---
title: Forti Analyzer
slug: connectors/forti-analyzer
docTags:
createdAt: 2026-06-09T16:30:02.557Z
---
FortiAnalyzer is a centralized logging and reporting solution that provides visibility into network security events.
Forti Analyzer is a comprehensive security management solution that provides centralized logging, analysis, and reporting for Fortinet security devices. This connector enables Swimlane Turbine users to automate the retrieval and analysis of security alerts and logs from Forti Analyzer, enhancing threat detection and response capabilities. By integrating Forti Analyzer with Swimlane Turbine, users can streamline security operations, improve incident response times, and gain deeper insights into their security posture through automated workflows.
## Prerequisites
Before you can use the FortiAnalyzer connector for Turbine, you'll need access to the FortiAnalyzer API. This requires the following:
- Custom authentication using the following parameters:
- URL: The endpoint URL for accessing FortiAnalyzer services.
- JSON RPC: The protocol used for remote procedure calls.
- Username: Your FortiAnalyzer account username.
- Password: The password associated with your FortiAnalyzer account.
## Capabilities
This Connector provides the following capabilities:
- Get Alerts
- Search Logs
## Notes
- To access FortiAnalyzer API Documentation for the Connector - [Check Here](https://fndn.fortinet.net/index.php?/fortiapi/175-fortianalyzer/4091/175/logview/)
## Additional Documentation
- [Forti Analyzer Connector Documentation](https://docs.swimlane.com/connectors/forti-analyzer)
- [Forti Analyzer API Documentation](https://fndn.fortinet.net/index.php?/fortiapi/175-fortianalyzer/4091/175/logview/)
# Configurations
## FortiAnalyzer API Authentication
Authenticates using username and password.
### Configuration Parameters
| **Parameter** | **Description** | **Type** | **Required** |
| ------------- | ---------------------------------- | -------- | ------------ |
| url | A URL to the target host. | string | Required |
| jsonrpc | Json Remote Procedure Call. | string | Required |
| username | Username | string | Required |
| password | Password | string | Required |
| verify\_ssl | Verify SSL certificate | boolean | Optional |
| http\_proxy | A proxy to route requests through. | string | Optional |
# Actions
## Get Alerts
Fetches alert events from Forti Analyzer for monitoring and analysis of security alerts. Requires JSON body input.
### Endpoint
- **URL:** `/eventmgmt/alerts`
- **Method:** `GET`
### Input
| **Argument Name** | **Type** | **Required** | **Description** |
| ------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `id` | string | Optional | An identifier established by the client. |
| `jsonrpc` | string | Optional | A string specifying the JSON-RPC protocol version. |
| `method` | string | Optional | A string containing the method name to be invoked. |
| `params` | array | Optional | Parameter for Get Alerts |
| `params.apiver` | number | Required | Current API version. |
| `params.filter` | string | Optional | Filter expression. 'event\_value', 'severity', 'trigger\_name', 'count', 'comment' and 'flags' are supported. i.e. trigger\_name='Local Device Event' and severity >= 3. |
| `params.limit` | number | Optional | The max number of records to get (min - 1, max - 2000). |
| `params.offset` | number | Optional | offset of records to get. |
| `params.time-range` | object | Optional | Time range for data selection. |
| `params.time-range.end` | string | Required | Ending date time. Consider it following the timezone parameter's, ADOM's or FortiAnalyzer's timezone if timezone info is not specified within time range. Format 'yyyy-MM-dd'T'HH\:mm\:ssZ' (RFC 3339) e.g. '2016-10-17T20:45:37-07:00 or 'yyyy-MM-dd HH\:mm\:ss' e.g. '2016-10-17 20:45:37'. |
| `params.time-range.start` | string | Required | Starting date time. Consider it following the timezone parameter's, ADOM's or FortiAnalyzer's timezone if timezone info is not specified within time range. Format 'yyyy-MM-dd'T'HH\:mm\:ssZ' (RFC 3339) e.g. '2016-10-17T20:45:37-07:00 or 'yyyy-MM-dd HH\:mm\:ss' e.g. '2016-10-17 20:45:37'. |
| `params.timezone` | string | Optional | The timezone index or name. Time range in request and date/time if any in response will follow this timezone. |
| `params.url` | string | Required | The resource path to Alert Events. Example /eventmgmt/adom/
:::Iframe{code=""}
:::
/alerts. |
| `session` | string | Optional | The cookie of an active session in FortiAnalyzer. |
### Input Example
`{"json_body":{"id":"string","jsonrpc":"2.0","method":"get","params":[{"apiver":3,"filter":"","limit":1000,"offset":0,"time-range":{"end":"2025-04-10T06:48:48.637Z","start":"2025-04-10T06:48:48.637Z"},"timezone":"string","url":"/eventmgmt/adom//alerts"}],"session":"string"}}`
### Output
| **Parameter** | **Type** | **Description** |
| ------------- | -------- | -------------------------------- |
| `status_code` | number | HTTP status code of the response |
| `reason` | string | Response reason phrase |
### Output Example
`{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 2 May 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}`
## Search Logs
Initiate a task to search logs in Forti Analyzer using specified parameters, requiring a 'params' JSON body input.
### Endpoint
- **URL:** `/logview/logsearch`
- **Method:** `POST`
### Input
| **Argument Name** | **Type** | **Required** | **Description** |
| ------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `id` | string | Optional | An identifier established by the client. |
| `jsonrpc` | string | Optional | A string specifying the JSON-RPC protocol version. |
| `method` | string | Optional | A string containing the method name to be invoked. |
| `params` | array | Optional | A structure that holds the parameter values. |
| `params.apiver` | number | Required | Current API version. |
| `params.case-sensitive` | boolean | Optional | Case sensitivity in filter. |
| `params.device` | array | Required | Device filter. For all devices in some type please use the All-Device ID. |
| `params.device.csfname` | string | Optional | Name of security fabric. Format - csfname. e.g. 'Corp\_SF' |
| `params.device.devid` | string | Optional | Format - devid\[vdom]. e.g. 'FGT60C0000000001\[root]'. |
| `params.device.devname` | string | Optional | Format - devname\[vdom]. e.g. 'FGT-vancouver\[traffic]'. |
| `params.filter` | string | Optional | Filter expression. |
| `params.logtype` | string | Required | The name of the logtype. |
| `params.time-order` | string | Optional | Sort result in descending or ascending order by time. |
| `params.time-range` | object | Required | Time range for log selection. |
| `params.time-range.end` | string | Required | Ending date time. Consider it following the timezone parameter's, ADOM's or FortiAnalyzer's timezone if timezone info is not specified within time range. Format is 'yyyy-MM-dd'T'HH\:mm\:ssZ' (RFC 3339) e.g. '2016-10-17T20:45:37-07:00 or 'yyyy-MM-dd HH\:mm\:ss' e.g. '2016-10-17 20:45:37'. |
| `params.time-range.start` | string | Required | Starting date time. Consider it following the timezone parameter's, ADOM's or FortiAnalyzer's timezone if timezone info is not specified within time range. Format is 'yyyy-MM-dd'T'HH\:mm\:ssZ' (RFC 3339) e.g. '2016-10-17T20:45:37-07:00 or 'yyyy-MM-dd HH\:mm\:ss' e.g. '2016-10-17 20:45:37'. |
| `params.timezone` | string | Optional | The timezone index or name. Time range in request and date/time if any in response will follow this timezone. |
| `params.url` | string | Required | The resource path to log Search. |
| `session` | string | Optional | The cookie of an active session in FortiAnalyzer. |
### Input Example
`{"json_body":{"id":"string","jsonrpc":"2.0","method":"add","params":[{"apiver":3,"case-sensitive":false,"device":[{"csfname":"Corp_SF","devid":"FGT60C0000000001[root]","devname":"FGT-vancouver[traffic]"}],"filter":"","logtype":"traffic","time-order":"desc","time-range":{"end":"2019-07-03T17:16:35","start":"2019-07-02T17:16:35"},"timezone":"string","url":"/logview/adom/root/logsearch"}],"session":"string"}}`
### Output
| **Parameter** | **Type** | **Description** |
| ------------- | -------- | -------------------------------- |
| `status_code` | number | HTTP status code of the response |
| `reason` | string | Response reason phrase |
| `id` | string | Unique identifier |
| `jsonrpc` | string | Output field: jsonrpc |
| `result` | object | Result of the operation |
| `result.tid` | number | Unique identifier |
### Output Example
`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"string","jsonrpc":"2.0","result":{"tid":0}}}`
# Response Headers
| **Header** | **Description** | **Example** |
| -------------- | ----------------------------------------------------- | ---------------------------- |
| content-length | The length of the response body in bytes | 140 |
| content-type | The media type of the resource | application/json |
| Date | The date and time at which the message was originated | Thu, 2 May 2024 20:37:23 GMT |