Fortinet black logo

Administration Guide

Configuring FortiNDR

Configuring FortiNDR

FortiNDR (formerly FortiAI) can be added to the Security Fabric so it appears in the topology views and the dashboard widgets.

To add FortiNDR to the Security Fabric in the GUI:
  1. Enable the Security Fabric and configure the interface to allow other Security Fabric devices to join (see Configuring the root FortiGate and downstream FortiGates).

  2. Install the FortiNDR appliance and activate the product with a valid license (see Registering products in the Asset Management Guide). A license file is provided after the product is registered.
  3. In FortiNDR, go to System > FortiGuard and verify that the pre-trained models (engines) are up to date. Refer to the FortiGuard website for the latest FortiNDR ANN versions.

  4. Configure and authorize the FortiGate in the FortiNDR GUI to join the Security Fabric:
    1. Go to Security Fabric > Fabric Connectors and double-click the Security Fabric card.
    2. Click the toggle to Enable Security Fabric.
    3. Enter the IP addresses for the root FortiGate and the FortiNDR.

    4. Click OK. The FortiNDR is now authorized.
  5. Authorize the FortiNDR in FortiOS:
    1. Go to Security Fabric > Fabric Connectors and double-click the Security Fabric Setup card.
    2. In the topology tree, click the highlighted serial number and select Authorize.

    3. Click Accept to verify the device certificate.

      The Security Fabric widget on the dashboard also updates when the FortiNDR is authorized.

  6. Go to Security Fabric > Physical Topology or Security Fabric > Logical Topology to view more information.
To add FortiNDR to the Security Fabric in the CLI:
  1. Configure the interface to allow other Security Fabric devices to join:
    config system interface
        edit "port1"
            ...
            set allowaccess ping https ssh http fgfm fabric
            ...
        next
    end
  2. Enable the Security Fabric:
    config system csf
        set status enable
        set group-name "fabric-ai"
    end
  3. In FortiNDR, configure the device to join the Security Fabric:
    config system csf
        set status enable
        set upstream-ip 10.6.30.14
        set managment-ip 10.6.30.251
    end
  4. Authorize the FortiNDR in FortiOS:
    config system csf
        set status enable
        set group-name "fabric-ai"
        config trusted-list
            edit "FAIVMSTM21000000"
                set authorization-type certificate
                set certificate "*******************"
            next
        end
    end

Configuring FortiNDR

FortiNDR (formerly FortiAI) can be added to the Security Fabric so it appears in the topology views and the dashboard widgets.

To add FortiNDR to the Security Fabric in the GUI:
  1. Enable the Security Fabric and configure the interface to allow other Security Fabric devices to join (see Configuring the root FortiGate and downstream FortiGates).

  2. Install the FortiNDR appliance and activate the product with a valid license (see Registering products in the Asset Management Guide). A license file is provided after the product is registered.
  3. In FortiNDR, go to System > FortiGuard and verify that the pre-trained models (engines) are up to date. Refer to the FortiGuard website for the latest FortiNDR ANN versions.

  4. Configure and authorize the FortiGate in the FortiNDR GUI to join the Security Fabric:
    1. Go to Security Fabric > Fabric Connectors and double-click the Security Fabric card.
    2. Click the toggle to Enable Security Fabric.
    3. Enter the IP addresses for the root FortiGate and the FortiNDR.

    4. Click OK. The FortiNDR is now authorized.
  5. Authorize the FortiNDR in FortiOS:
    1. Go to Security Fabric > Fabric Connectors and double-click the Security Fabric Setup card.
    2. In the topology tree, click the highlighted serial number and select Authorize.

    3. Click Accept to verify the device certificate.

      The Security Fabric widget on the dashboard also updates when the FortiNDR is authorized.

  6. Go to Security Fabric > Physical Topology or Security Fabric > Logical Topology to view more information.
To add FortiNDR to the Security Fabric in the CLI:
  1. Configure the interface to allow other Security Fabric devices to join:
    config system interface
        edit "port1"
            ...
            set allowaccess ping https ssh http fgfm fabric
            ...
        next
    end
  2. Enable the Security Fabric:
    config system csf
        set status enable
        set group-name "fabric-ai"
    end
  3. In FortiNDR, configure the device to join the Security Fabric:
    config system csf
        set status enable
        set upstream-ip 10.6.30.14
        set managment-ip 10.6.30.251
    end
  4. Authorize the FortiNDR in FortiOS:
    config system csf
        set status enable
        set group-name "fabric-ai"
        config trusted-list
            edit "FAIVMSTM21000000"
                set authorization-type certificate
                set certificate "*******************"
            next
        end
    end