FortiSIEM Disk Growth Trend – Daily

Leave a reply

Disk Growth Trend – Daily

Event Type: PH_DEV_MON_SYS_DISK_TREND_DAY

Description: Event containing disk usage growth trend – daily view Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

Event Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive

Time

 phRecvTime Date Time at which AccelOps generated this event
Reporting IP reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name hostName string Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Host IP

Address

 hostIpAddr IP Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk Name diskName string Disk name
Disk Capacity

Util

 diskUtil double Disk utilization for a specific disk name (between 0-100).
Free Disk (MB) freeDiskMB uint32 Size of free disk available in MBytes
Total Disk (MB) totalDiskMB uint32 Size of total disk in MBytes
Used Disk (MB) usedDiskMB uint32 Size of used disk in MBytes
Current Daily

Disk Growth

(MB)

 diskGrowthMBDaily double Disk growth (MB) for the current day
Avg Daily Disk

Growth (MB)

 avgDiskGrowthMBDaily double Running avg of daily disk growth (MB) overall previous days
Days To Disk

Full

 timeToDiskFull uint32 Number of days until disk is full (from daily growth statistics)
Poll Interval pollIntv uint32 Polling interval in seconds.

FortiSIEM Network Interface Monitoring

Leave a reply

Network Interface Monitoring

Event Type: PH_DEV_MON_NET_INTF_UTIL

Description: Event containing network interface utilization metrics Source – almost all devices via SNMP:

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

NetApp DataONTAP (SNMP)

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP)

Sample event

[PH_DEV_MON_NET_INTF_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phIn tfFilter.cpp,[lineNumber]=275,[intfName]=GigabitEthernet4/41,[intfA lias]=Connection to Internet,[hostName]=SJ-Main-Cat6500,[hostIpAddr]=192.168.0.1,[pollI ntv]=177,[recvBytes]=0,[recvBitsPerSec]=0.000000,[inIntfUtil]=0.000 000,[sentBytes]=0,[sentBitsPerSec]=0.000000,[outIntfUtil]=0.000000,

[recvPkts]=0,[sentPkts]=0,[inIntfPktErr]=0,[inIntfPktErrPct]=0.0000 00,[outIntfPktErr]=0,[outIntfPktErrPct]=0.000000,[inIntfPktDiscarde d]=0,[inIntfPktDiscardedPct]=0.000000,[outIntfPktDiscarded]=0,[outI ntfPktDiscardedPct]=0.000000,[outQLen]=0,[intfSpeed64]=1000000000,[ intfAdminStatus]=up,[intfOperStatus]=down,[daysSinceLastUse]=487,[p hLogDetail]=

Key Attributes:

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_NET_INTF_UTIL
Event

Severity

 eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event

Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event

Receive

Time

 phRecvTime Date Time at which AccelOps generated this event
Reporting IP reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.

 

Raw Event

Log

 rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name hostName string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP

Address

 hostIpAddr IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host Intf

Name

 intfName string The name of the network interface for which this statistics applies
In Intf Util inIntfUtil double Inbound (or received) network utilization (between 0-100).
Received

Bytes

 recvBytes uint32 Inbound (or received) bytes during this interval
Received

Byte Rate

(/sec)

 recvBytesPerSec double Inbound (or received) byte rate during this interval
Received

Packets

 recvPkts uint32 Inbound (or received) packets received during this interval
In Packet

Error

 inIntfPktErr uint32 Inbound (or received) packet errors
In Packet

Error Pct

 inIntfPktErrPct double Inbound (or received) packet error as a percentage of total packets
In Packet

Discards

 inIntfPktDiscarded uint32 Inbound (or received) packet discarded
In Packet

Discard Pct

 inIntfPktDiscardedPct double Inbound (or received) packet discarded as a percentage of total packets
Out Intf Util outIntfUtil double Outbound (or sent) network utilization (between 0-100).
Sent Bytes sentBytes uint32 Outbound (or sent) bytes during this interval
Sent Byte

Rate (/sec)

 sentBytesPerSec double Inbound (or received) byte rate during this interval
Sent Packets sentPkts uint32 Outbound (or sent) packets sent during this interval
Out Packet

Error

 outIntfPktErr double Outbound (or sent) packet errors
Out Packet

Error Pct

 outIntfPktErrPct double Outbound (or sent) packet error as a percentage of total packets
Out Packet

Discards

 outIntfPktDiscarded uint32 Outbound (or sent) packet discarded
Out Packet

Discard Pct

 outIntfPktDiscardedPct double Outbound (or sent) packet discarded as a percentage of total packets
Out Queue

Length

 outQLen uint32 Length of output queue
Poll Interval pollIntv uint32 Polling interval in seconds

 

 

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_SYS_DISK_TREND_DAY
Event Severity eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)

FortiSIEM Disk I/O Monitoring

Leave a reply

Disk I/O Monitoring

Event Type: PH_DEV_MON_DISK_IO_UTIL

Description: Event containing disk utilization metrics Source:

Microsoft Windows (WMI), Linux (SSH), HP-UX (SSH), IBM AIX (SSH)

NetApp DataONTAP (SNMP)

Key Attributes:

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_DISK_IO_UTIL
Event

Severity

 eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event

Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event

Receive

Time

 phRecvTime Date Time at which AccelOps generated this event
Reporting

IP

 reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event

Log

 rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name hostName string Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Host IP

Address

 hostIpAddr IP Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk Name diskName string Disk name
Disk Read

Rate (KBps)

 diskReadKBytesPerSec double Disk read rate in KBytes/sec.
Disk Write

Rate (KBps)

 diskWriteKBytesPerSec double Disk write rate in KBytes/sec.
Disk Read

Rate (/sec)

 diskReadReqPerSec double Disk read rate in read IO per sec.
Disk Write

Rate (/sec)

 diskWriteReqPerSec double Disk write rate in write IO per sec.
Disk IO Util diskIOUtil double Disk I/O utilization
Disk Read

Latency

(ms)

 devDiskRdLatency double Disk Read Latency – for Windows (WMI) only
Disk Write

Latency

(ms)

 devDiskWrLatency double Disk Write latency – for Windows (WMI) only
Disk Queue

Length

 diskQLen uint32 Disk Queue Length – for Windows (WMI) only
Poll Interval pollIntv uint32 Polling interval in seconds.

FortiSIEM Disk space Monitoring

1 Reply

Disk space Monitoring

Event Type: PH_DEV_MON_SYS_DISK_UTIL

Description: Event containing disk utilization metrics Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

Reporting IP reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as

Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event

Log

 rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name hostName string Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Host IP

Address

 hostIpAddr IP Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk Name diskName string Disk name
Disk

Capacity Util

 diskUtil double Disk utilization for a specific disk name (between 0-100).
Free Disk

(MB)

 freeDiskMB uint32 Size of free disk available in MBytes
Total Disk

(MB)

 totalDiskMB uint32 Size of total disk in MBytes
Used Disk

(MB)

 usedDiskMB uint32 Size of used disk in MBytes
Poll Interval pollIntv uint32 Polling interval in seconds.

AccelOps Generated Event Format

Leave a reply
AccelOps Generated Event Format
AccelOps Generated Events

AccelOps is an event based analytics system. When it monitors systems and applications, it produces events containing the collected metrics this section describes details of such events. This can used to write custom queries, reports and rules.

System Performance Monitoring Events

Availability Monitoring Events

VMware Monitoring Events

Hardware Monitoring Events

Application Monitoring Events

Network Flow Monitoring Events

Security Information Management

System Performance Monitoring Events

System Performance Monitoring Events

AccelOps generates the following events related to system monitoring events

CPU Monitoring Event

Memory Monitoring

Disk space Monitoring

Disk I/O Monitoring

Network I/O Monitoring

Disk Growth Trend – Daily

Disk Growth Trend – Weekly

Disk Growth Trend – Monthly

CPU Monitoring

Event Type: PH_DEV_MON_SYS_CPU_UTIL

Description: Event containing CPU utilization metrics

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

NetApp DataONTAP

Microsoft Windows (SNMP, WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) Key Attributes:

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_SYS_CPU_UTIL
Event

Severity

 eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event

Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event

Receive

Time

 phRecvTime Date Time at which AccelOps generated this event
Reporting IP reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as

Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event

Log

 rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name hostName string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP

Address

 hostIpAddr IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
CPU

utilization

 cpuUtil double Overall CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system.
User CPU

Utilization

 sysCpuUtil double User CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Av ailable for Linux (via SNMP) only.
System

CPU

Utilization

 userCpuUtil double System CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Available for Linux (via SNMP) only.
Poll Interval pollIntv uint32 Polling interval in seconds

Memory Monitoring

Event Type: PH_DEV_MON_SYS_MEM_UTIL

Description: Event containing system memory utilization metrics Source:

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

 

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_SYS_DISK_UTIL
Event

Severity

 eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event

Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event

Receive

Time

 phRecvTime Date Time at which AccelOps generated this event

Microsoft Windows (SNMP, WMI), Linux (SNMP,SSH), Solaris (SNMP), HP-UX (SNMP,SSH), IBM AIX (SNMP,SSH) Key Attributes:

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_SYS_MEM_UTIL
Event Severity eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to

Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive

Time

 phRecvTime Date Time at which AccelOps generated this event
Reporting IP reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as

Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name hostName string Host name (as in AccelOps CMDB) of the device whose memory utilization is being reported
Host IP

Address

 hostIpAddr IP Access IP (as in AccelOps CMDB) of the device whose memory utilization is being reported
Memory

utilization

 memUtil double Overall system physical memory utilization (between 0-100).
Buffer Memory

(KB)

 bufMemKB uint32 Size of buffered memory. Available for Linux (via SNMP) only.
Cache Memory

(KB)

 cacheMemKB uint32 Size of cached memory. Available for Linux (via SNMP) only.
Swap memory

Utilization

 swapMemUtil double Swap Memory Utilization. Available for Linux (via SNMP) only.
Free Swap

Memory (KB)

 freeSwapMemKB uint32 Free Swap Memory. Available for Linux (via SNMP) only.
Swap Read

Rate

(Pages/sec)

 swapInRate double Rate at which pages are swapped in. Available for Windows (WMI), Linux (SSH), HP-UX (SSH), IBM AIX (SSH).
Swap Write

Rate

(Pages/sec)

 swapOutRate double Rate at which pages are swapped out. Available for Windows (WMI), Linux (SSH), HP-UX (SSH), IBM AIX (SSH).
Poll Interval pollIntv uint32 Polling interval in seconds.

FortiSIEM Event Attribute Master List Troubleshooting

1 Reply
Event Attribute Master List

This section describes the master list of event attributes. Events are parsed into these attributes and used in Accelops analytics. There are 4 broad categories of event attributes

Generic Attributes

Network Attributes

System Attributes

Application Attributes

Environmental Attributes

Generic Attributes
Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_SYS_CPU_UTIL
Event Name eventName string
Event Severity eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
IPS Event Risk

Rating

 ipsEvRR
IPS Event Threat

Rating

 ipsEvTR
Event ID eventId
Event Receive

Time

 phRecvTime Date Time at which AccelOps generated this event
Device Time deviceTime Date
Event Action eventAction uint16
Reporting IP reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Reporting Device

Name

 reptDevName string
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Relaying Device

Name

 relayDevName string
Raw Event Log rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
Poll Interval pollIntv uint32 Polling interval in seconds
Customer ID phCustId
Customer Name customer
Agent ID phAgentId
Event Rate (/sec) eventsPerSec
Peak Event Rate

(/sec)

 peakEventsPerSec
Event Parse

Status

 eventParsedOK
Incident Source incidentSrc
Incident Target incidentTarget
Incident Reporting

IP

 incidentRptIp
Incident Trigger

Attribute List

 triggerAttrList
Incident Detail incidentDetail
Incident ID incidentId
Incident Status incidentStatus
Incident First

Occurrence Time

 incidentFirstSeen
Incident Last

Occurrence Time

 incidentLastSeen
Incident Ticket ID incidentTicketId
Incident Ticket

Status

 incidentTicketStatus
Incident Ticket

User

 incidentTicketUser
Incident

Comments

 incidentComments
Incident View

Status

 incidentViewStatus
Incident View

Users

 incidentViewUsers
Incident Cleared

Time

 incidentClearedTime
Incident Cleared

User

 incidentClearedUser
Incident Cleared

Reason

 incidentClearedReason
Incident

Notification

Recipients

 incidentNotiRecipients
Network Attributes
Name Id Type Description
Source IP srcIpAddr IP Source IP address of the flow
Source Host Name srcName
Host IP hostIpAddr IP
Host Name hostName
Dest IP destIpAddr IP Destination IP address of the flow
Dest Name destName
Source MAC srcMACAddr
Dest MAC destMACAddr
Host MAC hostMACAddr
IP Protocol ipProto uint16 IP protocol e.g. TCP/UDP/GRE/ICMP etc
Source TCP/UDP Port srcIpPort uint16 Source TCP/UDP port
Dest TCP/UDP Port destIpPort uint16 Destination TCP/UDP port
ICMP Type icmpType uint16 ICMP type
ICMP Code icmpCode uint16 ICMP code
IP Type of Service tos uchar IP Type of Service
Sent TCP flags srcDestTCPFlags uchar OR-ed TCP Flags from Source to Destination
Received TCP flags destSrcTCPFlags uchar OR-ed TCP Flags from Destination to Source
Source Intf SNMP Index srcSnmpIntfIndex uint16 Source SNMP interface index
Dest Intf SNMP Index destSnmpIntfIndex uint16 Destination SNMP interface index
Source Intf name srcIntfName
Dest Intf Name destIntfName
Host Intf Name intfName
Source Autonomous System Number srcASNum uint16 Source Autonomous number

 

Dest Autonomous System Number destASNum uint16 Destination Autonomous number
Source VLAN srcVLAN
Dest VLAN destVLAN
Host VLAN hostVLAN
Sent Bytes sentBytes uint32 Sent Bytes in this flow
Sent Packets sentPkts uint32 Sent Packets in this flow
Sent Bytes Rate (/sec) sentBytesPerSec
Received Bytes recvBytes uint32 Received Bytes in this flow
Received Packets recvPkts uint32 received Packets in this flow
Received Bytes Rate (/sec) recvBytesPerSec
Total Bytes totBytes
Total Packets totPkts
Total Byte rate (/sec) totBytesPerSec
Total Packet Rate (/sec) totPktsPerSec
Duration durationMsec
Intf Out Queue Length outQlen
In Packet Error inIntfPktErr
Out Packet Error outIntfPktErr
In Packet Error Pct inIntfPktErrPct
Out Packet Error Pct outIntfPktErrPct
In Intf Util inIntfUtil double
Out Intf Util outIntfUtil double
In Packet Discard inIntfPktDiscarded
Out Packet Discard outIntfPktDiscarded
In Packet Discard Pct inIntfPktDiscardedPct
Out Packet Discard Pct outIntfPktDiscarded
Source Firewall Zone srcFwZone
Dest Firewall Zone destFwZone
Min Jitter minJitterMs
Max Jitter maxJitterMs
Avg Jitter avgJitterMs
Min SD Jitter minJitterSDMs
Max SD Jitter maxJitterSDMs
Avg SD Jitter avgJitterSDMs
Min DS Jitter minJitterDSMs
Max DS Jitter maxJitterDSMs
Avg DS Jitter avgJitterDSMs
Packets Lost pktLost
Packets SD Lost pktLostSD
Packets DS Lost pktLostDS
Packets Missing pktMIA
Packets Late pktLate
Packets Out-of-Seq pktOutSeq
VoIP MOS Score mosScore
VoIP ICPIF Score icpifScore
VoIP Codec codec
VoIP Phone Status voIPPhoneStatus
Calling Party Number callingPartyNumber
Original Called Party Number originalCalledPartyNumber

 

Final Called Party Number finalCalledPartyNumber
Call Connect Time dateTimeConnect
Call Disconnect Time dateTimeDisconnect
Call Duration callDuration
CBQoS Policy Name qosPolicy
CBQoS Class Name qosClass
CBQoS Conform KBps qosConformRate
CBQoS Exceeded KBps qosExceedRate
CBQoS Violated KBps qosViolateRate
CBQoS PrePolice KBps qosPrePoliceRate
CBQoS PostPolice KBps qosPostPoliceRate
CBQoS Drop KBps qosDropRate
CBQoS Drop Pct qosDropPct
CBQoS Curr Queue Length qosCurrQueue
CBQoS Max Queue Length qosMaxQueue
CBQoS Discarded Pkt qosDiscardPkt
OSPF State ospfState
BGP State bgpState
OSPF Area Id ospfAreaId
Source FiberChannel WWN Id srcWWN
Dest FiberChannel WWN Id destWWN
wlanSsid
wlanControllerIp
wlanContrHostName
wlanUserCount
wlanSuppChannels
wlanSendutil
wlanRecvUtil
wlanChannelUtil
wlanPoorSNRUserCount
ifLoadProfile
ifIntefProfile
ifCoverageProfile
ifNoiseProfile
wlanRssi
wlanSnr
wlanMobilityStatus
wlanProtocol
wlanAssocUpTime
wlanMaxHostTxmitRate
ifCoverageIndx
ifNoseIndx
ifIntefIndex
System Attributes
Name Id Type Description
Computer computer
Target Computer targetComputer

 

Domain domain
Target Domain targetDomain
Source Domain srcDomain
Destination Domain destDomain
Operating System Type osType
Operating System

Version

 osVersion
File Name fileName
Object Type osObjType
Object Name osObjName
Target Object Type targetOsObjType
Target Object Name targetOsObjName
Object Handle osObjHandleID
Object Access Type osObjAccessType
Object Action osObjAction
System Uptime sysUpTime
System Uptime Pct sysUpTimePct double
System Downtime sysDownTime
CPU Name cpuName string
CPU utilization cpuUtil double Overall CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system.
User CPU Utilization userCpuUtil double User CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Available for Linux (via SNMP) only.
System CPU Utilization sysCpuUtil double System CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Available for Linux (via SNMP) only.
Memory Name memName string
Memory Utilization memUtil double
Free memory (KB) freeMemKB uint32
Buffer Memory (KB) bufMemKB uint32
Cache Memory (KB) cacheMemKB uint32
Swap Memory Utilization swapMemUtil double
Free Swap Memory (KB) freeSwapMemKB uint32
Minimum Swap Memory

(KB)

 memMinimumSwap uint32
Swap Memory Error

Message

 swapMemErrorString string
Swap Read (Pages/sec) swapInRate double
Swap Write (Pages/sec) swapOutRate double
Total Swap (Pages/sec) swapRate double
Swap Read (KBps) swapReadKBytesPerSec
Swap Write (KBps) swapWriteKBytesPerSec
Total Read I/O Rate

(KBps)

 ioReadKBytesPerSec
Total Write I/O Rate

(KBps)

 ioWriteKBytesPerSec
Disk Name diskName
Disk Utilization diskUtil
Free Disk (MB) freeDiskMB
Total Disk (MB) totalDiskMB
Used Disk (MB) usedDiskMB
Disk Queue Length diskQLen

 

Current Daily Disk

Growth

 diskGrowthMBDaily
Current Weekly Disk

Growth

 diskGrowthMBWeekly
Current Monthly Disk

Growth

 diskGrowthMBMonthly
Average Daily Disk

Growth

 avgDiskGrowthMBDaily
Average Weekly Disk

Growth

 avgDiskGrowthMBWeekly
Average Monthly Disk

Growth

 avgDiskGrowthMBMonthly
Days To Disk Full timeToDiskFull
RAID Group Id raidGrpId
RAID Type raidType
Application Attributes
Name Id Type Description
Application Name appName string Short descriptive name of the process, e.g. “Microsoft IIS”
Application Group Name appGroupName string Name of the application group to which the process belongs; e.g. “Microsoft IIS”
Software Name swProcName string Process/Executable name; e.g. svchost.exe
Software Param swParam string Process/Executable parameters, e.g. “-k iissvc”
CPU utilization cpuUtil double Process CPU utilization (between 0-100).
Memory utilization memUtil double Process memory utilization (between 0-100).
Real Peak Memory (KB) realMemPeakKBytes uint32 Peak real memory usage (KBytes).
Disk Read Rate (KBps) diskReadKBytesPerSec double Process disk read rate (KBytes/sec).
Disk Write Rate (KBps) diskWriteKBytesPerSec double Process disk write rate (KBytes/sec).
Environmental Attributes
Name Id Type Description
Hardware Status hwStatusCode string
Hardware Battery Status hwBatteryStatus
Hardware Disk Status hwDiskStatus
Hardware Power Supply Status hwPowerSupplyStatus
Hardware Temp Sensor Status hwTempSensorStatus
Hardware Fan Status hwFanStatus
Hardware Amp Status hwAmpStatus
Hardware Voltage Status hwVoltageStatus
Hardware Memory Status hwMemoryStatus
Hardware Log Status hwLogStatus
Hardware Processor Status hwProcStatus
Hardware Power Chord Status hwPowerChordStatus
Hardware Storage Controller Status hwStorageControllerStatus
HardwareStorage Channel  Status hwStorageChannelStatus
Hardware Storage Enclosure Status hwStorageEnclosureStatus

 

Hardware Power Supply Status hwStoragePowerSupplyStatus
Hardware Storage Fan Status hwStorageFanStatus
Hardware Storage Temp Status hwStorageTempStatus
Hardware EMM Status hwStorageEMMStatus
Hardware Log Disk Status logDiskStatus
Failed Power Supply Count hwFailedPowerSupplyCount
Storage LLC Status hwLLCStatus
Storage Link Status hwLinkStatus
Storage Port Status hwPortStatus
Hardware Misc Component Status hwMiscCompStatus
Host Spare Disk Count hwHotSpareDiskCount
UPS Battery Status upsBatteryStatus
UPS Remaining Battery Charge (Pct) upsRemainBatteryChargePct
UPS Replace Battery Indicator upsReplaceBatteryIndicator
UPS Time On Battery (sec) upsTimeOnBattery
UPS Output Status upsBasicOutputStatus
UPS Output Load upsAdvOutputLoad
UPS Output Voltage (V) upsAdvOutputVoltage
UPS Output Frequency (Hz) upsAdvOutputFreq
UPS  Battery Current (Amp) upsBatteryCurrent
UPS Battery Temperature (C) upsBatteryTempC
UPS Battery Voltage upsBatteryVoltage
UPS Estimated Time Remaining (sec) upsEstSecRemain
Temperature (C) envTempDegC
High Temperature Threshold (C) envTempHighThreshDegC
Low Temperature Threshold (C) envTempLowThreshDegC
Temperature Offset High (C) envTempOffHighDegC
Temperature Offset Low (C) envTempOffLowDegC
Temperature (F) envTempDegF
High Temperature Threshold (F) envTempHighThreshDegF
Low Temperature Threshold (F) envTempLowThreshDegF
Temperature Offset High (F) envTempOffHighDegF
Low Temperature Threshold (F) envTempOffLowDegF
Relative Humidity envHumidityRel
High Relative Humidity Threshold envHumidityRelHighThresh
Low Relative Humidity Threshold envHumidityRelLowThresh
Humidity Offset High envHumidityOffHigh
Humidity Offset Low envHumidityOffLow
Liebert HVAC System State lgpSystemState
Liebert HVAC Cooling State lgpCoolingState
Liebert HVAC Heating State lgpHeatingState
Liebert HVAC Humidifying State lgpHumidState
Liebert HVAC Dehumidifying State lgpDehumidState
Liebert HVAC Economy Cycle State lgpEconCycle
Liebert HVAC Fan State lgpFanState
Liebert HVAC Cooling capacity envCoolCap
Liebert HVAC Heating Capacity envHeatCap
outputVoltageXNVolts

 

 

 

 

FortiSIEM The IPS Vulnerability Map

Leave a reply
The IPS Vulnerability Map

The IPS Vulnerability Map lists devices that have a known vulnerability. You can view the IPS Vulnerability Map by going to Incidents > IPS Vunerability Map, and you can also add new devices to the map.

The IPS Vulnerability Map includes these columns.

Column Description
IPS Event Types The event types associated with the vulnerability
Vendor Vulnerability ID The vulnerability ID provided by the device vendor
CVE IDs The vulnerability ID provided by Common Vulnerabilities and Exposures
Vulnerability Description A brief description of the device’s vulnerability
Found in Device Type Specific devices or applications that have the vulnerability
Found in Version The version of the device or application that has the vulnerability
Fixed in Version The version in which the vulnerability was fixed
Fixed via Patches The patch version in which the vulnerability was fixed

 

Adding Entries to the IPS Vulnerabilities Map

 

Adding Entries to the IPS Vulnerabilities Map

  1. Go to Incidents > IPS Vulnerability Map.
  2. Click Add.
  3. Select the IPS Event Type associated with the vulnerability.
  4. Enter any Vendor Vulnerability ID
  5. Enter any CVE ID

See the Common Vulnerability and Exposures website for CVE IDs. Separate multiple IDs with commas.

  1. Enter a Vulnerability Description.
  2. For Affected Software, click Add, and then select the affected devices or applications from the Found in Device Type
  3. Enter any Found in Version information for the affected software.
  4. Enter any fix information for the vulnerability.
  5. Click OK.
  6. Click Save.

FortiSIEM Monitoring Custom Applications

Leave a reply
Monitoring Custom Applications

While FortiSIEM provides support for many applications, there may also be situations in which you have a custom application running in your infrastructure that you want to monitor. This topic explains how to set up FortiSIEM to monitor that application, and add it to a business service.

  1. Log in to your Supervisor.
  2. Go to CMDB > Applications, and either select a group where you want to add the application, or create a new one.
  3. Click New, and enter an Application Name and a Process Name.
  4. Click Save.
  5. Initiate discovery of the server where the application is running.
  6. Go to CMDB > Devices and select the server.
  7. Click the Software tab and make sure the application has been discovered.
  8. Go to General Settings > Monitoring > Important Processes.
  9. Click Add and enter the name of the process that the application is running on.
  10. Click Apply All.
  11. Run a structured historical search using these attributes to make sure the process utilization metrics are being received by FortiSIEM.
Attribute Value
Reporting IP The IP address of the server where the application is running
Event Type PH_DEV_MON_PROC_RESOURCE_UTIL
Application Name The name of the application
  1. Add your application to a business service.

You should now be able to go Dashboard > Summary Dashboards > Biz Service Summary and see your process running under Top Monitored Processes when you select the associated business service.