Troubleshooting Tip: How to check a device can be monitored

[idabouzi]

Description	This article provides some commands to check if a device can be monitored by FortiSIEM.
Scope	FortiSIEM.
Solution	In order to check a device can be monitored: For Windows devices, run the checkWMIMonitorability script depending on where the host is being discovered (Collector or Supervisor): /opt/phoenix/bin/checkWMIMonitorability <host_ip> <domain> <user> <pwd> <output_file> Example: /opt/phoenix/bin/checkWmiMonitorability 19.16.41.14 GROUPWORK user1 Password /tmp/WMIoutput.txt Then check the output file /tmp/WMIoutput.txt For devices using SNMP, use the snmpwalk command and check the response: SNMPv2 snmpwalk -v 2c -c <community string> <ip> < output_file> SNMPv3 snmpwalk -v 3 -u <snmpv3user> -l authpriv <IP> -a MD5 -A <snmpv3md5password> -x DES -X <snmpv3despassword>