Skip to main content
gurveersingh
gurveersingh
New Member
August 23, 2024
Question

Ingest system alerts using FortiEDR Connector

  • August 23, 2024
  • 2 replies
  • 1000 views

Could we explore the possibility of adding functionality to ingest system alerts from FortiEDR into FortiSOAR? The FortiEDR API supports reading system events, which could be leveraged for this integration.

 

https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/df7ab511-7435-11ea-9384-00505692583a/API_Guide_V4.1.pdf

    2 replies

    okumbhar
    Staff
    okumbhar
    Staff
    August 27, 2024

    @gurveersingh we are already having a data ingestion to fetch events from FortiEDR and create alert in FortiSOAR

    gurveersingh
    gurveersinghAuthor
    New Member
    August 27, 2024

    @okumbhar Currently, the connector is capable of ingesting only security alerts. Can we add the capability to also ingest system alerts, which will provide insight into component health status?

     

    Here is the sample API endpoint to which you can query to get system events

    https://localhost/management-rest/system-events/list-system-events?componentNames=ensilo,USER-PC&componentTypes=Aggregator,Core&fromDate=2017-05-27%2000:00:00&toDate=2017-05-28%2000:00:00

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!