|
In FortiAnalyzer 6.4, the FortiSIEM database is introduced and it consumes resources that may affect performance (i.e. CPU usage can significantly increase when the FortiSIEM module feature is enabled).
It is also necessary to adjust the resources based on MEA accordingly if required:
Management extension applications
To improve FortiAnalyzer performances, it is recommended to disable the FortiSIEM module by keeping in mind that if disabled:
- Log View -> Fabric will be unavailable. Administrators will not be able to search logs across different device types.
- FortiSoc -> Threat Hunting will be unavailable.
- Event Handlers using the SIEM logs will not be triggered.
- Reports using the Normalized Logs type will be empty.
- Handler and report for the DarkSide and Solarwind will partially work.
To review the current licenses:
diagnose license list
Name Status Expiry Description
---------------------------------------------------------------------
PBDS No License N/A post breach detection
SCPC No License N/A cloud storage service
SOAR No License N/A SOAR and SIEM bundle service
FOAS No License N/A FAZ Outbreak Detection Service
ISSS No License N/A Industrial Security Service
FGSA No License N/A Security Rating Update
To verify if the FortiSIEM module is up and running, the following CLI command can be used:
diagnose test app siemagentd 2
FAZ SIEM: up [status enabled]
siemagentd:
uptime: 70 day 19:06:45, shm-ver: 247, shm-fazid-max: 6
To disable the SIEM module, the following CLI command can be used:
config system global
(global) set disable-module siem
(global) end
DISABLE SIEM module
Do you want to continue? (y/n)y
diagnose siem remove database ALL
Remove the entire SIEM database has been requested.
This operation will remove all data in the SIEM database and reset the database server.
This operation will reboot the device.
Do you want to continue? (y/n)y
The following command can be used to Enable/disable the SIEM module in hardware models:
diagnose siem module-ctrl {enable | disable}
The following command can be used to start/ stop the SIEM module in VM-based units:
diagnose siem service {start | stop}
FortiAnalyzer's SIEM module related CLI reference.
Note.
As prompted above, FortiAnalyzer needs to be reloaded to make the change effective.
Related articles:
|
