Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

Fortinet FortiSIEM - A Step-by-Step BootCamp

Name: Fortinet FortiSIEM - A Step-by-Step BootCamp
Rating: 4.7 (270 reviews)

Tackle cyber threats in real time by using powerful, scalable, and efficient SIEM security software. That’s FortiSIEM.

Created byHatem Metwally

Last updated 5/2023

English

English [Auto],Italian [Auto],

What you'll learn

Security Information and Event Management
SIEM
Fortinet FortiSIEM
Hands-ON
Use Cases

Course content

4 sections • 26 lectures • 11h 9m total length

Introduction33:38
Explore the Fortinet FortiSIEM 40 sem bootcamp, covering architecture, sizing, ha and dr, installation, gui, logs, dashboards, reports, and licensing.
Foundations and Reference Architectures56:32
Explore FortiSIEM foundations and reference architectures, including rapid scale with supervisor, collectors, and workers; compare event databases (Clickhouse, Elasticsearch, local/NFS), and plan for on-prem, cloud, and MSSP deployments.
FortiSIEM Sizing - ClickHouse48:19
Size your FortiSIEM ClickHouse deployment using Fortinet's sizing guide, balancing minimum requirements, online retention, and storage with shards, replication, and hot and warm tiers.
High Availability and Disaster Recovery - ClickHouse16:55
Explore FortiSIEM's high availability and disaster recovery with the Clickhouse option, featuring a leader and followers supervisor architecture, optional load balancers, DNS redirection, and cross-site replication.
Supervisor All-In-One Installation28:07
Install and configure Fortinet FortiSIEM 40 SIM supervisor all-in-one from an ova, allocate multi-disk storage, set network, run automated config, register the license, and configure Clickhouse storage.
FortiCollector Installation & Registeration23:18
Install and register a FortiCollector with the FortiSIEM supervisor, following the same steps as the collector installation, and configure hostname, IP, DNS, and login.
FSM GUI simplified6:18
Explore a simplified FortiSIEM GUI with dashboards, analytics, incidents, CMDB, and case management. Navigate resources, rules, license, and settings to monitor health, updates, and event handling.
Windows Agent Installation & Registeration20:45
Install the FortiSIEM Windows agent, register it with the supervisor, and associate it with a collector; enable TLS 1.2 and disable disk fair share to enable running active status.
Search via Analytics page9:08
Explore the analytics page to search logs with keyword and attribute filters, adjust time ranges and chart types, and save and load custom layouts for repeat investigations.
Incidents, Rules Development and Troubleshooting58:27
Learn how Fortinet FortiSIEM incidents are triggered by rules across security, performance, availability, and change, and master incident creation through rule development and troubleshooting from logs to actions.
Sysmon Log Integration into FortiSIEM21:42
Enrich FortiSIEM by installing Sysmon, applying the config XML, and updating the agent template to include the Sysmon channel for high-fidelity Windows logs.
Sigma Rules and Sysmon Rule Development30:01
Explore how Fortinet FortiSIEM integrates Sysmon logs and adopts Sigma rules to detect malicious PowerShell behavior, and learn to develop and translate Sigma rules into FortiSIEM rules.
Command Line_Powershell Auditing and Sigma Rule Translation41:35
Translate a Sigma rule into a FortiSIEM rule by enabling command prompt and PowerShell auditing, mapping logs to FortiSIEM fields, and translating process creation events for detection.
Attack Simulation, File Integrity Monitoring and Linux Agent Installation35:37
Learn to deploy a FortiSIEM Linux agent, enable file integrity monitoring, and detect tampering via built-in FIM rules during an attack simulation on a Linux server.

SNMP39:28
FortiSIEM automatically discovers devices, applications, and users to build a CMDB, using SNMP, SSH, syslog, and NetFlow, with FortiGate as the example.
SSH13:04
Configure and monitor FortiGate devices with FortiSIEM using SSH credentials to retrieve running configurations, enforce password authentication, and validate discoveries alongside SNP monitoring.
SYSLOG6:51
Enable syslog on FortiGate to forward traffic and system logs to FortiSIEM via GUI or CLI, set the supervisor IP, facility option, RFC 524 syslog format, and port 514 UDP.
NETFLOW, Discovery Settings, CMDB Groups, Business SRV, and Custom Properties23:40
Explore NetFlow discovery with FortiGate in FortiSIEM, and distinguish NetFlow from syslog. Configure CMDB groups, business SRV, and custom properties for precise asset tagging.

Dashboards and Business Services31:25
Design and use dashboards in FortiSIEM to monitor incidents and performance, and organize mission-critical devices into business services with dynamic grouping and dashboards.
Reports14:12
Learn to locate and create FortiSIEM reports across 3000+ options, organize them in ABC folders, define conditions and display columns, run schedules, and save results for dashboards.

Upload New License File1:56
Extend a 40 SIM license by downloading the new license file from the 40 care website and uploading it on the admin license page to renew for one month.
NFS Archive and Retention Policy19:12
Configure an NFS archive to extend FortiSIEM's event retention by linking an NFS server to the Clickhouse online storage and applying 3-month online and 12-month archive retention.
Validate and Search Archives4:50
Validate archive data and learn to search archives in FortiSIEM, confirming online and archive synchronization on the analytics page and using retention policy to find logs beyond six months.
ClickHouse Warm Tier disk addition to Extend Online Retention12:29
Add a 500 GB sixth disk to create a warm tier for Clickhouse and extend online retention from three to six months, while keeping the archive aligned with online storage.
Splitting Data & Control Planes - Adding Network Interface to FortiSIEM39:22
Add a new data-plane interface to FortiSIEM, separate data and management networks, relocate the Linux agent, configure static routes and a FortiGate virtual IP, and test the isolated path.
Deep Dive on FortiSIEM Licensing and Part Numbers32:51
Explore FortiSIEM licensing in depth, including perpetual vs subscription models, base and additional part numbers, devices and endpoints, advanced agents for log and FIM and UBA, with two case analyses.

Requirements

Basic Unix/Linux Skills
Basic Network Security Concepts

Description

Do you want to enter the SIEM field?

Do you want to learn one of the leaders SIEM technologies?

Do you want to understand the concepts and gain the handson on Fortinet FortiSIEM?

Then this course is designed for you. Through baby steps you will learn Fortinet FortiSIEM

FortiSIEM is a highly scalable multi-tenant Security Information and Event Management (SIEM) solution that provides real time infrastructure and user awareness for threat detection, analysis and reporting.

FortiSIEM provides an actionable security intelligence platform to monitor security, performance and compliance through a single pane of glass.

FortiSIEM has hundreds of customers worldwide in markets including managed services, technology, financial services, healthcare, and government.

Companies around the world use FortiSIEM for the following use cases:

Threat management and intelligence that provide situational awareness and anomaly detection
Alleviating compliance mandate concerns for PCI, HIPAA and SOX
Managing “alert overload”
Handling the “too many tools” reporting issue
Detect unusual user and entity behavior (UEBA) without requiring the Administrator to write complex rules.
Addressing the MSPs/MSSPs pain of meeting service level agreements

Fortinet FortiSIEM was previously known as FortiSIEM, AccelOps.

The course is covering below topics

- Introduction

- Foundations and Reference Architecture

- Scale-Out Architecture

- Distributed Event Correlation

- Clustering Architecture

- Licensing

- High Availability and Disaster Recovery - ClickHouse

- FortiSIEM Sizing - ClickHouse

- All-In-One Supervisor Installation

- FortiCollector Installation & Registeration

- FSM GUI simplified

- Windows Agent Installation, Registeration and Template Association

- Search via Analytics page

- Incidents, Rules Development and Troubleshooting

- Sysmon Log Integration into FortiSIEM

- Sigma Rules and Sysmon Rule Development

- Command Line_Powershell Auditing and Sigma Rule Translation

- Attack Scenario, File Integrity Monitoring and Linux Agent Installation

- Dashboards and Business Services

- Reports

- Device Discovery - FortiGate - SNMP, SSH, SYSLOG, and NETFLOW

- Discovery Settings, CMDB Groups, Business Services and Custom Properties

- Upload New License File

- NFS Archive and Retention Policy

- Validate and Search Archives

- ClickHouse Warm Tier disk addition to Extend Online Retention

- Splitting Data & Control Planes - Adding Network Interface to FortiSIEM

- Deep Dive on FortiSIEM Licensing and Part Numbers

Please note that FortiSIEM image download/license requires FortiCare entitlement or to be an active partner with Fortinet

Who this course is for:

Network Security Specialists & Administrators
SOC Operators & Analysts
Information Security Sepcialists

Fortinet FortiSIEM - A Step-by-Step BootCamp

What you'll learn

Explore related topics

Course content

Core14 lectures • 7hr 10min

Device Discovery4 lectures • 1hr 23min

Dashboards, Business Services and Reports2 lectures • 46min

Appendix6 lectures • 1hr 51min

Requirements

Description

Who this course is for: