Alert Storm After an IPS Update
MetroParts Manufacturing's SOC runs FortiAnalyzer 3500F with 65 FortiGates, four FortiMail instances, and FortiEDR. Ingest is 8,000 events per second; retention is 180 days; the log disk is at 91%. At 09:12, ten minutes after a FortiGuard IPS signature update, FortiAnalyzer raises 1,500 Possible Ransomware C2 alerts from 600 hosts. FortiEDR shows no malicious process on the five hosts sampled, and FortiGate logs show the destinations resolving to a large CDN. One host is simultaneously generating SMB scan traffic to 40 peers. The SOC manager wants to mass-block the destination and delete old logs to recover disk. The service desk reports 20 users unable to reach a business SaaS application. The incident commander asks for a triage decision in 15 minutes.
1. How would you triage the 1,500 alerts in 15 minutes? Give the queries and decision points, and say what you would not do.
Read the worked answer
First establish timing: the alerts began ten minutes after an IPS update, which raises false-positive probability but does not clear the SMB scanner. Query FortiAnalyzer for unique destination IPs, URL categories, ASN ownership, and host count. If 600 hosts hit a small set of CDN IPs and FortiEDR shows no execution, treat the signature as likely over-broad. Pivot on the one host doing SMB scans to 40 peers: that is a separate, higher-confidence behavior. Check FortiEDR process trees, FortiSandbox verdicts, and authentication logs for that host. Do not mass-block the CDN; that would break the SaaS app and create a self-inflicted outage. Do not suppress the signature globally until you have a sample and vendor confirmation. Decision: keep the SMB host as a potential incident, downgrade the 1,500 alerts to a tuning candidate, and open a FortiGuard false-positive case with packet captures. If any host shows payload execution, escalate immediately.
2. With the FortiAnalyzer disk at 91%, what immediate and structural actions would you take without destroying evidence?
Read the worked answer
At 91 percent, the immediate risk is losing the incident window. Do not delete old logs. Export or forward the relevant ADOM logs to external storage or the SIEM, then reduce noise: stop logging allowed DNS or low-value traffic, trim verbose UTM logs, and check whether debug is enabled. Apply retention per ADOM rather than globally; keep security events and the current incident longer. Structural fixes: add disk capacity, split high-volume devices into their own ADOM, forward a copy to a long-term syslog store, and set alerts at 80 percent. Deleting logs to recover disk destroys evidence and may violate retention policy. If the FortiAnalyzer is a VM, expand the virtual disk according to Fortinet procedure; do not manually delete log files.
3. The host that is scanning 40 peers is confirmed as a possible lateral-movement source. What containment decision do you make and what evidence do you preserve?
Read the worked answer
Treat the SMB scanner as a possible lateral-movement source. Isolate it with FortiNAC quarantine or FortiEDR containment, preserving memory and network state. Collect running processes, services, scheduled tasks, SMB sessions, local admins, and recent logons. Check whether the 40 peers accepted connections or authenticated. Reset credentials used on that host and review domain admin exposure. Do not reimage before collecting evidence. If FortiEDR shows ransomware behavior, escalate to full incident response and check backups. If it is a vulnerability scanner or IT tool, document the owner and exclude it narrowly. The decision hinges on evidence of execution and lateral success, not on the alert count.