Deployment Plan

The high-level deployment plan is as follows:

1. FortiSIEM – Install FortiSIEM Agents and enable UEBA where licensed. Specific steps to deploy and enable can be found in the Windows Agent Installation Guide.

2. FortiSIEM - Define IP watchlist.

3. FortiSIEM - Import the custom rules.

4. FortiSIEM - Customize the rules to reference the watchlists.

5. FortiGate - Configure the FortiGate to collect the IPs from the Fabric watchlists.

6. FortiGate – Configure use case for FortiGate consumption of the IP Address Threat Feed.