Overview

Fortinet FortiNDR Cloud is a cloud-native network detection and response solution built for the rapid detection of threat activity, investigation of suspicious behavior, proactive hunting for potential risks, and directing a fast and effective response to active threats. It ingests and stores threat intelligence from a wide variety of sources. FortiNDR Cloud provides a Python Client Library that allows you to retrieve some of this threat intelligence data using API and Metastream clients.

This document provides information and recommendations about how to use our Python Client Library to import the information gathered by FortiNDR Cloud into the Security Operation Center's (SOC) main platform of choice so it can be further processed and analyzed.

How Python Client Library works

The FortiNDR Cloud Service exposes several fully RESTful APIs that allows users to interact with the FortiNDR Cloud backend. Leveraging these APIs, it is possible to incorporate the data collected and analyzed by FortiNDR Cloud into the third-party Security solution system.

In addition to this, MetaStream provides raw events, observations, and Suricata alerts from FortiNDR Cloud in an AWS S3 bucket provisioned by Fortinet.

The Python Client Library leverages the exposed RESTful APIs to allow users to incorporate the network telemetry data collected and analyzed by FortiNDR Cloud into the third-party Security solution system. This Client Library also allows users to connect to AWS and retrieve selected data from the Metastream AWS S3 Bucket. This information can then be imported into the Security Operation Center's (SOC) main platform of choice or utilized as required.