How to retrieve data from FortiNDR Cloud Services

FortiNDR Cloud Service collects an array of information that can be imported using this library.

• Detections:

  An alert mechanism that notifies you of events impacting your device and network. Detections allow you to quickly identify and respond to suspicious or known malicious activity in your network.

• Events:

  FortiNDR Cloud network sensors perform deep packet inspection of all observed network traffic and extract key protocol metadata. This metadata is enriched and organized into records called Events. In addition, FortiNDR Cloud observations and Suricata detections appear as events.

• Entities:

  FortiNDR Cloud entities are unique identifiers on the network. Entities are extracted from the event data and cataloged in their own data store. Contextual information is then added to the entities when applicable.

• Suricata:

  A match for a single Suricata signature with details.

• Observation:

  Observations are a result of multi-stage data pipelines that go across multiple events, do historical data lookups, draw correlations, compute several statistics and in some cases use machine learning algorithms to classify and predict outcomes.

Any of the above information can be retrieved using this Client Library. The next section provides more details, instructions and recommendations regarding how to build and use the client library to retrieve each event type in order to import them.