How to use credentials menu through collector?

[bhinangt]

When we add credentials in FortiSIEM admin settings, it only asks to map IP.

Same IP can belong to multiple clients also, But in mapping there is no option to select collector. So how to map credentials to correct device linked to correct collector.

Also do i need to allow supervisor to firewall port 22 if i want to add SSH credentials? This is not possible by allowing collector to firewall connection over port 22?

[Richie_C]

I don't have a collector in my lab but you should have a dropdown menu on the credentials page. It will be in the same place as the red square below. 

If you select collector here, you only need to allow connections on tcp/22 from the collector. 

[bhinangt]

This is snapshot from Global view with collector setup. No such option

[Richie_C]

Can you provide some more information about your setup please?

Is it service provider or enterprise setup?

How many collector have you registered?

If in service provide mode, are the collectors dedicated to an org or are they multi org collectors?

Thanks

[bhinangt]

Service Provider,
20 Collectors

No sharing of collectors, its dedicated.

Mean while instead of global view, i switched to individual organization view and added credentials. It went through collector, test was successful but then also no SNMP performance logs being reported.

Also not sure of the approach to add credentials is correct.

[Richie_C · Accepted solution]

Yes, you should to run the discovery from the correct organization.

You only mentioned SSH above. Did you also configure SNMP credentials. Did the test credentials option work? Did the discovery succeed for SNMP?

[bhinangt]

Thank you @Richie_C it worked!

[wagersantonio]

To map credentials to the correct device and collector in FortiSIEM, follow these steps: First, add the credentials in the FortiSIEM admin settings and map them to the device's IP address. Since the same IP can belong to multiple clients, you need to ensure the correct collector is managing the device. Unfortunately, FortiSIEM doesn't directly allow selecting a collector during mapping. Instead, organize devices so each collector handles a specific range of IPs or clients. Regarding SSH credentials, you only need to allow the collector to connect to the firewall over port 22, not the supervisor. This way, the collector can use SSH to communicate with the devices it manages.