Get ISDB\Internet Service Name in Traffic Logs?

Forum|Forum|4 years ago
April 22, 2022
1 reply
2339 views

Hello,

I'd like to know if it is possible to include the ISDB name in the FortiGate/FortiAnalyzer traffic logs. I've had access to this information with another vendor and am curious if it can be done with FortiNet.

This log enrichment would be extremely valuable in threat hunting efforts, where traffic can be immediately identified and associated with the source, as opposed seeing an IP that must be manually looked up.

For context, I've had a lot of success identifying compromised hosts and user accounts by simply searching for inbound traffic originating from VPN vendors and commonly-abused US-based cloud hosting providers like Digital Ocean, AWS, etc.

jimsokol

New Member

A given IP can be in more than one, sometime numerous categories, some benign, some malicious

natewesoAuthor

New Member

That makes sense and thank you for the reply. In that case I can see why it is probably not possible to do what I am looking for.

I think what I am really looking is if FortiNet had the ability to append the ASN (Name or Number) to routable IPs, and make that available in the logs. I am also working on this with my current SIEM vendor, Logrhythm but unfortunately they do not have similar log enrichment capability.