Category Archives: Administration Guides

FortiSIEM Hypervisor Installations for Report Server

Hypervisor Installations for Report Server

These topics cover the installation of Report Server in various hypervisor enviroments.

Installing and Registering AccelOps Report Server in Amazon Web Services

Installing and Registering AccelOps Report Server in KVM

Installing and Registering AccelOps Report Server in Microsoft Hyper-V Installing and Registering AccelOps Report Server in VMware ESX

Installing and Registering AccelOps Report Server in Amazon Web Services

Follow the instructions for setting up an AccelOps virtual appliance as described in Setting Up Supervisor, Worker and Collector Nodes in AWS, and then register the Report Server to the Supervisor as described in Installing and Registering AccelOps Report Server in VMware ESX.

Turn on archive mode for Report server CMDB replication

  1. Mount a NFS shared directory on both Super and report server and make sure that this mount can survive system reboot. For example:

/data/replication/archive

  1. Make this shared directory own by postgres.postgres
  2. On Super, edit postgresql.conf under /cmdb/data to turn on archive mode by uncommenting (removing # in the first column) the following lines and make sure archive_command points to the correct directory which is created in step 1
  3. On Report Server, edit /cmdb/data/recovery.conf and uncomment the following lines and make sure restore_command and archive_cleanup_command are pointing to the directory created in step 1:
  4. On Super, restart postgresql DB ‘service postgresql-9.1 restart’
  5. On Super, restart App Server (Glassfish)
  6. On Report Server, restart postgresql DB ‘service postgresql-9.1 restart’

Registering Report Server

  1. In the Admin tab, select License Management.
  2. Under Report Server Information, click Add.
  3. Enter the Report Server IP Address, and the Database Username and Password you want to use to administer Report Server.

These are also the credentials that you will use when you set up the Visual Analytics Server to read data from Report Server.

  1. Click Run in Background if you want Report Server registration to run in the background for larger installations.

When CMDB size is under 1GB, registration takes approximately 3 minutes to complete.

  1. When registration completes, click OK in the confirmation dialog.
  2. Under the Admin tab, select Cloud Health and make sure Report Server is up and running.

Installing and Registering AccelOps Report Server in KVM

Follow the instructions for installing an AccelOps virtual appliance as described in Importing a Supervisor, Collector, or Worker Image into KVM, and then register the Report Server with the Supervisor as described in Installing and Registering a Report Server Node in ESX.

Turn on archive mode for Report server CMDB replication

  1. Mount a NFS shared directory on both Super and report server and make sure that this mount can survive system reboot. For example:

/data/replication/archive

  1. Make this shared directory own by postgres.postgres
  2. On Super, edit postgresql.conf under /cmdb/data to turn on archive mode by uncommenting (removing # in the first column) the following lines and make sure archive_command points to the correct directory which is created in step 1
  3. On Report Server, edit /cmdb/data/recovery.conf and uncomment the following lines and make sure restore_command and archive_cleanup_command are pointing to the directory created in step 1:
  4. On Super, restart postgresql DB ‘service postgresql-9.1 restart’
  5. On Super, restart App Server (Glassfish)
  6. On Report Server, restart postgresql DB ‘service postgresql-9.1 restart’

Registering Report Server

  1. In the Admin tab, select License Management.
  2. Under Report Server Information, click Add.
  3. Enter the Report Server IP Address, and the Database Username and Password you want to use to administer Report Server.

These are also the credentials that you will use when you set up the Visual Analytics Server to read data from Report Server.

  1. Click Run in Background if you want Report Server registration to run in the background for larger installations.

When CMDB size is under 1GB, registration takes approximately 3 minutes to complete.

  1. When registration completes, click OK in the confirmation dialog.
  2. Under the Admin tab, select Cloud Health and make sure Report Server is up and running.

Installing and Registering AccelOps Report Server in Microsoft Hyper-V

Follow the virtual appliance installing instructions in Installing in Microsoft Hyper-V, and then register the Report Server node with the Supervisor as described in Installing and Registering AccelOps Report Server in VMware ESX.

Turn on archive mode for Report server CMDB replication

  1. Mount a NFS shared directory on both Super and report server and make sure that this mount can survive system reboot. For example:

/data/replication/archive

  1. Make this shared directory own by postgres.postgres
  2. On Super, edit postgresql.conf under /cmdb/data to turn on archive mode by uncommenting (removing # in the first column) the following lines and make sure archive_command points to the correct directory which is created in step 1
  3. On Report Server, edit /cmdb/data/recovery.conf and uncomment the following lines and make sure restore_command and archive_cleanup_command are pointing to the directory created in step 1:
  4. On Super, restart postgresql DB ‘service postgresql-9.1 restart’
  5. On Super, restart App Server (Glassfish)
  6. On Report Server, restart postgresql DB ‘service postgresql-9.1 restart’

Registering Report Server

  1. In the Admin tab, select License Management.
  2. Under Report Server Information, click Add.
  3. Enter the Report Server IP Address, and the Database Username and Password you want to use to administer Report Server.

These are also the credentials that you will use when you set up the Visual Analytics Server to read data from Report Server.

  1. Click Run in Background if you want Report Server registration to run in the background for larger installations.

When CMDB size is under 1GB, registration takes approximately 3 minutes to complete.

  1. When registration completes, click OK in the confirmation dialog.
  2. Under the Admin tab, select Cloud Health and make sure Report Server is up and running.

Installing and Registering AccelOps Report Server in VMware ESX

These instructions are for installing Report Server on VMWare ESX, and assume that you have already installed and configured an AccelOps environment. For instructions for a complete AccelOps install, see the topics under Installation.

Installing Report Server

Follow the instructions for installing an AccelOps virtual appliance as described in the topics under Installing a Supervisor, Worker, or Collector Node in ESX and in Configuring the Supervisor, Worker, or Collector from the VM Console.

Turn on archive mode for Report server CMDB replication

  1. Mount a NFS shared directory on both Super and report server and make sure that this mount can survive system reboot. For example:

/data/replication/archive

  1. Make this shared directory own by postgres.postgres
  2. On Super, edit postgresql.conf under /cmdb/data to turn on archive mode by uncommenting (removing # in the first column) the following lines and make sure archive_command points to the correct directory which is created in step 1
  3. On Report Server, edit /cmdb/data/recovery.conf and uncomment the following lines and make sure restore_command and archive_cleanup_command are pointing to the directory created in step 1:
  4. On Super, restart postgresql DB ‘service postgresql-9.1 restart’
  5. On Super, restart App Server (Glassfish)
  6. On Report Server, restart postgresql DB ‘service postgresql-9.1 restart’

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

FortiSIEM Installation and Configuration of AccelOps Visual Analytics

Installation and Configuration of AccelOps Visual Analytics

Installation and configuration of AccelOps Visual Analytics involves setting up AccelOps Report Server, and then integrating it with Tableau Server and Desktop from Tableau Software. Topics in this section contain setup and configuration instructions for Report Server. For information on setting up and configuring Tableau Server and Desktop, see the online Tableau Software documentation.

Requirements for Visual Analytics Report Server

Setting Up Visual Analytics

Hypervisor Installations for Report Server

Syncing with the Report Server

 

Requirements for Visual Analytics Report Server

You install Visual Analytics Report Server as an AccelOps node, and these requirements assume that you have already set up and installed AccelOps. If you are working with a fresh install of AccelOps that includes Report Server, see the topics under Installation for complete requirements and installation instructions for the AccelOps Virtual Appliance.

Hardware Requirements for Report Server Nodes

Component Quantity Host

SW

Processor Memory OS/App Storage Reports Data Storage (1 year)
Report

Server

1 ESX 8 Core 3

GHz, 64 bit

16 GB 200GB (80GB OS/App, 60GB

CMDB, 60GB SVN)

See recommendations under Hardware Requirements for

Supervisor and Worker nodes

 

 

Setting Up Visual Analytics

There are three components to Accelops Visual Analytics:

  1. Accelops Report Server
  2. Tableau Server
  3. Tableau Desktop

Setting up Visual Analytics involves setting up each of those components in order, and establishing the relationship between them.

  1. You must first install Report Server as described in Installing and Registering AccelOps Report Server in VMware ESX.
  2. After installing Tableau Server on a Windows server, and installing Tableau Desktop on a Windows or Mac OS X device, you then connect the two systems as described in the Tableau Software product documentation.
  3. When this connection is established, it automatically triggers the remote registration and configuration of the AccelOps Report Server, including replication of the CMDB and EventDB data from the AccelOps Cluster to the AccelOps Report Server, as well as the user account required for access to the original databases.

Registration of the Report Server and replication of the AccelOps database data may take some time depending on the size of the original CMDB. Registration is complete when the replication process catches up with the latest data in the system. From that point on, replication from the CMDB to Accelops Report Server takes place in near real time, letting you run Visual Analytics queries against CMDB data that has been replicated to the Report Server’s phoenixdb.

You can find full information about setting up all components of AccelOps Visual Analytics in the section Installation and Configuration of

AccelOps Visual Analytics


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

FortiSIEM Visual Analytics

Visual Analytics

Visual Analytics is an add-on for AccelOps that lets you create custome visualizations of AccelOps report data, as well as dashboards containing multiple visualization charts. AccelOps Visual Analytics has three components:

  1. The AccelOps Report Server, which syncs with and replicates AccelOps reports in near-real time.
  2. Tableau Server from Tableau Software, which enables the publication and distribution of your visualizations.
  3. Tableau Desktop, also from Tabeleau Software, which is your primary tool for creating visualizations.

See Installation and Configuration of AccelOps Visual Analytics for information about setting up AccelOps Report Server. For more detailed information about Tableau Server and Desktop, including installation, configuration, and examples of creating sheets and workbooks, you should consult the Product Support section of the Tableau Software website.

 

AccelOps Visual Analytics Architecture

Overview and Report Server Architecture

Using AccelOps Report Server with Tableau Software

Overview and Report Server Architecture

With AccelOps Visual Analytics, you can now create visual representations of the data that is stored in AccelOps. This includes:

Structured data stored in the AccelOps CMDB relational PostgreSQL database, such as: Discovered information about devices, systems, applications and users

Identity and location information

Incidents and notifications

Unstructured data such as logs, events, performance metrics etc. that are monitored by AccelOps and stored in the EventDB NoSQL database, which is accessible by Supervisors and Workers over NFS.

In order to provide near real-time visual analytics without compromising the performance of your AccelOps deployment, both structured and unstructured data is exported to a separate virtual machine, the AccelOps Report Server, running PostgreSQL. The Report Server contains two databases that are queried by AccelOps Visual Analytics:

phoenixdb

This database contains the entire AccelOps CMDB and is populated via asynchronous PostgreSQL replication (slony) in near-real time.

reportdb

This database contains the results of event queries

You can find more information about AccelOps Report Server in the topic Report Server Architecture: phoenixdb and reportdb and its related topics.

Using AccelOps Report Server with Tableau Software

AccelOps Report Server integrates with Tableau Software to provide the interface for creating and publishing your data visualizations. Workbooks containing visualizations based on AccelOps data are created using Tableau Desktop, and then are published to Tableau server, where they can be accessed on any Windows or OS X device by users how have been granted permission for viewing or editing them. AccelOps provides some workbooks for visualizations, but you can construct others for custom analytics. You can find more information about workbooks in the section Cre ating and Managing Workbooks.

 

 

 


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

FortiSIEM Audit

Audit

Audit Reports can be used to determine if a device is running the recommended OS and installed software versions, performance metrics are within bounds and harmful events have not triggered.

Creating Audit Report

Running an Audit

Exporting Audit Results

Scheduling an Audit

 

Creating Audit Report

To create an Audit Report

  1. Go to Analytics tab
  2. Expand Audit node on the left tree and go to the folder to which the new report will belong. You can also create a new folder first by clicking on the + on top of the left tree.
  3. Click New.
  4. Enter the following information for an Audit Report
    1. Name: Name of the Audit Report
    2. Description: Description of the Audit Report
    3. Vendor: Select a specific device vendor from the drop down list. The Audit Report will be specific to the chosen device vendor and model
    4. Model: Select a vendor specific model from the drop down list. The Audit Report will be specific to the chosen device vendor and model
    5. Specify Failed Criteria for the Audit Report. A device will fail the audit if any of the specified criteria is matched. i. OS Version Condition:
      1. Choose an operator: possible choices are IN, NOT IN, CONTAINS, NOT CONTAINS
      2. Specify value to be matched: this can be a comma separated list ii. Install Software Condition:
      3. Specify Condition name. This is just for reference purposes.
      4. Specify Install software name – the name has to be exactly identical to the discovered installed software in CMDB > Devices > Installed Software > Name
      5. Choose an operator: possible choices are IN, NOT IN, CONTAINS, NOT CONTAINS
      6. Specify value to be matched: this can be comma separated list
  • Rules Condition:
    1. Click and the Rule selector dialog appears
    2. Select the appropriate Rule folder from the left most tree. If you do not know the specific folder, then choose the top level Rules folder.
    3. Select the rules from the middle section. You can also type a search string. You can expand the window and shrink the left most section to see more of the rule descriptions. The rules in the selected folder will appear in the middle section.
    4. Click Items >> to place the selected rules on the rightmost section 5. Click
  1. Report Condition:
    1. Click and the Report selector dialog appears
    2. Select the appropriate Report folder from the left most tree. If you do not know the specific folder, then choose the top level Reports folder. The reports in the selected folder will appear in the middle section.
    3. Select the reports from the middle section. You can also type a search string. You can expand the window and shrink the left most section to see more of the report descriptions.
    4. Click Items >> to place the selected reports on the rightmost section 5. Click OK.

 

Audit Policy Criteria Matching Notes

  1. For each criteria, only devices in CMDB with vendor and model specified in the Audit Report is considered
  2. If any of the criteria matches, then the device fails the audit
  3. IN and NOT IN are exact match while CONTAINS and NOT CONTAINS are case insensitive sub-string match
  4. For OS Version match, the entered value is compared with the Version column in CMDB > Device.
  5. For Installed Software Version match, the entered value is compared with the Version column in CMDB > Device > Installed Software
  6. For Rule match, the specified rule must trigger during the time interval specified in the Audit Report. Organization id and access IP of the device is compared to the Organization Id and Host IP in an incident.
  7. For Report match, the specified reports run for the time duration specified in Audit Report must have data.
Running an Audit

To run an Audit,

  1. Select an Audit Policy
  2. Click Run Now
  3. In the follow up dialog,
    1. Select the organizations for which to run the audit (meaningful for Service Provider version)
    2. Choose a time window – absolute or relative
    3. Click OK

The Audit Policy check results are displayed in the right bottom pane.

Summary tab shows a high level overview of the Audit Policy check.

 Audit Result Distribution chart shows the device pass/fail distribution for every selected organization.

Failed Criteria distribution chart shows the contribution of each audit criteria to the devices that failed the audit.

Detail tab shows the Audit Policy check for each device matching the vendor, model specified in the policy.

Organization specifies the entity to which the device belongs

Device Name is the host name of the device in CMDB

Audit Status is the Pass/Fail flag

Details specifes the reasons for Audit Policy check failure

Exporting Audit Results

To export an Audit Report,

  1. Select an Audit Policy
  2. Run the Audit Policy Check. The results will be shown in the bottom right pane.
  3. Click Export
    1. Add User Notes
    2. Choose Output Format – PDF or CSV
    3. Click Generate Report – the PDF file will be stored in local disk
Scheduling an Audit

To schedule a report to run at a later time

  1. Choose between one of two options
    1. Run this report for – If the ‘Run this report for’ button is selected, a report will be scheduled for the super user, containing data from the organizations selected. The super user will be the owner of the report. The recipients of the report may be defined in the ‘Send Notifications’ section below or in Admin -> General Settings -> Analytics.
    2. Schedule this report for – If the ‘Schedule this report for’ button is selected, multiple reports will be scheduled — one for each selected organization — and containing only that organization’s data. The reports will be owned by the respective organizations. The recipients of the report are taken from Admin -> General Settings -> Analytics. When multiple reports are run in this way the notification recipients cannot be indicated in the ‘Send Notifications’ section below.
  2. Select all the Organizations for which to run the Audit Report
  3. Select the Report time range
  4. Specify Schedule settings – when to run this report
  5. Choose Output Format – PDF or CSV
  6. Select notification – report recipients and method
    1. If you choose Send default notification, then the settings in Admin > General Settings > Analytics > Alerts to be sent when scheduler runs any REPORT, is used
    2. If you choose Specify custom notifications, then you can specify email addresses
    3. If you choose Copy to a remote directory, then the settings in Admin > General Settings > Analytics > Reports to be copied to this remote location when scheduler runs any REPORT, is used

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

FortiSIEM Viewing Available Reports

Viewing Available Reports
  1. Log in to your Supervisor node.
  2. Go to Analytics > Reports.
  3. For multi-tenant deployments, select the Organization for which you want to view the available reports.
  4. Expand the Reports list, and select the subcategory of report you want to view.
  5. Select the report you want to view information about. Each report has four information tabs:
Report

Tab

Description
Summary Includes the Filter and Group By conditions for the report, and the report’s Display attributes
Schedule Information about when the report is scheduled to run. See Scheduling Reports for more information. You can click the + icon to set a schedule for the report to run.
Results The results from any scheduled runs of the report, or results you have saved from running the report.
Definition The XML definition of the report.

 


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

FortiSIEM Scheduling Reports

Scheduling Reports

You can schedule reports to run once or on recurring periods in the future. When the test runs, the results will be saved to the Results tab for the report, and in Analytics > Generated Reports.

Prerequisites

When you schedule a report, you can specify notifications that should be sent for that report. In addition, you should make sure that the d efault settings for notifications for all scheduled reports have been set up.

Procedure

  1. Log in to your Supervisor node.
  2. Go to Analytics > Reports.
  3. Select the report you want to schedule.
  4. Select Schedule this report for:
  5. For multi-tenant deployments, select the Organization for which this report should apply.
  6. Select the Report Time Range.
  7. Select the Schedule Settings.
  8. Select the Output Format, whether you want to include the Chart in the output, and the Maximum Rows to Display.
  9. Specify the Notifications that should be sent when the report runs.

Click Specify custom notifications if you want to send notifications to specific email addresses.

To copy the report to a remote directory, first define the remote location in Admin > General Settings > Analytics > Report to be copied to this remote location when scheduler runs any report. and then select Copy to a remote directory option.

  1. Specify the amount of time the report should be retained after it has run.
  2. Click OK.

The report will run at the time you scheduled.

Related Links

Setting Up Email Alert Routing for Scheduled Reports


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

FortiSIEM Running System and User-Defined Reports and Baseline Reports

Running System and User-Defined Reports and Baseline Reports

AccelOps includes a number of baseline reports for common data center analytics, as well as over 300 reports relating to IT infrastructure. You can also create your own reports. This topic describes how to run a system-generated or user-defined baseline report.

  1. Log in to your Supervisor node.
  2. Go to Analytics > Reports and select the subcategory containing the report you want to run.

For baseline reports, select Baseline.

  1. Select the report to run.
  2. Click Run Now to run the report immediately, or Run Later to schedule the report.
  3. If you chose Run Now and have a multi-tenant deployment, select the Organization for which you want to run the baseline report, and then click OK.

The report will run and the results will be displayed.

For baseline results, the values in the Profile Date Type column indicate whether the baseline date type is a Weekend (Saturday and Sunday) – 0 or Workday – 1. The values in Hour of Day, 1 – 24, column indicate the time on which the baseline is based.

You can further refine the results of reports and baseline reports as described in Using Search Results to Refine Historical Searches.

For baseline reports, you can create scatter plots of the report results, use the Quick Info menu to get more information about items in the report results, and also view geolocation information about the results. For other types of reports you can use all the charts and other methods of refining results that are related to historical search.

Related Links

Scheduling Reports

Using Search Results to Refine Historical Searches

System-Defined Baseline Reports

Overview of Historical Search Results and Charts

Using the Analysis Menu

Using Geolocation Attributes in Rules

Refining the Results from Historical Search


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

FortiSIEM Report Bundles

Report Bundles

Report bundles are groups of reports for common IT infrastructure analytics, such as Windows Server Health. Be defining a bundle and placing reports into it, you can run all the reports at the same time, and apply the same filter conditions to all reports. You can view system and user-defined report bundles under Analytics > Report Bundles.

Creating a Report Bundle Running a Report Bundle

Creating a Report Bundle

Creating a report bundle involves naming and describing the bundle, adding reports to the bundle, and then setting what you want to include in the report results.

  1. Log in to your Supervisor node.
  2. Go to Analytics > Reports > Report Bundles.
  3. Click the + icon at the top of the Analytics navigation pane.
  4. For Group, enter the name of the bundle, and then enter a Description.
  5. Under Select Group Members, select the report category that contains the report you want to add to the bundle.

When you select a category, all the reports in that category will be added to the selection window.

  1. Select a report and use the >> button to add it to the bundle.
  2. Select Show Table if you want all reports to include tables by default.

You can set individual reports to show tables by selecting the report under Show Reports, clicking Edit, and then selecting Show Table.

  1. Enter the number of Rows per Table.
  2. Click OK.

Running a Report Bundle

  1. Log in to your Supervisor node.
  2. Go to Analytics > Reports > Report Bundles.
  3. Select a report bundle to run.
  4. At the top of the Analytics navigation pane, click the blue Arrow
  5. For multi-tenant deployments, select the Organization for which the reports should apply.
  6. Select the Time Range for the results.
  7. Set any Data Conditions to use in filtering the results.

The most common use cases for setting data conditions involves imposing additional restrictions on the reporting devices, for example reporting devices IN a particular device group. These conditions are AND-ed to the filter conditions in every report of the bundle.

  1. Click Export.

The reports will run in the background, and when ready, you will see a dialog to save or download the PDF files.


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!