Troubleshooting Tip: How to verify IOC detection, license, and TIDB status on FortiAnalyzer

Description

This article describes how to troubleshoot IOC detection on FortiAnalyzer by walking through the key checks needed to confirm that the IOC service is licensed, enabled, updated, and receiving the required FortiGate logs for proper detection.

Scope

FortiAnalyzer / FortiAnalyzer Cloud.

Solution

Indicators of Compromise (IOC) help identify potentially compromised client hosts or endpoints by comparing visited IP addresses, domains, and URLs against the FortiGuard Threat Intelligence Database (TIDB). The TIDB package is downloaded from FortiGuard and updated regularly.

When troubleshooting IOC detection on FortiAnalyzer, the following checks can be performed.

1. Verify that the IOC license is installed:

IOC requires a separate FortiGuard license.

To check the license information downloaded from FortiGuard, run the following CLI command:

diagnose fmupdate dbcontract fds

Example output:

FL-1KE3R16-----1 [SERIAL_NO]

AccountID:
Industry:
Company:
Contract:  1
PBDS-1-99-20250104

The PBDS contract indicates that the IOC license is installed.

Example:

Contract Raw Data:
Contract=PBDS-1-99-20250104:0:1:1:0

2. Verify the IOC license status and TIDB version:

To check whether the IOC license is detected by FortiAnalyzer and to confirm the TIDB version currently in use, run the following:

diagnose test application sqllogd 204 stats

Example output:

License of post breach detection installed.
License expiration : 2025-Jan-04
TIDB version : 00000.01017-1902242107
TIDB load time : 2019-02-24 14:11:2

This confirms that the IOC license is installed and shows the current TIDB version loaded by FortiAnalyzer.

In another output example, the license was successfully installed, but the message 'post breach detect service is not running yet' was displayed, as shown below:

diagnose test application sqllogd 204 stats
License of post breach detection installed.
License expiration_str: 2026-07-17
post breach detect service is not running yet

3. Verify that the IOC service is enabled:

Even if the license is installed, IOC detection may not work if the IOC service is disabled.

To check the IOC service status, run:

get system log ioc

Example output:

notification         : enable
notification-throttle: 1440
rescan-max-runner    : 8
rescan-run-at        : 1
rescan-status        : enable
status               : disable

In this example, the IOC service is disabled because the status is shown as disabled.

To enable the IOC service, run:

config system log ioc
    set status enable
end

After enabling it, verify the status again:

get system log ioc

notification         : enable
notification-throttle: 1440
rescan-max-runner    : 8
rescan-run-at        : 1
rescan-status        : enable
status               : enable

The IOC service should now show:

status               : enable

4. Make sure FortiGate logs contain the required information:

FortiAnalyzer uses IP addresses, domains, and URLs from FortiGate logs to identify IOC matches. Therefore, the FortiGate logs must contain at least one of the following details:

• IP address.

• Domain.

• URL.

For example:

• IP information is usually available in traffic logs.

• Domain information is usually available in DNS filter logs.

• URL information is usually available in web filter logs.

• If the required information is not present in the logs received by FortiAnalyzer, IOC detection may not trigger.

5. Check whether a specific URL, domain, or IP exists in the local TIDB:

To check whether a specific URL is included in the local TIDB, run the following:

diagnose test application sqllogd 204 tidb type=1, key=<url>

Example output:

<url> is not in tidb type black_url.

To check whether a specific domain is included in the local TIDB, run the following command:

diagnose test application sqllogd 204 tidb type=2, key=<domain>

Example output:

x.com is in tidb type black_domain. id=726851 hash=863185493322 3418302

To check whether a specific IP address is included in the local TIDB, run:

diagnose test application sqllogd 204 tidb type=3, key=<ip>

Example output:

<ip> is not in tidb type black_ip.

If the URL, domain, or IP is found in the TIDB and FortiAnalyzer is receiving logs that contain the matching value, IOC detection should be triggered.