Alerts Trigger - Severity Logs

[azkel]

Hi.! I have an " Alert Trigger" set to reach me only Critical severity alerts. However, I get the mail alerts Medium severity. Device: FortiAnalyzer 100C, v5.0.2 Time: Wed Jan 26 13:40:41 ART 2014 Type: alert Severity: high From: FortiAnalyzer-100C(FL100C3910003883) Trigger: HighAlert Threshold: more than 1 event(s) occurred within last 6 minutes Return-Path: log@etherincoll.com Message-ID: <WLSP-O0169aZbLAX3cf00000005@wlsp-o01.GLOBAL.etherincoll.com> X-OriginalArrivalTime: 29 Jan 2014 13:40:01.0233 (UTC) FILETIME=[F382BA90:01CD7D0B] Date: 26 Jan 2014 13:40:41 -0300 Log message: date=2014-01-26 time=13:40:41 itime=1391024859 devid=FG300B3910600945 logid=16385 type=ips subtype=signature pri=alert vd=Portmirror severity=medium srcip=10.10.15.38 dstip=10.10.52.8 srcintf=" port4" policyid=1 identidx=0 sessionid=0 status=detected proto=1 service=icmp count=1 attackname=" Multiple.Vendor.ICMP.Remote.DoS" icmpid=0x0000 icmptype=0x04 icmpcode=0x00 attackid=13244 sensor=" ruleipspmirror" ref=" http://www.fortinet.com/ids/VID13244" incidentserialno=1719070378 msg=" DoS: Multiple.Vendor.ICMP.Remote.DoS," Then, Severity: high Log message: severity=medium Any ideas to help me resolve this situation? Regards.

[mnantel_FTNT]

I recommend you first upgrade to FAZ 5.0.6 as there have been countless improvement to alert handling. You might get an easier time configuring this with the Event Management tool in 5.0.6... Post back if you still struggle afterwards!

[ss198939]

if i want to set alert for device reboot by power distruption then which option should i select

[chall_FTNT]

Event handler on the FortiAnalyzer is triggered by logs received from the FortiGates.  If all power is lost to the FortiGate, it would not be able to generate a log.  It also does not generate a log message upon reboot explaining why it rebooted.

Sounds like you would need to find a way to correlate FortiGate reboots coincided with power fluctuations in your environment.  Perhaps if you a UPS solution that is monitoring power availability & it could send syslog to FAZ, it might be possible to use Event Handler somehow.  Otherwise, you would need some other monitoring solution.  Perhaps involving SNMP.

[ss198939]

first of all thanks a lot for quick reply.

i can configure SNMP as well. but in that how can i configure reboot option as there is no such option i can see in fortigate. but if i download MIB file and upload it to SNMP server then will that option be there? if yes what would be name of that option.

i want to configure this now. but i don't have control of SNMP server. so i will send MIB file to SNMP guy. but i need to guide him ro reboot or power disruption which option need to check.

Moreover i don't have fortianalyzer 

[ss198939]

i have fortimanager . so is it possible to enable Event handler in forti manager. as we have analyzer option also there.

if yes then only for reboot or power distruption which option is there

[chall_FTNT]

Sorry, I assumed your question was about FortiAnalyzer because this is a FortiAnalyzer forum.

In general, FortiGates do not record a reason for their last shutdown.  Also, although some mid & high range FortiGates have PSU monitors, you still would only be able to poll realtime information on the state of their power supplies.

But you could poll FortiGates for their uptime values

fgSysUpTime OID     .1.3.6.1.4.1.12356.101.4.1.20  (from FortiGate MIB)

& correlate that information with polling of some other 3rd party devices like UPS which monitor power conditions.

[ss198939]

is it possible to do something on SMTP with MIB file. so that if fortigate goes down i can come to knw in SMTP server ?

[chall_FTNT]

That questions is a good one for whatever network monitoring tool you are using.  Whether the trigger condition is the output of an SNMP query to the FortiGate or lack of response to a ping probe for a predefined period of X seconds, the alert could presumably trigger an e-mail notification.

The one thing you can do on the FortiAnalyzer (or FortiManager with FortiAnalyzer features enabled) is to define an event handler to be triggered by lack of logging from a FortiGate.