FortiAnalyzer Integration

FortiAnalyzer

Version: FortiAnalyzer 4.0, 5.0 and later.

FortiAnalyzer logs and analyzes aggregated log data from Fortinet devices and other syslog-compatible devices. Netsurion examines this collective of logs and leverage machine learning to identify critical events, suspicious network traffic, configuration changes and user behaviour analytics.

Netsurion Enterprise gathers and examines acquired logs to identify about administrator logon, network file sharing, resources monitored, devices added, changed and modified.

Netsurion Data Source Integration for FortiAnalyzer allows you to monitor the following:-

Operations - Backup and restore activity, Device management, Resource Monitoring,User management and System management and Network share management.
Security - IPsec activity.
Compliance - Administrator logon activity, Administrator logon failed activity and Configuration changes activity.

Once FortiAnalyzer is configured to deliver events to Netsurion Manager; Alerts, Dashboards and Reports can be configured into Netsurion.

Some of the Data Source Integrations available in Netsurion are listed below.

Alerts

Type	Name	Description
Operations	FortiAnalyzer - Administrator deleted a device	This alert is generated when administrator deleted the device.
Operations	FortiAnalyzer - Removed a disk from RAID array	This alert is generated when administrator removes the disk from the RAID array.
Compliance	FortiAnalyzer - User logon failed	This alert is generated when administrator attempt to log in to the web-based manager using GUI or CLI was failed.

Reports

Type	Name	Description
Security	FortiAnalyzer - IPsec activity	This report provides information related to IPsec VPN connections which includes columns such as Local IP, Local Port, Remote IP, Remote Port, Outbound Interface, Action, Initiated, Mode, Direction, and Status.
Operations	FortiAnalyzer - Backup and restore activity	This reports provides information related to backup, restore, reboot, upload and which includes columns such as User Name, User Interface, Action, Status and Message details.
Operations	FortiAnalyzer - Device management	This report provides information related to device added, deleted, rename, changed, registered and unregistered details which includes columns such as User Name, User Interface, Source IP, Action, Status and Message Details.
Operations	FortiAnalyzer - Resource monitoring	This report provides information related to resource usage which includes columns such as Status and Message Details.
Operations	FortiAnalyzer - User management	This report provides information related to user profile accessed, deleted, changed which includes columns such as User Name, User Interface, Source IP, Status and Message Details.
Operations	FortiAnalyzer - System management	This report provides information related to bootup, downgraded, migration, and delete log, delete archive which includes columns such as User Name, User Interface, Source IP, Action, Status and Message details.
Operations	FortiAnalyzer - Network share management	This report provides information related to network area storage and network file sharing which includes columns such as User Name, User Interface, Source IP, Status and Message Details.
Compliance	FortiAnalyzer - Administrator logon activity	This report provides information related to user login and logout which includes User Name, User Interface, Source IP, Action, Status and Reason fields.
Compliance	FortiAnalyzer - Administrator logon failed	This report provides information related to login failure which includes column such as User Name, User Interface, Source IP, Action, Status and Reason.
Compliance	FortiAnalyzer - Configuration changes activity	This report provides information related to change in authentication server which includes columns such as User Name, User Interface, Source IP, Status and Message details.

Documentation

The configuration details are consistent with Netsurion Enterprise version 7.X and later, and FortiAnalyzer 4.0 , 5.0 and later.

Download Integration Guide for more information.