FortiSIEM Overview of the CMDB User Interface

Overview of the CMDB User Interface

While the Summary and Widget dashboard views of your IT infrastructure provide real-time monitoring and reporting on your IT infrastructure, the CMDB view provides more in-depth detail about devices, applications, users, and other IT infrastructure components as they are listed in the CMDB, as well as the ability to manage these objects.

Tab Overview

Inventory Management and Edit Details Controls

User Interface Controls for Device View

Data Collection Status

Tab Overview

This screenshot shows the Device view of the CMDB tab with Devices selected in the Device View of the IT infrastructure hierarchy. For any type of object you select in the hierarchy, the CMDB will load a Summary view of the objects in the top pane, and Details for any individual object you select from the summary in the bottom pane. While the available details will change depending on the type of object you select, all objects in the CMDB view will have Inventory Management controls in the summary pane, and an Edit Details control in the Details pane.

Inventory Management and Edit Details Controls
UI

Control

Description
New Add a new object to the CMDB

Manually Adding Devices to the CMDB

In most cases you will want to add devices to the CMDB through the device discovery process, but there are some situations in which you may want to add them manually, as described in Adding Devices to the CMDB Outside of Discovery and Adding a Synthetic Monitoring Test to a Business Service.

Delete Delete a selected object from the CMDB
Edit Edit details about the selected object. You can also use the Edit Details button in the Details pane for the same purpose. You can also set device-specific properties to use in defining per-device thresholds.
User Interface Controls for Device View

The view of devices in the CMDB provides you with a number of ways to access information about a device. Some of the device user interface controls in the CMDB view you can also find in the dashboard summary view of devices, such as the Analysis menu and the Quick Info view of a device.

UI Control Description
Views Inventory

A summary of all devices of that type in the CMDB

Topo

Shows all devices of the selected type in a topology view

Performance

Shows a Performance Summary dashboard for all devices of that type

IP

Management

Hover your mouse cursor over the IP address associated with a device to open the IP Management menu

Quick Info

Loads the Quick Info for the device, which you can also see by selecting Quick Info in the Analysis menu Topology

Shows the device’s location in the network topology, which you can also see by clicking the Topology button in the device

Details pane

Show Real-Time events on this IP

Loads a Real Time Search with the selected IP address in the search criteria

Show Events on this IP for the Past 5 Minutes

Loads and Historial search with the selected IP address in the search criteria and the Time filter set to Last 5 Mins

Add to WatchList

Add that IP address to a WatchList

More Location

Displays any location information associated with the device

Change Org

For multi-tenant deployments, change the organization associated with the device Impacted Org

Shows organizations that device is associated with

Maintenance

Displays the maintenance schedule for the device

Export General Info

Exports a summary view of selected devices, or a detailed view of information for a specific device, in PDF or CSV format

Approve Approve any newly-discovered devices
Analysis The Analysis menu contains a number of options for component analytics, depending on the component selected. See Using the Analysis Menu for more information. You can also access the Analysis menu for a component by hovering your mouse over the component’s Device IP menu until the blue Quick Info icon appears, and then clicking the icon.
Quick Info The Quick Info view of a device, which you can also access through the Analysis menu or hovering your mouse cursor over the Device IP column, displays General and Health information for the device, and when appropriate, Identity and Location information. It also contains links to additional information about the device:

Incidents

An exportable summary of incidents associated with the device

Health

Availability, Performance, and Security health information for the device. You can also access this information by clicking the Device Health user interface control, or by selecting Device Health in the Analysis menu.

BizService

Any business services impacted by the device. You can also access this information by selecting Impacted Business Services in the Analysis menu.

Applications

Displays a report on the top 10 applications associated with the device by Average CPU Utilization over the past hour Vulnerability and IP Status (Not used in the Dashboard view)

Displays the vulnerability status reports that are also available by selecting Vulnerability and IPS Status in the Analysis menu

Hardware Health (Used only for the CMDB/Storage view)

Displays health information for the hardware being used for storage

Interfaces

Displays a report on the top 10 interfaces associated with the device by average throughput Topology

Shows the device’s location in the network topology. You can also access this information by selecting Topology in the A nalysis menu.

The Quick Info view also contains two links, Goto Config Item, which links to the device entry in the CMDB, and Goto Identity , which links to Analytics > Identity and Location Report, where you can edit this information for the device.

Device Info Each tab contains information about a specific aspect of the device, as well as an Edit button to change information:

Summary

General organizational and operational information about the device

Health

Availability, Performance, and Security health reports for the device. You can also access this information by selecting a device in the Summary dashboard, and then click Health, or by going to Quick Info > Health after selecting the device. If any Incidents are displayed, click the number to view the Incident Summary. Depending on the reported metric, you can zoom in for a closer look at graphs and reports by clicking the Magnifying Glass icon that appears when you hover your mouse cursor over them. Monitor

Shows Event Receive Status and Performance Monitor Status – when data was last collected and status

Contact

Contact information for the device

Interfaces

Interfaces connected to the device

Software

Software running on the device. Categories include Installed Software, Running Applications, Windows Services, and Installed Patches. In the Installed Software category you can use the Diff… button to compare different versions of software you’ve installed.

Hardware

Information about the hardware associated with the device. Categories include Processors, Storage, SAN Storage, Syst em BIOS, Components, SAN Ports, RAID Groups, LUNs, and Storage Groups.

Configuration

Configuration files associated with the device. You can compare configuration files by selecting two or more, and then clicking Diff…

Relationships

Other devices that this device interacts with

Topology Shows the selected device in the Topology view
Edit Details Click to edit the Summary, Contact Info, Interfaces, and Properties for the device

 

Data Collection Status

Real time data collection status is shown for each device

Performance Monitor Status

Normal – if every performance monitor job status for this device is Normal

Warning – if at least one performance monitor job status for this device is Warning and none is critical Critical – if at least one performance monitor job status for this device is Critical

Event Receive Status

Normal – if the event receive status of every protocol for this device is Normal

Warning – if the event receive status of at least one protocol for this device is Warning and none is critical Critical – if the event receive status of at least one protocol for this device is Critical

Performance Monitor Job Status is computed as follows. Two global constants are defined in Admin > Device Support > Custom Properties.

  1. Performance Monitoring Time Gap Warning Threshold – multiples of polling interval (default 3)
  2. Performance Monitoring Time Gap Critical Threshold – multiples of polling interval (default 5)

Event Receive Job Status is computed as follows. Two global constants are defined in Admin > Device Support > Custom Properties.

  1. Event Receive Time Gap Warning Threshold in minutes (default 10)
  2. Event Receive Time Gap Critical Threshold in minutes (default 20)

These constants can also be specified at a per device level from CMDB > Device > Bottom pane Edit > Properties. Write new values for these thresholds in the edit box and click Save.

Metric Status Condition
Performance Monitor Job

Status

Normal Performance Monitoring Time Gap LESS THAN Performance Monitoring Time Gap Warning Thresh old
Performance Monitor Job

Status

Warning Performance Monitoring Time Gap GREATER THAN Performance Monitoring Time Gap Warning T hreshold BUT

LESS THAN Performance Monitoring Time Gap Critical Threshold

Performance Monitor Job

Status

Critical Performance Monitoring Gap GREATER THAN Performance Monitoring Time Gap Critical Threshol d
Event Receive Job Status Normal Event Receive Time Gap LESS THAN Event Receive Time Gap Warning Threshold
Event Receive Job Status Warning Event Receive Time Gap GREATER THAN Event Receive Time Gap Warning Threshold BUT

LESS THAN Event Receive Time Gap Critical Threshold

Event Receive Job Status Critical Event Receive Time Gap GREATER THAN Event Receive Time Gap Critical Threshold

The following table shows how the various job types are classified into Performance Monitor or Event Received types

Job Type Classification in CMDB > Device >

Monitor

Jobs defined in Admin > Setup wizard > Monitor Change/performance Performance Monitor
Jobs defined in Admin > Setup wizard > Pull Events (e.g. Event Receive
Protocols via which data is pushed to us – syslog, SNMP Trap, Netflow, SFlow, Windows Agents etc Event Receive

 

The following rules trigger when certain data collection exceptions happen.

Rule When does it trigger? When does it clear?
Missing specific performance metric from a device Triggers when Performance Monitor is Critical for one job for a monitored device Clears when Performance Monitor is

Normal for that job from that device

No performance metrics from a device Triggers when Performance Monitor is Critical for ALL jobs for a monitored device Clears when Performance Monitor is

Normal for all jobs from that device

FortiSIEM Performance

Monitoring Relay Not Working –

All Devices delayed

Triggers when Performance Monitor is Critical for all devices

monitored by a Worker/Collector (that is acting as a Performance Monitoring Relay)

Clears when Performance Monitor is

Normal for all devices from that

Worker/Collector

No logs from a device Triggers when Event Receive Job Status is Critical for one devi ce Clears when Event Receive Job

Status is Normal for that device

FortiSIEM Log Relay Not

Working – All Devices delayed

Triggers when Event Receive Job Status is Critical for all devic es to a specific Worker/collector (that is acting as a Log Relay) Clears when Event Receive Job

Status is Normal for all devices from that Worker/Collector

 

 

 


Having trouble configuring your Fortinet hardware or have some questions you need answered? Ask your questions in the comments below!!! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Don't Forget To Buy Your Fortinet Hardware From The Fortinet GURU

Leave a Reply

Name *
Email *
Website

This site uses Akismet to reduce spam. Learn how your comment data is processed.