HTML5 based GUI for dashboard
You can logon to HTML5 version of Dashboard page using the link https://<SupervisorIP>/phoenix/html.
For details see Dashboards – HTML5 version.
Policy based event retention
Currently, the on-line event database storage is managed in a FCFS basis. When the event database gets full, oldest events are purged or archived. This release enables you to set event retention policies based on Customer (Service Provider case), Reporting Devices and Event Types. For example, performance metrics and flow events should be kept for 30 days but server logs for 1 year.
This release also provides visibility into which reporting Device and Event Type is consuming most storage on a per-day basis. This enables administrators to write better data retention policies.
Note that this feature will consume significant compute and storage I/O resources. Since events are stored in a compressed manner, these events have to be first uncompressed, then filtered according to the data retention policies and finally the logs that remain have to be re-indexed. It is recommended that you create these policies after some thought and change infrequently. Run the reports to monitor the performance of retention policy execution.
For details, see Managing Online Event Data..
Vulnerability correlation and device risk scoring
In this release, FortiSIEM assigns a risk score (0-100) to a device by combining Asset Weight, Vulnerabilities found on that device, Security and Non-security incident counts and severities. Users can modify certain factors to tailor the risk computation for their environment. A view is created that shows the devices ranked by risk scores along with a timeline view of the incidents that resulted in that score. The risk score is computed hourly and the trend is presented in the view.
For details, see here for Flash version and here for HTML5 version. Risk computation is detailed here.
Scalable windows agent architecture enabling agent sending events to collectors (Windows Agent/Agent Manager 2.1)
FortiSIEM Windows agents provides efficient log collection and other important functionalities such as file integrity monitoring, registry and installed software change monitoring, removable media insertion and write activity etc. In previous releases, a set of Windows agents were associated with a single Windows Agent Manager (WAM), which was responsible for configuring the Windows Agents and then relaying logs from the Agents to a Collector. This architecture has several issues, e.g. (a) WAM is a single point of failure for configuration and log relay, (b)rigid association of Agents to a single WAM results in deployment and bookkeeping issues when large number of agents need to be deployed.
This release vastly improves the above architecture. WAM is primarily used for configuring Agents. As part of the configuration, Agents can be associated to one or more FortiSIEM collectors. Agents send log directly to the assigned set of collectors in a round robin fashion. A single WAM can configure a large number of Agents. By removing the WAM from the event forwarding path and utilizing the Collector infrastructure, this architecture provides great scalability.
For details, see here
Dynamic CMDB groups
CMDB Device Groups and Business Service Groups are critical to FortiSIEM Analytics. It enables users to write rules as reports of the form
“Reporting IP IN A CMDB Group”. Currently, CMDB Device Groups are populated during discovery based on an internal template keying on Device vendor and model, e.g. Fortinet FortiGate belongs to both Firewall Group and VPN Group, Cisco IOS belongs to Router/Switch Group etc. Business Groups have to created manually and kept up to date.
This release automates this process by allowing the user to define rules for dynamically associating devices to CMDB groups and Business Services. A rule condition can be based on Device Vendor, Model, Host Name and IP Range. When there is a match, the matching devices would be placed in the specified CMDB Groups and Business Services. The Dynamic CMDB Group happens automatically during discovery. But the assignment rules can also be applied at any time to force immediate assignment. Note that this dynamic CMDB Group assignment is in addition t o the internal template based assignment during discovery.
For details, see Creating Dynamic CMDB Group Policies..
Display CMDB reports in dashboard
Currently, a dashboard can only show reports containing event data. Starting with this release, CMDB reports can also be displayed on the same dashboard, side by side with event data.
For details, see here for Flash version and here for HTML5 version.
Multi-line syslog handling
Often applications generate a single syslog in multiple lines. For analysis purposes, the multiple lines need to put together into a single log. This feature enables you to do that.
User can write multiple multi-line syslog combining rules based on reporting IP and begin and ending patterns. All matching syslog within the begin and ending pattern are combined into a single log.
For details, see Multi-line Syslog Handling..
Custom configuration change monitoring
FortiSIEM can collect configurations from devices and detect changes. Currently, FortiSIEM supports a limited set of devices for this feature and users can not add devices of their choice.
This release provides a way for users to do configuration change monitoring for any device. The user simply needs to upload their own configuration collection script into the system and associate to a device type. When that device type is discovered, a configuration change detection job is created via the user defined custom configuration collection script.
For details, see Custom Configuration Change Monitoring.
STIX/TAXII support for external threat intelligence
This release allows you to download any threat intelligence data in STIX format using TAXII transport protocol without writing any code. Supported IOCs include Malware Domain, IP, URL and hash.
For details, see Custom Malware Domain Threat Feed, Custom Malware IP Threat Feed, Custom Malware Hash Threat Feed and Custom Malware URL Threat Feed.
Ability to monitor a subset of interfaces and processes
Currently, FortiSIEM monitors all interfaces and processes and there is no way to disable monitoring a subset of interfaces and processes. Many network devices (e.g. Voice Gateways) have logical interfaces that do not need to be monitored. Similarly servers have processes that may not need to be monitored. Often these redundant interfaces and processes create lots of events and consumes lots of storage over time, specially if there are many devices with such interfaces/processes.
This release allows you to specify a set of important interfaces and processes. Once this set is defined, FortiSIEM switches to monitoring only this set of important interfaces and processes.
For details, see Adding Important Interfaces and Adding Important Processes.
Ability to flag a WAN interface
Often it is important to monitor only WAN interfaces in a dashboard or report. Typically a deployment has many routers/firewalls with one or two WAN interfaces. Since WAN interfaces are not clearly marked in any configuration or SNMP MIB, the only way to create a report is manually list all the devices and interface pairs in the query. This makes the query quite cumbersome.
This release enables you to mark an interface as a WAN interface. The interface events will have the WAN flag set. To query all WAN interfaces, one simply has to specify “isWAN = true” in the query. This makes writing a query extremely simple.
For details, see Adding Important Interfaces.
Ability to define per-process CPU, Memory thresholds
FortiSIEM provides a way to specify global thresholds and per device local thresholds and refer to them in a rule. This way a single rule can capture global and local thresholds.
The thresholds can be a single value such as Critical CPU threshold, Warning CPU threshold or a map such as a map of interface utilization, disk utilization. While the single values are completely customizable meaning that users can add their own; map thresholds need a definition of the keys (such as interface name, disk name) to be defined in the system.
This release extends the map thresholds to also include process name. User can define global thresholds for process CPU utilization, process Memory utilization and per device, per process overrides (e.g. SQL Server).
For details, see Setting Global and Per-Device Threshold Properties.
Ability to include attachments in a ticket
FortiSIEM provides its own ticketing system for users that do not want to rely on an external ticketing system. Often there is a need to include attachments in a ticket, e.g. to demonstrate the problem while creating a ticket and to demonstrate the problem resolution while closing a ticket. This release allows you to include (PDF and PNG formatted) attachments into a ticket and export that ticket in PDF format to also include the attachments.
For details, see Ticket Related Operations..
Allow exceptions for merging based on hardware serial numbers
FortiSIEM has an algorithm based on hardware serial numbers, host name, IP and MAC addresses to merge devices in CMDB, which is needed since FortiSIEM repeatedly discovers devices. Currently, hardware serial number is a definitive factor – two devices are merged if their serial number is identical. However often some virtualized devices have generic serial numbers e.g. “Unknown”, “0000” etc which causes devices to merged incorrectly. This release provides a way to create a list of virtual serial numbers which are not considered for merge purposes.
For details, see Discovery Settings.
Device / Application Support
Windows Server 2016 – discovery, performance monitoring and log analysis like other Windows Servers – see Microsoft Windows Server Configuration.
FortiDDoS – log analysis – see FortiDDoS Configuration
Google Apps – audit log analysis – see Google Apps Audit Configuration.
Microsoft Office 365 – audit log analysis – see Microsoft Office365 Audit Configuration
Cisco ACI – performance monitoring – see Cisco Application Centric Infrastructure (ACI) Configuration
Brocade CER and MLX routers – performance monitoring – see Brocade NetIron CER Routers
Clavister IPS – log analysis – see here
Cisco SF 300 SG300/350 switches – discovery, performance monitoring – see Cisco 300 Series Routers
Fortinet 5001B firewalls – discovery, performance monitoring – per CPU utilization extensions – see Fortinet FortiGate Firewall
Bug Fixes / Enhancements
|17906||major||Parser||FortiSandbox Parser does not support FortiSandbox VM|
|17415||major||Parser||Some WatchGuard events are not parsed|
|17453||major||Parser||Update the SourceFire parser to support version 6 and later and Snort messages.|
|18053||major||GUI||Incorrect Admin > General Settings > Discovery > Application Filter|
|17281||normal||App Server||Handle rediscovery of devices moved from a system defined group|
|17346||normal||App Server||Should not update ‘Worker up’ error message every 3 minute if the worker is not in down status|
|18056||normal||Parser||Parse event severity from Stonesoft events|
|12617||normal||Parser||Event severity of some Snort events are incorrect|
|16765||normal||GUI||Multiple users cannot use the same dashboard name|
|16845||normal||System||FortiSIEM Login credential anonymization algorithm causes unnecessary login failures|
|16514||normal||App Server||Reports: Display Column “Display As” not working for scheduled PDF reports|
|18108||normal||App Server||Incident Id in Notification Email includes HTML tags in Email Subject|
|17418||normal||GUI||Add Remediation to Rule Export|
|15868||normal||Discovery||FortiSIEM SSH not logging out of Palo Alto Firewall during configuration discovery|
|17979||normal||GUI||Improve display performance of CMDB > Link Usage page in GUI|
|17422||normal||Parser||Imperva DAM Unknown Event Types in Panasonic logs|
|16985||normal||App Server||Allow Super-Global admin assign incident ticket to a org user in Super|
|17555||normal||Parser||Application recognition inconsistency in Netflow IPFIX analysis|
|17507||normal||Rule||Error in System defined Rule “Cisco Call Manager DDR Down”|
|17110||normal||Parser||Reporting device name parsed wrong in Motorola AirDefense Parser|
|16966||normal||GUI||Virtual IPs disappear after exporting and importing credentials|
|16956||normal||GUI||When two super global users create a dashboard for an org, they see each others dashboards in that org|
|16311||normal||GUI||Sometimes the value of application performance shows incompletely when the bar is red|
|17253||normal||GUI||Page header of Ticket export has display issues|
|17540||normal||GUI||Can’t export the result of a cloned Audit Rule to PDF|
|16023||normal||GUI||Incidents page – Filter condition will change after user cancels it via “…” and “e”|
|17436||normal||GUI||Cannot save new ticket without assignee or due date.|
|17837||normal||System||Reverse tunnel vulnerability not fixed on 4.7.2 upgrade|
|16763||normal||Parser||Event parse status is wrong for MYSQL_JDBC_PULL_STAT|
|16762||enhancement||Parser||Parse ‘reporting device name’ ‘host name’ at the first time for log discovered device.|
|13823||enhancement||GUI||Allow Users to select Important Processes per device from the software tab in CMDB|
|17094||enhancement||GUI||Need CMDB Report for Running Applications|
|17860||enhancement||App Server||Threat Feed integration with InSights required by Panasonic|
|15792||enhancement||App Server||Support ‘Report Logo’ and ‘UI Logo’ for Organizations UI and PDF reports|
|16973||enhancement||App Server||Improve and Optimize CI lookup|
|16983||enhancement||App Server||Need a way to specify ticket due dates to specific times|
|17093||enhancement||DataManager||Create an event for when Incoming EPS is more than Guaranteed EPS|
|12049||enhancement||Parser||Parse more Symantec AV Events|
|18003||enhancement||Parser||Some event type display names have %s|
|17428||enhancement||App Server||In CMDB Report, allow Organization and Collector Name as columns|
|16994||enhancement||GUI||Allow the ability to launch integration policy from a specific Incident|
Current Open Issues
|8867||Normal||Rule Engine||LAST and FIRST operators in rules do not work (may crash Rule Worker module)|
|11036||Normal||Rule Engine||Rule Worker module may abort when a PctChange Expression is used|
|14242||Normal||Query Engine||RBAC data conditions not enforced for SP organizations when login in via the super org and moving to another org.|
|15022||Normal||Parser Engine||Parser module may stall/pause if a host name resolution is slow. Work around for now is to disable host name resolution.|
|11112||Normal||Rule Engine||COUNT DISTINCT operations consume large resources for rules utilizing Anomaly Detection|
|14478||Normal||GUI||Sometimes GUI pops up warning (Large amount of data stored over the boundaries) when users restore the archived data or delete the restored data|
|Failed Custom JDBC job shows in performance page after Discovery|
|15247||Normal||Parser||AIX Parser cannot parse events correctly.|
|15253||Normal||Parser||Reporting device name is parsed wrong in LinuxInotifyParser (affects Linux file integrity monitoring via AccelOps agent)|
|Maintenance calendar issue – Maintenance for a device does not start at the configured time if there is a long running disabled job of another device|
|Dashboard Search Filtering Does not work for Clariion LUNs under Summary Tab|
|Generating PDF Reports over 100 Pages will drop Page Footer|
|“Validation Status” column in Admin->Event DB->Event Integrity does not allow for sorting.|
|15300||Minor||GUI||For Report Server, if you sync -> unsync -> sync is rapid succession, then the last sync may not take effect|
|Charts in exported reports (PDF format) only contain stacked charts – not line charts|
Having trouble configuring your Fortinet hardware or have some questions you need answered? Ask your questions in the comments below!!! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!