Integrate a Fortinet FortiSIEM On-Premises Device

Configure a Fortinet FortiSIEM on-premises device to pull IOCs from Threat Command.

The following table shows device-specific integration characteristics:

Imported IOCs are accepted/monitored. You can create a policy to block those IOCs.

To integrate the device, perform these steps (described in the following sections):

1. Add the device to the Threat Command virtual appliance.
2. Configure the device to pull IOCs from Threat Command.

Add a Fortinet FortiSIEM on-premises device

The procedure to add the device to Threat Command is different depending on the version of the Threat Command virtual appliance in your environment. To determine which version is running, see Determine the Version of Virtual Appliance.

Add the on-premises device

Configure a FortiSIEM device to pull IOCs

After a device has been added to the Threat Command virtual appliance, you must enable it to pull IOCs from Threat Command.

Configuration for on-premises devices

When configuring an on-premises device, it is important to know which version of the Threat Command virtual appliance is running in your environment. This will affect which Rapid7 URL is displayed in the Device Details screen and also which URL to copy into the device management console.

When running version 4.0 or later, the Legacy URL should be used only with Rapid7 support.

To determine which version of the virtual appliance is running, see Determine the version of virtual appliance.

Prerequisites

• You have the device login credentials.
• The device has been added.
• You have administrative credentials to access Threat Command with a subscription to the Automation and TIP modules.
• An IOC group for this device exists in Threat Command.
  Creating IOC groups is described in Create an IOC group

Due to device limitations, IOC groups can consist of only one type of IOC. To support more than one type (domains, IP addresses, etc.), create multiple IOC groups.

To pull IOCs into FortiSIEM, you must set up a separate FortiSIEM resource group for each Threat Command IOC group. The process of creating different forms of FortiSIEM groups is very similar and is described together. The small differences are noted in the description.

To configure a FortiSIEM device to pull IOCs:

1. From Threat Command, copy the IOC group URL:
   1. From the Threat Command main menu, select Automation > Integrations.
   2. From the On-Premises device list, select the FortiSIEM device.
   3. Click the link icon to the far right of the device IOC group.
      
   4. From the IOC Group URL dialog box, copy the URL.
   5. (Optional) To ensure that the IOC group contains values, hover over the IOC group line, then click the information icon.

If the IOC list is not populated, stop, and then try again.

1. Log in to the FortiSIEM management console.
2. From the main menu, click Resource. The task description will continue with the Malware Domains resource group, to match the Threat Command domains IOC group. The same steps are used for the other resource groups.
3. In the Resources menu, click Malware Domains (label 1).
   The list of currently defined malware domains groups is displayed.
   
4. Click + (label 2) to create a new group.
5. In the Create New Malware Domain Group dialog, type a name and a description (optional), then click Save.
   In our example, the resource was named IntSights1_Domains.
6. Expand the Manage Domains  section and select the new resource (label 1 IntSghts1_Domains), then click More > Update (label 2).
7. In the Update Malware Domain dialog, select Update via API, then click the URL edit icon. The dialog box expands to display additional parameters.
8. Enter the details for the resource group, as described in Resource tables. (This is the only step where creating resource groups differs.)
9. Click Save.
10. In the Update Malware Domain dialog, click the Schedule + icon.
    The dialog box expands to display additional parameters.
11. Set a schedule and recurrence pattern for when FortiSIEM should pull the IOCs, then click Save.
12. Click Close.
13. To verify that IOCs are uploaded to FortiSIEM go to the resource you created and verify that IOCs are populated in the table.
    For example:
    

Resource group tables

Use these tables for the input for the resource group details:

Update Malware Domain values

Update Malware IP values

Update Malware URL values

Update Malware Hashes values