Default Passwords

The CMDB Default Password page contains a list of default vendor credentials. These well-known credentials should never be used in production. During device discovery FortiSIEM checks if the device credentials are still set to default , and the system rule Default Password Detected by System triggers an incident if they are.

A sample raw event log for a default password incident:

<174>Oct 20 22:50:03 [PH_AUDIT_DEFAULT_PWD_MATCH]:[phEventCategory]=2,[appTransportProto]=SNMP,[reptModel]=

Adding a New Default Password

1. Log in to your Supervisor node.
2. Go to CMDB > Default Passwords.
3. Select a group where you want to add the default password, or create a new one.
4. Click New.
5. Select the Vendor and Model of the device for which you want to enter a default password.
6. Select the Access Protocol that is used to connect to the device.
7. Enter the default User Name and Password for the device.