FortiAnalyzer
FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
Kush_Patel
Staff
Staff
Article Id 276352
Description

This article describes how to use the provided API request to automate the process.

 

FortiAnalyzer is a powerful tool for centralizing and analyzing logs and reports from Fortinet units.

To streamline the management of unauthorized devices and ensure they are correctly associated with the appropriate ADOM, it is possible to use the FortiAnalyzer API.

This article describes how to use the provided API request to automate the process.

Scope FortiAnalyzer.
Solution

Automating the authorization of unauthorized devices to the correct ADOM in FortiAnalyzer using the provided API request streamlines the management of devices and ensures they are appropriately categorized for log and report analysis

. By following the steps outlined in this article and customizing the API request with the relevant device details, this process can be automated efficiently.

 

Using the API Request:

The provided API request is in JSON format and can be sent to the FortiAnalyzer API endpoint to automate the device authorization process.

 

JSON:

 

{

  "method": "exec",

  "params": [

    {

      "url": "/dvm/cmd/add/device",

      "data": {

        "adom": "<ADOM_NAME>",

        "flags": ["create_task", "nonblocking"],

        "device": [

          {

            "adm_usr": "admin",

            "adm_pass": ["<admin_password>"],

            "device action": "promote_unreg",

            "name": "<device_name, usually serial number>",

            "ip": "<reachable_IP>",

            "sn": "<Serial>"

          }

        ]

      }

    }

  ],

  "session": "<session_ID>",

  "id": 1

}

 

Explanation of Parameters:

 

  • <ADOM_NAME>: Replace this with the name of the target ADOM to authorize the device.
  • <admin_password>: Enter the password of the FortiAnalyzer admin account.
  • <device_name>: Provide a name for the device, usually its serial number.
  • <reachable_IP>: Specify the reachable IP address of the device.
  • <Serial>: Enter the serial number of the device.

 

Steps to Automate Device Authorization:

  1. Prepare the API request with the necessary details as explained above.
  2. Send the API request to the FortiAnalyzer API endpoint. It is possible to use tools like cURL or scripting languages like Python to make API requests.
  3. The API request will create a task to promote the unauthorized device ('device action': 'promote_unreg') to the specified ADOM.
  4. Once the task is executed, the device will be authorized and associated with the designated ADOM in FortiAnalyzer.

Related article:

Technical Tip: Managing the JSON API call with Postman and how to delete, create and update an ADOM ...