Using FortiSOAR for Asset Management

[MichZhon]

We are using FortiSOAR for asset management. The source data is synchronized from FortiSIEM CMDB. But there are multiple systems used by different teams to manage their own asset. For example, Network team use Netbox to maintain network device, while SRE team use phpIPAM to manage server info. I would like to use FortiSOAR as a centralized CMDB which can sync the data from mutiple systems and handle the conflict info. 

Is this something can be done by FortiSOAR? Any solution?

[MichZhon]

When I talk about asset management, from security operations perspective, the most important info is the owner of an IP. This is the top headache when we receive a security alert showing an IP is either compromised or infected by malware, the first thing an analyst would like to know is what is this IP (hostname, business), and who is the owner. And we often need to go to multiple systems to figure out the answer.

[anarula]

Hey @MichZhon  -- Yes, this is certainly thing which one would like to centralize while still retaining the need for diversity. So in you can example, let me categorize this as following

Problem Statement:  Need Asset Management Module that can integrate with FortiSIEM CMDB, Netbox and phpIPAM to provide a consolidated picture of assets maintained across these 3 systems. Further, the system should be able to synchronize, identify conflicts, merge duplicates to provide a single picture. Additionally you may also desire an ability to take actions on this data (For ex, isolate the host) using EPP/EDR technology such as FortiEDR, CrowdStrike etc.

Solution: First off all, yes FortiSOAR is the right place to do so, and it makes it rather easier with its ability to create custom modules and playbooks to ingest data, playbook to take actions etc. So here is how you would solve this problem

1) Create a module called Asset (this already exists btw, you may just need to add the additional fields required for your purpose).

2) Create Ingestion Playbook for each of the sources. As an example, you will create a playbook Ingest Assets from FortiSIEM - This playbook would using the FortiSIEM connector, connect to FortiSIEM, take the data from CMDB and Create/Merge asset records in FortiSOAR Asset Module. You will need to create similar playbook for ingesting asset information from Netbox and phpIPAM. Please note these playbook need to run on schedule basis (ex, every 24 hours) and need to handle merging/resolving-conflicts

3) Create Action Playbook (ex, Isolate Asset). This playbook would be Manual Trigger on selection of Asset Record. This playbook would use the respective EDR connector to take actions.

feel free to ask additional questions.