Fabric View
Fabric Connectors
You can use FortiAnalyzer to create the following types of fabric connectors:
ITSM
You can use the Fabric Connectors tab to create the following types of ITSM connectors:
l ServiceNow l Webhook, a generic connector
Creating or editing ITSM connectors
You can create ITSM connectors for ServiceNow and Webhook.
To create or edit ITSM connectors:
- Go to Fabric View > Fabric Connectors.
- To create an ITSM connector, click Create New. In the Create New Fabric Connector wizard, select ServiceNow or Webhook, and click Next.
To edit an ITSM connector, click the ITSM connector. The connector options are displayed.
- Configure the following options, and then click OK:
| Property | Description | |
| Name | Type a name for the fabric connector. | |
| Description | (Optional) Type a description for the fabric connector. | |
| Protocol | Select HTTPS. | |
| Property | Description | |
| Port | Specify the port FortiAnalyzer uses to communicate with the external platform. | |
| Method | Select POST. | |
| Title | Type a title for the fabric connector. | |
| URL | Type the URL of the external platform.
Using ServiceNow as an example, copy and paste the URL from ServiceNow API URL in the Connection to ServiceNow API section in ServiceNow > FortiAnalyzerSystem Properties. |
|
| Enable HTTP Authentication | Set HTTP authentication to ON or OFF.
Using ServiceNow as an example, enter the username and password from the Connection to ServiceNow API section in ServiceNow > FortiAnalyzer System Properties. |
|
| Status | Toggle ON to enable the fabric connector. Toggle OFF to disable the fabric connector. | |
Storage
You can use the Fabric Connectors tab to create the following types of storage connectors: l Amazon S3
l Microsoft Azure l Google Cloud
Creating or editing storage connectors
You can create storage connectors for Amazon S3, Microsoft Azure, and Google Cloud. Once you have created a storage connector, you can upload FortiAnalyzer logs to cloud storage. See Upload logs to cloud storage on page 219
To create a storage connector:
- Go to Fabric View > Fabric Connectors.
- Select Create New. In the Create New Fabric Connector wizard, choose Amazon S3, Azure Blob, or Google and select Next.
- Configure the following options and select OK.
| Property | Description | |
| Name | Type a name for the fabric connector. | |
| Comments | (Optional) Add comments about the connector. | |
| Title | Type a title for the fabric connector. | |
| Status | Toggle On to enable the fabric connector. Toggle Off to disable the fabric connector. | |
| Amazon S3
Azure Blob |
Provider | Type AWS. |
| Region | Select a region. | |
| Access Key ID | Paste the access key from the IAM user account. | |
| Secret Access Key | Paste the secret access key from the IAM user account. Click the eye icon to Show or Hide the key. | |
| Storage Account
Name |
Paste the storage account name from the Microsoft Azure account. | |
| Account Key | Paste the account key from the Microsoft Azure account. | |
| Cloud
Project Number |
Paste the project number from the Google account. | |
| Service Account Credentials | Paste the entire Google account JSON key into the field. Click the eye icon to Show or Hide the key. | |
| Cloud Location | Select a Google Cloud location. For information about Google locations, visit the product help. |
- Advanced options will differ between the various types of storage connectors.
To edit a storage connector:
- Go to Fabric View > Fabric Connectors.
- Select an existing storage connector to edit.
- In the dropdown menu that appears below the connector name, modify the connector settings.
- Select OK.
Identity Center
The Fabric View > Identity Center pane displays a list of users and endpoints in the network from relevant logs, and correlates them with FortiAnalyzer modules.
The Identity Center is useful for user and endpoint mapping. Some users might use multiple endpoints in the network, endpoints might use multiple different interfaces to connect, network interfaces might have multiple IP addresses, and so on. A map of users and their endpoints gives you better visibility when you analyze logs, events, and incidents. This also helps with your reporting.
To view relevant identity logs directly from the SOC, Log View, and Incidents & Events panes, click the user or endpoint log, then click the Topography link in the pop-up that appears.
This Identity pane lists all endpoints and users from relevant logs and correlates them with FortiAnalyzer modules.
| Column | Description |
| User Name | The name of the user. |
| User Group | The group of user identities. An identity can be a: l Local user account (username/password stored on the FortiGate unit) l Remote user account (password stored on a RADIUS, LDAP, or TACACS+ server) l PKI user account with digital client authentication certificate stored on the FortiGate unit l RADIUS, LDAP, or TACACS+ server, optionally specifying particular user groups on that server l User group defined on an FSSO server. |
| Endpoints | Endpoint host name, IP address, or MAC address. A user may be connected to multiple endpoints.
Click the endpoint to display the corresponding user information in the Assets pane. |
| Social | The user’s Name, Picture, Email, Phone Number, and Social if it is available. |
| Source | The name of device that created the log. |
| Last Update | The date and time the log was updated. |
Use the toolbar to select a Security Fabric, time period, and columns.
End user information is limited if there is no FortiClient in your installation.
- Endpoints are detected based on MAC address and displayed by IP address instead of host name.
- User related information might not be available.
- Detailed information such as OS version, avatar, and social ID information are not available.
To provide a unified experience, you can customize how identity information is displayed, including which fields are displayed, the order, and the priority.
To configure the display settings in the Social column:
- Go to Log View >Tools > UserDisplay Preferences.
- Select the order preference tab you want to configure.
Tabs include Name, Picture, Email, Phone Number, and Social.
- Rearrange the order preference as per your needs by drag-and-dropping an entry. For names, pictures, emails, and phone numbers, only the top entry will appear in the identity pop-up window.
- User information can be disabled by moving the Show toggle to the Off position in the respective tabs.
Assets
The Fabric View > Assets pane is the central location for security analysts to view endpoint and user information to make sure they are compliant. Endpoints are important assets in a network as they are the main entry points in a cybersecurity breach.
The Assets pane is useful for the following:
- Incident response. Check assets that are infected or vulnerable as part of your SOC analysis and incident response process. l Identify unknown and non-compliant users and endpoints.
To view relevant asset logs directly from the SOC, Log View, and Incidents & Events panes, click the user or endpoint log, then click the Topography link in the pop-up that appears.
The Assets pane lists all endpoints and users from relevant logs and correlates them with FortiAnalyzer modules. Sort by the Vulnerabilities column to see which endpoints and users have the highest vulnerabilities.
| Column | Description |
| Endpoint | Endpoint host name or IP address. |
| User | The name of the user. Click the name to view the corresponding user information in the Identity Center pane. |
| MAC Address | Endpoint MAC address. |
| IP Address | IP address the endpoint is connected to. A user might be connected to multiple endpoints. |
| FortiClient UUID | Unique ID of the FortiClient. |
| Hardware / OS | OS name and version. |
| Vulnerabilities | The number of vulnerabilities for critical, high, medium, and low vulnerabilities. Click the vulnerability to view the name and category. |
| Network Location | The location of the FortiAnalyzer device. |
| Last Update | The date and time the log was updated. |
Use the toolbar to select a Security Fabric, time period, and columns.
If there is no FortiClient in your installation, then endpoint and end user information is limited.
- Endpoints are detected based on MAC address and displayed by IP address instead of host name.
- User related information might not be available.
- Detailed information such as OS version, avatar, and social ID information are not available.