Hello adem_netsys,
Any EDR solution can be integrated into FortiSIEM in terms of
- Alert on EDR (usually on a management platform)
- Alert is sent out via SNMP trap, Syslog or custom API to FortiSIEM
- FortiSIEM stores this alert as event in the event DB
- Every EDR alert is set to trigger an incident on FortiSIEM
You can also use a remediation script on python to create a link back to your EDR platform (e.g. trigger endpoint quarantine).
So the main question would be: What EDR are you looking at?
You may also have a look at the External Systems Configuration Guide, your system could already be listed here.
If your question is more like "can I send all endpoint logs [not only alerts] to FSM", better look at the Advanced Agents which are already a very good log source for endpoints and fully integrated in FSM.
Best,
Christian
FCP & FCSS Security Operations | Fortinet Advanced Partner
