FortiSIEM IOC Integration

[adem_netsys]

Hi all,

We've implemented IOC integration with virustotal and we are able to get a result about verdict. We want to write a rule using these results, for example, regarding malicious and suspicious ones. Is this possible? Has anyone tried this before?

Thanks in advance

[Secusaurus]

Hi @adem_netsys,

There are two types of integrations for IOCs:

Admin -> Settings -> General -> External integration

This one is used for automated analysis of an Incident. So, it would be working after a rule has triggered. It will stuff the incident into a pre-defined "script", craft a request against virustotal in your case and enrich the notes of the Incident then. There is no additional rule to create here. You'd look up the result in the notes of the incident.

Resources -> Malware Hash/Malware Domains/...

Here, in general, you configure kind of watchlists that will be auto-updated. A lot of rules automatically check against these lists. If you want to create custom rules, you use them just like watchlists.

Best,

Christian