Pulling Data from a MS_SQL table into FortiSIEM

Forum|Forum|1 year ago
September 30, 2024
7 replies
2436 views

Hi Dear Community,

I have a need to pull data from a MS_SQL DB from a specific Table with a specific query into FortiSIEM.
I have read all documentation of "External Systems Configuration Guide"
https://docs.fortinet.com/document/fortisiem/7.0.2/external-systems-configuration-guide/723635/microsoft-sql-server

in the documentation above it doesn't seem like there is an option to pull specific data from a specific table but rather only auditing and monitoring of the DB.

Does anyone have any suggestion or a guide on how to pull data from an MS_SQL DATABASE
DataBase name : X_DB
Table name: Y_Table

Fortisiem

soltantde2

New Member

I am not sure what you mean by extraction tool? Usually, you would have connectors to data sources which have a driver and usually, the most used one with SQL DBs is the ODBC Driver

GidonTAuthor

Visitor III

@soltantde2 i never mentioned any "extraction tool".

as mentioned in the question -
I need to pull data from a specific table in a specific database in MS SQL SB.
do you have any suggestions ?

FSM_FTNT

Staff

Have a look at the documentation herehttps://help.fortinet.com/fsiem/7-2-3/Online-Help/HTML5_Help/Custom-JDBC-Performance-Monitor-for-a-Custom-Table.html?Highlight=custom%20monitor

GidonTAuthor

Visitor III

Thank you very much @FSM_FTNT !
I will try this solution and will update on the results

GidonTAuthor

Visitor III

Hi Community,

After a long and tedious attempts to configure the FortiSIEM to communicate directly with the MS SQL DB (Creating New Events, Attributes, Credentials, Templates and much more) i was not successful and the lack of detailed documentation (other than Performance Monitoring for SQL DBs) wasn't helpful as-well.
My solution was
1. Crating a PowerShell script (which uses "Invoke-SqlCmd") to pull the data directly from the MS SQL DB with the specific query (using a Managed Service Account for extra security).
2. Dumping the query results into a file on the machine after some manipulation to add only the new entries from the SQL Table.
3. Installing a FortiSIEM agent on the machine and configuring the dumped query results as a user defined custom log file.

The use of PS and log file was MUCH easier than trying to configure all the different FortiSIEM elements required for this to work properly.

adem_netsys

Explorer III

Hi @GidonT

Which Siem version are you using? In my experience, you will need to have version 7.2.2 and above to use the JDBC connection properly. If you have this, you can share at which point you are getting errors.

GidonTAuthor

Visitor III

Hi @adem_netsys .

I am using an earlier version of FortiSIEM.
but thank you anyway for your response.

Sign up

Login with SSO

Login to the community

Login with SSO