Using FortiSOAR for Asset Management

When I talk about asset management, from security operations perspective, the most important info is the owner of an IP. This is the top headache when we receive a security alert showing an IP is either compromised or infected by malware, the first thing an analyst would like to know is what is this IP (hostname, business), and who is the owner. And we often need to go to multiple systems to figure out the answer.

Hey @MichZhon  -- Yes, this is certainly thing which one would like to centralize while still retaining the need for diversity. So in you can example, let me categorize this as following

Problem Statement:  Need Asset Management Module that can integrate with FortiSIEM CMDB, Netbox and phpIPAM to provide a consolidated picture of assets maintained across these 3 systems. Further, the system should be able to synchronize, identify conflicts, merge duplicates to provide a single picture. Additionally you may also desire an ability to take actions on this data (For ex, isolate the host) using EPP/EDR technology such as FortiEDR, CrowdStrike etc.

Solution: First off all, yes FortiSOAR is the right place to do so, and it makes it rather easier with its ability to create custom modules and playbooks to ingest data, playbook to take actions etc. So here is how you would solve this problem

1) Create a module called Asset (this already exists btw, you may just need to add the additional fields required for your purpose).

2) Create Ingestion Playbook for each of the sources. As an example, you will create a playbook Ingest Assets from FortiSIEM - This playbook would using the FortiSIEM connector, connect to FortiSIEM, take the data from CMDB and Create/Merge asset records in FortiSOAR Asset Module. You will need to create similar playbook for ingesting asset information from Netbox and phpIPAM. Please note these playbook need to run on schedule basis (ex, every 24 hours) and need to handle merging/resolving-conflicts

3) Create Action Playbook (ex, Isolate Asset). This playbook would be Manual Trigger on selection of Asset Record. This playbook would use the respective EDR connector to take actions.

feel free to ask additional questions.

I started building an asset module in FortiSOAR using the existing CMDB connector and some custom playbooks to sync data from our scanners. For bigger teams, streamlining game asset workflows with DAM might save time by connecting asset metadata into SOAR, but I kept mine simple due to limited sources. You can also trigger alerts when unknown assets pop up, which helped me spot unmanaged devices quickly.

awesome @Lepoevin . 

Care to share the Playbook here with community? and perhaps some screenshots of how things are looking?

Hi @Lepoevin 

Appreciate if you can share the playbook with us.