FortiSOAR and FAZ Data Ingest

[MattPant1]

Hello,

We have configured out FAZ for data ingest on our SOAR, we run the data ingest wizard, in the mapping screen, I can see web filter and app control logs. When we try to run the ingest, we get an error on the playbook, for the action, count events for multiple adoms, we get the following error.

Invalid ADOM name provided  Connector :: fortinet-fortianalyzerV3.1.0

Has anyone seen this?

Thanks

[RenuAndh]

Hi,

Can you check the provided ADOM name in configuration is correct ? from the error it seems the ADOM name is invalid.

[MattPant1]

Hello, the ADOM name is root, we noted from the documentation, multiple ADOM support is from FAZ 7.0.2 we are not there yet, this is likely the issue. Thanks

[RenuAndh]

yes if you want to use Multiple ADOMs, you must have access to Fortinet FortiAnalyzer whose release is 7.0.2 or later. But with root ADOM it should work provided "Read" and "Write" access to JSON API access in FAZ setup.