Hi everyone;
I still have an incident (backdoor found) appearing on the Fortisiem console, the source of this incident is the IPS of the Fortigate Firwall which detects traffic coming from internal clients towards malicious links.
My need is as follows:
I want to create a rule (or an costum event) which will search the SQL database of the antivirus solution server, in order to confirm whether this client has an antivirus agent or not.
How can the SIEM query and retrieve data from this database?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hey Chouaib
FortiSIEM acts on events it recieves from various devices. For example, in your case, the anti-virus solution could send a log to FortiSIEM stating that a client does not have a AV agent or maybe the agent is deactivated.
You can then create a rule to trigger based on the event being received.
FortiSIEM has out-of-the-box support for the following DB servers:
There is also out-of-the-box support for the following end-point:security software:
Outside of this, a custom integration would be required. Some options would be as follows:
In each of the above cases, you would need to write a custom parser to interpret the events. You could then create the required rule.
I hope that helps.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.