FortiSIEM Discovering Devices

Discovering Devices

Prerequisites

Make sure you have configured the Discovery Settings for your deployment

Set up the Access Credentials for your devices so FortiSIEM can communicate with them

Procedure

After you have set up the access protocols for your devices as described in Setting Access Credentials for Device Discovery, you are ready to discover devices in your IT infrastructure.

1. Log in to your Supervisor node.

Discovering Devices for Multi-Tenant Deployments

If you have a multi-tenant FortiSIEM deployment that uses Collectors and you and want to discover devices for a specific organization, rather than the Global organization, log into your Supervisor node as an admin user for that organization. See Dis covery for Multi-Tenant Deployments for more information about how discovery works for multi-tenant deployments with and without Collectors.

2. Go to Admin > Setup Wizard > Discovery.
3. Click Add.

You can also schedule single or recurring discovery processes as described in Scheduling a Discovery.

4. In the Range Definition dialog, set the options for this discovery.

See Discovery Range Definition Options for more information about the options available in this dialog.

5. Click OK.

Your range definition will be added to the list.

6. Select your range definition, and then click Discover.

A discovery dialog will show you the progress of your discovery. For long-running discoveries, you can use the Run in Background optio n.

7. When discovery completes, the results will be displayed in the dialog. Click Errors to view any errors.

Possible Causes of Discovery Errors

If there are errors during the discovery process, the Errors screen will inform you of their severity, impact, and potential resolution. Some possible reasons for errors include:

A device is not online or not reachable via ping. FortiSIEM will attempt to ping devices before initiating a full discovery to save time.

A device is not responding to SNMP or WMI requests, or there is a firewall blocking these requests from FortiSIEM The SNMP/WMI credentials are incorrect

WMI may not have been set up correctly on the server. See the appropriate topic under Configuring External Systems for Discovery, Monitoring and Log Collection for how to configure WMI for your device.

Approving Newly Discovered Devices

If you selected Approved Devices Only for the discovery setting Allow Incident Firing On, as described in Discovery Settings, then you will need to approve your newly discovered devices before incidents will be triggered for those devices. See Approving Newly Discovered Devices for more information.