Next Steps

• Integrations

• Collector Deployment from FortiSIEM Cloud

• Agent Deployment from FortiSIEM Cloud

• Archive Storage Setup

• Troubleshooting

Integrations

FortiSIEM Cloud does not allow any insecure communication inbound. Only HTTPS TCP/443 is available inbound.

It is recommended that integrating and monitoring of devices or applications by FortiSIEM is performed by a FortiSIEM Collector. FortiSIEM Cloud can directly monitor device API integrations such as Office 365 and AWS CloudTrail, however this is not recommended as it can increase the load on the FortiSIEM Cloud and require the purchase of additional FortiSIEM Compute Units to compensate for this overhead.

Collector Deployment from FortiSIEM Cloud

When configuring your collectors for deployment from FortiSIEM Cloud, you will need to provide the FortiSIEM Cloud FQDN, for example fsmcld0000000000111.fortisiem.cloud, as the FortiSIEM Supervisor IP address. To get the FortiSIEM FQDN, take the following steps:

1. Navigate to the FortiCloud portal.

2. Click on your FortiCloud instance.

3. Click Manage.

4. Copy the FQDN.

For more information on Collector deployment, see the Register Collectors section from the appropriate hardware configuration guide or VM installation guide from the FortiSIEM Document Library.

Agent Deployment from FortiSIEM Cloud

When configuring your agents for deployment from FortiSIEM Cloud, you will need additional information from the FortiCloud Portal. Take the following steps:

1. Navigate to the FortiCloud portal.

2. Click on your FortiCloud instance.

3. Click Manage.

4. Use the information from this page to complete your agent deployment.

For more information on Agent deployment, see the appropriate agent installation guide (FortiSIEM Windows Agent Installation Guide, FortiSIEM Linux Agent Installation Guide) from the FortiSIEM Document Library.

Archive Storage Setup

If you have purchased any “FC-10-SMCLD-542-02-DD" entitlements with your FortiSIEM Cloud Instance, a separate Archive storage module will be deployed alongside your instance. This provides you with the infrastructure to move data to Archive, using your own defined retention policies.

The FortiSIEM Cloud platform will automatically deploy your Archive storage, the FortiSIEM Cloud instance will then automatically move data from Online to Archive based on your retention policy needs.

To setup your custom retention policies, see the following topics:

• FortiSIEM Cloud Event Retention

  • How FortiSIEM Cloud Event Retention Works

  • Explanation of Retention Policies in Detail

  • Creating FortiSIEM Cloud Event Retention Policy