MSSQL Custom Application logs - JDBC Integration

[AliMhaerFathy]

Hello,

Summary:
I have a MSSQL DB, and i have an application which sends its logs to custom tables.

Task:
Can I use the JDBC connection to connect to these custom tables, and retrieve the table's columns, then I create the parser? 
FortiSIEM 

[adem_netsys · Accepted solution]

Hi @AliMhaerFathy 

While configuring JDBC, you specify the columns you want to get and create a special event type for it. The incoming raw data consists of the columns you created, so you do not need a parser.  My advice would be to create a sql view and use it. After doing these operations, you should not forget to do discovery.

[adem_netsys · Accepted solution]

Hi @AliMhaerFathy 

While configuring JDBC, you specify the columns you want to get and create a special event type for it. The incoming raw data consists of the columns you created, so you do not need a parser.  My advice would be to create a sql view and use it. After doing these operations, you should not forget to do discovery.

[AliMhaerFathy]

Thanks for your support @adem_netsys, it's really appreciated!

Here i can see we put the table name and not specified any columns.

could you elborate further, as it's critical to get this application log?

[AliMhaerFathy]

I have a need to pull data from a MS_SQL DB from a specific Table with a specific query into FortiSIEM. 
I have read all documentation of "External Systems Configuration Guide"
https://docs.fortinet.com/document/fortisiem/7.0.2/external-systems-configuration-guide/723635/micro...


in the documentation above it doesn't seem like there is an option to pull specific data from a specific table but rather only auditing and monitoring of the DB. 

Does anyone have any suggestion or a guide on how to pull data from an MS_SQL DATABASE
DataBase name : X_DB
Table name: Y_Table

[AliMhaerFathy · Accepted solution]

It works! Alhamdullah.

Kindly, follow the instructions below:

[AliMhaerFathy]

Hi @adem_netsys 

It works fine, however the OOB JDBC performance monitor disappeared once the custom performance object worked