Technical Tip: How to enable the payload dump in the FortiNDR

Description

This article describes how to enable the payload dump in the FortiNDR.

Scope

FortiNDR.

Solution

1. Navigating to FortiNDR Admin GUI -> System -> Artifact Storage -> Payload:
   
   

   

   
   

2. Switch to Enable for the option Payload for NDR Detection or Observation Sessions.
   
   

   

   
   

3. Enable this type of anomaly using the following command:
   
   

config system ndr settings
set type botnet encrypted-attack network-attack IOC weak-cipher  
set dump-payload enable  
end