FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
flunaibarra
Staff
Staff
Article Id 293860

 

Description

This article describes the pre-requirements and troubleshooting steps for a Windows Agent registration with a Supervisor.
Before going through this Article, review the document link below to verify that you have the correct Windows agent package for the version of the registered FortiSIEM.

Windows Agent Installation Guide:

FortiSIEM Windows Agent 7.2.x

 

FortiSIEM Compatibility Matrix:
FortiSIEM Version Compatibility for Rocky Linux Based Releases

Scope Windows Agent 4.4.x, 5.x, 7.x.x, 7.1.x, 7.2.x.
Supervisor and Collector 6.x, 7.x, 7.1.x, 7.2.x.
Solution

Prerequisites:

  • From FortiSIEM:
    An agent user account should have been created for agent registration:
     
    For Enterprise, Go to CMDB -> Users -> FortiSIEM Users -> New -> enter a User Name, checkmark the System Admin box, checkmark the Agent Admin box, add a Password, confirm the Password, and Save.

 

Agent_user_Enter.png

 

  • For the Service Provider, Go to Global View -> Admin -> Setup -> Organization -> Select the Organization -> Edit -> In the Agent User section, enter a username, enter a Password, confirm the Password, and Save.

 

User_Agent_Org.png

  

Note the Organization Name and Organization ID for the agent registration.

 

ORGID_NAME.PNG

 

  • From Windows Host: Test the connection on port 443 to Supervisor with the following command from Powershell:

    Test-NetConnection <Super_IP> -port 443


TestConnection.PNG
The result should show: TcpTestSucceded = True
If the result is TcpTestSucceded = False, it is necessary to check the port 443 connection between the host and the Supervisor.

 

  • Net framework version.
    Check the NetFramework version in the Windows host is up to date with the following command.
    Make sure the version is 4.6.2 or higher.


reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /s


NetFramework.PNG

  • TLS v1.2.
    Check that TLS1.2 is enabled and running on the Host with the following command:

    reg query "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client"


TLS.PNG
If TLS1.2 is not enabled, run the following command in Powershell:

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 00000000

 

  • Installation:
    'Right-click' in the FSMLogAgent.exe file -> Choose License Type and Add the registration information.


AgentRegistration.PNG

 

Troubleshooting.

There are 3 reasons for the registration to fail:

  1. Package requirements are not installed in the host, or the OS version is not supported.
  2. Registration information is incorrect. This includes Supervisor IP/FDQN, username, password, Orgname, and OrgID.
  3. Connection issues include network configuration/communication on port 443, NAT, SSL inspection, external firewall rules blocking, and certificate configuration. Etc.

   

  • Review the Agent Trace.log on the Windows host to identify the HTTP status codes.

Error_Codes.PNG


401 and 403 errors indicate an authentication issue - Review the registration information. For example: ORG name, ORG ID, agent username, and password. If necessary, create a new Windows agent user account.

 

  • Manual URL Check:
    Using a web browser on the Windows host, enter: https://<ip of super>/phoenix/rest/register/winAgent.

 

Note:

A username and password prompt is expected. DO NOT enter any credentials here, as it will not pass. This is only a check to verify the availability of the URL.

 

URL_test.png

 

  • Check the SSL Supervisor's log to confirm the host connection. SSH to Supervisor:

cat /var/log/httpd/ssl_access_log

 

ssl_access_code2.PNG

 

Review the HTTP status code.

 

  • Leave running the tail command in Supervisor and Run the agent installation in the host:

 

tail -f /opt/glas*/dom*/dom*/logs/phoenix.log 

 

For example:


Tail_registration.PNG

 Tail_registration2.PNG

 

The registration logs will provide more information about the registration.