Disk I/O Monitoring

Event Type: PH_DEV_MON_DISK_IO_UTIL

Description: Event containing disk utilization metrics Source:

Microsoft Windows (WMI), Linux (SSH), HP-UX (SSH), IBM AIX (SSH)

NetApp DataONTAP (SNMP)

Key Attributes:

Disk space Monitoring

Event Type: PH_DEV_MON_SYS_DISK_UTIL

Description: Event containing disk utilization metrics Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

AccelOps Generated Event Format

AccelOps Generated Events

AccelOps is an event based analytics system. When it monitors systems and applications, it produces events containing the collected metrics this section describes details of such events. This can used to write custom queries, reports and rules.

System Performance Monitoring Events

Availability Monitoring Events

VMware Monitoring Events

Hardware Monitoring Events

Application Monitoring Events

Network Flow Monitoring Events

Security Information Management

System Performance Monitoring Events

System Performance Monitoring Events

AccelOps generates the following events related to system monitoring events

CPU Monitoring Event

Memory Monitoring

Disk space Monitoring

Disk I/O Monitoring

Network I/O Monitoring

Disk Growth Trend – Daily

Disk Growth Trend – Weekly

Disk Growth Trend – Monthly

CPU Monitoring

Event Type: PH_DEV_MON_SYS_CPU_UTIL

Description: Event containing CPU utilization metrics

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

NetApp DataONTAP

Microsoft Windows (SNMP, WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) Key Attributes:

Memory Monitoring

Event Type: PH_DEV_MON_SYS_MEM_UTIL

Description: Event containing system memory utilization metrics Source:

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

Microsoft Windows (SNMP, WMI), Linux (SNMP,SSH), Solaris (SNMP), HP-UX (SNMP,SSH), IBM AIX (SNMP,SSH) Key Attributes:

Event Attribute Master List

This section describes the master list of event attributes. Events are parsed into these attributes and used in Accelops analytics. There are 4 broad categories of event attributes

Generic Attributes

Network Attributes

System Attributes

Application Attributes

Environmental Attributes

Generic Attributes

Network Attributes

System Attributes

Application Attributes

Environmental Attributes

The IPS Vulnerability Map

The IPS Vulnerability Map lists devices that have a known vulnerability. You can view the IPS Vulnerability Map by going to Incidents > IPS Vunerability Map, and you can also add new devices to the map.

The IPS Vulnerability Map includes these columns.

Adding Entries to the IPS Vulnerabilities Map

Adding Entries to the IPS Vulnerabilities Map

2. Go to Incidents > IPS Vulnerability Map.
3. Click Add.
4. Select the IPS Event Type associated with the vulnerability.
5. Enter any Vendor Vulnerability ID
6. Enter any CVE ID

See the Common Vulnerability and Exposures website for CVE IDs. Separate multiple IDs with commas.

7. Enter a Vulnerability Description.
8. For Affected Software, click Add, and then select the affected devices or applications from the Found in Device Type
9. Enter any Found in Version information for the affected software.
10. Enter any fix information for the vulnerability.
11. Click OK.
12. Click Save.

Monitoring Custom Applications

While FortiSIEM provides support for many applications, there may also be situations in which you have a custom application running in your infrastructure that you want to monitor. This topic explains how to set up FortiSIEM to monitor that application, and add it to a business service.

1. Log in to your Supervisor.
2. Go to CMDB > Applications, and either select a group where you want to add the application, or create a new one.
3. Click New, and enter an Application Name and a Process Name.
4. Click Save.
5. Initiate discovery of the server where the application is running.
6. Go to CMDB > Devices and select the server.
7. Click the Software tab and make sure the application has been discovered.
8. Go to General Settings > Monitoring > Important Processes.
9. Click Add and enter the name of the process that the application is running on.
10. Click Apply All.
11. Run a structured historical search using these attributes to make sure the process utilization metrics are being received by FortiSIEM.

12. Add your application to a business service.

You should now be able to go Dashboard > Summary Dashboards > Biz Service Summary and see your process running under Top Monitored Processes when you select the associated business service.

Dynamic Population of Location, User, and and Geolocation Information for Events

In most cases, network logs only contain IP address information, but to investigate incidents involving that IP, you need additional context for that IP address such as host name, user, and geolocation information. Because FortiSIEM collects detailed IT infrastructure information in the CMDB, it is able to correlate that information to the IP address to create a context for the event, and insert that context information into events in real time as parsed attributes. This topic describes the way in which this context information is populated into events.

Correlating Event Information

Assigning Attributes to Events

Host Name Attribute

User Name Attribute

Geolocation Attribute

Dynamic Updating of Attribute Information

Attributes Added to Events

Correlating Event Information

Event information is derived from several different sources.

1. During the discovery process, FortiSIEM discovers the host name and network interface address information during discovery and stores them in the CMDB. If any IP address other than the Access IP changes, then running a rediscovery will update the CMDB with the right information.
2. FortiSIEM collates information from various authentication logs and forms a time-based Identity and Location Report containing the IP address, MAC address, Host Name, Domain, User, Network Access Point, and Network Access Point Port for the event.
3. The geolocation database maps IP addresses to Country, State, City, Organization, Longitude, and Latitude information.

Assigning Attributes to Events

When FortiSIEM parses an event, attributes are assigned to it following this process:

Host Name Attribute

For each IP address (Host IP, Source IP, Destination IP, Reporting IP):

1. FortiSIEM checks the CMDB for an associated host name, and if one is found, then the host name is added to the event.
2. If the host name is not found in then CMDB, then FortiSIEM checks the Identity and Location Report for the host name, and if one is found, then it is added to the event.
3. If the host name is not found in either the CMDB or Identity and Location Report, then FortiSIEM runs DNS lookup for the host name, and if one is found, then it is added to the event. For performance reasons the DNS result is cached, and because excessive DNS lookups can cause event processing delays, FortiSIEM has an algorithm to dynamically bypass DNS lookup if it begins falling behind in event processing.

User Name Attribute

For Source IP, FortiSIEM checks for user information in the Identity and Location Report, and if anything is found, it is added to the event.

Geolocation Attribute

For each IP address (Host IP, Source IP, Destination IP, Reporting IP), FortiSIEM checks the geolocation database. If geolocation information is found for that IP, then  Country, State, City, Organization, Longitude, and Latitude information is added to it.

Dynamic Updating of Attribute Information

For any of these attributes, when there is a change in the infrastructure (for example, a network device has a new IP or a new user logs on to the system), the change is populated into the CMDB and/or Identity and Location Report, and the event parsing module learns of the change and starts populating events with the new metadata.

Because the FortiSIEM approach to populating event attributes is dynamic and change driven, it is always able to map the right IP address to host names and users in the face of dynamic changes in the IT infrastructure.

Attributes Added to Events

Miscellaneous Operations

Exporting Events to Files

You can run the phExportEvent tool from a Supervisor or Worker node to export events to CSV files. The file will contain these fields: