Fortinet FortiSIEM

fortinet fortisiem provides centralized security monitoring, event correlation, and automated incident response across hybrid it infrastructures fortinet fortisiem is an advanced security information and event management (siem) platform that unifies security monitoring, incident response, and device management across complex environments this connector enables swimlane turbine users to automate the retrieval, enrichment, and updating of security incidents, monitor agent and device status, and orchestrate incident response workflows directly with fortisiem by integrating fortisiem with swimlane turbine, security teams can streamline incident lifecycle management, accelerate investigations, and ensure comprehensive visibility and control over their security operations—all without writing code this integration empowers organizations to respond faster to threats, reduce manual effort, and maximize the value of their siem investment prerequisites before using the fortinet fortisiem connector, ensure you have the following prerequisites in place http basic authentication setup, requiring url the base url of your fortisiem instance username a valid fortisiem user account with appropriate api permissions password the password associated with the specified username api token authentication configured, requiring url the base url of your fortisiem instance access token an oauth bearer token generated from the fortisiem gui (admin > settings > system > api token) capabilities this connector provides the following capabilities fetch incidents get all agent status get incident by id get incidents by query id get query progress get triggering events start get triggering events progress get triggering events result query cmdb devices submit query with xml update incident update incident external notes for more information on fortisiem fortisiem main site https //www fortinet com/products/siem/fortisiem api documentation link fortisiem api documentation link https //fortinetweb s3 amazonaws com/docs fortinet com/v2/attachments/e499a132 794a 11ec bdf2 fa163e15d75b/fortisiem 6 5 0 integration api guide pdf#discover additional documentation fortinet fortisiem connector documentation https //docs swimlane com/connectors/fortinet fortisiemfortinet fortisiem api documentation https //www fortinet com/products/siem/fortisiemfortinet fortisiem authentication guide https //docs swimlane com/authentication guides/fortinet fortisiem configurations api token authentication authenticates using an oauth bearer token generated from the fortisiem gui (admin > settings > system > api token) configuration parameters parameter description type required url a url to the target host string required access token oauth bearer access token generated from the fortisiem gui string required verify ssl verify ssl certificate boolean optional http proxy a proxy to route requests through string optional http basic authentication authenticates using username and password configuration parameters parameter description type required url a url to the target host string required username username string required password password string required verify ssl verify ssl certificate boolean optional http proxy a proxy to route requests through string optional actions fetch incidents retrieve incidents from the fortinet fortisiem database within a specified time range using 'timefrom' and 'timeto' parameters endpoint url /phoenix/rest/pub/incident method post input argument name type required description filters object optional parameter for fetch incidents filters incidentid array optional array of specific incident ids to filter by filters incidentstatus array optional 0=active, 1=auto cleared, 2=manually cleared, 3=system cleared filters eventseverity array optional severity level 1 10, e g \[1,2,3,4] filters eventseveritycat array optional possible values low, medium, high filters phincidentcategory array optional 1=availability, 2=performance, 3=change, 4=security, 5=other filters phcustid array optional array of organization ids to filter by filters customer array optional array of customer/organization names to filter by filters incidentreso array optional 0=none, 1=open, 2=truepositive, 3=falsepositive, 4=inprogress start number optional parameter for fetch incidents size number optional parameter for fetch incidents timefrom number optional parameter for fetch incidents timeto number optional parameter for fetch incidents orderby string optional parameter for fetch incidents descending boolean optional parameter for fetch incidents fields array optional parameter for fetch incidents input example {"json body" {"filters" {"incidentstatus" \[0],"incidentid" \[8064]},"start" 0,"size" 500,"timefrom" 1620677781736,"timeto" 1620684981736,"orderby" "incidentlastseen","descending"\ true,"fields" \["eventseveritycat","eventseverity","incidentlastseen","incidentfirstseen","eventtype","eventname","incidentsrc","incidenttarget","incidentdetail","incidentrptip","incidentrptdevname","incidentstatus","incidentcomments","customer","incidentclearedreason","incidentclearedtime","incidentcleareduser","count","incidentid","incidentsrc","incidenttarget","incidentextuser","incidentextclearedtime","incidentextticketid","incidentextticketstate","incidentexttickettype","incidentreso","phincidentcategory","phsubincidentcategory","incidenttitle","attacktechnique","attacktactic"]}} output parameter type description status code number http status code of the response reason string response reason phrase total number total number of incidents matched in the query pages number total number of pages to paginate over, includes the first page start number starting object index of the range in this page of events sizeperpage number number of incidents returned per page of the query queryid string query id used for paginating subsequent requests beyond the first page data array response data data incidenttitle string response data data eventseverity number response data data incidentfirstseen number response data data incidentreso number response data data incidentrptip string response data data incidentlastseen number response data data incidentsrc string response data data count number response data data attacktechnique string response data data eventtype string response data data phincidentcategory number response data data incidentclearedtime number response data data incidenttarget string response data data attacktactic string response data data eventseveritycat string response data data incidentdetail string response data data incidentrptdevname string response data output example {"status code" 200,"reason" "ok","json body" {"total" 317,"pages" 2,"start" 0,"sizeperpage" 10,"queryid" "pub inc query 81 1684452618294","data" \[{}]}} get all agent status retrieve the status of all linux and windows agents from fortinet fortisiem with support for pagination, organization filtering, and specific agent hostname selection endpoint url /phoenix/rest/agentstatus/v3/all method post input argument name type required description query parameters start number required pagination offset start at 0 and increment by size until start + size >= count query parameters size number optional number of agents to return per page must be between 1 and 2000 defaults to 2000 if not specified input example {"json body" \[{"orgname" "super","agents" \["host1 example com","host2 example com"]}],"query parameters" {"start" 0,"size" 2000}} output parameter type description status code number http status code of the response reason string response reason phrase start number the offset used in this page of the paginated query count number total number of agents across all pages iterate until start + size >= count agents array output field agents agents orgname string name of the resource agents hostname string name of the resource agents ip string output field agents ip agents agenttype string type of the resource agents agentstatus number status value agents devicetype string type of the resource agents agentversion string output field agents agentversion agents policyid number unique identifier agents lastheartbeattime number time value agents lasteventreceivetime number time value output example {"status code" 200,"reason" "ok","json body" {"start" 0,"count" 540,"agents" \[{}]}} get incident by id retrieve detailed information for a specific incident in fortinet fortisiem using the provided incident id endpoint url /phoenix/rest/query/eventquery method post input argument name type required description parameters incidentid string required parameters for the get incident by id action parameters timeout mins number optional parameters for the get incident by id action parameters minutes ago string optional parameters for the get incident by id action parameters get query id boolean optional parameters for the get incident by id action input example {"parameters" {"incidentid" "8064","timeout mins" 10,"minutes ago" "524160","get query id"\ false}} output parameter type description status code number http status code of the response reason string response reason phrase queryid string unique identifier output example {"status code" 200,"reason" "ok","json body" {"queryid" "12345"}} get incidents by query id retrieve paginated incident query results from fortinet fortisiem using queryid, offset, and limit, and parse totalcount to determine the number of required api calls endpoint url /phoenix/rest/query/events/{{queryid}}/{{offset}}/{{limit}} method get input argument name type required description path parameters queryid string required the query id returned from the submit query with xml (eventquery) post call path parameters offset number required first object index to return start at 0, then increment by limit + 1 for each subsequent call path parameters limit number required number of objects to retrieve per page input example {"path parameters" {"queryid" "10277","offset" 0,"limit" 1000}} output parameter type description status code number http status code of the response reason string response reason phrase result object result of the operation result requestid number unique identifier result timestamp number epoch milliseconds when the response was generated result error object result of the operation result error code number 0 indicates no error, any other value is an error code result queryresult object result of the operation result queryresult queryid string unique identifier result queryresult start number the offset used in this page of results result queryresult totalcount number total number of matching events use to calculate pagination stop when totalcount currentoffset < limit result queryresult events array array of event objects returned for this page output example {"status code" 200,"reason" "ok","json body" {"result" {"requestid" 10277,"timestamp" 1683849950912,"error" {},"queryresult" {}}}} get query progress retrieve the current progress of a previously submitted event query in fortinet fortisiem using the provided query id endpoint url /phoenix/rest/query/progress/{{query id}} method get input argument name type required description path parameters query id string required the requestid,expiretime values retrieved from an eventquery response, in the format "requestid,expiretime" (e g "16761,1698294671787") input example {"path parameters" {"query id" "16761,1698294671787"}} output parameter type description status code number http status code of the response reason string response reason phrase xml body object request body data xml body requestid integer request body data xml body timestamp integer request body data xml body result object request body data xml body result error object request body data xml body result error code string request body data xml body result expiretime integer request body data xml body result progress integer percent completion of the query (0 100) output example {"status code" 200,"reason" "ok","xml body" {"requestid" 10649,"timestamp" 1674166342394,"result" {"expiretime" 1674184342315,"progress" 75}}} get triggering events progress retrieve the progress percentage (0 100) of a triggering event query in fortinet fortisiem using the provided queryid endpoint url /phoenix/rest/pub/incident/triggeringevents/progress/{{queryid}} method get input argument name type required description path parameters queryid string required query id returned from get triggering events start input example {"path parameters" {"queryid" "14262"}} output parameter type description status code number http status code of the response reason string response reason phrase output example {"status code" 200,"reason" "ok","json body" 100} get triggering events result retrieve raw triggering events associated with a specified query id in fortinet fortisiem once the query progress reaches 100% endpoint url /phoenix/rest/pub/incident/triggeringevents/result/{{queryid}} method get input argument name type required description path parameters queryid string required query id returned from get triggering events start query parameters size number optional optional number of raw events to return default is 10, max is 100 input example {"path parameters" {"queryid" "14262"},"query parameters" {"size" 20}} output parameter type description status code number http status code of the response reason string response reason phrase data array raw events tied to the incident data custid number response data data index number response data data id string response data data eventtype string response data data receivetime number response data data rawmessage string response data data nid string response data data attributes object response data data eventattributes array response data data datastr string response data output example {"status code" 200,"reason" "ok","json body" {"data" \[]}} get triggering events start initiate a request to retrieve triggering events for an incident in fortinet fortisiem and receive a queryid for tracking progress and results endpoint url /phoenix/rest/pub/incident/triggeringevents/start method get input argument name type required description query parameters incidentid number required the incident id for which underlying events are retrieved query parameters timefrom number required start of the raw event search window in epoch milliseconds the max interval between timefrom and timeto cannot exceed 24 hours query parameters timeto number required end of the raw event search window in epoch milliseconds the max interval between timefrom and timeto cannot exceed 24 hours query parameters size number optional optional number of raw events to return default is 10, max is 100 input example {"query parameters" {"incidentid" 123456,"timefrom" 1685985216000,"timeto" 1685985215000,"size" 20}} output parameter type description status code number http status code of the response reason string response reason phrase queryid string query id used in get triggering events progress and get triggering events result output example {"status code" 200,"reason" "ok","json body" {"queryid" "14262"}} query cmdb devices retrieve a paginated list of devices from the fortinet fortisiem cmdb using optional filters and display fields, with start and size parameters for pagination endpoint url /phoenix/rest/pub/device method post input argument name type required description start number optional offset for pagination start at 0 and increment by size until all records are retrieved size number optional number of records per page defaults to 50 custid number optional organization id to filter by optional, for super user only lastmodifiedtime number optional only return devices modified after this timestamp in epoch ms filter object optional key value filter pairs must be used together with fields filter name string optional name of the resource filter accessip string optional parameter for query cmdb devices filter devicetype vendor string optional type of the resource filter devicetype model string optional type of the resource filter status string optional filter by cmdb device status use integer 0 3 when filtering filter discovermethod string optional http method to use filter policyname string optional name of the resource filter devicestatus agentstatus string optional status value filter agenttype number optional 0=linux, 1=windows, 2=windows+ueba, 3=ueba only filter agentversion string optional parameter for query cmdb devices filter description string optional parameter for query cmdb devices filter devicestatus eventstatus string optional status value filter location string optional parameter for query cmdb devices filter devicestatus monitorstatus string optional status value filter eventparserlist name string optional name of the resource filter purduelevel number optional parameter for query cmdb devices filter devicetag string optional parameter for query cmdb devices fields array optional fields to include in response id must always be included if omitted, default fields are returned input example {"json body" {"start" 0,"size" 50,"filter" {"status" "pending","devicetype model" "fortios"},"fields" \["id","name","accessip","status","discovermethod","riskscore","lastmodifiedtime"]}} output parameter type description status code number http status code of the response reason string response reason phrase total number total number of matching cmdb devices across all pages data array response data data id number response data data name string response data data naturalid string response data data vmname string response data data appname string response data data processname string response data data version string response data data hwvendor string response data data hwmodel string response data data hwserialnum string response data data description string response data data accessip string response data data assetcategory string response data data importance string response data data discoveragent string response data data discovertime number response data data discovermethod string response data data creationmethod string response data data updatemethod string response data data eventcollectmethod string response data data systemuptime number response data output example {"status code" 200,"reason" "ok","json body" {"total" 120,"data" \[{}]}} submit query with xml submit an xml report query to fortinet fortisiem and receive a requestid and expiretime for use in subsequent progress and results api calls endpoint url /phoenix/rest/query/eventquery method post input argument name type required description xml body string required fortisiem report xml populate reportinterval low and high with epoch seconds (10 digits) for the query time range input example {"xml body" "\<reports>\n \<report baseline=\\"\\" rssync=\\"\\">\n \<name>all security and change incidents\</name>\n \<customerscope>\n \<include all=\\"true\\"/>\n \<exclude/>\n \</customerscope>\n \<selectclause>\n \<attrlist>phrecvtime,reptdevipaddr,eventtype\</attrlist>\n \</selectclause>\n \<reportinterval>\n \<low>1674166342\</low>\n \<high>1674184342\</high>\n \</reportinterval>\n \</report>\n\</reports>\n"} output parameter type description status code number http status code of the response reason string response reason phrase requestid number query id to use in progress and results api calls timestamp number epoch milliseconds when the query was submitted result object result of the operation result error object result of the operation result error code number 0 indicates no error, any other value is an error code result expiretime number epoch ms expiry use with requestid for progress url e g /progress/ , output example {"status code" 200,"reason" "ok","json body" {"requestid" 10649,"timestamp" 1674166342394,"result" {"error" {},"expiretime" 1674184342315}}} update incident update an existing incident in fortinet fortisiem using the specified incident id and modify only the desired attributes endpoint url /phoenix/rest/pub/incident/update/{{incidentid}} method post input argument name type required description path parameters incidentid string required the id of the incident to update required in the url path incidentid number optional required in the json body must match the path parameter incidentstatus number optional 0=active, 1=auto cleared, 2=manually cleared, 3=system cleared incidentseverity string optional possible values low, medium, high incidentextuser string optional the user as defined in the external ticketing system incidentextclearedtime number optional cleared time in the external ticketing system in epoch millis incidentextticketid string optional ticket id as defined in the external system incidentextticketstate string optional state of the case as defined in the external system incidentexttickettype string optional external ticket system ticket type comments string optional investigation notes to be added to this individual incident input example {"json body" {"incidentid" 8064,"incidentstatus" 2,"incidentseverity" "high","incidentextuser" "user a","incidentextclearedtime" 1620677781736,"incidentextticketid" "ins00456","incidentextticketstate" "closed","incidentexttickettype" "incident","comments" "soc team investigated and closed this incident "},"path parameters" {"incidentid" "8064"}} output parameter type description status code number http status code of the response reason string response reason phrase text body string returns success on successful update output example {"status code" 200,"reason" "ok","text body" "success"} update incident external update a specific incident in fortinet fortisiem by providing the incidentid and updated details in the json body endpoint url /phoenix/rest/incident/external method post input argument name type required description incidentid number optional this is the unique incident id for this individual incident severity number optional integer severity 1 10 (1 4 low, 5 8 medium, 9 10 high) resolution number optional integer resolution code (0 4) incidentstatus number optional integer status code (0 3) externalassigneduser string optional the user as defined in the external ticketing system externalcleartime number optional the cleared time as defined in the external ticketing system, in epoch millis externalticketid string optional this is the ticket id as defined in the external system externalticketstate string optional this is the state of the case as defined in external system externaltickettype string optional external ticket system ticket type playbook string optional this is the playbook that was executed on the incident comments string optional investigation notes to be added to this individual incident input example {"json body" {"incidentid" 22,"severity" 9,"resolution" 1,"incidentstatus" 0,"externalassigneduser" "myuser","externalcleartime" 1683595260000,"externalticketid" 12345,"externalticketstate" "closed","externaltickettype" "incident","playbook" "blockiocs","comments" "this is a test comment"}} output parameter type description status code number http status code of the response reason string response reason phrase text body string returns ok on successful update output example {"status code" 200,"reason" "ok","text body" "ok"} response headers header description example content type the media type of the resource application/json date the date and time at which the message was originated thu, 01 jan 2024 00 00 00 gmt