Fortinet FortiSIEM v5.0.2

About the connector

FortiSIEM provides integrations that allow you to query and make changes to the CMDB, query events, and send incident notifications. Provide actions like get incidents, comment incident, cleared incident, get device details, get monitored organizations, report related actions and get all associated events for an incident from FortiSIEM.

This document provides information about the Fortinet FortiSIEM Connector, which facilitates automated interactions with your Fortinet FortiSIEM server using FortiSOAR™ playbooks. Add the Fortinet FortiSIEM Connector, as a step in FortiSOAR™ playbooks and perform automated operations such as retrieving device information for all devices configured on the Fortinet FortiSIEM server and retrieving a list of monitored organizations from the Fortinet FortiSIEM server.

You can use FortiSOAR™'s Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling incidents from Fortinet FortiSIEM.
For more information, see the Data Ingestion Support section.
NOTE: You must reconfigure data ingestion if you have upgraded your FortiSIEM connector to version5.0.0 (or later) from version 4.5.0. For more information, see the Reconfiguring FortiSIEM Data Ingestion section.

Version information

Connector Version: 5.0.2

FortiSOAR™ Version Tested on: 7.4.0-3204

Fortinet FortiSIEM Version Tested on: 6.7.0 1716

Authored By: Fortinet

Certified: Yes

Release Notes for version 5.0.2

Following changes have been made to the Fortinet FortiSIEM Connector in version 5.0.2:

• Fixed Run Advanced Search Query, Search Events and Get Event Details actions to support the progress response change that occurred with FortiSIEM v6.7.0 and later
• Only FortiSIEM releases 6.7.0 and later are supported by this connector
• The FortiSIEM API no longer supports filtering incidents based on severity and sub-category in the List Incidents action
• Reconfigure Data Ingestion after upgrading the connector

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-fortinet-fortisiem

Prerequisites to configuring the connector

• You must have the URL of Fortinet FortiSIEM server to connect and perform automated operations and credentials to access that server.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Fortinet FortiSIEM server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Fortinet FortiSIEM connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations:

operation: List Incidents

Input parameters

{
    "status": [
        0
    ],
    "eventType": [
        "PH_RULE_SERVER_CPU_WARN"
    ],
    "incidentRptIp": [
        "10.7.12.156"
    ]
}

Output

The output contains the following populated JSON schema:

    {
        "data": [
            {
                "count": "",
                "customer": "",
                "eventName": "",
                "eventType": "",
                "incidentId": "",
                "incidentSrc": "",
                "attackTactic": "",
                "incidentReso": "",
                "eventSeverity": "",
                "incidentRptIp": "",
                "incidentTitle": "",
                "incidentDetail": "",
                "incidentStatus": "",
                "incidentTarget": {
                    "hostName": "",
                    "hostIpAddr": ""
                },
                "attackTechnique": [
                    {
                        "name": "",
                        "techniqueid": ""
                    }
                ],
                "eventSeverityCat": "",
                "incidentLastSeen": "",
                "incidentFirstSeen": "",
                "incidentRptDevName": "",
                "phIncidentCategory": "",
                "incidentClearedTime": "",
                "incidentClearedReason": "",
                "phSubIncidentCategory": ""
            }
        ],
        "size": "",
        "start": "",
        "total": ""
    }
    

operation: Get Incident Details

Input parameters

Output

The output contains the following populated JSON schema:

    {
        "total": "",
        "size": "",
        "data": [
            {
                "incidentTitle": "",
                "eventSeverity": "",
                "incidentFirstSeen": "",
                "incidentReso": "",
                "incidentRptIp": "",
                "incidentLastSeen": "",
                "incidentSrc": "",
                "count": "",
                "attackTechnique": "",
                "eventType": "",
                "phIncidentCategory": "",
                "incidentClearedTime": "",
                "incidentTarget": "",
                "attackTactic": "",
                "phSubIncidentCategory": "",
                "eventSeverityCat": "",
                "incidentDetail": "",
                "incidentRptDevName": "",
                "eventName": "",
                "incidentId": "",
                "incidentStatus": "",
                "customer": ""
            }
        ],
        "start": ""
    }

operation: Update Incident

Input parameters

Output

The output contains the following populated JSON schema:

    {
        "message": "",
        "incident_id": ""
    }

operation: Comment Incident

Input parameters

Output

The output contains the following populated JSON schema:

    {
        "message": "",
        "incident_id": ""
    }

operation: Clear Incident With Reason

Input parameters

Output

The output contains the following populated JSON schema:

    {
        "message": "",
        "incident_id": []
    }

operation: Get Events For Incident

Input parameters

Output

The output contains the following populated JSON schema:

    {
        "id": "",
        "nid": "",
        "index": 0,
        "custId": 2000,
        "dataStr": {},
        "eventType": "",
        "attributes": {
            "Count": "",
            "Event ID": "",
            "Source IP": "",
            "Time skew": "",
            "Event Type": "",
            "Attack Name": "",
            "Device Time": "",
            "Relaying IP": "",
            "Collector ID": "",
            "Malware Name": "",
            "Reporting IP": "",
            "Raw Event Log": "",
            "Destination IP": "",
            "Event Severity": "",
            "Organization ID": "",
            "Reporting Model": "",
            "Reporting Device": "",
            "Reporting Vendor": "",
            "Source Host Name": "",
            "Virus/Malware ID": "",
            "Event Parser Name": "",
            "Organization Name": "",
            "Event Parse Status": "",
            "Event Receive Time": "",
            "Event Rule Trigger": "",
            "Source TCP/UDP Port": "",
            "Destination Host Name": "",
            "System Event Category": "",
            "Event Severity Category": "",
            "Destination TCP/UDP Port": "",
            "External Event Receive Protocol": ""
        },
        "rawMessage": "",
        "receiveTime": "",
        "eventAttributes": []
    }

operation: Search Events

Input parameters

Output

The output contains the following populated JSON schema:

    {
        "@start": "",
        "events": [
            {
                "id": "",
                "nid": "",
                "index": "",
                "custId": "",
                "dataStr": "",
                "eventType": "",
                "attributes": {
                    "type": "",
                    "uuid": "",
                    "vdom": "",
                    "count": "",
                    "fwRule": "",
                    "osType": "",
                    "eventId": "",
                    "ipProto": "",
                    "srcName": "",
                    "subtype": "",
                    "customer": "",
                    "destName": "",
                    "fwAction": "",
                    "logLevel": "",
                    "memberID": "",
                    "totFlows": "",
                    "trandisp": "",
                    "eventName": "",
                    "eventType": "",
                    "reptModel": "",
                    "sessionId": "",
                    "srcIpAddr": "",
                    "srcIpPort": "",
                    "totPkts64": "",
                    "destIpAddr": "",
                    "destIpPort": "",
                    "deviceTime": "",
                    "parserName": "",
                    "phRecvTime": "",
                    "recvPkts64": "",
                    "reptVendor": "",
                    "sentPkts64": "",
                    "srcMACAddr": "",
                    "totBytes64": "",
                    "collectorId": "",
                    "eventAction": "",
                    "rawEventMsg": "",
                    "recvBytes64": "",
                    "reptDevName": "",
                    "sentBytes64": "",
                    "serviceName": "",
                    "srcIntfName": "",
                    "timeSkewSec": "",
                    "appGroupName": "",
                    "destIntfName": "",
                    "durationMSec": "",
                    "eventParsedOk": "",
                    "eventSeverity": "",
                    "reptDevIpAddr": "",
                    "profileDetails": "",
                    "relayDevIpAddr": "",
                    "phEventCategory": "",
                    "eventRuleTrigger": "",
                    "eventSeverityCat": "",
                    "masterSrcMACAddr": "",
                    "postNATSrcIpAddr": "",
                    "postNATSrcIpPort": "",
                    "extEventRecvProto": ""
                },
                "receiveTime": ""
            }
        ],
        "@queryId": "",
        "@errorCode": "",
        "@totalCount": ""
    }

operation: Get Event Details

Input parameters

Output

The output contains the following populated JSON schema:

    {
        "id": "",
        "nid": "",
        "index": "",
        "custId": "",
        "dataStr": "",
        "eventType": "",
        "attributes": {
            "uuid": "",
            "vdom": "",
            "count": "",
            "fwRule": "",
            "eventId": "",
            "ipProto": "",
            "srcName": "",
            "subtype": "",
            "customer": "",
            "destName": "",
            "fwAction": "",
            "logLevel": "",
            "memberID": "",
            "totFlows": "",
            "trandisp": "",
            "eventName": "",
            "eventType": "",
            "reptModel": "",
            "sessionId": "",
            "srcIpAddr": "",
            "srcIpPort": "",
            "totPkts64": "",
            "destGeoOrg": "",
            "destIpAddr": "",
            "destIpPort": "",
            "deviceTime": "",
            "parserName": "",
            "phRecvTime": "",
            "recvPkts64": "",
            "reptVendor": "",
            "sentPkts64": "",
            "totBytes64": "",
            "collectorId": "",
            "destGeoCity": "",
            "eventAction": "",
            "rawEventMsg": "",
            "hostIpAddr": "",
            "hostName": "",
            "recvBytes64": "",
            "reptDevName": "",
            "sentBytes64": "",
            "serviceName": "",
            "srcIntfName": "",
            "timeSkewSec": "",
            "appGroupName": "",
            "destGeoState": "",
            "destIntfName": "",
            "durationMSec": "",
            "eventParsedOk": "",
            "eventSeverity": "",
            "reptDevIpAddr": "",
            "destGeoCountry": "",
            "profileDetails": "",
            "relayDevIpAddr": "",
            "destGeoLatitude": "",
            "phEventCategory": "",
            "destGeoLongitude": "",
            "eventRuleTrigger": "",
            "eventSeverityCat": "",
            "postNATSrcIpAddr": "",
            "postNATSrcIpPort": "",
            "extEventRecvProto": "",
            "destGeoCountryCodeStr": ""
        },
        "receiveTime": ""
    }

operation: Get All Devices

Input parameters

Output

The output contains the following populated JSON schema:

    {
        "devices": {
            "device": [
                {
                    "name": "",
                    "accessIp": "",
                    "approved": "",
                    "creationMethod": "",
                    "discoverMethod": "",
                    "discoverTime": "",
                    "naturalId": "",
                    "unmanaged": "",
                    "updateMethod": "",
                    "version": "",
                    "deviceType": {
                        "accessProtocols": "",
                        "jobWeight": "",
                        "model": "",
                        "vendor": "",
                        "version": ""
                    },
                    "organization": {
                        "@id": "",
                        "@name": ""
                    }
                }
            ]
        }
    }

operation: Get All Devices For Specified IP Address Range

Input parameters

Output

The output contains the following populated JSON schema:

    {
        "devices": {
            "device": [
                {
                    "name": "",
                    "accessIp": "",
                    "approved": "",
                    "creationMethod": "",
                    "discoverMethod": "",
                    "discoverTime": "",
                    "naturalId": "",
                    "unmanaged": "",
                    "updateMethod": "",
                    "version": "",
                    "deviceType": {
                        "accessProtocols": "",
                        "jobWeight": "",
                        "model": "",
                        "vendor": "",
                        "version": ""
                    },
                    "organization": {
                        "@id": "",
                        "@name": ""
                    }
                }
            ]
        }
    }

operation: Get Device Information

Input parameters

Output

The output contains the following populated JSON schema:

    {
        "device": {
            "luns": "",
            "name": "",
            "status": "",
            "version": "",
            "accessIp": "",
            "approved": "",
            "storages": "",
            "naturalId": "",
            "unmanaged": "",
            "components": "",
            "deviceType": {
                "model": "",
                "vendor": "",
                "version": "",
                "category": "",
                "jobWeight": ""
            },
            "interfaces": {
                "networkinterface": {
                    "adminStatus": "",
                    "description": "",
                    "inSpeed": "",
                    "ipv4Addr": "",
                    "ipv4IsVirtual": "",
                    "ipv4Mask": "",
                    "isCritical": "",
                    "isMonitor": "",
                    "isTrunk": "",
                    "isWAN": "",
                    "macAddr": "",
                    "macIsVirtual": "",
                    "name": "",
                    "operStatus": "",
                    "outSpeed": "",
                    "snmpIndex": "",
                    "speed": "",
                    "type": ""
                }
            },
            "processors": "",
            "raidGroups": "",
            "applications": "",
            "discoverTime": "",
            "organization": {
                "@id": "",
                "@name": ""
            },
            "updateMethod": "",
            "ipToHostNames": "",
            "storageGroups": "",
            "creationMethod": "",
            "description": "",
            "discoverMethod": "",
            "winMachineGuid": "",
            "eventParserList": "",
            "systemUpTime": "",
            "softwarePatches": "",
            "softwareServices": "",
            "sanControllerPorts": ""
        }
    }

operation: List Monitored Devices and Attributes

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "monitoredDevices": {
        "perfMonDevices": {
            "device": {
                "accessIp": "",
                "deviceName": "",
                "deviceType": "",
                "monitors": {
                    "monitor": [
                        {
                            "category": "",
                            "method": ""
                        }
                    ]
                },
                "organization": ""
            }
        },
        "eventPullingDevices": ""
    }
}

operation: List Monitored Organizations

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "@id": "",
    "name": "",
    "@xmlId": "",
    "@custId": "",
    "@ownerId": "",
    "disabled": "",
    "domainId": "",
    "initialized": "",
    "@creationTime": "",
    "collectors": {
        "collector": []
    },
    "@lastModified": "",
    "@entityVersion": "",
    "custProperties": ""
}

operation: Get Organization Details

Input parameters

Output

The output contains the following populated JSON schema:

{
    "@entityVersion": "",
    "@creationTime": "",
    "@custId": "",
    "@id": "",
    "@lastModified": "",
    "custProperties": "",
    "collectors": {
        "collector": []
    },
    "@ownerId": "",
    "@xmlId": "",
    "disabled": "",
    "domainId": "",
    "initialized": "",
    "name": ""
}

operation: Run Advanced Search Query

Input parameters

Output

No output schema is available at this time.

operation: Get Event Attributes

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "FQDN": "",
    "Type": "",
    "UUID": "",
    "User": "",
    "VM IP": "",
    "Domain": "",
    "Host IP": "",
    "ICMP Id": "",
    "IP Port": "",
    "Message": "",
    "User Id": "",
    "Agent ID": "",
    "Checksum": "",
    "Computer": "",
    "Duration": "",
    "Event ID": "",
    "Host MAC": "",
    "URI Stem": "",
    "Disk Name": "",
    "File Name": "",
    "File Path": "",
    "Host City": "",
    "Host Name": "",
    "Host VLAN": "",
    "ICMP Code": "",
    "ICMP Type": "",
    "Rule Name": "",
    "Server IP": "",
    "TCP flags": "",
    "URI Query": "",
    "WLAN SSID": "",
    "Event Name": "",
    "Event Type": "",
    "File Owner": "",
    "Host Model": "",
    "Host State": "",
    "IP Version": "",
    "Image File": "",
    "Sent Bytes": "",
    "Source IP ": "",
    "Source MAC": "",
    "Source TOS": "",
    "User Group": "",
    "VPN Status": "",
    "Attack Name": "",
    "Device Port": "",
    "Device Time": "",
    "Employee ID": "",
    "Host Vendor": "",
    "IP Protocol": "",
    "Incident ID": "",
    "Mail Sender": "",
    "New Host IP": "",
    "Object Name": "",
    "Relaying IP": "",
    "Server Name": "",
    "Source City": "",
    "Source VLAN": "",
    "Target User": "",
    "Total Bytes": "",
    "Collector ID": "",
    "Collector IP": "",
    "DHCP Gateway": "",
    "Event Action": ": ",
    "Event Source": "",
    "Host Country": "",
    "Mail Subject": "",
    "Malware Name": "",
    "Malware Type": "",
    "Process Name": "",
    "Reporting IP": ": ",
    "Sent Packets": "",
    "Source State": "",
    "VM Host Name": "",
    "Win Logon Id": "",
    "ARP Source IP": "",
    "Connection Id": "",
    "DNS Server IP": "",
    "IPS Sensor Id": "",
    "Mail Receiver": "",
    "Object Handle": "",
    "Raw Event Log": "",
    "Software Name": "",
    "Target Domain": "",
    "Total Packets": "",
    "VPN Conn Type": "",
    "WLAN Radio Id": "",
    "ARP Source MAC": "",
    "Account Number": "",
    "Auth Server IP": "",
    "Collector Name": "",
    "DNS Query Type": "",
    "Destination IP": "",
    "Event Severity": "",
    "Hash Algorithm": "",
    "Incident Title": "",
    "Malware Action": "",
    "OS Object Type": "",
    "Received Bytes": "",
    "Recv Auth Fail": "",
    "Reporting City": "",
    "Sent TCP flags": "",
    "Snort Event ID": "",
    "Source Country": "",
    "TCP Connection": "",
    "UDP Connection": "",
    "Win Logon Type": "",
    "DHCP Server MAC": "",
    "Destination MAC": "",
    "Destination TOS": "",
    "Firewall Action": "",
    "HTTP User Agent": "",
    "Host Virtual IP": "",
    "ICMP Connection": "",
    "Incident Source": "",
    "Incident Target": "",
    "Organization ID": "",
    "Relaying Device": "",
    "Reporting Model": "",
    "Reporting State": "",
    "Target Computer": "",
    "Target Host MAC": "",
    "VPN Tunnel Name": "",
    "WLAN Channel Id": "",
    "WLAN User count": "",
    "Application Name": "",
    "Application Port": "",
    "Auth Server Name": "",
    "Destination City": "",
    "Destination VLAN": "",
    "Event Occur Time": "",
    "Firewall Session": "",
    "Operating System": "",
    "Received Packets": "",
    "Reporting Device": "",
    "Reporting Vendor": "",
    "Source Host Name": "",
    "DHCP Request Type": "",
    "Destination State": "",
    "Event Description": "",
    "Host Organization": "",
    "Incident Category": "",
    "Informational URL": "",
    "Organization Name": "",
    "Reporting Country": "",
    "Target User Group": "",
    "ARP Destination IP": "",
    "Event Parse Status": "",
    "Event Receive Time": "",
    "IP Type of Service": "",
    "Object Access Type": "",
    "Post-NAT Source IP": "",
    "Previous Source IP": "",
    "Recv Packet Errors": "",
    "Sent Packet Errors": "",
    "Source Device Port": "",
    "Vulnerability Name": "",
    "Vulnerability Type": "",
    "ARP Destination MAC": "",
    "Destination Country": "",
    "Host Interface Name": "",
    "Recv Interface Util": "",
    "Sent Interface Util": "",
    "Source Organization": "",
    "Source TCP/UDP Port": "",
    "Vulnerability Score": "",
    "Win Logon Fail Code": "",
    "False Positive Check": "",
    "IDS Database Version": "",
    "Post-NAT Source Port": "",
    "Source Firewall Zone": "",
    "Vulnerability CVE Id": "",
    "Business Service Name": "",
    "Destination Host Name": "",
    "IPS Event Risk Rating": "",
    "Incident Reporting IP": "",
    "Network Access Device": "",
    "Recv Packet Error Pct": "",
    "Sent Packet Error Pct": "",
    "Source Interface Name": "",
    "System Event Category": "",
    "Pre-NAT Destination IP": "",
    "Reporting Organization": "",
    "Virus Database Version": "",
    "Destination Device Port": "",
    "Event Severity Category": "",
    "IPS Event Threat Rating": ": ",
    "Post-NAT Destination IP": "",
    "Destination Organization": "",
    "Destination Service Name": "",
    "Destination TCP/UDP Port": "",
    "Network Access Device IP": "",
    "Operating System Version": "",
    "Pre-NAT Destination Port": "",
    "Destination Firewall Zone": "",
    "Palo Alto Firewall Action": "",
    "Destination Interface Name": "",
    "Extension Database Version": "",
    "Network Access Device Port": "",
    "Source Interface SNMP Index": "",
    "Firewall Session Utilization": "",
    "Post-NAT Destination Ip Port": "",
    "Previous Source TCP/UDP Port": "",
    "Command and Control Host Name": "",
    "Wireless Attack Signature Name": "",
    "Incident Trigger Attribute List": "",
    "Source Autonomous System Number": "",
    "Command and Control TCP/UDP Port": "",
    "Destination Interface SNMP Index": "",
    "Destination Autonomous System Number": "",
    "Anti-Virus Extension Database Version": ""
}

operation: Get Events Data By Query ID

Input parameters

Output

The output contains a non-dictionary value.

operation: Create Watch List

Input parameters

    {
        "description":"Servers,networkorstoragedevices",
        "displayName":"ResourceIssuesTest4",
        "type":"DyWatchList",
        "isCaseSensitive":false,
        "dataCreationType":"USER",
        "topGroup":false,
        "valuePattern":null,
        "valueType":"STRING",
        "ageOut":"1d",
        "custId":1,
        "entries":[
            {
            "inclusive":true,
            "entryValue":"PVVol_A001_A000356_5new",
            "ageOut":"1d",
            "count":1,
            "custId":1,
            "firstSeen":1612901760000,
            "lastSeen":1612901760000,
            "triggeringRules":"DatastoreSpaceWarning",
            "dataCreationType":"USER"
            }
        ]
    }

Output

The output contains the following populated JSON schema:

{
    "response": [
        {
            "isCaseSensitive": "",
            "naturalId": "",
            "displayName": "",
            "description": "",
            "valuePattern": "",
            "ageOut": "",
            "topGroup": "",
            "entries": [
                {
                    "naturalId": "",
                    "firstSeen": "",
                    "count": "",
                    "triggeringRules": "",
                    "description": "",
                    "entryValue": "",
                    "expiredTime": "",
                    "ageOut": "",
                    "lastSeen": "",
                    "dataCreationType": "",
                    "custId": "",
                    "id": "",
                    "state": ""
                }
            ],
            "dataCreationType": "",
            "valueType": "",
            "custId": "",
            "name": "",
            "id": ""
        }
    ],
    "status": ""
}

operation: Get Watch Lists

Input parameters

Output

The output contains the following populated JSON schema:

If you choose Get All Watch Lists or By Watch List ID as Get Watch List Data By, then the output contains the following populated JSON schema:

{
    "response": [
        {
            "isCaseSensitive": "",
            "naturalId": "",
            "displayName": "",
            "description": "",
            "valuePattern": "",
            "ageOut": "",
            "topGroup": "",
            "entries": [
                {
                    "naturalId": "",
                    "firstSeen": "",
                    "count": "",
                    "triggeringRules": "",
                    "description": "",
                    "entryValue": "",
                    "expiredTime": "",
                    "ageOut": "",
                    "lastSeen": "",
                    "dataCreationType": "",
                    "custId": "",
                    "id": "",
                    "state": ""
                }
            ],
            "dataCreationType": "",
            "valueType": "",
            "custId": "",
            "name": "",
            "id": ""
        }
    ],
    "status": ""
}

Output schema when you choose Get Watch List Data By as By Watch List Entry ID:

{
    "response": {
        "isCaseSensitive": "",
        "naturalId": "",
        "displayName": "",
        "description": "",
        "valuePattern": "",
        "ageOut": "",
        "topGroup": "",
        "entries": [
            {
                "naturalId": "",
                "firstSeen": "",
                "count": "",
                "triggeringRules": "",
                "description": "",
                "entryValue": "",
                "expiredTime": "",
                "ageOut": "",
                "lastSeen": "",
                "dataCreationType": "",
                "custId": "",
                "id": "",
                "state": ""
            }
        ],
        "dataCreationType": "",
        "valueType": "",
        "custId": "",
        "name": "",
        "id": ""
    },
    "status": ""
}

This is the default output schema:

{
    "response": [
        {
            "isCaseSensitive": "",
            "naturalId": "",
            "displayName": "",
            "description": "",
            "valuePattern": "",
            "ageOut": "",
            "topGroup": "",
            "entries": [
                {
                    "naturalId": "",
                    "firstSeen": "",
                    "count": "",
                    "triggeringRules": "",
                    "description": "",
                    "entryValue": "",
                    "expiredTime": "",
                    "ageOut": "",
                    "lastSeen": "",
                    "dataCreationType": "",
                    "custId": "",
                    "id": "",
                    "state": ""
                }
            ],
            "dataCreationType": "",
            "valueType": "",
            "custId": "",
            "name": "",
            "id": ""
        }
    ],
    "status": ""
}

operation: Get Watch List Entries Count

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "response": {
        "entry_count": ""
    }
}

operation: Get Watch List Entry

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "response": {
        "id": "",
        "count": "",
        "state": "",
        "ageOut": "",
        "custId": "",
        "lastSeen": "",
        "firstSeen": "",
        "naturalId": "",
        "entryValue": "",
        "description": "",
        "expiredTime": "",
        "triggeringRules": "",
        "dataCreationType": ""
    }
}

operation: Add Watch List Entries to Watch List

Input parameters

    {
        "inclusive": false,
        "count": 10,
        "custId": 1,
        "triggeringRules": "Datastore Space Warning",
        "entryValue": "PVVol_A001_A000356_POWER2",
        "ageOut": "1d",
        "lastSeen": 1613601369215,
        "firstSeen": 1613601369215,
        "disableAgeout": false,
        "dataCreationType": "USER"
    }

Output

The output contains the following populated JSON schema:

{
    "response": "",
    "status": ""
}

operation: Update Watch List Entry

Input parameters

    {
        "lastSeen": 1612901760002,
        "dataCreationType": "USER",
        "firstSeen": 1612901760001,
        "count": 100,
        "custId": 1,
        "triggeringRules": "Datastore Space Warning",
        "description": "Testing again",
        "id": 889400,
        "inclusive": true,
        "entryValue": "PVVol_A001_A000356_POWER23",
        "expiredTime": 1612988160001,
        "ageOut": "2d"
    }

Output

The output contains the following populated JSON schema:

{
    "response": {
        "naturalId": "",
        "firstSeen": "",
        "count": "",
        "triggeringRules": "",
        "description": "",
        "entryValue": "",
        "expiredTime": "",
        "ageOut": "",
        "lastSeen": "",
        "dataCreationType": "",
        "custId": "",
        "id": "",
        "state": ""
    },
    "status": ""
}

operation: Delete Watch List Entry

Input parameters

Output

The output contains the following populated JSON schema:

{
    "response": "",
    "status": ""
}

operation: Delete Watch List

Input parameters

Output

The output contains the following populated JSON schema:

{
    "response": "",
    "status": ""
}

operation: Create Lookup Table

Input parameters

[
    {
      "key": true,
      "name": "url",
      "type": "STRING"
    },
    {
      "key": false,
      "name": "wfCategoryID",
      "type": "LONG"
    }
]

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "name": "",
    "columnList": [
        {
            "key": "",
            "name": "",
            "type": ""
        }
    ],
    "description": "",
    "lastUpdated": "",
    "organizationName": ""
}

operation: Get All Lookup Table

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": [
        {
            "id": "",
            "name": "",
            "columnList": [
                {
                    "key": "",
                    "name": "",
                    "type": ""
                }
            ],
            "description": "",
            "lastUpdated": "",
            "organizationName": ""
        }
    ],
    "size": "",
    "start": "",
    "total": ""
}

operation: Delete Lookup Table

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "message": ""
}

operation: Import Lookup Table Data

Input parameters

{
    "url": 1,
    "wfCategoryID": 2
}

Output

The output contains the following populated JSON schema:

{
    "taskId": ""
}

operation: Check Import Task Status

Input parameters

Output

The output contains the following populated JSON schema:

{
    "actionResult": "",
    "id": "",
    "progress": "",
    "status": ""
}

operation: Get Lookup Table Data

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": [],
    "size": "",
    "start": "",
    "total": ""
}

operation: Update Lookup Table Data

Input parameters

{
   "url": "www.test.com",
    "wfCategoryID": 30,
    "score": 0.50119
}

Output

The output contains the following populated JSON schema:

{
    "response": "",
    "message": ""
}

operation: Delete Lookup Table Data

Input parameters

[
    {
      "keyColumn_1": "value",
      "keyColumn_2": "value"
    }
]  

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "message": ""
}

operation: Get All Resource Lists

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "pid": "",
    "version": "",
    "displayName": "",
    "description": "",
    "groupType": {
        "name": "",
        "displayName": ""
    },
    "naturalId": "",
    "children": [
        {
            "id": "",
            "pid": "",
            "version": "",
            "displayName": "",
            "description": "",
            "groupType": {
                "name": "",
                "displayName": ""
            },
            "naturalId": "",
            "children": [],
            "retiredChildren": [],
            "itemIds": "",
            "systemGroup": "",
            "custId": "",
            "groupConfig": "",
            "valueType": "",
            "dataCreationType": "",
            "fullPathName": "",
            "valuePattern": "",
            "topGroup": "",
            "displayOrder": "",
            "dashboardStatus": "",
            "myDashboard": "",
            "myWidgetDashboard": "",
            "myBizServiceDashboard": "",
            "mySummaryDashboard": "",
            "myLinkUsageDashboard": "",
            "superGlobal": "",
            "rootOfMyDashboard": "",
            "myIdentityLocationDashboard": "",
            "myPCIDashboard": ""
        }
    ],
    "retiredChildren": [],
    "itemIds": "",
    "systemGroup": "",
    "custId": "",
    "groupConfig": "",
    "valueType": "",
    "dataCreationType": "",
    "fullPathName": "",
    "valuePattern": "",
    "topGroup": "",
    "displayOrder": "",
    "dashboardStatus": "",
    "myDashboard": "",
    "myWidgetDashboard": "",
    "myBizServiceDashboard": "",
    "mySummaryDashboard": "",
    "myLinkUsageDashboard": "",
    "superGlobal": "",
    "rootOfMyDashboard": "",
    "myIdentityLocationDashboard": "",
    "myPCIDashboard": ""
}

operation: Get Resource List Entries

Input parameters

Output

The output contains the following populated JSON schema:

{
    "headerData": {
        "objectTypeName": "",
        "columnNames": [],
        "columnTypes": [],
        "methodNames": [],
        "columnWidths": [],
        "columnActions": [],
        "keys": [],
        "attrKeys": []
    },
    "lightValueObjects": [
        {
            "objectId": "",
            "custId": "",
            "parentId": "",
            "collectorId": "",
            "data": [],
            "extData": "",
            "naturalId": "",
            "aoSys": ""
        }
    ],
    "errCode": "",
    "errObj": "",
    "dataType": "",
    "totalCount": ""
}

operation: Add Entries To Resource List

Input parameters

{
    "singleIp": "3.3.3.3",
    "enableDateFound": false,
    "enableLastSeen": false,
    "dateFound": null,
    "lastSeen": null,
    "name": "3.3.3.3",
    "malwareType": "ip",
    "severity": "low",
    "highIp": "3.3.3.3",
    "lowIp": "3.3.3.3",
    "sysDefined": false,
    "active": true,
    "groupId": 15732450304
}

Output

The output contains the following populated JSON schema:

{
    "lastModified": "",
    "creationTime": "",
    "custId": "",
    "ownerId": "",
    "collectorId": "",
    "grpNid": "",
    "id": "",
    "naturalId": "",
    "name": "",
    "lowIp": "",
    "highIp": "",
    "description": "",
    "sysDefined": "",
    "active": "",
    "malwareType": "",
    "confidence": "",
    "severity": "",
    "country": "",
    "asn": "",
    "dateFound": "",
    "lastSeen": "",
    "org": "",
    "groupId": "",
    "naturalIdProperty": "",
    "creationDate": "",
    "lastModifiedDate": "",
    "xmlId": "",
    "systemEntity": ""
}

operation: Remove Entries From Resource List

Input parameters

Output

The output contains a non-dictionary value.

Included playbooks

The Sample - Fortinet FortiSIEM - 5.0.2 playbook collection comes bundled with the Fortinet FortiSIEM connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Fortinet FortiSIEM connector.

• > FortiSIEM > Fetch
• >> FortiSIEM > Fetch Associated events for Incident
• Device: Get All Devices
• Device: Get All Devices For Specified IP Address Range
• Device: Get Device Information
• Device: List Monitored Devices and Attributes
• Event: Get Event Attribute
• Event: Get Event Details
• Event: Get Events For Incident
• Event: Search Events
• FortiSIEM > Ingest
• Get Events Data By Query ID
• Incident: Clear Incident With Reason
• Incident: Comment Incident
• Incident: Get Incident Details
• Incident: List Incidents
• Incident: Update Incident
• Lookup Table: Check Import Task Status
• Lookup Table: Create Lookup Table
• Lookup Table: Delete Lookup Table
• Lookup Table: Delete Lookup Table Data
• Lookup Table: Get All Lookup Table
• Lookup Table: Get Lookup Table Data
• Lookup Table: Import Lookup Table Data
• Lookup Table: Update Lookup Table Data
• Organization: Get Organization Details
• Organization: List Monitored Organizations
• Resource List: Add Entries To Resource List
• Resource List: Get All Resource Lists
• Resource List: Get Resource List Entries
• Resource List: Remove Entries From Resource List
• Run Advanced Search Query
• Watch List: Add Watch List Entries To Watch List
• Watch List: Create Watch List
• Watch List: Delete Watch List
• Watch List: Delete Watch List Entry
• Watch List: Get Watch List Entries Count
• Watch List: Get Watch List Entry
• Watch List: Get Watch Lists
• Watch List: Update Watch List Entry

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection, since the sample playbook collection gets deleted during connector upgrade and delete.

Data Ingestion Support

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling incidents from Fortinet FortiSIEM. Currently, Incidents in Fortinet FortiSIEM are mapped to Alerts in FortiSOAR™. For more information on the Data Ingestion Wizard, see the Connectors Guide in the FortiSOAR™ product documentation.

NOTE: To link MITRE techniques records to alerts that are being created using the Data Ingestion Wizard, use the MITRE ATT&CK Enrichment Framework and MITRE ATT&CK Threat Hunting Solution Packs.

Configure Data Ingestion

You can configure data ingestion using the Data Ingestion Wizard to seamlessly map the incoming FortiSIEM Incidents to FortiSOAR™Alerts.

IMPORTANT: You must reconfigure data ingestion if you have upgraded your FortiSIEM connector to version 5.0.0 (or later) from version 4.5.0. For more information, see the Reconfiguring FortiSIEM Data Ingestion section.

The Data Ingestion Wizard enables you to configure the scheduled pulling of data from FortiSIEM into FortiSOAR™. It also lets you pull some sample data from FortiSIEM using which you can define the mapping of data between FortiSIEM and FortiSOAR™. The mapping of common fields is generally already done by the Data Ingestion Wizard; users are mostly required to only map any custom fields that are added to the FortiSIEM incident.

1. To begin configuring data ingestion, click Configure Data Ingestion on the Fortinet FortiSIEM connector's Configurations page.
   Click Let's Start by fetching some data, to open the Fetch Sample Data screen.
   
   Sample data is required to create a field mapping between FortiSIEM data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.

2. On the Fetch Data screen, provide the configurations required to fetch Fortinet FortiSIEM data.
   Users can choose to pull data from Fortinet FortiSIEM by either specifying the last X minutes in which the incidents have been created or updated in FortiSIEM (By Updates in Last X Minutes) or by specifying an Incident ID (By Sample Incident ID). When fetching data based on By Updates in Last X Minutes, specify the number of minutes from when to retrieve incidents that were created or updated in Fortinet FortiSIEM, in the Pull Incidents Creates/Updates In Last X Minutes field. When fetching data based on By Sample Incident ID, specify the ID of the incident to retrieve from Fortinet FortiSIEM, in the Incident ID field. When fetching data based on By Updates in Last X Minutes , you can apply additional parameters such as:

   • Maximum Incidents To Pull
   • Maximum Events To Pull Per Incident
   • Filter Incidents - based on Status, Category, Sub-category, Severity, and Event Type
   • Incident Status - Filter incidents based on incident status
   • Other Filters - Specify parameters using which to filter the incidents retrieved from the Fortinet FortiSIEM server. For example,
     {
"status": [0],
"eventType": ["PH_RULE_SERVER_CPU_WARN"],
"incidentRptIp": ["10.7.12.156"]
}
   The fetched data is used to create a mapping between the FortiSIEM data and FortiSOAR™ alerts. Once you have completed specifying the configurations, click the Fetch Data button.
   
   When configuring data ingestion for MSSP systems, if Configure Multi-Tenant Mappings checkbox is checked, ensure that you map the organization name defined in FortiSIEM as a tenant in FortiSOAR™, in the Organization Mapping field:
   
   NOTE: If you have not mapped or wrongly mapped an organization, then the incident record will be created as a Self entry.

3. On the Field Mapping screen, map the fields of a FortiSIEM incident to the fields of an alert present in FortiSOAR™
   To map a field, click the key in the sample data to add the Jinja value of the field. For example, to map the customer parameter of a FortiSIEM incident to the Username parameter of a FortiSOAR™ alert, click the Username field and then click the customer field to populate its keys:
   
   For more information on field mapping, see the Data Ingestion chapter in the FortiSOAR™ product documentation's Connectors Guide. Once you have completed the mapping of fields, click Save Mapping & Continue.

4. (Optional) Use the Scheduling screen to configure schedule-based ingestion, i.e., specify the polling frequency to FortiSIEM, so that the content gets pulled from the FortiSIEM integration into FortiSOAR™
   On the Scheduling screen, from the Do to schedule the ingestion? drop-down list, select Yes.
   In the Configure Schedule Settings section, specify the Cron expression For example, if you want to pull data from FortiSIEM every morning at 5 am, click Daily, in the hour box enter 5, and in the minute box enter 0:
   
   Once you have completed scheduling, click Save Settings & Continue.

5. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.

Reconfiguring FortiSIEM Data Ingestion

If you have upgraded your FortiSIEM connector to version 5.0.0 or later from version 4.5.0, then you must reconfigure the FortiSIEM Data Ingestion.

Use Data Ingestion on FortiSIEM v5.0.0 and later: Post-upgrade re-run the Data Ingestion Wizard to reconfigure FortiSIEM data ingestion, i.e., Open the Configurations page of the FortiSIEM connector and click Configure Data Ingestion.

Use Data Ingestion on FortiSIEM v4.5.0: Reconfigure FortiSIEM Data Ingestion using one of the following methods:

• Before upgrading the connector, open the data ingestion playbooks and save the connector step again.
  
  OR


• If you have not performed the above pre-upgrade step, then post-upgrade, export the data ingestion playbooks of the previous version, edit the playbooks.json file to update the version of the FortiSIEM connector from version 5.0.2 or 5.0.0 to the previous version of the connector, and then re-import the playbooks.json file.

Best Practices - Working with FortiSOAR FortiSIEM Integration

Following is a list of recommendations and suggested best practices for working with the FortiSOAR FortiSIEM integration:

• As the number of incidents in FortiSIEM might be very high, it is suggested to only pull the incidents that are of importance and need further action. For example, incidents of certain types and certain severity. The ingestion experience allows the configuration of these filters to meet the right requirements.
• It is strongly suggested to use the Maximum Events To Pull Per Incident parameter to limit and only fetch required or latest events per incident.
• It is recommended to tune the Maximum Incidents To Pull parameter to limit the incidents fetched per iteration. Tune this parameter based on your scheduled time and the average number of incidents being pulled (with some buffer for peaks).
• Various performance improvements are done with each important release of the connector, and hence it is suggested to upgrade to the latest version of the integration. Before upgrading, we strongly recommend reading the release notes and the connector documentation to understand the upgrade requirements/precursors/compatibility.
• There are important API enhancements support from FortiSIEM that are incorporated from v5.0.0 (and later) of the connector. Hence, upgrades from earlier versions (for example, from 4.5.0 - 5.0.0) requires to be well-planned. This has been documented in the Reconfiguring FortiSIEM Data Ingestion section.