FortiSIEM

### Overview This presentation demonstrates the real-time integration between FortiSIEM and Armis, illustrating how combining the two platforms establishes an automated, comprehensive security ecosystem. Armis supplies asset intelligence and context, while FortiSIEM utilizes this data to power a unified Configuration Management Database (CMDB), enhanced threat correlation analytics, and automated response capabilities.

### Key Topics - **Credential Setup and API Connection**: Establishing integration between FortiSIEM and Armis using REST API keys under the admin settings. - **Asset Discovery and Synchronization**: Pulling asset information discovered by Armis directly into FortiSIEM to populate and classify devices in the CMDB. - **Event Ingestion and Health Verification**: Monitoring integration health via event status checks and reviewing 24-hour event reports. - **Threat Correlation and Incident Detection**: Aggregating disparate alerts from Armis into a coherent attack sequence within FortiSIEM. - **Investigation and Response Automation**: Expanding threat context using visual investigation features and addressing incidents via automation playbooks and dedicated IoT/OT dashboards.

### Technical Details - **Integration Configuration**: In the admin section under setup and credentials, a REST API key is configured to establish the connection with Armis. - **Asset Classification in CMDB**: Asset scans directly pull devices into FortiSIEM, with discovery results logged in the history log. Filtering the CMDB by the Armis REST API method shows that FortiSIEM automatically categorizes discovered hardware, including IT and IoT devices. - **Event Ingestion**: The pull events interface verifies connection health with a green check mark, and 24-hour reports show event types generated by Armis. - **Alert Correlation**: In a demonstrated scenario, Armis flags several individual alerts originating from source IP `192.168.86.67`—including communication to an external host, communication to a suspicious host, and a Chinese DNS query. FortiSIEM correlates these discrete alerts into a single actionable incident representing the complete attack chain. - **Investigation Workflow**: The investigation tab reveals that `192.168.86.67` belongs to a printer. Further visual investigation exposes that the same printer attempted an Active Directory logon and communicated with a malicious FortiGuard-flagged IP address located in China. - **Dashboarding and Remediation**: Threats can be mitigated using FortiSIEM automation playbooks. Additionally, the FortiSIEM OT/IoT dashboard contains a dedicated Armis section displaying real-time alerts, host-triggered events, device details, associated CVEs, and alert policies.

### Takeaways The integration allows security teams to automatically discover and classify unmanaged IT and IoT assets, correlate fragmented alerts into end-to-end attack chains, perform deep visual investigations, and trigger automated remediation playbooks directly within FortiSIEM.