FortiGate / FortiOS

FortiManager

FortiAnalyzer

User Guide

FortiSIEM User Guide
TABLE OF CONTENTS
Overview
FortiSIEM Releases
- What's New in 7.5.1
- What's New in 7.5.0
- What's New in 7.4.2
- What's New in 7.4.1
- What's New in 7.4.0
- What's New in 7.3.5
- What's New in 7.3.4
- What's New in 7.3.3
- What's New in 7.3.2
- What's New in 7.3.1
- What's New in 7.3.0
- What's New in 7.2.7
- What's New in 7.2.6
- What's New in 7.2.5
- What's New in 7.2.4
- What's New in 7.2.3
- What's New in 7.2.2
- What's New in 7.2.1
- What's New in 7.2.0
- What's New in 7.1.9
- What's New in 7.1.8
- What's New in 7.1.7
- What's New in 7.1.6
- What's New in 7.1.5
- What's New in 7.1.4
- What's New in 7.1.3
- What's New in 7.1.2
- What's New in 7.1.1
- What's New in 7.1.0
- What's New in 7.0.4
- What's New in 7.0.3
- What's New in 7.0.2
- What's New in 7.0.1
- What's New in 7.0.0
Windows Agent Releases
Content Pack Updates
Key Concepts
Getting Started
Advanced Operations
- CMDB
- Incidents and Cases
- Device Support
- Rules, Reports, and Dashboards
- Advanced Health System
- Managing FortiSIEM
Administration
- Setup
- Device Support
- Health
- User Activity
- License
- Content Update
- Settings
Managing CMDB
- Devices
- Applications
- Users
- Business Services
- CMDB Reports
Managing Resources
- Reports
  - Viewing System Reports
  - Creating New Reports
  - Running System Reports
  - Working With Report Design Templates
  - Scheduling Reports
  - Importing and Exporting Reports
  - Importing and Exporting Report Definitions
- Saved Report Results
- ReportAI
- Rules
  - Viewing Rules
  - Creating Rules
  - Activating and Deactivating a Rule
  - Testing a Rule
  - Exporting and Importing Rule Definitions
  - Importing Sigma Rules
- Machine Learning Jobs
  - Viewing Machine Learning Jobs
  - Editing a Machine Learning Job
  - Deleting a Machine Learning Job
- Watch Lists
  - System-defined Watch List
  - Creating a Watch List
  - Modifying a Watch List
  - Using a Watch List
  - Exporting and Importing Watch Lists
- Lookup Tables
  - Adding a Lookup Table
  - Deleting a Lookup Table
  - Working with Lookup Table Data
- External Datasets
  - Configuring AWS Security Lake
  - Configuring AWS S3
  - Configuring MySQL
  - Configuring Fortinet FortiEDR
  - Configuring PostgreSQL
  - Configuring Snowflake
  - Provider and Dataset Import / Export Operations
- Osquery
  - Viewing osquery Templates
  - Creating osquery Templates
  - Running osquery
- Automation
  - Playbooks
  - Playbook Assets
  - Content Hub
  - Solution Packs
  - Remediations
  - FortiSOAR Playbooks
    - Viewing FortiSOAR Playbooks
    - Updating FortiSOAR Playbooks
  - FortiSOAR Connectors
    - Viewing Connectors
    - Updating Connectors
- Malware Domains
  - Adding a Malware Domain
  - Modifying a Malware Domain
  - Deleting a Malware Domain
  - Importing Malware Domains
  - Viewing Malware Domains
- Malware IPs
  - Adding a Malware IP
  - Modifying a Malware IP
  - Deleting a Malware IP
  - Importing Malware IPs
  - Viewing Malware IPs
- Malware Hash
  - Adding a Malware Hash
  - Modifying a Malware Hash
  - Deleting a Malware Hash
  - Importing/Updating User-defined Malware Hash
  - Viewing Malware Hash
- Malware Processes
  - Creating a Malware Process Group
  - Adding a Malware Process
  - Modifying a Malware Process
  - Deleting a Malware Process
  - Importing Malware Processes
  - Viewing Malware Processes
- Malware URLs
  - Adding a Malware URL
  - Modifying a Malware URL
  - Deleting a Malware URL
  - Importing Malware URLs
  - Viewing Malware URLs
- Anonymity Network
  - Adding Anonymity Networks
  - Modifying Anonymity Networks
  - Updating Anonymity Networks
- Country Groups
  - Creating a Country Group
  - Adding a Country Group
  - Modifying a Country Group
  - Deleting a Country Group
  - Changing the Home Country
- Default Password
  - Adding a Default Password
  - Modifying a Default Password
  - Importing and Exporting a Default Password
- Event Types
  - Adding an Event Type
  - Modifying an Event Type
  - Deleting an Event Type
- User Agents
  - Adding User Agents
  - Modifying User Agents
  - Importing and Exporting User Agents
- Networks
  - Adding a Network
  - Modifying a Network
  - Deleting a Network
  - Importing / Exporting Networks
- Protocols
  - Adding a Protocol
  - Modifying a Protocol
  - Deleting a Protocol
Working with Built-In External Threat Feeds
- Working with AbuseIPDB Threat Feed
- Working with AlienVault OTX Threat Feeds
- Working with ANY.RUN Threat Feeds
- Working with BlocklistDE Threat Feed
- Working with C2 Tracker Threat Feed
- Working with CertPL ThreatFeed
- Working with CINS Score Threat Feed
- Working with Dragos Worldview Threat Feeds
- Working with Emerging Threats Threat Feed
- Working with FireHOL Threat Feed
- Working with FortiGuard Threat Feeds
- Working with FortiRecon Threat Feeds
- Working with FortiSandbox Threat Feeds
- Working with FortiSOAR Threat Feeds
- Working with Google Threat Intelligence Threat Feeds
- Working with GreenSnow Threat Feed
- Working with IPsum Threat Feed
- Working with MalwareBazaar Threat Feed
- Working with Malware Patrol Threat Feeds
- Working with Mandiant Threat Feeds
- Working with MISP Threat Feeds
- Working with OpenCTI Threat Feeds
- Working with OpenPhish Threat Feed
- Working with Proofpoint Threat Feed
- Working with Snort Threat Feed
- Working with ThreatConnect Threat Feeds
- Working with ThreatStream Threat Feeds
- Working with TweetFeed Threat Feeds
- Working with URLhaus Threat Feed
Working with Custom External Threat Feeds
- Custom Malware IP Threat Feed
- Custom Malware Domain Threat Feed
- Custom Malware URL Threat Feed
- Custom Malware Hash Threat Feed
- Creating Python Script to download Custom Threat Feed
- Custom Malware Processes
Working with Cases
- Creating a Case Manually
- Creating a Case Automatically
- Viewing All Cases
- Searching Cases
- Viewing a Case in Depth
- Acting on a Case
- Case Dashboard
- Case Report
- Steps to Update Case Escalation from 6.x-7.1.x to 7.2.x
Working with Incidents
- Overview
- List View
- Risk View
- Explorer View
- MITRE ATT&CK View
- UEBA View
- Investigating Incidents
- Automated Incident Resolution Recommendation
- Lookups Via External Websites
- CVE-Based IPS False Positive Analysis
- Remediating an Incident using a Script
- Executing a FortiSOAR Playbook on an Incident
- Executing a Playbook with Automation Service
- Running a FortiSOAR Connector on an Incident
- Troubleshooting Incident Trigger
Working with Analytics Search
- Overview
- Running a Built-in Historical Search
- Creating a New Search
- Creating a Nested Search
- Viewing Real-time Search Results
- Viewing Historical Search Results
- Searches Using Pre-computed Results
- Working with Search Results
Advanced Search
- Overview
- Running a Built-in Advanced Search
- Creating a New Advanced Search
- Fixing SQL Query Syntax Errors with FortiAI
- Miscellaneous Advanced Search Operations
- Advanced Search Examples
Federated Search
- Overview
- Observables and Mappings
- Creating a Federated Search
- Creating a Federated Search from Incidents or Analytics
- Miscellaneous Federated Search Operations
- Working with Federated Search Results
Machine Learning
- Overview
- Anomaly Detection
- Classification
- Clustering
- Forecasting
- Regression
Automation Audit Events
Working with Dashboards
- General Operations
- Widget Dashboard
- Summary Dashboard
- Business Service Dashboard
- Identity and Location Dashboard
- Interface Usage Dashboard
- PCI Logging Status Dashboard
Managing Tasks
FortiAI
- FortiAI Chat
- Incident Analysis
- Case Analysis
- Log Analysis
- Advanced Search SQL Helper
FortiSIEM Manager
- FortiSIEM Manager Incidents
  - FortiSIEM Manager Incidents Overview View
  - FortiSIEM Manager Incidents - List View
- FortiSIEM Manager CMDB Users
  - FortiSIEM Manager CMDB Adding Users
  - FortiSIEM Manager - Editing User Information
- FortiSIEM Manager Resources
- FortiSIEM Manager Admin
Appendix
- Administrative Tools and Information
- ClickHouse Usage Notes
- Configuration Notes
- Elasticsearch Usage Notes
- Examples of Custom Performance Monitors
- Exporting QRadar Logs to FortiSIEM
- FortiEMS Endpoint Tagging
- FortiSIEM Attribute to Observable Mappings
- GUI Notes
  - Flash to HTML5 GUI Mapping
  - FortiSIEM Charts and Views
- FortiSOAR Integration Notes
  - Configuring FortiSOAR for FortiSIEM Integration
  - Writing FortiSIEM Compatible FortiSOAR Playbooks
- Functions in Analytics
- Knowledge Base
- License Enforcement
- Parser Specification
- Python Threat Feed Framework
- Sample Windows Agent Logs
- UEBA Information
- Windows Agent System Variables

Home FortiSIEM 7.5.1 User Guide

7.5.1

ClickHouse Storage Regions

Before Release 7.5.0, when a Collector or an external device sends events to a (Event Upload) Worker, that worker will distribute events to all ClickHouse Data Nodes. Starting with Release 7.5.0, you can have storage separation, meaning that events from specific collectors/devices can be stored in specific ClickHouse Data Nodes, with no overlap.

To accomplish this:

You need to form ClickHouse Regions. Each ClickHouse Region includes
- One or more Event Upload Workers
- One or more ClickHouse Shards
Event Upload Workers and ClickHouse Shards must be non-overlapping across ClickHouse Regions.
You need to configure a Collector or an external device to send events to any Event Upload Worker of the region.

Step 1: Creating a ClickHouse Region

Make sure that you have already configured the ClickHouse Cluster and defined the Shards.

To configure a ClickHouse Region, take the following steps.

Navigate to Admin > Settings > Database > ClickHouse Regions.
If you have not configured any regions, you will see a Default Region that includes all Shards and Event Upload Workers. Click + to create a new ClickHouse Region configuration.
In the Name field, enter a name for the ClickHouse Region storage configuration.
From the Shards drop-down, select the shards belonging to the region. Click + to add more Shards for the region.
From the Event Upload Workers drop-down, select the event upload workers for the region. Click + to add more Event Upload Workers.
When done, click Save.
Click the Apply () icon to apply the saved changes.

Step 2: Configuring Collector to Forward Events to a Worker Belonging to a Region

If your Collectors are directly sending events to a Worker, then

For Service Provider deployments, navigate to Admin > Setup > Organization. For Enterprise deployments, navigate to Admin > Setup > Collector.
Select the Collector and click the Edit () icon.
Set Event Worker to the IP address of an Event Upload Worker in the region. This will enable the Collector to send to the specific Workers in the Region.
Click Save.

If your Collectors are sending via a Load Balancer, then configure the Load Balancer so that Collectors events are only sent to the Workers in the Region.