Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

External Systems Configuration Guide

Box.com

Integration points

Protocol Information Discovered Used For
Box.com API   Security and Compliance

Box API Integration

FortiSIEM can pull audit events from Box.com Cloud Service via Box API.

Configuring Box.com Service

Create an account to be used for FortiSIEM communication.

  • A general account can pull user events
  • An Admin account can pull enterprise events

Configuring FortiSIEM

Use the account in previous step to enable FortiSIEM access.

  1. Logon to FortiSIEM.
  2. Go to ADMIN > Setup > Credentials.
  3. Click New to create a Box.com credential.
    1. Choose Device Type = Box.com Box (Vendor = Box.com, Model = Box).
    2. Choose Access Protocol = Box API.
    3. Choose Account as the email address for the account created while Configuring Box.com Service.
    4. Choose the Organization if it is an MSP deployment and the same credential is to be used for multiple customers.
    5. Click Save.
    6. You will be redirected to the Box.com website.
    7. Enter credentials for Box.com and click Authorize.
    8. Click Grant Access to Box. You should see that the authorization for FortiSIEM to access your Box.com account was successful.
  4. Enter an IP Range to Credential Association:
    1. Set Hostname to box.com.
    2. Select the Credential created in step 3.
    3. Click Save.
  5. Select the entry in step 4 and click Test Connectivity and make sure it succeeds, implying that the credential is correct.
  6. An entry will be created in ADMIN > Setup > Pull Events corresponding to this event pulling job. FortiSIEM will start to pull events from Box.com Cloud Service using the Box.com API.

To test for received Box.com events:

  1. Go to ADMIN > Setup > Pull Events.
  2. Select the Box.com entry and click Report.

The system will take you to the Analytics tab and run a query to display the events received from Box.com in the last 15 minutes. You can modify the time interval to get more events.

Box.com

Integration points

Protocol Information Discovered Used For
Box.com API   Security and Compliance

Box API Integration

FortiSIEM can pull audit events from Box.com Cloud Service via Box API.

Configuring Box.com Service

Create an account to be used for FortiSIEM communication.

  • A general account can pull user events
  • An Admin account can pull enterprise events

Configuring FortiSIEM

Use the account in previous step to enable FortiSIEM access.

  1. Logon to FortiSIEM.
  2. Go to ADMIN > Setup > Credentials.
  3. Click New to create a Box.com credential.
    1. Choose Device Type = Box.com Box (Vendor = Box.com, Model = Box).
    2. Choose Access Protocol = Box API.
    3. Choose Account as the email address for the account created while Configuring Box.com Service.
    4. Choose the Organization if it is an MSP deployment and the same credential is to be used for multiple customers.
    5. Click Save.
    6. You will be redirected to the Box.com website.
    7. Enter credentials for Box.com and click Authorize.
    8. Click Grant Access to Box. You should see that the authorization for FortiSIEM to access your Box.com account was successful.
  4. Enter an IP Range to Credential Association:
    1. Set Hostname to box.com.
    2. Select the Credential created in step 3.
    3. Click Save.
  5. Select the entry in step 4 and click Test Connectivity and make sure it succeeds, implying that the credential is correct.
  6. An entry will be created in ADMIN > Setup > Pull Events corresponding to this event pulling job. FortiSIEM will start to pull events from Box.com Cloud Service using the Box.com API.

To test for received Box.com events:

  1. Go to ADMIN > Setup > Pull Events.
  2. Select the Box.com entry and click Report.

The system will take you to the Analytics tab and run a query to display the events received from Box.com in the last 15 minutes. You can modify the time interval to get more events.