FortiSIEM Agent Templates

Audit Policy Category

• The recommended audit policy category for auditing logon activity is Logon/Logoff.

Purpose of Security Auditing

• The purpose of security auditing is to track and monitor system events, including logon activity, file access, and system events.

Audit Policy for File Access

• The recommended audit policy for auditing access to files and folders is Object Access.

Process Command Line Auditing

• The process command line auditing can include commands, arguments, and executable paths.

Event 4688

• Event 4688 documents the creation of a new process.

Importance of 'Audit System Events' Policy

• Enabling the 'Audit system events' policy is important to track system events, including system startup, shutdown, and restart.

Audit Object Access Events

• The 'Audit object access events' policy can be used to audit access to files, folders, registry keys, and other objects.

Minimum Audit Policy for Logon Activity

• The recommended minimum audit policy for auditing logon activity is Success and Failure.

Misconception in Audit Policy Configuration

• When configuring audit policies, avoid the misconception that enabling too many policies can lead to performance issues.

Advanced Audit Policy Settings

• The purpose of advanced audit policy settings is to provide more granular control over auditing and to improve security monitoring.

Templates in FortiSIEM

• A template in FortiSIEM is a pre-defined set of audit policies and settings that can be applied to multiple agents.

Assigning Templates in FortiSIEM

• Multiple templates can be assigned to the same agent in FortiSIEM.
• Templates can be created by administrators and assigned to agents.

Template Name in FortiSIEM

• The template name in FortiSIEM must be unique and descriptive.

Event Tab in FortiSIEM

• The Event tab of a template in FortiSIEM allows defining event filters and rules.

Enabling UEBA Logs Collection in FortiSIEM

• UEBA logs collection in FortiSIEM can be enabled by configuring the required settings and agents.

Basic Windows Auditing

• The main categories for success and failure in Basic Windows Auditing are Object Access, Policy Change, Privilege Use, System Events, and Logon/Logoff.

Templates Across Multiple Customers

• A template can be used across multiple customers in FortiSIEM, but it requires proper configuration and management.

Assigning Multiple Templates

• When multiple templates are assigned to the same agent in FortiSIEM, the settings are combined, and the agent applies the resulting policies and settings.

Filtering on Event Tab

• The Event tab of a template in FortiSIEM allows filtering by event ID, severity, and other criteria.