Integrate a Fortinet FortiSIEM Cloud Device
Copy link

Configure a Fortinet FortiSIEM cloud device to pull IOCs from Digital Risk Protection (Threat Command). You must first add the device to Digital Risk Protection (Threat Command) and then configure the device itself to pull IOCs from Digital Risk Protection (Threat Command).

Add a Fortinet FortiSIEM cloud device
Copy link

Add a cloud device to Digital Risk Protection (Threat Command).

Prerequisites

  • You have the credentials to access the device.
  • You have administrative credentials to access Digital Risk Protection (Threat Command) with a subscription to the Automation and TIP modules.

To add a cloud device to Digital Risk Protection (Threat Command):

  1. Log in to Digital Risk Protection (Threat Command) at https://dashboard.ti.insight.rapid7.com
  2. From the main menu, select Automation -> Integrations. add cloud device
  3. From the Integrations page, click Cloud.
  4. Click Add new device.
  5. In the Add New Cloud Device dialog, type a user-defined name for the device.
    The name can contain a maximum of 50 letters, spaces, numbers, and underscores.
  6. Select the Device type.
    The default device IOCs limit is displayed.
  7. (Optional) You can change the IOCs limit.
  8. Click Add.
  9. To verify that the new device is added, refresh the Automation > Integrations page.
    The new device is added to the cloud integrations device list. Next to the device name, there is a red dot, indicating that communication has not yet been established. The dot will change to green when the device is synchronized. If the device cannot synchronize for more than 48 hours, an email warning is sent to the account administrator.

Configure a Fortinet FortiSIEM device to pull IOCs
Copy link

After a device has been added, you must enable it to pull IOCs from Digital Risk Protection (Threat Command).

Before you begin, ensure:

  • You have the device login credentials.
  • The device has been added.
  • You have administrative credentials to access Digital Risk Protection (Threat Command) with a subscription to the Automation and TIP modules.
  • An IOC group for this device exists in Digital Risk Protection (Threat Command).
    Creating IOC groups is described in Create an IOC group

Due to device limitations, IOC groups can consist of only one type of IOC. To support more than one type (domains, IP addresses, etc.), create multiple IOC groups.

To pull IOCs into FortiSIEM, you must set up a separate FortiSIEM resource group for each Digital Risk Protection (Threat Command)  IOC group. The process of creating different forms of FortiSIEM groups is very similar and is described together. The small differences are noted in the description.

To configure a FortiSIEM device to pull IOCs:

  1. From Digital Risk Protection (Threat Command), copy the IOC group URL:
    1. From Digital Risk Protection (Threat Command), select Automation > Integrations.
    2. From the On-Premises device list, select the FortiSIEM device.
    3. Click the link icon to the far right of an IOC group.
    temporary placeholder
    1. From the IOC Group URL dialog box, copy the URL.
      The URL is unique for each IOC group.
    2. To ensure that the IOC group contains values, hover over the IOC group line, then click the information icon. temporary placeholder

If the IOC list is not populated, stop, and then try again.

  1. Log in to the FortiSIEM management console.
  2. From the main menu, click Resource. temporary placeholder

The task description will continue with the Malware Domains resource group, to match the Digital Risk Protection (Threat Command) domains IOC group. The same steps are used for the other resource groups.

  1. In the Resources menu, click Malware Domains (label 1).
    The list of currently defined malware domains groups is displayed. temporary placeholder
  2. Click + (label 2) to create a new group.
  3. In the Create New Malware Domain Group dialog, type a name and a description (optional), then click Save.
    In our example, the resource was named IntSights1_Domains.
  4. Expand the Manage Domains  section and select the new resource (label 1 IntSights1_Domains), then click More > Update (label 2). temporary placeholder
  5. In the Update Malware Domain dialog, select Update via API, then click the URL edit icon. temporary placeholder The dialog box expands to display additional parameters. temporary placeholder
  6. Enter the details for the resource group, as described in the table for the specific resource group type. (This is the only step where creating resource groups differs.)

Update Malware Domain values
Copy link

Field in update dialogEnter this
URLPaste URL from the domains IOC group in the Digital Risk Protection (Threat Command) Integrations page.
- Replace [APPLIANCE_IP] with the IP address of your Digital Risk Protection (Threat Command) virtual appliance.
- Ensure that the port matches the port in use.
User NameLeave blank
PasswordLeave blank
Plug-in ClassLeave as-is
Field SeparatorType a comma (this is the default)
Data FormatCSV
Date UpdateSelect Full
Data MappingSelect Domain Name and Position = 1

Update Malware IP values
Copy link

Field in update dialogEnter this
URLPaste URL from the IP address IOC group in the Digital Risk Protection (Threat Command) Integrations page.
- Replace [APPLIANCE_IP] with the IP address of your Digital Risk Protection (Threat Command) virtual appliance.
- Ensure that the port matches the port in use.
User NameLeave blank
PasswordLeave blank
Plug-in ClassLeave as-is
Field SeparatorType a dash (this is the default)
Data FormatCSV
Date UpdateSelect Full
Data MappingSelect Low IP and Position = 1

Update Malware URL values
Copy link

Field in update dialogEnter this
URLPaste URL from the URLs IOC group in the Digital Risk Protection (Threat Command) Integrations page.
Replace [APPLIANCE_IP] with the IP address of your Digital Risk Protection (Threat Command) virtual appliance.
- Ensure that the port matches the port in use.
User NameLeave blank
PasswordLeave blank
Plug-in ClassLeave as-is
Field SeparatorType a comma (this is the default)
Data FormatCSV
Date UpdateSelect Full
Data MappingSelect URL and Position = 1

Update Malware Hashes values
Copy link

Field in update dialogEnter this
URLPaste URL from the Hashes IOC group in the Digital Risk Protection (Threat Command) Integrations page.
- Replace [APPLIANCE_IP] with the IP address of your Digital Risk Protection (Threat Command) virtual appliance.
- Ensure that the port matches the port in use.
User NameLeave blank
PasswordLeave blank
Plug-in ClassLeave as-is
Field SeparatorType a comma (this is the default)
Data FormatCSV
Date UpdateSelect Full
Data Mapping
- Select Botnet Name and Position = 1
- Select Algorithm and Position = 2
- Select HashCode and Position = 3
  1. Click Save.
  2. In the Update Malware Domain dialog, click the Schedule + icon.
    The dialog box expands to display additional parameters. temporary placeholder
  3. Set a schedule and recurrence pattern for when FortiSIEM should pull the IOCs, then click Save.
  4. Click Close.
  5. To verify that IOCs are uploaded to FortiSIEM go to the resource you created and verify that IOCs are populated in the table.
    For example: temporary placeholder