Fortinet FortiAnalyzer v1.4.0

About the connector

FortiAnalyzer is the NOC-SOC security analysis tool built with an operations perspective. FortiAnalyzer (FAZ) supports analytics-powered use cases to provide better detection against breaches.

This document provides information about the Fortinet FortiAnalyzer Connector, which facilitates automated interactions with your Fortinet FortiAnalyzer server using FortiSOAR™ playbooks. Add the Fortinet FortiAnalyzer Connector, as a step in FortiSOAR™ playbooks and perform automated operations such as creating and updating incidents on Fortinet FortiAnalyzer and retrieving user and endpoint information from Fortinet FortiAnalyzer.

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling incidents from Fortinet FortiAnalyzer. Currently, "events" in Fortinet FortiAnalyzer are mapped to "alerts" in FortiSOAR™. For more information, see the Data Ingestion Support section

Version information

Connector Version: 1.4.0

FortiSOAR™ Version Tested on: 6.4.4-3164

FortiAnalyzer Version Tested on: VM64-KVMv6.4.4 Interim build 4751

Authored By: Fortinet

Certified: Yes

Release Notes for version 1.4.0

The following enhancements have been made to the Fortinet FortiAnalyzer connector in version 1.4.0:

• Added the following new operations and playbooks:
  • Get ADOMs
  • Add a Master Device
  • Add a Slave Device
  • Add a New Device
  • Get Devices
  • Get Log Status
  • Get Device Information
  • Authorize Device
  • Delete a Device
• Fixed an issue with the 'Get Event' action to correctly fetch event data when an alert ID or a list of alert IDs are provided. Earlier incorrect data was fetched by this action when alert ID(s) were specified.

Installing the connector

From FortiSOAR™ 5.0.0 onwards, use the Connector Store to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root user to install connectors from an SSH session:
yum install cyops-connector-fortinet-fortianalyzer

Prerequisites to configuring the connector

• You must have the URL of the Fortinet FortiAnalyzer server to which you will connect and perform automated operations and credentials (username-password pair) to access that server.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Fortinet FortiAnalyzer server.
• The minimum privileges that require to be assigned to users who are going to use this connector and run actions on Fortinet FortiAnalyzer are users with a "Standard" or "Superuser" profile that has "Read" and "Write" access to JSON API.
  
  You can also create a new user in Fortinet Analyzer and you can use this newly-created user in the connector configuration.

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Fortinet FortiAnalyzer connector row (if you are in the Grid view on the Connectors page), and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations from version 4.10.0 onwards:

operation: Create Incident

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": {
"incid": ""
},
"jsonrpc": "",
"id": ""
}

operation: Get Incident

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema:
{
"jsonrpc": "",
"result": {
"data": [
{
"severity": "",
"category": "",
"incid": "",
"euid": "",
"description": "",
"endpoint": "",
"refinfo": "",
"attach_revision": "",
"epid": "",
"createtime": "",
"status": "",
"attach_lastupdate": "",
"lastuser": "",
"revision": "",
"reporter": "",
"lastupdate": ""
}
],
"status": {
"code": "",
"message": ""
},
"detail-level": ""
},
"id": ""
}

operation: Update Incident

Input parameters

Output

The output contains the following populated JSON schema:
{
"jsonrpc": "",
"result": {
"status": {
"code": "",
"message": ""
}
},
"id": ""
}

operation: Get Events For Incident

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": {
"data": [
{
"createtime": "",
"data": "",
"incid": "",
"lastuser": "",
"attachid": "",
"lastupdate": "",
"revision": "",
"attachtype": ""
}
],
"status": {
"code": "",
"message": ""
}
},
"jsonrpc": "",
"id": ""
}

operation: Get Executed Report List

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": {
"count": "",
"revision": "",
"data": [
{
"devtype": "",
"state": "",
"profileid": "",
"date": "",
"title": "",
"timestamp-end": "",
"adminuser": "",
"schedule_color": "",
"format": [],
"tid": "",
"progress-percent": "",
"name": "",
"period-end": "",
"end": "",
"timestamp-start": "",
"start": "",
"period-start": ""
}
]
},
"jsonrpc": "",
"id": ""
}

operation: Get Report Schedule List

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"result": {
"status": {
"code": "",
"message": ""
},
"data": [
{
"report-per-device": "",
"week-start": "",
"date-format": "",
"include-other": "",
"period-last-n": "",
"period-opt": "",
"display-device-by": "",
"schedule-valid-end": [],
"devices": [
{
"devices-name": ""
}
],
"schedule-color": "",
"filter": "",
"admin-user": "",
"filter-type": "",
"report-layout": [
{
"layout-id": ""
}
],
"email-report-per-device": "",
"language": "",
"ldap-user-case-change": "",
"orientation": "",
"name": "",
"time-period": "",
"print-report-filters": "",
"schedule-type": "",
"ldap-server": "",
"auto-hcache": "",
"display-table-contents": "",
"filter-logic": "",
"obfuscate-user": "",
"device-list-type": "",
"include-coverpage": "",
"output-format": "",
"schedule-valid-start": [],
"resolve-hostname": "",
"ldap-query": "",
"schedule-frequency": "",
"output-profile": "",
"dev-type": "",
"max-reports": "",
"status": ""
}
]
},
"jsonrpc": "",
"id": ""
}

operation: Run Report

Input parameters

Output

The output contains the following populated JSON schema:
{
"jsonrpc": "",
"result": {
"tid": ""
},
"id": ""
}

operation: Get Report File

Input parameters

Output

The output contains the following populated JSON schema:
{
"jsonrpc": "",
"result": {
"tid": "",
"length": "",
"name": "",
"data-type": "",
"checksum": "",
"data": ""
},
"id": ""
}

operation: Get User Info

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema:
{
"result": {
"data": [
{
"workphone": "",
"socialid": {
"data": []
},
"gender": "",
"authtype": "",
"euname": "",
"euuuid": "",
"euid": "",
"title": "",
"eugroup": "",
"employeeid": "",
"email": "",
"lastseen": "",
"workemail": "",
"firstseen": "",
"phone": "",
"firstname": "",
"birthday": "",
"homeaddr": "",
"lastname": "",
"workaddr": ""
}
],
"status": {
"code": "",
"message": ""
}
},
"jsonrpc": "",
"id": ""
}

operation: Get Endpoint Info

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema:
{
"result": {
"data": [
{
"epname": "",
"fctuid": "",
"detecttype": "",
"osname": "",
"detectkey": "",
"macip": [
{
"lastseen": "",
"epip": "",
"mac": ""
}
],
"lastseen": "",
"adomoid": "",
"epid": "",
"epdevtype": "",
"osversion": "",
"vd": "",
"devid": ""
}
],
"status": {
"code": "",
"message": ""
}
},
"jsonrpc": "",
"id": ""
}

operation: List Log Fields

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"jsonrpc": "",
"result": {
"field": [
{
"defaultshow": "",
"desc": "",
"logfldgrp": "",
"name": "",
"type": ""
}
],
"private-field": [
{
"defaultshow": "",
"desc": "",
"logfldgrp": "",
"name": "",
"type": ""
}
]
}
}

operation: Get Log-File Content

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"jsonrpc": "",
"result": {
"checksum": "",
"data": "",
"data-type": "",
"length": "",
"log-count": "",
"offset": "",
"logfile-orig-size": ""
}
}

operation: Log Search over Log-File

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"jsonrpc": "",
"result": {
"data": [
{
"logver": "",
"idseq": "",
"itime": "",
"devid": "",
"vd": "",
"date": "",
"time": "",
"logid": "",
"type": "",
"subtype": "",
"level": "",
"eventtime": "",
"tz": "",
"srcip": "",
"srcname": "",
"srcport": "",
"srcintf": "",
"srcintfrole": "",
"dstip": "",
"dstport": "",
"dstintf": "",
"dstintfrole": "",
"srcuuid": "",
"dstuuid": "",
"sessionid": "",
"proto": "",
"action": "",
"policyid": "",
"policytype": "",
"poluuid": "",
"service": "",
"dstcountry": "",
"srccountry": "",
"trandisp": "",
"duration": "",
"sentbyte": "",
"rcvdbyte": "",
"sentpkt": "",
"rcvdpkt": "",
"appcat": "",
"srchwvendor": "",
"osname": "",
"mastersrcmac": "",
"srcmac": "",
"srcserver": "",
"dtime": "",
"itime_t": "",
"devname": ""
}
],
"return-lines": "",
"total-count": ""
}
}

operation: Get Log-File State

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema:
{
"id": "",
"jsonrpc": "",
"result": {
"device-file-list": [
{
"device-id": "",
"device-name": "",
"endtime": "",
"starttime": "",
"vdom-file-list": [
{
"endtime": "",
"logfile-list": {
"elog": {
"files": [
{
"endtime": "",
"filename": "",
"fsize": "",
"starttime": ""
}
],
"logtype": {
"id": "",
"key": "",
"name": ""
}
}
},
"starttime": "",
"vdom-name": ""
}
]
}
]
}
}

operation: Start Log Search Request

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"jsonrpc": "",
"result": {
"tid": ""
}
}

operation: Fetch Log Search Result by Task ID

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"jsonrpc": "",
"result": {
"data": [
{
"action": "",
"app": "",
"appcat": "",
"date": "",
"devid": "",
"devname": "",
"devtype": "",
"dstcountry": "",
"dstintf": "",
"dstip": "",
"dstport": "",
"dtime": "",
"duration": "",
"itime": "",
"itime_t": "",
"level": "",
"logid": "",
"logver": "",
"mastersrcmac": "",
"osname": "",
"policyid": "",
"proto": "",
"rcvdbyte": "",
"rcvdpkt": "",
"sentbyte": "",
"sentpkt": "",
"service": "",
"sessionid": "",
"srccountry": "",
"srcintf": "",
"srcip": "",
"srcmac": "",
"srcname": "",
"srcport": "",
"subtype": "",
"time": "",
"trandisp": "",
"transip": "",
"transport": "",
"type": "",
"vd": ""
}
],
"percentage": "",
"return-lines": "",
"status": {
"code": "",
"message": ""
},
"tid": ""
}
}

operation: Get Event

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema:
{
"id": "",
"jsonrpc": "",
"result": {
"data": [
{
"ack_flag": "",
"addi_info": "",
"alert_id": "",
"count": "",
"ctime": "",
"dev_name": "",
"devid": "",
"epid": "",
"epname": "",
"euid": "",
"euname": "",
"event_info": "",
"event_name": "",
"event_status": "",
"event_type": "",
"last_occurrence": "",
"last_update": "",
"read_flag": "",
"severity": "",
"trigger_name": "",
"vd_name": ""
}
]
}
}

operation: Get Event Log

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"jsonrpc": "",
"result": {
"data": [
{
"action": "",
"alert_log_seqnum": "",
"cat": "",
"catdesc": "",
"crlevel": "",
"crscore": "",
"devid": "",
"devname": "",
"direction": "",
"dstintf": "",
"dstip": "",
"dstport": "",
"dtime": "",
"epid": "",
"euid": "",
"eventtype": "",
"fctuid": "",
"hostname": "",
"id": "",
"itime": "",
"level": "",
"logid": "",
"logver": "",
"method": "",
"msg": "",
"policyid": "",
"profile": "",
"proto": "",
"rcvdbyte": "",
"reqtype": "",
"sentbyte": "",
"service": "",
"sessionid": "",
"srcintf": "",
"srcip": "",
"srcport": "",
"subtype": "",
"type": "",
"unauthuser": "",
"url": "",
"vd": ""
}
]
}
}

operation: Get Incident Assets

Input parameters

Output

The output contains the following populated JSON schema:
{
"jsonrpc": "",
"id": "",
"result": {
"data": [
{
"seqid": "",
"incid": "",
"srctype": "",
"srcinfo": "",
"ctime": "",
"epid": "",
"euid": "",
"epname": "",
"euname": ""
}
],
"status": ""
}
}

operation: Get Incident Attachments

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"jsonrpc": "",
"result": {
"data": [
{
"attachid": "",
"attachtype": "",
"createtime": "",
"data": "",
"incid": "",
"lastupdate": "",
"lastuser": "",
"revision": ""
}
],
"status": {
"code": "",
"message": ""
}
}
}

operation: Update Incident Attachment

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": {
"status": {
"code": "",
"message": ""
}
},
"jsonrpc": "",
"id": ""
}

operation: Get ADOMs

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"id": "",
"result": [
{
"data": [
{
"oid": "",
"name": "",
"desc": "",
"state": "",
"mode": "",
"os_ver": "",
"mr": "",
"flags": "",
"mig_os_ver": "",
"mig_mr": "",
"obj_customize": "",
"tab_status": "",
"logview_customize": "",
"restricted_prds": "",
"log_db_retention_hours": "",
"log_file_retention_hours": "",
"log_disk_quota": "",
"log_disk_quota_split_ratio": "",
"log_disk_quota_alert_thres": "",
"uuid": "",
"create_time": "",
"workspace_mode": ""
}
],
"status": {
"code": "",
"message": ""
},
"url": ""
}
]
}

operation: Add a Master Device

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"result": [
{
"data": {
"device": {
"beta": "",
"conn_mode": "",
"dev_status": "",
"flags": "",
"ip": "",
"maxvdom": "",
"mgmt_id": "",
"mgmt_mode": "",
"mr": "",
"name": "",
"oid": "",
"os_type": "",
"os_ver": "",
"patch": "",
"platform_id": "",
"platform_str": "",
"sn": "",
"source": "",
"tab_status": "",
"vm.lic_type": "",
"vm_lic_expire": ""
}
},
"status": {
"code": "",
"message": ""
},
"url": ""
}
]
}

operation: Add a Slave Device

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"result": [
{
"status": {
"code": "",
"message": ""
},
"url": ""
}
]
}

operation: Add a New Device

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"result": [
{
"data": {
"device": {
"beta": "",
"conn_mode": "",
"dev_status": "",
"flags": "",
"ip": "",
"maxvdom": "",
"mgmt_id": "",
"mgmt_mode": "",
"mr": "",
"name": "",
"oid": "",
"os_type": "",
"os_ver": "",
"patch": "",
"platform_id": "",
"platform_str": "",
"sn": "",
"source": "",
"tab_status": "",
"tunnel_ip": "",
"version": "",
"vm.lic_type": "",
"vm_lic_expire": ""
}
},
"status": {
"code": "",
"message": ""
},
"url": ""
}
]
}

operation: Get Devices

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"id": "",
"result": [
{
"data": [
{
"adm_pass": [
"",
""
],
"adm_usr": "",
"app_ver": "",
"av_ver": "",
"beta": "",
"branch_pt": "",
"build": "",
"checksum": "",
"conf_status": "",
"conn_mode": "",
"conn_status": "",
"db_status": "",
"desc": "",
"dev_status": "",
"fap_cnt": "",
"faz.full_act": "",
"faz.perm": "",
"faz.quota": "",
"faz.used": "",
"fex_cnt": "",
"flags": "",
"foslic_cpu": "",
"foslic_dr_site": "",
"foslic_inst_time": "",
"foslic_last_sync": "",
"foslic_ram": "",
"foslic_type": "",
"foslic_utm": "",
"fsw_cnt": "",
"ha_group_id": "",
"ha_group_name": "",
"ha_mode": "",
"ha_slave": "",
"hdisk_size": "",
"hostname": "",
"hw_rev_major": "",
"hw_rev_minor": "",
"hyperscale": "",
"ip": "",
"ips_ext": "",
"ips_ver": "",
"last_checked": "",
"last_resync": "",
"latitude": "",
"lic_flags": "",
"lic_region": "",
"location_from": "",
"logdisk_size": "",
"longitude": "",
"maxvdom": "",
"mgmt.__data[0]": "",
"mgmt.__data[1]": "",
"mgmt.__data[2]": "",
"mgmt.__data[3]": "",
"mgmt.__data[4]": "",
"mgmt.__data[5]": "",
"mgmt.__data[6]": "",
"mgmt.__data[7]": "",
"mgmt_id": "",
"mgmt_if": "",
"mgmt_mode": "",
"mgt_vdom": "",
"module_sn": "",
"mr": "",
"name": "",
"node_flags": "",
"nsxt_service_name": "",
"oid": "",
"opts": "",
"os_type": "",
"os_ver": "",
"patch": "",
"platform_str": "",
"prefer_img_ver": "",
"prio": "",
"private_key": "",
"private_key_status": "",
"psk": "",
"role": "",
"sn": "",
"source": "",
"tab_status": "",
"tunnel_cookie": "",
"tunnel_ip": "",
"vdom": [
{
"comments": "",
"devid": "",
"ext_flags": "",
"flags": "",
"name": "",
"node_flags": "",
"oid": "",
"opmode": "",
"rtm_prof_id": "",
"status": "",
"tab_status": "",
"vpn_id": ""
}
],
"version": "",
"vm_cpu": "",
"vm_cpu_limit": "",
"vm_lic_expire": "",
"vm_mem": "",
"vm_mem_limit": "",
"vm_status": ""
}
],
"status": {
"code": "",
"message": ""
},
"url": ""
}
]
}

operation: Get Log Status

Input parameters

Output

The output contains the following populated JSON schema:
{
"jsonrpc": "",
"id": "",
"result": {
"data": [
{
"vdoms": [
{
"vdom": "",
"last-log-time": "",
"last-log-timestamp": "",
"lograte": ""
}
],
"devid": ""
}
]
}
}

operation: Get Device Information

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"result": [
{
"data": {
"adm_pass": [],
"adm_usr": "",
"app_ver": "",
"av_ver": "",
"beta": "",
"branch_pt": "",
"build": "",
"checksum": "",
"conf_status": "",
"conn_mode": "",
"conn_status": "",
"db_status": "",
"desc": "",
"dev_status": "",
"fap_cnt": "",
"faz.full_act": "",
"faz.perm": "",
"faz.quota": "",
"faz.used": "",
"fex_cnt": "",
"flags": "",
"foslic_cpu": "",
"foslic_dr_site": "",
"foslic_inst_time": "",
"foslic_last_sync": "",
"foslic_ram": "",
"foslic_type": "",
"foslic_utm": "",
"fsw_cnt": "",
"ha_group_id": "",
"ha_group_name": "",
"ha_mode": "",
"ha_slave": "",
"hdisk_size": "",
"hostname": "",
"hw_rev_major": "",
"hw_rev_minor": "",
"hyperscale": "",
"ip": "",
"ips_ext": "",
"ips_ver": "",
"last_checked": "",
"last_resync": "",
"latitude": "",
"lic_flags": "",
"lic_region": "",
"location_from": "",
"logdisk_size": "",
"longitude": "",
"maxvdom": "",
"mgmt.__data[0]": "",
"mgmt.__data[1]": "",
"mgmt.__data[2]": "",
"mgmt.__data[3]": "",
"mgmt.__data[4]": "",
"mgmt.__data[5]": "",
"mgmt.__data[6]": "",
"mgmt.__data[7]": "",
"mgmt_id": "",
"mgmt_if": "",
"mgmt_mode": "",
"mgt_vdom": "",
"module_sn": "",
"mr": "",
"name": "",
"node_flags": "",
"nsxt_service_name": "",
"oid": "",
"opts": "",
"os_type": "",
"os_ver": "",
"patch": "",
"platform_str": "",
"prefer_img_ver": "",
"prio": "",
"private_key": "",
"private_key_status": "",
"psk": "",
"role": "",
"sn": "",
"source": "",
"tab_status": "",
"tunnel_cookie": "",
"tunnel_ip": "",
"vdom": [
{
"comments": "",
"devid": "",
"ext_flags": "",
"flags": "",
"name": "",
"node_flags": "",
"oid": "",
"opmode": "",
"rtm_prof_id": "",
"status": "",
"tab_status": "",
"vpn_id": ""
}
],
"version": "",
"vm_cpu": "",
"vm_cpu_limit": "",
"vm_lic_expire": "",
"vm_mem": "",
"vm_mem_limit": "",
"vm_status": ""
},
"status": {
"code": "",
"message": ""
},
"url": ""
}
]
}

operation: Authorize Device

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"result": [
{
"data": {
"device": {
"beta": "",
"conn_mode": "",
"dev_status": "",
"faz.perm": "",
"flags": "",
"maxvdom": "",
"mgmt_id": "",
"mgmt_mode": "",
"mr": "",
"name": "",
"oid": "",
"os_type": "",
"os_ver": "",
"patch": "",
"platform_id": "",
"platform_str": "",
"sn": "",
"source": "",
"tab_status": "",
"tunnel_ip": "",
"version": "",
"vm.lic_type": "",
"vm_lic_expire": ""
}
},
"status": {
"code": "",
"message": ""
},
"url": ""
}
]
}

operation: Delete a Device

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"result": [
{
"status": {
"code": "",
"message": ""
},
"url": ""
}
]
}

Included playbooks

The Sample - Fortinet FortiAnalyzer - 1.4.0 playbook collection comes bundled with the Fortinet FortiAnalyzer connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fortinet FortiAnalyzer connector.

• Add a Master Device
• Add a New Device
• Add a Slave Device
• Authorize Device
• Create Incident
• Delete a Device
• Fetch Log Search Result by Task ID
• > FortiAnalyzer > Fetch
• FortiAnalyzer > Ingest
• >> FortiAnalyzer > Init Macros
• FortiAnalyzer > Post Create Alert > Fetch Logs
• Get ADOMs
• Get Device Information
• Get Devices
• Get Endpoint Info
• Get Event
• Get Event Log
• Get Events For Incident
• Get Executed Report List
• Get Incident
• Get Incident Assets
• Get Incident Attachments
• Get Log-File Content
• Get Log-File State
• Get Report File
• Get Report Schedule List
• Get User Info
• List Log Fields
• Log Search over Log-File
• Run Report
• Start Log Search Request
• Update Incident
• Update Incident Attachment

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Data Ingestion Support

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling events and their related logs from FAZ. Currently, "events" in FAZ are mapped to "alerts" in FortiSOAR™. For more information on the Data Ingestion Wizard, see the "Connectors Guide" in the FortiSOAR™ product documentation.

Configure Data Ingestion

You can configure data ingestion using the “Data Ingestion Wizard” to seamlessly map the incoming FAZ "Events" to FortiSOAR™ "Alerts".

The Data Ingestion Wizard enables you to configure scheduled pulling of data from FAZ into FortiSOAR™. It also lets you pull some sample data from FAZ using which you can define the mapping of data between FAZ and FortiSOAR™. The mapping of common fields is generally already done by the Data Ingestion Wizard; users mostly require to only map any custom fields that are added to the FAZ event.

1. To begin configuring data ingestion, click Configure Data Ingestion on the FAZ connector’s "Configurations" page.
   Click Let’s Start by fetching some data, to open the “Fetch Sample Data” screen.
   
   Sample data is required to create a field mapping between FAZ data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.
2. On the Fetch Data screen, provide the configurations required to fetch FAZ data.
   Users can choose to pull data from FAZ specifying a query using which you want to pull events from FAZ. Supported keys are 'alertid', 'devid', 'severity', etc. You can also specify additional parameters such as the maximum number of events to be fetched, the maximum logs to be fetched for each event, and the last X minutes based on which you want to pull events from FAZ. The fetched data is used to create a mapping between the FAZ data and FortiSOAR™ alerts.
   
   Once you have completed specifying the configurations, click Fetch Data.

3. On the Field Mapping screen, map the fields of a FAZ event to the fields of an alert present in FortiSOAR™.
   To map a field, click the key in the sample data to add the “jinja” value of the field. For example, to map the eventtype parameter of a FAZ event to the type parameter of a FortiSOAR™ alert, click the Type field and then click the eventtype field to populate its keys:
   
   For more information on field mapping, see the Data Ingestion chapter in the "Connectors Guide" in the FortiSOAR™ product documentation. Once you have completed mapping fields, click Save Mapping & Continue.

4. Use the Scheduling screen to configure schedule-based ingestion, i.e., specify the polling frequency to FAZ, so that the content gets pulled from the FAZ integration into FortiSOAR™.
   On the Scheduling screen, from the Do you want to schedule the ingestion? drop-down list, select Yes.
   In the “Configure Schedule Settings” section, specify the Cron expression for the schedule. For example, if you want to pull data from FAZ every 5 minutes, click Every X Minute and in the minute box enter */5. This would mean that based on the configuration you have set up, data, i.e., events will be pulled from FAZ every 5 minutes.
   
   Once you have completed scheduling, click Save Settings & Continue.

5. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion, and exit the Data Ingestion Wizard.

Parallel Data Ingestion to Pull Incidents and Events

Data ingestion in the Fortinet FortiAnalyzer connector v1.1.0 pulls "Incidents" from FAZ and in v1.2.0 and later, it pulls "Events". If you want to pull both Incidents and Events, then you need to create two configurations as follows:

1. If you have v1.1.0 of the Fortinet FortiAnalyzer connector configured on a configuration named 'demo', and you have updated this connector to v1.2.0 or later, then the 'demo' configuration will continue to pull "Incidents" from FAZ:
   
   
   
2. If you want to also pull "Events" from FAZ, then you must configure data ingestion on a new configuration named for example, 'demo 2':
   
   
   
   
   Now you can use the 'demo 2' configuration to pull "Events" from FAZ.

Limitations of the Fortinet FortiAnalyzer connector

• The "Sort" function does not work for the connector actions when you set the "Detail Level" for the results as 'Extended'. The "Sort" function works fine when you set the "Detail Level" for the results as 'Basic' or 'Standard'.
• The "Get Report Schedule List" and "Run Report" actions do not work for FortiAnalyzer’s standard user for all ADOMs.
• There are some limitations from the Fortinet FortiAnalyzer API itself, due to which you might face the following issues while using the Fortinet FortiAnalyzer connector:
  • The log file downloaded using the "Get Log-File Content" action is in the 'base64' format, which is not in a readable format. The log file gets added to the "Attachments" in FortiSOAR™. The file content is not in a readable format, even if you try using the 'text/gzip/base64' data type.
  • The "Get Event Logs" action does not return records as per the specified limit. The playbook returns '25' records as output even if you have specified any other number such as, '5' records. This issue also affects the data ingestion process of pulling logs for events based on the 'Limit' parameter.
  • The "List Log Fields" action does not work for the FortiDDos and FortiDeceptor device types and for some subtypes such as 'default'.