Pulling Data from a MS_SQL table into FortiSIEM

[GidonT]

Hi Dear Community, 

I have a need to pull data from a MS_SQL DB from a specific Table with a specific query into FortiSIEM. 
I have read all documentation of "External Systems Configuration Guide"
https://docs.fortinet.com/document/fortisiem/7.0.2/external-systems-configuration-guide/723635/micro...


in the documentation above it doesn't seem like there is an option to pull specific data from a specific table but rather only auditing and monitoring of the DB. 

Does anyone have any suggestion or a guide on how to pull data from an MS_SQL DATABASE
DataBase name : X_DB
Table name: Y_Table

[soltantde2]

I am not sure what you mean by extraction tool? Usually, you would have connectors to data sources which have a driver and usually, the most used one with SQL DBs is the ODBC Driver

[GidonT]

@soltantde2 i never mentioned any "extraction tool".

as mentioned in the question - 
I need to pull data from a specific table in a specific database in MS SQL SB. 
do you have any suggestions ? 

[FSM_FTNT]

Have a look at the documentation herehttps://help.fortinet.com/fsiem/7-2-3/Online-Help/HTML5_Help/Custom-JDBC-Performance-Monitor-for-a-C...

[GidonT]

Thank you very much @FSM_FTNT !
I will try this solution and will update on the results

[GidonT]

Hi Community, 

After a long and tedious attempts to configure the FortiSIEM to communicate directly with the MS SQL DB (Creating New Events, Attributes, Credentials, Templates and much more) i was not successful and the lack of detailed documentation (other than Performance Monitoring for SQL DBs) wasn't helpful as-well. 
My solution was 
1. Crating a PowerShell script (which uses "Invoke-SqlCmd") to pull the data directly from the MS SQL DB with the specific query (using a Managed Service Account for extra security).
2. Dumping the query results into a file on the machine after some manipulation to add only the new entries from the SQL Table. 
3. Installing a FortiSIEM agent on the machine and configuring the dumped query results as a user defined custom log file. 

The use of PS and log file was MUCH easier than trying to configure all the different FortiSIEM elements required for this to work properly.  

[adem_netsys]

Hi @GidonT 

Which Siem version are you using? In my experience, you will need to have version 7.2.2 and above to use the JDBC connection properly. If you have this, you can share at which point you are getting errors.

[GidonT]

Hi @adem_netsys .

I am using an earlier version of FortiSIEM. 
but thank you anyway for your response.