Skip to main content
AlexFerdissan
AlexFerdissan
New Member
February 27, 2025
Question

FortiSIEM: Facilitating investigation by ensuring the traceability of dynamic IP addresses

  • February 27, 2025
  • 3 replies
  • 834 views

Dynamic IP addresses change regularly, making it difficult to identify the host associated with an IP address detected at any given time during incident investigations.

 

Is there anyone who can give me a solution?,

 

In my opinion, I think we can create a correlation rule that associates DHCP log events with assigned IP addresses to help maintain a correspondence between dynamic IP addresses and hosts, or use Lookup Tables to keep track of the history of assignments.

 

Thanks,

 

 

3 replies

AEK
SuperUser
AEK
SuperUser
February 27, 2025

Does it help to increase lease time and/or use DHCP reservation?

AEK
    AlexFerdissan
    AlexFerdissanAuthor
    New Member
    February 27, 2025

    Your question is not clear; the problem is not in configuration of DHCP server.

    I think you don't understand me very well. I want a solution in fortisiem to quickly get the name of the local host (victime) through the IP address discovered in the incident list.

    Thanks

    Richie_C
    Staff
    Richie_C
    Staff
    March 5, 2025

    Hi @AlexFerdissan 

    Maybe the identity and location dashboard could be helpful in this instance. FortiSIEM keeps track and can link users based on various logs. Some of the behavior is supported by default if the correct types of events are being received. However, sometimes you will need to add extra data sources. For example if you have a DHCP server that is not in the supported list. More information on the feature can be found here:

    https://help.fortinet.com/fsiem/7-3-1/Online-Help/HTML5_Help/Dashboard-identity-location.htm?Highlight=identity%20and%20location

    This data is then used to enrich received events. For example a username might be added to an event automatically.  

    Thanks

    Terms & ConditionsAccessibility statement