Define the FortiSIEM Watch List Groups

This deployment requires creating two watch list groups:

1. “External Fabric Threats” of type IP and validity of 2 weeks

2. “Fabric Threats” of type IP and validity of 1 weeks

The validity of one and two weeks can be configured to be longer or shorter, depending on how transient the IP is likely to be. For example, there may be little value keeping a DHCP assigned IP in the watchlists for longer than 1 week as it may have been assigned to another host.

General steps to configure watchlists can be found here.

To create the External Fabric Threats Watch List Group, take the following steps from the FortiSIEM GUI.

1. Navigate to RESOURCES > Watch Lists.

2. In the left pane, click the + icon to create a new watch list group.

3. From the Create New Watch List Group windows, take the following steps:

   1. In the Group field, enter "External Fabric Threats".

   2. From the Type drop-down list, select IP.

   3. In the Expired in # Week(s) field, enter/select 2.

   4. Click Save.

   

To create the Fabric Threats Watch List Group, take the following steps from the FortiSIEM GUI.

1. Navigate to RESOURCES > Watch Lists.

2. In the left pane, click the + icon to create a new watch list group.

3. From the Create New Watch List Group windows, take the following steps:

   1. In the Group field, enter "Fabric Threats".

   2. From the Type drop-down list, select IP.

   3. In the Expired in # Week(s) field, enter/select 1.

   4. Click Save.