Indicator enrichment

The indicator enrichment feature empowers security analysts by providing them with comprehensive threat intelligence on identified IP addresses, domains, and URLs. This enriched context allows for a deeper understanding of security incidents, leading to more informed and effective response decisions.

FortiAnalyzer uses FortiGuard and VirusTotal enrichment services to evaluate the risk possessed by the indicators. These services are used by means of a predefined playbook in FortiAnalyzer: Indicator Enrichment. This playbook is enabled by default and is read-only. It can be found in Incidents & Events > Automation > Playbook.

The FortiGuard enrichment services are built-in and ready to use, but VirusTotal requires an API Key in the fabric connector.

To setup the VirusTotal Connector:

1. Go to Incidents & Events > Automation > Active Connectors.

2. Double-click the VirusTotal connector.

3. In the API Key field, update the API key.

4. Click OK.

5. Enable the VirusTotal connector.

   When this connector is enabled, indicator enrichment will provide the VirusTotal information.

You can enrich indicators from the Indicator pane, or from an incident that contains the indicator. When an incident is raised from an event, the event's indicators are attached to the incident.

To enrich an indicator from and incident:

1. Go to Incident & Events > Incidents > Incidents.

2. Select the related incident and click Analysis.

   You can also enrich the indicator from the toolbar in the table view.

   The Enrich option is only available when there are indicators that can be enriched. Private IP addresses are not valid IP indicators.

3. Click Enrich.

   The Enrich pane displays.

4. Review the details in the Enrich pane.

5. Click Save Enrichment or Cancel according to the review.

   The indicator will only be processed and enriched after clicking Save Enrichment.

When indicators are enriched, FortiAnalyzer will display the following information:

Section		Description
FortiGuard CTS		Displays the indicator confidence, IOC tags, IOC, antivirus, and web filter categories.
VirusTotal Summary		Displays a Risk Summary, a Detection tab, and a Details tab.
	Risk Summary	Displays detailed security vendor analysis, presenting a comprehensive list indicating whether each vendor has detected the indicator, along with their assigned risk category if detected.
	Detection	Displays detailed security vendor analysis, presenting a comprehensive list indicating whether each vendor has detected the indicator, along with their assigned risk category if detected.
	Details	Displays the Whois Summary and Whois Lookup, providing essential information such as organization details, address, data source, and contact information.

Saving the same enrichment would update the existing entry in the history. A new entry will only be created when there are changes in the enrichment.