Hi Robero,

I invite you to post your message in English to get more chance to obtain an answer. 

And if your question is concerning FortiSIEM, there is a “FortiSIEM” group available where FortiSIEM experts are replying faster :)!

Difficulty Receiving MongoDB (SaaS) Logs in FortiSIEM

 

Context

I am working on integrating a MongoDB SaaS environment (hosted by a cloud provider) with FortiSIEM for centralized log collection and correlation.

During the assessment, I found that the SaaS platform does not support sending logs directly via Syslog or traditional agents. Instead, log export is only available through provider-supported integrations.

What I Found

The MongoDB SaaS environment hosted on DigitalOcean allows log export only to the following destinations:

• Elasticsearch

• OpenSearch

There is no direct support for:

• Syslog (UDP/TCP)

• Logstash as a direct endpoint

• Native integration with FortiSIEM

Problem

FortiSIEM is not compatible with the Elasticsearch/OpenSearch ingestion API, which prevents direct integration between the MongoDB SaaS platform and FortiSIEM.

Additionally, the FortiSIEM Collector is a hardened appliance with limited capabilities, making it impractical or unsupported to install an intermediate Elasticsearch/OpenSearch instance on the same host.

Question

What is the recommended Fortinet architecture for ingesting logs from SaaS services (such as MongoDB) when the provider only supports exporting logs to Elasticsearch/OpenSearch and does not support Syslog or direct API integration with FortiSIEM?

Has anyone implemented this type of integration successfully? If so, what architecture or intermediary solution did you use?

​@Secusaurus hello :).

Do you have an idea?

Hi ​@Roberto_C,

In FortiSIEM, there are five main concepts to get information from given systems:

• Syslog: Requires a setup on the system to send logs to the cluster. As there is no specific definition of Syslog, you could consider anything that a system sends to the cluster as “Syslog”, FortiSIEM's parser will handle this as if it is syslog.
• SNMP: Requires a setup on the system to authorize SNMP queries from the cluster. This is usually used for CPU/RAM/… monitoring and pretty standard if you monitor a full hardware (in your case, you are monitoring software)
• Specific predefined API-calls: This is usually used to pull WMI/OMI on Windows systems or very specific API-calls like ESXi that have been implemented directly into FortiSIEM.
• Agents: For Windows and Linux, you can install an agent on the end system which will then be configured to collect everything you like from the system (for Windows, usually event logs; for Linux, usually defined log-files) and sends this compressed to the cluster.
• Generic HTTP-requests: Everything that has not a direct implementation yet, can be ingested via custom crafted HTTP-request against e.g. a REST-API. See: https://docs.fortinet.com/document/fortisiem/7.5.1/external-systems-configuration-guide/412973/generic-log-api-poller-https-advanced-integration
  You will need to write a parser then to do something with the output you get there.

For your scenario, I'd check if you may install software on the MongoDB (probably not) or try to find out the API definitions and go for the generic poller. If the SaaS does not have an API allowing to request log information, you will not get around having another server serving Elasticseach/Opensearch and configure that system to just forward anything it receives via Syslog to your cluster.

Best,
Christian

Thank you Christian!

Hi everyone, hope you're doing well.Thanks for the support, and sorry for the delay in getting back to you. The client decided against using MongoDB as a SaaS before I even had a chance to present the downsides.