Discovering Devices

Prerequisites

Make sure you have configured the Discovery Settings for your deployment

Set up the Access Credentials for your devices so FortiSIEM can communicate with them

Procedure

After you have set up the access protocols for your devices as described in Setting Access Credentials for Device Discovery, you are ready to discover devices in your IT infrastructure.

1. Log in to your Supervisor node.

Discovering Devices for Multi-Tenant Deployments

If you have a multi-tenant FortiSIEM deployment that uses Collectors and you and want to discover devices for a specific organization, rather than the Global organization, log into your Supervisor node as an admin user for that organization. See Dis covery for Multi-Tenant Deployments for more information about how discovery works for multi-tenant deployments with and without Collectors.

2. Go to Admin > Setup Wizard > Discovery.
3. Click Add.

You can also schedule single or recurring discovery processes as described in Scheduling a Discovery.

4. In the Range Definition dialog, set the options for this discovery.

See Discovery Range Definition Options for more information about the options available in this dialog.

5. Click OK.

Your range definition will be added to the list.

6. Select your range definition, and then click Discover.

A discovery dialog will show you the progress of your discovery. For long-running discoveries, you can use the Run in Background optio n.

7. When discovery completes, the results will be displayed in the dialog. Click Errors to view any errors.

Possible Causes of Discovery Errors

If there are errors during the discovery process, the Errors screen will inform you of their severity, impact, and potential resolution. Some possible reasons for errors include:

A device is not online or not reachable via ping. FortiSIEM will attempt to ping devices before initiating a full discovery to save time.

A device is not responding to SNMP or WMI requests, or there is a firewall blocking these requests from FortiSIEM The SNMP/WMI credentials are incorrect

WMI may not have been set up correctly on the server. See the appropriate topic under Configuring External Systems for Discovery, Monitoring and Log Collection for how to configure WMI for your device.

Approving Newly Discovered Devices

If you selected Approved Devices Only for the discovery setting Allow Incident Firing On, as described in Discovery Settings, then you will need to approve your newly discovered devices before incidents will be triggered for those devices. See Approving Newly Discovered Devices for more information.

Setting Access Credentials for Device Discovery

Before you can discover devices, you need to provide the access protocol and credentials associated with the IP address or range where your devices are located. FortiSIEM will then use this information to access your devices, pull information from them, and begin monitoring them.

Access Protocols Required for Discovery

SNMP, VM SDK (for VMware vCenter), or WMI (for Windows devices) must be one of the access protocols for which you provide credentials in order for the devices associated with an IP address or range to be discovered. If your device does not use one of these protocols, then you must configure it to communicate with FortiSIEM as described in the topics under Configuring External Systems for Discovery, Monitoring and Log Collection. As described in those topics, you may also need to set up additional configurations within your devices to send logs and other information to FortiSIEM.

Associate Credentials Only with the IP Address Where They Will be Used

Credentials should only be associated with IP addresses where they can be used. Assigning multiple credentials to IP addresses where they are not used will trigger discovery operations for each credential, and the system will wait for a timeout to occur for each credential before it moves to the next one. This will cause the discovery process to require much more processing time and processing power from the FortiSIEM system. You can, however, associate the same credential (for example, a generic SNMP access credential) to multiple IP addresses where it will be used to communicate with a device over that protocol.

Before starting the discovery process, credentials need to be defined and then associated to specific IP addresses.

Define Credentials

1. Log into your Supervisor node.
2. Go to Admin > Setup Wizard > Discovery.
3. Under Enter Credentials, click Add.
4. Enter a Name for the credential.
5. Select a Device Type to associate with the credential.
6. Select the Access Protocol for which you want to enter credentials.

Note that the Device Type selection determines which Access Protocols are available. Change the default destination ports only if needed

7. Choose Password Configuration method
   1. Manual – means that you have to define credentials in FortiSIEM
   2. CyberArk – means Accelps will fetch credentials from CyberArk
8. If you choose Password Configuration as Manual, then enter the credentials required for the Access Protocol.
9. If you choose Password Configuration as CyberArk, then choose CyberArk parameters
   1. AppID must be set to FortiSIEM
   2. Specify Safe, Folder, Object: This is the CyberArk Vault Safe, Folder, Object where the credential is defined.
   3. Specify User Name: This is the User Name of the credential
   4. Specify Platform (Policy ID): This is the platform related property for the credential. Specify this only if this property is also set in CyberArk. The match will be case sensitive.
   5. Specify Database: This is a property for the database credential. Specify this only if this property is also set in CyberArk. The match will be case sensitive.
   6. Check Include Address for Query: If checked, FortiSIEM will query the CyberArk credential by IP or host name. Specify this if CyberArk credential objects are specified by IP.
10. Click Save. The credentials you created will be added to the list.

Specify Device to Credential Mapping

1. Under Enter IP Range to Credential Associations, click Add.
2. Select the credential you just created from the list.

Note that you can add multiple credentials to the same IP/host information in this step by clicking +.

3. Enter an IP address, IP range, or Host Name to associate with the credential.

Test Connectivity

You need to perform a Test Connectivity to make sure that the credentials are correct.

1. Select the IP/credential association you just created, and click Test Connectivity. A ping will be performed first to make sure that the host is alive. If ping is disabled in your network, then choose Test Connectivity without ping.

A dialog will show you the results of your connectivity tests. Note that the connectivity tests can take several minutes, so you may want to use the Run in Background option.

Setting up CyberArk

This section specifies how FortiSIEM can be configured to fetch credentials from CyberArk.

Installing CyberArk Provider in FortiSIEM

1. Login to FortiSIEM as root
2. Run the rpm command to begin the installation:

The installation runs automatically and does not require any interactive response from the user. When the installation is complete, the following message appears: “Installation process completed successfully.”

Configuring CyberArk Provider in FortiSIEM

1. Login as root
2. Open the Vault.ini file and specify the parameters of the Vault that will be accessed by the Provider
3. Run CreateCredFile to create a credential file for the administrative user that will create the Vault environment during installation.
4. Check the log file /var/tmp/aim-install-logs/CreateEnv.log to make sure that the Provider environment was created successfully
5. Start the CyberArk Application Password Provider service manually as a privileged user
6. Run ldconfig

Configuring CyberArk for communication with FortiSIEM

1. Login to CyberArk Password Vault Web Access (PVWA) Interface as an user allowed to managed applications (it requires Manage Users authorization).
2. Add FortiSIEM as an Application
   1. Go to Applications and click Add Application.
   2. Set Name to FortiSIEM
   3. In the Description, specify a short description of the application that will help you identify it (e.g. FortiSIEM SIEM)
   4. In the Business owner section, specify contact information about the application’s Business owner.
   5. In the lowest section, specify the Location of the application in the Vault hierarchy. If a Location is not selected, the application will be added in the same Location as the user who is creating this application.
   6. Click Add; the application is added and is displayed in the Application Detailspage
3. Check Allow extended authentication restrictions – this enables you to specify an unlimited number of machines and Windows domain OS users for a single application
4. Specify the application’s (FortiSIEM) Authentication This information enables the Credential Provider to check certain application characteristics before retrieving the application password.
   1. In the Authentication tab, click Add; a drop-down list of authentication characteristics is displayed.
   2. Specify the OS user as “admin” and Click
   3. Specify the application path as “/opt/phoenix/bin”. Make sure Path is folder and Allow internal scripts to request credentials… check boxes are checked
   4. Do not specify a hash
   5. In the Allowed Machines tab, click Add and specify the IP/host name of the FortiSIEM Supervisor, Workers and Collectors 5.  Authorize FortiSIEM to retrieve accounts.
   6. Go to Policies > Access Control (Safes)
   7. For every Safe, Click on Members.
   8. Click on Add Safe Member
   9. Search for FortiSIEM. An entry will already exist. Select that entry.
   10. Check Retrieve accounts.
   11. Click Add

Now FortiSIEM should be ready to retrieve passwords from CyberArk via Test Connectivity and Discovery.

Discovery for Multi-Tenant Deployments

In multi-tenant deployments with organizations, the discovery process differs depending on whether or not you are using Collectors. This is because of the way in which IP addresses are used to establish the relationship between devices and organizations.

If you are using Collectors, IP address overlap between organizations is allowed

If you are not using Collectors, then each organization must have a unique IP address

These two requirements determine which administrative account you will use for discovery.

For organizations with collectors, you must initiate discovery using the administrative account associated with the organization. Every device discovered by a collector is automatically assigned to the organization that the collector belongs to.

For organizations without collectors, you must initiate discovery using the Super/Global administrative account. Devices for all organizations are discovered at the same time, and are assigned to organizations based on the IP address assignments you set up for the organization.

.

If a device matches only one organization’s IP address assignment, then it is assigned to that organization

If a device matches multiple organization definitions, then it is assigned to the Super/Global organization. These would typically be devices that are part of the Super/Global organization’s network backbone.

Related Links

How Devices are Added to Organizations

Managing Organizations for Multi-Tenant Deployments

Setting Device Location Information

In the Admin > General Settings > Discovery screen, you can set device locations based on IP range and organization. You can do this manually for each organization or IP range, or upload a CSV file that contains location information. This information can then be applied to devices already in the CMDB, or during the discovery process, to set their location.

Manually Creating Location Information

Uploading Location Information from a CSV File

Prerequisite

Procedure

Manually Creating Location Information

1. Log into your Supervisor node.
2. Go to Admin > General Settings > Discovery.
3. Under Location, click Add.
4. For Multi-Tenant deployments, enter the Organization you want to associate with the IP range and devices.
5. Enter the IP/IP Range you want to associate with the location.

This can be in either CIDR notation, such as 192.168.64.0/24, or range notation, such as 192.168.64.0-192.168.64.255.

6. Enter the Display Name you want to use for this location.

For example, San Jose Office, Northern California Campus, etc.

7. Enter any additional location information that is relevant for your location.
8. Click OK.
9. In the Location Definition dialog, select Update Manual Devices if you want to update devices that have had their locations set manually in the CMDB.
10. Click OK.

The location information will appear in the Location pane.

11. Select a location in the Location pane, and then click Apply to associate all devices in the CMDB with that IP/IP range to that organization and location.

A dialog will indicate how many devices have been updated.

12. Click OK.
13. Go to CMDB > Devices and check that your device locations have been updated.

Uploading Location Information from a CSV File

Prerequisite

Before you can upload it, you must first create a CSV file with this format.

Example

Procedure

1. Log into your Supervisor node.
2. Go to Admin > General Settings > Discovery.
3. Under Location, click Import.
4. Browse to your CSV file and select it.
5. Click Upload.

Discovery Settings

Before you initiate discovery, you should configure the Discovery Settings in your Supervisor.

• Log in to your Supervisor node.

2. Go to Admin > General Settings > Discovery.
3. Configure the settings as required for your deployment.

See Setting Device Location Information for information on how to manually enter locations for devices, or to upload a CSV file of device locations.

Discovering Infrastructure

FortiSIEM can automatically discover the devices, applications, and users in your IT infrastructure and begin monitoring them. You initiate device discovery by providing the credentials that are needed to access the infrastructure component, and from there FortiSIEM is able to discover information about your component such as the host name, operating system, hardware information such as CPU and memory, software information such as running processes and services, and configuration information. Once discovered, FortiSIEM will also begin monitoring your component on an ongoing basis.

Though FortiSIEM is able to automatically manage device discovery, the pulling of event information such as logs and IPS events from your device, and establishing what aspects of your device functionality it can monitor, you can also manually configure the way FortiSIEM interacts with your infrastructure by creating custom event pulling methods and monitoring profiles for your devices.

Configuring Syslog over TLS

To receive syslog over TLS, a port needs to be enabled and certificates need to be defined.

The following configurations are already added to phoenix_config.txt in Super/Worker and Collector nodes.

Note – the syslog over TLS client needs to be configured to communicate properly with FortiSIEM.