Adding Devices to the CMDB Outside of Discovery

There are situations in which you may want to add devices to the Configuration Management Database (CMDB) outside of the discovery procedure. For example, FortiSIEM needs access to devices over SNMP or WMI to discover them, but you may have devices in your

infrastructure that don’t utilize these access protocols. The IP addresses for those devices will still be contained in traffic logs, and rules may need to incorporate that device. In order to make sure that logs are parsed correctly and rules function as expected, you need to make sure that these undiscovered devices are associated with an IP address. Adding a device directly to the CMDB lets you provide the information necessary for FortiSIEM to recognize the device, including associating it with an IP address or range.

Adding Devices to Device Groups

When you add a device to the CMDB manually, make sure to choose the group, such Firewall, Printers, or Storage, in the Device View where you want to add it. If you only add it to the top-most Devices group, it will not be added to the topology map correctly.

1. Log into your Supervisor node.
2. Click CMDB.
3. In the Device View, select Devices, then select the sub-category where you want to add the device.
4. In the summary pane, click New.
5. For Summary, Contact, Interfaces, and Properties, enter information for the new device.

Entering Interface Information

When you enter the interface information for the device, make sure to provide the correct IP address and network mask for the interfaces. FortiSIEM will use this network information to generate the Network Segments for the device.

6. Click Save when you’re done adding the device information.

Related Links

Adding a Synthetic Monitoring Test to a Business Service

Scheduling a Discovery

Discovery can be a long-running process when performed on a large network, or over a large IP range, and so you may want to schedule it to occur when there is less load on your network or during off hours. You may also want to set up a schedule for the process to run and discover new devices on a regular basis.

1. Log in to your Supervisor node.
2. Go to Admin > Setup Wizard > Discovery.
3. Click Schedule.
4. Click the +
5. Select from the available ranges.

You can select multiple ranges and set the order in which discovery will run on them by using the up and down arrows.

6. Set the time at which you want discovery to run.
7. For a one-time scheduled discovery, enter a Date for the discovery to run.
8. For recurring discoveries, select how often (hourly, daily, weekly, monthly), you want discovery to run, and then enter other scheduling options.
9. Click OK.

Discovery Range Definition Options

When you set the range definition for your discovery processes, several options are available for how you want the discovery process to run.

Inspecting Changes Since Last Discovery

After you run discovery for the first time, FortiSIEM keeps track of changes to your discovered devices during subsequent discovery runs, including new devices, changed devices, and failed devices.

1. Log in to your Supervisor node.
2. Go to Admin > Discovery Results.
3. Select a discovery result.
4. Click View Changes.
5. Expand the folder Discovery Delta.
6. Move your mouse cursor over a folder or item until a blue Information icon appears, and then click on the icon to view basic information about the item.

Inspecting Event Pulling Methods for Devices

Once you have discovered and approved the devices in your IT infrastructure, you should verify that the FortiSIEM perfMonitor module is polling them over the correct access protocol and pulling event information from them. If you are having issues collecting performance metrics from your devices, you should begin troubleshooting by first checking the status of the event pulling method for the device.

1. Go to Admin > Setup Wizard > Pull Events.
2. Review the Event Pulling Status for each of your discovered devices.

3. Click Show Errors to view a more detailed description of any errors associated with an event pulling method.
4. Click Edit to change any of the event pulling methods associated with a device.
5. Click Apply to apply any changes to your event pulling methods.
6. Click Test Pull Events to test any changes you make.

Approving Newly Discovered Devices

When devices are discovered by FortiSIEM, monitoring of them begins automatically, and incidents for those devices will trigger automatically based on the rules associated with that device. However, you can configure the Discovery Settings so incidents will be triggered only for devices you approve. If you select Approved Devices Only for Allow Incident Firing On, then you will need to approve devices before incidents will be triggered for those devices, but they will still be monitored and added to the CMDB.

1. Log in to your Supervisor node.
2. Go to Admin > Discovery Results.
3. Select a discovery result.
4. Click View Changes.
5. Expand the folder Discovery Delta.
6. Expand the folder New Devices.
7. Select the devices you want to approve, and click Approve Selected.

You can approve all the new devices by selecting the New Devices folder, and then click Approve All.

Related Links

Discovery Settings

Discovering Microsoft Azure Infrastructure

Discovering Microsoft Azure Cloud infrastructure follows the same basic process described in Setting Access Credentials for Device Discovery an d Discovering Devices, but requires a different approach to associating credentials to IP addresses, since Azure uses dynamic, rather than static, IP address assignment.

Create a Certificate file for communicating to Azure Management Server

Setting Access Credentials for Microsoft Azure Discovery

Associating Microsoft Azure with Credentials

Discovering Microsoft Azure Compute Nodes

Create a Certificate file for communicating to Azure Management Server

3. Login to the Azure old portal, upload the .cer to the Settings->”Management Certificates” section.

Setting Access Credentials for Microsoft Azure Discovery

1. Log into your Supervisor node.
2. Go to Admin > Setup Wizard > Credentials.
3. Under Enter Credentials, click Add.
4. Enter a Name for the credential.
5. For Device Type, select Microsoft Azure Compute.
6. For Subscription ID, enter .
7. Upload the Certificate File, enter the region where your AWS instance is located.
8. Enter the Access Key ID and Secret Access Key associated with your AWS instance.
9. Click Save.

Associating Microsoft Azure with Credentials

After you’ve defined all the credentials associated with the access protocols used by devices in your Microsoft Azure instance, you need to associate those credentials.

1. Log into your Supervisor node.
2. Go to Admin > Setup Wizard > Credentials.
3. Under Enter IP Range to Credential Associations, click Add.
4. For IP/Host Name, enter com.
5. Click +, and add the Microsoft Azure Compute credential created in “Setting Access Credentials for Microsoft Azure Discovery”, as well as any other generic credentials you’ve created.
6. Click OK.
7. Click Test Connectivity to make sure you can reach your instance and that all credentials are entered correctly before you initiate discovery.

Discovering Microsoft Azure Compute Nodes

After you’ve defined and tested all the credentials, you can proceed to discovery.

1. Log into your Supervisor node.
2. Go to Admin > Setup Wizard > Discovery.
3. Click Add
4. For Discovery Type, select Azure Scan.
5. Click
6. Select the entry just created and click

If discovery is successful, your discovered instances will be added to Admin > Setup wizard > Monitor Change/Performance and CMDB > Devices > Microsoft Azure Cloud > Azure Compute.

Discovering Amazon Web Services (AWS) Infrastructure

Discovering infrastructure in AWS follows the same basic process described in Setting Access Credentials for Device Discovery and Discovering Devices, but requires a different approach to associating credentials to IP addresses, since AWS uses dynamic, rather than static, IP address assignment. The generic AWS SDK credential is used to discover Amazon Machine Instances (AMIs) and associated information such as host name, instance ID, and instance state, while credentials for generic versions of WMI, SMTP, and other access protocols are used to discover associated devices as you would for any other discovery process.

Setting Access Credentials for AWS Instances

Associating the AWS Host with Credentials

If you have not already configured Access Keys and permissions on AWS, please follow the steps outlined in AWS Access Key IAM Permissions and IAM Policies.

Setting Access Credentials for AWS Instances

1. Log into your Supervisor node.
2. Go to Admin > Setup Wizard > Discovery.
3. Under Enter Credentials, click Add.
4. Enter a Name for the credential.
5. For Device Type, select Amazon AWS SDK.
6. For Access Protocol, select AWS SDK.
7. For Region, enter the region where your AWS instance is located.
8. Enter the Access Key ID and Secret Access Key associated with your AWS instance.
9. Click Save.

Associating the AWS Host with Credentials

After you’ve defined all the credentials associated with the access protocols used by devices in your AWS instance, you need to associate those credentials to the AWS host. In other deployment configurations, you would associate credentials with IP addresses corresponding to your device locations, but since AWS uses dynamic IP addressing, you need to associate all your credentials to the same host.

1. Under Enter IP Range to Credential Associations, click Add.
2. For IP/Host Name, enter com.
3. Click +, and add the AWS SDK credential, as well as any other generic credentials you’ve created.
4. Click OK.
5. Click Test Connectivity to make sure you can reach your instance and that all credentials are entered correctly before you initiate discovery.

Both the connectivity test and the discovery process will try to connect to the Amazon instances first, and from there will try to connect to the private IPs of discovered instances using the other access protocols.

6. You can now initiate discovery of your instances and associated devices as described in Discovering Devices, but for Discovery Type, select AWS Scan.

If discovery is successful, your discovered instances and devices will be added to Admin > Setup wizard > Monitor Change/Performance, and in CMDB > Devices, you will see an Amazon EC2 directory, which will include your discovered instances. If you have defined other access credentials, the discovered devices will also appear in that directory, as well as under CMDB > Server. You can query these devices from either directory.