Configuring API Data Collection and Integration in FortiSIEM

Hi @mshah,

Have a look at this document: https://docs.fortinet.com/document/fortisiem/7.2.5/external-systems-configuration-guide/412973

I think this is what you look for with API-polling.

For the result, you will have to write a parser. There is a self-paced parser training available at training.fortinet.com which really helps understanding how to proceed here.

Best,

Christian

Hii, @Secusaurus Thanks for your quick answer. I will check the document which you shared and get back to you if I have any doubts for it.

Hii @Secusaurus, 

Thanks for your response. My use case involves multiple API endpoints that share the same base URL. Based on the documentation you provided, it seems that each endpoint would need to be configured individually. Is there a way to streamline this process so that the user only needs to input the base URL once? Specifically, I’m looking for a way to write a script that takes basic inputs like the base URL, API token, pull interval from fortiSIEM UI from user and automatically parses the API response, storing it as events in FortiSIEM.

Would appreciate any guidance or suggestions!

Hi @mshah,

From my knowledge, there is no option to do multiple requests from one setup. I would solve this with a small webserver in-between (in the segment of the supervisor/workers) that just collects multiple information with that one request, but this obviously is a workaround, not a solution.

Would be a nice feature request, though.

Best,

Christian