Analysis

Incident > Analysis lists the Incidents detected by FortiDeceptor.

To use the Analysis page:

1. Go to Incident > Analysis.
2. The Analysis page displays the list of events:

   Severity	Severity of the event.
   Protocol	Network protocol the attacker used to perform the attack.
   Last Activity	Date and time of the last activity.
   Type	Type of event.
   Attacker IP	Attacker IP address.
   Attacker User	Attacker username.
   Victim IP	IP address of the victim.
   Victim Port	Port of the victim.
   Decoy ID	Unique ID of the Decoy VM.
   ID	ID of the incident.
   Attacker Port	Port where the attack originated.
   Tag Key	Unique key string for the incident.
   Attacker Password	Password used by the attacker.
   Start	Date and time when the attack started.

3. To refresh the data, click Refresh.
4. To download the detailed analysis report in PDF format, click Export to PDF.
5. To mark items as read, expand the incident details or click Mark all as read.

   Newly-detected incidents are in bold to indicate they are unread.

6. To display specific types of events, click Show Interaction Events Only (default), IPS Events Only, Web Filter Events Only, or All.
7. To specify columns and table settings, use the Settings icon at the bottom right.

Malware Analysis: Sandbox and Virus Total Configuration

FortiSandbox

The integration between FortiDeceptor and FortiSandbox will provide a complete static and dynamic analysis against malicious code captured by the network decoys. The malware analysis report will be available on the FortiDeceptor admin console.

1. Configure the following parameters:

   Name	The Fabric connector name
   Vendor	Choose the sandbox vendor from the list
   IP/URL	Type the FortiSandbox IP address or URL
   Port	Type the FortiSandbox API port. (default is 443)
   Username	Type the API username. (please configure it on the Sandbox Console)
   Password	Type the API password. (please configure it on the Sandbox Console)

2. Click on the Test button to ensure the API connection is working properly.
3. Click Save to store the configuration

VirusTotal

The integration between FortiDeceptor and the well-known VirusTotal service allows the submission of suspicious files (MD5) for malware analysis. When integrated, VirusTotal detection ratios will be displayed in the incident analysis alert Workflow for relevant events.

1. To use the API you must sign up to VirusTotal Community (https://www.virustotal.com/gui/join-us).
2. Once you have a valid VirusTotal Community account you will find your personal API key in your personal settings section. This key is all you need to use the VirusTotal API.
3. Type your VT API Key in the FDC UI for the integration.