EDR Entegration With FortiSIEM

Hello adem_netsys,

Any EDR solution can be integrated into FortiSIEM in terms of

1. Alert on EDR (usually on a management platform)
2. Alert is sent out via SNMP trap, Syslog or custom API to FortiSIEM
3. FortiSIEM stores this alert as event in the event DB
4. Every EDR alert is set to trigger an incident on FortiSIEM

You can also use a remediation script on python to create a link back to your EDR platform (e.g. trigger endpoint quarantine).

So the main question would be: What EDR are you looking at?

You may also have a look at the External Systems Configuration Guide, your system could already be listed here.

If your question is more like "can I send all endpoint logs [not only alerts] to FSM", better look at the Advanced Agents which are already a very good log source for endpoints and fully integrated in FSM.

Best,

Christian