Fortinet black logo

Integration API Guide

Events and Report Integration

Events and Report Integration

This REST API based caller makes an HTTP(S) request with an input XML that defines the query. Since a query can take some time and the number of returned results can be large, the query works as follows:

  1. Caller submits the query and gets a Query Id back from FortiSIEM. This is done via Request API.
  2. Caller polls for query progress and waits until the query is completed. This is done via Polling API.
  3. When the query is completed, Caller gets the results via Results API.
    1. Caller gets the total number of query results and the query result fields.
    2. Caller gets the results - one chunk at a time.

This API provides a way to programmatically run any query on the event data. Following are the specifications for:

Request API Specifications

Release Added

5.1

Input URL https://<FortiSIEM_Supervisor_IP>/phoenix/rest/query/eventQuery
Input Parameters XML file containing the query parameters.
Input Credentials
  • Enterprise deployments: User name and password of any FortiSIEM account. Use "super" as the organization for Enterprise deployments.
    Curl example: curl -k -u super/admin:Admin*123
  • Service Provider deployments: User name and password of Super account for getting incidents for all organizations. If incidents for a specific organization are needed, then an organization-specific account and an organization name is needed.
    Curl example with super organization: curl -k -u super/admin:Admin*123
    Note: If querying for a specific organization, replace "super" with the organization name.
Output queryId or an error code if there is a problem in handling the query or the query format.

Polling API Specifications

The request will poll until the server completes the query.

Release Updated

6.7.0

Input URL

https://<FortiSIEM_Supervisor_IP>/phoenix/rest/query/progress/<requestId>, <expireTime>

Output progress (pct)
Until progress reaches 100 (completed), caller needs to continue polling FortiSIEM. This is because the server may need to aggregate the results or insert meta-information before sending the results.

Results API Specifications

Release Added

5.1

Input URL

https://<FortiSIEM_Supervisor_IP>/phoenix/rest/query/events/<requestId>,<expireTime>/<begin>/<end>

Output totalCount (first time) and an XML containing the incident attributes.
For the first call, begin = 0 and end can be 1000. You must continuously query the server by using the same URL, but increasing the begin and end until the totalCount is reached.

Refer to Example Usage for a sample query.

Events and Report Integration

Events and Report Integration

This REST API based caller makes an HTTP(S) request with an input XML that defines the query. Since a query can take some time and the number of returned results can be large, the query works as follows:

  1. Caller submits the query and gets a Query Id back from FortiSIEM. This is done via Request API.
  2. Caller polls for query progress and waits until the query is completed. This is done via Polling API.
  3. When the query is completed, Caller gets the results via Results API.
    1. Caller gets the total number of query results and the query result fields.
    2. Caller gets the results - one chunk at a time.

This API provides a way to programmatically run any query on the event data. Following are the specifications for:

Request API Specifications

Release Added

5.1

Input URL https://<FortiSIEM_Supervisor_IP>/phoenix/rest/query/eventQuery
Input Parameters XML file containing the query parameters.
Input Credentials
  • Enterprise deployments: User name and password of any FortiSIEM account. Use "super" as the organization for Enterprise deployments.
    Curl example: curl -k -u super/admin:Admin*123
  • Service Provider deployments: User name and password of Super account for getting incidents for all organizations. If incidents for a specific organization are needed, then an organization-specific account and an organization name is needed.
    Curl example with super organization: curl -k -u super/admin:Admin*123
    Note: If querying for a specific organization, replace "super" with the organization name.
Output queryId or an error code if there is a problem in handling the query or the query format.

Polling API Specifications

The request will poll until the server completes the query.

Release Updated

6.7.0

Input URL

https://<FortiSIEM_Supervisor_IP>/phoenix/rest/query/progress/<requestId>, <expireTime>

Output progress (pct)
Until progress reaches 100 (completed), caller needs to continue polling FortiSIEM. This is because the server may need to aggregate the results or insert meta-information before sending the results.

Results API Specifications

Release Added

5.1

Input URL

https://<FortiSIEM_Supervisor_IP>/phoenix/rest/query/events/<requestId>,<expireTime>/<begin>/<end>

Output totalCount (first time) and an XML containing the incident attributes.
For the first call, begin = 0 and end can be 1000. You must continuously query the server by using the same URL, but increasing the begin and end until the totalCount is reached.

Refer to Example Usage for a sample query.