Events and Report Integration

This REST API based caller makes an HTTP(S) request with an input XML that defines the query. Since a query can take some time and the number of returned results can be large, the query works as follows:

1. Caller submits the query and gets a Query Id back from FortiSIEM. This is done via Request API.
2. Caller polls for query progress and waits until the query is completed. This is done via Polling API.
3. When the query is completed, Caller gets the results via Results API.
   1. Caller gets the total number of query results and the query result fields.
   2. Caller gets the results - one chunk at a time.

This API provides a way to programmatically run any query on the event data. Following are the specifications for:

• Request API
• Polling API
• Results API

Request API Specifications

Release Added	5.1
Input URL	https://<FortiSIEM_Supervisor_IP>/phoenix/rest/query/eventQuery
Input Parameters	XML file containing the query parameters.
Input Credentials	Enterprise deployments: User name and password of any FortiSIEM account Use "super" as the organization for Enterprise deployments. Curl example: curl -k -u super/admin:Admin*123 Service Provider deployments: User name and password of Super account for getting incidents for all organizations. If incidents for a specific organization are needed, then an organization-specific account and an organization name is needed. In this case, replace "super" with the organization name from the curl example.
Output	queryId or an error code if there is a problem in handling the query or the query format.

Polling API Specifications

The request will poll until the server completes the query.

Release Added	5.1
Input URL	https://<FortiSIEM_Supervisor_IP>/phoenix/rest/query/progress/<queryId>
Output	progress (pct) Until progress reaches 100 (completed), caller needs to continue polling FortiSIEM. This is because the server may need to aggregate the results or insert meta-information before sending the results.

Results API Specifications

Release Added	5.1
Input URL	https://<FortiSIEM_Supervisor_IP>/phoenix/rest/query/events/<queryId>/<begin>/<end>
Output	totalCount (first time) and an XML containing the incident attributes. For the first call, begin = 0 and end can be 1000. You must continuously query the server by using the same URL, but increasing the begin and end until the totalCount is reached.

Refer to Example Usage for a sample query.