying IP relayDevIpAddr rawEventMsg
Date
Date
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address vmName hostName hostIpAddr string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported phyMachName phyMachIpAddr IP vSwitch string intfName sentPkts recvPkts sentBytes recvBytes
Poll Interval pollIntv string string uint32 Sent Packets uint32 Received Packets uint32 Sent Bytes uint32 Received Bytes uint32 Polling interval in seconds
Sample event:
Page 1177
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Feb 08 18:22:16 10.1.2.11 java:
[PH_DEV_MON_VM_NET_INTF_UTIL]:[eventSeverity]=PHL_INFO,[phyMachName
]=HOST-10.1.2.51,
[phyMachIpAddr]=10.1.2.51, [pollIntv]=180, [vmName]=CO159,
[morId]=vm-194, [hostName]=CO159, [hostIpAddr]=10.1.2.159,
[vSwitch]=vSwitch0, [intfName]=Network adapter 1, [sentPkts]=454,
[recvPkts]=939, [sentBytes]=102400, [recvBytes]=307200
VM Cluster CPU Utilization
<134>Oct 02 12:10:04 172.16.10.28 java:
[PH_DEV_MON_VMCLUSTER_CPU_UTIL]:[eventSeverity]=PHL_INFO,
[pollIntv]=180, [cluster]=sj-cluster, [clusterId]=domain-c36,
[clusterPath]=Datacenters/DataCenter172/sj-cluster, [cpuTotalMHz]=19144,
[cpuUtilMHz]=652.0, [cpuUtil]=3.4
VM Cluster Memory Utilization
<134>Oct 02 12:10:04 172.16.10.28 java:
[PH_DEV_MON_VMCLUSTER_MEM_UTIL]:[eventSeverity]=PHL_INFO,
[pollIntv]=180, [cluster]=sj-cluster, [clusterId]=domain-c36,
[clusterPath]=Datacenters/DataCenter172/sj-cluster, [memTotalMB]=16370,
[memConsumedKB]=1.1672604E7, [memOverheadKB]=163124.0, [memUtil]=70.61
VM Cluster Datastore I/O Utilization
<134>Oct 02 12:10:04 172.16.10.28 java:
[PH_DEV_MON_VMCLUSTER_DATASTORE_IO]:[eventSeverity]=PHL_INFO,
[cluster]=sj-cluster, [morId]=domain-c36,
[clusterPath]=Datacenters/DataCenter172/sj-cluster,
[datastore]=datastore1, [diskReadReqPerSec]=6.011,
[diskWriteReqPerSec]=32.122, [diskReadKBytesPerSec]=147.333,
[diskWriteKBytesPerSec]=467.778
VM Resource pool CPU Utilization
Page 1178
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Oct 02 12:15:43 192.168.1.3 java:
[PH_DEV_MON_VMRESPOOL_CPU_UTIL]:[eventSeverity]=PHL_INFO,
[pollIntv]=180, [resourcePool]=Grafted from 192.168.1.3,
[resPoolId]=pool1, [resPoolPath]=ESX3i-QA-01.prospecthills.net/Grafted from 192.168.1.3, [cpuUtil]=35.78, [cpuUtilMHz]=1745.0
VM Resource pool Memory Utilization
<134>Oct 02 12:12:43 192.168.1.3 java:
[PH_DEV_MON_VMRESPOOL_MEM_UTIL]:[eventSeverity]=PHL_INFO,
[pollIntv]=180, [resourcePool]=Grafted from 192.168.1.3,
[resPoolId]=pool1, [resPoolPath]=ESX3i-QA-01.prospecthills.net/Grafted from 192.168.1.3, [memUtil]=0.0, [memOverheadKB]=252740.0
ESX State Monitoring
134>Oct 02 12:01:01 172.16.10.28 java:
[PH_DEV_MON_ESX_STATE]:[eventSeverity]=PHL_INFO,
[hostName]=HOST-172.16.20.125, [hostIpAddr]=172.16.20.125,
[pollIntv]=180, [phyMachConnectionState]=notResponding,
[phyMachConnectionStateCode]=2, [phyMachPowerState]=unknown,
[phyMachPowerStateCode]=3, [status]=red
ESX CPU Monitoring
ESX Memory Monitoring
ESX Datastore Utilization Monitoring
Page 1179
FortiSIEM Installation Guide FortiSIEM Installation Guide
<134>Oct 02 12:00:42 192.168.1.3 java:
[PH_DEV_MON_ESX_DISK_UTIL]:[eventSeverity]=PHL_INFO,
[hostName]=ESX3i-QA-01.prospecthills.net, [hostIpAddr]=192.168.1.3,
[pollIntv]=180, [morId]=ha-host, [datastore]=LocalHD192.168.1.3,
[datastoreType]=VMFS, [diskUtil]=93.65, [totalDiskMB]=476672.0,
[freeDiskMB]=30283.0, [usedDiskMB]=446389.0
ESX Disk I/O Monitoring
<134>Oct 02 12:00:42 192.168.1.3 java:
[PH_DEV_MON_ESX_DISK_IO]:[eventSeverity]=PHL_INFO,
[hostName]=ESX3i-QA-01.prospecthills.net, [hostIpAddr]=192.168.1.3,
[pollIntv]=180, [morId]=ha-host, [diskName]=mpx.vmhba32:C0:T0:L0,
[diskReadKBytesPerSec]=9.9, [diskWriteKBytesPerSec]=0.3,
[diskReadReqPerSec]=1.215, [diskWriteReqPerSec]=0.045,
[devDiskRdLatency]=0.1, [devDiskWrLatency]=0.4, [kernDiskRdLatency]=0.0,
[totDiskRdLatency]=0.1, [totDiskWrLatency]=0.4, [kernDiskWrLatency]=0.0
ESX Datastore I/O Monitoring
<134>Oct 02 12:00:43 192.168.1.3 java:
[PH_DEV_MON_ESX_DATASTORE_IO]:[eventSeverity]=PHL_INFO, [morId]=ha-host,
[datastore]=LocalHD192.168.1.3,
[phyMachName]=ESX3i-QA-01.prospecthills.net,
[phyMachIpAddr]=192.168.1.3, [pollIntv]=180, [diskReadReqPerSec]=9.335,
[diskWriteReqPerSec]=14.155, [diskReadKBytesPerSec]=338.9,
[diskWriteKBytesPerSec]=120.8
Page 1180
FortiSIEM Installation Guide FortiSIEM Installation Guide
Application Monitoring Events
Application Monitoring Events
AccelOps generates the following events related to application monitoring
Microsoft DNS Performance Metrics
Microsoft DHCP Performance Metrics
Microsoft Active Directory Performance Metrics
IP SLA ICMP metrics
Generic IPSLA metrics
Tomcat Application Server Monitoring Metrics
Glassfish Application Server Monitoring Metrics
Weblogic Application Server Monitoring Metrics
Websphere Application Server Monitoring Metrics
JBOSS Application Server Monitoring Metrics
Process Resource Utilization
Event Type: PH_DEV_MON_PROC_RES_UTIL
Description: Event containing process resource utilization metrics
Source:
Cisco IOS (SSH)
Microsoft Windows (SNMP, WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP)
Key Attributes:
Name Id
Event Type eventType
Event
Severity eventSeverity
Event
Severity
Category eventSeverityCat
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr
Type Description
string Event type set to PH_DEV_MON_PROC_RES_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
Relaying IP relayDevIpAddr rawEventMsg
IP
IP
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address
Application
Name
Application
Group
Name
Software
Name hostName hostIpAddr appName appGroupName swProcName string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported string Short descriptive name of the process, e.g. "Microsoft IIS" string Name of the application group to which the process belongs; e.g. "Microsoft IIS" string Process/Executable name; e.g. svchost.exe
Page 1181
FortiSIEM Installation Guide FortiSIEM Installation Guide
Software
Param
CPU utilization
Memory utilization
Real Peak
Memory
(KB)
Disk Read
Rate (KBps) swParam cpuUtil memUtil realMemPeakKBytes string Process/Executable parameters, e.g. "-k iissvc" double Process CPU utilization (between 0-100).
double Process memory utilization (between 0-100) uint32 Peak real memory usage (KBytes).
.
Available only for Windows (WMI)
diskReadKBytesPerSec double Process disk read rate (KBytes/sec). Available only for Windows (WMI)
Disk Write
Rate (KBps)
System
Uptime diskWriteKBytesPerSec double Process disk write rate (KBytes/sec). Available only for Windows (WMI) sysUpTime
Poll Interval pollIntv uint32 The total time for which process was up. Available only for Windows (WMI) uint32 Polling interval in seconds
Sample event
[PH_DEV_MON_PROC_RESOURCE_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPe rfJob.cpp,[lineNumber]=2801,[swProcName]=mfeann.exe,[hostName]=QA-V-WIN0
3-IIS1,[hostIpAddr]=192.168.1.6,[memUtil]=0.208340,[cpuUtil]=0.000000,[a ppName]=McAfee Virus-scan Process,[appGroupName]=McAfee Virus-scan
Process,[pollIntv]=176,[swParam]= 940,[phLogDetail]=
[PH_DEV_MON_PROC_RESOURCE_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phPe rfJob.cpp,[lineNumber]=2809,[swProcName]=snmp.exe,[hostName]=QA-EXCHG,[h ostIpAddr]=172.16.10.28,[memUtil]=0.254050,[cpuUtil]=0.062386,[appName]=
Windows SNMP Service,[appGroupName]=Windows SNMP
Service,[realMemPeakKBytes]=5320,[virtMemKBytes]=55528,[peakVirtMemKByte s]=57848,[diskReadKBytesPerSec]=0.107272,[diskWriteKBytesPerSec]=0.00002
5,[sysUpTime]=1586025,[pollIntv]=176,[swParam]=,[phLogDetail]=
Apache Performance Metrics
Event Type: PH_DEV_MON_APP_APACHE_MET
Description: Event containing Apache web server performance metrics
Source: Apache (HTTP(S))
Key Attributes:
Name
Event Type
Event Severity
Event Severity
Category
Event Receive
Time
Reporting IP
Id
eventType eventSeverity eventSeverityCat phRecvTime reptDevIpAddr
Type Description
string Event type set to PH_DEV_MON_SYS_CPU_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
IP IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
Page 1182
FortiSIEM Installation Guide FortiSIEM Installation Guide
Relaying IP relayDevIpAddr
Raw Event Log rawEventMsg
Host name hostName
Host IP Address hostIpAddr httpTotalAccesses HTTP
Connection
Count
HTTP Total
KBytes httpTotalKBytes apacheCPULoad Apache CPU
Load
Apache Uptime
Apache Request
Rate (/sec) apacheUptime apacheReqPerSec
IP IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported uint32 Total number of HTTP(S) connections during this interval uint32 Total bytes transferred (KBytes) during this interval double CPU utilization of Apache processes uint64 Uptime of Apache processes double HTTP connection rate (/sec) apacheBytesPerSec double HTTP connection rate (bytes/sec) Apache Transfer
Rate (Bytes/sec)
Apache Transfer
Rate (Bytes/Req)
Apache Busy
Workers
Apache Idle
Workers
Poll Interval apacheBytesPerReq double HTTP per-connection transferred bytes apacheBusyWorkers uint32 Number of busy Apache worker threads apacheIdleWorkers pollIntv uint32 Number of idle Apache worker threads uint32 Polling interval in seconds
Microsoft ASP.NET Metrics
Event Type: PH_DEV_MON_APP_ASPNET_MET
Description: Event containing ASP.NET metrics
Source:
Microsoft Windows (WMI)
Key Attributes:
Name
Event Type
Id
eventType
Type Description
string Event type set to PH_DEV_MON_PROC_RES_UTIL
Event
Severity
Event
Severity
Category
Event
Receive
Time eventSeverity eventSeverityCat string phRecvTime
Reporting IP reptDevIpAddr uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP relayDevIpAddr rawEventMsg
IP
IP
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name hostName hostIpAddr string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported Host IP
Address
Application
Group Name appGroupName string Name of the application group to which the process belongs; e.g. "Microsoft IIS"
Sample ASP.NET event
Page 1183
FortiSIEM Installation Guide FortiSIEM Installation Guide
[PH_DEV_MON_APP_ASPNET_MET]:[eventSeverity]=PHL_INFO,[fileName]=phPerfJo b.cpp,[lineNumber]=4868,[hostName]=QA-EXCHG,[hostIpAddr]=172.16.10.28,[a ppGroupName]=Microsoft
ASPNET,[aspReqExecTimeMs]=0,[aspReqCurrent]=0,[aspReqDisconnected]=0,[as pReqQueued]=0,[aspReqRejected]=0,[aspReqWaitTimeMs]=0,[phLogDetail]=
Exchange RPC Metrics
Event Type: PH_DEV_MON_APP_ASPNET_MET
Description: Event containing ASP.NET metrics
Source:
Microsoft Windows (WMI)
Key Attributes:
Name Id Type Description
Event Type
Event
Severity
Event
Severity
Category eventType eventSeverity string Event type set to PH_DEV_MON_PROC_RES_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) eventSeverityCat string
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP relayDevIpAddr rawEventMsg
IP
IP
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address
Application
Group Name hostName hostIpAddr appGroupName string
IP string
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Name of the application group to which the process belongs; e.g. "Microsoft IIS"
Exchange RPC Error Metrics
Event Type: PH_DEV_MON_APP_ASPNET_MET
Description: Event containing ASP.NET metrics
Source:
Microsoft Windows (WMI)
Key Attributes:
Name
Event Type
Event
Severity
Event
Severity
Category
Event
Receive
Time
Id
eventType eventSeverity eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High phRecvTime
Type Description
string Event type set to PH_DEV_MON_PROC_RES_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Date Time at which AccelOps generated this event
Page 1184
FortiSIEM Installation Guide FortiSIEM Installation Guide
Reporting IP reptDevIpAddr
Relaying IP relayDevIpAddr
IP
IP
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address
Application
Group Name rawEventMsg hostName hostIpAddr string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported appGroupName string Name of the application group to which the process belongs; e.g. "Microsoft IIS"
Exchange Mailbox Metrics
Event Type: PH_DEV_MON_APP_ASPNET_MET
Description: Event containing ASP.NET metrics
Source:
Microsoft Windows (WMI)
Key Attributes:
Name
Event Type
Event
Severity
Event
Severity
Category
Relaying IP
Raw Event
Log
Host name
Host IP
Address
Application
Group Name
Id
eventType eventSeverity
Type
string
Description
Event type set to PH_DEV_MON_PROC_RES_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) eventSeverityCat string
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr relayDevIpAddr rawEventMsg hostName hostIpAddr appGroupName
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
IP
IP
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string
IP string
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Name of the application group to which the process belongs; e.g. "Microsoft IIS"
Exchange SMTP Metrics
Event Type: PH_DEV_MON_APP_ASPNET_MET
Description: Event containing ASP.NET metrics
Source:
Microsoft Windows (WMI)
Key Attributes:
Name
Event Type
Event
Severity
Event
Severity
Category
Id
eventType eventSeverity
Type Description
string Event type set to PH_DEV_MON_PROC_RES_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Page 1185
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr
Date Time at which AccelOps generated this event
Relaying IP relayDevIpAddr
IP IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address
Application
Group Name rawEventMsg hostName hostIpAddr string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported appGroupName string Name of the application group to which the process belongs; e.g. "Microsoft IIS"
Microsoft DNS Performance Metrics
Event Type: PH_DEV_MON_APP_ASPNET_MET
Description: Event containing ASP.NET metrics
Source:
Microsoft Windows (WMI)
Key Attributes:
Name Id Type Description
Event Type
Event
Severity
Event
Severity
Category eventType eventSeverity string Event type set to PH_DEV_MON_PROC_RES_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) eventSeverityCat string
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP relayDevIpAddr rawEventMsg
IP
IP
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address
Application
Group Name hostName hostIpAddr appGroupName string
IP string
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Name of the application group to which the process belongs; e.g. "Microsoft IIS"
Microsoft DHCP Performance Metrics
Event Type: PH_DEV_MON_APP_ASPNET_MET
Description: Event containing ASP.NET metrics
Source:
Microsoft Windows (WMI)
Key Attributes:
Name
Event Type
Event
Severity
Id
eventType eventSeverity
Type Description
string Event type set to PH_DEV_MON_PROC_RES_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Page 1186
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event
Severity
Category
Event
Receive
Time eventSeverityCat string phRecvTime
Reporting IP reptDevIpAddr
Date
IP
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP relayDevIpAddr IP
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
rawEventMsg string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address
Application
Group Name hostName hostIpAddr appGroupName string
IP string
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Name of the application group to which the process belongs; e.g. "Microsoft IIS"
Microsoft Active Directory Performance Metrics
Event Type: PH_DEV_MON_APP_ASPNET_MET
Description: Event containing ASP.NET metrics
Source:
Microsoft Windows (WMI)Key Attributes:
Name Id Type Description
Event Type
Event
Severity eventType eventSeverity string Event type set to PH_DEV_MON_PROC_RES_UTIL uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event
Severity
Category eventSeverityCat string
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP relayDevIpAddr rawEventMsg
IP
IP
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address
Application
Group Name hostName hostIpAddr appGroupName string
IP string
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Name of the application group to which the process belongs; e.g. "Microsoft IIS"
IP SLA VoIP Metrics
Event Type: PH_DEV_MON_IPSLA_VOIP_MET
Description: Event containing IP SLA metrics
Source:
Cisco IOS
Key Attributes:
Name
Event Type
Id
eventType
Type Description
string Event type set to PH_DEV_MON_IPSLA_VOIP_MET
Page 1187
FortiSIEM Installation Guide FortiSIEM Installation Guide
Min Round Trip
Time (RTT) (msec)
Average Jitter
(msec)
Max Jitter (msec)
Min Jitter (msec)
Average Jitter
Source to
Destination (msec)
Max Jitter Source to
Destination (msec)
Min Jitter Source to
Destination (msec)
Average Jitter
Destination to
Source (msec)
Max Jitter
Destination to
Source (msec)
Min Jitter
Destination to
Source (msec)
Packets Lost
Packets Lost
Source to
Destination
Packets Lost
Destination to
Source
Event Severity
Event Severity
Category eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time phRecvTime
Reporting IP reptDevIpAddr
Date
IP
Time at which AccelOps generated this event
IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP relayDevIpAddr
Raw Event Log
Source IP Address
Source Name
Destination IP
Address
Destination Name rawEventMsg srcIpAddr srcName destIpAddr destName srcIpPort
IP IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly,
Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string Source IP Address in the IP SLA test
IP Host Name of Source IP as in AccelOps CMDB - this is not reported in IP SLA but inserted by AccelOps during event processing string Destination IP Address in the IP SLA test (the peer IP SLA gateway) string Host Name of DestinationIP as in AccelOps CMDB - this is not reported in IP SLA but inserted by AccelOps during event processing uint16 Source TCP/UDP Port as in IP SLA test Source TCP/UDP
Port
Destination
TCP/UDP Port
IP SLA Protocol
VoIP Codec
Average Round Trip
Time (RTT) (msec)
Max Round Trip
Time (RTT) (msec) destIpPort ipSLAProto codec uint16 Destination TCP/UDP Port as in IP SLA test string string avgDurationMSec uint32 maxDurationMsec uint32 minDurationMsec uint32 avgJitterMs maxJitterMs minJitterMs avgJitterSDMs maxJitterSDMs minJitterSDMs avgJitterDSMs maxJitterDSMs minJitterDSMs pktLost pktLostSD pktLostDS uint32 uint32 uint32 uint32 uint32 uint32 uint32 uint32 uint32 uint32 uint32 uint32
Page 1188
FortiSIEM Installation Guide FortiSIEM Installation Guide
Packets Missing In
Action
Packets Late
Packets Out of
Sequence
VoIP MOS Score
VoIP ICPIF Score pktMIA pktLate pktOutSeq mosScore icpifScore uint32 uint32 uint32 double uint32
IP SLA HTTP Metrics
Event Type: PH_DEV_MON_IPSLA_HTTP_MET
Description: Event containing HTTP IP SLA metrics
Source: Cisco IOS (SNMP)
Key Attributes:
Name
Event Type
Event Severity
Event Severity
Category
Event Receive Time
Reporting IP
Relaying IP
Raw Event Log
Source IP Address
Source Name
Id
eventType eventSeverity eventSeverityCat phRecvTime reptDevIpAddr relayDevIpAddr rawEventMsg srcIpAddr srcName
Type Description
string Event type set to PH_DEV_MON_IPSLA_HTTP_MET uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
IP IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string Source IP Address in the IP SLA test
IP Host Name of Source IP as in AccelOps CMDB - this is not reported in IP SLA but inserted by
AccelOps during event processing string Destination IP Address in the IP SLA test (the peer IP SLA gateway) Destination IP
Address
Destination Name destIpAddr destName string Host Name of DestinationIP as in AccelOps CMDB - this is not reported in IP SLA but inserted by AccelOps during event processing uint16 Source TCP/UDP Port as in IP SLA test Source TCP/UDP
Port
Destination
TCP/UDP Port
IP SLA Protocol
HTTP Response
Time (msec)
DNS Response Time
(msec)
TCP Connect response Time
(msec)
HTTP Transaction
Response Time
(msec)
IPSLA HTTP Status
IPSLA Status
Description
HTTP Status Code srcIpPort destIpPort ipSLAProto httpResponseTimeMs dnsResponseTimeMs ipslaHttpStatus ipslaHttpStatusDesc httpStatusCode uint16 Destination TCP/UDP Port as in IP SLA test string uint32 uint32 tcpConnectResponseTimeMs uint32 httpTransactResponseTimeMs uint32 uint32 string string
Page 1189
FortiSIEM Installation Guide FortiSIEM Installation Guide
Tomcat Application Server Performance Metrics
There are 7 events that captures various metrics
PH_DEV_MON_TOMCAT_CPU - CPU usage related metrics
PH_DEV_MON_TOMCAT_MEMORY - Memory usage related metrics
PH_DEV_MON_TOMCAT_SERVLET - Servlet usage related metrics
PH_DEV_MON_TOMCAT_SESSION - Session usage related metrics
PH_DEV_MON_TOMCAT_DB - Database usage related metrics
PH_DEV_MON_TOMCAT_THREAD_POOL - Thread pool related metrics
PH_DEV_MON_TOMCAT_REQUEST_PROCESSOR - Request Processor related metrics
The details for each event is below
Event Type: PH_DEV_MON_TOMCAT_CPU
Description: Event containing Tomcat Application Server CPU utilization
Source: Tomcat (JMX)
Sample Event:
<134>Jan 22 01:57:32 10.1.2.16 java:
[PH_DEV_MON_TOMCAT_CPU]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN08R2-
JMX,[destDevPort]=9218,[appVersion]=Apache Tomcat/7.0.27,[appServerState]=STARTED,[sysUpTime]=2458304,[cpuUtil]=0
Key Attributes:
Name Id
Event Type eventType
Type
string
Description
Event type set to
PH_DEV_MON_TOMCAT_CPU_MET
x x
Event
Severity
Event
Severity
Category
Event
Receive
Time eventSeverity eventSeverityCat string phRecvTime
Reporting IP reptDevIpAddr uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Date
IP
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low,
5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP relayDevIpAddr rawEventMsg
IP string
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address x hostName hostIpAddr destDevPort appVersion string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported uint32 x uint32 x
System
Uptime
CPU
Utilization appServerState sysUpTime cpuUtil double x uint64 Tomcat Uptime double CPU utilization of Apache processes
Event Type: PH_DEV_MON_TOMCAT_MEMORY
Description: Event containing Tomcat Application Server memory utilization
Source: Tomcat (JMX)
Sample Event:
<134>Jan 22 01:57:32 10.1.2.16 java:
[PH_DEV_MON_TOMCAT_MEMORY]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN
08R2-JMX,[destDevPort]=9218,[appVersion]=Apache
Tomcat/7.0.27,[appServerState]=STARTED,[freeMemKB]=116504,[freeSwapMemKB]=2974020,[memTotalMB]=4095,[swapMemTotalM
B]=8189,[virtMemCommitKB]=169900,[memUtil]=98,[swapMemUtil]=65,[heapUsedKB]=18099,[heapMaxKB]=932096,[heapCommitKB]=
48896,[heapUtil]=37,[nonHeapUsedKB]=22320,[nonHeapMaxKB]=133120,[nonHeapCommitKB]=24512,[nonHeapUtil]=91
Key Attributes:
Page 1190
FortiSIEM Installation Guide FortiSIEM Installation Guide
Name Id
Event Type
Event
Severity
Event
Severity
Category eventType eventSeverity eventSeverityCat
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr
Type Description
string Event type set to
PH_DEV_MON_TOMCAT_CPU_MET
uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string
Date
Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Time at which AccelOps generated this event
Relaying IP relayDevIpAddr appServerState freeMemKB freeSwapMemKB memTotalMB swapMemTotalMB virtMemCommitKB memUtil swapMemUtil heapUsedKB heapMaxKB heapCommitKB heapUtil nonHeapUsedKB nonHeapMaxKB nonHeapCommitKB nonHeapUtil
IP
IP
IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw event containing all attributes in comma separated "[Attribute] = value" format.
Raw Event
Log
Host name
Host IP
Address
System
Uptime
CPU
Utilization rawEventMsg hostName hostIpAddr destDevPort appVersion string string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported uint64 Tomcat Uptime double CPU utilization of Apache processes
Event Type: PH_DEV_MON_TOMCAT_SERVLET
Description: Event containing Tomcat Application Server Servlet usage
Source: Tomcat (JMX)
Sample Event:
<134>Jan 22 01:57:33 10.1.2.16 java:
[PH_DEV_MON_TOMCAT_SERVLET]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN
08R2-JMX,[destDevPort]=9218,[appVersion]=Apache
Tomcat/7.0.27,[webAppName]=//localhost/host-manager,[servletName]=HTMLHostManager,[countAllocated]=0,[totalRequests]=0,[reqEr rors]=0,[loadTime]=0,[reqProcessTimeAvg]=0,[maxInstances]=20,[servletState]=STARTED
Key Attributes:
Name Id Type Description
Page 1191
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event Type eventType
Event
Severity eventSeverity
Event
Severity
Category eventSeverityCat
Event
Receive
Time phRecvTime
Reporting IP reptDevIpAddr string Event type set to
PH_DEV_MON_TOMCAT_SERVLET
uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to
Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event
Relaying IP relayDevIpAddr x x x x x x
CPU
Utilization
Raw Event
Log
Host name x x
Host IP
Address x
System
Uptime rawEventMsg hostName hostIpAddr destDevPort appVersion webAppName servletName countAllocated
IP
IP
IP address of device reporting this event. In this case set to the device reporting the utilization (same as
Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng
IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP
Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported uint32 x uint32 x double x uint64 Tomcat Uptime double CPU utilization of Apache processes totalRequests reqErrors uint32 x uint32 x loadTime uint32 x reqProcessTimeAvg uint32 x maxInstances servletState uint32 x string x
Event Type: PH_DEV_MON_TOMCAT_SESSION
Description: Event containing Tomcat Application Server Session usage
Source: Tomcat (JMX)
Sample Event:
<134>Jan 22 01:57:33 10.1.2.16 java:
[PH_DEV_MON_TOMCAT_SESSION]:[eventSeverity]=PHL_INFO,[destIpAddr]=10.1.2.16,[hostIpAddr]=10.1.2.16,[hostName]=SH-WIN
08R2-JMX,[destDevPort]=9218,[appVersion]=Apache
Tomcat/7.0.27,[webContextPath]=/host-manager,[activeSessionsPeak]=0,[activeSessions]=0,[duplicateSession]=0,[expiredSession]=0,[r ejectedSession]=0,[sessionLifetimeAvg]=0,[sessionLifetimePeak]=0,[sessionProcessTimeMs]=0,[sessionCreateRate]=0,[sessionExpireR ate]=0,[webAppState]=STARTED,[processExpiresFrequency]=6,[maxSessionLimited]=-1,[maxInactiveInterval]=1800
Key Attributes:
Name Id
Event Type eventType
Event
Severity
Event
Severity
Category eventSeverity eventSeverityCat phRecvTime Event
Receive
Time
Reporting
IP reptDevIpAddr
Type Description
string Event type set to
PH_DEV_MON_TOMCAT_SESSION
uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date
IP
Time at which AccelOps generated this event
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
Page 1192
FortiSIEM Installation Guide FortiSIEM Installation Guide
Relaying IP relayDevIpAddr
Raw Event
Log
Host name x x
Host IP
Address x
System
Uptime x x x
CPU
Utilization x x x rawEventMsg hostName hostIpAddr destDevPort appVersion webContextPath activeSessionsPeak activeSessions
IP IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string
IP
Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported uint32 x uint32 x double x uint64 Tomcat Uptime double CPU utilization of Apache processes duplicateSession expiredSession rejectedSession sessionLifetimeAvg uint32 x uint32 x uint32 x uint32 x sessionLifetimePeak sessionProcessTimeMs sessionCreateRate sessionExpireRate uint32 x string webAppState processExpiresFrequency string x maxSessionLimited maxInactiveInterval
Page 1193
FortiSIEM Installation Guide FortiSIEM Installation Guide
Network Flow Monitoring Events
Network Flow Events
These events are generated from Cisco Netflow and SFlow.
Event Type: IOS-NETFLOW-BI (BI standing for bidirecational: two unidirectional netflow messages are combined into one),
SFLOW-BI
Description: Event containing netflow data
Source: Cisco IOS (Netflow)
Key Attributes:
Name
Event Type
Event Severity
Event Severity
Category
Id
eventType eventSeverity eventSeverityCat
Type Description
string Event type set to IOS-NETFLOW-BI, SFLOW-BI uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Date Time at which AccelOps generated this event (after receiving netflow) Event Receive
Time
Reporting IP phRecvTime
Relaying IP
Source IP
Dest IP
IP Protocol
Source TCP/UDP
Port reptDevIpAddr relayDevIpAddr srcIpAddr destIpAddr ipProto srcIpPort
Date
Date
IP
IP
IP address of device reporting this event. In this case set to the device reporting the utilization
(same as Host name attribute)
IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to
AccelOps IP Address.
Source IP address of the flow
Destination IP address of the flow uint16 IP protocol e.g. TCP/UDP/GRE/ICMP etc uint16 Source TCP/UDP port
Dest TCP/UDP
Port
ICMP Type
ICMP Code destIpPort icmpType icmpCode uint16 Destination TCP/UDP port uint16 ICMP type uint16 ICMP code
IP Type of Service tos
Sent TCP flags srcDestTCPFlags uchar uchar
IP Type of Service
OR-ed TCP Flags from Source to Destination destSrcTCPFlags uchar OR-ed TCP Flags from Destination to Source Received TCP flags
Source Intf SNMP
Index
Source Interface
Name srcSnmpIntfIndex srcIntfName uint16 Source SNMP interface index string Source Interface name
Dest Intf SNMP
Index
Destination
Interface Name
Source
Autonomous
System Number destSnmpIntfIndex uint16 Destination SNMP interface index destIntfName srcASNum
Dest Autonomous
System Number
Sent Bytes destASNum
Sent Packets
Received Bytes sentBytes sentPkts recvBytes
Received Packets recvPkts string Destination Interface name uint16 Source Autonomous number uint16 Destination Autonomous number uint32 Sent Bytes in this flow uint32 Sent Packets in this flow uint32 Received Bytes in this flow uint32 received Packets in this flow
Page 1194
FortiSIEM Installation Guide
Security Information Management
FortiSIEM Installation Guide
Page 1195
FortiSIEM Installation Guide
User Password Monitoring Events
AccelOps generates the following events related to user password monitoring during LDAP discoveries.
LDAP Password Never Expire Events
LDAP Password Not Required Events
LDAP Password Never Expire Events
Event Type: PH_DEV_DISCOV_ADS_PASSWORD_NEVER_EXPIRES
Description: Event contains users whose password never expires
Source: Windows Active Directory Discovery via LDAP
Sample event
FortiSIEM Installation Guide
<174>Feb 12 12:09:29 PH-QA-AUTOTEST phDiscover[22677]:
[PH_DISCOV_ADS_PASSWORD_NEVER_EXPIRES]:[eventSeverity]=PHL_INFO,[pr ocName]=phDiscover,[fileName]=dirUser.cpp,[lineNumber]=1733,[hostIp
Addr]=192.168.0.10,[user]=joe.user,[userFullName]=Joe
User,[userDN]=CN=Joe
User,CN=Users,DC=acme,DC=net,[passwordAge]=586,[passwordLastSet]=13
10069061,[phLogDetail]=
Key Attributes:
Name
Event Type
Event Severity
Event Severity
Category
Id
eventType eventSeverity
Type Description
string
Event type set to
PH_DEV_DISCOV_ADS_PASSWORD_NEVER_EXPIRES
uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to
Low, 5-8 are mapped to Medium and 9-10 are mapped to High phRecvTime Date Time at which AccelOps generated this event Event Receive
Time
Reporting IP
Relaying IP
Raw Event Log reptDevIpAddr relayDevIpAddr rawEventMsg
Host name hostName
Host IP Address hostIpAddr
Date
Date string string
IP
AccelOps Super IP
AccelOps Super IP
Raw event containing all attributes in comma separated "[Attribute] = value" format.
Active Directory Server Host Name
Active Directory Server IP
User
User Full Name user string User logon name userFullName string user Full Display Name
User
Distinguishing
Name
Password Age
Password Last
Set userDN string User Distinguishing name passwordAge uint64 Password age in days passwordLastSet Date Time when password was last set
LDAP Password Not Required Events
Event Type:
PH_DISCOV_ADS_PASSWORD_NOT_REQD
Description: Event contains users whose password is not required
Source: Windows Active Directory Discovery via LDAP
Sample event
Page 1196
FortiSIEM Installation Guide FortiSIEM Installation Guide
<174>Feb 12 12:09:29 PH-QA-AUTOTEST phDiscover[22677]:
[PH_DISCOV_ADS_PASSWORD_NOT_REQD]:[eventSeverity]=PHL_INFO,[procNam e]=phDiscover,[fileName]=dirUser.cpp,[lineNumber]=1738,[hostIpAddr]
=192.168.0.10,[user]=AO-DB01$,[userFullName]=AO-DB01,[userDN]=CN=AO
-DB01,CN=Computers,DC=accelops,DC=net,[phLogDetail]=
Key Attributes:
Name Id Type Description
Event Type
Event Severity
Event Severity
Category
Event Receive
Time
Reporting IP
Relaying IP
Raw Event Log eventType eventSeverity string Event type set to uint16 Set to 1.
PH_DEV_DISCOV_ADS_PASSWORD_NEVER_EXPIRES
eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to
Low, 5-8 are mapped to Medium and 9-10 are mapped to High phRecvTime Date Time at which AccelOps generated this event reptDevIpAddr relayDevIpAddr rawEventMsg
Date AccelOps Super IP
Date AccelOps Super IP string Raw event containing all attributes in comma separated "[Attribute] = value" format.
Host name hostName
Host IP Address hostIpAddr
User
User Full Name string
IP
Active Directory Server Host Name
Active Directory Server IP user string User logon name userFullName string user Full Display Name
User
Distinguishing
Name userDN string User Distinguishing name
LDAP Password Expiry Event
Event Type: PH_DISCOV_ADS_PASSWORD_TO_EXPIRE
Description: Event contains users and the times when their passwords were last set and when their passwords are about to expire
Source: Windows Active Directory Discovery via LDAP
Sample event
<174>Feb 12 12:09:29 PH-QA-AUTOTEST phDiscover[22677]:
[PH_DISCOV_ADS_PASSWORD_TO_EXPIRE]:[eventSeverity]=PHL_INFO,[procNa me]=phDiscover,[fileName]=dirUser.cpp,[lineNumber]=1750,[hostIpAddr
]=192.168.0.10,[user]=testuser,[userFullName]=Testuser,[userDN]=CN=
Testuser,CN=Users,DC=acme,DC=net,[daysToPasswordExpiry]=0,[password
LastSet]=1360606672,[phLogDetail]=
Key Attributes:
Name
Event Type
Event Severity
Event Severity
Category
Id
eventType eventSeverity eventSeverityCat
Type Description
string Event type set to
PH_DISCOV_ADS_PASSWORD_TO_EXPIRE
uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Page 1197
FortiSIEM Installation Guide FortiSIEM Installation Guide
Event Receive
Time
Reporting IP
Relaying IP
Raw Event Log
Host name phRecvTime reptDevIpAddr relayDevIpAddr rawEventMsg hostName
Host IP Address hostIpAddr
User user
User Full Name userFullName
User
Distinguishing
Name
Days to
Password
Expiry
Password Last
Set userDN
Date
Date
AccelOps Super IP
AccelOps Super IP string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string Active Directory Server Host Name
IP Active Directory Server IP string User logon name string user Full Display Name daysToPasswordExpiry uint64 Number of days until the password will expire passwordLastSet
Date string
Date
Time at which AccelOps generated this event
User Distinguishing name
Time when password was last set
LDAP Password Stale Events
Event Type: PH_DISCOV_ADS_PASSWORD_STALE
Description: Event contains users and the times when their password was last set and when their password age - only include users whose password age is at least 90 days
Source: Windows Active Directory Discovery via LDAP
Sample event
<174>Feb 12 12:09:29 PH-QA-AUTOTEST phDiscover[22677]:
[PH_DISCOV_ADS_PASSWORD_STALE]:[eventSeverity]=PHL_INFO,[procName]= phDiscover,[fileName]=dirUser.cpp,[lineNumber]=1744,[hostIpAddr]=19
2.168.0.10,[user]=test.user,[userFullName]=Test
User,[userDN]=CN=Partha
Bhattacharya,CN=Users,DC=acme,DC=net,[passwordAge]=586,[passwordLas tSet]=1310069061,[phLogDetail]=
Key Attributes:
Name
Event Type
Event Severity
Event Severity
Category
Id
eventType
Type Description
string Event type set to
PH_DISCOV_ADS_PASSWORD_STALE
eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity) eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to
Low, 5-8 are mapped to Medium and 9-10 are mapped to High phRecvTime Date Time at which AccelOps generated this event Event Receive
Time
Reporting IP
Relaying IP
Raw Event Log
Host name reptDevIpAddr relayDevIpAddr rawEventMsg hostName
Date
Date
AccelOps Super IP
AccelOps Super IP string Raw event containing all attributes in comma separated "[Attribute] = value" format.
string Active Directory Server Host Name
Host IP Address hostIpAddr
User user
User Full Name
IP string
Active Directory Server IP
User logon name userFullName string user Full Display Name
Page 1198
FortiSIEM Installation Guide
User
Distinguishing
Name
Password Age
Password Last
Set userDN string User Distinguishing name passwordAge uint64 Age of the password in days passwordLastSet Date Time when password was last set
FortiSIEM Installation Guide
Page 1199
FortiSIEM Installation Guide
Scenario-based Rules and Reports
Scenario-based System Rules and Reports
This section describes scenario based rules and reports that comes pre-built with a default AccelOps installation.
FortiSIEM Installation Guide
Page 1200
FortiSIEM Installation Guide FortiSIEM Installation Guide
Change management related
Change management related
Network Device Config Changes
Change: Router Configuration Changes Detected From Log: This report provides details about router config changes
Change: Router Run versus Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config
Change: Router Config Changes Detected Via Login: This report captures detected configuration changes via login
WLAN Config Change: This report tracks all software, hardware and device configuration changes at WLAN Access points and Base stations. The report includes Original Reporting Controller IP, Event Type and MAC address of the AP or Controller where the event happened. If the MAC address is empty then, the event happened at the reporting Controller.
Change: Firewall Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config
Change: Firewall Config Changes Detected Via Login: This report captures detected startup or running config changes - the changes are detected by logging into the device and hence is accurate.
Server Changes
Change: Database Server DDL Changes: Captures database DDL changes
Change: Top Windows Servers, Users by Account Modification Count: This report ranks the windows servers and their administrative users by the number of user account modification events
Change: Windows Server Account Modification Details: This report captures the details of windows account modification events.
Details include the administrative user, target user, the operation performed and the raw log
Change: Windows File Access Details: This report captures the details of windows server file access events. Details include the administrative user, file/directory, the operation performed and the raw log
Change: Top Windows Servers, Users By Config/Policy Modification Count: This report ranks the windows servers and their administrative users by the number of server configuration or policy modification events
Change: Windows Server Config Modification Details: This report captures the details of windows server configuration or policy modification events. Details include the administrative user, file/directory, the operation performed and the raw log
Change: Local User Accounts Created: This report captures user accounts added on a server
Change: Local User Accounts Deleted: This report captures user accounts removed from a server
Change: User Accounts Modified: This report captures local user account modifications.
Change: Users Added To Local Groups: This report captures users added to local groups.
Change: Users Added To Global Groups: This report captures users added to global or univeral groups.
Change: Users Deleted From Local Groups: This report captures users deleted from local groups.
Change: Users Deleted From Global Groups: This report captures users deleted from global or univeral groups.
Change: Local Groups Deleted: This report captures local group deletions
Change: Local Groups Modified: This report captures local group modifications
Change: Global Groups Created: This report captures global group creations
Change: Global Groups Deleted: This report captures global group deletions
Change: Global Groups Modified: This report captures global group modifications
Change: Local Groups Created: This report captures local group creations
Change: Windows Server Password Changes: Tracks password changes
Change: Windows Server Account Lock/Unlock history: Captures account lockouts and unlocks on windows servers. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.
Change: Windows Audit Policy Changed: This report captures audit policy changes
Change: Windows File Access Failures: This report captures the details of windows server file access failures. Details include the administrative user, file/directory, the operation performed and the raw log
Change: Windows File Access Successes: This report captures the details of windows server file access successes. Details include the administrative user, file/directory, the operation performed and the raw log
Change: All Account/Group Change Events: This report lists all account/group change events
Change: Top Windows Domain Controllers, Users By Account Modification Count: Ranks Domain Controllers and their administrators by the number of account modifications performed
Change: Windows Domain Account Modification Details: Details windows domain account modifications
Change: Top Windows Domain Controllers, Users By File Modification Count: Ranks the Domain Controllers abd their administrators by the number of file modifications performed
Change: Windows Domain Controller File Modification Details: Provides details about domain controller file modifications
Change: Top Windows Domain Controllers, Users By Config Modification Count: Ranks Domain Controllers and their administrators by the number of config modifications performed
Change: Windows Domain Controller Config Changes: Provides detailed windows domain controller config changes
Change: Computers added to domain: Captures computers added to a domain
Change: Computers deleted from domain: Captures computers removed from a domain
Change: Domain user accounts created: Captures user accounts added to a domain
Page 1201
FortiSIEM Installation Guide FortiSIEM Installation Guide
Change: Domain user accounts deleted: Captures user accounts removed from a domain
Change: Domain user accounts modified: Captures domain user account modifications.
Change: Domain groups created: Captures domain group creations
Change: Domain groups deleted: Captures domain group deletions
Change: Domain groups modified: Captures domain group modifications
Change: Users Added To Domain Groups: Tracks users added to domain groups
Change: Users Deleted From Domain Groups: Tracks users deleted from domain groups. The information contains who did it (User,
Computer, Domain, Source IP) along with the deleted account (Target User) and group (Target User Group).
Change: Domain User Password Changes: Tracks password changes
Change: Domain Account Lock/Unlock history: Captures account lockouts and unlocks on domain accounts. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.
Change: Domain Account Unlocks: Captures account unlocks on domain accounts. Account unlocks happen after lockouts that may happen on repeated login failures
Change: Windows Domain Controller Audit Policy Changed: This report captures audit policy changes
Change: Unix Users Added To Group: Tracks user additions to groups
Change: Unix User Password Changed: Tracks password changes
Change: Audited file changes: Tracks user modifications to files and directories. Both the content and attribute modifications are captured. For actions on directories, the affected files in the directories are also captured.
Page 1202
FortiSIEM Installation Guide FortiSIEM Installation Guide
Compliance related
Compliance related
PCI
PCI 1.x: Top Reporting Firewalls By Event Count: Ranks the firewalls by the number of events sent
PCI 1.x: Firewall Config Changes Detected Via Login: This report captures detected startup or running config changes - the changes are detected by logging into the device and hence is accurate.
PCI 1.x: Router Config Changes Detected From Log: This report provides details about router config changes
PCI 1.x: Router Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config
PCI 1.x: Firewall Run vs Startup Config Difference Via Login: This report captures detected differences between a firewall's running and startup config
PCI 1.x: Router/Switch Config Changes Detected Via Login: This report captures detected startup or running config changes - the changes are detected by logging into the device and hence is accurate.
PCI 1.x: Router Config Changes Detected Via Login: This report captures detected startup or running config changes - the changes are detected by logging into the device and hence is accurate.
PCI 1.x: Firewall Admin Activity Details: Provides details about firewall admin activity - logons, command executions and logoff
PCI 1.x: Router Admin Activity Details: Provides details about router admin activity - logons, command executions and logoff
PCI 1.x: Firewall NAT Translations: This report captures the NAT translations over a time window
PCI 1.x: Top Firewalls and Outbound Permitted Services By Connections, Bytes: Ranks firewalls and permitted outbound services by first the total number of connections and then by bytes for that service
PCI 1.x: Top Firewalls and Inbound Permitted Services By Connections, Bytes: Ranks firewalls and permitted inbound services by first the total number of connections and then by bytes for that service
PCI 1.x: Top Firewalls and Permitted High Port Services By Connections, Bytes: Tracks the high port services permitted by firewalls
- these services may pose security risk
PCI 1.x: Top Firewalls and Permitted Uncommon Services By Connections, Bytes: Tracks uncommon services permitted by firewalls - common services include DNS, SMTP, Web
PCI 1.x: Top Firewalls and Permitted Vulnerable Low Port Services By Connections, Bytes: Tracks uncommon services permitted by firewalls - vulnerable services include Microsoft services such as MS-RPC (135), NETBIOS-SSN (139), MICROSOFT-DS (445),
MS-SQL (1433,1434), FTP (23), TELNET (21)
PCI 1.x: Top Firewall Originated Or Destined Permitted Connections By Count: Ranks the firewall originated or destined connections - these connections would be typically be for administrative and monitoring purposes
PCI 5.x: Top Reporting Security Management Servers:
PCI 1.x: Virus found but not remediated by Host Antivirus: Captures events that indicate the viruses that Host Antivirus found but failed to remedy
PCI 5.x: Spyware found but not remediated by Host Antivirus:
PCI 5.x: Top hosts with Malware found by Host Antivirus:
PCI 5.x: Top IPs with Malware Found By IPS and Firewalls: Tracks IP addresses with Malware as found by IPS
PCI 5.x: Top IPs with Malware Found By Antivirus and Security Gateways: Tracks IP addresses with Malware as found by Host
Anti-virus and Security Gateways
PCI 5.x: Non-compliant Hosts and Security Software License Expirations: Tracks non-compliant hosts and license expiry events from Security Management Gateways and Firewalls. Non-compliant hosts may not have proper security software running and therefore may pose a security threat. License expiration of security software may expose exploitable security vulnerabilities.
PCI 8.x,10.x: Detailed Successful Login At PCI Device: Captures detailed successful logins at any device or application including servers, network devices, domain controllers, VPN gateways, WLAN controllers and applications
PCI 8.x: Windows Server Account Lockouts: This report captures account lockouts on windows servers. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation
PCI 8.x: Windows Domain Account Lockouts: This report details windows domain account lockouts
PCI 8.x: Windows Server Account Lock/Unlock history: Captures account lockouts and unlocks on windows servers. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.
PCI 8.x: Domain Account Lock/Unlock history: Captures account lockouts and unlocks on domain accounts. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.
PCI 8.x: Server Password Changes: Tracks password changes
PCI 8.x: Local Windows User Accounts Created: This report captures user accounts added on a server
PCI 8.x: Local Windows User Accounts Deleted: This report captures user accounts removed from a server
PCI 8.x: Local Windows User Accounts Modified: This report captures local user account modifications.
PCI 8.x: Users Added To Local Groups: This report captures users added to local groups.
PCI 8.x: Users Added To Global Groups: This report captures users added to global or univeral groups.
PCI 8.x: Users Deleted From Local Groups: This report captures users deleted from local groups.
PCI 8.x: Users Deleted From Global Groups: This report captures users deleted from global or univeral groups.
PCI 8.x: Local Windows Groups Deleted: This report captures local group deletions
PCI 8.x: Local Windows Groups Modified: This report captures local group modifications
Page 1203
FortiSIEM Installation Guide FortiSIEM Installation Guide
PCI 8.x: Local Windows Groups Created: This report captures local group creations
PCI 8.x: Global Windows Groups Created: This report captures global group creations
PCI 8.x: Global Windows Groups Deleted: This report captures global group deletions
PCI 8.x: Global Windows Groups Modified: This report captures global group modifications
PCI 10.x: Detailed Failed Login At PCI System: Captures detailed failed logins at any device or application - servers, network devices, domain controllers, VPN gateways, WLAN controllers and applications
PCI 10.x: Privileged Windows Server Logon Attempts using the Administrator Account: This report details prvileged logon attempts to a windows server using the Administrator account
PCI 10.x: Remote Desktop Connections to Windows Servers: This report details successful and failed remote desktop connections
PCI 10.x: Unix Server Privileged Logon: This report details UNIX server privileged logon (su) details with all parsed parameters and raw logs
PCI 10.x: Unix Server Privileged Command Execution: This report details privilege command execuations (sudo) at a Unix server
PCI 10.x: Successful Firewall Admin Logon Details: Details about successful firewall logons
PCI 10.x: Failed Firewall Admin Logon Details: Details about failed firewall logons
PCI 10.x: Successful Router Admin Logon Details: Details about successful router logons
PCI 10.x: Failed Router Admin Logon Details: Details about failed router logons
PCI 10.x: Successful VPN Admin Logon: Provides event details for all successful VPN admin logons
PCI 10.x: Failed VPN Admin Logon: Provides event details for all failed VPN admin logons
PCI 10.x: Successful WLAN Admin Logon: Tracks successful admin logons to the WLAN Controller
PCI 10.x: Failed WLAN Admin Logon: Tracks failed admin logons to the WLAN Controller
PCI 10.x: Network Device Down/Restart: Tracks network device down and restart events
PCI 10.x: Server Down/Restart: Tracks server down and restart events
PCI 10.x: Application Down/Restart: Tracks application stop and start events
PCI 10.x: Network Device Link Module Down/Up: Tracks network device miscellaneous module (e.g. fan, power etc.) down/up events
PCI 10.x: Network Device Errors: Tracks errors reported by network device
COBIT
COBIT AI2.4: Successful Database Server Logon Details: Captures successful database server logons
COBIT AI2.4: Failed Database Server Logon Details: Captures failed database server logons
COBIT AI2.4: Top App Servers By Current Uptime: Ranks App servers by current uptime (i.e. time since last reboot)
COBIT AI2.5: Server Installed Software Changes: This report captures detected installed software changes
COBIT DS3.x: Top Devices By CPU Util: Ranks the devices by average cpu utilization over a window
COBIT DS3.x: Top Devices By Memory Util: Ranks the devices by average memory utilization over a window
COBIT DS3.x: Top Devices By Disk Util: Ranks the devices by average system disk utilization over a window
COBIT DS3.x: Top Firewalls By Connections: Ranks the firewalls by average connection count over a window. The ratio of the connection count to the max connection count since startup is also provided. If the ratio is close 1 and the firewall is up for a long time, the the firewall must be busy from a firewalled connection point of view.
COBIT DS3.x: Top Device Intf By Util, Error, Discards: Ranks the devices and their network interfaces by first average inbound and then by outbound interface utilization. The utilization is computed by accounting for the link bandwidth.
COBIT DS3.x: Top Server Apps By CPU, Mem Util: Ranks the server processes by first average cpu utilization and then by memory utilization over a window
COBIT DS3.x: Top Network Device Processes By CPU, Mem Util: Ranks the host processes by average cpu utilization over a window
COBIT DS3.x: Top App Servers By CPU Usage With Other Performance Metrics: Ranks App servers by the amount of CPU usage this report provides details on other performance aspects such as memory, threads and classes
COBIT DS3.x: All devices under performance monitoring: Captures all devices under performance monitoring
COBIT DS4.x: Device Ping Monitor Statistics: Tracks the PING response times and packet loss for the monitored devices
COBIT DS4.x: Network Device Down/Restart: Tracks network device down and restart events
COBIT DS4.x: Server Down/Restart: Tracks server down and restart events
COBIT AI2.4,DS4.x: Application Down/Restart: Tracks application stop and start events
COBIT DS4.x: Network Device Failover: Tracks network device failovers
COBIT DS4.x: Network Device Interface Down/Up: Tracks network device interface down and up events
COBIT AI2.4,DS4.x: Server Interface Down/Up: Tracks server network interface down and up events
COBIT DS4.x: Network Device License Expiry: Tracks network device license expiry events
COBIT DS4.x: Application License Expiry: Tracks application license expiry events
COBIT DS4.x: Network Device Link Module Down/Up: Tracks network device miscellaneous module (e.g. fan, power etc.) down/up events
COBIT DS4.x: Top Network Devices, Errors By Count: Ranks network devices by reported error count
COBIT DS4.x: Top Devices by Accumulated Downtime: Ranks the devices by total system downtime over the last week
COBIT AI2.4,DS4.x: Top Applications By Response Time: Ranks the services by average application level probe response times
COBIT DS5.4: Windows Server Account Lock/Unlock history: Captures account lockouts and unlocks on windows servers. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.
COBIT DS5.4: Domain Account Lock/Unlock history: Captures account lockouts and unlocks on domain accounts. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.
COBIT DS5.4: Server Password Changes: Tracks password changes
COBIT DS5.4: Local Windows User Accounts Created: This report captures user accounts added on a server
COBIT DS5.4: Local Windows User Accounts Deleted: This report captures user accounts removed from a server
COBIT DS5.4: Local Windows User Accounts Modified: This report captures local user account modifications.
COBIT DS5.4: Users Added To Local Windows User Groups: This report captures users added to local groups.
COBIT DS5.4: Users Added To Global Windows User Groups: This report captures users added to global or univeral groups.
Page 1204
FortiSIEM Installation Guide FortiSIEM Installation Guide
COBIT DS5.4: Users Deleted From Local Windows User Groups: This report captures users deleted from local groups.
COBIT DS5.4: Users Deleted From Global Windows User Groups: This report captures users deleted from global or univeral groups.
COBIT DS5.4: Local Windows Groups Deleted: This report captures local group deletions
COBIT DS5.4: Local Windows Groups Modified: This report captures local group modifications
COBIT DS5.4: Local Windows Groups Created: This report captures local group creations
COBIT DS5.4: Global Windows Groups Created: This report captures global group creations
COBIT DS5.4: Global Windows Groups Deleted: This report captures global group deletions
COBIT DS5.4: Global Windows Groups Modified: This report captures global group modifications
COBIT DS5.4: Unix Users Added To Group: Tracks user additions to groups
COBIT DS5.4: Unix User Password Changed: Tracks password changes
COBIT DS5.5: Privileged Windows Server Logon Attempts using the Administrator Account: This report details prvileged logon attempts to a windows server using the Administrator account
COBIT DS5.5: Remote Desktop Connections to Windows Servers: This report details successful and failed remote desktop connections
COBIT DS5.5: Unix Server Privileged Logon: This report details UNIX server privileged logon (su) details with all parsed parameters and raw logs
COBIT DS5.5: Unix Server Privileged Command Execution: This report details privilege command execuations (sudo) at a Unix server
COBIT DS5.5: Successful Firewall Admin Logon Details: Details about successful firewall logons
COBIT DS5.5: Failed Firewall Admin Logon Details: Details about failed firewall logons
COBIT DS5.5: Successful Router Admin Logon Details: Details about successful router logons
COBIT DS5.5: Failed Router Admin Logon Details: Details about failed router logons
COBIT DS5.5: Successful VPN Admin Logon: Provides event details for all successful VPN admin logons
COBIT DS5.5: Failed VPN Admin Logon: Provides event details for all failed VPN admin logons
COBIT DS5.5: Successful WLAN Admin Logon: Tracks successful admin logons to the WLAN Controller
COBIT DS5.5: Failed WLAN Admin Logon: Tracks failed admin logons to the WLAN Controller
COBIT DS5.6: Top Incidents Ranked By Severity, Count: Ranks the incidents by first their severity and then by their count.
COBIT DS5.6: All Availability Incidents: Captures the availability incidents
COBIT DS5.6: Performance Incidents: Captures the performance related incidents
COBIT DS5.6: Security Incidents: Captures the security related incidents
COBIT DS5.9: Virus found but not remediated by Host Antivirus: Captures events that indicate the viruses that Host Antivirus found but failed to remedy
COBIT DS5.9: Spyware found but not remediated by Host Antivirus:
COBIT DS5.9: Top Hosts with Malware found by Host Antivirus:
COBIT DS5.9: Top Hosts with Malware Found By Network IPS and Firewalls: Tracks IP addresses with Malware as found by IPS
COBIT DS5.9: Top Hosts with Malware Found By Antivirus and Security Gateways: Tracks IP addresses with Malware as found by
Host Anti-virus and Security Gateways
COBIT DS5.9: Non-compliant Hosts and Security Software License Expirations: Tracks non-compliant hosts and license expiry events from Security Management Gateways and Firewalls. Non-compliant hosts may not have proper security software running and therefore may pose a security threat. License expiration of security software may expose exploitable security vulnerabilities.
COBIT DS5.10: Top Firewalls and Permitted Outbound Services By Connections, Bytes: Ranks firewalls and permitted outbound services by first the total number of connections and then by bytes for that service
COBIT DS5.10: Top Firewalls and Permitted Inbound Services By Connections, Bytes: Ranks firewalls and permitted inbound services by first the total number of connections and then by bytes for that service
COBIT DS5.10: Top Firewalls and Permitted High Port Services By Connections, Bytes: Tracks the high port services permitted by firewalls - these services may pose security risk
COBIT DS5.10: Top Firewalls and Permitted Uncommon Services By Connections, Bytes: Tracks uncommon services permitted by firewalls - common services include DNS, SMTP, Web
COBIT DS5.10: Top Firewalls and Permitted Vulnerable Low Port Services By Connections, Bytes: Tracks uncommon services permitted by firewalls - vulnerable services include Microsoft services such as MS-RPC (135), NETBIOS-SSN (139), MICROSOFT-DS
(445), MS-SQL (1433,1434), FTP (23), TELNET (21)
COBIT DS5.10: Top Firewall Originated Or Destined Permitted Connections By Count: Ranks the firewall originated or destined connections - these connections would be typically be for administrative and monitoring purposes
COBIT DS5.10: Top Blocked Internal Sources, Services, Destinations: Ranks blocked Internal Sources, Services, Destinations
Ranked By Connection Count
COBIT DS5.10: Top Blocked Internal Destinations, Services Ranked By Connection Count: Ranks blocked Internal Destinations,
Services Ranked By Connection Count
COBIT DS5.10: Top Network IPS events By Severity, Count: Ranks the network IPS events by count
COBIT DS5.10: Top Network Scanners By Event Count: Ranks the source IP addresses by detected network scan or reconnaissance events
COBIT DS5.10: Top Blocked Network Attacks By Count: Ranks the network attacks attacks blocked by network IPS
COBIT DS5.10: Top Web Users By Uncommon HTTP Method Connections: Ranks web users by uncommon HTTP methods used
COBIT DS5.10: Top Web Users By HTTP POST Exchanged Bytes: Ranks web clients by HTTP POST byte count - can catch malware sending confidential information out
COBIT DS5.10: Top Visited Web Sites And Categories By Connections: Ranks (successfully) visited web sites and categories by the number of connections
COBIT DS5.10: Top Denied Web Sites And Categories By Connections: Ranks web sites and categories that were denied by policy, by the number of connections
COBIT DS5.10: Top Web Users, Denied Sites And Categories By Connections: Ranks users, web sites and categories that were denied by policy, by the number of connections
COBIT DS5.10: Top Inbound Blacklisted Mail Gateways By Connections: Ranks denied mail gateways by the number of attempted
Page 1205
FortiSIEM Installation Guide FortiSIEM Installation Guide
SMTP connections. The most common reason of denial is often the gateway being included in blacklists.
COBIT DS5.10: Top Inbound Blacklisted Mail Gateways and SMTP Error Types By Connections: Ranks denied mail gateways and the SMTP errors by the number of attempted connections. The most common SMTP error is often the gateway being included in mail blacklists.
COBIT DS5.10: Filtered Inbound Spam Count: Counts total inbound spam denied by spam filtering policy
COBIT DS5.10: Top Outbound Blacklisted Mail Gateways By Connections: Ranks denied mail gateways by the number of attempted
SMTP connections. The most common reason of denial is often the gateway being included in blacklists.
COBIT DS5.10: Top Outbound Blacklisted Mail Gateways and SMTP Error Types By Connections: Ranks denied mail gateways and the SMTP errors by the number of attempted connections. The most common SMTP error is often the gateway being included in mail blacklists.
COBIT DS5.10: Filtered Outbound Spam Count: Counts total outbound spam denied by policy
COBIT DS5.10: Total Denied Web Connections By Policy: Counts denied web site connections because of policy violations
COBIT DS5.10: Top Mail Security Gateway Actions By Count: Ranks the actions taken by the mail security gateway - actions include blocking an inbound/outbound mail gateway because of RBL or other SMTP violations, blocking a mail because of spam or other policy violations and delivering a mail
COBIT DS9.x: Firewall Config Changes Detected Via Login: This report captures detected startup or running config changes - the changes are detected by logging into the device and hence is accurate.
COBIT DS9.x: Firewall Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config
COBIT DS9.x: Router/Switch Config Changes Detected Via Login: This report captures detected startup or running config changes the changes are detected by logging into the device and hence is accurate.
COBIT DS9.x: Firewall Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config
SOX
SOX (AI2.4): Successful Database Server Logons: Captures successful database server logons
SOX (AI2.4): Failed Database Server Logons: Captures failed database server logons
SOX (AI2.4,DS4.x): Top Applications By Response Time: Ranks the services by average application level probe response times
SOX (AI2.4): Top App Servers By Current Uptime: Ranks App servers by current uptime (i.e. time since last reboot)
SOX (AI2.4,DS4.x): Application Down/Restart: Tracks application stop and start events
SOX (AI2.4,DS4.x): Server Interface Down/Up: Tracks server network interface down and up events
SOX (AI2.5): Server Installed Software Changes: This report captures detected installed software changes
SOX (DS3.x): Top Devices By CPU Util: Ranks the devices by average cpu utilization over a window
SOX (DS3.x): Top Devices By Memory Util: Ranks the devices by average memory utilization over a window
SOX (DS3.x): Top Devices By Disk Util: Ranks the devices by average system disk utilization over a window
SOX (DS3.x): Top Firewalls By Connections: Ranks the firewalls by average connection count over a window. The ratio of the connection count to the max connection count since startup is also provided. If the ratio is close 1 and the firewall is up for a long time, the the firewall must be busy from a firewalled connection point of view.
SOX (DS3.x): Top Device Intf By Util, Error, Discards: Ranks the devices and their network interfaces by first average inbound and then by outbound interface utilization. The utilization is computed by accounting for the link bandwidth.
SOX (DS3.x): Top Server Apps By CPU, Mem Util: Ranks the server processes by first average cpu utilization and then by memory utilization over a window
SOX (DS3.x): Top Network Device Processes By CPU, Mem Util: Ranks the host processes by average cpu utilization over a window
SOX (DS3.x): Top App Servers By CPU Usage With Other Performance Metrics: Ranks App servers by the amount of CPU usage this report provides details on other performance aspects such as memory, threads and classes
COBIT DS5.6: All Availability Incidents: Captures the availability incidents
SOX (DS5.6): Performance Incidents: Captures the performance related incidents
SOX (DS3.x): All devices under performance monitoring: Captures all devices under performance monitoring
SOX (DS5.4): Windows Server Account Lock/Unlock history: Captures account lockouts and unlocks on windows servers. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.
SOX (DS5.4,PCI1.x)): Domain Account Lock/Unlock history: Captures account lockouts and unlocks on domain accounts. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation.
SOX (DS5.4,PCI1.x): Server Password Changes: Tracks password changes
SOX (DS5.4,PCI1.x): Local Windows User Accounts Created: This report captures user accounts added on a server
SOX (DS5.4,PCI1.x): Local Windows User Accounts Deleted: This report captures user accounts removed from a server
SOX (DS5.4,PCI1.x): Local Windows User Accounts Modified: This report captures local user account modifications.
SOX (DS5.4,PCI1.x): Users Added To Local Windows User Groups: This report captures users added to local groups.
SOX (DS5.4): Users Added To Global Windows User Groups: This report captures users added to global or univeral groups.
SOX (DS5.4,PCI1.x): Users Deleted From Local Windows User Groups: This report captures users deleted from local groups.
SOX (DS5.4,PCI1.x): Users Deleted From Global Windows User Groups: This report captures users deleted from global or univeral groups.
SOX (DS5.4,PCI1.x): Local Windows Groups Deleted: This report captures local group deletions
SOX (DS5.4,PCI1.x): Local Windows Groups Modified: This report captures local group modifications
SOX (DS5.4,PCI1.x): Local Windows Groups Created: This report captures local group creations
SOX (DS5.4,PCI1.x): Global Windows Groups Created: This report captures global group creations
SOX (DS5.4,PCI1.x): Global Windows Groups Deleted: This report captures global group deletions
SOX (DS5.4,PCI1.x): Global Windows Groups Modified: This report captures global group modifications
SOX (DS5.4,PCI1.x): Unix Users Added To Group: Tracks user additions to groups
SOX (DS5.4,PCI1.x): Unix User Password Changed: Tracks password changes
SOX (DS5.5,PCI1.x): Privileged Windows Server Logon Attempts using the Administrator Account: This report details prvileged
Page 1206
FortiSIEM Installation Guide FortiSIEM Installation Guide logon attempts to a windows server using the Administrator account
SOX (DS5.5,PCI1.x): Remote Desktop Connections to Windows Servers: This report details successful and failed remote desktop connections
SOX (DS5.5,PCI1.x): Unix Server Privileged Logon: This report details UNIX server privileged logon (su) details with all parsed parameters and raw logs
SOX (DS5.5,PCI1.x): Unix Server Privileged Command Execution: This report details privilege command execuations (sudo) at a Unix server
COBIT DS5.5: Successful Firewall Admin Logon Details: Details about successful firewall logons
COBIT DS5.5: Failed Firewall Admin Logon Details: Details about failed firewall logons
SOX (DS5.5,PCI1.x): Successful Router Admin Logon Details: Details about successful router logons
SOX (DS5.5,PCI1.x): Failed Router Admin Logon Details: Details about failed router logons
SOX (DS5.5,PCI1.x): Successful VPN Admin Logon: Provides event details for all successful VPN admin logons
SOX (DS5.5,PCI1.x): Failed VPN Admin Logon: Provides event details for all failed VPN admin logons
SOX (DS5.5,PCI1.x): Successful WLAN Admin Logon: Tracks successful admin logons to the WLAN Controller
SOX (DS5.5,PCI1.x): Failed WLAN Admin Logon: Tracks failed admin logons to the WLAN Controller
SOX (DS5.6): Security Incidents: Captures the security related incidents
SOX (DS5.9): Virus found but not remediated by Host Antivirus: Captures events that indicate the viruses that Host Antivirus found but failed to remedy
SOX (DS5.9): Spyware found but not remediated by Host Antivirus:
SOX (DS5.9): Top Hosts with Malware found by Host Antivirus:
SOX (DS5.9): Top Hosts with Malware Found By Network IPS and Firewalls: Tracks IP addresses with Malware as found by IPS
SOX (DS5.9): Top Hosts with Malware Found By Antivirus and Security Gateways: Tracks IP addresses with Malware as found by
Host Anti-virus and Security Gateways
SOX (DS5.9): Non-compliant Hosts and Security Software License Expirations: Tracks non-compliant hosts and license expiry events from Security Management Gateways and Firewalls. Non-compliant hosts may not have proper security software running and therefore may pose a security threat. License expiration of security software may expose exploitable security vulnerabilities.
SOX (DS5.10): Top Firewalls and Permitted Outbound Services By Connections, Bytes: Ranks firewalls and permitted outbound services by first the total number of connections and then by bytes for that service
SOX (DS5.10): Top Firewalls and Permitted Inbound Services By Connections, Bytes: Ranks firewalls and permitted inbound services by first the total number of connections and then by bytes for that service
SOX (DS5.10): Top Firewalls and Permitted High Port Services By Connections, Bytes: Tracks the high port services permitted by firewalls - these services may pose security risk
SOX (DS5.10): Top Firewalls and Permitted Uncommon Services By Connections, Bytes: Tracks uncommon services permitted by firewalls - common services include DNS, SMTP, Web
SOX (DS5.10): Top Firewalls and Permitted Vulnerable Low Port Services By Connections, Bytes: Tracks uncommon services permitted by firewalls - vulnerable services include Microsoft services such as MS-RPC (135), NETBIOS-SSN (139), MICROSOFT-DS
(445), MS-SQL (1433,1434), FTP (23), TELNET (21)
SOX (DS5.10): Top Firewall Originated Or Destined Permitted Connections By Count: Ranks the firewall originated or destined connections - these connections would be typically be for administrative and monitoring purposes
SOX (DS5.10): Top Blocked Internal Sources, Services, Destinations: Ranks blocked Internal Sources, Services, Destinations
Ranked By Connection Count
SOX (DS5.10): Top Blocked Internal Destinations, Services Ranked By Connection Count: Ranks blocked Internal Destinations,
Services Ranked By Connection Count
SOX (DS5.10): Top Network IPS events By Severity, Count: Ranks the network IPS events by count
SOX (DS5.10): Top Network Scanners By Event Count: Ranks the source IP addresses by detected network scan or reconnaissance events
SOX (DS5.10): Top Blocked Network Attacks By Count: Ranks the network attacks attacks blocked by network IPS
SOX (DS5.10): Top Web Users By Uncommon HTTP Method Connections: Ranks web users by uncommon HTTP methods used
SOX (DS5.10): Top Web Users By HTTP POST Exchanged Bytes: Ranks web clients by HTTP POST byte count - can catch malware sending confidential information out
SOX (DS5.10): Top Visited Web Sites And Categories By Connections: Ranks (successfully) visited web sites and categories by the number of connections
SOX (DS5.10): Top Denied Web Sites And Categories By Connections: Ranks web sites and categories that were denied by policy, by the number of connections
SOX (DS5.10): Top Web Users, Denied Sites And Categories By Connections: Ranks users, web sites and categories that were denied by policy, by the number of connections
SOX (DS5.10): Top Inbound Blacklisted Mail Gateways By Connections: Ranks denied mail gateways by the number of attempted
SMTP connections. The most common reason of denial is often the gateway being included in blacklists.
SOX (DS5.10): Top Inbound Blacklisted Mail Gateways and SMTP Error Types By Connections: Ranks denied mail gateways and the SMTP errors by the number of attempted connections. The most common SMTP error is often the gateway being included in mail blacklists.
SOX (DS5.10): Filtered Inbound Spam Count: Counts total inbound spam denied by spam filtering policy
SOX (DS5.10): Top Outbound Blacklisted Mail Gateways By Connections: Ranks denied mail gateways by the number of attempted
SMTP connections. The most common reason of denial is often the gateway being included in blacklists.
SOX (DS5.10): Top Outbound Blacklisted Mail Gateways and SMTP Error Types By Connections: Ranks denied mail gateways and the SMTP errors by the number of attempted connections. The most common SMTP error is often the gateway being included in mail blacklists.
SOX (DS5.10): Filtered Outbound Spam Count: Counts total outbound spam denied by policy
SOX (DS5.10): Total Denied Web Connections By Policy: Counts denied web site connections because of policy violations
SOX (DS5.10): Top Mail Security Gateway Actions By Count: Ranks the actions taken by the mail security gateway - actions include blocking an inbound/outbound mail gateway because of RBL or other SMTP violations, blocking a mail because of spam or other policy violations and delivering a mail
Page 1207
FortiSIEM Installation Guide FortiSIEM Installation Guide
SOX (DS9.x): Firewall Config Changes Detected Via Login: This report captures detected startup or running config changes - the changes are detected by logging into the device and hence is accurate.
SOX (DS9.x): Firewall Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config
SOX (DS9.x): Router/Switch Config Changes Detected Via Login: This report captures detected startup or running config changes the changes are detected by logging into the device and hence is accurate.
SOX (DS9.x): Firewall Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config
HIPAA
HIPAA 164.308(a)(3): Server Password Changes: Tracks password changes
HIPAA 164.308(a)(3),164.312(a)(2): Local Windows User Accounts Created: This report captures user accounts added on a server
HIPAA 164.308(a)(3): Local Windows User Accounts Deleted: This report captures user accounts removed from a server
HIPAA 164.308(a)(3): Local Windows User Accounts Modified: This report captures local user account modifications.
HIPAA 164.308(a)(3): Users Added To Local Groups: This report captures users added to local groups.
HIPAA 164.308(a)(3): Users Added To Global Groups: This report captures users added to global or univeral groups.
HIPAA 164.308(a)(3): Users Deleted From Local Groups: This report captures users deleted from local groups.
HIPAA 164.308(a)(3): Users Deleted From Global Groups: This report captures users deleted from global or univeral groups.
HIPAA 164.308(a)(3): Local Windows Groups Deleted: This report captures local group deletions
HIPAA 164.308(a)(3): Local Windows Groups Modified: This report captures local group modifications
HIPAA 164.308(a)(3): Local Windows Groups Created: This report captures local group creations
HIPAA 164.308(a)(3): Global Windows Groups Created: This report captures global group creations
HIPAA 164.308(a)(3): Global Windows Groups Deleted: This report captures global group deletions
HIPAA 164.308(a)(3): Global Windows Groups Modified: This report captures global group modifications
HIPAA 164.308(a)(4): Firewall Config Changes Detected Via Login: This report captures detected startup or running config changes the changes are detected by logging into the device and hence is accurate.
HIPAA 164.308(a)(4): Router Config Changes Detected Via Login: This report captures detected startup or running config changes the changes are detected by logging into the device and hence is accurate.
HIPAA 164.308(a)(4): Router Run vs Startup Config Difference Via Login: This report captures detected differences between a routers running and startup config
HIPAA 164.308(a)(4): Top Firewalls and Outbound Permitted Services By Connections, Bytes: Ranks firewalls and permitted outbound services by first the total number of connections and then by bytes for that service
HIPAA 164.308(a)(4): Top Firewalls and Inbound Permitted Services By Connections, Bytes: Ranks firewalls and permitted inbound services by first the total number of connections and then by bytes for that service
HIPAA 164.308(a)(4): Top Firewalls and Permitted High Port Services By Connections, Bytes: Tracks the high port services permitted by firewalls - these services may pose security risk
HIPAA 1.x: Top Firewalls and Permitted Uncommon Services By Connections, Bytes: Tracks uncommon services permitted by firewalls - common services include DNS, SMTP, Web
HIPAA 164.308(a)(4): Top Firewalls and Permitted Vulnerable Low Port Services By Connections, Bytes: Tracks uncommon services permitted by firewalls - vulnerable services include Microsoft services such as MS-RPC (135), NETBIOS-SSN (139),
MICROSOFT-DS (445), MS-SQL (1433,1434), FTP (23), TELNET (21)
HIPAA 164.308(a)(4): Top Firewall Originated Or Destined Permitted Connections By Count: Ranks the firewall originated or destined connections - these connections would be typically be for administrative and monitoring purposes
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c),164.312(a)(2): Detailed Successful Login At HIPAA Device: Captures detailed successful logins at any device or application including servers, network devices, domain controllers, VPN gateways, WLAN controllers and applications
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c),164.312(a)(2): Detailed Failed Login At HIPAA System: Captures detailed failed logins at any device or application - servers, network devices, domain controllers, VPN gateways, WLAN controllers and applications
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Successful Firewall Admin Logon Details: Details about successful firewall logons
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Failed Firewall Admin Logon Details: Details about failed firewall logons
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Successful Router Admin Logon Details: Details about successful router logons
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Failed Router Admin Logon Details: Details about failed router logons
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Successful VPN Admin Logon: Provides event details for all successful VPN admin logons
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Failed VPN Admin Logon: Provides event details for all failed VPN admin logons
HIPAA 10.x: Successful WLAN Admin Logon: Tracks successful admin logons to the WLAN Controller
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Failed WLAN Admin Logon: Tracks failed admin logons to the WLAN Controller
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Privileged Windows Server Logon Attempts using the Administrator Account: This report details prvileged logon attempts to a windows server using the Administrator account
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Remote Desktop Connections to Windows Servers: This report details successful and failed remote desktop connections
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c),164.312(a)(2): Successful Windows Server Logons: This report records successful windows server logons
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c),164.312(a)(2): Failed Windows Server Logons: This report reports failed windows servers logons
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c),164.312(a)(2): Successful Unix Server Logons: This report details successful unix server logons with all parsed fields and raw logs
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c),164.312(a)(2): Failed Unix Server Logons: This report details failed unix server logons with all parsed fields and raw logs
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Unix Server Privileged Logon: This report details UNIX server privileged logon (su) details with all parsed parameters and raw logs
Page 1208
FortiSIEM Installation Guide FortiSIEM Installation Guide
HIPAA 164.308(a)(4),164.308(a)(5)(ii)(c): Unix Server Privileged Command Execution: This report details privilege command execuations (sudo) at a Unix server
HIPAA 164.308(a)(5)(ii)(c): Windows Server Account Lockouts: This report captures account lockouts on windows servers. Account lockouts happen on repeated login failures and may be suspicious if they are repeated or happen at odd hours of operation
HIPAA 164.308(a)(5)(ii)(c): Windows Server Account Unlocks: Captures account unlocks on windows servers. Account unlocks happen after lockouts that may happen on repeated login failures
HIPAA 164.308(a)(5): Server Password Changes: Tracks password changes
HIPAA 164.308(a)(6): Virus found but not remediated by Host Antivirus: Captures events that indicate the viruses that Host Antivirus found but failed to remedy
HIPAA 164.308(a)(6): Spyware found but not remediated by Host Antivirus:
HIPAA 164.308(a)(6): Top hosts with Malware found by Host Antivirus:
HIPAA 164.308(a)(6): Top IPs with Malware Found By IPS and Firewalls: Tracks IP addresses with Malware as found by IPS
HIPAA 164.308(a)(6): Top IPs with Malware Found By Antivirus and Security Gateways: Tracks IP addresses with Malware as found by Host Anti-virus and Security Gateways
HIPAA 164.308(a)(6): Non-compliant Hosts and Security Software License Expirations: Tracks non-compliant hosts and license expiry events from Security Management Gateways and Firewalls. Non-compliant hosts may not have proper security software running and therefore may pose a security threat. License expiration of security software may expose exploitable security vulnerabilities.
HIPAA 164.308(a)(6): Top Network Scanners By Event Count: Ranks the source IP addresses by detected network scan or reconnaissance events
HIPAA 164.308(a)(6): Top Blocked Network Attacks By Count: Ranks the network attacks attacks blocked by network IPS
HIPAA 164.308(a)(6): Top Network IPS events (affecting HIPAA devices) Ranked By Severity, Count: Ranks the network IPS events affecting HIPAA devices
HIPAA 164.308(a)(6): Top System detected Security Incidents (affecting HIPAA devices) Ranked By Severity, Count: Ranks the security related incidents by first their severity and then by their count - restricted to HIPAA devices
HIPAA 164.312(a)(2): Successful VPN Logons: Captures successful VPN logons
HIPAA 164.312(a)(2): Failed VPN Logons: Captures failed VPN logons
HIPAA 164.312(a)(2): Successful Wireless Logons: Captures successful wireless logons
HIPAA 164.312(a)(2): Failed Wireless Logons: Captures failed wireless logons
HIPAA 164.312(a)(2): Successful Windows Domain Authentications: Captures successful domain authentications
HIPAA 164.312(a)(2): Failed Windows Domain Authentications: Captures failed domain authentications
HIPAA 164.312(a)(2): Successful Database Server Logons: Captures successful database server logons
HIPAA 164.312(a)(2): Failed Database Server Logons: Captures failed database server logons
HIPAA 164.312(b): Windows Audit Policy Changed: This report captures audit policy changes
HIPAA 164.312(b): All System Admin User Logon Attempts: Details all System Admin User Logon Attempts
HIPAA 164.312(b): System Operational Warnings: Detects System operational errors including license limits, down collector
Page 1209
FortiSIEM Installation Guide FortiSIEM Installation Guide
Performance related
Network Performance Rules
Network Performance Reports
Top Routers Ranked By CPU Utilization: Ranks the routers by average cpu utilization over a window
Top Router Network Intf By Util, Error, Discards: Ranks the firewalls and their network interfaces by first average inbound and then by outbound interface utilization. The utilization is computed by accounting for the link bandwidth.
Top Routers By Memory Utilization: Ranks the firewalls by average memory utilization over a window
Top Firewalls By CPU Utilization: Ranks the firewalls by average cpu utilization over a window
Top Firewalls By Connection Count: Ranks the firewalls by average connection count over a window. The ratio of the connection count to the max connection count since startup is also provided. If the ratio is close 1 and the firewall is up for a long time, the the firewall must be busy from a firewalled connection point of view.
Top Firewall Network Intf By Util, Error, Discards: Ranks the firewalls and their network interfaces by first average inbound and then by outbound interface utilization. The utilization is computed by accounting for the link bandwidth.
Top Firewalls By Memory Utilization: Ranks the firewalls by average memory utilization over a window
Server Performance Rules
Server Performance Reports
Top Windows Servers By CPU Util: Ranks the windows servers by average cpu utilization over a window
Top Windows Servers By Memory Util and swap rate: Ranks the devices by average memory utilization and swap rate
Least Loaded Windows Servers By CPU Util: Ranks the windows servers by average cpu utilization over a window
Top Windows Servers By Disk I/O Activity: Ranks the windows servers by average disk I/O utilization over a window. This requires
WMI.
Top Windows Servers By Disk Space Util: Ranks the devices by average system disk utilization over a window
Top Unix Devices By CPU Util: Ranks the devices by average cpu utilization
Top Unix Devices By Memory Util and Swap Rate: Ranks the unix devices by average memory utilization over a window and provides details of memory utilization components such as buffered and cached memory
Top Unix Devices By Disk Space Util: Ranks the devices by average system disk utilization over a window
Top Unix Servers By Disk I/O Activity: Ranks the unix servers by average disk I/O utilization over a window
Virtualization Performance Rules
Virtualization Performance Reports
VM level
Performance: Top VMs By CPU Utilization: This report ranks virtual machines by cpu utilization
Performance: Top VMs By CPU Utilization With Details: This report ranks virtual machines by cpu utilization. Other CPU usage metrics are included.
Performance: Top VMs By CPU Ready Pct: This report ranks virtual machines by cpu ready percent. A high number indicates the VMis starved of CPU
Performance: Least utilized VMs By CPU: This report ranks virtual machines in the descending order of cpu utilization
Performance: Top VMs By Memory Utilization With Details: This report ranks virtual machines by memory utilization. Other memory usage metrics are included.
Performance: Top VMs By Swap Activity: This report ranks virtual machines by swapping activity
Performance: Top VMs By Memory Utilization: This report ranks virtual machines by memory utilization
Performance: Top VMs By Disk I/O Activity With Details: This report ranks virtual machines by disk I/O activity. Other disk I/O usage metrics are included.
Performance: Top VMs By Disk I/O Read Latency: This report ranks virtual machines by disk I/O latency
Performance: Top VMs By Disk I/O Write Latency: This report ranks virtual machines by disk I/O latency
Performance: Top VMs By Disk I/O Read Volume (MBps): This report ranks virtual machines by disk I/O read (MBps)
Performance: Top VMs By Disk I/O Write Volume (MBps): This report ranks virtual machines by disk I/O writes (MBps)
Page 1210
FortiSIEM Installation Guide FortiSIEM Installation Guide
Performance: Top VMs By Datastore I/O Activity With Details: This report ranks virtual machines by datastore I/O activity. Other datastore I/O usage metrics are included.
Performance: Top VMs By Datastore I/O Read Latency: This report ranks virtual machines by datastore I/O latency
Performance: Top VMs By Datastore I/O Write Latency: This report ranks virtual machines by datastore I/O latency
Performance: Top VMs By Datastore I/O Read Volume (MBps): This report ranks virtual machines by datastore I/O read (MBps)
Performance: Top VMs By Datastore I/O Write Volume (MBps): This report ranks virtual machines by datastore I/O writes (MBps)
ESX level
Performance: Top ESX Hosts By CPU Utilization: This report ranks ESX hosts by aggregate cpu utilization. Other CPU usage metrics are included.
Performance: Top ESX Hosts By Memory Utilization With Details: This report ranks ESX hosts by memory utilization. Other memory usage metrics are included.
Performance: Top ESX Hosts By Memory Utilization: This report ranks ESX hosts by memory utilization.
Performance: Top ESX Hosts By Swap Activity: This report ranks ESX hosts by swap activity
Performance: ESX Hosts With Balooning Memory: This report identifies ESX hosts with low enough memory where memory balooning technique is used for memory management
Performance: ESX Hosts With Swapping Memory: This report identifies ESX hosts with low memory where swapping memory technique is used for memory management
Performance: Top ESX Hosts By Disk I/O Activity With Details: This report ranks ESX hosts by disk I/O operations. Other disk I/O usage metrics are included.
Performance: Top ESX Hosts By Disk I/O Read Volume (MBps): This report ranks ESX hosts by read disk I/O (MBps)
Performance: Top ESX Hosts By Disk I/O Write Volume (MBps): This report ranks ESX hosts by write disk I/O (MBps)
Performance: Top ESX Hosts By Disk I/O Latency With Details: This report ranks ESX hosts by disk I/O latency. Other disk I/O usage metrics are included.
Performance: Top ESX Hosts By Kernel Disk I/O Read Latency: This report ranks ESX hosts by kernel disk I/O read latency.
Performance: Top ESX Hosts By Kernel Disk I/O Write Latency: This report ranks ESX hosts by kernel disk I/O write latency.
Performance: Top ESX Hosts By Device Disk I/O Read Latency: This report ranks ESX hosts by device disk I/O read latency
Performance: Top ESX Hosts By Device Disk I/O Write Latency: This report ranks ESX hosts by device disk I/O write latency.
Performance: Top ESX Hosts By Network Activity With Details: This report ranks ESX hosts by network activity.
Performance: Top ESX Hosts By Inbound Network Utilization: This report ranks ESX hosts by inbound network utilization
Performance: Top ESX Hosts By Outbbound Network Utilization: This report ranks ESX hosts by outbound network utilization
Performance: Datastores with Highest Utilization: This report ranks ESX hosts by datastore utlization
Performance: Datastores with Lowest Free Space: This report ranks ESX datastore with lowest free space
Performance: Top ESX Hosts By Datastore I/O Activity With Details: This report ranks ESX hosts by datsatore I/O operations. Other datastore I/O usage metrics are included.
Performance: Top ESX Hosts By Datastore I/O Read Volume (MBps: This report ranks ESX hosts by read datastore I/O (MBps)
Performance: Top ESX Hosts By Datastore I/O Write Volume (MBps): This report ranks ESX hosts by write datastore I/O (MBps)
Performance: Top ESX Hosts By Datastore I/O Latency With Details: This report ranks ESX hosts by datastore I/O latency. Other datastore I/O usage metrics are included.
Performance: Top ESX Hosts By Kernel Datastore I/O Read Latency: This report ranks ESX hosts by kernel datastore I/O read latency.
Performance: Top ESX Hosts By Kernel Datastore I/O Write Latency: This report ranks ESX hosts by kernel datastore I/O write latency.
Performance: Top ESX Hosts By Device Datastore I/O Read Latency: This report ranks ESX hosts by device datastore I/O read latency
Performance: Top ESX Hosts By Device Datastore I/O Write Latency: This report ranks ESX hosts by device datastore I/O write latency.
Cluster level
Performance: Top VMWare Clusters By CPU Utilization: This report ranks VMWare clusters by CPU utilization
Performance: Top VMWare Clusters By Memory Utilization: This report ranks VMWare clusters by memory utilization
Performance: Top VMWare Clusters By Device Datastore Read Latency: This report ranks VMWare clusters by datastore read latency
Performance: Top VMWare Clusters By Device Datastore Write Latency: This report ranks VMWare clusters by datastore write latency
Performance: Top VMWare Clusters By Datastore I/O Activity With Details: This report ranks VMWare Clusters by datsatore I/O operations. Other datastore I/O usage metrics are included.
Performance: Top VMWare Clusters By Datastore I/O Read Volume (MBps): This report ranks ESX hosts by read datastore I/O
(MBps)
Performance: Top VMWare Clusters By Datastore I/O Write Volume (MBps): This report ranks ESX hosts by write datastore I/O
(MBps)
Performance: Top VMWare Clusters By Datastore I/O Latency With Details: This report ranks ESX hosts by datastore I/O latency.
Other datastore I/O usage metrics are included.
Performance: Top VMWare Clusters By Kernel Datastore I/O Read Latency: This report ranks ESX hosts by kernel datastore I/O read latency.
Performance: Top VMWare Clusters By Kernel Datastore I/O Write Latency: This report ranks ESX hosts by kernel datastore I/O write latency.
Performance: Least Utilized VMWare Clusters By CPU: This report ranks least utilized VMWare clusters by CPU utilization
Performance: Least Utilized VMWare Clusters By Memory: This report ranks least utilized VMWare clusters by memory utilization
Page 1211
FortiSIEM Installation Guide FortiSIEM Installation Guide
Performance: Least Utilized VMWare Clusters By Device Datastore Read Latency: This report ranks least utilized VMWare clusters by datastore read latency
Performance: Least Utilized VMWare Clusters By Device Datastore Write Latency: This report ranks least utilized VMWare clusters by datastore write latency
Performance: Least Utilized VMWare Clusters By Disk I/O Read Volume (MBps): This report ranks least utlized VMware clusters by disk I/O read (MBps)
Performance: Least Utilized VMware Clusters By Disk I/O Write Volume (MBps): This report ranks least utilized VMWare clusters by disk I/O write volume (MBps)
Resource pool level
Performance: Top VMWare Resource Pools By CPU Utilization: This report ranks VMWare resource pools by CPU utilization
Performance: Top VMWare Resource Pools By Memory Utilization: This report ranks least utilized VMWare resource pools by memory utilization
Application Performance Rules
Application Performance Reports
Performance: Top Oracle Database servers by buffer cache hit ratio: Ranks the Oracle database servers by buffer cache hit ratio and presents other metrics
Performance: Top Oracle Database servers by table space usage: Ranks the Oracle databases by table space usage
Performance: Top MS SQL Database servers by buffer cache hit ratio: Ranks the MS SQL Servers by buffer cache hit ratio and presents other metrics
Performance: Top MS SQL Database servers by space usage: Ranks the MS SQL Servers by space usage
Page 1212
FortiSIEM Installation Guide FortiSIEM Installation Guide
Security Related Rules and Reports
Security Rules
Security Reports
Access Control Violations
Network Device Access
Multiple Admin Login Failures: Net Device: Detects excessive logon failures at a network device - 5 consecutive failures in a 10 minute period.
Repeated Admin Multiple Login Failures: Net Device: Detects repeating occurrences of multiple logon failures at a network device
Account Locked: Network Device: Detects account lockout caused by excessive logon failures
Server Access
Multiple Logon Failures: Server: Detects excessive logon failures at a server - 5 consecutive failures in a 10 minute period
Repeated Multiple Logon Failures: Server: Detects repeating occurrences of multiple logon failures at a server from the same user.
Multiple Privileged Logon Failures: Server: Detects excessive privileged logon failures at a server - 3 consecutive failures in a 10 minute period
Account Locked: Server: Detects account lockout caused by excessive logon failures
Network Access
Multiple Logon Failures: Domain: Detects multiple domain logon failures - 5 consecutive failures in a 10 minute period
Repeated Multiple Logon Failures: Domain: Detects repeating occurrences of multiple domain logon failures
Multiple Logon Failures: VPN: Detects multiple VPN logon failures - 5 consecutive failures in a 10 minute period
Repeated Multiple Logon Failures: VPN: Detects repeating occurrences of excessive VPN logon failures
Multiple Logon Failures: WLAN Detects multiple Wireless logon failures - 5 consecutive failures in a 10 minute period
Repeated Multiple Logon Failures: WLAN: Detects repeating occurrences of excessive wireless LAN logon failures
Account Locked: Domain: Detects account lockout caused by excessive logon failures
Application Access
Multiple Logon Failures: Web Server: Detects excessive application logon failures - 5 consecutive failures in a 10 minute period.
Application logsons include the one that may require authentication for accessing the authentication, such as HTTP, SNMP, FTP, POP3,
IMAP etc.
Repeated Multiple Logon Failures: Web Server: Detects repeating occurrences of multiple application logon failures
Multiple Logon Failures: Database: Detects excessive database logon failures - 5 consecutive failures in a 10 minute period.
Repeated Multiple Logon Failures: Database: Detects repeating occurrences of multiple application logon failures
Multiple Logon Failures: Misc App: Detects excessive application logon failures - 5 consecutive failures in a 10 minute period.
Application logsons include the one that may require authentication for accessing the authentication, such as HTTP, SNMP, FTP, POP3,
IMAP etc.
Repeated Multiple Logon Failures: Misc App: Detects repeating occurrences of multiple application logon failures
Special situations
Privileged Command Execution Failure: Detects excessive privileged command execution (e.g. sudo exec) failure at a server
Disabled Account Logon Attempt: Detects logon attempts to disabled accounts
Logon Time Restriction Violation: Detects logon attempts at times which are not permitted by policy
Multiple Logon Failures: Same Src, Multiple Hosts: Detects the same source having excessive logon failures at distinct hosts
Multiple Logon Failures: Same Src and Dest, Multiple Accounts: Detects same source having excessive logon failures at the same destination host but multiple distinct accounts are used during the logon failure
Suspicious Logon Failure: no following successful login: Detects an unusual condition where a source has authentication failures at
Page 1213
FortiSIEM Installation Guide FortiSIEM Installation Guide a host but that is not followed by a successful authentication at the same host within the same day
Failed VPN Logon From Outside My Country: Detects VPN logon from outside my country. My Country is set to "United States" and may need to be changed for outside United States
Concurrent Failed Authentications To Same Account From Multiple Countries: Detects simultaneous failed server/network device/domain authentications to the same system and the same account from different countries. This may indicate stolen credentials unless it is an administrative account and is supposed to be accessed by administrators from multiple countries.
Concurrent Failed Authentications To Same Account From Multiple Cities: Detects simultaneous failed server/network device/domain authentications to the same system and the same account from different cities. This may indicate stolen credentials unless it is an administrative account and is supposed to be accessed by administrators from multiple cities.
Concurrent Successful Authentications To Same Account From Multiple Countries: Detects simultaneous successful server/network device/domain authentications to the same system and the same account from different countries. This may indicate stolen credentials unless it is an administrative account and is supposed to be accessed by administrators from multiple countries.
Concurrent Successful Authentications To Same Account From Multiple Cities: Detects simultaneous successful server/network device/domain authentications to the same system and the same account from different cities. This may indicate stolen credentials unless it is an administrative account and is supposed to be accessed by administrators from multiple cities.
Concurrent VPN Authentications To Same Account From Different Cities: Detects simultaneous VPN authentications to the same account within a short period of time from different cities. This may indicate a stolen credential.
Suspicious logon attempt detected: Detects suspicious logon attempts that indicate policy violations, e.g. root logon to database servers, default passwords, attempts to bypass authentication, root logon over unencrypted protocols such as Telnet, ftp, anonymous logons etc.
Transient Account Usage: Detects that an account was created, used and then deleted within a short period of time
Multiple Accounts Disabled by Administrator: Detects that multiple (more than 3) accounts were disabled by administrator in a short period of time
Network Scanning Activity
Heavy TCP Host Scan: Detects excessive half-open TCP sessions from the same source to many distinct destinations in a short period of time. The threshold is 200 flows within 3 minutes. Scanning may be a precursor to exploits. However, network management and mapping tools often scan the network for discovery purposes and authorized scanners need to be blacklisted. P2P clients also exhibit this behavior when they attempt to establish connections to (non-existent) peers.
Heavy TCP Host Scan On Fixed Port: Detects excessive half-open TCP sessions from the same source to many distinct destinations and on the same destination port in a short period of time. The threshold is 200 flows within 3 minutes. A fixed destination port may indicate that the scanning host is attempting to find hosts on a well known port (with a vulnerability). Scanning may be a precursor to exploits. However, network management and mapping tools often scan the network for discovery purposes and authorized scanners need to be blacklisted. P2P clients also exhibit this behavior when they attempt to establish connections to (non-existent) peers.
Heavy TCP Port Scan: Single Host: Detects a host performing a port scan - this involves excessive half open TCP connections from the same source to many distinct ports on a host in a short period of time. The thresholds are at least 20 distinct ports in a 2 minute window
Heavy TCP Port Scan: Multiple Hosts: Detects that a source is doing port scans on multiple hosts. The thresholds are port scans on at least 5 hosts in 15 minute window
Heavy UDP Host Scan: Detects excessive number of UDP connections from the same source to many distinct destinations in a short period of time. The threshold is 200 flows within 3 minutes. Scanning may be a precursor to exploits. However, network management and mapping tools often scan the network for discovery purposes and authorized scanners need to be blacklisted. P2P clients also exhibit this behavior when they attempt to establish connections to (non-existent) peers.
Heavy UDP Host Scan On Fixed Port: Detects excessive number of UDP connections from the same source to many distinct destinations and on the same destination port in a short period of time. The threshold is 200 flows within 3 minutes. A fixed destination port may indicate that the scanning host is attempting to find hosts on a well known port (with a vulnerability). Scanning may be a precursor to exploits. However, network management and mapping tools often scan the network for discovery purposes and authorized scanners need to be blacklisted. P2P clients also exhibit this behavior when they attempt to establish connections to (non-existent) peers.
Heavy UDP Port Scan: Single Host: Detects excessive UDP connections from the same source to many distinct ports on the same destination in a short period of time
Heavy UDP Port Scan: Multiple Hosts: Detects that a source is doing UDP port scans on multiple hosts. The thresholds are port scans on at least 5 hosts in 15 minute window
Heavy ICMP Ping sweep: Detects excessive number of ICMP echo request packets from the same source to many distinct destinations in a short period of time. Nachhi worm exploited pings to spread. The threshold is 50 pings within 3 minutes. Scanning may be a precursor to exploits. However, network management and mapping tools often scan the network for discovery purposes and authorized scanners need to be blacklisted.
Excessive ICMP Unreachables: Detects an usually high frequency of ICMP destination unreachable packets between the same source and destination - this indicates routing error
TCP DDOS Attack: Detects excessive number of half-open TCP connections from many distinct sources to the same destination host and on the same port in a short period of time. This may indicate that the destination server is under some sort of attack.
Excessive Denied Connections From Same Src: Detects excessive denies from the same source to many distinct destinations on the same port in a short period of time. The intent could be malicious or some sort of misconfiguration.
Excessive Denied Connections To Same Destination: Detects excessive denies from many distinct sources to the same destination on the same destination port
Multiple IPS Scans From Same Src: Detects multiple IPS scans from the same source IP in a short period of time.
Invalid TCP/UDP Port Traffic: Detects invalid TCP/UDP traffic with 0 port
Invalid TCP Flags - Medium Intensity: Detects moderate (e.g. 100 or more flows in 5 minutes) amount of traffic with invalid TCP flag combinations (NULL,FIN, SYN-FIN, SYN-FIN-PUSH, SYN-FIN-RESET, SYN-FIN-RESET-PUSH,SYN-FIN-RESET-PUSH-ACK-URG) -
Page 1214
FortiSIEM Installation Guide FortiSIEM Installation Guide may indcate scanning and probing activity from the sender
Invalid TCP Flags - High Intensity: Detects excessive (e.g. 500 or more flows in 5 minutes) amount of traffic with invalid TCP flag combinations (FIN, SYN-FIN, SYN-FIN-PUSH, SYN-FIN-RESET, SYN-FIN-RESET-PUSH,SYN-FIN-RESET-PUSH-ACK-URG) - may indicate scanning and probing activity from the sender
Excessive ICMP Traffic From Same Source: Detects excessive (e.g. more than 5000 in 5 minutes) ICMP traffic from the same source
Malware
Source: Antivirus, Security gateway, Host IPS, Network IPS, Firewall Log
Virus outbreak: Detects potential virus outbreak - same virus found on three distinct computers/IP addresses
Virus found but not remediated: Detects that host anti-virus or content inspection devices found a virus but could not remediate it
Spyware found but not remediated: Detects that host anti-virus or content inspection devices found a spyware but could not remediate it
Spam/Malicious Mail Attachment found but not remediated:
Scanner found severe vulnerability:
Rootkit found:
Phishing attack found but not remediated:
Malware found but not remediated:
Denied Blacklisted Source:
Denied Blacklisted Destination:
Multiple Distinct IPS Events From Same Src:
Permitted Blacklisted Source:
Permitted Blacklisted Destination:
Source: External threat intelligence
Traffic to Zeus Blocked IP List:
Traffic to Emerging Threat Spamhaus List:
Traffic to Emerging Threat Shadow server List:
Traffic to Emerging Threat RBN List:
Traffic to Emerging Threat Dshield List:
Permitted traffic from Emerging Threat Spamhaus List:
Permitted Traffic from Zeus Blocked IP List:
Permitted Traffic from Emerging Threat Shadow server List:
Permitted Traffic from Emerging Threat RBN List:
Permitted Traffic from Emerging Threat Dshield List:
DNS Traffic to Malware Domains:
Adware process found:
Traffic to bogon networks:
Source: Network Traffic Analysis
Excessive End User Mail: Detects a scenario where a host, that is itself not an authorized mail gateway, is sending excessive emails
(more than 20 emails in 2 minutes). This behavior may indicate malware running on an end host that is trying to send spam or privileged information to its own set of mail servers (which may be compromised).
Excessive Denied End User Mail To Unauthorized Mail Gateways: Detects a scenario where a host, that is itself not an authorized mail gateway, is unsuccessfully trying to send excessive emails to unauthorized mail gateways. Authorized mail gateways are represented by the "Mail Gateway" group. Such requests would be typically denied because, either the firewall would block SMTP from end hosts and/or mail gateways only receive mail from other authorized mail gateways. This behavior may indicate malware running on an end host that is trying to send spam or privileged information to its own set of mail servers (which may be compromised).
End User DNS Queries to Unauthorized DNS Servers: Detects a scenario where a host, that is itself not a DNS server, is trying to send DNS requests to unauthorized DNS servers. Authorized DNS servers are represented by the "DNS Server" group. In a typical scenario, end hosts always send DNS requests to authorized DNS servers which in turn communicate to other DNS servers - so this behavior may indicate malware running on the end host.
Excessive End User DNS Queries: Detects a scenario where a host, that is itself not an DNS server, is sending excessive DNS requests. Authorized DNS servers are represented by the "DNS Server" group. In a typical scenario, the frequency of end host DNS requests is not high unless, there is a script running - this might indicate the presence of malware on the end host.
Excessive Denied DNS Queries: Detects a scenario where a host, has a very high frequency of denied DNS traffic.
Excessive Uncommon DNS Queries: Detects the same host that is not a DNS server, doing an excessive amount of uncommon domain name queries - this indicates the host is likely infected with malware. An end host typically needs to perform only A and PTR queries; any other query inidicates the likely presence of malware.
Excessive Repeated DNS Queries To Same Domain: Detects an usually high frequency of DNS name resolution queries from the same host to the same domain name in a short period of time. This is not expected behavior since, in a typical scenario, the domain name resolution is cached at the end point. Repeated queries indicates that a special DNS client is likely running at the end host that is trying to make use of fast flux techniques to get back many infected hosts behind a crafted domain name.
Excessive Malware Domain Name Queries: Detects bad domain name queries which indicate malware infected end hosts.
Page 1215
FortiSIEM Installation Guide FortiSIEM Installation Guide
Suspicious Botnet like End host DNS Behavior: Detects an end host meeting at least 3 requirements for suspicious use of DNS requests - this indicates that a bot is likely running on the end host
Unusually Large ICMP Echo Packets: Detects large (> 200 bytes/pkt) ICMP echo request and response packets - this is unusual since
ICMP packets carry minimal information and are small in size. THis may indicate that some other traffic is being carried over ICMP protocol.
Unusual ICMP Traffic:
Explicit Security Issues
SQL Injection Attack detected by NIPS:
High Severity Non-Cisco IPS Exploit:
High Severity Inbound Permitted IPS Exploit:
High Severity Inbound Denied Security Exploit:
High Risk Rating Cisco IPS Exploit:
Excessive WLAN Exploits: Same Source:
Excessive WLAN Exploits:
DoS Attack detected by NIPS:
Distributed DoS Attack detected by NIPS:
Layer 2 Switch Port Security Violation:
Policy violations
Firewall Perimeter Policy
Outbound cleartext password usage detected:
Inbound cleartext password usage detected:
VNC from Internet:
Remote Desktop from Internet:
Large Outbound Transfer:
Large Outbound Transfer To Outside My Country:
Large Inbound Transfer From Outside My Country:
External website access policy
Inappropriate Website access: Multiple categories:
Inappropriate Website access: High volume:
Inappropriate Website access:
Internal website access policy
Executable file posting from external source:
Excessive HTTP Client Side Errors:
Excessive FTP Client Side Errors:
Change control policy
Windows Audit Log Cleared:
Windows Audit Disabled:
WLAN policy
Rogue or Unsecure AP Detected:
Excessive Rogue or Unsecure APs Detected:
Wireless Host Blacklisted:
VPN policy
Long lasting VPN session:
High throughput VPN session:
Suspicious Traffic
Tunneled traffic detected:
IRC traffic detected:
Page 1216
FortiSIEM Installation Guide
P2P traffic consuming high network bandwidth:
FortiSIEM Installation Guide
Access Control Reports
Network Device Access
Failed Router Admin Logons: Details about failed router administrative logons
Successful Router Admin Logons: Details about successful router administrative logons
Failed Firewall Admin Logons: Details about failed firewall administrative logons
Successful Firewall Admin Logons: Details about successful firewall administrative logons
Failed VPN Admin Logon: Provides event details for all failed VPN admin logons
Successful VPN Admin Logon: Provides event details for all successful VPN admin logons
Successful WLAN Admin Logon: Tracks successful admin logons to the WLAN Controller
Failed WLAN Admin Logon: Tracks failed admin logons to the WLAN Controller
Network Access
Top Users Ranked By Successful VPN Logon: Ranks the VPN Gateways and their users by the number of successful VPN logons.
Top VPN Gateways Ranked By Distinct Users: Ranks the VPN Gateways by the total number of distinct user logons
Top VPN Users Ranked By Failed VPN Logons: Ranks the VPN Gateways and their users by the number of failed VPN logons.
Wireless Logon Failure Details: Provides details of wireless logon authentication failures
Top Wireless Controllers, Users By Failed Logon Count: Ranks wireless controllers by the total number of failed logons
Top Windows Domain Controllers, Users By Successful Domain Authentication Count: Ranks the Windows Domain Controllers and their users by the number of successful domain authentications
Top Windows Domain Controllers, Users By Failed Domain Authentication Count: Ranks the Windows Domain Controllers and the users by the number of failed authentications
Windows Domain Account Lockouts: Details windows domain account lockouts
Remote Desktop Connections to Domain Controller: Details successful remote desktop connections
Privileged Domain Controller Logon Attempts using the Administrator Account: Ranks the windows servers and their users by the number of failed logons using the administrator account
Failed Authentication Server Logons: Captures failed AAA Server Logons
Successful Authentication Server Logons: Captures successful AAA Server Logons
Server Access
Top Unix Servers, Users By Successful Logon Count: This report ranks the UNIX servers and their users by successful logon count
Top Unix Servers, Users By Failed Logon Count: This report ranks the UNIX servers and their users by failed logon count
Top Unix Servers, Users By Successful Privilege Escalation Count: This report ranks the UNIX servers and their users by successful privilege escalations (su) count
Top Unix Servers, Users By Failed Privilege Escalation Count: This report ranks the UNIX servers and their users by failed privilege escalations (su) count
Top Windows Servers, Users By Successful Logon Count: Ranks the Windows Servers and their users by the number of successful logons
Top Windows Servers, Users By Failed Logon Count: Ranks the Windows Servers and the users by the number of failed authentications
Windows Server Account Lockouts: Details windows server lockouts
Windows Server Account Unlocks: Captures account unlocks on windows servers. Account unlocks happen after lockouts that may happen on repeated login failures
Remote Desktop Connections to Windows Servers: Details successful remote desktop connections
Privileged Server Logon Attempts using the Administrator Account: Ranks the windows servers and their users by the number of failed logons using the administrator account
Application Access
Top FTP Clients By Unauthorized Access Error Count: Ranks FTP servers and their clients by the total number of unauthorized access error count
Top Web Visitors By Unauthorized Access Error Count: Ranks web servers and visitors by the total number of unauthorized access error count
Top Users By Successful Database Server Logons: Ranks database users by the number of successful logons
Top Users By Failed Database Server Logons: Ranks database users by the number of failed logons
Malware Reports
Page 1217
FortiSIEM Installation Guide FortiSIEM Installation Guide
Virus found and remediated Captures events that indicate the viruses found and remediated - the events could be from Host Anti-virus or Network Security Gateways
Virus found but not remediated Captures events that indicate viruses found but failed to remedy - the events could be from Host
Anti-virus or Network Security Gateways
Spyware found and remediated Captures events that indicate spyware was found and remediated on a host - the events could be from
Host Anti-virus or Network Security Gateways
Spyware found but not remediated Captures events that indicate spyware was found but the detecting software failed to remediated the vulnerability - the events could be from Host Anti-virus or Network Security Gateways
Spam/Malicious Mail Attachment found and remediated Captures events that indicate spam or mailicious mail attachments were found and remediated on a host - the events could be from Host Anti-virus or Network Security Gateways
Spam/Malicious Mail Attachment found but not remediated Captures events that indicate spyware was found but the detecting software did not remediated the vulnerability
Phishing attempt found and remediated Captures events that indicate phishing attempt
Top IPs with Malware Found By Antivirus and Security Gateways: Tracks IP addresses with Malware as found by Host Anti-virus and Security Gateways
Top Computers with Malware Found By Antivirus and Security Gateways: Tracks computers with Malware as found by Host
Anti-virus and Security Gateways
Top IPs with Malware Found By IPS and Firewalls: Tracks IP addresses with Malware as found by IPS - these are somewhat less reliable than Host Anti-virus and Security Gateways
Top IPs with Malware Found By Security Gateways: Tracks IP addresses with Malware as found by Security Gateways
Non-compliant Hosts and Security Software License Expirations: Tracks non-compliant hosts and license expiry events from
Security Management Gateways and Firewalls. Non-compliant hosts may not have proper security software running and therefore may pose a security threat. License expiration of security software may expose exploitable security vulnerabilities.
Host Vulnerabilities discovered: Tracks vulnerabilities discovered on a host
Other Security Issues
Top Network IPS events By Severity, Count: Ranks the network IPS events by count
Top Network Scanners By Event Count: Ranks the source IP addresses by detected network scan or reconnaissance events
Top Blocked Network Attacks By Count: Ranks the network attacks attacks blocked by network IPS
Rogue APs detected: Lists the rogue APs
Rogue AP Detection Details: Provides details of rogue AP events
Top WLAN IDS Alerts: Ranks WLAN IDS alerts
Multiple Distinct IPS Events From Same Src: Detects multiple IPS events from the same source IP in a short period of time - the source IP may have been infected
Multiple IPS Scans From Same Src: Detects multiple IPS scans from the same source IP in a short period of time.
High Risk Rating Cisco IPS Exploit: Detects a high risk rating IPS exploit event. This is applicable for Cisco IPS.
High Severity IPS Exploit: Detects a high severity IPS exploit detected by non-Cisco IPS
High Severity Security Exploit: Detects a high severity security exploit detected by non IPS devices
Network Traffic Analysis
Top Conversations By Bytes: Ranks the top conversations by total bytes. A conversation includes Source IP, Destination IP, Protocol and Destination Port.
Top Conversations By Bytes: Detailed View Ranks the top conversations by total bytes but also provides, sent Bytes and received
Bytes as additional information. A conversation includes Source IP, Destination IP, Protocol and Destination Port.
Top Source IPs By Bytes Ranks the top source IPs by bytes
Top Source IPs By Bytes: Detailed View Ranks the top source IPs and destination ports by bytes
Top Destination IPs By Bytes Ranks the top destination IPs by bytes
Top Destination IPs By Bytes: Detailed View Ranks the top destination IPs and ports by bytes
Top Protocols By Bytes: Ranks the top protocols and destination ports by bytes
Top Protocols By Bytes: Detailed View: Ranks the top protocol and destination ports by bytes
Top Router Link Usage By Bytes Ranks the top router link usage by bytes
Page 1218
FortiSIEM Installation Guide FortiSIEM Installation Guide
Availability Related Rules and Reports
AccelOps Availability Rules
System component issues
System Collector Down: Detects that collector is down
System Collector Event Delayed: Detects that collector has not sent an event to AccelOps cloud for more than 10 minutes
System Worker Down: Detects that system worker is down
License Issues
System License Warning: High Event Rate: Detects that the system is receiving events at a rate that is higher than the license limit.
Events beyond the license limit would be dropped unless the license is upgraded
System License Warning: High Config Items: Detects that the number of CMDB configuration items is close to the license limit additonal configuration items would not be stored unless the license is upgraded.
Notification issues
Scheduled Report Send Error: Detects that system has failed to deliver a scheduled report
Incident Notification Error: Detects that system has failed to take notification action on an incident
Large Supervisor JMS Request Queue: Detects that Supervisor JMS Request queue is very large
Large Supervisor JMS System Queue: Detects that Supervisor JMS System queue is very large
Data collection errors
WMI Service Unavailable: Detects that WMI service is unavailable
SNMP Service Unavailable: Detects that SNMP service is unavailable
Performance Monitoring Error: Detects that the system failed to monitor a performance monitoring metric
No Events Reported In Last Hour: Detects that a reporting device that reported events (logs etc) in the last hour did not report any events this hour. This does not include monitoring events (like CPU, Memory etc). This indicates that there is a problem in the network or at the reporting device.
Large Worker Input Event Queue: Detects that Worker input event queue is very large (greater than 100MB). This indicates that the workers are falling behind in handling events and cannot keep pace with the rate at which workers are sending events. Consider ading more workers or adding resources to workers.
Large Worker Input SVN Queue: Detects that Worker input SVN queue is very large (greater than 100MB). This indicates that the workers are falling behind in handling SVN files from collectors or from the parser modules. Check the SVN installation.
Event Storage/Archiving/Purging issues
AccelOps Availability Reports
Network Availability Rules
Network Availability Reports
Server Availability Rules
Server Availability Reports
Page 1219
FortiSIEM Installation Guide
Virtualization Availability Rules
Virtualization Availability Reports
Storage Availability Rules
Storage Availability Reports
Application Availability Rules
Application Availability Reports
FortiSIEM Installation Guide
Page 1220
FortiSIEM Installation Guide FortiSIEM Installation Guide
Integration API
AccelOps provides an API that you can use to query and make changes to the CMDB, query events, and send notifications. These topics contain information on API parameters, sample XML input and output files, and python scripts that you can use to interact with the API.
Python Support
Versions 2.5, 2.6
Version 2.4 is only supported when import ssl
is changed to from socket import ssl
Version 3.0 cannot be supported unless all print statements are rewritten
You will need to install httplib2 and ssl manually, if they are not already installed
Topics
Get the List of Monitored Devices and Attributes
Get the List of Monitored Organizations
Add, Update or Delete Device Maintenance Schedule
Formats for Incident Notifications over Email, HTTPS, SNMP Trap, and API
External Help desk / CMDB Integration
External Threat Intelligence Integration
Page 1221
FortiSIEM Installation Guide
CMDB APIs
These APIs are available for interacting with the AccelOps CMDB.
Get the List of Monitored Devices and Attributes
Get the List of Monitored Organizations
Add, Update or Delete Device Maintenance Schedule
FortiSIEM Installation Guide
Page 1222
FortiSIEM Installation Guide FortiSIEM Installation Guide
Add or Update an Organization
Sample Code for Adding an Organization
Sample Code for Updating an Organization's Attributes
Applies To
Multi-tenant deployments
API Parameters
Methodology REST API based: makes an HTTP(S) request with an input XML containing the organization information. The key to the organization information is the name.
Request
URL
Add an organization: https://<AccelOps_IP>/phoenix/rest/organization/add
Update an organization: https://<AccelOps_IP>/phoenix/rest/organization/update
Input
Parameters
Input XML
Username and password of Super account or Organization specific account, Organization definition file
Output
Contains organization details - the key is the organization name, which means that entries with the same name will be merged.
None
Sample Code for Adding an Organization
The sample shows how to add the organization organization341
and specify its attributes.
Sample XML Input File
Page 1223
FortiSIEM Installation Guide FortiSIEM Installation Guide
<organizations>
<organization>
<name>organization341</name>
<fullName>Test organization 341</fullName>
<description>organization341 account</description>
<adminUser>organization341</adminUser>
<adminPwd>organization*341</adminPwd>
<adminEmail>[email protected]</adminEmail>
<includeRange>172.16.40.1-172.16.40.100</includeRange>
<excludeRange>172.16.40.10,172.16.40.20</excludeRange>
<custResource>
<diskQuote>536870912000</diskQuote>
<eps>1000</eps>
<configItem>550</configItem>
<duration>365</duration>
</custResource>
<collectors>
<collector>
<eps>100</eps>
<name>coll341-1</name>
<registered>false</registered>
<startTime>1303455600</startTime>
<endTime>1304060400</endTime>
</collector>
<collector>
<eps>200</eps>
<name>coll341-2</name>
<registered>false</registered>
</collector>
</collectors>
</organization>
</organizations>
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
AddOrg.py script Usage
Page 1224
FortiSIEM Installation Guide import sys, base64, urllib, urllib2 from xml.dom.minidom import Node, Document, parseString def restPost(appServer, user, password, file):
f = open(file, 'r')
content = f.read()
f.close()
url = "https://" + appServer +
"/phoenix/rest/organization/add"
auth = "Basic %s" % base64.encodestring(user + ":" + password)
request = urllib2.Request(url, content)
request.add_header('Authorization', auth)
request.add_header('Content-Type',
'text/xml') # 'application/xml'
request.add_header('Content-Length', len(content)+2)
request.add_header('User-Agent',
'Python-urllib2/2.7')
request.get_method = lambda: 'PUT'
try:
handle = urllib2.urlopen(request)
except urllib2.HTTPError, error:
if (error.code != 204):
print error if __name__=='__main__':
if len(sys.argv) != 5:
print "Usage: addOrgSample.py
appServer user password orgDefFile"
print "Example: python addOrgSample.py 192.168.20.116 super/admin adm1n orgDef.xml"
sys.exit()
restPost(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
FortiSIEM Installation Guide python addOrg.py <AccelOps_IP>
<user> <password> <orgDefFile>
Sample Code for Updating an Organization's Attributes
Th sample increases the max events per sec ( eps
) value of organization341
to
1000
. The Key is the name.
Sample XML Input File
Page 1225
FortiSIEM Installation Guide FortiSIEM Installation Guide
<organizations>
<organization>
<name>organization341</name>
<fullName>Test organization 341</fullName>
<description>organization341 account</description>
<adminUser>organization341</adminUser>
<adminPwd>organization*341</adminPwd>
<adminEmail>[email protected]</adminEmail>
<includeRange>172.16.40.1-172.16.40.100</includeRange>
<excludeRange>172.16.40.10,172.16.40.20</excludeRange>
<custResource>
<diskQuote>536870912000</diskQuote>
<eps>1000</eps>
<configItem>1000</configItem>
<duration>365</duration>
</custResource>
<collectors>
<collector>
<eps>100</eps>
<name>coll341-1</name>
<registered>false</registered>
<startTime>1303455600</startTime>
<endTime>1304060400</endTime>
</collector>
<collector>
<eps>200</eps>
<name>coll341-2</name>
<registered>false</registered>
</collector>
</collectors>
</organization>
</organizations>
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
AddOrg.py script Usage
Page 1226
FortiSIEM Installation Guide import sys, base64, urllib, urllib2 from xml.dom.minidom import Node, Document, parseString def restPost(appServer, user, password, file):
f = open(file, 'r')
content = f.read()
f.close()
url = "https://" + appServer +
"/phoenix/rest/organization/update"
auth = "Basic %s" % base64.encodestring(user + ":" + password)
request = urllib2.Request(url, content)
request.add_header('Authorization', auth)
request.add_header('Content-Type',
'text/xml') # 'application/xml'
request.add_header('Content-Length', len(content)+2)
request.add_header('User-Agent',
'Python-urllib2/2.7')
request.get_method = lambda: 'PUT'
try:
handle = urllib2.urlopen(request)
except urllib2.HTTPError, error:
if (error.code != 204):
print error if __name__=='__main__':
if len(sys.argv) != 5:
print "Usage: addOrgSample.py
appServer user password orgDefFile"
print "Example: python addOrgSample.py 192.168.20.116 super/admin adm1n orgDef.xml"
sys.exit()
restPost(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
FortiSIEM Installation Guide python updateOrg.py <AccelOps_IP>
<user> <password> <orgDefFile
>
Page 1227
FortiSIEM Installation Guide FortiSIEM Installation Guide
Create or Update Credentials
Sample Code for Adding and Updating Credentials
Applies To
Enterprise and multi-tenant deployments
API Parameters
The key is the credential name in the input XML. If a credential with the same name exists, then the credential in the database will be updated with the new content.
Multi-Tenant Deployments
Methodology
Request URL
REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned.
https://<AccelOps_IP>/phoenix/rest/deviceMon/updateCredential
Input Parameters Username and password of Super account or Organization specific account, Organization name
Input XML
An XML file that contains credentials and IP to credential mappings
Output
None
Enterprise Deployments
Methodology
Input XML
Output
REST API based: make an HTTP(S) request with an input XML
Request URL
https://<AccelOps_IP>/phoenix/rest/deviceMon/updateCredential
Input Parameters Username and password of any AccelOps account
An XML file that contains credentials and IP to credential mappings
None
Sample Code for Adding and Updating Credentials
This sample takes the credentials and, optionally, the organization name as arguments and writes out the parsed XML output file in a comma separated value (CSV) format on the screen. The output can be redirected to a file if needed.
Sample XML Input File
Page 1228
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
UpdateCredentiual.py Script Usage
Page 1229
FortiSIEM Installation Guide import sys, base64, urllib, urllib2 def restPost(appServer, user, password, file):
f = open(file,'r')
content = f.read()
f.close()
url = "https://" + appServer +
"/phoenix/rest/deviceMon/updateCredential"
auth = "Basic %s" % base64.encodestring(user
+ ":" + password)
request = urllib2.Request(url, content)
request.add_header('Authorization', auth)
request.add_header('Content-Type','text/xml')
# 'application/xml'
request.add_header('Content-Length', len(content)+2)
request.add_header('User-Agent',
'Python-urllib2/2.7')
request.get_method = lambda: 'PUT'
try:
handle = urllib2.urlopen(request)
except urllib2.HTTPError, error:
if (error.code != 204):
print error
if __name__=='__main__':
if len(sys.argv) != 5:
print "Usage: UpdateCredential.py
appServer user password credentialDefFile"
print "Example: python
UpdateCredential.py 192.168.20.116 super/admin adm1n credentialDef.xml"
sys.exit()
restPost(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
FortiSIEM Installation Guide python UpdateCredential.py
<AccelOps_IP> <user>
<password> <credential xml file>
Example
python UpdateCredential.py
172.16.20.210 "super/admin"
"admin*1" AddCredential.xml
The Super_user needs to be explicitly stated in organization/user format, for example
"super/admin"
or
"super/ admin"
instead of just
"admin"
Page 1230
FortiSIEM Installation Guide FortiSIEM Installation Guide
Discover Devices
Sample Code for Discovery Request
Sample Output XML for Discovery Results
Sample Output Text for Discovery Results
Applies To
Enterprise and multitenant deployments
API Parameters
Multitenant Deployments
Methodology REST API based: make an HTTP(S) request with an input XML containing the devices to be discovered. An output XML containing the task Id is returned. The task Id can then be used to get the status of the discovery results
Request
URL
Discovery request:
Discovery result: https://<AccelOps_IP>/phoenix/rest/deviceMon/discover https://<AccelOps_IP>/phoenix/rest/deviceMon/discover/status?taskId=1234
Input
Parameters
Output
Username and password of Super account or Organization specific account, Organization name
Discovery request: XML containing task Id
Discovery result: XML containing discovered devices and attributes
Enterprise Deployments
Methodology REST API based: make an HTTP(S) request with an input XML containing the devices to be discovered. An output XML containing the task Id is returned. The task Id can then be used to get the status of the discovery results
Request
URL
Discovery request:
Discovery result: https://<AccelOps_IP>/phoenix/rest/deviceMon/discover https://<AccelOps_IP>/phoenix/rest/deviceMon/discover/status?taskId=1234
Input
Parameters
Output
Username and password of any AccelOps account
Discovery request: XML containing task Id
Discovery result: XML containing discovered devices and attributes
Sample Code for Discovery Request
This sample takes the credentials and, optionally, organization name as arguments and writes out the parsed XML output file in a comma separated value (CSV) format on the screen. The output can be redirected to a file if needed.
Sample Input XML File
Page 1231
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
Discover.py Script Usage
Page 1232
FortiSIEM Installation Guide import sys, base64, urllib, urllib2 def restPost(appServer, user, password, file):
f = open(file, 'r')
content = f.read()
f.close()
url = "https://" + appServer +
"/phoenix/rest/deviceMon/discover"
auth = "Basic %s" % base64.encodestring(user + ":" + password)
request = urllib2.Request(url, content)
request.add_header('Authorization', auth)
request.add_header('Content-Type',
'text/xml') # 'application/xml'
request.add_header('Content-Length', len(content))
request.add_header('User-Agent',
'Python-urllib2/2.4')
request.get_method = lambda: 'PUT'
try:
handle = urllib2.urlopen(request)
except urllib2.HTTPError, error:
if (error.code != 204):
print error if __name__=='__main__':
if len(sys.argv) != 5:
print "Usage: discoverDevice.py
appServer user password deviceDefFile"
print "Example: python discoverDevice.py 192.168.20.116
super/admin adm1n deviceDef.xml"
sys.exit()
restPost(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
FortiSIEM Installation Guide python Discover.py <AccelOps_IP> <user>
<password> <device xml file name>
Example
python Discover.py 172.16.20.210
"super/admin" "admin*1" DiscoverDevice.
xml
The Super_user needs to be explicitly stated in organization/user format, for example,
"super/adm in" or
"super/admin"
instead of just
"admin"
.
Sample Output XML for Discovery Results
Page 1233
FortiSIEM Installation Guide
Sample Output Text for Discovery Results
FortiSIEM Installation Guide
Page 1234
FortiSIEM Installation Guide FortiSIEM Installation Guide
Get CMDB Device Info
API Parameters for Enterprise Deployments
Get Short Description of All Devices
Get Short Description of All Devices in an Address Range
Get Full Information About One Device
Get a Section of Information (Applications, Interfaces, Processors, Storage) About One Device
API Parameters for Multitenant Deployments
Get Short Description of All Devices for an Organization
Get Short Description of All Devices in an Address Range for an Organization
Get Full Information About One Device Belonging to an Organization
Applies To
Enteprise and multitenant deployments.
API Parameters for Enterprise Deployments
Get Short Description of All Devices
Methodology
Input URL
REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned.
https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/devices
Input Credentials Username and password of any AccelOps account
Output
An XML that contains a short set of attributes for each device, including:
Host Name
Access IP
Creation Method
Description
Vendor, Model, version
Contact info
Location
Uptime
Hardware Model
Serial Number
Business Service Groups to which the device belongs
Sample XML Output
AllDevicesShortInfo.xml
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
Page 1235
FortiSIEM Installation Guide FortiSIEM Installation Guide
getCMDBinfo.py Script
import base64 import urllib2 from xml.dom.minidom import Node,
Document, parseString def GetCMDBInfo(appServer, user, password):
encodePassword = base64.encodestring(user + ":" + password)
auth = "Basic %s" % encodePassword
restURL = "https://" + appServer +
"/phoenix/rest/cmdbDeviceInfo/devices"
req = urllib2.Request(restURL, None,
{"Authorization": auth })
handle = urllib2.urlopen(req)
outXML = handle.read()
print outXML if __name__=='__main__':
import sys
if len(sys.argv)!=4:
print "Usage: GetCMDBInfo.py
appServer user password"
exit()
param=GetCMDBInfo(sys.argv[1], sys.argv[2], sys.argv[3])
Usage
python getCMDBInfo.py
<AccelOpsSuperIp> super/<user>
<password>
Get Short Description of All Devices in an Address Range
Methodology REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned.
Input URL
https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/devices?includeIps=<includeIpSet>&excludeIps=<excludeIpSet
>
Username and password of any AccelOps account
Input
Credentials
Output
An XML that contains short description of devices with access IPs in the specified address range
Formatting for the <IncludeIPset> and <ExcludeIPset> Attributes
Both < includeIpSet>
and < excludeIpSet>
can take any of these forms:
IPaddress
IPaddress1,IPaddress2
IPaddress1-IPaddress2
IPaddress1,IPaddress2-IPaddress3,IPaddress4,IPaddress5-IPaddress6
Examples
Page 1236
FortiSIEM Installation Guide FortiSIEM Installation Guide
If you want all devices in the range
192.168.20.1-192.168.20.100
, then issue the API https://<AccelOps_IP>/pho enix/rest/cmdbDeviceInfo/devices?includeIps=192.168.20.1-192.168.20.100
If you want all devices in the range
192.168.20.1-192.168.20.100,
but want to exclude
192.168.20.25,
then issue the API
192.168.20.20, https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/devices?include
Ips=192.168.20.1-192.168.20.100&excludeIps=192.168.20.20,192.168.20.25
If you want all devices in the range 1
92.168.20.1-192.168.20.100,
but want to exclude
192.168.20.20-192.168.20
.25
, then issue the API https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/devices?includeIps=192.16
8.20.1-192.168.20.100&excludeIps=192.168.20.20-192.168.20.25
Sample XML Output
Query: https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/devices?includeIps=192.168.20.1-192.168.20.40
Output
: AllDeviceInRangeShortDescription.xml
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
getCMDBinfo.py Script
import base64 import urllib2 from xml.dom.minidom import Node, Document, parseString def GetCMDBInfo(appServer, user, password):
encodePassword = base64.encodestring(user + ":" + password)
auth = "Basic %s" % encodePassword
restURL = "https://" + appServer +
"/phoenix/rest/cmdbDeviceInfo/devices?includeIps=192.168.20.1-192.168.20.40"
req = urllib2.Request(restURL, None, {"Authorization": auth })
handle = urllib2.urlopen(req)
outXML = handle.read()
print outXML if __name__=='__main__':
import sys
if len(sys.argv)!=4:
print "Usage: GetCMDBInfo.py appServer user password"
exit()
param=GetCMDBInfo(sys.argv[1], sys.argv[2], sys.argv[3])
Get Full Information About One Device
Methodology
Input URL
REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned.
https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/device?ip=<deviceIp>&loadDepend=true
Page 1237
FortiSIEM Installation Guide FortiSIEM Installation Guide
Input Credentials Username and password of any AccelOps account
Output
An XML that contains full information AccelOps has discovered about a device
Sample XML Output
Query: https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/device?ip=192.168.1.12&loadDepend=true
Output
: oneWindowsServerFullInfo.xml
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
getCMDBinfo.py Script
import base64 import urllib2 from xml.dom.minidom import Node, Document, parseString def GetCMDBInfo(appServer, user, password):
encodePassword = base64.encodestring(user + ":" + password)
auth = "Basic %s" % encodePassword
restURL = "https://" + appServer +
"/phoenix/rest/cmdbDeviceInfo/device?ip=192.168.1.12&loadDepend=true"
req = urllib2.Request(restURL, None, {"Authorization": auth })
handle = urllib2.urlopen(req)
outXML = handle.read()
print outXML if __name__=='__main__':
import sys
if len(sys.argv)!=4:
print "Usage: GetCMDBInfo.py appServer user password"
exit()
param=GetCMDBInfo(sys.argv[1], sys.argv[2], sys.argv[3])
Usage
python getCMDBInfo.py
<AccelOpsSuperIp> super/<user>
<password>
Get a Section of Information (Applications, Interfaces, Processors, Storage) About One
Device
Methodology REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned.
Input URL
https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/device?ip=<deviceIp>&loadDepend=true&fields=<sectionName>
Username and password of any AccelOps account
Input
Credentials
Output
An XML that contains the specified section discovered for the device
Page 1238
FortiSIEM Installation Guide FortiSIEM Installation Guide
Options for <sectionName>
applications interfaces processors storages
Sample XML Output
Query: https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/device?ip=192.168.1.12&fields=interfaces&loadDepend
=true
Output
: oneWindowsServerInterfaces.xml
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
getCMDBinfo.py Script
import base64 import urllib2 from xml.dom.minidom import Node, Document, parseString def GetCMDBInfo(appServer, user, password):
encodePassword = base64.encodestring(user + ":" + password)
auth = "Basic %s" % encodePassword
restURL = "https://" + appServer +
"/phoenix/rest/cmdbDeviceInfo/device?ip=192.168.1.12&fields=interfaces&loadDepend=true"
req = urllib2.Request(restURL, None, {"Authorization": auth })
handle = urllib2.urlopen(req)
outXML = handle.read()
print outXML if __name__=='__main__':
import sys
if len(sys.argv)!=4:
print "Usage: GetCMDBInfo.py appServer user password"
exit()
param=GetCMDBInfo(sys.argv[1], sys.argv[2], sys.argv[3])
API Parameters for Multitenant Deployments
The device information APIs for multitenant deployments are essentially the same as the ones you would use for enterprise deployments, except you must specify an organization for the input URL and credentials. In the API samples in this section,
ACME
is used as the name of an example organization.
Page 1239
FortiSIEM Installation Guide FortiSIEM Installation Guide
Get Short Description of All Devices for an Organization
Methodology
REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned.
Input URL
https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/devices&organization=ACME
Input Credentials Username and password of any AccelOps account for the Acme organization
Output
An XML that contains a short set of attributes for each device, including:
Host Name
Access IP
Creation Method
Description
Vendor, Model, version
Contact info
Location
Uptime
Hardware Model
Serial Number
Business Service Groups to which the device belongs
Sample XML Output
AllDevicesShortInfo.xml
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
getCMDBinfoSP.py Script Usage
Page 1240
FortiSIEM Installation Guide import base64 import urllib2 from xml.dom.minidom import Node, Document, parseString def GetCMDBInfo(appServer, user, password):
encodePassword = base64.encodestring(user + ":" + password)
auth = "Basic %s" % encodePassword
org = user.split('/')[0]
restURL = "https://" + appServer +
"/phoenix/rest/cmdbDeviceInfo/devices?organization="
+ org
req = urllib2.Request(restURL, None,
{"Authorization": auth })
handle = urllib2.urlopen(req)
outXML = handle.read()
print outXML if __name__=='__main__':
import sys
if len(sys.argv)!=4:
print "Usage: GetCMDBInfo.py appServer user password"
exit()
param=GetCMDBInfo(sys.argv[1], sys.argv[2], sys.argv[3])
FortiSIEM Installation Guide python getCMDBInfoSP.py
<AccelOpsSuperIp>
ACME/<user> <password>
Get Short Description of All Devices in an Address Range for an Organization
Methodology REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned.
Input URL
https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/devices?includeIps=<includeIpSet>&excludeIps=<excludeIpSet>&organization=ACM
E
Input
Credentials
Output
Username and password of any AccelOps account in the Acme organization
An XML that contains a short description of devices with access IPs in the specified address range for the Acme organization
Formatting for the <IncludeIPset> and <ExcludeIPset> Attributes
Both < includeIpSet>
and < excludeIpSet>
can take any of these forms:
IPaddress
IPaddress1,IPaddress2
IPaddress1-IPaddress2
IPaddress1,IPaddress2-IPaddress3,IPaddress4,IPaddress5-IPaddress6
Examples
If you want all devices in the range
192.168.20.1-192.168.20.100
, then issue the API https://<AccelOps_IP>/pho enix/rest/cmdbDeviceInfo/devices?includeIps=192.168.20.1-192.168.20.100
If you want all devices in the range
192.168.20.1-192.168.20.100,
but want to exclude
192.168.20.20,
Page 1241
FortiSIEM Installation Guide FortiSIEM Installation Guide
192.168.20.25,
then issue the API https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/devices?include
Ips=192.168.20.1-192.168.20.100&excludeIps=192.168.20.20,192.168.20.25
If you want all devices in the range 1
92.168.20.1-192.168.20.100,
but want to exclude
192.168.20.20-192.168.20
.25
, then issue the API https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/devices?includeIps=192.16
8.20.1-192.168.20.100&excludeIps=192.168.20.20-192.168.20.25
Sample XML Output
Query: https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/devices?includeIps=192.168.20.1-192.168.20.40
Output
: AllDeviceInRangeShortDescription.xml
Sample Python Code
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
getCMDBinfoSP.py Script
import base64 import urllib2 from xml.dom.minidom import Node, Document, parseString def GetCMDBInfo(appServer, user, password):
encodePassword = base64.encodestring(user + ":" + password)
auth = "Basic %s" % encodePassword
org = user.split('/')[0]
restURL = "https://" + appServer +
"/phoenix/rest/cmdbDeviceInfo/devices?includeIps=192.168.20.1-192.168.20.40&organization="
+ org
req = urllib2.Request(restURL, None, {"Authorization": auth })
handle = urllib2.urlopen(req)
outXML = handle.read()
print outXML if __name__=='__main__':
import sys
if len(sys.argv)!=4:
print "Usage: GetCMDBInfo.py appServer user password"
exit()
param=GetCMDBInfo(sys.argv[1], sys.argv[2], sys.argv[3])
Get Full Information About One Device Belonging to an Organization
Methodology REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned.
Input URL
https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/device?ip=<deviceIp>&loadDepend=true&organization=ACME
Username and password of any AccelOps account for the Acme organization
Input
Credentials
Output
An XML that contains full information AccelOps has discovered about a device
Page 1242
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sample XML Output
Query: https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/device?ip=192.168.1.12&loadDepend=true&organization
=ACME
Output
: oneWindowsServerFullInfo.xml
Sample Python Code
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
getCMDBinfoSP.py Script
import base64 import urllib2 from xml.dom.minidom import Node, Document, parseString def GetCMDBInfo(appServer, user, password):
encodePassword = base64.encodestring(user + ":" + password)
auth = "Basic %s" % encodePassword
org = user.split('/')[0]
restURL = " https://" + appServer + "/phoenix/rest/cmdbDeviceInf o/device?ip=192.168.1.12&organization=" + org
req = urllib2.Request(restURL, None, {"Authorization": auth })
handle = urllib2.urlopen(req)
outXML = handle.read()
print outXML if __name__=='__main__':
import sys
if len(sys.argv)!=4:
print "Usage: GetCMDBInfo.py appServer user password"
exit()
param=GetCMDBInfo(sys.argv[1], sys.argv[2], sys.argv[3])
Usage
python getCMDBInfoSP.py
<AccelOpsSuperIp> ACME/<user>
<password>
Get a Section of Information (Applications, Interfaces, Processors, Storage) About One Device for an Organization
Methodology
REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned.
Input URL
https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/device?ip=<deviceIp>&loadDepend=true&fields=<sectionName>&organization=ACME
Input
Credentials
Username and password of any AccelOps account for the Acme organization
Output
An XML that contains the specified section discovered for the device
Options for <sectionName>
applications interfaces processors storages
Sample XML Output
Query: https://<AccelOps_IP>/phoenix/rest/cmdbDeviceInfo/device?ip=192.168.1.12
&loadDepend=true &fields=inter faces&organization=ACME
Output
: oneWindowsServerInterfaces.xml
Page 1243
FortiSIEM Installation Guide
Sample Python Code
FortiSIEM Installation Guide
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
getCMDBinfoSP.py Script
import base64 import urllib2 from xml.dom.minidom import Node, Document, parseString def GetCMDBInfo(appServer, user, password):
encodePassword = base64.encodestring(user + ":" + password)
auth = "Basic %s" % encodePassword
org = user.split('/')[0]
restURL = "https://" + appServer +
"/phoenix/rest/cmdbDeviceInfo/device?ip=192.168.1.12&loadDepend=true&fields=interfaces&organization="
+ org
req = urllib2.Request(restURL, None, {"Authorization": auth })
handle = urllib2.urlopen(req)
outXML = handle.read()
print outXML if __name__=='__main__':
import sys
if len(sys.argv)!=4:
print "Usage: GetCMDBInfo.py appServer user password"
exit()
param=GetCMDBInfo(sys.argv[1], sys.argv[2], sys.argv[3])
Page 1244
FortiSIEM Installation Guide FortiSIEM Installation Guide
Get the List of Monitored Devices and Attributes
API Parameters for Multitenant
Applies To
Enterprise and multitenant deployments.
API Parameters for Enterprise
Methodology
Input URL
REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned. https://<AccelOps_IP>/phoenix/rest/deviceInfo/monitoredDevices
Input Credentials Username and password of any AccelOps account
Output
An XML that contains device name, device type, organization name and list of monitored attributes
API Parameters for Multitenant
Methodology
REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned.
Input URL
https://<AccelOps_IP>/phoenix/rest/deviceInfo/monitoredDevices
Input Credentials Username and password of Super account or Organization specific account, Organization name
Output
An XML that contains device name, device type, organization name and list of monitored attributes
Sample XML Output
Output MonitoredDevices.txt
Sample Code
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
GetMonitoredDevicesByOrg
.py Script
Usage
GetMonitoredDevicesByOrg.py
python GetMonitoredDevicesByOrg.py <AccelOps_IP> <user> <password> <org_name>
Sample Query
python GetMonitoredDevicesByOrg.py 172.16.20.210 "super/admin" "admin*1"ACME
Super_user needs to be explicitly stated in organization/user format, for example
"super/admin"
or
"supe r/admin"
instead of just
"admin"
.
Page 1245
FortiSIEM Installation Guide FortiSIEM Installation Guide
Get the List of Monitored Organizations
Applies To
Multitenant deployments
API Parameters
Methodology
Input URL
REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned. https://<AccelOps_IP>/phoenix/rest/config/Domain
Input Credentials Username and password of Super account
Output
An XML that contains Organization id, Organization name, Status, Included and Excluded IP range
Sample XML Output
Sample Code
This sample python script takes the Super credentials as arguments and writes out the parsed XML output file in a comma separated value (CSV) format on the screen. The output can be redirected to a file if needed.
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
GetMonitoredOrganizations.py Script Usage
python
GetMonitoredOrganizations.py
<AccelOps_IP> <super_user>
<super_password> import httplib2 import ssl from xml.dom.minidom import Node, Document, parseString
def GetMonitoredOrganizations(appServer, user, password):
Url="https://"+appServer+"/phoenix/rest/config/Domain"
h=httplib2.Http(disable_ssl_certificate_validation=True)
h.add_credentials(user, password)
resp, content=h.request(Url, "GET")
outXML=content.decode()
param=dumpXML(outXML)
return param def dumpXML(xml):
param=[]
doc=parseString(xml)
for node in doc.getElementsByTagName("domains"):
for node1 in node.getElementsByTagName("domain"):
xmlId=node1.getAttribute("xmlId")
if xmlId in ['Domain$system', 'Domain$service',
'Domain$Super']:
pass
else:
Page 1246
FortiSIEM Installation Guide
mapping={'name':'', 'domainId':'',
'disabled':'', 'initialized':'', 'include':'',
'exclude':''}
for node2 in node1.getElementsByTagName("domainId"):
for node3 in node2.childNodes:
if node3.nodeType==Node.TEXT_NODE:
mapping['domainId']=node3.data
for node4 in node1.getElementsByTagName("excludeRange"):
for node5 in node4.childNodes:
if node5.nodeType==Node.TEXT_NODE:
mapping['exclude']=node5.data
for node6 in node1.getElementsByTagName("includeRange"):
for node7 in node6.childNodes:
if node7.nodeType==Node.TEXT_NODE:
mapping['include']=node7.data
for node8 in node1.getElementsByTagName("name"):
for node9 in node8.childNodes:
if node9.nodeType==Node.TEXT_NODE:
mapping['name']=node9.data
for node10 in node1.getElementsByTagName("disabled"):
for node11 in node10.childNodes:
if node11.nodeType==Node.TEXT_NODE:
mapping['disabled']=node11.data
for node12 in node1.getElementsByTagName("initialized"):
for node13 in node12.childNodes:
if node13.nodeType==Node.TEXT_NODE:
mapping['initialized']=node13.data
param.append(mapping)
return param def generateResult(param):
print "Org Name,Org Id,Disabled,Initialized,Include
Range,Exclude Range\n\n"
for item in param:
print "%s,%s,%s,%s,%s,%s\n" % (item['name'], item['domainId'], item['disabled'], item['initialized'], item['include'], item['exclude']) if __name__=='__main__':
import sys
if len(sys.argv)!=4:
print "Usage: GetMonitoredOrganizations.py appServer user password"
exit()
FortiSIEM Installation Guide
Page 1247
FortiSIEM Installation Guide
param=GetMonitoredOrganizations(sys.argv[1], sys.argv[2], sys.argv[3])
generateResult(param)
FortiSIEM Installation Guide
Page 1248
FortiSIEM Installation Guide FortiSIEM Installation Guide
Update Device Monitoring
API Parameters for Enterprise Deployments
API Parameters for Multitenant Deployments
Applies To
Enterprise and multitenant deployments.
API Parameters for Enterprise Deployments
Methodology REST API based: make an HTTP(S) request with an input XML (optional).
Input URL
https://<AccelOps_IP>/phoenix/rest/deviceMon/updateMonitor
Username and password of any AccelOps account
Input
Credentials
Input
Parameters
Output
Username and password of Super account or Organization specific account, Organization name, input XML containing the updates to device monitoring configuration.
HTTP Status Code
API Parameters for Multitenant Deployments
Methodology REST API based: make an HTTP(S) request with an input XML (optional).
Input URL
Input
Credentials
Output
https://<AccelOps_IP>/phoenix/rest/deviceMon/updateMonitor
Username and password of Super account or Organization specific account, Organization name, input XML containing the updates to device monitoring configuration.
HTTP Status Code
Sample XML Output
MonitorDevice.xm
l
Sample Code
Sample XML Input File
Page 1249
FortiSIEM Installation Guide FortiSIEM Installation Guide
<configureMonitoring>
<systemMonitors>
<systemMonitor ip = "92.68.4.18" method = "SNMP" type = "CPU
Util" enable = "true" interval = "120"/>
</systemMonitors>
<eventPullingObjs>
<eventPullingObj ip = "92. 68.4.23" method = "WMI" enable =
"true" />
<eventPullingObj ip = "92.68.4.24" method = "WMI" enable =
"true" />
</eventPullingObjs>
</configureMonitoring>
Sample Python Script
This sample takes the credentials, and optionally an organization name, as arguments and writes out the parsed XML output file in a comma separated value (CSV) format on the screen. The output can be redirected to a file if needed.
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
UpdateMonitor.py Script Usage
Page 1250
FortiSIEM Installation Guide import sys, base64, urllib, urllib2 def restPost(appServer, user, password, file):
f = open(file, 'r')
content = f.read()
f.close()
url = "https://" + appServer +
"/phoenix/rest/deviceMon/updateMonitor"
auth = "Basic %s" % base64.encodestring(user + ":" + password)
request = urllib2.Request(url, content)
request.add_header('Authorization', auth)
request.add_header('Content-Type',
'text/xml') # 'application/xml'
request.add_header('Content-Length', len(content)+2)
request.add_header('User-Agent',
'Python-urllib2/2.7')
request.get_method = lambda: 'PUT'
try:
handle = urllib2.urlopen(request)
except urllib2.HTTPError, error:
if (error.code != 204):
print error if __name__=='__main__':
if len(sys.argv) != 5:
print "Usage: UpdateMonitor.py
appServer user password deviceDefFile"
print "Example: python
UpdateMonitor.py 192.168.20.116
super/admin adm1n deviceMonitorDef.xml"
sys.exit()
restPost(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
FortiSIEM Installation Guide python UpdateMonitor.py <AccelOps_IP>
<user> <password> <device monitor xml file name>
Sample Query
python UpdateMonitor.py 172.16.20.210
"super/admin"
"admin*1" MonitorDevice.xml
Super_user needs to be explicitly stated in organization/user format, for example
"super/admi n"
or
"super/admin"
instead of just
"admin"
Page 1251
FortiSIEM Installation Guide FortiSIEM Installation Guide
Add, Update or Delete Device Maintenance Schedule
API Parameters for Adding/Updating Maintenance Schedule
API Parameters for Deleting Maintenance Schedule
Sample Code to Add/Update a Device Maintenance Schedule
Sample Code to Delete a Device Maintenance Schedule
Applies To
<Enterprise and multitenant deployments.>
<Enterprise deployments.>
<Multitenant deployments>
API Parameters for Adding/Updating Maintenance Schedule
Methodology
Input URL
REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned. https://<AccelOps_IP>/phoenix/rest/deviceMaint/update
Input Parameters An XML file
Input Credentials Username and password of any AccelOps account
Output
An XML file
API Parameters for Deleting Maintenance Schedule
Methodology
Input URL
REST API based: make an HTTP(S) request with an input XML (optional). An output XML is returned. https://<AccelOps_IP>/phoenix/rest/deviceMaint/delete
Input Parameters An XML file
Input Credentials Username and password of any AccelOps account
Output
An XML file
Sample Code to Add/Update a Device Maintenance Schedule
Sample XML Input File
Page 1252
FortiSIEM Installation Guide FortiSIEM Installation Guide
<MaintSchedules>
<MaintSchedule>
<name>My schedule</name>
<description>KIN-REMOTE</description>
<devices>
<device>92.68.4.18</device>
</devices>
<groups>
<group>Windows</group>
</groups>
<fireIncidents>true</fireIncidents>
<timeZoneId>America/Anchorage</timeZoneId>
<schedule>
<startHour>12</startHour>
<startMin>2</startMin>
<duration>3</duration><!-- minute -->
<timeZone>-9</timeZone>
<startDate>2014-3-27</startDate><!-- year-month-day -->
<endDate>2014-3-27</endDate>
<endDateOpen>false</endDateOpen><!-- "From start date on" option on GUI -->
</schedule>
</MaintSchedule>
</MaintSchedules>
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
AddMaint.py Script Usage
Page 1253
FortiSIEM Installation Guide
import sys, base64, urllib, urllib2 def restPost(appServer, user, password, file):
f = open(file, 'r')
content = f.read()
f.close()
url = "https://" + appServer +
"/phoenix/rest/deviceMaint/update"
auth = "Basic %s" % base64.encodestring(user + ":" + password)
request = urllib2.Request(url, content)
request.add_header('Authorization', auth)
request.add_header('Content-Type',
'text/xml') # 'application/xml'
request.add_header('Content-Length', len(content)+2)
request.add_header('User-Agent',
'Python-urllib2/2.7')
request.get_method = lambda: 'PUT'
try:
handle = urllib2.urlopen(request)
except urllib2.HTTPError, error:
if (error.code != 204):
print error if __name__=='__main__':
if len(sys.argv) != 5:
print "Usage: AddMaint.py
appServer user password scheduleDefFile"
print "Example: python
AddMaint.py 192.168.20.116 super/admin adm1n scheduleDef.xml"
sys.exit()
restPost(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
FortiSIEM Installation Guide python AddMaint.py <AccelOps_IP> <user>
<password> <maintenance schedule xml file name>
Sample Query
python AddMaint.py 172.16.20.210
"super/admin"
"admin*1" MaintenanceSchedule.xml
Super_user needs to be explicitly stated in organization/user format, for example
"super/admi n"
or
"super/admin"
instead of just
"admin"
Sample Code to Delete a Device Maintenance Schedule
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
Page 1254
FortiSIEM Installation Guide
DeleteMaint.py Script
import sys, base64, urllib, urllib2 def restPost(appServer, user, password, file):
f = open(file, 'r')
content = f.read()
f.close()
url = "https://" + appServer +
"/phoenix/rest/deviceMaint/delete"
auth = "Basic %s" % base64.encodestring(user + ":" + password)
request = urllib2.Request(url, content)
request.add_header('Authorization', auth)
request.add_header('Content-Type',
'text/xml') # 'application/xml'
request.add_header('Content-Length', len(content)+2)
request.add_header('User-Agent',
'Python-urllib2/2.7')
request.get_method = lambda: 'PUT'
try:
handle = urllib2.urlopen(request)
except urllib2.HTTPError, error:
if (error.code != 204):
print error if __name__=='__main__':
if len(sys.argv) != 5:
print "Usage: DeleteMaint.py
appServer user password scheduleDefFile"
print "Example: python
DeleteMaint.py 192.168.20.116
"super/admin" "adm1n" scheduleDef.xml"
sys.exit()
restPost(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
FortiSIEM Installation Guide
Usage
python DeleteMaint.py <AccelOps_IP>
<user> <password> <maintenance schedule xml file name>
Sample Query
python DeleteMaint.py 172.16.20.210
"super/admin"
"admin*1" MaintenanceSchedule.xml
Super_user needs to be explicitly stated in organization/user format, for example
"super/admi n"
or
"super/admin"
instead of just
"admin"
Page 1255
FortiSIEM Installation Guide FortiSIEM Installation Guide
Events and Report Integration
This API provides a way to programmatically run any query or report that can be executed on the event data from the AccelOps GUI.
General Description
Methodology REST API based: make an HTTP(S) request with an input XML that defines the query.
Since the number of returned results can be large, the caller has to first get the total number of results
Then get the results one chunk at a time. Every time, an output XML containing the query results is returned.
Request API Parameters
Input URL
Input
Parameters
Input
Credentials
Output
https://<AccelOps_IP>/phoenix/rest/query/eventQuery
XML file containing the query parameters
Enterprise Deployments: Username and password of any AccelOps account
Multi-tenant Deployments: Username and password of Super account for getting incidents for all organizations. If incidents for a specific organization are needed, then an organization-specific account and an organization name is needed.
queryId
or an error code if there is a problem in handling the query or the query format
Polling API Parameters
The request will poll until the server completes the query.
Input
URL
https://<AccelOps_IP>/phoenix/rest/query/progress/<queryId>
Output progress (pct)
Until progress reaches 100, at which point the server completes the query, you need to continue polling the server. This is because the server may need to aggregate the results or insert meta-information before sending the results.
Results API Parameters
Input
URL
https://<AccelOps_IP>/phoenix/rest/query/events/<queryId>/<begin>/<end>
Output totalCount (first time) and an XML containing the incident attributes.
For the first call,
begin
= 0 and the begin
and end
end
can be 1000. You need to continuously query the server by using the same URL, but increasing
until the totalCount is reached.
Sample XML Output
Failed-Logins-Report.txt
Sample Code
This sample takes the credentials, input XML and. optionally. organization name as arguments and writes out the query results in a comma separated value (CSV) format on the screen. The output can be redirected to a file if needed.
Page 1256
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sample XML Input Files
Failed Login at Any Device Top Events by Severity and
Count
Top Reporting Device and Module by Event Count
Top Servers By Least Free
Disk Space
Sample Python Script
Note: This is only a sample code tested using Python 2.6. You will need to adapt this to make in your environment.
<script name>.py Script Usage
Sample Query
python GetQueryResultsByOrg.py
172.16.20.210 "super/admin" "admin*1" all ./failed-login.xml
Super_user needs to be explicitly stated in organization/user format, for example
"super/admin
"
or
"super/admin"
instead of just
"admin"
You also need to download the getMonitoredOrganizations python script into the same directory
Script Disables SSL Certificate
These python scripts disable SSL certificate check in a line that looks like this: h=httplib2.Http(disable_ssl_certificate_validation=True)
For production use, you should install a proper certificate on your AccelOps nodes , and enable the certificate validation by changing all lines of the scripts that are similar to the line above to: h=httplib2.Http()
Page 1257
FortiSIEM Installation Guide FortiSIEM Installation Guide
Incident Notification
AccelOps can send notifications via email/SMS, HTTPS, SNMP traps, and over the AccelOps API. These topics describe the formats for these notification types, and how to use the notification API.
Formats for Incident Notifications over Email, HTTPS, SNMP Trap, and API
Page 1258
FortiSIEM Installation Guide FortiSIEM Installation Guide
Formats for Incident Notifications over Email, HTTPS, SNMP Trap, and API
This topic describes the formats for the various types of notifications that AccelOps can send by email/SMS, HTTPS, SNMP trap, or through the
API>.
Email/SMS Notification
Email is the most common form of incident notification. For integration purposes, an incident email subject and body can be parsed and specific actions can be taken if necessary.
These screenshots shows three types of email that can be sent depending on whether an incident is NEW, UPDATEd or CLEARed
New Update Clear
Subject Line Format
[New|Update|Clear] <HostName>: <Rule Name>
Body Format
Section
Generic
Rule
Incident Target
Incident Source
Field
Incident Id
Time
Severity
Incident Count
Rule Name
Rule
Description
Host Name
(optional)
Host IP
(optional)
Other attributes as defined in rule
Host Name
(optional)
Host IP
(optional)
Description
Unique ID of the incident in AccelOps. An incident can be searched in AccelOps by this ID.
Time when this incident occurred
Incident severity: HIGH|MEDIUM|LOW and a numeric severity in the range 0-10 (0-4 LOW, 5-8
MEDIUM and 9-10 HIGH
How many times this incident has occurred. For NEW incidents, the count is 1.
Name of the rule, repeated in the subject line
Where the incident occurred, or the target of an IPS alert
For security-related incidents, where the incident originated
Page 1259
FortiSIEM Installation Guide FortiSIEM Installation Guide
Incident Details
)
Affected Business
Services (optional
Identity and
Location
Other attributes as defined in rule
Rule-specific details that caused the incident to trigger
Xontains additional information for IP addresses in incident source or target. This information is present only if such information is discovered by AccelOps and shown in the Identity and Location tab.
Host name
User
Domain
Nearest switch name/port or VPN gateway or Wireless Controller
First and last seen times for this IP address to identity/location binding
SMS Format
SMS notification is a shortened version of email notification
SNMP Trap Notification
MIB File
AccelOps can send out SNMP traps on incidents. Use the attached MIB file to configure your device to send SNMP traps to AccelOps.
HTTP(S) Notification
XML Schema
The AccelOps AONotification.xsd file shows the XML schema for incident notifications.
.
XML File Format
Sample Incident XML file pushed out via HTTP(S)
Section
Generic
Field
incidentId ruleId
Description
Unique ID of the incident in AccelOps. An incident can be searched in AccelOps by this ID.
Unique id of the rule in AccelOps
Page 1260
FortiSIEM Installation Guide FortiSIEM Installation Guide incidentTarget repeatCout how many times this incident has occurred name Name of the rule that triggered the incident description Description of the rule including conditions under which the rule is written to trigger displayTime Time when this incident occurred
Where the incident occurred, or the target of an IPS alert. It consists of attribute, name and value pairs.
incidentSource vendor severity
AccelOps
Incident severity: HIGH | MEDIUM | LOW organization The name of the organization for which this incident occurred status New, Update or Clear attribute name value attribute name
Parsed event attribute id
Display name of the attribute
Common examples of attributes are srcIpAddr, destIpAddr, hostIpAddr etc.
The attribute's value
For security-related incidents, where the incident originated incidentDetails value attribute name
Parsed event attribute id
Display name of the attribute
Common examples of attributes are srcIpAddr, destIpAddr, hostIpAddr etc.
The attribute's value
Rule-specific details that caused the incident to trigger shown as an attribute with name and value pairs.
Parsed event attribute id affectedBizSrvc deviceDetails value
Display name of the attribute
Common examples of attributes are srcIpAddr, destIpAddr, hostIpAddr etc.
The attribute's value
A comma-separated list of business service names
Contains additional information for IP addresses in incident source or target. This information is present only if such information is discovered by AccelOps and shown in the Identity and Location tab.
ipAddr hostName vendor model version users - Logged on users using this IP info obtained from Active Directory userName - Active Directory login name fullName - Full name of this user in Active Directory or defined manually email - email address of the user in Active Directory or defined manually jobTitle - jobTitle of the user in Active Directory or defined manually
First and last seen times for this IP address to user binding
Unable to render {include} The included page could not be found.
Page 1261
FortiSIEM Installation Guide FortiSIEM Installation Guide
Using the Notification API
Querying Incidents for the Last 2 Hours
Applies To
Enterprise and multitenant deployments.
General API Parameters
Methodology REST API based: make an HTTP(S) request with an input XML. An output XML is returned. Since the number of returned results can be large, the requester has to first get the total number of results, and then get the results one chunk at a time.
Request API Parameters
Input URL
Input
Parameters
Input
Credentials
Output
https://<AccelOps_IP>/phoenix/rest/query/eventQuery
XML file containing the query parameters
Enterprise Deployments: Username and password of any AccelOps account
Mulittenant Deployments: Username and password of Super account for getting incidents for all organizations. If incidents for a specific organization are needed, then an organization-specific account and an organization name is needed.
queryId
or an error code if there is a problem in handling the query or the query format
Polling API Parameters
The request will poll until the server completes the query.
Input
URL
https://<AccelOps_IP>/phoenix/rest/query/progress/<queryId>
Output progress (pct)
Until progress reaches 100, at which point the server completes the query, you need to continue polling the server. This is because the server may need to aggregate the results or insert meta-information before sending the results.
Results API Parameters
Input
URL
https://<AccelOps_IP>/phoenix/rest/query/events/<queryId>/<begin>/<end>
Output totalCount (first time) and an XML containing the incident attributes.
For the first call,
begin
= 0 and the begin
and end
end
can be 1000. You need to continuously query the server by using the same URL, but increasing
until the totalCount is reached
Sample XML Ouput
Incidents Report Output
XML Schema
The AccelOps AONotification.xsd file shows the XML schema for incident notifications.
.
Page 1262
FortiSIEM Installation Guide
Sample Code
Sample XML Input File
Querying Incidents for the Last 2 Hours
FortiSIEM Installation Guide
Sample Python Script
<script name>.py Script Usage
Sample Query
python GetIncidentsByOrg.py 172.16.20.210 "super/admin"
"admin*1" SoftwareAB
Super_user needs to be explicitly stated in organization/user format, for example
"sup er/admin"
or
"super/admin"
instead of just
"admin"
Page 1263
FortiSIEM Installation Guide FortiSIEM Installation Guide
External Help desk / CMDB Integration
Currently AccelOps has inbuilt support for ServiceNow and ConnectWise for CMDB and 2-way incident integration. Other systems can be supported by create a new Java plugin by following instructions in the AccelOps ServiceAPI. The document is available at AccelOps support portal under AccelOps ServiceAPI section.
Page 1264
FortiSIEM Installation Guide FortiSIEM Installation Guide
External Threat Intelligence Integration
New external threat intelligence websites can be supported by create a new Java plugin by following instructions in the AccelOps ServiceAPI. The document is available at AccelOps support portal under AccelOps ServiceAPI section.
Page 1265
FortiSIEM Installation Guide FortiSIEM Installation Guide
License Registration
Worker registration
Methodology
Usage
Input Parameters
Output
Run this command to add or delete a Worker from Super
Command located at /opt/phoenix/deployment/jumpbox
Run commands from Super
Add a Worker to Super: phProvisionWorker --add <user> <password> <super> <worker>
Remove a Worker from Super: phProvisionWorker --delete <user> <password> <super> <worker>
None user: username of admin account to logon to GUI password: password of admin account to logon to GUI superIp: Supervisor IP Address or FQDN workerIp: Worker IP Address or FQDN
Collector registration
Methodology
Usage
Input Parameters
Output
Sample
Interaction
Run this command to add or delete a collector
Add a Collector to Super
Run this command from Collector
Usage: /opt/phoenix/bin/phProvisionCollector --add <user> <password> <super> <organization> <collector>
Remove a Collector to Super
Run this command from Super
Usage: /opt/phoenix/bin/phProvisionCollector --delete <user> <password> <super> <organization>
<collector> user: username of admin account to logon to GUI password: password of admin account to logon to GUI super: Supervisor IP Address or FQDN organization: organization name (SP), Super (Enterprise) collector: Collector IP Address or FQDN
None
[root@Super171]# cd /opt/phoenix/deployment/jumpbox
[root@Super171]# phProvisionCollector --delete admin admin*1 10.10.110.171 test-org 10.10.110.172
Continue the provision process...
Deleting Collector: 10.10.110.172 from Super: 10.10.110.171 with Organization: test-org
…
Sucessfully done.
AccelOps License registration
Methodology
Usage
Input Parameters
Output
Download License from AccelOps
Run this command from Super as root
Usage: /pbin/phdownloadlicense <user> <password> <ao-license-server> user: username for obtaining license password: password for obtaining license ao-license-server: AccelOps license server host name
None
Page 1266
FortiSIEM Installation Guide FortiSIEM Installation Guide
Sample interaction [root@sp161 pbin]# phdownloadlicense rstest rstest va-reg.accelops.net
Retrieving Information ...
New license file has been retrieved. You may use phinstalllicense to install the new license.
Methodology Install downloaded license as root
Usage
Run this command from Super as root
Usage: /pbin/phinstalllicense
None
Input
Parameters
Output
Sample interaction
None
[root@sp161 pbin]# phinstalllicense
The process of installing a license will disrupt AccelOps services. Do you want to start the installation at this time ?
[yes/no] : yes
Installing license ...
Number of Licensed VA(s) = 10
...
Number of Running Worker(s) = 0
...
Exiting from worker provision ...
[root@sp161 pbin]# phLicenseTool --verify
license matched
[root@sp161 pbin]# phLicenseTool --show
Report License: workers=9; citems=5000; eps=10000;storage=10737418240000; starttime=1399878000; endtime=1447398000; mode=1; rsOrg=111; rsExp=1432796400; SP=1; organizationNum=10; country=; customerId=1086; customerName=rstest; collectors=5; devicesupport=1; basicAgents=1; advancedAgents=1; profile=0
Page 1267
FortiSIEM Installation Guide
How-to articles
Title
FortiSIEM Windows Agent and Agent Manager Install
Moving CMDB to a separate Database Host
Creator
Partha Bhattacharya
Shashi Guruprasad
Modified
Jul 15, 2016
Jul 14, 2016
FortiSIEM Installation Guide
Add how-to article
Page 1268
FortiSIEM Installation Guide
Common user errors
Excessive logging after turning on SNMP in Linux
Failures to write events into event database
Excessive logging after turning on SNMP in Linux
By default Linux logs every connection. With UDP based SNMP, this can become excessive.
To fix the issue, follow steps as specified in Linux Server Configuration : Configuration > SNMP V1, V2 > Step 4
Failures to write events into event database
Check /data permissions
FortiSIEM Installation Guide
Page 1269
Copyright© 2016 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet,
Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features, or development, and circumstances may change such that any forward-looking statements herein are not accurate.
Fortinet disclaims in full any covenants, representations,and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.
Unduh
Tautan publik diperbarui
Tautan publik ke obrolan Anda telah diperbarui. You may view and manage your chat links after registration here.
Tautan publik dokumen
Iklan
