Damballa Failsafe

Configuration in FortiSIEM

Complete these steps in the FortiSIEM UI:

1. Go to the ADMIN > Setup > Credentials tab.
2. In Step 1: Enter Credentials, and click New to create a new credential.
   1. Follow the instructions in "Setting Credentials" in the User's Guide to create a new credential.
   2. Enter these settings in the Access Method Definition dialog box:

      Setting	Value
      Name	A name for the device.
      Device Type	Damballa Failsafe
      Access Protocol	See Access Credentials
      Port	See Access Credentials
      Password config	See Password Configuration

3. In Step 2: Enter IP Range to Credential Associations, click New to create a new mapping.
   1. Enter a host name, an IP, or an IP range in the IP/Host Name field.
   2. Select the name of your credential from the Credentials drop-down list.
   3. Click Save.
4. Click the Test drop-down list and select Test Connectivity to test the connection to Damballa Failsafe.
5. To see the jobs associated with Damballa, select ADMIN > Setup > Pull Events.
6. To see the received events select ANALYTICS, then enter "Damballa" in the search box.