Skip to main content
adem_netsys
adem_netsys
Explorer III
December 19, 2025
Question

FortiSIEM IOC Integration

  • December 19, 2025
  • 1 reply
  • 260 views

Hi all,

 

We've implemented IOC integration with virustotal and we are able to get a result about verdict. We want to write a rule using these results, for example, regarding malicious and suspicious ones. Is this possible? Has anyone tried this before?

 

Thanks in advance

    1 reply

    Secusaurus
    Secusaurus
    Contributor III
    December 19, 2025

    Hi @adem_netsys,

     

    There are two types of integrations for IOCs:

    Admin -> Settings -> General -> External integration

    This one is used for automated analysis of an Incident. So, it would be working after a rule has triggered. It will stuff the incident into a pre-defined "script", craft a request against virustotal in your case and enrich the notes of the Incident then. There is no additional rule to create here. You'd look up the result in the notes of the incident.

     

    Resources -> Malware Hash/Malware Domains/...

    Here, in general, you configure kind of watchlists that will be auto-updated. A lot of rules automatically check against these lists. If you want to create custom rules, you use them just like watchlists.

     

     

    Best,

    Christian

    NSE8 | Fortinet Advanced MSSP Partner
    Terms & ConditionsAccessibility statement