Creating Event Attributes, Event Types, and Device Types

When you create a custom parser or monitor, you must also specify the device, application, event type, and event attribute to which it applies. If these objects aren’t already included in the FortiSIEM CMDB, you can create them as a preliminary step to creating your parser or monitor.

Creating Device and Application Types

Creating Event Attribute Types Creating Event Types

Creating Device and Application Types

If the device or application that you want to create a parser or monitor for isn’t already listed in Admin > Device Support > Device/App Types, you can add it.

1. Go to Admin > Device Support > Device/App Types.
2. Click New, and then choose New Device Type or New Application Type.
3. Enter the information for the new device or application type.

4. Click Save.

Creating Event Attribute Types

Event attributes are used to capture parsed information from events. You only have to create a new attribute if the one you want use for your custom parser or monitor is not listed in Admin > Device Support > Event Attribute Types.

2. Click New.
3. Enter a Name and Display Name.
4. Select the Value Type to associate with the event attribute type.
5. Optionally enter a Display Format Type and Description.
6. Click Save.

Creating Event Types

After parsing an event or log, FortiSIEM assigns a unique event type to that event/log. When you create a new custom parser for device logs, you almost always have to add a new event type to FortiSIEM so the log events can be identified.

1. Go to Admin > Device Support > Event Types.
2. Click New.
3. Enter a Name for the new event type.
4. Select the Device Type to associate with the event type.

If the device type isn’t included in the menu options, you can add it to FortiSIEM.

5. Select the Event Type Group category for this event type.
6. Select a Severity to associate with the event type.
7. Enter an optional Description.
8. Click Save.

Creating Custom Parsers and Monitors for Devices

Creating a custom parser for device logs involves writing an XML specification for the parser, and then using a test event to make sure the logs are parsed correctly. Creating a custom monitor involves defining a performance object that you want to monitor, associating that performance object to a device type, event type, and event attribute type, and then testing to make sure that the monitored metrics are correctly received by FortiSIEM. You can create custom monitors for system and application performance, command outputs, and file monitoring.

Creating a Custom Multi-Line SSH Command Output Monitor

Creating a Custom WINEXE Command Output Monitor

Custom File Monitor

Agent-less File-Integrity Monitoring

Agent-less Target File Monitoring Custom Configuration Change Monitoring

Data Update Subscription Service

FortiSIEM is constantly developing support for additional IT infrastructure devices. By subscribing to the FortiSIEM Data Update Service, you can receive updates when support for new devices becomes available, rather than waiting for it to be included in a formal release. In addition to devices you can also receive new rules, reports, parser updates etc.

Data Update Overview

Configuring Data Update

Data Update Overview

FortiSIEM data update subscription service updates your FortiSIEM deployment with the latest device support related data as it becomes available, rather than having to wait for it to be included in a formal release.

The following items can be included in an update

New event attribute

New event types

New device type

New parsers or modifications for existing parsers

Performance monitoring templates for new devices or modified ones for existing devices

New rules or modifications for existing rules

New reports or modifications for existing reports – both CMDB report and event based reports

New groups or modifications for existing groups for Event Types, Rules, Reports, Device Groups, Application Groups Code to handle new devices

Configuring Data Update

Provide a brief (two to three sentence) description of the task or the context for the task.

Prerequisites

Procedure

Configure Data Update Server Setting

Check Available Data Updates

Apply Data Update on Supervisor

Apply Data Update on Collectors

Check whether Data Update Installed Successfully

Prerequisites

Contact FortiSIEM support and make sure that your license includes Data Update Service

Make sure you have Data Update URL – this is typically https://images.FortiSIEM.net/upgrade/ds – contact FortiSIEM to make sure that this information has not changed

Make sure you have license credentials

Procedure

Configure Data Update Server Setting

1. Log on to FortiSIEM Supervisor with Administrator credentials
2. Go to Admin > General Settings > System
3. Configure Data Update Server Setting
   1. Enter Data Update URL (see prerequisites)
   2. Enter Server Username and Server Password – these are the license credentials
   3. Specify Notify Email (optional) – you will receive email when new data updates are available d. Click Save

Check Available Data Updates

1. Log on to FortiSIEM Supervisor with Administrator credentials
2. Go to Admin > Data Update
3. Click Refresh
   1. Available data updates are shown on left
   2. Click a version on the left and the contents for that version is shown on the right
4. Check the current data version from Admin > Cloud Health > Data Update Version. The number after 3rd decimal is the data version. For example 4.4.1.38 means data version is 38.
5. Note the data version you would like to upgrade to.

Apply Data Update on Supervisor

1. SSH to FortiSIEM Supervisor as root
2. Go to /pbin
3. Download the data version by running ./phdownloaddata and specify the data version you would like to upgrade to
4. Install the data version by running ./phinstalldata

Apply Data Update on Collectors

1. Log on to FortiSIEM Supervisor with Administrator credentials
2. Go to Admin > Collector Health
   1. Select a Collector
   2. Click Download Data Update – this downloads the data files to the collector
   3. Click Install Data Update – this installs the data files on the collector
   4. Repeat for all collectors

Check whether Data Update Installed Successfully

1. Log on to FortiSIEM Supervisor with Administrator credentials
2. Check Admin > Cloud Health > Data Update Version
3. Check Admin > Collector Health > Data Update Version

Creating Business/IT Services

By defining an IT or Business Service, you can create a logical grouping of devices and IT components which can be monitored together.

1. Log in to your Supervisor node.
2. Go to CMDB > Business Services.
3. Click New.
4. Enter a Name and Description for the business service.
5. Select a Device/Application Group, and when the list of associated devices loads into the selection pane, select a device and click >> t o add it to the Selected Devices/Applications for the business service.
6. Click Save when you’re done adding devices to the business service.

After you have created a business service, you can select it, and the Show Topology option, to view it within overall IT topology. You can also use the links in the Analysis menu of the Business Services summary dashboard to find out more information about incidents, device availability, device and application performance, interface and event status, and real-time and historical search for a selected business service.

Configuring Monitoring

Once FortiSIEM discovers your devices, they will monitored continuously, and you can use the data collected to analyze the performance of your infrastructure. You can also configure FortiSIEM to send notifications when events that meet specific conditions occur in your infrastructure.

You can disable the collection of metrics for specific devices, disable devices for monitoring, and change the polling interval for metric collection.

Some devices need to be configured to send logs to FortiSIEM, as described in the topics under Configuring External Systems for Discovery, Monitoring and Log Collection. You can also configure FortiSIEM to monitor important ports, processes, and interfaces, and set up monitoring tests that use synthetic transaction to make sure that critical services are up and running.

Device Monitoring Settings

Adding Important Interfaces

Adding Important Processes

Adding Important Ports

Excluding Disks from Disk Capacity Utilization Monitoring

Managing Monitoring of System and Application Metrics for Devices

Setting Up Synthetic Transaction Monitoring Tests

Protocol Settings for Synthetic Transaction Monitoring Tests Adding a Synthetic Monitoring Test to a Business Service

Device Monitoring Settings

While FortiSIEM constantly monitors and reports on your IT infrastructure, there are several settings you can use to refine reporting on critical interfaces, important processes and ports, and disk utilization.

Adding Important Interfaces

Adding Important Processes

Adding Important Ports

Excluding Disks from Disk Capacity Utilization Monitoring

Adding Important Interfaces

This setting allows you to always get interface utilization reports on a set of important network interfaces across all device types.

Important Interface Setup after 4.8.1 Upgrade

The behavior of interface monitoring has dramatically changed since 4.8. So it is very important to follow these steps.

1. Create a list of all Important interfaces
2. Go to Admin > General Settings > Monitoring > Important Interfaces Click Enable. This will stop all interface monitoring.
3. Click
4. Select either Device View or Interface View.
5. Select a device to view and select its interfaces, or select an interface.
6. Click OK to add the selected interface to the list. The Critical and Monitor boxes would be automatically checked.
7. Check the WAN box if applicable. If checked, the interface utilization events would have isWAN = “yes” attribute. You can use this to run a report for all WAN interfaces.
8. Click Apply All. Now FortiSIEM will start monitoring only the selected interfaces in this tab will be monitored.
9. If you want to disable this behavior and return to ALL interface monitoring (as in releases prior to 4.8), then click Disable.

Adding Important Processes

This setting allows you to always get process resource utilization reports and up/down alerts on a set of important processes across all device types.

Important Process Setup after 4.8.1 Upgrade

The behavior of process utilization monitoring has dramatically changed since 4.8. So it is very important to follow these steps.

1. Create a list of all Important interfaces
2. Go to Admin > General Settings > Monitoring > Important Processes Click Enable. This will stop all interface monitoring.
3. Click
4. Enter a Process Name and any Parameters, and then click OK.
5. Click Apply All. Now FortiSIEM will start monitoring only the selected processes in this tab.
6. If you want to disable this behavior and return to ALl interface monitoring, then click Disable.

Adding Important Ports

Always reporting the UP/DOWN status for every TCP/UDP port on every server can consume a significant amount of resources. FortiSIEM will report the UP/DOWN status only for the ports you add to the Important Ports list. Matching is exact based on port number and IP protocol.

1. Go to Admin > General Settings > Monitoring.
2. Under Important Ports, click Add.
3. Enter the Port Number and select the Port Type.
4. Click OK.
5. Click Apply All.

Excluding Disks from Disk Capacity Utilization Monitoring

You can exclude disks from disk capacity utilization monitoring. Disk capacity utilization events will not be generated for devices matching the device name, access IP, and disk name that you provide. Incidents will not trigger for these events, and the disks will not show up in summary dashboards.

2. Under Excluded Disks, click Add.
3. Select a device to to view its disks, and then select the disk you want to exclude from monitoring.
4. Click OK.
5. Click Apply All.

Managing Monitoring of System and Application Metrics for Devices

When FortiSIEM discovers devices, it also discovers the system and application metics that can be monitored for each device, and displays these in the Monitor Change/Performance tab of the Setup Wizard. Here you can also disable the monitoring of specific metrics for devices, disable devices from being monitored, and change the polling interval for specific metrics. See Inspecting Event Pulling Methods for Devices for an explanation of the different status indicators for System Monitor and Application Monitor metrics.

1. Go to Admin > Setup Wizard > Monitor Change/Performance.
2. Click Refresh to make sure you have the latest list of devices.
3. To disable monitoring for a device, clear the Enable option for it.
4. To enable or disable monitoring of a specific metrics for a device, click on a device to select it, then click Edit and select System Monitoring or Application Monitoring to view the list of metrics associated with that monitor and device.
5. To change the polling interval for a metric, in the More menu, select Set Intervals. Select the Monitor Type and Device, and then set the interval.
6. When you are done making changes, click Apply.

Setting Up Synthetic Transaction Monitoring Tests

A Synthetic Transaction Monitoring (STM) test lets you test whether a service is up or down, and measure the response time. An STM test can range from something as simple as pinging a service, to something as complex as sending and receiving an email or a nested Web transaction. Setting up an STM test involves defining the type of monitor, associating the monitor definition to a device and testing it, and then deploying the STM test to a Supervisor or Collector. You can view the results of STM tests in the Synthetic Transaction Monitoring page, either by navigating to Summary Dashboard > Availability/Performance > Application Summary > Synthetic Transaction Monitoring, or to Admin > Setup Wizard > Synthetic Transaction Monitoring, and then clicking on Monitoring Status. You can also report on the results of STM tests in the reports Top Applications By Synthetic Transaction Response Time and Top Applications By Synthetic Transaction Response Time –

Detailed view. When an STM test fails, three system rules are triggered, and you can receive an email notification of that failure by creating a notification policy for these rules.

1. Go to Admin > Setup Wizard > Synthetic Transaction Monitoring.
2. Click Add.
3. Enter a Name and Description for the test.
4. For Frequency, enter how often, in minutes, you want the test to run.
5. Select the Protocol for your test.

See Protocol Settings for Synthetic Transaction Monitoring Tests for more information about the settings and test results for specific protocols.

6. Click Save.

You now have to associate the STM test with a target host name, IP address, or IP range.

7. Click Create and Test.
8. For Monitoring Definition select one of the STM tests you have created.
9. For Host Name or IP/Range, enter the information for your STM test target.
10. For Port, click + and enter any ports to use when connecting to the target with this test.
11. Click OK.

FortiSIEM will run the test and verify if it is successful. If it succeeds, it will be added to the list of tests with a yellow Star next to it, indicating that it has been added but is not yet running.

12. Click Apply All to begin executing your tests at their set frequency.

The yellow Star will be removed from your test after it executes against the target the first time

Protocol Settings for Synthetic Transaction Monitoring Tests

This table describes the settings associated with the various protocols used for setting up Synthetic Transaction Monitoring tests.

Adding a Synthetic Monitoring Test to a Business Service

You may want to add a Synthetic Transaction Monitoring (STM) test to a Business Service as part of the monitoring infrastructure for that service. However, in order to enable reporting on that STM, you need to add it to the business service as a device that FortiSIEM can then report on. This topic explains how to create a device for an STM test and add it to your business service report.

1. Create your STM as described in Setting Up Synthetic Transaction Monitoring Tests.
2. Note the IP address that your STM resolves to in Step 9 of the setup instructions.
3. In the CMDB tab, select Devices, and then select a subcategory where you want to add the STM device.

You may want to create your own group where you manage your STM devices.

4. In the summary pane for the device subcategory, click New.
5. Complete all relevant information for the STM device, providing the IP address/range from Step 2 in the Access IP field of the Summary
6. Click Save when you’re done entering device information for the STM.
7. Follow the instructions in Creating a Report to add information about the STM device to a business service report, and then use the instructions in Adding Widgets to Dashboards to add it to your dashboard.

Related Links

Adding Devices to the CMDB Outside of Discovery

Creating CMDB Groups and Adding Objects to Them

Creating a Report

Adding Widgets to Dashboards

Creating Dynamic CMDB Group Policies

This setting allows you to write rules to put devices in CMDB Device Group and Business Service Groups of your choice. When a device is discovered, the policies defined here are applied and the device is assigned to the group(s) defined in the matching policies.

To create a new CMDB Group Policy

1. Go to Admin > General Settings > Discovery > CMDB Group
2. Click Add
3. For matching conditions – enter the following information
   1. Organization – the organization which this rule applies to
   2. Vendor – the matching device vendor – select from the list
   3. Model – the matching device model – select from the list
   4. Host Name – matching device host name via regular expression match
   5. IP Range – matching device access IP – format is single IP, IP range, CIDR
4. For Actions (Add To) – enter the following information
   1. Groups – specify the groups which the matching devices will be added to
   2. Biz Services – specify the business services which the matching devices will be added to

To apply one or more CMDB Group policies,

1. Select one or more policies and click Apply or Click Apply All to apply all policies.
2. Once a policy is saved, then next discovery will apply these policies. That means, discovered devices will belong to the groups and business services defined in the policies.

Decommissioning a device

Decommissioning a device lets you re-assign the IP address to a new device but still keep the old device in CMDB for historical purposes.

To decommission a device

1. Go to CMDB > Devices 2. Select the device.
2. Click on the menu under Name and select Decommission.
3. Provide a Reason and Select OK to decommission the device
4. Consequences of decommissioning
   1. Device will be moved to CMDB > Devices > Decommission folder
   2. Device will be removed from maintenance calendars
   3. Performance monitoring will stop
   4. A new device with the same IP can be discovered

To re-commission the device

1. Go to CMDB > Devices > Decommission 2. Select the device.

3. Click on the menu under Name and select Recommission.
4. The device will be moved back to the folder where it was when it was decommissioned. 5. Performance monitoring will resume

Adding Devices to the CMDB Outside of Discovery

There are situations in which you may want to add devices to the Configuration Management Database (CMDB) outside of the discovery procedure. For example, FortiSIEM needs access to devices over SNMP or WMI to discover them, but you may have devices in your

infrastructure that don’t utilize these access protocols. The IP addresses for those devices will still be contained in traffic logs, and rules may need to incorporate that device. In order to make sure that logs are parsed correctly and rules function as expected, you need to make sure that these undiscovered devices are associated with an IP address. Adding a device directly to the CMDB lets you provide the information necessary for FortiSIEM to recognize the device, including associating it with an IP address or range.

Adding Devices to Device Groups

When you add a device to the CMDB manually, make sure to choose the group, such Firewall, Printers, or Storage, in the Device View where you want to add it. If you only add it to the top-most Devices group, it will not be added to the topology map correctly.

1. Log into your Supervisor node.
2. Click CMDB.
3. In the Device View, select Devices, then select the sub-category where you want to add the device.
4. In the summary pane, click New.
5. For Summary, Contact, Interfaces, and Properties, enter information for the new device.

Entering Interface Information

When you enter the interface information for the device, make sure to provide the correct IP address and network mask for the interfaces. FortiSIEM will use this network information to generate the Network Segments for the device.

6. Click Save when you’re done adding the device information.

Related Links

Adding a Synthetic Monitoring Test to a Business Service