Technical Tip: Integrate FortiAppSec cloud with Splunk Server using SSL protocol

• To integrate FortiAppSec cloud with Splunk Server using SSL protocol for secure connectivity, log in to the FortiAppSec portal: https://portal.appsec.fortinet.com/
   
• Once on the portal, select 'General', enable the Audit Logs Export tab, and select server type as Syslog.

Set the Log format as Splunk to support connectivity.

• Under the protocol, use the  SSL protocol and enter the Splunk IP address and port defined on the Splunk server for connectivity.
• After enabling SSL, there are 2 options available:
  • Server Certificate Verification.
  • Custom Certificate and Key.
• By default, these options are disabled, but can be enabled if required.
• After the configuration is done, select the TEST button to ensure the connection. Once the test shows success, then SAVE the config.

Note:

Test the server configuration before saving the settings.

Related document:

Using WAF with Splunk