1. Logon to FortiSIEM
2. Go to ADMIN > Setup > Credential.
3. Click New to create AlertLogic API credential:

   
   

   For Access Protocol = AlertLogic API V3

   Setting	Value
   Name	<set name>
   Device Type	Alert Logic IPS
   Access Protocol	AlertLogic API V3
   Pull Interval	5 minutes
   Password config	See Password Configuration
   API Key	The API Key for device access is provided by AlertLogic
   Organization	Choose the Organization if it is an MSP deployment and the same credential is to be used for multiple customers

   
   

   For Access Protocol = AlertLogic IPS

   Settings	Description
   Name	Enter a name for the credential
   Device Type	Alert Logic IPS
   Access Protocol	Alert Logic IPS
   Pull Interval	The interval in which FortiSIEM will pull events from Alert Logic. Default is 5 minutes.
   Access Key ID	Access key for your Alert Logic instance.
   Secret Key	Secret key for your Alert Logic instance
   Organization	The organization the device belongs to.
   Description	Description of the device.

4. Enter an IP Range to Credential Association.
   1. Set Hostname to alertlogic.com
   2. Select the Credential created in step 3 above.
   3. Click Save.
5. Select the entry in step 4 and click Test > Test Connectivity. If it succeeds, then the credential is correct.
6. An entry will be created in ADMIN > Setup > Pull Events corresponding to this event pulling job. FortiSIEM will start to pull events from AlertLogic Cloud service using the AlertLogic V3 API.

To test for events received from AlertLogic:

1. Go to ADMIN > Setup > Pull Events.
2. Select the Windows Defender ATP entry and click Report.

The system will take you to the ANALYTICS tab and run a query to display the events received from AlertLogic in the last 15 minutes. You can modify the time interval to get more events.