Fortinet FortiAnalyzer-300F FortiGuard IOC Subscription License User Manual

1. Introduction

This user manual provides essential information for the activation, configuration, and management of the Fortinet FortiGuard Indicator of Compromise (IOC) subscription license for the FortiAnalyzer-300F appliance. The FortiGuard IOC service enhances your FortiAnalyzer's ability to detect and respond to advanced threats by providing up-to-date threat intelligence.

The FortiAnalyzer-300F is a comprehensive security logging, analytics, and reporting platform that provides organizations with a centralized view of their security posture. Integrating the FortiGuard IOC subscription ensures that your FortiAnalyzer is equipped with the latest threat intelligence to identify compromised systems within your network.

2. Product Overview

The FortiAnalyzer-300F is a dedicated appliance designed for network security logging, analysis, and reporting. It collects log data from various Fortinet devices, providing insights into network activity, security events, and compliance. The FortiGuard IOC subscription (SKU: FC-10-L300F-149-02-12) is a critical component that extends the FortiAnalyzer's capabilities by delivering real-time threat intelligence.

This subscription provides a continuously updated database of known Indicators of Compromise, enabling the FortiAnalyzer to proactively identify patterns and artifacts associated with malicious activities, such as malware infections, botnet communications, and targeted attacks.

Figure 1: Front view of the FortiAnalyzer-300F appliance, featuring multiple hot-swappable drive bays and front panel connectivity options.

Figure 2: Angled front view of the FortiAnalyzer-300F, illustrating its robust, rack-mountable chassis suitable for data center environments.

Figure 3: Rear view of the FortiAnalyzer-300F appliance, displaying redundant power supplies, various network interfaces, and available expansion slots for additional connectivity.

3. Setup and Activation

To utilize the FortiGuard IOC subscription, ensure your FortiAnalyzer-300F appliance is properly installed and configured for network access. The subscription activation process typically involves registering the license with your FortiCloud account and then applying it to the FortiAnalyzer unit.

3.1. Prerequisites

• A functional FortiAnalyzer-300F appliance with network connectivity.
• An active FortiCloud account. If you do not have one, register at support.fortinet.com.
• The FortiGuard IOC subscription license certificate or key (FC-10-L300F-149-02-12).
• Internet access for the FortiAnalyzer to communicate with FortiGuard services.

3.2. License Activation Steps

1. Register the License: Log in to your FortiCloud account at support.fortinet.com. Navigate to the 'Asset Management' section and register your FortiGuard IOC subscription using the provided license key.
2. Associate with FortiAnalyzer: Ensure the registered license is associated with your FortiAnalyzer-300F appliance within your FortiCloud account.
3. Synchronize FortiAnalyzer: Access the FortiAnalyzer-300F web-based manager. Go to System > FortiGuard. Ensure the FortiAnalyzer is configured to connect to FortiGuard services.
4. Update License Information: The FortiAnalyzer will automatically synchronize with FortiGuard to retrieve and apply the new IOC subscription. You may need to manually initiate a refresh or update if the license does not appear active immediately.
5. Verify Status: Confirm the FortiGuard IOC subscription status is 'Active' within the FortiAnalyzer's FortiGuard settings.

4. Operating the FortiGuard IOC Subscription

Once activated, the FortiGuard IOC subscription automatically integrates with your FortiAnalyzer-300F, enhancing its threat detection capabilities. The FortiAnalyzer will begin receiving updated IOC feeds from FortiGuard.

4.1. Accessing IOC Data and Reports

• Threat Monitoring: Navigate to the 'FortiView' or 'Monitor' sections within the FortiAnalyzer GUI to view real-time and historical threat data, including IOC detections.
• Reports: Generate custom or pre-defined reports that include IOC detection summaries. This can be found under the 'Reports' section. Look for templates related to threat analysis or compromised hosts.
• Log View: Directly inspect logs for IOC-related events. The FortiAnalyzer will tag logs that match known IOCs, making them easier to identify and investigate.

4.2. Configuring Alerts

To ensure timely response to IOC detections, configure alerts within the FortiAnalyzer:

1. Go to Event Management > Event Handler List.
2. Create new event handlers or modify existing ones to trigger alerts based on IOC detection events.
3. Define alert actions, such as email notifications, SNMP traps, or syslog messages, to inform security personnel immediately when an IOC is detected.

5. Maintenance

Regular maintenance ensures the continuous and effective operation of your FortiGuard IOC subscription.

5.1. License Renewal

The FortiGuard IOC subscription is valid for a specific period (e.g., 1 year). It is crucial to renew the license before its expiration date to maintain uninterrupted threat intelligence updates. Renewal can be managed through your FortiCloud account or by contacting your Fortinet reseller.

5.2. Subscription Status Verification

Periodically check the subscription status on your FortiAnalyzer-300F:

• Log in to the FortiAnalyzer web GUI.
• Navigate to System > FortiGuard.
• Verify that the FortiGuard IOC service shows an 'Active' status and the correct expiration date.

5.3. Network Connectivity

Ensure the FortiAnalyzer-300F maintains stable internet connectivity to FortiGuard servers for receiving timely IOC database updates. Any disruption can lead to outdated threat intelligence.

6. Troubleshooting

This section addresses common issues you might encounter with your FortiGuard IOC subscription.

6.1. License Not Active

• Check FortiCloud: Verify that the license is correctly registered and associated with your FortiAnalyzer-300F in your FortiCloud account.
• Synchronize Manually: On the FortiAnalyzer, go to System > FortiGuard and try to manually refresh the license information.
• Network Connectivity: Ensure the FortiAnalyzer can reach FortiGuard servers (e.g., check DNS resolution, firewall rules, proxy settings).

6.2. IOC Data Not Updating

• Internet Access: Confirm the FortiAnalyzer has outbound internet access on the necessary ports (typically TCP 443 for HTTPS).
• FortiGuard Server Status: Check the FortiGuard service status page on the Fortinet support website for any ongoing issues.
• System Resources: Ensure the FortiAnalyzer has sufficient system resources (CPU, memory, disk space) to process updates.

6.3. Detections Not Appearing in Reports

• Log Forwarding: Verify that logs from your FortiGate or other devices are correctly forwarded to the FortiAnalyzer.
• Report Configuration: Review your report settings to ensure they include IOC-related data fields and filters.
• Time Synchronization: Ensure the FortiAnalyzer's system time is synchronized with an NTP server to prevent discrepancies in log timestamps.

7. Specifications

The following specifications pertain to the FortiAnalyzer-300F appliance and its associated license.

8. Warranty and Support

Fortinet products, including the FortiAnalyzer-300F appliance and FortiGuard subscriptions, are backed by Fortinet's comprehensive support services. For specific warranty details regarding your FortiAnalyzer hardware, please refer to the documentation included with the appliance or visit the official Fortinet website.

The FortiGuard IOC subscription includes access to Fortinet's threat intelligence updates for the duration of the license. For technical assistance, troubleshooting, or inquiries regarding your subscription, please contact Fortinet Technical Support through your FortiCloud account or the Fortinet support portal:

• Fortinet Support Portal: https://support.fortinet.com/
• Ensure you have your FortiCloud account credentials and the serial number of your FortiAnalyzer-300F appliance ready when contacting support.