Technical Tip: Fetching CPU utilization metrics from Windows Hosts in FortiSIEM by using WMI Classes

[summer1]

Description	This article describes how FortiSIEM can collect CPU utilization metrics from Windows hosts without installing a Windows agent by using WMI classes and a PowerShell query. This method can also support additional operations through the use of various WMI performance classes. Use cases include operations such as troubleshooting, issue isolation, and working within restricted environments.
Scope	FortiSIEM.
Solution	The following steps outline how to configure a FortiSIEM Windows agent template to retrieve CPU statistics directly, leveraging the WMI class. The illustration below is about pulling CPU metric directly from a Hyper-V host, but users can leverage any other WMI class depending on operational requirements, as referenced in this document: Monitoring Performance Data. Edit the Windows Agent Template. Go to Setup -> Windows Agent, select the required template, and select Edit. Add the required WMI Class. Under Script -> WMI classes, select New and apply the following settings: Name: Performance. WMI Class: Win32_PerfFormattedData_HvStats_HyperVHypervisorLogicalProcessor. Attributes: Select all attributes. Save the WMI Configuration. Select Save. Add a PowerShell Script. Under the PowerShell Script section -> Select New -> In the Script content field, insert the following command: Get-CimInstance -Namespace "root\CIMV2" -ClassName "Win32_PerfFormattedData_HvStats_HyperVHypervisorLogicalProcessor" | Select-Object Name, PercentTotalRunTime, ContextSwitchesPersec Save and Apply the Template. Select Save, then select Apply to push the template changes. Verify Event Ingestion. Depending on the interval specified, events are generated every 'X' minutes (min value: 15 minutes). To confirm collection, go to Analytics and search for the following pattern: EVENT TYPE CONTAIN Win32_PerfFormattedData_HvStats AND reporting IP <Windows Host IP> This confirms that the Windows host in question is sending performance metrics successfully.  Note: Depending on the WMI class being used under the template, the search query must be of the appropriate event type. Additional notes: No default parser exists for this event type. A custom parser must be created to normalize or extract the required fields. The same method supports a wide range of operational requirements, since any WMI class from the Monitoring Performance Data can be referenced and used as needed. Explaining various types of WMI classes and their uses is beyond the scope of this article.