Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Administration Guide

Quarantine Integration

FortiDeceptor on FortiGate Security Fabric topology map

Security Fabric integration allows FortiDeceptor and deception decoys to be visible through the Fabric network topology map.

To configure Security Fabric integration, enter the upstream device IP in Port in FortiDeceptor. Next you will add the FortiDeceptor fabric connector in FortiGate.

To configure FortiGate for Security Fabric integration in FortiDeceptor:
  1. In FortiDeceptor, go to Fabric > Quarantine Integration.
  2. Under Fabric Upstream section, select Enabled.

  3. Enter the FortiGate IP address in Upstream IP Address and the FortiGate connector port in Port.

To add the FortiDeceptor fabric connector in FortiGate:
  1. In FortiGate, log in as an admin and go to Security Fabric > Fabric Connectors.
  2. Add the FortiDeceptor connector for this integration. For information, see Configuring other Security Fabric devices > FortiDeceptor in the FortiGate Administration Guide.

    When configuring the Fabric Connector in FortiGate, you must enable Allow downstream device REST API.

    FortiDeceptor supports the CSF protocol that triggers automatic mitigation/-isolation of the infected endpoint from the network and prevents the attack from moving laterally.

    The CSF integration provides access to more fabric devices for isolations like FortiSwitch through the Fortigate.

    SAML support between Fortigate WEB-UI to FortiDeceptor to allows SSO login from Fortigate to FortiDeceptor.

    Tooltip

    Cooperative Security Fabric (CSF), also known as a Fortinet Security Fabric, spans across an entire network linking different security sensors and tools together to collect, coordinate, and respond to malicious behavior in real time. CSF can be used to coordinate the behavior of different Fortinet products in your network, including FortiGate, FortiAnalyzer, FortiClient, FortiSandbox, FortiAP, FortiSwitch, and FortiClient Enterprise Management Server (EMS).

  3. To trigger automatic mitigation using the CSF:

    1. In FortiGate, log in as an admin and go to Security Fabric > Automation.
    2. Click Trigger > Create New.
    3. Configure the Fabric Connector Event:
      1. Enter the Name of the event.
      2. Enter a Description of the event.
      3. Select a FDC appliance from the connector menu.
      4. Select an event.
      5. Select the Event Severity.
      6. Click OK.
  4. In the same screen, go to Action > Create New and choose any mitigation response you would like to execute once the FortiDeceptor pushes an incident alert to Fortigate.

  5. In FortiGate, go to Security Fabric > Physical Topology to verify that the FortiDeceptor is on the topology map.

  6. In FortiGate, go top Dashboard > Status to view FortiDeceptor information and deception decoys configuration status.

FortiDeceptor integration for threat response mitigation

Use Fabric > Quarantine Integration to view and configure FortiGate and other device settings for integration with FortiDeceptor. Integration uses REST APIs, XML APIs, or webhooks. When decoys are accessed, FortiDeceptor makes quarantine calls and attackers are immediately quarantined on the device for further analysis.

The following information is displayed:

Action

Click Edit to edit the integration settings.

Click Delete to delete the device.

Enabled

Shows if the device is enabled or disabled.

Status

Device status.

Name

Alias of the integrated device.

Integrate Method

  • FGT-REST-API
  • FGT-WEBHOOK
  • PAN-XMLAPI
  • GEN-WEBHOOK
  • FNAC-WEBHOOK
  • WMI-Disable
  • FortEDR-Isolation
  • Cisco-ISE
  • Microsoft-ATP

  • CrowdStrike-Isolation

  • FSM-Watch-List

Severity

Security level. The selected level and all levels above it are blocked. For example, if you select Medium, then when any attack reaches medium, high, or critical levels, the attacker IP address is blocked. If you select Critical, then only the critical level is blocked.

Detail

Device integration details.

To integrate a device:
  1. Go to Fabric > Integration Devices.
  2. Click Quarantine Integration With New Device.
  3. Configure the device for integration. Then click Save.

    Enabled

    Enable or disable this device.

    Name

    Specify a name for this device.

    Block Severity

    The selected level and all levels above it are blocked. For example, if you select Medium, then when any attack reaches medium, high, or critical levels, the attacker IP address is blocked. If you select Critical, then only the critical level is blocked.

    Appliance

    Option for Central Management manager device to integrate the incidents from the specified appliances only.

    Integrate Method

    The integration method of this device:

    • FGT-REST-API (Default)
    • FGT-WEBHOOK
    • PAN-XMLAPI
    • GEN-WEBHOOK
    • FNAC-WEBHOOK
    • WMI-Disable
    • FortEDR-Isolation
    • Cisco-ISE
    • Microsoft-ATP

    • CrowdStrike-Isolation

    • FSM-Watch-List

    Different integration methods have different settings. To view the settings for each integration type, see Integrate Method settings

    IP or Device IP

    IP address of the integrated device.

    Port

    Port number of the integrated device API service. Default is 8443.

    Username and Password

    Username and password of the integrated device.

    VDOM

    For FortiGate devices, the default access VDOM.

    Verify SSL

    Enable to verify SSL.

    Expiry

    Default blocking time in second. Default is 3600 seconds.

Quarantine Integration

FortiDeceptor on FortiGate Security Fabric topology map

Security Fabric integration allows FortiDeceptor and deception decoys to be visible through the Fabric network topology map.

To configure Security Fabric integration, enter the upstream device IP in Port in FortiDeceptor. Next you will add the FortiDeceptor fabric connector in FortiGate.

To configure FortiGate for Security Fabric integration in FortiDeceptor:
  1. In FortiDeceptor, go to Fabric > Quarantine Integration.
  2. Under Fabric Upstream section, select Enabled.

  3. Enter the FortiGate IP address in Upstream IP Address and the FortiGate connector port in Port.

To add the FortiDeceptor fabric connector in FortiGate:
  1. In FortiGate, log in as an admin and go to Security Fabric > Fabric Connectors.
  2. Add the FortiDeceptor connector for this integration. For information, see Configuring other Security Fabric devices > FortiDeceptor in the FortiGate Administration Guide.

    When configuring the Fabric Connector in FortiGate, you must enable Allow downstream device REST API.

    FortiDeceptor supports the CSF protocol that triggers automatic mitigation/-isolation of the infected endpoint from the network and prevents the attack from moving laterally.

    The CSF integration provides access to more fabric devices for isolations like FortiSwitch through the Fortigate.

    SAML support between Fortigate WEB-UI to FortiDeceptor to allows SSO login from Fortigate to FortiDeceptor.

    Tooltip

    Cooperative Security Fabric (CSF), also known as a Fortinet Security Fabric, spans across an entire network linking different security sensors and tools together to collect, coordinate, and respond to malicious behavior in real time. CSF can be used to coordinate the behavior of different Fortinet products in your network, including FortiGate, FortiAnalyzer, FortiClient, FortiSandbox, FortiAP, FortiSwitch, and FortiClient Enterprise Management Server (EMS).

  3. To trigger automatic mitigation using the CSF:

    1. In FortiGate, log in as an admin and go to Security Fabric > Automation.
    2. Click Trigger > Create New.
    3. Configure the Fabric Connector Event:
      1. Enter the Name of the event.
      2. Enter a Description of the event.
      3. Select a FDC appliance from the connector menu.
      4. Select an event.
      5. Select the Event Severity.
      6. Click OK.
  4. In the same screen, go to Action > Create New and choose any mitigation response you would like to execute once the FortiDeceptor pushes an incident alert to Fortigate.

  5. In FortiGate, go to Security Fabric > Physical Topology to verify that the FortiDeceptor is on the topology map.

  6. In FortiGate, go top Dashboard > Status to view FortiDeceptor information and deception decoys configuration status.

FortiDeceptor integration for threat response mitigation

Use Fabric > Quarantine Integration to view and configure FortiGate and other device settings for integration with FortiDeceptor. Integration uses REST APIs, XML APIs, or webhooks. When decoys are accessed, FortiDeceptor makes quarantine calls and attackers are immediately quarantined on the device for further analysis.

The following information is displayed:

Action

Click Edit to edit the integration settings.

Click Delete to delete the device.

Enabled

Shows if the device is enabled or disabled.

Status

Device status.

Name

Alias of the integrated device.

Integrate Method

  • FGT-REST-API
  • FGT-WEBHOOK
  • PAN-XMLAPI
  • GEN-WEBHOOK
  • FNAC-WEBHOOK
  • WMI-Disable
  • FortEDR-Isolation
  • Cisco-ISE
  • Microsoft-ATP

  • CrowdStrike-Isolation

  • FSM-Watch-List

Severity

Security level. The selected level and all levels above it are blocked. For example, if you select Medium, then when any attack reaches medium, high, or critical levels, the attacker IP address is blocked. If you select Critical, then only the critical level is blocked.

Detail

Device integration details.

To integrate a device:
  1. Go to Fabric > Integration Devices.
  2. Click Quarantine Integration With New Device.
  3. Configure the device for integration. Then click Save.

    Enabled

    Enable or disable this device.

    Name

    Specify a name for this device.

    Block Severity

    The selected level and all levels above it are blocked. For example, if you select Medium, then when any attack reaches medium, high, or critical levels, the attacker IP address is blocked. If you select Critical, then only the critical level is blocked.

    Appliance

    Option for Central Management manager device to integrate the incidents from the specified appliances only.

    Integrate Method

    The integration method of this device:

    • FGT-REST-API (Default)
    • FGT-WEBHOOK
    • PAN-XMLAPI
    • GEN-WEBHOOK
    • FNAC-WEBHOOK
    • WMI-Disable
    • FortEDR-Isolation
    • Cisco-ISE
    • Microsoft-ATP

    • CrowdStrike-Isolation

    • FSM-Watch-List

    Different integration methods have different settings. To view the settings for each integration type, see Integrate Method settings

    IP or Device IP

    IP address of the integrated device.

    Port

    Port number of the integrated device API service. Default is 8443.

    Username and Password

    Username and password of the integrated device.

    VDOM

    For FortiGate devices, the default access VDOM.

    Verify SSL

    Enable to verify SSL.

    Expiry

    Default blocking time in second. Default is 3600 seconds.