Discovery

Question 1

Where is discovery information stored?

Answer 1

in CMDB

Question 2

When does FortiSIEM gain the ability to discover all physical and virtual infrastructure?

Answer 2

After entering admin credentials as well as a range of IP addresses that exist on the network

Question 3

What is typically used for network device configuration pulling?

Answer 3

SSH

Question 4

Which FortiSIEM components are capable of device discovery?

Answer 4

Supervisor or a Dedicated collector

Question 5

What is mandatory for discovering Linux servers?

Answer 5

SNMP

Question 6

What is SSH typically used for when discovering Linux server?

Answer 6

specific memory paging and disk I/O utilization values

Question 7

Which FortiSIEM components can discover Linux servers?

Answer 7

only the Supervisor or a Dedicated collector perform discovery

Question 8

What is the process of discovering Windows machines?

Answer 8

Question 9

What are the three possible ways of sending logs/events from a Windows machine?

Answer 9

1. WMI through RPC (TCP 135)
2. Third party agents (Snare) via syslog (UDP/514, TCP/1470)
3. FortiSIEM Agent (TCP/443)

Question 10

What needs to be used for flat file log collection to collect log files such as DNS and DHCP?

flat file - logs written to local files (e.g., .log or .txt) like DHCP or DNS

Answer 10

Agent - not a feature of WMI or SNMP

Question 11

How is the collection done if a device is discovered by the Supervisor?

Answer 11

FortiSIEM will load balance collection amongst the FortiSIEM cluster

Question 12

How is the collection done if a device is discovered by the Collector?

Answer 12

a one-to-one relationship is formed between the discovered device and Collector - only the discovering collector performs the data collection

Question 13

What should be the destination for syslog from the network device?

Answer 13

Collector

Question 14

What are 2 types of discovery?

Answer 14

1. Auto Log Discovery
2. GUI Discovery

Question 15

What does FSM do when Auto Log Discovery is used?

Answer 15

waits for devices, such as firewall or router to send its syslog messages or SNMP traps

Question 16

Depending on deployment model, manually configure syslog on network devices to send the logs to …?

Answer 16

1. Supervisor
2. Worker
3. Collector

Question 17

Describe the steps in the Auto Discovery Process

Answer 17

Question 18

How can you exclude specific IP ranges from the discovery process?

Answer 18

the Discovery tab provides a device filter to restrict what IP ranges are added from auto discovery to avoid scanning critical infrastructure like IPMI/iDRAC ranges, skip customer/test/lab segments, etc.

Question 19

How does GUI discovery work and what does it do?

Answer 19

actively collects data from devices in the network and uses user-defined credentials and various protocols for two distinct purposes:
1. discover devices, applications and users in the network and populate CMDB object groups
2. determine what metrics are available for each device and application and automatically apply collection templates

Question 20

What is the advantage of GUI Discovery over Auto Log Discovery?

Answer 20

fully populates the CMDB and determines what can be monitored on the device from performance and availability management standpoint

Question 21

Describe the GUI Discovery Process

Answer 21

Question 22

Where is GUI Discovery configured?

Answer 22

Admin > Setup > Discovery

Question 23

What is a pull event?

Answer 23

• a collection template designed to pull security (SIEM-type of events) from devices
• for security event log collection, GUI discovery applies log collection templates known as Pull Events
• FortiSIEM can actively connect to devices or systems to fetch logs or events, rather than waiting for the device to push them

Question 24

When are pull events especially useful?

Answer 24

1. Windows systems (via WMI or Agent)
2. Databases (via JDBC)
3. Cloud platforms (API-based pull)
4. Email gateways, ticketing systems, web services, etc.

Question 25

What needs to be done first before it is possible to use pull events?

Answer 25

define credentials under Admin > Setup > Credentials, which includes protocol (WMI, SSH, API), username/password or certs, port, and optionally device type

Question 26

No information can be collected from a device without ...?

Answer 26

proper authentication

Question 27

Some devices require a secondary credential to allow information collection. Why?

Answer 27

To collect running config of the device, SSH is required, as SNMP alone won't be able to gather configuration data

Question 28

What is mapped to CMDB groups to determine which devices run specific applications?

Answer 28

processes