FortiEDR - Exporting threat hunting to Splunk

[ns4]

Hello,

I wanted to consult with you about the option of exporting all events (under threat hunting) from FortiEdr (5.2.0) to Splunk.

I establish to pass security events, system events and audit trail with the syslog option, but it is not efficient enough.

I wish to pass all events (under threat hunting) to Splunk, with maximum data. Is there a way to do so?

Thanks!

[Stephen_G]

Hi ns4,

Thanks for using our forum! We'll try to get you an answer as soon as we can.

If anybody seeing this has any ideas, feel free to contribute!

[Stephen_G]

Hi ns4,

Sorry it's taking a while to get you an answer. We're still looking.