Fortinet black logo

Agentless ZTNA with FortiSIEM UEBA and FortiGate

Home FortiSIEM 7.1.2 Agentless ZTNA with FortiSIEM UEBA and FortiGate
7.1.2
7.1.6
7.1.5
7.1.4
7.1.3
7.1.2
7.1.1
7.1.0
7.0.3
7.0.2
7.0.1
7.0.0
6.7.9
6.7.8
6.7.7
6.7.6
6.7.5
6.7.4
6.7.3
6.7.2

Verify Device Added to Watchlist and Threat Feed

Verify Device Added to Watchlist and Threat Feed

To verify that a device has been added to the Watchlist and Threat Feed, take the following steps.

  1. On FortiSIEM, verify an incident has been triggered by navigating to INCIDENTS, and checking for active incidents.

  2. Verify the user’s device IP has been added to the corresponding watchlist by navigating to Resources > Watch Lists > Fabric Threats or Resources > Watch Lists > External Fabric Threats.

  3. On both Enterprise Core and 1st Floor FortiGates, verify that the FSM_Threat_Feed has been populated with the IP of the offending device.


Previous
Next

Verify Device Added to Watchlist and Threat Feed

To verify that a device has been added to the Watchlist and Threat Feed, take the following steps.

  1. On FortiSIEM, verify an incident has been triggered by navigating to INCIDENTS, and checking for active incidents.

  2. Verify the user’s device IP has been added to the corresponding watchlist by navigating to Resources > Watch Lists > Fabric Threats or Resources > Watch Lists > External Fabric Threats.

  3. On both Enterprise Core and 1st Floor FortiGates, verify that the FSM_Threat_Feed has been populated with the IP of the offending device.


Previous
Next