OnSight custom plugins

OnSights support two kinds of custom plugins that can be run on instances that are unable to support a FortiMonitor Agent such as network devices and PaaS cloud services.

This feature is only available on the OnSight vCollector.

OnSight custom plugins:

• Custom CounterMeasure action plugins

• Custom metric plugins

Custom CounterMeasure actions and custom metric plugins can also be developed locally using the Local development environment. These plugins can then be uploaded to OnSight to run in a production environment. You need Docker to use the development environment.

Note: Custom plugins are only available on OnSights where they are deployed. For OnSight groups, the custom plugins must be deployed to all OnSights in the group. See Deployment.

CounterMeasure action plugins

OnSight-based CounterMeasures allows CounterMeasures to be run on instances that cannot use the FortiMonitor Agent. OnSight-based CounterMeasures actions are executed from the OnSight and have the ability to target any number of remote targets corresponding to instances monitored from that OnSight. These CounterMeasure actions are primarily intended to target actions and data collection from remote devices and not from the OnSight host itself. The following are a few scenarios where OnSight-based CounterMeasures can be useful.

• Run CounterMeasures on network devices which do not run FortiMonitor Agents

• Trigger API calls to virtualization systems like VCenter, Nutanix, HyperV

• Trigger API calls to cloud providers (AWS, Azure, Google) for PaaS and SaaS services

To create a CounterMeasure action plugin, see Creating a custom CounterMeasure.

Custom metric plugins

You can add your own custom metric plugins to the OnSight to allow you to collect metrics from remote devices.

To create a custom metric plugin, see Creating a custom metric plugin.

Requirements

It is recommended that you upgrade to the latest version of the OnSight vCollector before proceeding. To verify that an OnSight vCollector is of appropriate version to run OnSight custom plugins, run the following:

From Root (using sudo -i, for example):

onsight check-upgrade

Directory Structure

The following outlines the directory structure relevant to using OnSight custom plugins. These directories are located on the host VM that runs the OnSight.

• /usr/share/onsight/countermeasures: Directory to put countermeasure plugins

• /usr/share/onsight/custom-metrics: Directory to put custom metric plugins

• /usr/share/onsight/secrets: Directory for secrets

• /usr/share/onsight/ssh-keys: Directory to put ssh private key files

• /usr/share/onsight/dependencies: Directory to install python packages required to run plugins. If your plugin requires other python packages, you can install them under /usr/share/onsight/dependencies/ directory. For example, if your plugin requires pyyaml package, you can install it with this command: pip install -t /usr/share/onsight/dependencies pyyaml

• /var/log/countermeasures: Directory contains:

  • countermeasure.log

  • custom_metric.log