FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
mbenvenuti
Staff
Staff
Article Id 402552
Description This article describes how to reimage a FortiSIEM-500G Collector.
Scope FortiSIEM FortiSIEM-500G.
Solution

When the machine software needs to be reset to another version than the one that it was manufactured, it's possible to go through the re-image process. Here are the following steps:

 

  1. Requirements:
    • USB hub.
    • USB Keyboard.
    • USB mouse.
    • VGA Monitor.
    • 2 USB keys of 16GB and 8GB:.
    • Ubuntu Desktop Setup Files (IE ubuntu-20.04.2.0-desktop-amd64.iso https://ubuntu.com/download/desktop ).
    • Rufus Bootable USB Utility on a Windows machine(Use the one attached).
    • FortiSIEM Image with CheckSum validated (IE FSM_Full_All_RAW_HARDWARE_7.2.4_build0268.zip from https://support.fortinet.net).

 

  1. Prepare the bootable USB Key:
    1. Download the Ubuntu Image from a Windows PC https://ubuntu.com/download/desktop.
    2. Open Rufus application with admin permissions.
    3. Plug the 8GB USB disk into the device.
    4. In the Device field, select the involved USB.
    5. Select the Ubuntu Image file just downloaded.
    6. In the Partition Scheme, select 'MBR'.
    7. Inthe  target System, select BIOS or UEFI.
    8. Display advanced properties and Tick 'Add fixes for old BIOSes (extra partition, align, etc.)'.
    9. Leave the 'Format Options' section with default values.
    10. Press 'Start'.

 

2025-07-18 18_22_00-Rufus 3.14.1788 (Portable).png

 

  1. Prepare the USB Key with the FortiSIEM disk image:
    1. Go to https://support.fortinet.net
    2. Download the RAW image along with the targeted version, like: FSM_Full_All_RAW_HARDWARE_7.2.4_build0268.zip
    3. In the computer, format the USB key using exFat by 'right-clicking' on the USB key icon and 'Format...'.
    4. Move the FSM_Full_All_RAW_HARDWARE_7.2.4_build0268.zip image file to that disk.

 

  1. Configure the BIOS of the FortiSIEM machine to boot from the Ubuntu USB Key:
    1. Plug the USB hub, keyboard, mouse, VGA screen, and Ubuntu key created earlier.
    2. Power on the machine.
    3. Access the Bios menu by typing 'Esc' or 'Del'.
    4. Type the BIOS password provided by Fortinet Support.
    5. In the BIOS menu, activate USB features and boot to USB Key:
      1. Go to 'Advanced' menu .
      2. USB Configuration:

 

2025-07-19 07_00_27-COM3 - PuTTY.png

 

Activate 'USB Mass Storage' by putting 'Enabled', then press 'Esc' to go back tto he initial menu:

 

2025-07-19 07_01_04-COM3 - PuTTY.png

 

 Go to 'Boot' menu, and modify 'Boot Option #1' to 'USB Key' (Leave UEFI Boot = Disabled):

 

2025-07-19 07_01_52-COM3 - PuTTY.png

 

Go to 'Save & Exit' menu and select 'Save changes and reset'.

The machine will reset and boot on the USB key.

 

  1. Re-imaging from Ubuntu USB:
    • When booting on the Ubuntu USB key, select the 'Try or Install Ubuntu' option:

 

2025-07-19 07_02_36-COM3 - PuTTY.png

 

  • Go through the Ubuntu steps with 'Try' mode.
  • Open a terminal and run 'sudo su' to have admin permissions.
  • Run 'fdisk -l' to identify the SATA 32GB disk and note its name '/dev/sdx' . Warning! This step is important to avoid re-imaging on the wrong disk:
  •  

20250721_094234.png

 

  • Plug the USB key with the FortiSIEM image.
  • On the Ubuntu desktop, click on the USB key just plugged to mount and open it.
  • Identify the FortiSIEM image file location and change directory to that location:

 

df -l

cd /media/ubuntu/fsm

ls -l

FSM_Full_All_RAW_HARDWARE_7.2.4_build0268.zip

 

  • Then re-image the disk with the command (Replace the disk name /dev/sdx with the one found earlier):

 

unzip -p FSM_Full_All_RAW_HARDWARE_7.2.4_build0268.zip | dd status=progress of=/dev/sdb

 

20250721_095325.png

 

  • Wait for the transfer to proceed.
  • Once finished, Run 'shutdown -h now' to stop the machine.
  • Remove USB disks and Power off the FortiSIEM.

 

  1. Restore the default BIOS configuration:
  • Power on the machine.
  • Enter the BIOS menu once again.
  • Restore the default BIOS settings at the 'Save & Exit' menu and select 'Restore Defaults', type Yes:

 

20250721_101025.png

 

  • select 'Save changes and reset'.
  • Now the machine starts the new FortiOS installed.
  • Reinstall FortiSIEM Application:

 

execute fsm-clean

execute factoryreset --force

execute fsm-clean

execute fsm-load

reboot

 

FortiSIEM is ready for use.

Contributors