Fabric extension

Fabric extension must be set up if you want to create custom countermeasure actions and custom metric plugins for Fortinet devices.

If you want to build and test custom plugins which use Fabric Helper Functions to access FortiGate, you should use API token authentication in onsight-dev regardless of how you actually integrate them in the prod environment.

First, get API token from the FortiGate GUI (System > Administrators > Create REST API Admin)

Add fortiapi-token variable to metadata

"fortiapi-token": "csHkh94cr0QQf8tb9px5N80w34fh11",

Optionally, you may need to add fortiapi-ip and fortiapi-port to specify IP/Port of the target FortiGate. you may need these when you run onsight-dev from an external network. First, check the connectivity to the target FortiGate.

"fortiapi-ip": "35.232.85.200",

"fortiapi-port": 443,

In your plugins, fabric helper functions will work in the same way regardless of integration methods. For example,

self.fortiapi_fortios(

instance_id, "/api/v2/monitor/system/resource/usage?resource=mem&interval=1-min")

FortiOS API

The following function calls FortiOS API on a FortiGate that is integrated with FortiMonitor. This function can be used for Fabric integrations using the Fabric tunnel, Fabric OnSight proxy, or for Fabric 6.x.

def fortiapi_fortios(self, instance_id, api_path, method="GET", data=None)

• instance_id: The instance ID of the target FortiGate. You can use the instance_id passed to get_data() function.

• api_path: FortiOS API path

• method: one of "GET", "POST", "PUT", "DELETE"

• data: The payload

Example of getting the memory usage of FortiGate:

def get_data(self, textkey, option, instance_id, hostname, device_type, device_sub_type, tags, attributes):

response = self.fortiapi_fortios(instance_id,"/api/v2/monitor/system/resource/usage?resource=mem&interval=1-min")

return response["results"]["mem"][0]["current"]

FortiManager API

This function calls FortiManager API on FortiManager that is integrated with FortiMonitor. This function can be used for Fabric integrations using the FortiManager proxy.

def fortiapi_fortimanager(self, instance_id, api_path, method="get", data=None)

• instance_id: The instance ID of the target FortiManager. you can use the instance_id passed to get_data() function

• api_path: FortiManager API path

• method: one of "GET", "ADD", "SET", "UPDATE", "DELETE", "MOVE", "CLONE", "EXEC"

• data: payload

Example of getting the memory usage of FortiManager

def get_data(self, textkey, option, instance_id, hostname, device_type, device_sub_type, tags, attributes):

result = self.fortiapi_fortimanager( instance_id, "/cli/global/system/performance" )

memory = result[0]["data"]["Memory"]

return float(memory["Used"].split()[-1].split("%")[0])