Fortinet Community

Target Audience: Linux System Administrators, DevOps Engineers, Virtualization SpecialistsEnvironment: Proxmox VE 8.4.2, Ubuntu 22.04 LTS (Workstation), FortiVoice 7.2.3 for KVM deployment package   Introduction While Fortinet provides comprehensive documentation for deploying FortiVoice on vanilla KVM (FortiVoice Private Cloud KVM Deployment Guide), translating these instructions to Proxmox VE (PVE) requires careful adaptation. A direct translation of KVM settings results in a critical failure where the appliance enters a reboot loop immediately after decompressing the root filesystem.   This article details the troubleshooting methodology used to identify the root cause—a combination of entropy starvation and disk bus mismatches—and provides the configuration required to stabilize the deployment.   The Symptom When deploying the FortiVoice 7.2.3build0507 qcow2 images on Proxmox 8.4.2 using default settings, the VM fails to boot.   The console displays a kernel pan

    As organizations increasingly rely on AI to accelerate cloud security investigations and security vendors embed more AI into their solutions, supporting responsible and transparent AI usage becomes critical. The FortiCNAPP AI team is committed to giving customers clear visibility and control over generative AI capabilities.     This update reinforces responsible AI adoption while preparing the platform for upcoming AI-powered security capabilities.    Trust in AI?  Trust in Artificial Intelligence (AI) should not be assumed and depends on several crucial considerations. Risk assessments of the data being processed are essential. AI's non-deterministic nature means we must be overtly aware and deliberate about what data we feed into AI systems. For the security-oriented, this will be especially vital as Generative AI and integration into Agentic workflows and beyond continue to evolve and

When rolling out AWS Network Firewall at the internet edge, one of the first practical decisions security practitioners must make is how to implement deep packet inspection without turning rule authoring and maintenance into a full‑time job. Although custom Suricata rules provide fine‑grained control, they also require constant tuning, threat research, and lifecycle management—work that can quickly slow down delivery in dynamic and fast‑moving AWS environments.   Fortinet’s Managed Rules offer a more operationally efficient approach. Backed by FortiGuard Labs threat intelligence and delivered as a native AWS Network Firewall stateful rule group, these rules allow you to enforce proven security controls without managing individual signatures. From an infrastructure perspective, they integrate cleanly into existing firewall policies and behave exactly like any other stateful rule group—no sidecar appliances, no custom update pipelines.   In this article, we will explore how For

FortiCNAPP AI Assist: From signal overload to action SOC Analyst burnout and the cybersecurity skills gap continue to worsen. SOC teams shouldn’t need deep detection expertise to understand what happened and decide what to do next — and FortiCNAPP AI Assist is built around that simple observation. Shaped for and by analysts using the product daily, every change targets a specific friction point between “alert fired” and “incident resolved.” The result is an AI-assisted triage workflow that correlates context, prioritizes findings, generates remediation grounded in the specific alert, and calls out exactly where confidence ends and assumptions begin. This matters because composite alerts — FortiCNAPP's high-fidelity signals that correlate multiple indicators into coherent attack narratives — carry a lot of context by design. As Fortinet's white paper on AI-driven investigation and remediation describes, the opportunity is in bridging the gap between surfacing correlated alert observatio

AI-Based Detection of Malicious Commands   Recently, we released a new AI model as part of our FortiCNAPP product to further improve the resilience of our intrusion detection capability. The Anomalous Host Command detection uses small language models to identify shell command line strings that: differ significantly from those previously executed in the environment, and exhibit characteristics that are suggestive of malicious activity. This model contributes signals to FortiCNAPP Composite Alerts and makes our platform more robust to attempts to evade detection.     Why Shell Commands?   Reliable intrusion detection integrates signals from numerous data sources to distinguish malicious activity from benign background noise. Process data, including the command line string associated with each process, is one of the more valuable data sources we analyze. This command line data is so valuable because it has the potential to provide strong evidence of malicious intent.

Geremy Condra, Nick Schmeller, Zeki Sherif, Zhenxiao Qi, Chris Horn, Shree Kumar, Tareq AlKhatib What Is RiskWatch?  RiskWatch watches your running workloads and tells you which vulnerabilities attackers can actually exploit. Instead of flagging every package at a vulnerable version, RiskWatch detects when your systems execute known vulnerable code, then delivers precise evidence of exposure alongside clear steps to fix it.    RiskWatch is a new capability within our FortiCNAPP Agent (formerly Lacework) that continuously monitors cloud workloads and surfaces actionable insights across your entire environment.   Why This Changes Everything Security teams are drowning. Vulnerability backlogs grow faster than teams can remediate them, budgets are tight, and most tools do little more than repackage CVSS scores.    The root problem: traditional vulnerability scanners compare packag

Intruder Movement   Cyber intruders gain access to cloud environments in a variety of ways, ranging from the exploitation of vulnerable software to the use of leaked or harvested access keys. In many cases, these intruders do not stay put; they move through the environment to expand their opportunities for exploitation and persistence. Evidence of this movement is essential for differentiating benign versus malicious behavior and for successfully remediating genuine intrusions.   Composite Alerts   FortiCNAPP presents suspected intrusions in the form of Composite Alerts. The aim with Composite Alerts is to assemble a complete narrative of suspicious activity, so that it may be triaged without your security team having to look elsewhere for more context. We have designed Composite Alerts to track within a single alert all entities and activity that may be associated with one another. Examples of what we look for include entities associated by suspected lateral movement, p

Background   We are migrating existing Lacework customers from our current Lacework support portal (Zendesk) to the FortiCare support portal to service all support requests for the Lacework FortiCNAPP product.    We ask all customers to start submitting support tickets in FortiCare instead of Zendesk as soon as possible. Until July 23rd, 2025, both systems will be active. All tickets that remain in Zendesk after the cutover date will be migrated to FortiCare.   Prerequisites   Your Zendesk account has been migrated to FortiCare as an IAM user. In order to be able to use it, the Master Account Owner of your company needs to generate the password reset link for you and share your FortiCare Account ID. If you already have it, you can proceed to the next step.   If you haven't yet received your password reset link and/or the FortiCare Account ID, you need to contact your Master Account Owner. This is the person responsible for the Lacework FortiCNAPP prod

Modernizing applications in the healthcare sector is not just a technology initiative. It is a strategic decision that directly impacts continuity of care, the protection of patient data, and compliance with increasingly strict regulations. Hospitals, clinics, and laboratories are rapidly adopting the cloud to support telemedicine, electronic health records, connected medical devices, and analytics initiatives. For technology and business leaders, the challenge is clear: how can we accelerate modernization while maintaining control, predictability, and trust?       The Challenge of Cloud Modernization in the Healthcare Sector   The cloud offers scale, agility, and elasticity, but in the healthcare sector it also increases operational complexity. Hybrid and multicloud environments coexist with legacy systems, critical applications, and connected medical devices, all handling highly sensitive data. For decision-makers, the main challenges include: Safeguarding sensi

As modern networks continue to expand across distributed branches, hybrid workplaces, and cloud-connected infrastructures, the operational burden on IT teams is only intensifying. Alert fatigue, complexity in troubleshooting, and gaps in wireless visibility often delay remediation and drive-up operational costs. With FortiAIOps 3.0, Fortinet set a new benchmark—moving network operations from reactive fault monitoring to predictive, context-aware intelligence. Now, with the release of FortiAIOps 3.2, this evolution goes even further. FortiAIOps 3.2 introduces a suite of advanced capabilities designed to strengthen wireless intelligence, automate resource optimization, and deliver deeper end-to-end visibility across both infrastructure and client experiences. Enhanced AI-driven analytics, richer Wi-Fi insights, and expanded monitoring ensure that IT teams can troubleshoot faster, anticipate issues earlier, and maintain higher service quality across the board. Let’s explore what’s new in

How Attackers Masquerade and Abuse Digital Signatures in DLL Side-Loading   By: Dor Neemani and Dan Antonov   Overview DLL side-loading is a long-standing technique leveraged by threat actors to execute malicious code under the context of trusted, digitally signed binaries. By abusing the Windows DLL search order, attackers can trick legitimate executables into loading their own malicious libraries instead of the intended system DLLs. This allows execution to appear legitimate and often bypasses application whitelisting, EDR heuristics, and user suspicion.   Infection Chain The attack chain began with a phishing email linking to what appeared to be a .docx document. The downloaded “docx” was actually a ZIP archive containing multiple files, several flagged as Hidden and System. After extraction, these files remain invisible in File Explorer unless the user enables “Show protected operating system files”. This simple trick conceals the malicious components from casual ins

What Is QoS? QoS (Quality of Service) refers to the ability of a network to provide different priority levels to different applications, users, or data flows, or to guarantee a certain level of performance. QoS helps ensure: Low latency for real-time traffic (VoIP, video) High throughput for bulk data transfers Fair bandwidth allocation between users   QoS at Different Layers 1. Layer 2: Ethernet – Class of Service (CoS) QoS at Layer 2 is applied using the 802.1p standard, which embeds priority information in the Ethernet frame.  Ethernet Frame (with 802.1Q VLAN Tag)   +-------------+-------------+-------------+-------------+-------------+-------------+ | Dest. MAC   | Src. MAC    | Tag (TPID)  | 802.1p/VID | Ethertype   | Payload     | | 6 bytes     | 6 bytes     | 2 bytes     | 2 bytes     | 2 bytes     | ...&