Fortinet FortiAnalyzer v3.2.0

About the connector

FortiAnalyzer is the NOC-SOC security analysis tool built with an operations perspective. FortiAnalyzer (FAZ) supports analytics-powered use cases to provide better detection against breaches.

This document provides information about the Fortinet FortiAnalyzer Connector, which facilitates automated interactions with your Fortinet FortiAnalyzer server using FortiSOAR™ playbooks. Add the Fortinet FortiAnalyzer Connector, as a step in FortiSOAR™ playbooks and perform automated operations such as creating and updating incidents on Fortinet FortiAnalyzer and retrieving user and endpoint information from Fortinet FortiAnalyzer.

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling events from Fortinet FortiAnalyzer. Currently, events in Fortinet FortiAnalyzer are mapped to alerts in FortiSOAR™. For more information, see the Data Ingestion Support section.

Version information

Connector Version: 3.2.0

FortiSOAR™ Version Tested on: 7.4.1-3167

FortiAnalyzer Version Tested on: v7.4.0 GA

Authored By: Fortinet

Certified: Yes

Release Notes for version 3.2.0

Following enhancements have been made to the Fortinet FortiAnalyzer Connector in version 3.2.0:

• Added following new actions and playbooks:
  • Add Incident Attachment
  • Start bulk device log Search Request
• Renamed following parameters and actions:
  • On the connector configurations page, ADOM Name parameter is now ADOM Name(s)
  • The action Get User Info is now Get User Information
  • The action Get Endpoint Info is now Get Endpoint Information
  • The action Add a Master Device is now Add a Primary Device
  • The action Add a Slave Device is now Add a Secondary Device
• Following actions can now fetch all records or specific records associated with specified IDs:
  • Get User Information
  • Get Endpoint Information
• Removed following parameters from actions Get Event for Multiple ADOMs and Get Event
  • Device ID
  • Device Name
• Updated Output Schema for following actions:
  • Get Incident Attachments
  • Get Event For Multiple ADOMs
  • Get Incident For Multiple ADOMs
  • Get ADOMs
  • Get Devices
  • Get Device Information
  • Get Report Schedule List
  • Get Executed Report List
  • Get Report File
  • Get Log-file State
  • List Log Fields
  • Get Log Status
  • Get Log File Content
  • Log Search Over Log-file
  • Get Incident Assets
  • Get Events For Incident
  • Add A New Device
  • Add A Primary Device
  • Authorize Device
  • Get Event
  • Get Incident
  • Create Incident
  • Update Incident
• Added mappings in Alerts module for fields Source IP, Destination IP, Rule, and Computer Name for data ingestion and correlated Alerts and Assets module.
• Added ingestion support for the field Device from FortiAnalyzer in the FortiSOAR™ Asset's module and correlated it to corresponding alerts and events.
• Fixed issue where connector showed a successful configuration even when the password for super user was incorrect.
• Incorporated fixes issued by Fortinet FortiAnalyzer in their API for following actions:
  • Get Endpoint Information
  • Get User Information
  These actions were failing for optional inputs.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-fortinet-fortianalyzer

Prerequisites to configuring the connector

• You must have the URL of the Fortinet FortiAnalyzer server to which you will connect and perform automated operations and credentials (username-password pair) to access that server.
• Multiple ADOMs are supported only with Fortinet FortiAnalyzer v7.0.2. Therefore, to use Multiple ADOMs, you must have access to Fortinet FortiAnalyzer v7.0.2 or later.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Fortinet FortiAnalyzer server.
• Users who are going to use this connector and run actions on Fortinet FortiAnalyzer must have Standard or Superuser profile with Read and Write access to JSON API.

  

  You can also create a new user in Fortinet Analyzer and you can use this newly-created user in the connector configuration.

  IMPORTANT: The Fortinet Analyzer API v7.0.0 onwards, requires the Superuser permission for Multiple ADOM Support. Therefore, from Fortinet Analyzer release 7.0.0 onwards, operations will fail when users with Standard profile try to run operations with multiple ADOM support.

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Fortinet FortiAnalyzer connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations:

operation: Create Incident

Input parameters

    {
        "epid":123
    }
                

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "incid": "",
        "revision": "",
        "attach_revision": ""
    }
}

operation: Get Incident

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result": {
        "status": {
            "code": "",
            "message": ""
        },
        "detail-level": "",
        "data": [
            {
                "attach_lastupdate": "",
                "attach_revision": "",
                "category": "",
                "createtime": "",
                "description": "",
                "endpoint": "",
                "epid": "",
                "euid": "",
                "incid": "",
                "lastupdate": "",
                "lastuser": "",
                "refinfo": "",
                "reporter": "",
                "revision": "",
                "severity": "",
                "status": "",
                "epcount": "",
                "eucount": "",
                "report_src": "",
                "assigned_to": "",
                "remedy_time": "",
                "report_srcid": "",
                "remedy_action": "",
                "report_detail": "",
                "remedy_approver": "",
                "remedy_executor": "",
                "incident_reporter": ""
            }
        ]
    },
    "jsonrpc": "",
    "id": ""
}

operation: Update Incident

Input parameters

    {
        "epid":123
    }
                

Output

The output contains the following populated JSON schema:

{
    "result": {
        "incid": "",
        "revision": "",
        "attach_revision": "",
        "status": {
            "code": "",
            "message": ""
        }
    },
    "jsonrpc": "",
    "id": ""
}

operation: Get Events For Incident

Input parameters

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "data": [
            {
                "attachid": "",
                "incid": "",
                "attachtype": "",
                "data": "",
                "tags": "",
                "attachsrc": "",
                "user_tags": "",
                "attachsrcid": "",
                "attachsrctrigger": "",
                "createtime": "",
                "lastupdate": "",
                "lastuser": "",
                "revision": ""
            }
        ],
        "status": {
            "code": "",
            "message": ""
        }
    }
}

operation: Get Incident Assets

Input parameters

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "data": [
            {
                "seqid": "",
                "incid": "",
                "srctype": "",
                "srcinfo": "",
                "ctime": "",
                "epid": "",
                "mac": "",
                "epip": "",
                "osname": "",
                "alerttime": "",
                "osversion": "",
                "euid": "",
                "epname": "",
                "euname": ""
            }
        ],
        "status": ""
    }
}

operation: Get Executed Report List

Input parameters

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "data": [
            {
                "name": "",
                "devtype": "",
                "timezone": "",
                "schedule_color": "",
                "title": "",
                "device": {
                    "data": "",
                    "count": ""
                },
                "tid": "",
                "date": "",
                "adminuser": "",
                "profileid": "",
                "start": "",
                "timestamp-start": "",
                "end": "",
                "timestamp-end": "",
                "timezone-desc": "",
                "period-start": "",
                "period-end": "",
                "state": "",
                "progress-percent": "",
                "format": []
            }
        ],
        "count": "",
        "revision": ""
    }
}

operation: Get Report Schedule List

Input parameters

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "status": {
            "code": "",
            "message": ""
        },
        "data": [
            {
                "admin-user": "",
                "auto-hcache": "",
                "date-format": "",
                "description": "",
                "dev-type": "",
                "device-list-type": "",
                "devices": [
                    {
                        "devices-name": "",
                        "interfaces": ""
                    }
                ],
                "display-device-by": "",
                "display-table-contents": "",
                "email-report-per-device": "",
                "filter": "",
                "filter-logic": "",
                "data-accuracy": "",
                "filter-type": "",
                "is-template": "",
                "include-coverpage": "",
                "include-other": "",
                "language": "",
                "ldap-query": "",
                "ldap-server": "",
                "ldap-user-case-change": "",
                "max-reports": "",
                "name": "",
                "tz": "",
                "obfuscate-user": "",
                "orientation": "",
                "output-format": "",
                "output-profile": "",
                "period-last-n": "",
                "period-opt": "",
                "print-report-filters": "",
                "report-layout": [
                    {
                        "layout-id": ""
                    }
                ],
                "report-per-device": "",
                "resolve-hostname": "",
                "soc-cust-filters": "",
                "schedule-color": "",
                "soc-def-filters": "",
                "cached-filtering": "",
                "schedule-frequency": "",
                "schedule-type": "",
                "soc-filtering": "",
                "address-filter": [
                    {
                        "id": "",
                        "grp-name": "",
                        "obj-name": "",
                        "address-type": "",
                        "include-option": ""
                    }
                ],
                "schedule-valid-end": [],
                "schedule-valid-start": [],
                "status": "",
                "time-period": "",
                "week-start": ""
            }
        ]
    }
}

operation: Run Report

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result": {
        "tid": ""
    },
    "jsonrpc": "",
    "id": ""
}

operation: Get Report File

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result": {
        "checksum": "",
        "data": "",
        "length": "",
        "name": "",
        "tid": "",
        "data-type": ""
    },
    "jsonrpc": "",
    "id": "",
    "@id": "",
    "file": {
        "id": "",
        "@id": "",
        "size": "",
        "uuid": "",
        "@type": "",
        "assignee": "",
        "filename": "",
        "metadata": [],
        "mimeType": "",
        "thumbnail": "",
        "uploadDate": ""
    },
    "name": "",
    "type": "",
    "uuid": "",
    "@type": "",
    "tasks": [],
    "alerts": [],
    "assets": [],
    "owners": [],
    "people": [],
    "@context": "",
    "assignee": "",
    "comments": [],
    "warrooms": [],
    "incidents": [],
    "createDate": "",
    "createUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "indicators": [],
    "modifyDate": "",
    "modifyUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "recordTags": [],
    "userOwners": [],
    "description": ""
}

operation: Get User Information

Input parameters

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "data": [
            {
                "euid": "",
                "euuuid": "",
                "euname": "",
                "title": "",
                "firstname": "",
                "lastname": "",
                "gender": "",
                "birthday": "",
                "socialid": {
                    "data": []
                },
                "authtype": "",
                "eugroup": "",
                "homeaddr": "",
                "employeeid": "",
                "firstseen": "",
                "lastseen": "",
                "workaddr": "",
                "workphone": "",
                "workemail": "",
                "phone": "",
                "email": ""
            }
        ],
        "status": {
            "code": "",
            "message": ""
        }
    }
}

operation: Get Endpoint Information

Input parameters

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "data": [
            {
                "lastseen": "",
                "epid": "",
                "epname": "",
                "epdevtype": "",
                "osname": "",
                "osversion": "",
                "fctuid": "",
                "adomoid": "",
                "detecttype": "",
                "detectkey": "",
                "devid": "",
                "vd": "",
                "macip": [
                    {
                        "mac": "",
                        "epip": "",
                        "lastseen": ""
                    }
                ]
            }
        ],
        "status": {
            "code": "",
            "message": ""
        }
    }
}

operation: List Log Fields

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "jsonrpc": "",
    "result": {
        "field": [
            {
                "defaultshow": "",
                "desc": "",
                "logfldgrp": "",
                "name": "",
                "type": ""
            }
        ],
        "private-field": [
            {
                "defaultshow": "",
                "desc": "",
                "logfldgrp": "",
                "name": "",
                "type": ""
            }
        ],
        "data": [
            {
                "field": [
                    {
                        "desc": "",
                        "name": "",
                        "type": "",
                        "logfldgrp": "",
                        "defaultshow": ""
                    }
                ],
                "index": "",
                "logtype": "",
                "private-field": [
                    {
                        "desc": "",
                        "name": "",
                        "type": "",
                        "logfldgrp": "",
                        "defaultshow": ""
                    }
                ]
            }
        ]
    }
}

operation: Get Log-File Content

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "jsonrpc": "",
    "result": {
        "checksum": "",
        "data": "",
        "data-type": "",
        "length": "",
        "log-count": "",
        "offset": "",
        "logfile-orig-size": ""
    },
    "@id": "",
    "file": {
        "id": "",
        "@id": "",
        "size": "",
        "uuid": "",
        "@type": "",
        "assignee": "",
        "filename": "",
        "metadata": [],
        "mimeType": "",
        "thumbnail": "",
        "uploadDate": ""
    },
    "name": "",
    "type": "",
    "uuid": "",
    "@type": "",
    "tasks": [],
    "alerts": [],
    "assets": [],
    "owners": [],
    "people": [],
    "@context": "",
    "assignee": "",
    "comments": [],
    "warrooms": [],
    "incidents": [],
    "createDate": "",
    "createUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "indicators": [],
    "modifyDate": "",
    "modifyUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "recordTags": [],
    "userOwners": [],
    "description": ""
}

operation: Log Search over Log-File

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "jsonrpc": "",
    "result": {
        "data": [
            {
                "logver": "",
                "idseq": "",
                "itime": "",
                "devid": "",
                "vd": "",
                "app": "",
                "date": "",
                "time": "",
                "logid": "",
                "type": "",
                "appid": "",
                "subtype": "",
                "transip": "",
                "countapp": "",
                "level": "",
                "eventtime": "",
                "tz": "",
                "srcip": "",
                "srcname": "",
                "msg": "",
                "url": "",
                "hostname": "",
                "direction": "",
                "eventtype": "",
                "scertcname": "",
                "scertissuer": "",
                "incidentserialno": "",
                "srcport": "",
                "srcintf": "",
                "srcintfrole": "",
                "dstip": "",
                "dstport": "",
                "dstintf": "",
                "dstintfrole": "",
                "srcuuid": "",
                "dstuuid": "",
                "sessionid": "",
                "srcfamily": "",
                "proto": "",
                "action": "",
                "policyid": "",
                "policytype": "",
                "poluuid": "",
                "service": "",
                "dstcountry": "",
                "srccountry": "",
                "trandisp": "",
                "duration": "",
                "sentbyte": "",
                "rcvdbyte": "",
                "sentpkt": "",
                "rcvdpkt": "",
                "appcat": "",
                "srchwvendor": "",
                "osname": "",
                "mastersrcmac": "",
                "srcmac": "",
                "applist": "",
                "apprisk": "",
                "srcserver": "",
                "transport": "",
                "utmaction": "",
                "offset_idx": "",
                "policyname": "",
                "dtime": "",
                "itime_t": "",
                "devname": "",
                "devtype": ""
            }
        ],
        "return-lines": "",
        "total-count": ""
    }
}

operation: Get Log-File State

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "jsonrpc": "",
    "result": {
        "device-file-list": [
            {
                "device-id": "",
                "device-name": "",
                "endtime": "",
                "starttime": "",
                "vdom-file-list": [
                    {
                        "endtime": "",
                        "logfile-list": {
                            "rlog": {
                                "files": [
                                    {
                                        "fsize": "",
                                        "endtime": "",
                                        "filename": "",
                                        "starttime": ""
                                    }
                                ],
                                "logtype": {
                                    "id": "",
                                    "key": "",
                                    "name": ""
                                }
                            },
                            "elog": {
                                "files": [
                                    {
                                        "endtime": "",
                                        "filename": "",
                                        "fsize": "",
                                        "starttime": ""
                                    }
                                ],
                                "logtype": {
                                    "id": "",
                                    "key": "",
                                    "name": ""
                                }
                            },
                            "tlog": {
                                "files": [
                                    {
                                        "fsize": "",
                                        "endtime": "",
                                        "filename": "",
                                        "starttime": ""
                                    }
                                ],
                                "logtype": {
                                    "id": "",
                                    "key": "",
                                    "name": ""
                                }
                            }
                        },
                        "starttime": "",
                        "vdom-name": ""
                    }
                ]
            }
        ]
    }
}

operation: Start Log Search Request

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "jsonrpc": "",
    "result": {
        "tid": ""
    }
}

operation: Start Bulk Device Log Search Request

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "jsonrpc": "",
    "result": {
        "tid": ""
    }
}

operation: Fetch Log Search Result by Task ID

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "jsonrpc": "",
    "result": {
        "data": [
            {
                "action": "",
                "app": "",
                "appcat": "",
                "date": "",
                "devid": "",
                "devname": "",
                "devtype": "",
                "dstcountry": "",
                "dstintf": "",
                "dstip": "",
                "dstport": "",
                "dtime": "",
                "duration": "",
                "itime": "",
                "itime_t": "",
                "level": "",
                "logid": "",
                "logver": "",
                "mastersrcmac": "",
                "osname": "",
                "policyid": "",
                "proto": "",
                "rcvdbyte": "",
                "rcvdpkt": "",
                "sentbyte": "",
                "sentpkt": "",
                "service": "",
                "sessionid": "",
                "srccountry": "",
                "srcintf": "",
                "srcip": "",
                "srcmac": "",
                "srcname": "",
                "srcport": "",
                "subtype": "",
                "time": "",
                "trandisp": "",
                "transip": "",
                "transport": "",
                "type": "",
                "vd": ""
            }
        ],
        "percentage": "",
        "return-lines": "",
        "status": {
            "code": "",
            "message": ""
        },
        "tid": ""
    }
}

operation: Get Event

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "jsonrpc": "",
    "result": {
        "data": [
            {
                "ack_flag": "",
                "addi_info": "",
                "alert_id": "",
                "count": "",
                "ctime": "",
                "dev_name": "",
                "devid": "",
                "ackflag": "",
                "alertid": "",
                "devname": "",
                "devtype": "",
                "logtype": "",
                "subject": "",
                "filterid": "",
                "groupby1": "",
                "groupby2": "",
                "logcount": "",
                "readflag": "",
                "epid": "",
                "csf": "",
                "tag": "",
                "epip": "",
                "vdom": "",
                "epname": "",
                "euid": "",
                "euname": "",
                "event_info": "",
                "event_name": "",
                "event_status": "",
                "event_type": "",
                "last_occurrence": "",
                "last_update": "",
                "read_flag": "",
                "severity": "",
                "alerttime": "",
                "eventtype": "",
                "extrainfo": "",
                "filterkey": "",
                "multiflag": "",
                "updatetime": "",
                "eventstatus": "",
                "filtercksum": "",
                "lastlogtime": "",
                "triggername": "",
                "firstlogtime": "",
                "handler_type": "",
                "alert_part_info": {
                    "ruleid": "",
                    "devtype": "",
                    "logtype": "",
                    "subtype": "",
                    "hdlrhash": "",
                    "rulename": "",
                    "selector": "",
                    "handlerid": "",
                    "handlername": ""
                },
                "automation_stitch": "",
                "trigger_name": "",
                "vd_name": ""
            }
        ]
    }
}

operation: Get Event Logs

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "jsonrpc": "",
    "result": {
        "data": [
            {
                "action": "",
                "alert_log_seqnum": "",
                "cat": "",
                "catdesc": "",
                "crlevel": "",
                "crscore": "",
                "devid": "",
                "devname": "",
                "direction": "",
                "dstintf": "",
                "dstip": "",
                "dstport": "",
                "dtime": "",
                "epid": "",
                "euid": "",
                "eventtype": "",
                "fctuid": "",
                "hostname": "",
                "id": "",
                "itime": "",
                "level": "",
                "logid": "",
                "logver": "",
                "method": "",
                "msg": "",
                "policyid": "",
                "profile": "",
                "proto": "",
                "rcvdbyte": "",
                "reqtype": "",
                "sentbyte": "",
                "service": "",
                "sessionid": "",
                "srcintf": "",
                "srcip": "",
                "srcport": "",
                "subtype": "",
                "type": "",
                "unauthuser": "",
                "url": "",
                "vd": ""
            }
        ]
    }
}

operation: Get Incident Assets

Input parameters

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "data": [
            {
                "seqid": "",
                "incid": "",
                "srctype": "",
                "srcinfo": "",
                "ctime": "",
                "epid": "",
                "mac": "",
                "epip": "",
                "osname": "",
                "alerttime": "",
                "osversion": "",
                "euid": "",
                "epname": "",
                "euname": ""
            }
        ],
        "status": ""
    }
}

operation: Add Incident Attachment

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result": {
        "attachids": []
    },
    "jsonrpc": "",
    "id": ""
}

operation: Get Incident Attachments

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "jsonrpc": "",
    "result": {
        "data": [
            {
                "attachid": "",
                "tags": "",
                "attachsrc": "",
                "user_tags": "",
                "attachsrcid": "",
                "attachsrctrigger": "",
                "attachtype": "",
                "createtime": "",
                "data": "",
                "incid": "",
                "lastupdate": "",
                "lastuser": "",
                "revision": ""
            }
        ],
        "status": {
            "code": "",
            "message": ""
        }
    }
}

operation: Update Incident Attachment

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result": {
        "status": {
            "code": "",
            "message": ""
        }
    },
    "jsonrpc": "",
    "id": ""
}

operation: Get ADOMs

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "result": [
        {
            "data": [
                {
                    "oid": "",
                    "name": "",
                    "desc": "",
                    "state": "",
                    "mode": "",
                    "os_ver": "",
                    "mr": "",
                    "flags": "",
                    "mig_os_ver": "",
                    "mig_mr": "",
                    "obj_customize": "",
                    "tab_status": "",
                    "logview_customize": "",
                    "restricted_prds": "",
                    "log_db_retention_hours": "",
                    "log_file_retention_hours": "",
                    "log_disk_quota": "",
                    "log_disk_quota_split_ratio": "",
                    "log_disk_quota_alert_thres": "",
                    "uuid": "",
                    "create_time": "",
                    "workspace_mode": "",
                    "tz": ""
                }
            ],
            "status": {
                "code": "",
                "message": ""
            },
            "url": ""
        }
    ]
}

operation: Add a Primary Device

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "result": [
        {
            "data": {
                "device": {
                    "beta": "",
                    "conn_mode": "",
                    "dev_status": "",
                    "flags": "",
                    "ip": "",
                    "maxvdom": "",
                    "mgmt_id": "",
                    "mgmt_mode": "",
                    "mr": "",
                    "name": "",
                    "oid": "",
                    "os_type": "",
                    "version": "",
                    "mgmt_uuid": "",
                    "vm_lic_overdue_since": "",
                    "os_ver": "",
                    "patch": "",
                    "platform_id": "",
                    "platform_str": "",
                    "sn": "",
                    "source": "",
                    "tab_status": "",
                    "vm.lic_type": "",
                    "vm_lic_expire": ""
                }
            },
            "status": {
                "code": "",
                "message": ""
            },
            "url": ""
        }
    ]
}

operation: Add a Secondary Device

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "result": [
        {
            "status": {
                "code": "",
                "message": ""
            },
            "url": ""
        }
    ]
}

operation: Add a New Device

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "result": [
        {
            "data": {
                "device": {
                    "beta": "",
                    "conn_mode": "",
                    "dev_status": "",
                    "flags": "",
                    "ip": "",
                    "maxvdom": "",
                    "mgmt_id": "",
                    "mgmt_mode": "",
                    "mgmt_uuid": "",
                    "vm_lic_overdue_since": "",
                    "mr": "",
                    "name": "",
                    "oid": "",
                    "os_type": "",
                    "os_ver": "",
                    "patch": "",
                    "platform_id": "",
                    "platform_str": "",
                    "sn": "",
                    "source": "",
                    "tab_status": "",
                    "tunnel_ip": "",
                    "version": "",
                    "vm.lic_type": "",
                    "vm_lic_expire": ""
                }
            },
            "status": {
                "code": "",
                "message": ""
            },
            "url": ""
        }
    ]
}

operation: Get Devices

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "result": [
        {
            "data": [
                {
                    "adm_pass": [
                        "",
                        ""
                    ],
                    "adm_usr": "",
                    "app_ver": "",
                    "av_ver": "",
                    "beta": "",
                    "branch_pt": "",
                    "build": "",
                    "checksum": "",
                    "conf_status": "",
                    "conn_mode": "",
                    "conn_status": "",
                    "db_status": "",
                    "desc": "",
                    "dev_status": "",
                    "fap_cnt": "",
                    "faz.full_act": "",
                    "faz.perm": "",
                    "faz.quota": "",
                    "faz.used": "",
                    "fex_cnt": "",
                    "first_tunnel_up": "",
                    "flags": "",
                    "foslic_cpu": "",
                    "foslic_dr_site": "",
                    "foslic_inst_time": "",
                    "foslic_last_sync": "",
                    "foslic_ram": "",
                    "foslic_type": "",
                    "foslic_utm": "",
                    "fsw_cnt": "",
                    "ha_group_id": "",
                    "ha_group_name": "",
                    "ha_mode": "",
                    "ha_slave": "",
                    "hdisk_size": "",
                    "hostname": "",
                    "hw_rev_major": "",
                    "hw_rev_minor": "",
                    "hyperscale": "",
                    "ip": "",
                    "ips_ext": "",
                    "ips_ver": "",
                    "last_checked": "",
                    "last_resync": "",
                    "latitude": "",
                    "lic_flags": "",
                    "lic_region": "",
                    "location_from": "",
                    "logdisk_size": "",
                    "longitude": "",
                    "maxvdom": "",
                    "mgmt.__data[0]": "",
                    "mgmt.__data[1]": "",
                    "mgmt.__data[2]": "",
                    "mgmt.__data[3]": "",
                    "mgmt.__data[4]": "",
                    "mgmt.__data[5]": "",
                    "mgmt.__data[6]": "",
                    "mgmt.__data[7]": "",
                    "mgmt_id": "",
                    "mgmt_if": "",
                    "mgmt_mode": "",
                    "mgt_vdom": "",
                    "mgmt_uuid": "",
                    "auto_mgmt": "",
                    "module_sn": "",
                    "mr": "",
                    "name": "",
                    "node_flags": "",
                    "nsxt_service_name": "",
                    "oid": "",
                    "onboard_rule": "",
                    "eip": "",
                    "opts": "",
                    "os_type": "",
                    "os_ver": "",
                    "patch": "",
                    "platform_str": "",
                    "prefer_img_ver": "",
                    "prio": "",
                    "private_key": "",
                    "private_key_status": "",
                    "psk": "",
                    "role": "",
                    "sn": "",
                    "source": "",
                    "tab_status": "",
                    "tunnel_cookie": "",
                    "tunnel_ip": "",
                    "vdom": [
                        {
                            "comments": "",
                            "devid": "",
                            "ext_flags": "",
                            "flags": "",
                            "name": "",
                            "node_flags": "",
                            "oid": "",
                            "opmode": "",
                            "rtm_prof_id": "",
                            "status": "",
                            "tab_status": "",
                            "vpn_id": "",
                            "vdom_type": ""
                        }
                    ],
                    "version": "",
                    "vm_cpu": "",
                    "vm_cpu_limit": "",
                    "vm_lic_expire": "",
                    "vm_lic_overdue_since": "",
                    "vm_mem": "",
                    "vm_mem_limit": "",
                    "vm_status": ""
                }
            ],
            "status": {
                "code": "",
                "message": ""
            },
            "url": ""
        }
    ]
}

operation: Get Log Status

Input parameters

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "data": [
            {
                "vdoms": [
                    {
                        "vdom": "",
                        "last-log-time": "",
                        "last-log-timestamp": "",
                        "lograte": ""
                    }
                ],
                "devs": [
                    {
                        "devid": "",
                        "is-ha": "",
                        "vdoms": [
                            {
                                "vdom": "",
                                "lograte": "",
                                "log-db-size": "",
                                "logstat-info": "",
                                "adom-quota-MB": "",
                                "last-log-time": "",
                                "log-disk-size": "",
                                "last-log-timestamp": ""
                            }
                        ],
                        "status": "",
                        "devname": "",
                        "logging-mode": "",
                        "logstat-info": "",
                        "encrypted-logging": "",
                        "encrypted-forwarding": ""
                    }
                ],
                "log-interval-dev-no-logging-upload": "",
                "log-interval-dev-no-logging-realtime": "",
                "devid": ""
            }
        ]
    }
}

operation: Get Device Information

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "result": [
        {
            "data": {
                "adm_pass": [],
                "adm_usr": "",
                "app_ver": "",
                "av_ver": "",
                "beta": "",
                "branch_pt": "",
                "build": "",
                "checksum": "",
                "conf_status": "",
                "conn_mode": "",
                "conn_status": "",
                "db_status": "",
                "desc": "",
                "dev_status": "",
                "fap_cnt": "",
                "faz.full_act": "",
                "faz.perm": "",
                "faz.quota": "",
                "faz.used": "",
                "fex_cnt": "",
                "flags": "",
                "foslic_cpu": "",
                "foslic_dr_site": "",
                "foslic_inst_time": "",
                "foslic_last_sync": "",
                "foslic_ram": "",
                "foslic_type": "",
                "foslic_utm": "",
                "fsw_cnt": "",
                "ha_group_id": "",
                "ha_group_name": "",
                "ha_mode": "",
                "ha_slave": "",
                "hdisk_size": "",
                "hostname": "",
                "hw_rev_major": "",
                "hw_rev_minor": "",
                "hyperscale": "",
                "ip": "",
                "ips_ext": "",
                "ips_ver": "",
                "last_checked": "",
                "last_resync": "",
                "latitude": "",
                "lic_flags": "",
                "lic_region": "",
                "location_from": "",
                "logdisk_size": "",
                "onboard_rule": "",
                "longitude": "",
                "maxvdom": "",
                "mgmt.__data[0]": "",
                "mgmt.__data[1]": "",
                "mgmt.__data[2]": "",
                "mgmt.__data[3]": "",
                "mgmt.__data[4]": "",
                "mgmt.__data[5]": "",
                "mgmt.__data[6]": "",
                "mgmt.__data[7]": "",
                "mgmt_id": "",
                "mgmt_if": "",
                "mgmt_mode": "",
                "mgmt_uuid": "",
                "mgt_vdom": "",
                "auto_mgmt": "",
                "module_sn": "",
                "mr": "",
                "name": "",
                "node_flags": "",
                "nsxt_service_name": "",
                "oid": "",
                "opts": "",
                "os_type": "",
                "os_ver": "",
                "patch": "",
                "platform_str": "",
                "prefer_img_ver": "",
                "first_tunnel_up": "",
                "prio": "",
                "private_key": "",
                "private_key_status": "",
                "vm_lic_overdue_since": "",
                "psk": "",
                "role": "",
                "sn": "",
                "eip": "",
                "source": "",
                "tab_status": "",
                "tunnel_cookie": "",
                "tunnel_ip": "",
                "vdom": [
                    {
                        "comments": "",
                        "devid": "",
                        "ext_flags": "",
                        "vdom_type": "",
                        "flags": "",
                        "name": "",
                        "node_flags": "",
                        "oid": "",
                        "opmode": "",
                        "rtm_prof_id": "",
                        "status": "",
                        "tab_status": "",
                        "vpn_id": ""
                    }
                ],
                "version": "",
                "vm_cpu": "",
                "vm_cpu_limit": "",
                "vm_lic_expire": "",
                "vm_mem": "",
                "vm_mem_limit": "",
                "vm_status": ""
            },
            "status": {
                "code": "",
                "message": ""
            },
            "url": ""
        }
    ]
}

operation: Authorize Device

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "result": [
        {
            "data": {
                "device": {
                    "beta": "",
                    "conn_mode": "",
                    "dev_status": "",
                    "faz.perm": "",
                    "flags": "",
                    "maxvdom": "",
                    "mgmt_id": "",
                    "mgmt_mode": "",
                    "mgmt_uuid": "",
                    "vm_lic_overdue_since": "",
                    "mr": "",
                    "name": "",
                    "oid": "",
                    "os_type": "",
                    "os_ver": "",
                    "patch": "",
                    "platform_id": "",
                    "platform_str": "",
                    "sn": "",
                    "source": "",
                    "tab_status": "",
                    "tunnel_ip": "",
                    "version": "",
                    "vm.lic_type": "",
                    "vm_lic_expire": ""
                }
            },
            "status": {
                "code": "",
                "message": ""
            },
            "url": ""
        }
    ]
}

operation: Delete a Device

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "result": [
        {
            "status": {
                "code": "",
                "message": ""
            },
            "url": ""
        }
    ]
}

operation: Get Event for Multiple ADOMs

Input parameters

NOTE: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "data": [
            {
                "alerttime": "",
                "logcount": "",
                "alertid": "",
                "adom": "",
                "epid": "",
                "epname": "",
                "subject": "",
                "euid": "",
                "euname": "",
                "devname": "",
                "logtype": "",
                "devtype": "",
                "devid": "",
                "vdom": "",
                "groupby1": "",
                "triggername": "",
                "tag": "",
                "eventtype": "",
                "severity": "",
                "extrainfo": "",
                "ackflag": "",
                "readflag": "",
                "filterkey": "",
                "firstlogtime": "",
                "multiflag": "",
                "lastlogtime": "",
                "updatetime": "",
                "filtercksum": "",
                "filterid": "",
                "csf": "",
                "epip": "",
                "groupby2": "",
                "eventstatus": "",
                "handler_type": "",
                "alert_part_info": {
                    "ruleid": "",
                    "devtype": "",
                    "logtype": "",
                    "subtype": "",
                    "hdlrhash": "",
                    "rulename": "",
                    "selector": "",
                    "handlerid": "",
                    "handlername": ""
                },
                "automation_stitch": ""
            }
        ]
    }
}

operation: Count Events for Multiple ADOMs

Input parameters

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "data": [
            {
                "severity": "",
                "count": ""
            }
        ]
    }
}

operation: Get Incident for Multiple ADOMs

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "data": [
            {
                "incid": "",
                "epid": "",
                "endpoint": "",
                "euid": "",
                "category": "",
                "severity": "",
                "status": "",
                "description": "",
                "reporter": "",
                "createtime": "",
                "lastupdate": "",
                "lastuser": "",
                "revision": "",
                "attach_lastupdate": "",
                "attach_revision": "",
                "refinfo": "",
                "report_src": "",
                "report_srcid": "",
                "report_detail": "",
                "assigned_to": "",
                "remedy_action": "",
                "remedy_executor": "",
                "remedy_approver": "",
                "remedy_time": "",
                "adom": "",
                "epcount": "",
                "eucount": "",
                "incident_reporter": ""
            }
        ],
        "detail-level": "",
        "status": {
            "code": "",
            "message": ""
        }
    }
}

operation: Count Incidents for Multiple ADOMs

Input parameters

Note: All the input parameters are optional. However, if you do not specify any parameter, then no filter criterion is applied, and an unfiltered list is returned.

Output

The output contains the following populated JSON schema:

{
    "jsonrpc": "",
    "id": "",
    "result": {
        "data": [
            {
                "count": ""
            }
        ],
        "detail-level": "",
        "status": {
            "code": "",
            "message": ""
        }
    }
}

Included playbooks

The Sample - Fortinet FortiAnalyzer - 3.2.0 playbook collection comes bundled with the Fortinet FortiAnalyzer connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fortinet FortiAnalyzer connector.

• > FortiAnalyzer > Fetch
• >> FortiAnalyzer > Related Assets for Event > Create
• Add Incident Attachment
• Add a Primary Device
• Add a New Device
• Add a Secondary Device
• Authorize Device
• Count Events for Multiple ADOMs
• Count Incidents for Multiple ADOMs
• Create Incident
• Delete a Device
• Fetch Log Search Result by Task ID
• FortiAnalyzer > Ingest
• Get ADOMs
• Get Device Information
• Get Devices
• Get Endpoint Information
• Get Event
• Get Event Logs
• Get Event for Multiple ADOMs
• Get Events For Incident
• Get Executed Report List
• Get Incident
• Get Incident Assets
• Get Incident Attachments
• Get Incident for Multiple ADOMs
• Get Log Status
• Get Log-File Content
• Get Log-File State
• Get Report File
• Get Report Schedule List
• Get User Information
• List Log Fields
• Log Search over Log-File
• Run Report
• Start Log Search Request
• Update Incident
• Update Incident Attachment

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Data Ingestion Support

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling events and their related logs from Fortinet FortiAnalyzer. Currently, events and their related logs ingested from Fortinet FortiAnalyzer is mapped to Alerts in FortiSOAR™. For more information on the Data Ingestion Wizard, see the Connectors Guide in the FortiSOAR™ product documentation.

Configure Data Ingestion

You can configure data ingestion using the Data Ingestion Wizard to seamlessly map the incoming Fortinet FortiAnalyzer events and their related logs to FortiSOAR™'s Alerts.

The Data Ingestion Wizard helps you to configure the scheduled pulling of data from Fortinet FortiAnalyzer into FortiSOAR™. It also lets you pull some sample data from Fortinet FortiAnalyzer using which you can define the mapping of data between Fortinet FortiAnalyzer and FortiSOAR™. The mapping of common fields is generally already done by the Data Ingestion Wizard; users are mostly required to only map any custom fields that are added to the Fortinet FortiAnalyzer events and their related logs.

1. To begin configuring data ingestion, click Configure Data Ingestion on the Fortinet FortiAnalyzer connector's Configurations page.

   Click Let's Start by fetching some data, to open the Fetch Sample Data screen.

   

   Sample data is required to create a field mapping between Fortinet FortiAnalyzer data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.

2. On the Fetch Data screen, provide the configurations required to fetch events and their related logs from Fortinet FortiAnalyzer.

   Users can pull events and their related logs from Fortinet FortiAnalyzer by specifying a query to pull events from Fortinet FortiAnalyzer using supported keys such as alertid, devid, and severity

   You can also specify additional parameters such as Maximum Records To Be Fetched, Maximum Logs To Be Fetched For Each Event, and Pull Sample Events in the Last X Minutes based on which to pull events from Fortinet FortiAnalyzer.

   The Configure Multi-Tenant Mapping checkbox is added to help map the ADOM specified in FortiAnalyzer with a tenant in FortiSOAR™.

   The fetched data is used to create a mapping between the events and their related logs from Fortinet FortiAnalyzer and FortiSOAR Alerts. Once you have completed specifying the configurations, click Fetch Data.

   

3. On the Field Mapping screen, map the fields of the ingested event in Fortinet FortiAnalyzer to the fields of an Alerts present in FortiSOAR™.

   To map a field, click the key in the sample data to add the Jinja value of the field. For example, to map the eventtype parameter of an ingested events and their related logs from Fortinet FortiAnalyzer to the type parameter of a FortiSOAR™ Alert, click the Type field and then click the eventtype field to populate its keys:

   

   For more information on field mapping, see the Data Ingestion chapter in the Connectors Guide in the FortiSOAR™ product documentation. Once you have completed the mapping of fields, click Save Mapping & Continue.

4. (Optional) Use the Scheduling screen to configure schedule-based ingestion, i.e., specify the polling frequency to Fortinet FortiAnalyzer, so that the content gets pulled from the Fortinet FortiAnalyzer integration into FortiSOAR™

   On the Scheduling screen, from the Do you want to schedule the ingestion? drop-down list, select Yes.

   In the Configure Schedule Settings section, specify the Cron expression for the schedule. For example, to pull data from Fortinet FortiAnalyzer every 5 minutes, click Every X Minute, and in the minute box enter */5. This means that the events and their related logs will be pulled from Fortinet FortiAnalyzer every 5 minutes:

   

   Once you have completed scheduling, click Save Settings & Continue.

5. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.

   Limitations of the Fortinet FortiAnalyzer connector

   1. • The Sort function does not work for the connector actions when you set the Detail Level for the results as 'Extended'. The Sort function works fine when you set the Detail Level for the results as 'Basic' or 'Standard'.
      • The Get Report Schedule List and Run Report actions do not work for FortiAnalyzer's standard user for all ADOMs.
      • There are some limitations from the Fortinet FortiAnalyzer API itself, due to which you might face the following issues while using the Fortinet FortiAnalyzer connector:
        • The log file downloaded using the Get Log-File Content action is in the 'base64' format, which is not in a readable format. The log file gets added to the Attachments in FortiSOAR™. The file content is not in a readable format, even if you try using the 'text/gzip/base64' data type.
        • The Get Event Logs action does not return records as per the specified limit. The playbook returns '25' records as output even if you have specified any other number such as, '5' records. This issue also affects the data ingestion process of pulling logs for events based on the 'Limit' parameter.
        • The List Log Fields action does not work for the FortiDDos and FortiDeceptor device types and for some subtypes such as 'default'.