Configuring API Data Collection and Integration in FortiSIEM

[mshah]

Hello,

I need to set up an hourly data collection process from multiple APIs and ingest the data as events into FortiSIEM as a part of new integration. Could you please help with the following:

1. How can users configure data collection (e.g., adding API keys, base URL, etc.) within FortiSIEM?
2. How do we write and integrate a custom script for this API data collection in FortiSIEM?
3. Which programming language is recommended for writing the script?
4. How do we create parsers for processing JSON data returned by the API?

Any insights or resources for this process would be greatly appreciated.

Thanks!

[Secusaurus]

Hi @mshah,

Have a look at this document: https://docs.fortinet.com/document/fortisiem/7.2.5/external-systems-configuration-guide/412973

I think this is what you look for with API-polling.

For the result, you will have to write a parser. There is a self-paced parser training available at training.fortinet.com which really helps understanding how to proceed here.

Best,

Christian

[mshah]

Hii, @Secusaurus Thanks for your quick answer. I will check the document which you shared and get back to you if I have any doubts for it.

[mshah]

Hii @Secusaurus, 

Thanks for your response. My use case involves multiple API endpoints that share the same base URL. Based on the documentation you provided, it seems that each endpoint would need to be configured individually. Is there a way to streamline this process so that the user only needs to input the base URL once? Specifically, I’m looking for a way to write a script that takes basic inputs like the base URL, API token, pull interval from fortiSIEM UI from user and automatically parses the API response, storing it as events in FortiSIEM.

Would appreciate any guidance or suggestions!

[Secusaurus]

Hi @mshah,

From my knowledge, there is no option to do multiple requests from one setup. I would solve this with a small webserver in-between (in the segment of the supervisor/workers) that just collects multiple information with that one request, but this obviously is a workaround, not a solution.

Would be a nice feature request, though.

Best,

Christian