Configuring FortiSIEM

FortiSIEM External Ports. CyberArk Password Vault Fortinet FortiAuthenticator Juniper Networks Steel-Belted RADIUS Microsoft Internet Authentication Server (IAS). After applying the license, the system will reboot and provide a login page. Login with the following default values: USER ID - admin; PASSWORD - admin.1; CUST/ORG ID - super; DOMAIN - LOCAL; For more information about FortiSIEM Licensing, see the Licensing Guide here.

Initial System Configuration

Before you can initiate discovery and monitoring of your IT infrastructure, you will need to configure several general settings, add users, and add organizations for multi-tenant deployments.

Setting Up the Email Gateway

Before you can set up notifications, you have to set up the email gateway that your system will use for all alerts and system notifications.

Log into your Supervisor node.
Go to Admin > General Settings > Email Settings.
Enter the Email Gateway Server.
Enter any additional account or connection information.
Click Save.

Setting Up Routing Information for Reports and Incident Notifications

Topics in this section describe how to set up email addresses to send alerts to when a scheduled report runs, and distribution information for notifications associated with incidents. You can also automate the sending of tickets to a Remedy system when an incident occurs. These are all general settings, in that you don’t need to have any rules or reports defined before you configure them. For information on configuring specific notification policies for rules and incidents, see Incident Notifications. For information on configuring Remedy to work with FortiSIEM notifications, see Configuring Remedy to Accept Incident Notifications from FortiSIEM.

Setting Up Email Alert Routing for Scheduled Reports

Setting Up SNMP Traps for Incident Notifications

Setting Up XML Message Routing for Incident Notifications

Setting Up Routing for Remedy Tickets

Related Links

Fortisiem Demo Login Password Reset

Scheduling Reports

Incident Notifications

Setting Up Email Alert Routing for Scheduled Reports

You can schedule reports to run and send email notifications to specific individuals. This setting is for default email notifications that will be sent when any scheduled report completes.

Log into your Supervisor node.
Go to Admin > General Settings > Analytics.
Click +.

If you haven’t configured your email gateway yet, you will see an error message.

Select SMS or Email for the delivery method.
Enter the email address or SMS number.
Click OK.
Click Save All when you are done.

Sending Alerts to the Console

Select Send an alert to console if you also want to send alerts to the console. Alerts are always displayed in the Incidents tab, while the alerts sent to the console are immediately displayed but without any grouping by rule name, incident source, incident target, or other detail information.

Empty Reports

Sometimes a report may be empty because there are no matching events. If you don’t want to send empty reports to users, select Do not send scheduled emails if report is empty. If you are running a multi-tenant deployment, and you select this option while in the Super/Global view, this will apply only to Super/Global reports. If you want to suppress delivery of empty reports to individual organizations, you will have to configure this option in the organizational view.

Related Links

Setting Up the Email Gateway Scheduling Reports

Setting Up SNMP Traps for Incident Notifications

You can define SNMP traps that will be notified when an event triggers an incident.

Log in to your Supervisor node.
Go to Admin > General Settings > Analytics.
Enter the SNMP Trap IP Address.
Enter the SNMP Community String that will authorize sending the trap to the SNMP trap IP address.
Select the SNMP Trap Type.
Select a Protocol.
Click Test SNMP to check the connection.
Click Save All.

Related Links

Incident Notifications

Setting Up XML Message Routing for Incident Notifications

You can configure FortiSIEM to send an XML message over HTTP(s) when an a incident is triggered by a rule.

Log in to your Supervisor.
Go to Admin > General Settings > Analytics.
For HTTP(S) Server URL, enter the URL of the remote host where the message should be sent.
Enter the Username and Password to use when logging in to the remote host, and then Reconfirm the password.
Click Test HTTP to check the connection.
Click Save All.

Setting Up Routing for Remedy Tickets

You can set up Remedy to accept notifications from FortiSIEM and generate tickets from those notifications, as described in Configuring Remedy to Accept Incident Notifications from FortiSIEM. These instructions explain how to set up the routing to your Remedy server.

Log in to your Supervisor node.
Go to Admin > General Settings > Analytics.
For WSDL, enter the URL of the Remedy Server.
Enter the Username and Password associated with your Remedy server, and then Reconfirm the password.
Click Test Remedy to test the connection.
Click Save All.

Related Links

Setting Up User Roles

FortiSIEM has a wide operational scope – it provides performance, availability, and environmental alerts, as well as change and security monitoring for network devices, servers and applications. It is difficult for one admin to monitor across the entire spectrum of available information. In addition, devices may be in widely distributed geographical and administratively disjointed locations. Role-based access control provides a way to partition the FortiSIEM administrative reponsibilities across multiple admins.

A role defines two aspects of a user’s interaction with the FortiSIEM platform:

Which user interface elements a user can see and the ability to use the associated Read/Write/Execute permissions. As an example, the built-in Executive role can see only the dashboard, while the Server Admin role cannot see network devices. Role permissions can be defined to the attribute level in which, for example, a Tier1 Network Admin role can see network devices but not their configurations.

What data can the user see. For example, consider a Windows Admin role and a Unix Admin role. They both can run the same reports, but the Windows admins sees only logs from Windows devices. This definition can also be fine-grained, for example one Windows admin sub-role can be defined to see Windows performance metrics, while another Windows admin sub-role can see Windows authentication logs.

Topics in this section explain how to use the Default roles that come with FortiSIEM, and how to define new ones.

Default Roles

Creating Custom User Roles

Default Roles

To perform any action with FortiSIEM, a user must be assigned a role with the required permissions. The roles listed in this table are default roles. You can create custom roles and permissions by following the instructions in the topic Creating Custom User Roles.

Role	Permissions
Full Admin	Full access to the GUI and full access to the data. Only this role can define roles, create users and map users to roles.
Network Admin	Full access to the network device portion of the GUI and full access to logs from network devices
System Admin	Full access to the Server/Workstation/Storage part of the GUI a