VECTRA AI and Fortigate Integration

[GoranMak]

Hi All, 

Anyone has done this integration, does it only require the API Token from the Fortigate to be provided to Vectra?

There is only this document from Fortinet on this matter:

https://www.fortinet.com/content/dam/fortinet/assets/solution-guides/sb-fortinet-and-vectra-security...

Vectra has something on GitHub and it only mentions the API Token 

https://github.com/vectranetworks/vaedbl/blob/master/README.md

Thanks,

Goran

[ozkanaltas]

Hello @GoranMak ,

My understanding is that Vectra provides an IP list for dynamic blocking on Security Products.

If you want to use this IP/Domain list. You can configure the threat feed on Fortigate with Vectra provides.

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/891236/ip-address-threat-fee...

You need to configure these URLs on the FortiGate threat feed.

Source IPs based on Host's T/C, tags: http://<host>:8080/dbl/src
Source IPs based on Host's Detection typ: http://<host>:8080/dbl/src_det
Destination IPs based on Detection type: http://<host>:8080/dbl/dest
Destination IPs of C2 detection for Hosts with Threat/Certainty threshold: http://<host>:8080/dbl/tc_dest