Generic

Before you initiate discovery, you should configure the Discovery Settings in your Supervisor as required for your deployment.

1. Go to Admin > Settings > Discovery > Generic tab.
2. Enter the following information under Generic Settings section. In a SP deployment, you must define all these settings for each Organization by logging in to the Organization directly.

Setting	Description
Virtual IPs	Often a common virtual IP address will exist in multiple machines for load balancing and fail-over purposes. When you discover devices, you must have these virtual IP addresses defined within your discovery settings for two reasons: Listing the virtual IP addresses ensures that two or more devices with the same virtual IP will not be merged into one device during device discovery, so each of the load-balanced devices will maintain their separate identity in the CMDB The virtual IP will not be used as an access IP during discovery, since the identity of the device when accessed via the virtual IP is unpredictable Enter the Virtual IP and click + to add more, if required.
Excluded Shared Device IPs	An enterprise often has servers that share credentials, for example mail servers, web proxies, and source code control servers, and a large number of users will authenticate to these servers to access their services. Providing a list of the IP addresses for these servers allows FortiSIEM to exclude these servers from user identity and location calculations in the Analytics > Identity and Location report. For example, suppose user A logs on to server B to retrieve his mail, and server B authenticates user A via Active Directory. If server B is not excluded, the Analytics > Identity and Location Report will contain two entries for user A: one for the workstation that A logs into, and also one for server B. You can eliminate this behavior by adding server B to the list of Server IPs with shared credentials. Enter the Excluded Shared Device IPs and click + to add more, if required.
Virtual Device Hardware Serial Numbers	If two or more devices have identical hardware serial number, specify them here. In general, hardware serial number is used to uniquely identify a device and therefore two devices with identical hardware serial number is merged into a single device in CMDB. If a hardware serial number is present in the Virtual Hardware Serial Numbers list, then it is excluded for merging purposes. Enter the Virtual Device Hardware Serial Numbers and click + to add more, if required.
Allow Incident Firing on	This setting allows you to control incident firings based on approved device status. If the Approved Devices Only option is selected, the following logic is used: (a) If at least one Source, Destination or Host IP is approved, the incident triggers. (b) Else if at least one incident reporting device is approved, the incident triggers. (c) Else the incident does not trigger. Note: System devices (Super, Worker, and Collectors) will always be considered to be approved devices. In other words, incidents will fire for these system devices even if Approved Devices Only option is selected. Select All Devices or Approved Devices Only accordingly.

3. Click Save.