Fortinet black logo

Administration Guide

Analysis

Copy Link
Copy Doc ID d90909a9-1ca9-11ec-8c53-00505692583a:810832
Download PDF

Analysis

Incident > Analysis lists the Incidents detected by FortiDeceptor.

To use the Analysis page:
  1. Go to Incident > Analysis.
  2. The Analysis page displays the list of events:

    Severity

    Severity of the event.

    Protocol

    Network protocol the attacker used to perform the attack.

    Last Activity

    Date and time of the last activity.

    Type

    Type of event.

    Attacker IP

    Attacker IP address.

    Attacker User

    Attacker username.

    Victim IP

    IP address of the victim.

    Victim Port

    Port of the victim.

    Decoy ID

    Unique ID of the Decoy VM.

    ID

    ID of the incident.

    Attacker Port

    Port where the attack originated.

    Tag Key

    Unique key string for the incident.

    Attacker Password

    Password used by the attacker.

    Start

    Date and time when the attack started.

  3. To refresh the data, click Refresh.
  4. To download the detailed analysis report in PDF format, click Export to PDF.
  5. To mark items as read, expand the incident details or click Mark all as read.

    Newly-detected incidents are in bold to indicate they are unread.

  6. To display specific types of events, click Show Interaction Events Only (default), IPS Events Only, Web Filter Events Only, or All.
  7. To specify columns and table settings, use the Settings icon at the bottom right.

Malware Analysis: Sandbox and Virus Total Configuration

FortiSandbox

The integration between FortiDeceptor and FortiSandbox will provide a complete static and dynamic analysis against malicious code captured by the network decoys. The malware analysis report will be available on the FortiDeceptor admin console.

  1. Configure the following parameters:
    Name The Fabric connector name
    Vendor Choose the sandbox vendor from the list
    IP/URL Type the FortiSandbox IP address or URL
    Port Type the FortiSandbox API port. (default is 443)
    Username Type the API username. (please configure it on the Sandbox Console)
    Password Type the API password. (please configure it on the Sandbox Console)
  2. Click on the Test button to ensure the API connection is working properly.
  3. Click Save to store the configuration
VirusTotal

The integration between FortiDeceptor and the well-known VirusTotal service allows the submission of suspicious files (MD5) for malware analysis. When integrated, VirusTotal detection ratios will be displayed in the incident analysis alert Workflow for relevant events.

  1. To use the API you must sign up to VirusTotal Community (https://www.virustotal.com/gui/join-us).
  2. Once you have a valid VirusTotal Community account you will find your personal API key in your personal settings section. This key is all you need to use the VirusTotal API.
  3. Type your VT API Key in the FDC UI for the integration.

Analysis

Incident > Analysis lists the Incidents detected by FortiDeceptor.

To use the Analysis page:
  1. Go to Incident > Analysis.
  2. The Analysis page displays the list of events:

    Severity

    Severity of the event.

    Protocol

    Network protocol the attacker used to perform the attack.

    Last Activity

    Date and time of the last activity.

    Type

    Type of event.

    Attacker IP

    Attacker IP address.

    Attacker User

    Attacker username.

    Victim IP

    IP address of the victim.

    Victim Port

    Port of the victim.

    Decoy ID

    Unique ID of the Decoy VM.

    ID

    ID of the incident.

    Attacker Port

    Port where the attack originated.

    Tag Key

    Unique key string for the incident.

    Attacker Password

    Password used by the attacker.

    Start

    Date and time when the attack started.

  3. To refresh the data, click Refresh.
  4. To download the detailed analysis report in PDF format, click Export to PDF.
  5. To mark items as read, expand the incident details or click Mark all as read.

    Newly-detected incidents are in bold to indicate they are unread.

  6. To display specific types of events, click Show Interaction Events Only (default), IPS Events Only, Web Filter Events Only, or All.
  7. To specify columns and table settings, use the Settings icon at the bottom right.

Malware Analysis: Sandbox and Virus Total Configuration

FortiSandbox

The integration between FortiDeceptor and FortiSandbox will provide a complete static and dynamic analysis against malicious code captured by the network decoys. The malware analysis report will be available on the FortiDeceptor admin console.

  1. Configure the following parameters:
    Name The Fabric connector name
    Vendor Choose the sandbox vendor from the list
    IP/URL Type the FortiSandbox IP address or URL
    Port Type the FortiSandbox API port. (default is 443)
    Username Type the API username. (please configure it on the Sandbox Console)
    Password Type the API password. (please configure it on the Sandbox Console)
  2. Click on the Test button to ensure the API connection is working properly.
  3. Click Save to store the configuration
VirusTotal

The integration between FortiDeceptor and the well-known VirusTotal service allows the submission of suspicious files (MD5) for malware analysis. When integrated, VirusTotal detection ratios will be displayed in the incident analysis alert Workflow for relevant events.

  1. To use the API you must sign up to VirusTotal Community (https://www.virustotal.com/gui/join-us).
  2. Once you have a valid VirusTotal Community account you will find your personal API key in your personal settings section. This key is all you need to use the VirusTotal API.
  3. Type your VT API Key in the FDC UI for the integration.