Skip to main content
idabouzi
Staff
Staff
February 28, 2025

Troubleshooting Tip: How to check a device can be monitored

  • February 28, 2025
  • 0 replies
  • 246 views
Description This article provides some commands to check if a device can be monitored by FortiSIEM.
Scope FortiSIEM.
Solution

In order to check a device can be monitored:

  • For Windows devices, run the checkWMIMonitorability script depending on where the host is being discovered (Collector or Supervisor):

 

/opt/phoenix/bin/checkWMIMonitorability <host_ip> <domain> <user> <pwd> <output_file>

 

Example:


/opt/phoenix/bin/checkWmiMonitorability 19.16.41.14 GROUPWORK user1 Password /tmp/WMIoutput.txt

Then check the output file /tmp/WMIoutput.txt

 

  • For devices using SNMP, use the snmpwalk command and check the response:

 

SNMPv2
snmpwalk -v 2c -c <community string> <ip> < output_file>

 

SNMPv3

snmpwalk -v 3 -u <snmpv3user> -l authpriv <IP> -a MD5 -A <snmpv3md5password> -x DES -X <snmpv3despassword>