DOCUMENT LIBRARY

FortiGate / FortiOS

FortiManager

FortiAnalyzer

User Guide

FortiSIEM User Guide
TABLE OF CONTENTS
Overview
FortiSIEM Releases
- What's New in 7.0.2
- What's New in 7.0.1
- What's New in 7.0.0
Windows Agent Releases
Content Pack Updates
Key Concepts
Getting Started
Advanced Operations
- CMDB
- Incidents and Cases
- Device Support
- Rules, Reports, and Dashboards
- Advanced Health System
- Managing FortiSIEM
Administration
- Setup
- Device Support
- Health
- License
- Content Update
- Settings
Managing CMDB
- Devices
- Applications
- Users
- Business Services
- CMDB Reports
Managing Resources
- Reports
  - Viewing System Reports
  - Working With Report Templates
  - Creating New Reports
  - Running System Reports
  - Scheduling Reports
  - Importing and Exporting Reports
  - Importing and Exporting Report Definitions
- Rules
  - Viewing Rules
  - Creating Rules
  - Activating and Deactivating a Rule
  - Testing a Rule
  - Exporting and Importing a Rule Definitions
- Networks
  - Adding a Network
  - Modifying a Network
  - Deleting a Network
- Watch Lists
  - System-defined Watch list
  - Creating a Watch List
  - Modifying a Watch List
  - Using a Watch List
  - Exporting and Importing Watch Lists
- Protocols
  - Adding a Protocol
  - Modifying a Protocol
  - Deleting a Protocol
- Event Types
  - Adding an Event Type
  - Modifying an Event Type
  - Deleting an Event Type
- Working with AlienVault OTX
- Working with Dragos IOCs
- Working with FortiGuard IOCs
- Working with Malware Patrol
- Working with ThreatConnect
- Malware Domains
  - Adding a Malware Domain
  - Modifying a Malware Domain
  - Deleting a Malware Domain
  - Importing Malware Domains
  - Viewing Malware Domains
    - Working with Custom Threat Feeds that use HTTPS Connectivity
- Malware IPs
  - Adding a Malware IP
  - Modifying a Malware IP
  - Deleting a Malware IP
  - Importing Malware IPs
  - Viewing Malware IPs
- Malware URLs
  - Adding a Malware URL
  - Modifying a Malware URL
  - Deleting a Malware URL
  - Importing Malware URLs
  - Viewing Malware URLs
- Malware Processes
  - Creating a Malware Process Group
  - Adding a Malware Process
  - Modifying a Malware Process
  - Deleting a Malware Process
  - Importing Malware Processes
  - Viewing Malware Processes
- Country Groups
  - Creating a Country Group
  - Adding a Country Group
  - Modifying a Country Group
  - Deleting a Country Group
  - Changing the Home Country
- Malware Hash
  - Adding a Malware Hash
  - Modifying a Malware Hash
  - Importing/Updating User-defined Malware Hash
  - Viewing Malware Hash
- Default Password
  - Adding a Default Password
  - Modifying a Default Password
  - Importing and Exporting a Default Password
- Anonymity Network
  - Adding Anonymity Networks
  - Modifying Anonymity Networks
  - Updating Anonymity Networks
- User Agents
  - Adding User Agents
  - Modifying User Agents
  - Importing and Exporting User Agents
- Remediations
  - Adding Remediations
  - Modifying Remediations
  - Deleting Remediations
- Lookup Tables
  - Adding a Lookup Table
  - Deleting a Lookup Table
  - Working with Lookup Table Data
- Playbooks
  - Viewing Playbooks
  - Updating Playbooks
- Connectors
  - Viewing Connectors
  - Updating Connectors
- Machine Learning Jobs
  - Viewing Machine Learning Jobs
  - Editing a Machine Learning Job
  - Deleting a Machine Learning Job
Working with Cases
- Creating a Ticket
- Editing a Ticket
- Managing Cases
Working with Incidents
- Overview View
- List View
- Risk View
- Explorer View
- MITRE ATT&CK View
- UEBA View
- Investigating Incidents
- Automated Incident Resolution Recommendation
- Lookups Via External Websites
- CVE-Based IPS False Positive Analysis
- Remediating an Incident using a Script
- Executing a Playbook on an Incident
- Running a Connector on an Incident
- Troubleshooting Incident Trigger
Working with Analytics Search
- Running a Built-in Search
- Understanding Search Components
- New Query Functions
- Viewing Historical Search Results
- Viewing Real-time Search Result
- Using Nested Queries
- Searches Using Pre-computed Results
- Saving Search Results
- Viewing Saved Search Results, Loading Reports and Shortcuts
- Exporting Search Results
- Emailing Search Results
- Creating a Rule from Search
- Copying Filter and Time Range Tab Information
- Executing a Playbook
- Running a Connector
Machine Learning
- Overview
- Anomaly Detection
- Classification
- Clustering
- Forecasting
- Regression
Working with Dashboards
- General Operations
- Widget Dashboard
- Summary Dashboard
- Business Service Dashboard
- Identity and Location Dashboard
- Interface Usage Dashboard
- PCI Logging Status Dashboard
Managing Tasks
FortiSIEM Manager
- FortiSIEM Manager Incidents
  - FortiSIEM Manager Incidents Overview View
  - FortiSIEM Manager Incidents - List View
- FortiSIEM Manager CMDB Users
  - FortiSIEM Manager CMDB Adding Users
  - FortiSIEM Manager - Editing User Information
- FortiSIEM Manager Resources
- FortiSIEM Manager Admin
Appendix
- Administrative Tools and Information
- ClickHouse Usage Notes
- Configuration Notes
- Elasticsearch Usage Notes
- FortiEMS Endpoint Tagging
- FortiSOAR Integration Notes
  - Configuring FortiSOAR for FortiSIEM Integration
  - Writing FortiSIEM Compatible FortiSOAR Playbooks
- Functions in Analytics
- GUI Notes
  - Flash to HTML5 GUI Mapping
  - FortiSIEM Charts and Maps
- Knowledge Base
- License Enforcement
- Python Threat Feed Framework
- UEBA Information

Home FortiSIEM 7.0.2 User Guide

7.0.2

Deleting ClickHouse Organization Data

The following steps enable you to delete events belonging to an Organization in a Service Provider environment.

As a pre-requisite, collect the Organization Id for the "to-be-deleted" organization and the IP addresses of one data node from each shard.

Logon to any ClickHouse data node.
Run the following command as admin.
/opt/phoenix/phscripts/clickhouse/clickhouse-delete-org-events.sh <orgId> <data_node_shard1_ip>,<data_node_shard2_ip>
An example environment is provided below, for which we will run an example command.
Shard1: Replica1: IP: 172.30.58.242
Shard1: Replica2: IP: 172.30.58.243
Shard2: Replica1: IP: 172.30.58.244
Shard2: Replica2: IP: 172.30.58.245
Org Id: 2002
Run the following command:
/opt/phoenix/phscripts/clickhouse/clickhouse-delete-org-events.sh 2002 172.30.58.242,172.30.58.244

This script uses ClickHouse Lightweight Delete concept, as illustrated here.

Deleting ClickHouse Organization Data

The following steps enable you to delete events belonging to an Organization in a Service Provider environment.

As a pre-requisite, collect the Organization Id for the "to-be-deleted" organization and the IP addresses of one data node from each shard.

Logon to any ClickHouse data node.
Run the following command as admin.
/opt/phoenix/phscripts/clickhouse/clickhouse-delete-org-events.sh <orgId> <data_node_shard1_ip>,<data_node_shard2_ip>
An example environment is provided below, for which we will run an example command.
Shard1: Replica1: IP: 172.30.58.242
Shard1: Replica2: IP: 172.30.58.243
Shard2: Replica1: IP: 172.30.58.244
Shard2: Replica2: IP: 172.30.58.245
Org Id: 2002
Run the following command:
/opt/phoenix/phscripts/clickhouse/clickhouse-delete-org-events.sh 2002 172.30.58.242,172.30.58.244

This script uses ClickHouse Lightweight Delete concept, as illustrated here.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

User Guide

Deleting ClickHouse Organization Data

Deleting ClickHouse Organization Data

Deleting ClickHouse Organization Data

Deleting ClickHouse Organization Data