Fortinet black logo

Administration Guide

Managing a Compromised Hosts rescan policy

Managing a Compromised Hosts rescan policy

Compromised Hosts can be configured to scan previous entries on regular intervals or when a new package is received from FortiGuard so that FortiAnalyzer performs a rescan using the latest available definitions.

Note

Requirements for managing a Compromised Hosts rescan policy:

  • This feature requires a valid indicators of compromise (IOC) license. The rescan options are not available in the GUI or CLI without a license.
  • The administrator must have Read-Write privileges for System Settings in order to configure global IOC rescan settings.

When IOC rescan is performed, the Ioc_Rescan tag is added to rescanned logs. Event handlers which include the Ioc_Rescan tag in their filters will process rescanned logs and generate new alerts tagged with Ioc_Rescan. Real-time logs matching these event handler filters continue to generate alerts without the Ioc_Rescan tag.

By default, the following handlers include Ioc_Rescan tag for all filters:

  • Default-Compromised Host-Detection-IOC-By-Endpoint
  • Default-Compromised Host-Detection-IOC-By-Threat


To configure rescan settings and check rescan results:
  1. Go to FortiView > FortiView > Threats > Compromised Hosts.
  2. Click the Compromised Hosts menu icon above the table view.

    The Compromised Hosts settings pane displays.

  3. Configure the Compromised Hosts Rescan Global Settings.
    1. Toggle Enable Global Compromised Hosts Rescan to On.
    2. Set the running time to a specific hour of the day, or select package update to perform a rescan when a package update is received.
  4. Configure the Compromised Hosts Rescan Current ADOM Settings.

    1. Toggle Enable Current ADOM Compromised Hosts Rescan to On.
    2. Select the log types to be scanned (DNS, Web Filter logs, Traffic logs, or Email filter logs).
    3. Set the number of previous days' logs to be scanned.

    By default, DNS, web filter, and traffic logs are enabled, and the scan will cover the last 14 days. The maximum recommended number of scan days is calculated based on historical scan speeds, or 30 days if no previous scans have been done.

  5. Rescan jobs are shown in the Rescan tasks table, which includes the following columns:

    Start Time The task's start time.
    Status

    The status of the task (complete, running, etc.).

    Running tasks can be canceled by clicking the cancel icon in the Status column.

    Percentage

    Task progress as a percentage.

    End Time The task's end time.

    Threat Count

    Configure the parameters for the selected action.

    Log Count

    The total number of logs with threats.

    Package Update Time

    The IOC package update time.

    Blacklist Count

    A count of the newly detected threats added to the blacklist.

  6. Select a non-zero threat count number in the table to drilldown to view specific task details, including the Detect Pattern, Threat Type, Threat Name, # of Events, and Endpoint.

    In FortiView > Threats > Compromised Hosts, a rescan icon is displayed in the Last Detected column if threats are found during a rescan. To view only those hosts that had threats found during a rescan, go to the settings menu and select Only Show Rescan.

    For FortiMail email filter rescans, the endpoint which visited an allowed URL will be marked as compromised if the URL is blocklisted in the latest URL blocklist. The compromised hosts are the users' email addresses which can be found in the To field of the log.

Managing a Compromised Hosts rescan policy

Compromised Hosts can be configured to scan previous entries on regular intervals or when a new package is received from FortiGuard so that FortiAnalyzer performs a rescan using the latest available definitions.

Note

Requirements for managing a Compromised Hosts rescan policy:

  • This feature requires a valid indicators of compromise (IOC) license. The rescan options are not available in the GUI or CLI without a license.
  • The administrator must have Read-Write privileges for System Settings in order to configure global IOC rescan settings.

When IOC rescan is performed, the Ioc_Rescan tag is added to rescanned logs. Event handlers which include the Ioc_Rescan tag in their filters will process rescanned logs and generate new alerts tagged with Ioc_Rescan. Real-time logs matching these event handler filters continue to generate alerts without the Ioc_Rescan tag.

By default, the following handlers include Ioc_Rescan tag for all filters:

  • Default-Compromised Host-Detection-IOC-By-Endpoint
  • Default-Compromised Host-Detection-IOC-By-Threat


To configure rescan settings and check rescan results:
  1. Go to FortiView > FortiView > Threats > Compromised Hosts.
  2. Click the Compromised Hosts menu icon above the table view.

    The Compromised Hosts settings pane displays.

  3. Configure the Compromised Hosts Rescan Global Settings.
    1. Toggle Enable Global Compromised Hosts Rescan to On.
    2. Set the running time to a specific hour of the day, or select package update to perform a rescan when a package update is received.
  4. Configure the Compromised Hosts Rescan Current ADOM Settings.

    1. Toggle Enable Current ADOM Compromised Hosts Rescan to On.
    2. Select the log types to be scanned (DNS, Web Filter logs, Traffic logs, or Email filter logs).
    3. Set the number of previous days' logs to be scanned.

    By default, DNS, web filter, and traffic logs are enabled, and the scan will cover the last 14 days. The maximum recommended number of scan days is calculated based on historical scan speeds, or 30 days if no previous scans have been done.

  5. Rescan jobs are shown in the Rescan tasks table, which includes the following columns:

    Start Time The task's start time.
    Status

    The status of the task (complete, running, etc.).

    Running tasks can be canceled by clicking the cancel icon in the Status column.

    Percentage

    Task progress as a percentage.

    End Time The task's end time.

    Threat Count

    Configure the parameters for the selected action.

    Log Count

    The total number of logs with threats.

    Package Update Time

    The IOC package update time.

    Blacklist Count

    A count of the newly detected threats added to the blacklist.

  6. Select a non-zero threat count number in the table to drilldown to view specific task details, including the Detect Pattern, Threat Type, Threat Name, # of Events, and Endpoint.

    In FortiView > Threats > Compromised Hosts, a rescan icon is displayed in the Last Detected column if threats are found during a rescan. To view only those hosts that had threats found during a rescan, go to the settings menu and select Only Show Rescan.

    For FortiMail email filter rescans, the endpoint which visited an allowed URL will be marked as compromised if the URL is blocklisted in the latest URL blocklist. The compromised hosts are the users' email addresses which can be found in the To field of the log.