FortiSIEM Features


HTML5 based GUI for dashboard

You can logon to HTML5 version of Dashboard page using the link https://<SupervisorIP>/phoenix/html.

For details see Dashboards – HTML5 version.

Policy based event retention

Currently, the on-line event database storage is managed in a FCFS basis. When the event database gets full, oldest events are purged or archived. This release enables you to set event retention policies based on Customer (Service Provider case), Reporting Devices and Event Types. For example, performance metrics and flow events should be kept for 30 days but server logs for 1 year.

This release also provides visibility into which reporting Device and Event Type is consuming most storage on a per-day basis. This enables administrators to write better data retention policies.

Note that this feature will consume significant compute and storage I/O resources. Since events are stored in a compressed manner, these events have to be first uncompressed, then filtered according to the data retention policies and finally the logs that remain have to be re-indexed. It is recommended that you create these policies after some thought and change infrequently. Run the reports to monitor the performance of retention policy execution.

For details, see Managing Online Event Data..

Vulnerability correlation and device risk scoring

In this release, FortiSIEM assigns a risk score (0-100) to a device by combining Asset Weight, Vulnerabilities found on that device, Security and Non-security incident counts and severities. Users can modify certain factors to tailor the risk computation for their environment. A view is created that shows the devices ranked by risk scores along with a timeline view of the incidents that resulted in that score. The risk score is computed hourly and the trend is presented in the view.

For details, see here for Flash version and here for HTML5 version. Risk computation is detailed here.

Scalable windows agent architecture enabling agent sending events to collectors (Windows Agent/Agent Manager 2.1)

FortiSIEM Windows agents provides efficient log collection and other important functionalities such as file integrity monitoring, registry and installed software change monitoring, removable media insertion and write activity etc. In previous releases, a set of Windows agents were associated with a single Windows Agent Manager (WAM), which was responsible for configuring the Windows Agents and then relaying logs from the Agents to a Collector. This architecture has several issues, e.g. (a) WAM is a single point of failure for configuration and log relay, (b)rigid association of Agents to a single WAM results in deployment and bookkeeping issues when large number of agents need to be deployed.

This release vastly improves the above architecture. WAM is primarily used for configuring Agents. As part of the configuration, Agents can be associated to one or more FortiSIEM collectors. Agents send log directly to the assigned set of collectors in a round robin fashion. A single WAM can configure a large number of Agents.  By removing the WAM from the event forwarding path and utilizing the Collector infrastructure, this architecture provides great scalability.

For details, see here

Dynamic CMDB groups

CMDB Device Groups and Business Service Groups are critical to FortiSIEM Analytics. It enables users to write rules as reports of the form

“Reporting IP IN A CMDB Group”. Currently, CMDB Device Groups are populated during discovery based on an internal template keying on Device vendor and model, e.g. Fortinet FortiGate belongs to both Firewall Group and VPN Group, Cisco IOS belongs to Router/Switch Group etc. Business Groups have to created manually and kept up to date.

This release automates this process by allowing the user to define rules for dynamically associating devices to CMDB groups and Business Services. A rule condition can be based on Device Vendor, Model, Host Name and IP Range. When there is a match, the matching devices would be placed in the specified CMDB Groups and Business Services. The Dynamic CMDB Group happens automatically during discovery. But the assignment rules can also be applied at any time to force immediate assignment. Note that this dynamic CMDB Group assignment is in addition t o the  internal template based assignment during discovery.

For details, see Creating Dynamic CMDB Group Policies..

Display CMDB reports in dashboard

Currently, a dashboard can only show reports containing event data. Starting with this release, CMDB reports can also be displayed on the same dashboard, side by side with event data.

For details, see here for Flash version and here for HTML5 version.

Multi-line syslog handling

Often applications generate a single syslog in multiple lines. For analysis purposes, the multiple lines need to put together into a single log. This feature enables you to do that.

User can write multiple multi-line syslog combining rules based on reporting IP and begin and ending patterns. All matching syslog within the begin and ending pattern are combined into a single log.

For details, see Multi-line Syslog Handling..

Custom configuration change monitoring

FortiSIEM can collect configurations from devices and detect changes. Currently, FortiSIEM supports a limited set of devices for this feature and users can not add devices of their choice.

This release provides a way for users to do configuration change monitoring for any device. The user simply needs to upload their own configuration collection script into the system and associate to a device type. When that device type is discovered, a configuration change detection job is created via the user defined custom configuration collection script.

For details, see Custom Configuration Change Monitoring.

STIX/TAXII support for external threat intelligence

This release allows you to download any threat intelligence data in STIX format using TAXII transport protocol without writing any code. Supported IOCs include Malware Domain, IP, URL and hash.

For details, see Custom Malware Domain Threat Feed, Custom Malware IP Threat Feed, Custom Malware Hash Threat Feed and Custom Malware URL Threat Feed.


Ability to monitor a subset of interfaces and processes

Currently, FortiSIEM monitors all interfaces and processes and there is no way to disable monitoring a subset of interfaces and processes. Many network devices (e.g. Voice Gateways) have logical interfaces that do not need to be monitored. Similarly servers have processes that may not need to be monitored. Often these redundant interfaces and processes create lots of events and consumes lots of storage over time, specially if there are many devices with such interfaces/processes.

This release allows you to specify a set of important interfaces and processes. Once this set is defined, FortiSIEM switches to monitoring only this set of important interfaces and processes.

For details, see Adding Important Interfaces and Adding Important Processes.

Ability to flag a WAN interface

Often it is important to monitor only WAN interfaces in a dashboard or report. Typically a deployment has many routers/firewalls with one or two WAN interfaces. Since WAN interfaces are not clearly marked in any configuration or SNMP MIB, the only way to create a report is manually list all the devices and interface pairs in the query. This makes the query quite cumbersome.

This release enables you to mark an interface as a WAN interface. The interface events will have the WAN flag set. To query all WAN interfaces, one simply has to specify “isWAN = true” in the query. This makes writing a query extremely simple.

For details, see Adding Important Interfaces.

Ability to define per-process CPU, Memory thresholds

FortiSIEM provides a way to specify global thresholds and per device local thresholds and refer to them in a rule. This way a single rule can capture global and local thresholds.

The thresholds can be a single value such as Critical CPU threshold, Warning CPU threshold or a map such as a map of interface utilization, disk utilization. While the single values are completely customizable meaning that users can add their own; map thresholds need a definition of the keys (such as interface name, disk name) to be defined in the system.

This release extends the map thresholds to also include process name. User can define global thresholds for process CPU utilization, process Memory utilization and per device, per process overrides (e.g. SQL Server).

For details, see Setting Global and Per-Device Threshold Properties.

Ability to include attachments in a ticket

FortiSIEM provides its own ticketing system for users that do not want to rely on an external ticketing system. Often there is a need to include attachments in a ticket, e.g. to demonstrate the problem while creating a ticket and  to demonstrate the problem resolution while closing a ticket. This release allows you to include (PDF and PNG formatted) attachments  into a ticket and export that ticket in PDF format to also include the attachments.

For details, see Ticket Related Operations..

Allow exceptions for merging based on hardware serial numbers

FortiSIEM has an algorithm based on hardware serial numbers, host name, IP and MAC addresses to merge devices in CMDB, which is needed since FortiSIEM repeatedly discovers devices. Currently, hardware serial number is a definitive factor – two devices are merged if their serial number is identical. However often some virtualized devices have generic serial numbers e.g. “Unknown”, “0000” etc which causes devices to merged incorrectly. This release provides a way to create a list of virtual serial numbers which are not considered for merge purposes.

For details, see Discovery Settings.

Device / Application Support

Windows Server 2016 – discovery, performance monitoring and log analysis like other Windows Servers – see Microsoft Windows Server Configuration.

FortiDDoS – log analysis – see FortiDDoS Configuration

Google Apps – audit log analysis – see Google Apps Audit Configuration.

Microsoft Office 365 – audit log analysis – see Microsoft Office365 Audit Configuration

Cisco ACI – performance monitoring – see Cisco Application Centric Infrastructure (ACI) Configuration

Brocade CER and MLX routers – performance monitoring – see Brocade NetIron CER Routers

Clavister IPS – log analysis – see here

Cisco SF 300 SG300/350 switches – discovery, performance monitoring – see Cisco 300 Series Routers

Fortinet 5001B firewalls – discovery, performance monitoring – per CPU utilization extensions – see Fortinet FortiGate Firewall


Bug Fixes / Enhancements

Bug ID Severity Component Description
17906 major Parser FortiSandbox Parser does not support FortiSandbox VM
17415 major Parser Some WatchGuard events are not parsed
17453 major Parser Update the SourceFire parser to support version 6 and later and  Snort messages.
18053 major GUI Incorrect Admin > General Settings > Discovery > Application Filter
17281 normal App Server Handle rediscovery of devices moved from a system defined group
17346 normal App Server Should not update ‘Worker up’ error message every 3 minute if the worker is not in down status
18056 normal Parser Parse event severity from Stonesoft events
12617 normal Parser Event severity of some Snort events are incorrect
16765 normal GUI Multiple users cannot use the same dashboard name
16845 normal System FortiSIEM Login credential anonymization algorithm causes unnecessary login failures
16514 normal App Server Reports: Display Column “Display As” not working for scheduled PDF reports
18108 normal App Server Incident Id in Notification Email includes HTML tags in Email Subject
17418 normal GUI Add Remediation to Rule Export
15868 normal Discovery FortiSIEM SSH not logging out of Palo Alto Firewall during configuration discovery
17979 normal GUI Improve display performance of CMDB > Link Usage page in GUI
17422 normal Parser Imperva DAM Unknown Event Types in Panasonic logs
16985 normal App Server Allow Super-Global admin assign incident  ticket to a org user in Super
17555 normal Parser Application recognition inconsistency in Netflow IPFIX analysis
17507 normal Rule Error in System defined Rule “Cisco Call Manager DDR Down”
17110 normal Parser Reporting device name parsed wrong in Motorola AirDefense Parser
16966 normal GUI Virtual IPs disappear after exporting and importing credentials
16956 normal GUI When two super global users create a dashboard for an org, they see each others dashboards in that org
16311 normal GUI Sometimes the value of application performance shows incompletely when the bar is red
17253 normal GUI Page header of Ticket export has display issues
17540 normal GUI Can’t export the result of a cloned Audit Rule to PDF
16023 normal GUI Incidents page – Filter condition will change after user cancels it via “…” and “e”
17436 normal GUI Cannot save new ticket without assignee or due date.
17837 normal System Reverse tunnel vulnerability not fixed on 4.7.2 upgrade
16763 normal Parser Event parse status is wrong for MYSQL_JDBC_PULL_STAT
16762 enhancement Parser Parse ‘reporting device name’ ‘host name’ at the first time for log discovered device.
13823 enhancement GUI Allow Users to select Important Processes per device from the software tab in  CMDB
17094 enhancement GUI Need CMDB Report for Running Applications
17860 enhancement App Server Threat Feed integration with InSights required by Panasonic
15792 enhancement App Server Support ‘Report Logo’ and ‘UI Logo’ for Organizations UI and PDF reports
16973 enhancement App Server Improve and Optimize CI lookup
16983 enhancement App Server Need a way to specify ticket due dates to specific times
17093 enhancement DataManager Create an event for when Incoming EPS is more than Guaranteed EPS
12049 enhancement Parser Parse more Symantec AV Events
18003 enhancement Parser Some event type display names have %s
17428 enhancement App Server In CMDB Report,  allow Organization and Collector Name as columns
16994 enhancement GUI Allow the ability to launch integration policy from a specific Incident

Current Open Issues

Id Severity Component Description
8867 Normal Rule Engine LAST and FIRST operators in rules do not work (may crash Rule Worker module)
11036 Normal Rule Engine Rule Worker module may abort when a PctChange Expression is used
14242 Normal Query Engine RBAC data conditions not enforced for SP organizations when login in via the super org and moving to another org.
15022 Normal Parser Engine Parser module may stall/pause if a host name resolution is slow. Work around for now is to disable host name resolution.
11112 Normal Rule Engine COUNT DISTINCT operations consume large resources for rules utilizing Anomaly Detection
14478 Normal GUI Sometimes GUI pops up warning (Large amount of data stored over the boundaries) when users restore the archived data or delete the restored data
15109 Normal Performance


Failed Custom JDBC job shows in performance page after Discovery
15247 Normal Parser AIX Parser cannot parse events correctly.
15253 Normal Parser Reporting device name is parsed wrong in LinuxInotifyParser (affects Linux file integrity monitoring via AccelOps agent)
14929 Normal Performance


Maintenance calendar issue – Maintenance for a device does not start at the configured time if there is a long running disabled job of another device
15068 Normal Application


Dashboard Search Filtering Does not work for Clariion LUNs under Summary Tab
15231 Normal Application


Generating PDF Reports over 100 Pages will drop Page Footer
15233 Minor Application


“Validation Status” column in Admin->Event DB->Event Integrity does not allow for sorting.
15300 Minor GUI For Report Server, if you sync -> unsync -> sync is rapid succession, then the last sync may not take effect
9261 Enhancement Application


Charts in exported reports (PDF format) only contain stacked charts – not line charts

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

This entry was posted in Administration Guides, FortiSIEM on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.