Default Passwords
The CMDB Default Password page contains a list of default vendor credentials. These well-known credentials should never be used in production. During device discovery FortiSIEM checks if the device credentials are still set to default , and the system rule Default Password Detected by System triggers an incident if they are.
A sample raw event log for a default password incident:
<174>Oct 20 22:50:03 [PH_AUDIT_DEFAULT_PWD_MATCH]:[phEventCategory]=2,[appTransportProto]=SNMP,[reptModel]=
Adding a New Default Password
- Log in to your Supervisor node.
- Go to CMDB > Default Passwords.
- Select a group where you want to add the default password, or create a new one.
- Click New.
- Select the Vendor and Model of the device for which you want to enter a default password.
- Select the Access Protocol that is used to connect to the device.
- Enter the default User Name and Password for the device.
Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!