FortiSiem Recover data from SQL DB

Question

Hi everyone;I still have an incident (backdoor found) appearing on the Fortisiem console, the source of this incident is the IPS of the Fortigate Firwall which detects traffic coming from internal clients towards malicious links.My need is as follows:I want to create a rule (or an costum event) which will search the SQL database of the antivirus solution server, in order to confirm whether this client has an antivirus agent or not.How can the SIEM query and retrieve data from this database?

Richie_C · Answer

Hey Chouaib

FortiSIEM acts on events it recieves from various devices. For example, in your case, the anti-virus solution could send a log to FortiSIEM stating that a client does not have a AV agent or maybe the agent is deactivated.

You can then create a rule to trigger based on the event being received.

FortiSIEM has out-of-the-box support for the following DB servers:

https://docs.fortinet.com/document/fortisiem/7.0.2/external-systems-configuration-guide/429432/database-server

There is also out-of-the-box support for the following end-point:security software:

https://docs.fortinet.com/document/fortisiem/7.0.2/external-systems-configuration-guide/956241/end-point-security-software

Outside of this, a custom integration would be required. Some options would be as follows: