Technical Tip: Integrate FortiAppSec cloud with Splunk Server using SSL protocol

[gsharma]

Description	This article describes how to integrate FortiAppSec cloud with Splunk Server using the SSL protocol for secure connectivity.
Scope	FortiAppSec Cloud.
Solution	To integrate FortiAppSec cloud with Splunk Server using SSL protocol for secure connectivity, log in to the FortiAppSec portal: https://portal.appsec.fortinet.com/ Once on the portal, select 'General', enable the Audit Logs Export tab, and select server type as Syslog. Set the Log format as Splunk to support connectivity. Under the protocol, use the  SSL protocol and enter the Splunk IP address and port defined on the Splunk server for connectivity. After enabling SSL, there are 2 options available: Server Certificate Verification. Custom Certificate and Key. By default, these options are disabled, but can be enabled if required. After the configuration is done, select the TEST button to ensure the connection. Once the test shows success, then SAVE the config. Note: Test the server configuration before saving the settings. Related document: Using WAF with Splunk