FortiSIEM Missed Data

Hello @EEHC , 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

Fortinet Community Team 

Hi @EEHC ,

The issue is specific to your system and would need deeper analysis of the Fortisiem logs. 

You can open a ticket with Fortinet support for any assistance.

However to get all these metrics verify if the device integration is done as suggested in external systems configuration guide , here the metric and supported protocol are given for 

information to be gathered. 

Related Link:
https://docs.fortinet.com/document/fortisiem/6.5.0/external-systems-configuration-guide/780675/fortisiem-external-systems-configuration-guide-online

I had a nice time. Here is what I got.

Syslog is the only supported method of FortiADC integration with FortiSIEM as per the external system configuration guide. So, pulling configuration information using SNMP for FortiADC devices may not be possible currently.

When I test credentials I get SSH failed (Host key verification failed). But discover is successful. I have to login to FortiSIEM Supervisor SSH and follow the steps mentioned in the KB Article "Technical Note: [Accelops KB] How to reset SSH key" to clear SSH key cache.

It helped so much and solved several problems.

I found the name for FortiGate is "_gateway". When I changed the name to FortiGate, The configuration data on FortiSIEM disappeared. I realized that there is a relation between the name and the configuration. I did rediscover for another IP addresses and found the name is displayed connected to the domain name. I did edit the name by adding the domain name and the configuration for both IP addresses is updated.