VirusTotal Integration in FortiSIEM

Hi @Kunj ,

All details regarding VirusTotal Integration are published in below document:

Integration Settings - VirusTotal : 

https://help.fortinet.com/fsiem/7-1-3/Online-Help/HTML5_Help/Integration-settings.htm#VirusTot2

VirusTotal Incident Outbound Integration:

 https://help.fortinet.com/fsiem/7-2-1/Online-Help/HTML5_Help/External_lookup_RiskIQ_VirusTotal.htm

System Settings - Lookup :

 https://help.fortinet.com/fsiem/7-2-1/Online-Help/HTML5_Help/System_Settings.htm#Lookup

You can integrate VirusTotal with FortiSIEM using the sections available in GUI.

Also link the integration to an automation policy, so that the integration runs when the automation policy triggers.

Make sure you have configured the FortiGuard and the VirusTotal External integration under Admin / Settings / External Integration

If you also check under Admin / Settings / Automation policy and then External Integration you can use it to add the VirusTotal summary info to the Incident.

When looking at an incident and get the slide in with the incident details it will also provide information on what FortiGuard and VirusTotal know about the IOC (IP, domain,) and uses it as part of the overall rating of the IoC. You can manually add this information to the Incidnet.

When viewing the incidents and there is an IP that has the malicious (looks like a bug) icon next to it, the would have been enriched and evaluated once the incident was generated. This information is then cached locally on the super and periodically refreshed.

Afraid not, this is a special case.

What would you want the dashboard to show? Maybe there is another way we can achieve it.