Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

External Systems Configuration Guide

Alert Logic IRIS API

Support for Alert Logic IRIS API allows FortiSIEM to respond to incidents and events in real-time with up-to-date situational awareness and comprehensive security analytics.

Integration Points

Protocol Information Discovered Used For
AlertLogic Iris API Security Alerts created by AlertLogic Security and Compliance

 

Event Types

In RESOURCES > Event Types, enter "AlertLogic" in the main content panel Search... field to see the event types associated with this device.

Rules

In RESOURCES > Rules, enter "AlertLogic" in the main content panel Search... field to see the rules associated with this device.

Reports

No defined reports.

Configuring Alert Logic for FortiSIEM API Access

Get API Key from Alert Logic
  1. Login to the Alert Logic user interface.
  2. On the left menu, select Admin >Account.
  3. Click New API Key.
  4. Enter a descriptive name in the Generate New API key dialog box.
  5. Click Save to generate the API key.

    A file containing your API key information (ID, ClientSecret, and Name) will be downloaded. The ID and ClientSecret will be used by FortiSIEM.

Configuring FortiSIEM for Alert Logic API Access

Complete these steps in the FortiSIEM UI:

  1. Go to the ADMIN > Setup > Credentials tab.
  2. In Step 1: Enter Credentials, click New to create a new credential.
    1. Follow the instructions in "Setting Credentials" in the User's Guide to create a new credential.
    2. Enter these settings in the Access Method Definition dialog box and click Save:

      Settings Description
      Name Enter a name for the credential
      Device Type Alert Logic IPS
      Access Protocol Alert Logic IPS
      Pull Interval The interval in which FortiSIEM will pull events from Alert Logic. Default is 5 minutes.
      Access Key ID Access key for your Alert Logic instance.
      Secret Key Secret key for your Alert Logic instance
      Organization The organization the device belongs to.
      Description Description of the device.
  3. In Step 2: Enter IP Range to Credential Associations, click New to create a mapping.
    1. Enter a host name, an IP, or an IP range in the IP/Host Name field.
    2. Select the name of your Alert Logic credential from the Credentials drop-down list.
    3. Click Save.
  4. Click the Test drop-down list and select Test Connectivity to test the connection to Alert Logic.
  5. To see the jobs associated with Alert Logic, select ADMIN > Setup > Pull Events.
  6. To see the received events select ANALYTICS, then enter "Alert Logic" in the search box.

Sample Events

Raw events of an incident start with [AlertLogic_Incident]:

[AlertLogic_Incident]:[reptDevIpAddr]=10.10.10.10,[reptDevName]=api.cloudinsight.alertlogic.com,[accountId]=11111111.0,[phCustId]=1,[inIncidentAcknowledgeStatus]=closed,[inIncidentEventFirstSeen]=1558710055.0,[inIncidentClearedTime]=1558710055.0,[inIncidentCreateTime]=1558710161.9708278,[inIncidentCreatedUserId]=,[inIncidentLastModifiedTime]=0,[inIncidentLastModifiedUser]=,[inCustomerName]=1074822-INT4 - RMS FAWS Test,[msg]=This is a correlation incident,[inIncidentId]=e911347e8c1ca0fa,[inIncidentStatus]=closed,[attackType]=suspicious-activity,[type]=,[count]=0.0,[comment]=Test,[eventSeverity]=5,[eventType]=AlertLogic-Incident-Mei_Test,[srcIpAddr]=255.255.255.255,[destIpAddr]=255.255.255.255

Raw events of an associated event start with [AlertLogic_Incident_Associated_Event]:

AlertLogic_Incident_Associated_Event]:[reptDevIpAddr]=10.10.10.10,[phCustId]=,[reptDevIpAddr]=34.192.118.124,[reptDevName]=api.cloudinsight.alertlogic.com,[accountId]=100000,[inIncidentId]=e9113683d6815742,[httpContentType]=application/x-alpacket-megmsgs,[description]=meta,[resourceType]=associated log,[resourceName]=Log,[uuid]=UVUxSk5BQ2tNS3NBQUFBQVhQQnNkRnp3YkhRQUFiRE1BQUVBSG1Gd2NHeHBZMkYwYVc5dUwzZ3RZV3h3WVdOclpYUXRiV1ZuYlhObmN3QUdURTlIVFZOSDphcHBsaWNhdGlvbi94LWFscGFja2V0LW1lZ21zZ3M6ZTkxMTM2ODNkNjgxNTc0MjoxMDc2MDM2Mw==,[hostName]=meta,[msg]=dddddddd,[eventSeverity]=5,[procId]=0,[procName]=meta,[collectorTime]=1559260276,[reptDevName]=user,[eventType]=AlertLogic_e9113683d6815742_Associated_Event

Alert Logic IRIS API

Support for Alert Logic IRIS API allows FortiSIEM to respond to incidents and events in real-time with up-to-date situational awareness and comprehensive security analytics.

Integration Points

Protocol Information Discovered Used For
AlertLogic Iris API Security Alerts created by AlertLogic Security and Compliance

 

Event Types

In RESOURCES > Event Types, enter "AlertLogic" in the main content panel Search... field to see the event types associated with this device.

Rules

In RESOURCES > Rules, enter "AlertLogic" in the main content panel Search... field to see the rules associated with this device.

Reports

No defined reports.

Configuring Alert Logic for FortiSIEM API Access

Get API Key from Alert Logic
  1. Login to the Alert Logic user interface.
  2. On the left menu, select Admin >Account.
  3. Click New API Key.
  4. Enter a descriptive name in the Generate New API key dialog box.
  5. Click Save to generate the API key.

    A file containing your API key information (ID, ClientSecret, and Name) will be downloaded. The ID and ClientSecret will be used by FortiSIEM.

Configuring FortiSIEM for Alert Logic API Access

Complete these steps in the FortiSIEM UI:

  1. Go to the ADMIN > Setup > Credentials tab.
  2. In Step 1: Enter Credentials, click New to create a new credential.
    1. Follow the instructions in "Setting Credentials" in the User's Guide to create a new credential.
    2. Enter these settings in the Access Method Definition dialog box and click Save:

      Settings Description
      Name Enter a name for the credential
      Device Type Alert Logic IPS
      Access Protocol Alert Logic IPS
      Pull Interval The interval in which FortiSIEM will pull events from Alert Logic. Default is 5 minutes.
      Access Key ID Access key for your Alert Logic instance.
      Secret Key Secret key for your Alert Logic instance
      Organization The organization the device belongs to.
      Description Description of the device.
  3. In Step 2: Enter IP Range to Credential Associations, click New to create a mapping.
    1. Enter a host name, an IP, or an IP range in the IP/Host Name field.
    2. Select the name of your Alert Logic credential from the Credentials drop-down list.
    3. Click Save.
  4. Click the Test drop-down list and select Test Connectivity to test the connection to Alert Logic.
  5. To see the jobs associated with Alert Logic, select ADMIN > Setup > Pull Events.
  6. To see the received events select ANALYTICS, then enter "Alert Logic" in the search box.

Sample Events

Raw events of an incident start with [AlertLogic_Incident]:

[AlertLogic_Incident]:[reptDevIpAddr]=10.10.10.10,[reptDevName]=api.cloudinsight.alertlogic.com,[accountId]=11111111.0,[phCustId]=1,[inIncidentAcknowledgeStatus]=closed,[inIncidentEventFirstSeen]=1558710055.0,[inIncidentClearedTime]=1558710055.0,[inIncidentCreateTime]=1558710161.9708278,[inIncidentCreatedUserId]=,[inIncidentLastModifiedTime]=0,[inIncidentLastModifiedUser]=,[inCustomerName]=1074822-INT4 - RMS FAWS Test,[msg]=This is a correlation incident,[inIncidentId]=e911347e8c1ca0fa,[inIncidentStatus]=closed,[attackType]=suspicious-activity,[type]=,[count]=0.0,[comment]=Test,[eventSeverity]=5,[eventType]=AlertLogic-Incident-Mei_Test,[srcIpAddr]=255.255.255.255,[destIpAddr]=255.255.255.255

Raw events of an associated event start with [AlertLogic_Incident_Associated_Event]:

AlertLogic_Incident_Associated_Event]:[reptDevIpAddr]=10.10.10.10,[phCustId]=,[reptDevIpAddr]=34.192.118.124,[reptDevName]=api.cloudinsight.alertlogic.com,[accountId]=100000,[inIncidentId]=e9113683d6815742,[httpContentType]=application/x-alpacket-megmsgs,[description]=meta,[resourceType]=associated log,[resourceName]=Log,[uuid]=UVUxSk5BQ2tNS3NBQUFBQVhQQnNkRnp3YkhRQUFiRE1BQUVBSG1Gd2NHeHBZMkYwYVc5dUwzZ3RZV3h3WVdOclpYUXRiV1ZuYlhObmN3QUdURTlIVFZOSDphcHBsaWNhdGlvbi94LWFscGFja2V0LW1lZ21zZ3M6ZTkxMTM2ODNkNjgxNTc0MjoxMDc2MDM2Mw==,[hostName]=meta,[msg]=dddddddd,[eventSeverity]=5,[procId]=0,[procName]=meta,[collectorTime]=1559260276,[reptDevName]=user,[eventType]=AlertLogic_e9113683d6815742_Associated_Event