AlertLogic Intrusion Detection and Prevention Systems (IPS)
- Integration Points
- Configuring AlertLogic for FortiSIEM API Access
- Configuring FortiSIEM for AlertLogic API Access
|Protocol||Information Discovered||Used For|
|AlertLogic V3 API||Security Alerts created by AlertLogic||Security and Compliance|
Configuring AlertLogic for FortiSIEM API Access
Contact AlertLogic for API access key. This must be entered in FortiSIEM in the next step.
Configuring FortiSIEM for AlertLogic API Access
- Logon to FortiSIEM
- Go to ADMIN > Setup > Credentials.
- At Step 1: Enter Credentials, click New to create AlertLogic API credential:
For Access Protocol = AlertLogic API V3
Setting Value Name <set name> Device Type Alert Logic IPS Access Protocol AlertLogic API V3 Pull Interval 5 minutes Password config See Password Configuration API Key The API Key for device access is provided by AlertLogic Organization Choose the Organization if it is an MSP deployment and the same credential is to be used for multiple customers
For Access Protocol = AlertLogic IPS
Settings Description Name Enter a name for the credential Device Type Alert Logic IPS Access Protocol Alert Logic IPS Pull Interval The interval in which FortiSIEM will pull events from Alert Logic. Default is 5 minutes. Access Key ID Access key for your Alert Logic instance. Secret Key Secret key for your Alert Logic instance Organization The organization the device belongs to. Description Description of the device.
- At Step 2: Enter IP Range to Credential Associations, click New to create a mapping.
- Enter "alertlogic.com" in the IP/Hostname field.
- Select the name of the credential created in step 3 from the Credentials drop-down list.
- Click Save.
- Select the entry in step 4 and click the Test drop-down list and select Test Connectivity. If it succeeds, then the credential is correct.
- An entry will be created in ADMIN > Setup > Pull Events corresponding to this event pulling job. FortiSIEM will start to pull events from AlertLogic Cloud service using the AlertLogic V3 API.
To test for events received from AlertLogic:
- Go to ADMIN > Setup > Pull Events.
- Select the AlertLogic entry and click Report.
The system will take you to the ANALYTICS tab and run a query to display the events received from AlertLogic in the last 15 minutes. You can modify the time interval to get more events.