Change Log
| Date | Change Description |
|---|---|
| 2018-05-23 | Initial version of the guide. |
| 2018-07-24 | Revision 2 with a new section under Windows Server Configuration - Configuring Log Monitoring for Non-Administrative User. |
| 2018-08-07 | Revision 3 with updated section: Fortinet FortiGate Firewall |
| 2018-09-12 | Revision 4 with updated section: Microsoft Azure Audit |
| 2018-09-26 | Revision 5 with updated section: WatchGuard Firebox Firewall |
| 2018-11-28 | Revision 6 with updated section: Fortinet FortiGate Firewall > Configuring SSH on FortiSIEM to communicate with FortiGate |
| 2019-01-29 | Revision 7: updated section: Cisco FireSIGHT |
| 2019-03-15 | Revision 8: new section: Threat Intelligence |
| 2019-03-28 | Revision 9: updates the guide to reflect the new menu hierarchy in the FortiSIEM tool. |
| 2019-04-24 | Revision 10: added Carbon Black Security Platform under End Point Security Software. |
| 2019-07-24 | Revision 11: updated integration instructions for Microsoft Office 365 Audit. |
| 2019-10-22 | Revision 12: added Clavister Firewall and FortiADC devices. Added Active Directory User Discovery section to Microsoft Active Directory device. Corrections to SQL Server DDL Event Creation Script and SQL Server Database Level Event Creation Script. |
| 2019-11-22 | Revision 13: added Zeek (Bro) installation instructions for Security Onion, Cyberoam FortiADC, Epic SecuritySIEM, FortiEDR, FortiNAC, FortiDeceptor, Microsoft Network Policy Server, TrendMicro Deep Discovery. Changed the name of Cisco FireAMP to Cisco AMP Cloud V0. Changed the name of Cisco AMP to Cisco AMP Cloud V1. |
| 2020-01-03 | Revision 14: added CradlePoint. |
| 2020-04-15 | Revision 15: added Alert Logic Iris API, AWS Kinesis, AWS Security Hub, Cisco Amp, GitLab Cli, Azure Event Hub, Azure Compute, McAfee ePolicy Orchestrator, LastLine, Imperva Securesphere Web App Firewall, Imperva Securesphere DB Security Gateway, Imperva Securesphere DB Monitoring Gateway, Green League WVSS, FortiInsight, Damballa Failsafe, AWS EC2, Cisco Fireamp, Novell Netware, Green League RSAS, Checkpoint SmartCenter, FortiTester, Cisco Viptela, MobileIron, Duo, Indegy Industrial Cybersecurity Suite, Netwrix, Darktrace DCIP, Hirschmann SCADA Firewalls and Switches. |
| 2020-07-22 | Revision 16: Edits to Cisco AMP Cloud V0 and Cisco AMP Cloud V1. |
| 2020-10-09 | Revision 17: Added Alcide io KAudit, Stormshield Network Security and Tigera Calico |
| 2020-12-18 | Revision 18: Added note to AWS CloudTrail API Configuration |
| 2021-01-05 | Revision 19: Added Mapping Active Directory User Attributes to FortiSIEM User Attributes. |
| 2021-02-03 | Revision 20: Updated Malwarebytes to Malwarebytes Endpoint Protection. |
| 2021-03-03 | Revision 21: Added NetApp Data ONTAP Supported Version. |
| 2021-03-18 | Revision 22: Added Claroty Continuous Threat Detection, Corero Smartwall Threat Defense, Dragos Platform, Malwarebytes Breach Remediation, Oracle Cloud Access Security Broker (CASB), Proofpoint. |
| 2021-04-05 | Revision 23: Updated Linux server section. |
| 2021-04-07 | Revision 24: Updated AWS Kinesis for 6.2.0. |
| 2021-04-16 | Revision 25: Updated Microsoft Office 365 Audit "Create the Office 365 API Credential" steps. |
| 2021-04-23 | Revision 26: Added Salesforce Configuration for 6.2.0, 6.1.x, 5.4.0, 5.3.x, 5.2.x releases. |
| 2021-07-06 | Revision 27: Added Security Orchestration and FortiGate SNMPv3 setup example. Updated: Cisco Firepower Threat Defense, Linux Server Rsyslog and Syslog-NG, AWS Security Hub, EC2 Cloudwatch API, AWS EC2 Discovery, Office365 API integration, Microsoft Azure Compute, Microsoft Windows Defender for Endpoint (Windows Defender ATP), Cisco IOS, Cisco FireSIGHT, Cisco Duo, Cisco FireAmp, Cisco Meraki Access Points, Rapid7 Nexpose, Rapid7 InsightVM, Google Workspace, Carbon Black Syslog setup, FortiManager syslog, FortiWeb syslog, FortiSandbox syslog, FortiAuthenticator syslog, FortiClient syslog, FortiADC syslog, FortiDeceptor syslog, FortiNAC syslog, FortiEDR syslog, FortiSOAR syslog. Environmental Sensors updated to Operational Technology, Syslog over TLS. New Device Support: Microsoft Windows Print Service Log, AWS Elasticsearch Load Balancer Log, CyberX OT/IoT Security via Log, Digital Defense Vulnerability Scanner via API, FortiAI via Log, FortiCASB integration via API, HP ILO via SNMP Trap, Palo Alto Cortex XDR via Log, Palo Alto WildFire via Log through Palo Alto Firewall. Device Support Extensions: CloudTrail Logs via AWS Kinesis, CyberArk Vault integration via REST API, FortiAnalyzer System Event Logs via Syslog, FortiEDR integration via API, FortiGate, FortiAP and FortiSwitch via FortiGate API, GCC High Tenant for Azure Audit, VPC Flog Logs via AWS Kinesis. |
| 2021-07-22 | Revision 28: Updated AWS Kinesis Configuration for Configuring AWS CloudTrail Logs through Kinesis Streams, and Configuring VPC Flow Logs through Kinesis Streams. |
2021-07-26 | Revision 29: Updated Epilog/snare link for Oracle Database Server, Juniper Steel Belted RADIUS, and Apache Web Server configuration. |
| 2021-07-30 | Revision 30: Updated Tenable Nessus Vulnerability Scanner configuration. |
| 2021-08-02 | Revision 31: Updated Cisco FireSIGHT Configuration. |
| 2021-08-26 | Revision 32: Updated AWS EC2 CloudWatch API, Googe Workspace / GSUITE, Zeek Network Security Monitor (Previously Bro). Added Microsoft Advanced Threat Analytics (ATA) On Premise Platform, KVM, FortiProxy, Google Cloud Platform, Mac OS, Otorio RAM2, UserGate UTM Firewall to 6.3.1. |
| 2021-08-30 | Revision 33: Updated Microsoft SQL Server for 6.x Guides. |
| 2021-08-31 | Revision 34: Added Syslog CEF Format configuration to Check Point FireWall-1 for 6.3.1 Guide. |
| 2021-09-16 | Revision 35: Updated Dell Force10 Router and Switch, Dell NSeries Switch, and Dell PowerConnect Switch and Router for 6.3.1, and Microsoft Office 365 Audit for 6.3.x Guides. |
| 2021-09-17 | Revision 36: Updated MySQL Server and CyberArk Password Vault for 6.3.x Guides. Added example syslog for Dell Force10 Router and Switch, Dell NSeries Switch, and Dell PowerConnect Switch and Router for 6.3.1 Guide. |
| 2021-09-24 | Revision 37: Updated Squid Web Proxy with syslog configuration for versions 4.1.1 and later for 6.1.1-6.3.x Guides. |
| 2021-10-06 | Revision 38: Added ArubaOS-CX Switch platform, Barracuda Web Application Firewall, and Cisco Umbrella to 6.3.2 Guide. |
2021-10-08 | Revision 39: Updated Microsoft Windows Server SNMP Configuration instructions and removed older Microsoft SQL Scripts for 6.3.x. |
| 2021-10-29 | Revision 40: Updated Cisco Firepower Management Center (FMC) - Formerly FireSIGHT and FirePower Threat Defense : Using Cisco eStreamer Client for 6.x Guides. |
| 2021-11-01 | Revision 41: Updated Configuring FortiSIEM through FortiOS REST API - Step 2: Create an Administrator Profile for 6.3.x. |
| 2021-11-08 | Revision 42: Updated Cisco Umbrella Prefix Configuration Information for 6.3.2. |
| 2021-11-16 | Revision 43: Updated FortiSIEM External Ports with sFlow port number and protocol from External Devices to Supervisor/Worker/Collector. |
| 2021-11-30 | Revision 44: Updated FortiSIEM External Ports Collector Communication table. |
| 2021-12-06 | Revision 45: Updated Enable WinRM and set authentication in Microsoft Windows Server. |
| 2021-12-08 | Revision 46: Updated Syslog over TLS section for 6.x. |
| 2021-12-23 | Revision 47: Google Cloud Platform configuration updated for 6.3.1 and later. |
| 2022-01-06 | Revision 48: SNMP V3 Traps section added. |
| 2022-01-11 | Revision 49: Microsoft Windows Server section updated with OMI for 6.3.3 and later. |
| 2022-01-13 | Revision 50: CrowdStrike Endpoint Security section updated for 6.2.x and later. |
2022-02-15 | Revision 51: Added Ports for OMI based monitoring and log collection in FortiSIEM External Ports section for 6.3.3 and later. |
2022-02-16 | Revision 52: Added ServiceNow Security Operations to Security Orchestration for 6.3.0 and later. |
| 2022-02-24 | Revision 53: Updated Microsoft Defender for Endpoint for 6.3.0 and later. |
| 2022-03-01 | Revision 54: Added Flow Support section. |
| 2022-03-02 | Revision 55: Updated MySQL Server - Settings for MySQL Server JDBC Access Credentials for Database Auditing - Audit Table field. |
| 2022-03-18 | Revision 56: Microsoft Defender for Endpoint legacy information updated. Microsoft Defender for Endpoint moved from Cloud Applications section to End Point Security Software section. |
| 2022-03-22 | Revision 57: Configuring Tigera Calico to Send Logs link updated. |
| 2022-03-28 | Revision 58: Updated Microsoft Azure Audit Configuration section. |
2022-03-29 | Revision 59: Updated Supported Devices and Applications by Vendor. |
| 2022-04-04 | Revision 60: Added Zscaler Cloud Firewall. |
| 2022-06-08 | Revision 61: Updated Setup in FortiSIEM section in Cisco Umbrella Configuration. |
| 2022-06-17 | Revision 62: FortiAI updated to FortiNDR. |
| 2022-07-13 | Revision 63: Updated Using Cisco eStreamer Client section in Cisco FireSIGHT and FirePower Threat Defence. |
| 2022-07-25 | Revision 64: Updated Microsoft Exchange. |
| 2022-08-09 | Revision 65: Updated Configuring FortiSIEM for Sophos Central for API Access. |
2022-09-07 | Revision 66: Updated FortiSIEM External Ports section. |
| 2022-09-15 | Revision 67: Updated FortiSIEM External Ports section. |
| 2022-10-31 | Revision 68: Updated Citrix Netscaler Application Delivery Controller (ADC) Configuration section. |
| 2022-12-22 | Revision 69: Updated Microsoft Azure Event Hub - Configuration in Azure Step 4. |
| 2023-01-10 | Revision 70: Updated Cisco Call Manager - Configure FortiSIEM to Receive CDR Records from Cisco Call Manager. |
| 2023-03-09 | Revision 71: Updated Microsoft Azure Audit - Create IP Range to Credential Association and Test Connectivity in FortiSIEM section. |
| 2023-04-10 | Revision 72: Updated Oracle WebLogic section. |
| 2023-05-10 | Revision 73: Updated Enable Office 365 Audit Log Search section for Microsoft Office 365 Audit. |
| 2023-06-14 | Revision 74: Updated Configuring FortiAnalyzer to Send Logs to FortiSIEM section for Fortinet FortiGate Firewall. |
| 2023-08-03 | Revision 75: Updated Blue Coat Web Proxy section. |
| 2023-09-14 | Revision 76: Updated Proofpoint section. |
| 2023-09-28 | Revision 77: Updated Microsoft Windows Server section. |
| 2023-10-17 | Revision 78: Updated Microsoft Office 365 Audit section. |
| 2024-02-07 | Revision 79: Added SQL Server 2022 support for Microsoft SQL Server. Added 7928 port entry for Supervisor Communication and Worker Communication in FortiSIEM Port Usage. |
| 2024-03-26 | Revision 80: Updated CLI command in Configuring FortiGate to send Syslog to FortiSIEM for FortiGate. |