FortiSIEM Configuration Technical Tip

[Yoseph]

Hello All,

I'm configuring FortiSIEM 7.3.0, but some of the use cases aren't clear to me, and I kindly request some advice about whether the following use cases are possible to configure and display on the FortiSIEM dashboard. if so, please give advice, or does it need some other solution to be integrated as a source?

Insider Threat & Lateral Movement	Enable detection of unusual user activity (e.g., access to sensitive data).
Correlate logins from multiple locations within a short time frame.
Flag mass file downloads from internal systems.

Vulnerability scan and\ assesment

Identify the Vulnerability of the assets

Regularly Test Security Systems & Processes	Detect failed or overdue security scans.
Alert on new vulnerabilities detected in PCI systems.

Track & Monitor All Access to Network Resources & Cardholder Data	Enable File Integrity Monitoring (FIM) for critical cardholder files.
Configure correlation rules for unauthorized database queries.
Generate reports for PCI audit trail compliance (log retention, event correlation).

Restrict Physical Access to Cardholder Data	Detect unauthorized access attempts to secure locations (integrate physical security logs).
Monitor logs from badge access control systems.

Identify & Authenticate Access to System Components	Collect authentication logs from AD, RADIUS, and LDAP.
Alert on multiple failed login attempts (brute force detection).
Monitor privileged user account logins outside business hours.

Restrict Access to Cardholder Data on a Need-to-Know Basis	Monitor and log privileged account access to PCI environments.
Detect excessive access attempts to cardholder data.
Generate reports on user access controls and permissions.

Develop & Maintain Secure Systems & Applications	Monitor application logs (FortiWeb, web servers, payment apps) for vulnerabilities.
Alert on SQL injection, XSS, and other application attacks.
Detect failed patch updates and outdated software versions.

Protect Against Malware & Regularly Update Software	Configure alerts for failed antivirus updates.
Detect unauthorized software installations on PCI systems.

Encrypt Transmission of Cardholder Data Across Open Networks	Monitor SSL/TLS traffic to ensure encryption of cardholder data.
Alert on unencrypted or weakly encrypted data transmissions.

Protect Stored Cardholder Data	Enable encryption monitoring for stored cardholder data.
Detect unauthorized access attempts to cardholder databases.
Generate reports on data access permissions and encryption status.

Web Application Security	Enable correlation rules for FortiWeb WAF attack detections.
Monitor failed authentication attempts on web portals.
Detect SQL injection, XSS, and other web attacks.

Database Security Monitoring	Detect unauthorized database access attempts.
Correlate database logs with application login failures.
Monitor unexpected SQL queries or bulk data extraction.

Malware & Ransomware Detection	Enable real-time monitoring for suspicious file encryption activity.
Set up alerts for connections to known malicious IPs.

[lbahtarliev · Accepted solution]

Hello @Yoseph ,

SIEM solutions in general rely on various log sources to correlate, analyze, enrich etc. data and provide meaningful insights and information. So the short answer to your question is yes, you really need to ingest the logs from all systems of interest into the FortiSIEM :)
Now to the point - I see PCI mentioned a few times in your table and I guess you are referring to PCI use cases that you need to cover. 

In that case, FortiSIEM offers some nice reports and features out of the box. So to get you started you can check:

• Resources > Reports > Compliance > PCI - There you can see the already available reports, but most importantly there is a column called 'Data Source' with detailed information on what devices, applications, etc. are used as log sources to gather data for particular report. This will really give you an idea what you need. 
• Admin > Settings > Compliance > PCI - Here you can see the already defined PCI Logging policies and create new ones etc.
• And finally, after you review, get familiar and configure what you need and want according to the above two bullets, you can then follow this nice guide: PCI Logging Status Dashboard to create fancy executive (and not only) dashboards for PCI related services.

Hope this helps. 

Regards,

Lyuben