Incident > Analysis lists the Incidents detected by FortiDeceptor.
- Go to Incident > Analysis.
- The Analysis page displays the list of events:
Severity of the event.
Network protocol the attacker used to perform the attack.
Date and time of the last activity.
Type of event.
IP address of the victim.
Port of the victim.
Unique ID of the Decoy VM.
ID of the incident.
Port where the attack originated.
Unique key string for the incident.
Password used by the attacker.
Date and time when the attack started.
- To refresh the data, click Refresh.
- To download the detailed analysis report in PDF format, click Export to PDF.
- To mark items as read, expand the incident details or click Mark all as read.
Newly-detected incidents are in bold to indicate they are unread.
- To display specific types of events, click Show Interaction Events Only (default), IPS Events Only, Web Filter Events Only, or All.
- To specify columns and table settings, use the Settings icon at the bottom right.
The integration between FortiDeceptor and FortiSandbox will provide a complete static and dynamic analysis against malicious code captured by the network decoys. The malware analysis report will be available on the FortiDeceptor admin console.
- Configure the following parameters:
Name The Fabric connector name Vendor Choose the sandbox vendor from the list IP/URL Type the FortiSandbox IP address or URL Port Type the FortiSandbox API port. (default is 443) Username Type the API username. (please configure it on the Sandbox Console) Password Type the API password. (please configure it on the Sandbox Console)
- Click on the Test button to ensure the API connection is working properly.
- Click Save to store the configuration
The integration between FortiDeceptor and the well-known VirusTotal service allows the submission of suspicious files (MD5) for malware analysis. When integrated, VirusTotal detection ratios will be displayed in the incident analysis alert Workflow for relevant events.
- To use the API you must sign up to VirusTotal Community (https://www.virustotal.com/gui/join-us).
- Once you have a valid VirusTotal Community account you will find your personal API key in your personal settings section. This key is all you need to use the VirusTotal API.
- Type your VT API Key in the FDC UI for the integration.