FortiSIEM - Licensing Guide

FORTINET DOCUMENT LIBRARY

http://docs.fortinet.com

FORTINET VIDEO GUIDE

http://video.fortinet.com

FORTINET BLOG
https://blog.fortinet.com

CUSTOMER SERVICE & SUPPORT

https://support.fortinet.com

http://cookbook.fortinet.com/how-to-work-with-fortinet-support/

FORTIGATE COOKBOOK
http://cookbook.fortinet.com

FORTINET TRAINING SERVICES

http://www.fortinet.com/training

FORTIGUARD CENTER
http://www.fortiguard.com

FORTICAST
http://forticast.fortinet.com

END USER LICENSE AGREEMENT

http://www.fortinet.com/doc/legal/EULA.pdf

FEEDBACK
Email: [email protected]

July18, 2018

FortiSIEM Licensing Guide

TABLE OF CONTENTS

Licensing 4
Overview 5
Prerequisites 6
License for new users 9
Registering Base FortiSIEM product 9
Adding additional devices/services 15
License for existing users 19

FortiSIEM Licensing Guide 3

Fortinet Technologies Inc.
 Licensing

Licensing

l Overview
l Prerequisites
l License for new users
l Registering Base FortiSIEM Product
l Adding Additional devices/services
l License for existing users

4 FortiSIEM Licensing Guide

Fortinet Technologies Inc.
Licensing Overview

Overview

Starting release 4.10.0, FortiSIEM will only accept licenses issued by FortiCare. AccelOps license server
will not issue any more licenses effective immediately.

FortiSIEM license key generation has been improved. Starting September

11, 2017, FortiCare will generate licenses ONLY using the new license key
generation algorithm and will only work with FortiSIEM 4.10.0 and later
releases.
This has the following implications:
l If you want a new FortiCare license key, for any reason (for
example, to extend maintenance and support or buy additional
device license), you must upgrade to 4.10.0 first and then apply the
4.10 license.
l If you are upgrading to FortiSIEM 4.10.0, you must get a newly
generated license key before starting the upgrade process.

Note: FortiSIEM license issued by AccelOps license server will continue to work until the license
expires. However, you have to get a new license from FortiCare if:
l your current FortiSIEM license has expired.
l you need to buy additional services.
l you have a valid license and need to upgrade to FortiSIEM 4.10.0 and above.

FortiSIEM Licensing Guide 5

Fortinet Technologies Inc.
 Prerequisites Licensing

Prerequisites

Before proceeding with FortiSIEM license registration, read and save the required information related to the
following:
a. Registration code
b. Hardware ID
c. FortiSIEM image download site

a) Registration code
FortiSIEM product functionality is driven by the product SKUs below. You have to first purchase the right
combination of SKUs based on your needs from Fortinet. You will receive the registration letters via email that will
contain a separate registration code for every SKU. You need to use these registration SKUs to obtain FortiSIEM

6 FortiSIEM Licensing Guide

Fortinet Technologies Inc.
Licensing Prerequisites

license.

Product SKU Description

FortiSIEM Base Product

Base All-In-One (AIO) Perpetual

FSM-AIO-BASE License for 50 devices and 500
EPS.
FortiSIEM All-In-One Perpetual
License
FSM-AIO-XXXX-UG Add X devices and EPS/device All-
In-One (AIO) Perpetual license for
Non-MSP/MSP's.

Per Device Subscription License

FortiSIEM All-In-One
FC[1-8]-10-FSM98-180-02-DD that manages minimum X devices,
Subscription License
10 EPS/Device.

FortiSIEM Additional Products

Add XX End-Points and 2 EPS/

FortiSIEM End-Point Device
FSM-EPD-XX-UG End-Point for End-Point Perpetual
Perpetual License
License

FortiSIEM End-Point Device FC[1-8]-10-FSM98-184-02-DD Per End-Point Subscription License

Subscription License for minimum X End-Points, 2
EPS/End-Point

Add 1 EPS Perpetual License FSM-EPS-100-UG Add 1 EPS Perpetual

Add 1 EPS Subscription License FC1-10-FSM98-183-02-DD Add 1 EPS Subscription

FortiSIEM Advanced Windows XX Advanced Windows Agents for

FSM-WIN-ADV-XX-UG
Agent Perpetual License Perpetual License

FortiSIEM Advanced Windows FC[1-8]-10-FSM98-182-02-DD Per Agent Subscription License for

Agent Subscription License minimum XX Advanced Windows
Agents

(X Points)  FortiSIEM Indicators of

IOC Service Subscription Compromise (IOC) Service. 1
FC[1-G]-10-FSM98-149-02-DD
License device or 2 End points or 3
Windows Agents equals 1 point.

FortiSIEM Support

24x7 FortiCare Contract (X points).

FortiCare Support for FortiSIEM FC[1-G]-10-FSM97-248-02-DD 1 device or 2 End points or 3
Windows Agents equals 1 point.

FortiSIEM Licensing Guide 7

Fortinet Technologies Inc.
Prerequisites Licensing

b) Hardware ID
The Hardware ID (UUID) is used to uniquely identify the server where FortiSIEM Supervisor node will run. Based
on the user-level, follow the steps below to get the Hardware ID.

l New user:
Follow one of the methods below:

l Open https://<ip_of_supervisor>/.
The license upload page displays the Hardware ID.
l Go to the server where FortiSIEM Supervisor node has to be installed or is currently installed.
a. Login via SSH as root.
b. Run the command cat /sys/class/dmi/id/product_uuid
c. Note the output – you will need this to create a license.

l Existing user:
l Flash GUI: Go to Admin > License Management.
l HTML5 GUI: Go to ADMIN > License > License.

c) FortiSIEM image download site

l Fresh installation:
l If you are new to Fortinet products and do not have a support account other than FortiSIEM,
download the FortiSIEM image from:
https://images-cdn.fortisiem.fortinet.com/VirtualAppliances/latestrelease.html
l If you have existing Fortinet products, login to Fortinet support site and find the image under
Download > Firmware Images.
l Upgrade:
l Use the traditional upgrade process which will download the image from the old location.

8 FortiSIEM Licensing Guide

Fortinet Technologies Inc.
 Licensing License for new users

License for new users

This section describes the procedures for new FortiSIEM users to license FortiSIEM product. There is no Base
requirement for Subscription License, but the Ordering Quantity has to meet minimum quantity requirements of
each SKU.

Note: The base device related SKUs has to be registered first.

Base SKU Description

FSM-AIO-BASE Base all-in-one Perpetual License for 50 devices and 500 EPS

Per Device Subscription License that manages minimum X

FC[1-8]-10-FSM98-180-02-DD
devices, 10 EPS/Device.

Other FortiSIEM products such as additional devices, windows agents, IOC Services, Maintenance and Support
etc. can be added after the Base has been registered.

l Registering Base FortiSIEM product

l Adding additional devices/services

Registering Base FortiSIEM product

1. Go to FortiCare Product Registration link: https://support.fortinet.com/
2. Click SIGN UP to create an account.
3. Log in using your Account ID/Email and Password.
4. Click Asset > Register/Renew and enter the Registration Code of the Base license based on the license type.
l Subscription based license: Open the SKU file corresponding to the Subscription based license:
FC[1-8]-10-FSM98-180-02-DD and get the Registration code.
l Perpetual license: Open the SKU file corresponding to the Base Perpetual License:
FSM-AIO-BASE and get the Registration code.

FortiSIEM Licensing Guide 9

Fortinet Technologies Inc.
License for new users Licensing

5. Select the End User Type and click Next.

6. On the License Registration page, enter the Hardware ID and select the Fortinet Partner type from the list.

7. Click Next.
8. Read and agree to the terms and conditions of Fortinet Product Registration Agreement and click Next.
9. On the Verification page, read and agree to the terms and click Confirm.
10. Verify the information displayed under Product Info and click Finish.
Note the Serial Number for use in further steps.

10 FortiSIEM Licensing Guide

Fortinet Technologies Inc.
Licensing License for new users

11. Go to Asset > Manage/View products and click the Serial number obtained from the previous step.

FortiSIEM Licensing Guide 11

Fortinet Technologies Inc.
License for new users Licensing

12. Select General and click Edit to associate the Hardware ID of the VM where the Supervisor is going to run.
The Hardware ID can be obtained by following the steps in Prerequisites (b).

13. Select License & Key and click Get the License file link to download the license.
Note: If you need to add additional devices to the license, download the license file after adding all the devices
following the steps under ' Adding additional devices/services

12 FortiSIEM Licensing Guide

Fortinet Technologies Inc.
Licensing License for new users

14. Download and install FortiSIEM. See Prerequisites (c) for the image location.
15. Once FortiSIEM is installed, log in and click Browse to select the license file.

Note: If the UI does not redirect to the license upload screen, open https://<ip_of_
supervisor>/phoenix/licenseUpload.html and upload the license file.

FortiSIEM Licensing Guide 13

Fortinet Technologies Inc.
License for new users Licensing

16. Enter the User ID (default value: admin) and Password (default value: admin*1).
17. Select the License Type based on the deployment type as:
l Enterprise for single organizations
l Service Provider for multiple organizations
Note: For earlier versions of FortiSIEM, the License Type options displayed were VA for Enterprise and SP for
Service Provider.
18. Click Upload which is enabled after selecting the license file.
19. Verify the license following one of the methods:
a. Verify the license information on FortiSIEM GUI:
l Flash GUI: Admin > License Management
l HTML5 GUI: ADMIN > License> License.
b. On the server where FortiSIEM is installed, execute the command on the license file and verify the
license information:
l # phLicenseRead <LicenseFile>

14 FortiSIEM Licensing Guide

Fortinet Technologies Inc.
 Licensing License for new users

Note: Using this tool, you will not be able to identify the License type.
c. On the server where FortiSIEM is installed, execute one the following commands:
l # phLicenseTool --show
l # phLicenseTool --verify

Adding additional devices/services

After registering the base license, you can register additional devices/services supported by FortiSIEM:

l Devices
l End points
l Windows Agents
l IOC Service
l Maintenance and Service
Follow the below steps to add a device/service:
1. Open the SKU related to get the Registration code. Refer to the table under Prerequisites (a).
2. On FortiCare, go to Asset > Register/Review and add the Registration code of the new device.
3. Click the Serial Number obtained while registering the base.

FortiSIEM Licensing Guide 15

Fortinet Technologies Inc.
License for new users Licensing

4. Go to General > Edit to associate the Hardware ID and save.

Note: If you are adding more devices or services, repeat the procedure of adding the related registration id to
the same serial number and use the license generated at the end of registering all devices/services.
5. Go to License & Key tab and click Get the License File to download the license.
6. Download and install FortiSIEM image from the link: https://images-
cdn.fortisiem.fortinet.com/VirtualAppliances/latestrelease.html
Refer to the 'Installation' section of FortiSIEM Installation and Upgrade Guide for more information about
FortiSIEM installation.
7. Log in to FortiSIEM and click Browse to select the license file.

Note: If the UI does not redirect to the license upload screen, open https://<ip_of_
supervisor>/phoenix/licenseUpload.html and upload the license file.

16 FortiSIEM Licensing Guide

Fortinet Technologies Inc.
Licensing License for new users

8. Enter the User ID (default value: admin) and Password (default value: admin*1).
9. Select the License Type based on the deployment type of your organization as:
l Enterprise for single organizations
l Service Provider for multiple organizations

Note: For earlier versions of FortiSIEM, the License Type options displayed were VA for Enterprise and SP for
Service Provider.
10. Verify the license following one of the methods:
a. On FortiSIEM GUI:
l Flash GUI: Go to Admin > License Management
l HTML5 GUI: Go to ADMIN > License > License.
b. On the server where FortiSIEM is installed, execute the command on the license file and verify the
license information:
l # phLicenseRead <LicenseFile>

FortiSIEM Licensing Guide 17

Fortinet Technologies Inc.
License for new users Licensing

Note: Using this tool, you will not be able to identify the License type.
c. On the server where FortiSIEM is installed, execute one the following commands:
l # phLicenseTool --show
l # phLicenseTool --verify

18 FortiSIEM Licensing Guide

Fortinet Technologies Inc.
 Licensing License for existing users

License for existing users

For existing FortiSIEM customers, licenses are already imported into FortiCare. While the current FortiSIEM
license will continue to work until the license expires, you have to get a new license from FortiCare, if you want to
renew the license or buy additional products. Follow the below procedure to get a license:
1. Go to FortiCare Product Registration link: https://support.fortinet.com/.
2. Log in using your Account ID/Email and Password.
3. Click Asset > Manage/View Products.
The Serial Number corresponding to your license will be displayed.
4. Click the Serial number and select the General tab on the left tree.

5. Click Edit to associate the Hardware ID and Save. Refer to Prerequisites (b) section to get the Hardware ID.

6. Go to License & Key tab on the left tree and click Get the License File to download the license.
7. Before installing the license, please verify that you have the right license installed. The system will not function
if you have an incorrect license.
Verify the license:

FortiSIEM Licensing Guide 19

Fortinet Technologies Inc.
License for existing users Licensing

a. Download the phLicenseRead tool from the image download site. See Prerequisites (c).
b. Copy the phLicenseRead tool to /opt/phoenix/bin in the Supervisor node. Make sure the
permissions are correct (root/root).
c. Execute the command on the license file downloaded in Step 6 to verify the license information: #
phLicenseRead <LicenseFile>
Note: Using the phLicenseRead tool, you will not be able to identify the License type.

Note: If the license is incorrect, contact Fortinet support to get the right license. Do not install partial
license.
8. Upgrade FortiSIEM.
Refer to the 'Upgrade' section of FortiSIEM Installation and Upgrade Guide for information about upgrade
process.
9. After the Supervisor reboots, log in to the Supervisor node and click Browse to upload the license file from Step 6.

10. Enter the User ID (default value: admin) and Password (default value: admin*1).
11. Click Upload.
12. Verify the license information from the GUI.

20 FortiSIEM Licensing Guide

Fortinet Technologies Inc.
Licensing License for existing users

Flash GUI: Admin > License Management

FortiSIEM Licensing Guide 21

Fortinet Technologies Inc.
License for existing users Licensing

HTML5 GUI: ADMIN > License > License/ Usage/ Nodes

22 FortiSIEM Licensing Guide

Fortinet Technologies Inc.
Licensing License for existing users

FortiSIEM Licensing Guide 23

Fortinet Technologies Inc.
Copyright© 2018 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet,
Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company
names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and
actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein
represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written
contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified
performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For
absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. In no event does Fortinet make any
commitment related to future deliverables, features or development, and circumstances may change such that any forward-looking statements herein are not accurate.
Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify,
transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.