Fortinet black logo

External Systems Configuration Guide

AlertLogic

AlertLogic Intrusion Detection and Prevention Systems (IPS)

Integration Points

Protocol Information Discovered Used For
AlertLogic V3 API Security Alerts created by AlertLogic Security and Compliance

Configuring AlertLogic for FortiSIEM API Access

Contact AlertLogic for API access key. This must be entered in FortiSIEM in the next step.

Configuring FortiSIEM for AlertLogic API Access

  1. Logon to FortiSIEM
  2. Go to ADMIN > Setup > Credentials.
  3. At Step 1: Enter Credentials, click New to create AlertLogic API credential:


    For Access Protocol = AlertLogic API V3

    SettingValue
    Name<set name>
    Device Type Alert Logic IPS
    Access ProtocolAlertLogic API V3
    Pull Interval5 minutes
    Password configSee Password Configuration
    API KeyThe API Key for device access is provided by AlertLogic
    OrganizationChoose the Organization if it is an MSP deployment and the same credential is to be used for multiple customers

    For Access Protocol = AlertLogic IPS

    Settings Description
    Name Enter a name for the credential
    Device Type Alert Logic IPS
    Access Protocol Alert Logic IPS
    Pull Interval The interval in which FortiSIEM will pull events from Alert Logic. Default is 5 minutes.
    Access Key IDAccess key for your Alert Logic instance.
    Secret Key Secret key for your Alert Logic instance
    Organization The organization the device belongs to.
    Description Description of the device.
  4. At Step 2: Enter IP Range to Credential Associations, click New to create a mapping.
    1. Enter "alertlogic.com" in the IP/Hostname field.
    2. Select the name of the credential created in step 3 from the Credentials drop-down list.
    3. Click Save.
  5. Select the entry in step 4 and click the Test drop-down list and select Test Connectivity. If it succeeds, then the credential is correct.
  6. An entry will be created in ADMIN > Setup > Pull Events corresponding to this event pulling job. FortiSIEM will start to pull events from AlertLogic Cloud service using the AlertLogic V3 API.

To test for events received from AlertLogic:

  1. Go to ADMIN > Setup > Pull Events.
  2. Select the AlertLogic entry and click Report.

The system will take you to the ANALYTICS tab and run a query to display the events received from AlertLogic in the last 15 minutes. You can modify the time interval to get more events.

AlertLogic

AlertLogic Intrusion Detection and Prevention Systems (IPS)

Integration Points

Protocol Information Discovered Used For
AlertLogic V3 API Security Alerts created by AlertLogic Security and Compliance

Configuring AlertLogic for FortiSIEM API Access

Contact AlertLogic for API access key. This must be entered in FortiSIEM in the next step.

Configuring FortiSIEM for AlertLogic API Access

  1. Logon to FortiSIEM
  2. Go to ADMIN > Setup > Credentials.
  3. At Step 1: Enter Credentials, click New to create AlertLogic API credential:


    For Access Protocol = AlertLogic API V3

    SettingValue
    Name<set name>
    Device Type Alert Logic IPS
    Access ProtocolAlertLogic API V3
    Pull Interval5 minutes
    Password configSee Password Configuration
    API KeyThe API Key for device access is provided by AlertLogic
    OrganizationChoose the Organization if it is an MSP deployment and the same credential is to be used for multiple customers

    For Access Protocol = AlertLogic IPS

    Settings Description
    Name Enter a name for the credential
    Device Type Alert Logic IPS
    Access Protocol Alert Logic IPS
    Pull Interval The interval in which FortiSIEM will pull events from Alert Logic. Default is 5 minutes.
    Access Key IDAccess key for your Alert Logic instance.
    Secret Key Secret key for your Alert Logic instance
    Organization The organization the device belongs to.
    Description Description of the device.
  4. At Step 2: Enter IP Range to Credential Associations, click New to create a mapping.
    1. Enter "alertlogic.com" in the IP/Hostname field.
    2. Select the name of the credential created in step 3 from the Credentials drop-down list.
    3. Click Save.
  5. Select the entry in step 4 and click the Test drop-down list and select Test Connectivity. If it succeeds, then the credential is correct.
  6. An entry will be created in ADMIN > Setup > Pull Events corresponding to this event pulling job. FortiSIEM will start to pull events from AlertLogic Cloud service using the AlertLogic V3 API.

To test for events received from AlertLogic:

  1. Go to ADMIN > Setup > Pull Events.
  2. Select the AlertLogic entry and click Report.

The system will take you to the ANALYTICS tab and run a query to display the events received from AlertLogic in the last 15 minutes. You can modify the time interval to get more events.