Damballa Failsafe

Configuration in FortiSIEM

Complete these steps in the FortiSIEM UI:

1. Go to the ADMIN > Setup > Credentials tab.
2. In Step 1: Enter Credentials:
   1. Follow the instructions in “Setting Credentials“ in the User's Guide to create a new credential.
   2. Enter these settings in the Access Method Definition dialog box:

      Setting	Value
      Name	A name for the device.
      Device Type	Damballa Failsafe
      Access Protocol	See Access Credentials
      Port	See Access Credentials
      Password config	See Password Configuration

3. In Step 2, Enter IP Range to Credential Associations:
   1. Select the name of your credential from the Credentials drop-down list.
   2. Enter a host name, an IP, or an IP range in the IP/Host Name field.
   3. Click Save.
4. Click Test to test the connection to Damballa Failsafe.
5. To see the jobs associated with Damballa, select ADMIN > Pull Events.
6. To see the received events select ANALYTICS, then enter Damballa in the search box.