First run

After installing, work through these steps as the first administrator. Each step links to the full page.

On the first start

When FireSight starts against an empty database it:

• creates the database tables;
• creates the first administrator from FIRESIGHT_ADMIN_USERNAME and FIRESIGHT_ADMIN_PASSWORD (or a generated password written to the log);
• creates the Standard chain with three stages: Team lead review (Team lead), Security review (Security) and Change advisory board (Change board);
• creates an emergency chain called Emergency change with one stage, Duty security approval (Security). Emergency changes stay off until you turn them on;
• creates an internal account, firesight-system, that scheduled jobs act as. It can't sign in;
• starts a 30-day evaluation for up to 10 firewalls.

First sign-in

1. Open FireSight through your reverse proxy.
2. Sign in with the first administrator's user name and password.
3. Open your name at the bottom of the menu and use Change password, especially if the password came from the log. See Signing in and your account.

Set-up checklist

1. Set the public address. If people reach FireSight through a reverse proxy, open Settings, Sign-in methods, General, and set Public address of FireSight (for example https://firesight.corp.example). Single sign-on needs this.
2. Add people. Either add FireSight accounts under Settings, Users & access, or connect a directory or single sign-on provider. See Users and roles and Sign-in methods.
3. Connect your firewalls. Add a FortiManager or a standalone FortiGate under Settings, Connections, click Test, then Sync now. See Connections.
4. Check each management domain's workspace mode (FortiManager ADOMs) in the ADOMs and firewalls table. See Connect a FortiManager.
5. Organise firewalls into regions and add IP pools. See Regions and IP addressing.
6. Set up approval chains. Adjust the standard chain, create chains for teams or data owners, assign them to management domains and add conditions. See Approval chains and Conditions.
7. Review the policies and schedules: lockout, session length, separation of duties, emergency changes, ticket references, the inactive-rule threshold, DNS, sync, expiry and monitoring intervals. See Settings reference.
8. Set up alerts for device health under Settings, Notifications, and click Send a test. See Notifications.
9. License the system. Download the activation request, register it on the portal, and install the license. See Licensing.

Go live

FireSight starts in simulation mode (FIRESIGHT_DEPLOY_MODE=simulate). Reads from your firewalls work normally, but deployments only record the plan; nothing is written. Settings, System shows the banner Deployments are simulated.

To start writing to your firewalls:

1. Test the whole flow against a lab FortiManager or FortiGate: request, approve, deploy, back out.
2. Set FIRESIGHT_DEPLOY_MODE=live in .env.
3. Restart: docker compose up -d.
4. Check Settings, System shows Deployments: Live.