Related to SIEM Implementation Concerns

  • 1.  Related to SIEM Implementation Concerns

    Posted Sep 24, 2019 01:11 AM
    Dear Friends,

    I need your support to find answers/recommendations from FortiSIEM.

    Description Implementation Concerns
     Log Archival Process When restoration is required, is this happened in a bulk or can we add parameters i.e: like firewall, device, etc.
    When in restoration, is this restored into the storage of live box?
    What will be the impact of the processing of Live SIEM afterward / Performance impact?  
    When archiving is this comply with PCI-DSS. Is this RAW log or Normalized log?
    The customer has requested to retain application 31 days and the rest for 12 months. If the auditors request to generate a report for 4,5 devices for 12Months, how this can be time for such request?  
    Endpoint Agent Is this only for endpoints like desktops, laptops or can we use this for servers?
    If we can install this in an application server like IIS, is it enough to forward the logs for main 
    What are the log types collected by, these agents?
    Are there any limitations on a collection of logs with this agent?
    Is an agent forwarding to a collector or all in one node or both? 
    All in one feature concept SIEM(Ex. As SIEM like Supervisor, Worker, Collector ) Please explain the All in one concept
    Collector device count limits Limitation number of device per collector, or based on EPS count
    If the collector has a maximum EPS rate exceeds what is the method to continue the BAU The queue is being cleared after 3 days, what will happen to the logs for the in-between 2 days? Is SIEM being capable enough to flag the timelines and for a log in the sending device?
    Need a better explanation about this procedure(Are there any queuing methods applied)
    Any disaster situation loss of collector connectivity and after back to normal status. this can be achieved.
     Lost of connectivity to SIEM and  reconnection procedure If a its for 2,3 days and connected back, what is the mechanism of ? 
     Saving location for logs What are the Log storing locations for Raw logs and logs