Fortinet Advanced Analytics Lab Guide for FortiSIEM 6.3

Description

Network Topology Lab 1: Customer Definition Exercise 1: Adding Customers With Collectors Define Customers With Collectors Define Customers Without Collectors Exercise 2: Discovering Devices Without a Collector Verify the SNMP Service on Kali Configure Device Credentials for an Organization Without a Collector Discover a Device Review Logs From an Organization Without a Collector Exercise 3: Reviewing Multi-Tenancy on FortiSOAR Review Tenants on FortiSOAR Lab 2: Worker Configuration Exercise 1: Adding a Worker Add a Worker to the FortiSIEM Cluster Exercise 2: Generating Incidents on FortiSIEM Generate Incidents on FortiSIEM Exercise 3: Configuring FortiSIEM Data Ingestion Configure the FortiSIEM Connector Lab 3: Administration and Management of Collectors Exercise 1: Assigning Collectors to Organizations Assign Collectors to Organizations Verify Collector Health Exercise 2: Registering Collectors Register Collectors Verify Collector Health Exercise 3: Discovering FGT Banking through a Collector Configure SNMP on FortiGate Add Credentials for FortiGate Discover Banking FortiGate Approve FortiGate in CMDB Exercise 4: Discovering FGT Aviation through a Collector Configure Syslog on FGT Aviation Configure SNMP on Aviation FortiGate Add Credentials for Aviation FortiGate Discover FortiGate Approve FortiGate in CMDB Lab 4: Administration and Management of Agents Exercise 1: Adding a Windows Agent to an Organization Configure Windows Agent Registration Credentials Configure the Windows Agent Installation Settings File Define an Audit Policy Verify the Windows Agent Status Exercise 2: Assigning Templates to Windows Agents Create a Windows Agent Monitor Template Associate a Host to a Template Verify the Agent Status Approve the Windows Agent Exercise 3: Discovering LDAP Users Discover LDAP Users and Groups Review LDAP Users on FortiSIEM Exercise 4: Adding a Linux Agent to an Organization Configure Linux Agent Registration Credentials Register the Linux Agent Verify the Linux Agent Status Exercise 5: Assigning Templates to Linux Agents Create Linux Agent Monitor Templates Associate a Host to a Template Verify the Agent Status Approve the Linux Agent Lab 5: Discover Rules Exercise 1: Analyzing Allowed Traffic Log All Sessions on FortiGate Analyze Traffic Events on FortiSIEM Create a Rule From an Analytics Search Exercise 2: Monitoring Firewall Sessions Build an Analytics Search Display the Average Firewall Session Lab 6: Configuration of Single Pattern Security Rules Exercise 1: Detecting Remote Desktop Access Review the Remote Desktop From Internet Rule RDP From the Internet Review the RDP Incident Exercise 2: Detecting Multiple VPN Logon Failures Review the Multiple VPN Logon Failures Rule Generate SSL VPN Login Failures Verify VPN events on FortiGate Review the Incident for Multiple VPN Logon Failures Exercise 3: Detecting Locked Domain Accounts Review the Domain Account Locked Rule Review the Incident for Locked Domain Accounts Exercise 4: Creating a New Security Rule Create a Custom Rule Log in to FortiGate From a Public IP Address Lab 7: Configuration of Multipattern Security Rules Exercise 1: Reviewing a VPN Login Event Review the LDAP Users Create a VPN Pool Connect to the SSL VPN Analyze the SSL VPN Event Exercise 2: Reviewing an RDP Event Run a Real-Time Analytics Search Analyze an RDP Event Exercise 3: emranBuilding a Multipattern Rule Create a New Multipattern Rule Establish an RDP Connection over SSL VPN Review the Incident Lab 8: Baseline Theory Exercise 1: Reviewing Baseline Reports and Rules Review Baseline Reports Review Baseline Rules Exercise 2: Determining What to Baseline Determine Parameters to Baseline Exercise 3: Creating a Baseline With the BaselineMate Script Define an Event Run the BaselineMate Script from Supervisor Exercise 4: Verifying the Baseline Report Verify the Baseline Report Run the Script to Replay USB Events Update the Daily and Profile Databases Run the Baseline Report Lab 9: Configuration of Baseline Rules Exercise 1: Building a Baseline Rule Build a Baseline Rule Exercise 2: Preparing FortiSIEM for a Baseline Rule Update the Profile Database Exercise 3: Triggering a Baseline Rule Trigger a Baseline Rule Verify the Incident on FortiSIEM Lab 10: UEBA Exercise 1: Building a UEBA AI Model Train the AI Engine Exercise 2: Running the UEBA Demo Run the UEBA Demo Exercise 3: Reviewing UEBA Incidents Review the UEBA Incidents Review the UEBA Rules Exercise 4: Reviewing the UEBA Dashboard Review the UEBA Dashboards Lab 11: MITRE ATT&CK Framework Exercise 1: Creating Tags on FortiSIEM Create Tags on FortiSIEM Exercise 2: Generating Incidents on FortiSIEM Generate Incidents on FortiSIEM Exercise 3: Reviewing the MITRE ATT&CK Framework Support on FortiSIEM Review the MITRE ATT&CK Incident Dashboard Exercise 4: Reviewing the MITRE ATT&CK Framework Support on FortiSOAR Review the MITRE ATT&CK Framework on FortiSOAR Lab 12: Clear Conditions Exercise 1: Reviewing Time-Based Clear Conditions Review Rules With Clear Conditions Review a Time-Based Clear Condition Exercise 2: Configuring a Pattern-Based Clear Condition Define a Pattern-Based Clear Condition Modify the SNMP Ping Interval Disable the SNMP Service Run the Rule as a Query Verify the Incident Enable the SNMP Service Run the Rule as a Query Verify the Incident Status Lab 13: Remediation Exercise 1: Remediating an Incident Execute the Remediation Analyze the Remediation Result Exercise 2: Configuring the REST API on FortiGate Configure the REST API on FortiGate Configure a New Web Filter Profile Exercise 3: Configuring the FortiGate Connector Configure the FortiGate Connector Configure a Playbook to Use the FortiGate Connector Exercise 4: Mitigating Malicious IOCs Extract Indicators Enrich Malicious Indicators Block Malicious Indicators Appendix A