System

Use the System pages to manage and configure the basic system options for FortiDeceptor. This includes administrator configuration, mail server settings, and maintenance information.

The System menu provides access to the following:

Administrators

Use the System > Administrators page to configure administrator user accounts.

If the user whose Admin Profile does not have Read Write privilege under System > Admin Profiles, the user can only view and edit their own information.

The following options are available:

The following information is displayed:

To create a new user:

1. Log in using an account with Read/Write access and go to System > Administrators.
2. Click Create New.
3. Configure the following:

Setting trusted hosts for administrators limits what computers an administrator can use to log into FortiDeceptor. When you identify a trusted host, FortiDeceptor only accepts the administrator’s login from the configured IP address or subnet. Attempts to log in with the same credentials from another IP address or subnet are dropped.

4. Click OK.

To edit a user account:

1. Log in using an account with Read/Write access and go to System > Administrators.
2. Select and account and click Edit.

Only the admin user can edit its own settings.

You must enter the old password before you can set a new password.

3. Edit the account and click OK.

To delete one or more user accounts:

1. Log in using an account with Read/Write access and go to System > Administrators.
2. Select the user account you want to delete.
3. Click Delete and confirm that you want to delete the user.

To test LDAP or RADIUS logins:

1. Log in using an account with Read/Write access and go to System > Administrators.
2. Select an LDAP or RADIUS user to test.
3. Click Test Login.
4. Enter the user password.
5. Click OK.

If an error occurs, a debug message appears.

Admin Profiles

Use administrator profiles to control administrator access privileges to system features. When you create an administrator account, you assign a profile to the account.

You cannot modify or delete the following predefined administrator profiles:

l SuperAdmin has access to all functionality. l Read only has read-only access.

Only users with the Super Admin profile can create, edit, and delete administrator profiles. Users can create, edit, and delete administrator profiles if they have Read Write privilege in their profile.

The Menu Access section has the following settings:

The CLI Commands section has the following settings:

To create an Administrator Profile:

1. Go to System > Admin Profiles.
2. Click Create New.
3. Specify the Profile Name.
4. If you wish, add a Comment.
5. Specify the privileges for Menu Access:
   • Dashboard l Dashboard
   • Deception
   • Customization l Deception OS l Deployment Network l Deployment Wizard l Decoy & Lure Status l Decoy Map
   • Whitelist
   • Incident l Analysis l Campaign l Attack Map
   • Fabric
   • FortiGate Integration l Quarantine Status l IOC Export
   • Network
   • Interfaces
   • System DNS l System Routing
   • System
   • Administrators l Admin Profiles l Certificates l LDAP Servers l RADIUS Servers l Mail Server
   • SNMP
   • FortiGuard l Settings l Login Disclaimer l System Settings l Table Customization
   • Log
   • All Events l Log Servers
6. Specify the privileges for CLI Commands:
   • Configuration l Set l Unset
   • System l Reboot l Shutdown l Reset Configuration l Factory Reset l Firmware Upgrade l Reset Widgets l IP Tables l test-network l usg-license
   • Upload VM Firmware License l Resize VM Hard Disk l Set Confirm ID for Windows VM l List VM License l Show VM Status l VM reset l DC Image Status l Set Maintainer l Set Timeout for Remote Auth l Data Purge l Log Purge l DMZ Mode
   • fdn-pkg l Utilities
   • TCP Dump
   • Trace Route
7. Click Save.

Certificates

Use this page to import, view, and delete certificates. Certificates are used for secure connection to an LDAP server, system HTTPS, and SSH services. FortiDeceptor has one default certificate firmware.

FortiDeceptor does not support generating certificates. FortiDeceptor supports importing certificates for SSH and HTTPS access using .crt, PKCS12, or .pem format.

The following options are available:

The following information is displayed:

To import a certificate:

1. Go to System > Certificates.
2. Click Import.
3. Enter the Certificate Name.
4. If you want to import a password protected PKCS12 certificate, select PKCS12 Format.
5. Click Choose File and locate the certificate and key files on your management computer.
6. Click OK to import the certificate.

To view a certificate:

1. Go to System > Certificates.
2. Select a certificate and click View.

The following information is available:

To delete a CA certificate:

1. Go to System > Certificates.
2. Select the certificate you want to delete.
3. Click Delete and confirm you want to delete the certificate.

LDAP Servers

FortiDeceptor supports remote authentication of administrators using LDAP servers. To use this feature, configure the server entries in FortiDeceptor for each authentication server in your network.

If you have configured LDAP support and require users to authenticate using an LDAP server, FortiDeceptor contacts the LDAP server for authentication. To authenticate with FortiDeceptor, the user enters a user name and password. FortiDeceptor sends this user name and password to the LDAP server. If the LDAP server can authenticate the user, FortiDeceptor authenticates the user. If the LDAP server cannot authenticate the user, FortiDeceptor refuses the connection.

The following options are available:

The following information is displayed:

To create a new LDAP server:

1. Go to System > LDAP Servers.
2. Click Create New.
3. Configure the following settings:

4. Click OK.

RADIUS Servers

FortiDeceptor supports remote authentication of administrators using RADIUS servers. To use this feature, configure the server entries in FortiDeceptor for each authentication server in your network.

If you have configured RADIUS support and require users to authenticate using a RADIUS server, FortiDeceptor contacts the RADIUS server for authentication. To authenticate with FortiDeceptor, the user enters a user name and password. FortiDeceptor sends this user name and password to the RADIUS server. If the RADIUS server can authenticate the user, FortiDeceptor authenticates the user. If the RADIUS server cannot authenticate the user, FortiDeceptor refuses the connection.

The following options are available:

The following information is displayed:

To add a RADIUS server:

1. Go to System > RADIUS Servers.
2. Click Create New.
3. Configure the following settings:

4. Click OK.

Mail Server

Use the System > Mail Server page to adjust mail server settings.

You can configure the following options:

SNMP

SNMP is a method to monitor your FortiDeceptor system on your local computer. You need an SNMP agent on your computer to read the SNMP information. Using SNMP, your FortiDeceptor system monitors for system events including CPU usage, memory usage, log disk space, interface changes, and malware detection. Go to System > SNMP to configure your FortiDeceptor system’s SNMP settings.

SNMP has two parts: the SNMP agent or the device that is sending traps, and the SNMP manager that monitors those traps. The SNMP communities on the monitored FortiDeceptor are hard coded and configured in the SNMP menu.

The FortiDeceptor SNMP implementation is read-only — SNMP v1, v2c, v3 compliant SNMP manager applications, such as those on your local computer, have read-only access to FortiDeceptor system information and can receive FortiDeceptor system traps.

You can also download FortiDeceptor and Fortinet core MIB files.

Configure the SNMP agent

The SNMP agent sends SNMP traps that originate on FortiDeceptor to an external monitoring SNMP manager defined in one of the FortiDeceptor SNMP communities. Typically, an SNMP manager is an application on a local computer that can read the SNMP traps and then generate reports or graphs.

The SNMP manager can monitor FortiDeceptor to determine if it is operating properly or if critical events are occurring. The description, location, and contact information for this FortiDeceptor system is part of the information an SNMP manager collects. This information is useful if the SNMP manager is monitoring many devices, and it enables a faster response when FortiDeceptor requires attention.

To configure SNMP agents:

1. Go to System > SNMP.
2. Configure the following settings:

To create an SNMP v1/v2c community:

1. Go to System > SNMP.
2. In the SNMP v1/v2c section, click Create New.
3. Configure the following settings:

4. Click OK.

To create an SNMP v3 user:

1. Go to System > SNMP.
2. In the SNMP v3 section, click Create New.
3. Configure the following settings:

4. Click OK.

To download MIB files:

1. At the bottom of the SNMP page, select the MIB file you want to download to your management computer.

FortiGuard

1. Go to System > FortiGuard.
2. The following options and information are available:

3. Click Apply to apply your changes.

Settings

Go to System > Settings to configure the idle timeout for the administrator account.

To configure idle timeout:

1. Go to System > Settings.
2. Enter a value between 1 and 480 minutes.
3. Click OK.

To reset all widgets:

You can reset all the widgets in the Dashboard by clicking the Reset button.

Login Disclaimer

Go to System > Login Disclaimer to customize the warning message, and to enable or disable the login disclaimer.

If enabled, the disclaimer appears when a user tries to log into the unit.

Table Customization

To customize the columns available for Incidents or Events:

1. Go to System > Table Customization.
2. In the Incident Columns pane, drag and drop the columns from the Available Column Headers to the Customized Column Headers and Orders.
3. In the Event Columns pane, drag and drop the columns from the Available Column Headers to the Customized Column Headers and Orders.
4. In the Table Settings pane, specify the Page Size and select the View Type.
5. Click Save.

Fabric

Use the Fabric pages to manage and configure FortiGate information for integration with FortiDeceptor. This includes blocking settings and Security Fabric status information. Blocking from FortiGate is an API call from FortiDeceptor which allows instant quarantine from FortiGate once an incident is detected. The quarantined IP is under user quarantine in the FortiGate GUI.

Fabric provides access to the following pages:

FortiGate Integration

Use Fabric > FortiGate Integration to configure FortiGate settings for integration with FortiDeceptor. FortiDeceptor uses FortiGate REST APIs to make quarantine calls when decoys are accessed. Attackers are immediately quarantined on the FortiGate for further analysis.

The following options are available:

The following information is displayed:

Fabric

Quarantine Status

The Fabric > Quarantine Status page displays the status of blocked and quarantined IP addresses. It also lets you manually block or unblock devices. The following options are available:

The following information is displayed:

IOC Export

Use the Fabric > IOC Export page to export the IOC file in CSV format for a specified time period. The CSV file can be processed by third party Threat Intelligence Platforms. The file contains the TimeStamp, Incident time, Attacker IP, related files, and WCF (Web Content Filtering) events. You can include MD5 checksums, WCF category, and reconnaissance alerts.

Monitor Attacks

Administrators can monitor attacks in two ways:

To monitor attacks using Incident pages:

• Incident > Analysis lists incidents and related events detected by FortiDeceptor. l Incident > Campaign lists attacks and related events detected by FortiDeceptor. l Incident > Attack Map shows attacks and related events detected by FortiDeceptor.

To monitor attacks using Dashboard widgets:

• Use the Dashboard Incidents & Events Distribution See Incidents and Events Distribution on page 18. l Use the Dashboard Incidents & Events Count widget.

Analysis

Incident > Analysis lists the Incidents detected by FortiDeceptor.

To use the Analysis page:

1. Go to Incident > Analysis.
2. The Analysis page displays the list of events:

3. To refresh the data, click Refresh.
4. To download the detailed analysis report in PDF format, click Export to PDF.
5. To mark items as read, expand the incident details or click Mark all as read.

Newly-detected incidents are in bold to indicate they are unread.

6. To display specific types of events, click Show All, IPS Events Only, or Web FilterEvents Only.
7. To specify columns and table settings, use the Settings icon at the bottom right.

Campaign

Incident > Campaign lists the Attacks detected by FortiDeceptor. An Attack consists of multiple Incidents.

To use the Campaign page:

1. Go to Incident > Campaign.
2. The Campaign page displays the list of attacks:

3. To refresh the data, click Refresh.
4. To export the data, click Export to PDF.
5. To specify columns and table settings, use the Settings icon at the bottom right.

Attack Map

Incident > Attack Map is a visual representation of the entire network showing real endpoints, Decoy VMs, and ongoing attacks.

To work with the Attack Map:

1. Go to Incident > Attack Map. l To change the display, drag items to another location. l Scroll to zoom in or out. l Click a node to see its information.
2. At the bottom of the Attack Map, use the timeline indicator to set the start and end time.
3. Click Click to begin filtering to select a different filter type and type values. Filter types include AttackerIP, Victim IP, and Decoy IP.

You can use multiple arguments with different filter types. All filter arguments and time indicator arguments are considered “AND” conditions.

4. To locate the node on the map, use the LOCATE BY IP
5. To save a snapshot of the map, click Save view .

Incidents and Events Distribution

This dashboard widget displays the number of incidents and events with the following risk level information and options.

Hover over the pie chart to see the number of Incidents or Events and their percentage.

To customize this widget:

1. Click the edit icon to make the following changes:

l Enter a Customized Widget Title. l Change the Refresh Interval. l Select a Time Period: Last 24 Hours, Last 7 Days, or Last 4 Weeks.

Incidents and Events Count

This dashboard widget displays the number of Incidents and Events.

To customize this widget:

1. Click the edit icon to make the following changes:

l Enter a Customized Widget Title. l Change the Refresh Interval. l Select a Time Period: Last 24 Hours, Last 7 Days, or Last 4 Weeks.

Top 10 Attackers by Events

This dashboard widget displays the top ten attackers by the number of events.

Top 10 Attackers by Incidents

This dashboard widget displays the top ten attackers by the number of incidents.

Top 10 IPS Attacks

This widget displays the top 10 IPS attacks by the number of attack events.

Incidents Distribution by Service

This dashboard widget displays the number of Incidents by service with the following information and options.

Global Attacker Distribution

This widget displays the number of Attackers by country on a global map.

Deploy Decoy VM

Use the Deception pages allows you to deploy Decoy VMs on your network. When a hacker gains unauthorized access to Decoy VMs, their movements can be monitored to understand how they attack the network.

Apart from the default decoy Windows, Linux, or SCADA OS images, FortiDeceptor supports custom OS images with a purchased subscription service. You can upload your custom ISO images and install the FortiDeceptor Toolkit on the image. For instructions, click the Help icon in the toolbar and select Customization.

To use FortiDeceptor to monitor the network:

• Go to Deception > Deception OS to check the Deception OS available. See View available Deception OS on page

9. 9. l Go to Deception > Deployment Network to auto-detect or specify the network where the Decoy VMs are deployed.

• Go to Deception > Deployment Wizard to deploy the Decoy VM on the network.
• Go to Deception > Decoy & Lure Status to start or stop deployed Decoy VMs, or download the FortiDeceptor Token Package to manually install on computers. l Go to Deception > Decoy Map to see the network of Decoy VMs.
• Go to Deception > Whitelist to specify the network that is to be considered safe. This is useful if the administrator wants to log into the deployment network and not be flagged as an attacker.

View available Deception OS

The Deception > Deception OS page lists the deception OSes available for creating Decoy VMs.

Set up the Deployment Network

Use the Deception > Deployment Network page to set up a monitoring interface into a VLAN or a subnet.

To add a VLAN or subnet to FortiDeceptor:

1. Go to Deception > Deployment Network.
2. Enable Auto VLAN Detection to automatically detect the VLANs on your network.

Auto VLAN detection allows FortiDeceptor to detect the available VLANs on the deployment network interface and display them in the GUI. You can select and add the VLANs for the deployment of Decoys later.

3. Select the Detection Interface and click OK.

You can select multiple ports.

4. Click Add New VLAN/Subnet to manually add a VLAN or a subnet. Configure the following settings:

5. Click Save.

The network IP/mask must be an IP address and not a subnet.

You must use the following guidelines to set the network IP/mask:

• Interface name and VLAN ID must be unique among all network IP/masks.
• If VLAN ID is 0, the network IP/mask must be unique among all the network IP/masks without VLAN and all system interfaces.
• If VLAN is not 0, the network IP/mask must be unique among all subnets in the same VLAN.

Deploy Decoy VMs with the Deployment Wizard

Use the Deception > Deployment Wizard page to create and deploy Decoy VMs on your network. Decoy VMs appear as real endpoints to hackers and can collect valuable information about attacks.

To deploy Decoys on the network:

1. Go to Deception > Deployment Wizard.
2. Click + to add a Decoy VM.
3. Configure the following:

4. For an Ubuntu VM, turn on SSH or SAMBA. For Windows, turn on RDP or SMB.

For SCADA, turn on HTTP, FTP, TFTP, SNMP, MODBUS, S7COMM, BACNET, IPMI, TRICONEX, GUARDIANAST, or IEC104.

5. Click Add Lure for the service and configure the following:

6. To launch the decoy VM immediately, enable Launch Immediately.
7. To reset the decoy VM after it detects incidents, enable Reset Decoy and specify the Reset Interval value in seconds.
8. Click Next.
9. The Hostname can start with an English character or a digit, and must not end with a hyphen. Maximum 15 characters using A-Z, a-z, 0-9, or hyphen (case-sensitive). Other symbols, punctuation, or white space are not allowed. The Hostname cannot conflict with decoy names.
10. Click Add Interface.
11. Select the Deploy Interface. Set this to the VLAN or subnet added in Set up the Deployment Network on page 10
12. Configure the following settings in the Add Interface forDecoy pane:

13. Click Done.
14. To deploy the decoys on the network, click Deploy.
15. To save this as a template in Deception > Deployment Wizard, click Template.

Deploy the FortiDeceptor Token Package

Use a FortiDeceptor Token Package to add breadcrumbs on real endpoints and lure an attacker to a Decoy VM. Tokens are normally distributed within real endpoints and other IT assets on the network to maximize the deception surface.

To download a FortiDeceptor Token Package:

1. Go to Deception > Decoy & Lure Status.
2. Select the Decoy VM by clicking its checkbox.
3. To download the FortiDeceptor Token Package, click Download Package.

You can only download packages with valid IP addresses. A package must have a status of Initialized, Stopped, Running, or Failed.

To deploy or uninstall a FortiDeceptor Token Package on an existing endpoint:

1. Copy the downloaded FortiDeceptor Token Package to an endpoint such as a Windows or Linux endpoint.
2. Unzip the FortiDeceptor Token Package.
3. In the folder for the OS, such as windows or ubuntu, follow the instructions in txt to install or uninstall the Token Package.

l For Windows, open the windows folder, right-click windows_token.exe and select Run as administrator. l For Ubuntu, open Terminal and run python ./ubuntu_token.py.

When the FortiDeceptor Token Package is installed on a real Windows or Ubuntu endpoint, it increases the deception surface and lures the attacker to a Decoy VM.

Monitor Decoy & Lure Status

The Deception > Decoy & Lure Status page shows the status of the Decoys on your network.

We recommend operating Decoy VMs with the same status for expected behavior.

To view the Deception Status:

1. Go to Deception > Decoy & Lure Status.

To delete one or more Decoy VMs:

1. Go to Deception > Decoy & Lure Status.
2. Click Delete beside the Decoy VM.
3. Click OK.

To start one or more Decoy VM:

1. Go to Deception > Decoy & Lure Status.
2. Select one or more Decoy VMs that are stopped.
3. Click Start.

To stop one or more Decoy VMs:

1. Go to Deception > Decoy & Lure Status.
2. Select one or more Decoy VMs that are running.
3. Click Stop.

Decoy Map

Deception > Decoy Map is a visual representation of the entire network showing real endpoints and Decoy VMs. You can apply filters to focus on specific decoys.

To work with the Decoy Map:

1. Go to Deception > Decoy Map. l To change the display, drag items to another location. l Scroll to zoom in or out.

l Click a node to see its information.

2. Click Click to begin filtering to select a filter type and type values. Filter types include Decoy Name, Decoy IP, and Lure Type.

You can use multiple arguments with different filter types. All filter arguments and time indicator arguments are considered “AND” conditions.

3. To locate the node on the map, use the LOCATE BY IP
4. To save a snapshot of the map, click Save view .

Configure a Whitelist

Use the Deception > Whitelist page to add an IP address for an administrator to log into the network. User actions from a whitelisted IP address are recorded as an Event or Incident.

To add a new whitelist IP address:

1. Go to Deception > Whitelist.
2. Click Add New Whitelist IP and configure its settings:

DMZ Mode

Deploy a FortiDeceptor hardware unit or VM in the Demilitarized Zone (DMZ). You can monitor attacks on the DMZ network when FortiDeceptor is installed in the DMZ network.

Limitations of the DMZ Mode

The DMZ Mode in FortiDeceptor functions like regular mode with the following exceptions:

• When DMZ mode is enabled, the banner displays DMZ-MODE.
• In Deception > Deployment Network, Deception MonitorIP/Mask is hidden. See Set up the Deployment Network on page 10.
• In Deception > Decoy & Lure Status in the Deception Status view, the Attack Test selection is disabled.
• Decoy VMs are limited to one deploy Interface. For information about IP address range, see Deploy Decoy VMs with the Deployment Wizard on page 10.

To enable DMZ mode in the CLI:

dmz-mode -e

To disable DMZ mode in the CLI: dmz-mode -d

Set up FortiDeceptor

This section explains the initial set up of FortiDeceptor.

Connect to the GUI

Use the GUI to configure and manage FortiDeceptor.

To connect to the FortiDeceptor GUI:

1. Connect the port1 (administration) interface of the device to a management computer using an Ethernet cable.
2. Configure the management computer to be on the same subnet as the internal interface of the FortiDeceptor unit:
   • Change the IP address of the management computer to 168.0.2.
   • Change the IP address of the network mask to 255.255.0.
3. Go to https://192.168.0.99.
4. Type admin in the Name field, leave the Password field blank, and click Login.

You can now proceed with configuring your FortiDeceptor unit.

Connect to the CLI

You can use CLI commands to configure and manage FortiDeceptor.

To connect to the FortiDeceptor CLI:

1. In the FortiDeceptor banner at the top, click the CLI Console

The CLI Console pane opens.

2. If necessary, click Connect and enter your username and password.

The CLI Console pane has icons to disconnect from the CLI console, clear console text, download console text, copy console text, open the CLI console in its own window, and close the console.

3. To close the CLI console, click the Close

Change the system hostname

The System Information widget displays the full host name. You can change the FortiDeceptor host name.

To change the host name:

1. Go to Dashboard, System Information
2. Click Change beside Host Name.
3. In the New Name field, type a new host name.

The hostname can start with a character or digit, and cannot end with a hyphen. A-Z, a-z, 0-9, or hyphen are allowed (case-sensitive). Other symbols, punctuation, or white space are not allowed.

4. Click Apply.

Change the administrator password

By default, you can log in to the GUI using admin and no password. It is highly recommended that you add a password to the admin account. For better security, regularly change the admin account password and the passwords for any other administrator accounts that you add.

To change the password of the logged in administrator:

1. In the FortiDeceptor banner at the top, click the username and select Change Password.
2. Change the password and click OK.

To change the administrator password in the Administrators page:

1. Go to System > Administrators.
2. Select an administrator and click Edit.
3. Change the password and click OK.

Configure the system time

You can change the FortiDeceptor system time in the Dashboard. You can configure the FortiDeceptor system time manually or synchronize with an NTP server.

To configure the system time:

1. Go to Dashboard, System Information
2. Click Change beside System Time.
3. Set the system time and click Apply. You might need to log in again.