FortiEDR - Exporting threat hunting to Splunk

[ns4]

Hello,

I wanted to consult with you about the option of exporting all events (under threat hunting) from FortiEdr (5.2.0) to Splunk.

I establish to pass security events, system events and audit trail with the syslog option, but it is not efficient enough.

I wish to pass all events (under threat hunting) to Splunk, with maximum data. Is there a way to do so?

Thanks!

[Stephen_G]

Hi ns4,

Thanks for using our forum! We'll try to get you an answer as soon as we can.

If anybody seeing this has any ideas, feel free to contribute!

[Stephen_G]

Hi ns4,

Sorry it's taking a while to get you an answer. We're still looking.

[Stephen_G]

Hi again ns4,

I'm afraid there is currently no support for forwarding threat hunting logs.

Only security events, system events and audit trails can be forwarded at the moment.

I'm sorry this likely wasn't the answer you wanted.