FortiSIEM Disk Growth Trend – Daily

Disk Growth Trend – Daily

Event Type: PH_DEV_MON_SYS_DISK_TREND_DAY

Description: Event containing disk usage growth trend – daily view Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk Name	diskName	string	Disk name
Disk Capacity Util	diskUtil	double	Disk utilization for a specific disk name (between 0-100).
Free Disk (MB)	freeDiskMB	uint32	Size of free disk available in MBytes
Total Disk (MB)	totalDiskMB	uint32	Size of total disk in MBytes
Used Disk (MB)	usedDiskMB	uint32	Size of used disk in MBytes
Current Daily Disk Growth (MB)	diskGrowthMBDaily	double	Disk growth (MB) for the current day
Avg Daily Disk Growth (MB)	avgDiskGrowthMBDaily	double	Running avg of daily disk growth (MB) overall previous days
Days To Disk Full	timeToDiskFull	uint32	Number of days until disk is full (from daily growth statistics)
Poll Interval	pollIntv	uint32	Polling interval in seconds.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

FortiSIEM Network Interface Monitoring

Leave a reply

Network Interface Monitoring

Event Type: PH_DEV_MON_NET_INTF_UTIL

Description: Event containing network interface utilization metrics Source – almost all devices via SNMP:

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

NetApp DataONTAP (SNMP)

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP)

Sample event

[PH_DEV_MON_NET_INTF_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phIn tfFilter.cpp,[lineNumber]=275,[intfName]=GigabitEthernet4/41,[intfA lias]=Connection to Internet,[hostName]=SJ-Main-Cat6500,[hostIpAddr]=192.168.0.1,[pollI ntv]=177,[recvBytes]=0,[recvBitsPerSec]=0.000000,[inIntfUtil]=0.000 000,[sentBytes]=0,[sentBitsPerSec]=0.000000,[outIntfUtil]=0.000000,

[recvPkts]=0,[sentPkts]=0,[inIntfPktErr]=0,[inIntfPktErrPct]=0.0000 00,[outIntfPktErr]=0,[outIntfPktErrPct]=0.000000,[inIntfPktDiscarde d]=0,[inIntfPktDiscardedPct]=0.000000,[outIntfPktDiscarded]=0,[outI ntfPktDiscardedPct]=0.000000,[outQLen]=0,[intfSpeed64]=1000000000,[ intfAdminStatus]=up,[intfOperStatus]=down,[daysSinceLastUse]=487,[p hLogDetail]=

Key Attributes:

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_NET_INTF_UTIL
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.

Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host Intf Name	intfName	string	The name of the network interface for which this statistics applies
In Intf Util	inIntfUtil	double	Inbound (or received) network utilization (between 0-100).
Received Bytes	recvBytes	uint32	Inbound (or received) bytes during this interval
Received Byte Rate (/sec)	recvBytesPerSec	double	Inbound (or received) byte rate during this interval
Received Packets	recvPkts	uint32	Inbound (or received) packets received during this interval
In Packet Error	inIntfPktErr	uint32	Inbound (or received) packet errors
In Packet Error Pct	inIntfPktErrPct	double	Inbound (or received) packet error as a percentage of total packets
In Packet Discards	inIntfPktDiscarded	uint32	Inbound (or received) packet discarded
In Packet Discard Pct	inIntfPktDiscardedPct	double	Inbound (or received) packet discarded as a percentage of total packets
Out Intf Util	outIntfUtil	double	Outbound (or sent) network utilization (between 0-100).
Sent Bytes	sentBytes	uint32	Outbound (or sent) bytes during this interval
Sent Byte Rate (/sec)	sentBytesPerSec	double	Inbound (or received) byte rate during this interval
Sent Packets	sentPkts	uint32	Outbound (or sent) packets sent during this interval
Out Packet Error	outIntfPktErr	double	Outbound (or sent) packet errors
Out Packet Error Pct	outIntfPktErrPct	double	Outbound (or sent) packet error as a percentage of total packets
Out Packet Discards	outIntfPktDiscarded	uint32	Outbound (or sent) packet discarded
Out Packet Discard Pct	outIntfPktDiscardedPct	double	Outbound (or sent) packet discarded as a percentage of total packets
Out Queue Length	outQLen	uint32	Length of output queue
Poll Interval	pollIntv	uint32	Polling interval in seconds

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_DISK_TREND_DAY
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)

FortiSIEM Disk I/O Monitoring

Leave a reply

Disk I/O Monitoring

Event Type: PH_DEV_MON_DISK_IO_UTIL

Description: Event containing disk utilization metrics Source:

Microsoft Windows (WMI), Linux (SSH), HP-UX (SSH), IBM AIX (SSH)

NetApp DataONTAP (SNMP)

Key Attributes:

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_DISK_IO_UTIL
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk Name	diskName	string	Disk name
Disk Read Rate (KBps)	diskReadKBytesPerSec	double	Disk read rate in KBytes/sec.
Disk Write Rate (KBps)	diskWriteKBytesPerSec	double	Disk write rate in KBytes/sec.
Disk Read Rate (/sec)	diskReadReqPerSec	double	Disk read rate in read IO per sec.
Disk Write Rate (/sec)	diskWriteReqPerSec	double	Disk write rate in write IO per sec.
Disk IO Util	diskIOUtil	double	Disk I/O utilization
Disk Read Latency (ms)	devDiskRdLatency	double	Disk Read Latency – for Windows (WMI) only
Disk Write Latency (ms)	devDiskWrLatency	double	Disk Write latency – for Windows (WMI) only
Disk Queue Length	diskQLen	uint32	Disk Queue Length – for Windows (WMI) only
Poll Interval	pollIntv	uint32	Polling interval in seconds.

FortiSIEM Disk space Monitoring

1 Reply

Disk space Monitoring

Event Type: PH_DEV_MON_SYS_DISK_UTIL

Description: Event containing disk utilization metrics Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk Name	diskName	string	Disk name
Disk Capacity Util	diskUtil	double	Disk utilization for a specific disk name (between 0-100).
Free Disk (MB)	freeDiskMB	uint32	Size of free disk available in MBytes
Total Disk (MB)	totalDiskMB	uint32	Size of total disk in MBytes
Used Disk (MB)	usedDiskMB	uint32	Size of used disk in MBytes
Poll Interval	pollIntv	uint32	Polling interval in seconds.

AccelOps Generated Event Format

Leave a reply

AccelOps Generated Event Format

AccelOps Generated Events

AccelOps is an event based analytics system. When it monitors systems and applications, it produces events containing the collected metrics this section describes details of such events. This can used to write custom queries, reports and rules.

System Performance Monitoring Events

Availability Monitoring Events

VMware Monitoring Events

Hardware Monitoring Events

Application Monitoring Events

Network Flow Monitoring Events

Security Information Management

System Performance Monitoring Events

AccelOps generates the following events related to system monitoring events

CPU Monitoring Event

Memory Monitoring

Disk space Monitoring

Disk I/O Monitoring

Network I/O Monitoring

Disk Growth Trend – Daily

Disk Growth Trend – Weekly

Disk Growth Trend – Monthly

CPU Monitoring

Event Type: PH_DEV_MON_SYS_CPU_UTIL

Description: Event containing CPU utilization metrics

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

NetApp DataONTAP

Microsoft Windows (SNMP, WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) Key Attributes:

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_CPU_UTIL
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
CPU utilization	cpuUtil	double	Overall CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system.
User CPU Utilization	sysCpuUtil	double	User CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Av ailable for Linux (via SNMP) only.
System CPU Utilization	userCpuUtil	double	System CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Available for Linux (via SNMP) only.
Poll Interval	pollIntv	uint32	Polling interval in seconds

Memory Monitoring

Event Type: PH_DEV_MON_SYS_MEM_UTIL

Description: Event containing system memory utilization metrics Source:

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_DISK_UTIL
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event

Microsoft Windows (SNMP, WMI), Linux (SNMP,SSH), Solaris (SNMP), HP-UX (SNMP,SSH), IBM AIX (SNMP,SSH) Key Attributes:

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_MEM_UTIL
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose memory utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose memory utilization is being reported
Memory utilization	memUtil	double	Overall system physical memory utilization (between 0-100).
Buffer Memory (KB)	bufMemKB	uint32	Size of buffered memory. Available for Linux (via SNMP) only.
Cache Memory (KB)	cacheMemKB	uint32	Size of cached memory. Available for Linux (via SNMP) only.
Swap memory Utilization	swapMemUtil	double	Swap Memory Utilization. Available for Linux (via SNMP) only.
Free Swap Memory (KB)	freeSwapMemKB	uint32	Free Swap Memory. Available for Linux (via SNMP) only.
Swap Read Rate (Pages/sec)	swapInRate	double	Rate at which pages are swapped in. Available for Windows (WMI), Linux (SSH), HP-UX (SSH), IBM AIX (SSH).
Swap Write Rate (Pages/sec)	swapOutRate	double	Rate at which pages are swapped out. Available for Windows (WMI), Linux (SSH), HP-UX (SSH), IBM AIX (SSH).
Poll Interval	pollIntv	uint32	Polling interval in seconds.

FortiSIEM Event Attribute Master List Troubleshooting

1 Reply

Event Attribute Master List

This section describes the master list of event attributes. Events are parsed into these attributes and used in Accelops analytics. There are 4 broad categories of event attributes

Generic Attributes

Network Attributes

System Attributes

Application Attributes

Environmental Attributes

Generic Attributes

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_CPU_UTIL
Event Name	eventName	string
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
IPS Event Risk Rating	ipsEvRR
IPS Event Threat Rating	ipsEvTR
Event ID	eventId
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Device Time	deviceTime	Date
Event Action	eventAction	uint16
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Reporting Device Name	reptDevName	string
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Relaying Device Name	relayDevName	string
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Poll Interval	pollIntv	uint32	Polling interval in seconds
Customer ID	phCustId
Customer Name	customer
Agent ID	phAgentId
Event Rate (/sec)	eventsPerSec
Peak Event Rate (/sec)	peakEventsPerSec
Event Parse Status	eventParsedOK
Incident Source	incidentSrc
Incident Target	incidentTarget
Incident Reporting IP	incidentRptIp
Incident Trigger Attribute List	triggerAttrList
Incident Detail	incidentDetail
Incident ID	incidentId
Incident Status	incidentStatus
Incident First Occurrence Time	incidentFirstSeen
Incident Last Occurrence Time	incidentLastSeen
Incident Ticket ID	incidentTicketId
Incident Ticket Status	incidentTicketStatus
Incident Ticket User	incidentTicketUser
Incident Comments	incidentComments
Incident View Status	incidentViewStatus
Incident View Users	incidentViewUsers
Incident Cleared Time	incidentClearedTime
Incident Cleared User	incidentClearedUser
Incident Cleared Reason	incidentClearedReason
Incident Notification Recipients	incidentNotiRecipients

Network Attributes

Name	Id	Type	Description
Source IP	srcIpAddr	IP	Source IP address of the flow
Source Host Name	srcName
Host IP	hostIpAddr	IP
Host Name	hostName
Dest IP	destIpAddr	IP	Destination IP address of the flow
Dest Name	destName
Source MAC	srcMACAddr
Dest MAC	destMACAddr
Host MAC	hostMACAddr
IP Protocol	ipProto	uint16	IP protocol e.g. TCP/UDP/GRE/ICMP etc
Source TCP/UDP Port	srcIpPort	uint16	Source TCP/UDP port
Dest TCP/UDP Port	destIpPort	uint16	Destination TCP/UDP port
ICMP Type	icmpType	uint16	ICMP type
ICMP Code	icmpCode	uint16	ICMP code
IP Type of Service	tos	uchar	IP Type of Service
Sent TCP flags	srcDestTCPFlags	uchar	OR-ed TCP Flags from Source to Destination
Received TCP flags	destSrcTCPFlags	uchar	OR-ed TCP Flags from Destination to Source
Source Intf SNMP Index	srcSnmpIntfIndex	uint16	Source SNMP interface index
Dest Intf SNMP Index	destSnmpIntfIndex	uint16	Destination SNMP interface index
Source Intf name	srcIntfName
Dest Intf Name	destIntfName
Host Intf Name	intfName
Source Autonomous System Number	srcASNum	uint16	Source Autonomous number

Dest Autonomous System Number	destASNum	uint16	Destination Autonomous number
Source VLAN	srcVLAN
Dest VLAN	destVLAN
Host VLAN	hostVLAN
Sent Bytes	sentBytes	uint32	Sent Bytes in this flow
Sent Packets	sentPkts	uint32	Sent Packets in this flow
Sent Bytes Rate (/sec)	sentBytesPerSec
Received Bytes	recvBytes	uint32	Received Bytes in this flow
Received Packets	recvPkts	uint32	received Packets in this flow
Received Bytes Rate (/sec)	recvBytesPerSec
Total Bytes	totBytes
Total Packets	totPkts
Total Byte rate (/sec)	totBytesPerSec
Total Packet Rate (/sec)	totPktsPerSec
Duration	durationMsec
Intf Out Queue Length	outQlen
In Packet Error	inIntfPktErr
Out Packet Error	outIntfPktErr
In Packet Error Pct	inIntfPktErrPct
Out Packet Error Pct	outIntfPktErrPct
In Intf Util	inIntfUtil	double
Out Intf Util	outIntfUtil	double
In Packet Discard	inIntfPktDiscarded
Out Packet Discard	outIntfPktDiscarded
In Packet Discard Pct	inIntfPktDiscardedPct
Out Packet Discard Pct	outIntfPktDiscarded
Source Firewall Zone	srcFwZone
Dest Firewall Zone	destFwZone
Min Jitter	minJitterMs
Max Jitter	maxJitterMs
Avg Jitter	avgJitterMs
Min SD Jitter	minJitterSDMs
Max SD Jitter	maxJitterSDMs
Avg SD Jitter	avgJitterSDMs
Min DS Jitter	minJitterDSMs
Max DS Jitter	maxJitterDSMs
Avg DS Jitter	avgJitterDSMs
Packets Lost	pktLost
Packets SD Lost	pktLostSD
Packets DS Lost	pktLostDS
Packets Missing	pktMIA
Packets Late	pktLate
Packets Out-of-Seq	pktOutSeq
VoIP MOS Score	mosScore
VoIP ICPIF Score	icpifScore
VoIP Codec	codec
VoIP Phone Status	voIPPhoneStatus
Calling Party Number	callingPartyNumber
Original Called Party Number	originalCalledPartyNumber

Final Called Party Number	finalCalledPartyNumber
Call Connect Time	dateTimeConnect
Call Disconnect Time	dateTimeDisconnect
Call Duration	callDuration
CBQoS Policy Name	qosPolicy
CBQoS Class Name	qosClass
CBQoS Conform KBps	qosConformRate
CBQoS Exceeded KBps	qosExceedRate
CBQoS Violated KBps	qosViolateRate
CBQoS PrePolice KBps	qosPrePoliceRate
CBQoS PostPolice KBps	qosPostPoliceRate
CBQoS Drop KBps	qosDropRate
CBQoS Drop Pct	qosDropPct
CBQoS Curr Queue Length	qosCurrQueue
CBQoS Max Queue Length	qosMaxQueue
CBQoS Discarded Pkt	qosDiscardPkt
OSPF State	ospfState
BGP State	bgpState
OSPF Area Id	ospfAreaId
Source FiberChannel WWN Id	srcWWN
Dest FiberChannel WWN Id	destWWN
	wlanSsid
	wlanControllerIp
	wlanContrHostName
	wlanUserCount
	wlanSuppChannels
	wlanSendutil
	wlanRecvUtil
	wlanChannelUtil
	wlanPoorSNRUserCount
	ifLoadProfile
	ifIntefProfile
	ifCoverageProfile
	ifNoiseProfile
	wlanRssi
	wlanSnr
	wlanMobilityStatus
	wlanProtocol
	wlanAssocUpTime
	wlanMaxHostTxmitRate
	ifCoverageIndx
	ifNoseIndx
	ifIntefIndex

System Attributes

Name	Id	Type	Description
Computer	computer
Target Computer	targetComputer

Domain	domain
Target Domain	targetDomain
Source Domain	srcDomain
Destination Domain	destDomain
Operating System Type	osType
Operating System Version	osVersion
File Name	fileName
Object Type	osObjType
Object Name	osObjName
Target Object Type	targetOsObjType
Target Object Name	targetOsObjName
Object Handle	osObjHandleID
Object Access Type	osObjAccessType
Object Action	osObjAction
System Uptime	sysUpTime
System Uptime Pct	sysUpTimePct	double
System Downtime	sysDownTime
CPU Name	cpuName	string
CPU utilization	cpuUtil	double	Overall CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system.
User CPU Utilization	userCpuUtil	double	User CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Available for Linux (via SNMP) only.
System CPU Utilization	sysCpuUtil	double	System CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Available for Linux (via SNMP) only.
Memory Name	memName	string
Memory Utilization	memUtil	double
Free memory (KB)	freeMemKB	uint32
Buffer Memory (KB)	bufMemKB	uint32
Cache Memory (KB)	cacheMemKB	uint32
Swap Memory Utilization	swapMemUtil	double
Free Swap Memory (KB)	freeSwapMemKB	uint32
Minimum Swap Memory (KB)	memMinimumSwap	uint32
Swap Memory Error Message	swapMemErrorString	string
Swap Read (Pages/sec)	swapInRate	double
Swap Write (Pages/sec)	swapOutRate	double
Total Swap (Pages/sec)	swapRate	double
Swap Read (KBps)	swapReadKBytesPerSec
Swap Write (KBps)	swapWriteKBytesPerSec
Total Read I/O Rate (KBps)	ioReadKBytesPerSec
Total Write I/O Rate (KBps)	ioWriteKBytesPerSec
Disk Name	diskName
Disk Utilization	diskUtil
Free Disk (MB)	freeDiskMB
Total Disk (MB)	totalDiskMB
Used Disk (MB)	usedDiskMB
Disk Queue Length	diskQLen

Current Daily Disk Growth	diskGrowthMBDaily
Current Weekly Disk Growth	diskGrowthMBWeekly
Current Monthly Disk Growth	diskGrowthMBMonthly
Average Daily Disk Growth	avgDiskGrowthMBDaily
Average Weekly Disk Growth	avgDiskGrowthMBWeekly
Average Monthly Disk Growth	avgDiskGrowthMBMonthly
Days To Disk Full	timeToDiskFull
RAID Group Id	raidGrpId
RAID Type	raidType

Application Attributes

Name	Id	Type	Description
Application Name	appName	string	Short descriptive name of the process, e.g. “Microsoft IIS”
Application Group Name	appGroupName	string	Name of the application group to which the process belongs; e.g. “Microsoft IIS”
Software Name	swProcName	string	Process/Executable name; e.g. svchost.exe
Software Param	swParam	string	Process/Executable parameters, e.g. “-k iissvc”
CPU utilization	cpuUtil	double	Process CPU utilization (between 0-100).
Memory utilization	memUtil	double	Process memory utilization (between 0-100).
Real Peak Memory (KB)	realMemPeakKBytes	uint32	Peak real memory usage (KBytes).
Disk Read Rate (KBps)	diskReadKBytesPerSec	double	Process disk read rate (KBytes/sec).
Disk Write Rate (KBps)	diskWriteKBytesPerSec	double	Process disk write rate (KBytes/sec).

Environmental Attributes

Name	Id	Type	Description
Hardware Status	hwStatusCode	string
Hardware Battery Status	hwBatteryStatus
Hardware Disk Status	hwDiskStatus
Hardware Power Supply Status	hwPowerSupplyStatus
Hardware Temp Sensor Status	hwTempSensorStatus
Hardware Fan Status	hwFanStatus
Hardware Amp Status	hwAmpStatus
Hardware Voltage Status	hwVoltageStatus
Hardware Memory Status	hwMemoryStatus
Hardware Log Status	hwLogStatus
Hardware Processor Status	hwProcStatus
Hardware Power Chord Status	hwPowerChordStatus
Hardware Storage Controller Status	hwStorageControllerStatus
HardwareStorage Channel Status	hwStorageChannelStatus
Hardware Storage Enclosure Status	hwStorageEnclosureStatus

Hardware Power Supply Status	hwStoragePowerSupplyStatus
Hardware Storage Fan Status	hwStorageFanStatus
Hardware Storage Temp Status	hwStorageTempStatus
Hardware EMM Status	hwStorageEMMStatus
Hardware Log Disk Status	logDiskStatus
Failed Power Supply Count	hwFailedPowerSupplyCount
Storage LLC Status	hwLLCStatus
Storage Link Status	hwLinkStatus
Storage Port Status	hwPortStatus
Hardware Misc Component Status	hwMiscCompStatus
Host Spare Disk Count	hwHotSpareDiskCount
UPS Battery Status	upsBatteryStatus
UPS Remaining Battery Charge (Pct)	upsRemainBatteryChargePct
UPS Replace Battery Indicator	upsReplaceBatteryIndicator
UPS Time On Battery (sec)	upsTimeOnBattery
UPS Output Status	upsBasicOutputStatus
UPS Output Load	upsAdvOutputLoad
UPS Output Voltage (V)	upsAdvOutputVoltage
UPS Output Frequency (Hz)	upsAdvOutputFreq
UPS Battery Current (Amp)	upsBatteryCurrent
UPS Battery Temperature (C)	upsBatteryTempC
UPS Battery Voltage	upsBatteryVoltage
UPS Estimated Time Remaining (sec)	upsEstSecRemain
Temperature (C)	envTempDegC
High Temperature Threshold (C)	envTempHighThreshDegC
Low Temperature Threshold (C)	envTempLowThreshDegC
Temperature Offset High (C)	envTempOffHighDegC
Temperature Offset Low (C)	envTempOffLowDegC
Temperature (F)	envTempDegF
High Temperature Threshold (F)	envTempHighThreshDegF
Low Temperature Threshold (F)	envTempLowThreshDegF
Temperature Offset High (F)	envTempOffHighDegF
Low Temperature Threshold (F)	envTempOffLowDegF
Relative Humidity	envHumidityRel
High Relative Humidity Threshold	envHumidityRelHighThresh
Low Relative Humidity Threshold	envHumidityRelLowThresh
Humidity Offset High	envHumidityOffHigh
Humidity Offset Low	envHumidityOffLow
Liebert HVAC System State	lgpSystemState
Liebert HVAC Cooling State	lgpCoolingState
Liebert HVAC Heating State	lgpHeatingState
Liebert HVAC Humidifying State	lgpHumidState
Liebert HVAC Dehumidifying State	lgpDehumidState
Liebert HVAC Economy Cycle State	lgpEconCycle
Liebert HVAC Fan State	lgpFanState
Liebert HVAC Cooling capacity	envCoolCap
Liebert HVAC Heating Capacity	envHeatCap
	outputVoltageXNVolts

FortiSIEM The IPS Vulnerability Map

Leave a reply

The IPS Vulnerability Map

The IPS Vulnerability Map lists devices that have a known vulnerability. You can view the IPS Vulnerability Map by going to Incidents > IPS Vunerability Map, and you can also add new devices to the map.

The IPS Vulnerability Map includes these columns.

Column	Description
IPS Event Types	The event types associated with the vulnerability
Vendor Vulnerability ID	The vulnerability ID provided by the device vendor
CVE IDs	The vulnerability ID provided by Common Vulnerabilities and Exposures
Vulnerability Description	A brief description of the device’s vulnerability
Found in Device Type	Specific devices or applications that have the vulnerability
Found in Version	The version of the device or application that has the vulnerability
Fixed in Version	The version in which the vulnerability was fixed
Fixed via Patches	The patch version in which the vulnerability was fixed

Adding Entries to the IPS Vulnerabilities Map

Go to Incidents > IPS Vulnerability Map.
Click Add.
Select the IPS Event Type associated with the vulnerability.
Enter any Vendor Vulnerability ID
Enter any CVE ID

See the Common Vulnerability and Exposures website for CVE IDs. Separate multiple IDs with commas.

Enter a Vulnerability Description.
For Affected Software, click Add, and then select the affected devices or applications from the Found in Device Type
Enter any Found in Version information for the affected software.
Enter any fix information for the vulnerability.
Click OK.
Click Save.

FortiSIEM Monitoring Custom Applications

Leave a reply

Monitoring Custom Applications

While FortiSIEM provides support for many applications, there may also be situations in which you have a custom application running in your infrastructure that you want to monitor. This topic explains how to set up FortiSIEM to monitor that application, and add it to a business service.

Log in to your Supervisor.
Go to CMDB > Applications, and either select a group where you want to add the application, or create a new one.
Click New, and enter an Application Name and a Process Name.
Click Save.
Initiate discovery of the server where the application is running.
Go to CMDB > Devices and select the server.
Click the Software tab and make sure the application has been discovered.
Go to General Settings > Monitoring > Important Processes.
Click Add and enter the name of the process that the application is running on.
Click Apply All.
Run a structured historical search using these attributes to make sure the process utilization metrics are being received by FortiSIEM.

Attribute	Value
Reporting IP	The IP address of the server where the application is running
Event Type	PH_DEV_MON_PROC_RESOURCE_UTIL
Application Name	The name of the application

Add your application to a business service.

You should now be able to go Dashboard > Summary Dashboards > Biz Service Summary and see your process running under Top Monitored Processes when you select the associated business service.