Hi everyone,!I'm working on optimising my FortiSIEM reporting, and I have two specific questions for the community:1. Daily Global Report ConfigurationI want to generate a "Daily Global Report" that covers everything (incidents, config changes, and system health, etc) for the last 24 hours.What is the best way to group this into a single automated task?2. AI Integration (Inside or Outside FortiSIEM)I'm interested in using AI to analyze or summarize these reports.If you use an external AI, how do you securely connect it to FortiSIEM to pull data automatically?Thanks in advance for your insights!

Hi @ghr,Regarding the first question, have a look at report bundles:For your second question: What kind of data would you like to pull?If you like to get reports, better way would be to send the reports to a distinct place and use them from there.For Incidents, have a look at Automation Policies →https://docs.fortinet.com/document/fortisiem/7.5.0/user-guide/744529/automation-policy-settingsFor querying the CMDB, FortiSIEM-API grants accessvia HTTP-requests (which I've never used yet), which can be found in the Fortinet Developer Network (you will need an account or Fortinet Partner to look into that →https://fndn.fortinet.net/index.php?/fortiapi/2627-fortisiem/)Best,Christian

G

ghr

Visitor III

Question

How should a Daily Global Report be configured? And is AI Integration in FortiSIEM Possible?

Forum|Forum|3 months ago
May 5, 2026
5 replies
97 views

Hi everyone,!

I'm working on optimising my FortiSIEM reporting, and I have two specific questions for the community:

1. Daily Global Report Configuration
I want to generate a "Daily Global Report" that covers everything (incidents, config changes, and system health, etc) for the last 24 hours.

What is the best way to group this into a single automated task?

2. AI Integration (Inside or Outside FortiSIEM)
I'm interested in using AI to analyze or summarize these reports.

If you use an external AI, how do you securely connect it to FortiSIEM to pull data automatically?

Thanks in advance for your insights!

Secusaurus

Contributor III

Hi @ghr,

Regarding the first question, have a look at report bundles:

For your second question: What kind of data would you like to pull?

If you like to get reports, better way would be to send the reports to a distinct place and use them from there.
For Incidents, have a look at Automation Policies → https://docs.fortinet.com/document/fortisiem/7.5.0/user-guide/744529/automation-policy-settings
For querying the CMDB, FortiSIEM-API grants access via HTTP-requests (which I've never used yet), which can be found in the Fortinet Developer Network (you will need an account or Fortinet Partner to look into that → https://fndn.fortinet.net/index.php?/fortiapi/2627-fortisiem/ )

Best,

Christian

NSE8 | Fortinet Advanced MSSP Partner

G

ghrAuthor

Visitor III

Hi @Secusaurus ,

Thank you so much for your help! Following your advice, I managed to successfully create and schedule my general activity report. It’s working perfectly now.

I’m now looking to take it to the next level using AI to make the report insights more relevant (better anomaly detection or summarization). Do you have any experience or ideas on:

External Processing: Sending report data to an external application to be analyzed by an AI/ML?
Internal Integration: Is there a way to leverage FortiSIEM’s built-in UEBA or ML features to enhance the report details directly inside the platform?

Thanks again for your valuable time!

Best regards,
Ghada

Secusaurus

Contributor III

Hi Ghada,

concerning AI processing: I think, most of the LLMs (local ones or cloud-based commercial ones) will work very good with a simple pre-prompt and getting the report. We do some kind of this the other way round: Scraping the internet for CVE and press information and piping this into an LLM by an open source automation tool regularly. That works quite well.

The UEBA and ML features of FortiSIEM are targeting the generation of Incidents. You can leverage them to get meaningful Incidents, but you will still end up with the report tables.

In 7.5.x, there are a lot of “FortiAI”-features that help to get more and “meaningful” (whatever that means using a hallucinating LLM...) insights into Events, Incidents and Cases, but these are currently only meant to work on the FSM GUI itself, not for reports.

Best,

Christian

NSE8 | Fortinet Advanced MSSP Partner

G

ghrAuthor

Visitor III

Hi Christian,

Thank you for these valuable insights! It’s great to hear that you’ve had success using LLMs with external automation tools—it confirms that my plan to use an external application for advanced reporting is the right direction.

You mentioned using "open source automation tools" to pipe data into LLMs. Could you please share which specific tools you recommend or have had success with?

Thanks again for the update on the new release!

Best regards,

Ghada

Sign up

Login with SSO

Login to the community

Login with SSO