Alert Logic IRIS API

Support for Alert Logic IRIS API allows FortiSIEM to respond to incidents and events in real-time with up-to-date situational awareness and comprehensive security analytics.

• Integration Points
• Event Types
• Reports
• Rules
• Configuring AlertLogic IRIS for FortiSIEM API Access
• Configuring FortiSIEM for AlertLogic IRIS API Access
• Sample Events

Integration points

Protocol	Information Discovered	Used For
AlertLogic Iris API	Security Alerts created by AlertLogic	Security and Compliance

Event Types

In RESOURCES > Event Types, enter "AlertLogic" in the Search field to see the event types associated with this device.

Rules

In RESOURCE > Rules, enter "AlertLogic" in the Search field to see the rules associated with this device.

Reports

No defined reports.

Configuring Alert Logic for FortiSIEM API Access

Get API Key from Alert Logic

1. Login to the Alert Logic user interface.
2. On the left menu, select Admin >Account.
3. Click New API Key.
4. Enter a descriptive name in the Generate New API key dialog box.
5. Click Save to generate the API key.

   A file containing your API key information (ID, ClientSecret, and Name) will be downloaded. The ID and ClientSecret will be used by FortiSIEM.

Configuring FortiSIEM for Alert Logic API Access

Complete these steps in the FortiSIEM UI:

1. Go to the ADMIN > Setup > Credentials tab.
2. In Step 1: Enter Credentials:
   1. Follow the instructions in “Setting Credentials“ in the User's Guide to create a new credential.
   2. Enter these settings in the Access Method Definition dialog box and click Save:

      Settings	Description
      Name	Enter a name for the credential
      Device Type	Alert Logic IPS
      Access Protocol	Alert Logic IPS
      Pull Interval	The interval in which FortiSIEM will pull events from Alert Logic. Default is 5 minutes.
      Access Key ID	Access key for your Alert Logic instance.
      Secret Key	Secret key for your Alert Logic instance
      Organization	The organization the device belongs to.
      Description	Description of the device.

3. In Step 2, Enter IP Range to Credential Associations:
   1. Select the name of your Alert Logic credential from the Credentials drop-down list.
   2. Enter a host name, an IP, or an IP range in the IP/Host Name field.
   3. Click Save.
4. Click Test to test the connection to Alert Logic.
5. To see the jobs associated with Alert Logic, select ADMIN > Pull Events.
6. To see the received events select ANALYTICS, then enter Alert Logicin the search box.

Sample Events

Raw events of an incident start with [AlertLogic_Incident]:

[AlertLogic_Incident]:[reptDevIpAddr]=10.10.10.10,[reptDevName]=api.cloudinsight.alertlogic.com,[accountId]=11111111.0,[phCustId]=1,[inIncidentAcknowledgeStatus]=closed,[inIncidentEventFirstSeen]=1558710055.0,[inIncidentClearedTime]=1558710055.0,[inIncidentCreateTime]=1558710161.9708278,[inIncidentCreatedUserId]=,[inIncidentLastModifiedTime]=0,[inIncidentLastModifiedUser]=,[inCustomerName]=1074822-INT4 - RMS FAWS Test,[msg]=This is a correlation incident,[inIncidentId]=e911347e8c1ca0fa,[inIncidentStatus]=closed,[attackType]=suspicious-activity,[type]=,[count]=0.0,[comment]=Test,[eventSeverity]=5,[eventType]=AlertLogic-Incident-Mei_Test,[srcIpAddr]=255.255.255.255,[destIpAddr]=255.255.255.255

Raw events of an associated event start with [AlertLogic_Incident_Associated_Event]:

AlertLogic_Incident_Associated_Event]:[reptDevIpAddr]=10.10.10.10,[phCustId]=,[reptDevIpAddr]=34.192.118.124,[reptDevName]=api.cloudinsight.alertlogic.com,[accountId]=100000,[inIncidentId]=e9113683d6815742,[httpContentType]=application/x-alpacket-megmsgs,[description]=meta,[resourceType]=associated log,[resourceName]=Log,[uuid]=UVUxSk5BQ2tNS3NBQUFBQVhQQnNkRnp3YkhRQUFiRE1BQUVBSG1Gd2NHeHBZMkYwYVc5dUwzZ3RZV3h3WVdOclpYUXRiV1ZuYlhObmN3QUdURTlIVFZOSDphcHBsaWNhdGlvbi94LWFscGFja2V0LW1lZ21zZ3M6ZTkxMTM2ODNkNjgxNTc0MjoxMDc2MDM2Mw==,[hostName]=meta,[msg]=dddddddd,[eventSeverity]=5,[procId]=0,[procName]=meta,[collectorTime]=1559260276,[reptDevName]=user,[eventType]=AlertLogic_e9113683d6815742_Associated_Event