Fortinet FortiSIEM

Fortinet FortiSIEM provides centralized security monitoring, event correlation, and automated incident response across hybrid IT infrastructures.

Fortinet FortiSIEM is an advanced security information and event management (SIEM) platform that unifies security monitoring, incident response, and device management across complex environments. This connector enables Swimlane Turbine users to automate the retrieval, enrichment, and updating of security incidents, monitor agent and device status, and orchestrate incident response workflows directly with FortiSIEM. By integrating FortiSIEM with Swimlane Turbine, security teams can streamline incident lifecycle management, accelerate investigations, and ensure comprehensive visibility and control over their security operations—all without writing code. This integration empowers organizations to respond faster to threats, reduce manual effort, and maximize the value of their SIEM investment.

Prerequisites

Before using the Fortinet FortiSIEM connector, ensure you have the following prerequisites in place:

HTTP Basic Authentication setup, requiring:

URL: The base URL of your FortiSIEM instance.

Username: A valid FortiSIEM user account with appropriate API permissions.

Password: The password associated with the specified username.

API Token Authentication configured, requiring:

URL: The base URL of your FortiSIEM instance.

Access Token: An OAuth Bearer token generated from the FortiSIEM GUI (Admin > Settings > System > API Token).

Capabilities

This Connector provides the following capabilities:

Fetch Incidents

Get All Agent Status

Get Incident by ID

Get Incidents by Query ID

Get Query Progress

Get Triggering Events Start

Get Triggering Events Progress

Get Triggering Events Result

Query CMDB Devices

Submit Query with XML

Update Incident

Update Incident External

Notes

For more information on FortiSIEM: FortiSIEM Main Site

API Documentation Link

FortiSIEM API Documentation Link

Additional Documentation

Fortinet FortiSIEM Connector Documentation

Fortinet FortiSIEM API Documentation

Fortinet FortiSIEM Authentication Guide

Configurations

API Token Authentication

Authenticates using an OAuth Bearer token generated from the FortiSIEM GUI (Admin > Settings > System > API Token).

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
access_token	OAuth Bearer access token generated from the FortiSIEM GUI.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Fetch Incidents

Retrieve incidents from the Fortinet FortiSIEM database within a specified time range using 'timeFrom' and 'timeTo' parameters.

Endpoint

URL: /phoenix/rest/pub/incident

Method: POST

Input

Argument Name	Type	Required	Description
filters	object	Optional	Parameter for Fetch Incidents
filters.incidentId	array	Optional	Array of specific incident IDs to filter by
filters.incidentStatus	array	Optional	0=Active, 1=Auto Cleared, 2=Manually Cleared, 3=System Cleared
filters.eventSeverity	array	Optional	Severity level 1-10, e.g. [1,2,3,4]
filters.eventSeverityCat	array	Optional	Possible values: LOW, MEDIUM, HIGH
filters.phIncidentCategory	array	Optional	1=Availability, 2=Performance, 3=Change, 4=Security, 5=Other
filters.phCustId	array	Optional	Array of organization IDs to filter by
filters.customer	array	Optional	Array of customer/organization names to filter by
filters.incidentReso	array	Optional	0=None, 1=Open, 2=TruePositive, 3=FalsePositive, 4=InProgress
start	number	Optional	Parameter for Fetch Incidents
size	number	Optional	Parameter for Fetch Incidents
timeFrom	number	Optional	Parameter for Fetch Incidents
timeTo	number	Optional	Parameter for Fetch Incidents
orderBy	string	Optional	Parameter for Fetch Incidents
descending	boolean	Optional	Parameter for Fetch Incidents
fields	array	Optional	Parameter for Fetch Incidents

Input Example

{"json_body":{"filters":{"incidentStatus":[0],"incidentId":[8064]},"start":0,"size":500,"timeFrom":1620677781736,"timeTo":1620684981736,"orderBy":"incidentLastSeen","descending":true,"fields":["eventSeverityCat","eventSeverity","incidentLastSeen","incidentFirstSeen","eventType","eventName","incidentSrc","incidentTarget","incidentDetail","incidentRptIp","incidentRptDevName","incidentStatus","incidentComments","customer","incidentClearedReason","incidentClearedTime","incidentClearedUser","count","incidentId","incidentSrc","incidentTarget","incidentExtUser","incidentExtClearedTime","incidentExtTicketId","incidentExtTicketState","incidentExtTicketType","incidentReso","phIncidentCategory","phSubIncidentCategory","incidentTitle","attackTechnique","attackTactic"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Total number of incidents matched in the query
pages	number	Total number of pages to paginate over, includes the first page
start	number	Starting object index of the range in this page of events
sizePerPage	number	Number of incidents returned per page of the query
queryId	string	Query ID used for paginating subsequent requests beyond the first page
data	array	Response data
data.incidentTitle	string	Response data
data.eventSeverity	number	Response data
data.incidentFirstSeen	number	Response data
data.incidentReso	number	Response data
data.incidentRptIp	string	Response data
data.incidentLastSeen	number	Response data
data.incidentSrc	string	Response data
data.count	number	Response data
data.attackTechnique	string	Response data
data.eventType	string	Response data
data.phIncidentCategory	number	Response data
data.incidentClearedTime	number	Response data
data.incidentTarget	string	Response data
data.attackTactic	string	Response data
data.eventSeverityCat	string	Response data
data.incidentDetail	string	Response data
data.incidentRptDevName	string	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"total":317,"pages":2,"start":0,"sizePerPage":10,"queryId":"pub_inc_query_81_1684452618294","data":[{}]}}

Get All Agent Status

Retrieve the status of all Linux and Windows agents from Fortinet FortiSIEM with support for pagination, organization filtering, and specific agent hostname selection.

Endpoint

URL: /phoenix/rest/agentStatus/v3/all

Method: POST

Input

Argument Name	Type	Required	Description
query_parameters.start	number	Required	Pagination offset. Start at 0 and increment by size until start + size >= count.
query_parameters.size	number	Optional	Number of agents to return per page. Must be between 1 and 2000. Defaults to 2000 if not specified.

Input Example

{"json_body":[{"orgName":"super","agents":["host1.example.com","host2.example.com"]}],"query_parameters":{"start":0,"size":2000}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
start	number	The offset used in this page of the paginated query
count	number	Total number of agents across all pages. Iterate until start + size >= count.
agents	array	Output field: agents
agents.orgName	string	Name of the resource
agents.hostName	string	Name of the resource
agents.ip	string	Output field: agents.ip
agents.agentType	string	Type of the resource
agents.agentStatus	number	Status value
agents.deviceType	string	Type of the resource
agents.agentVersion	string	Output field: agents.agentVersion
agents.policyId	number	Unique identifier
agents.lastHeartBeatTime	number	Time value
agents.lastEventReceiveTime	number	Time value

Output Example

{"status_code":200,"reason":"OK","json_body":{"start":0,"count":540,"agents":[{}]}}

Get Incident by ID

Retrieve detailed information for a specific incident in Fortinet FortiSIEM using the provided Incident ID.

Endpoint

URL: /phoenix/rest/query/eventQuery

Method: POST

Input

Argument Name	Type	Required	Description
parameters.incidentId	string	Required	Parameters for the Get Incident by ID action
parameters.timeout_mins	number	Optional	Parameters for the Get Incident by ID action
parameters.minutes_ago	string	Optional	Parameters for the Get Incident by ID action
parameters.get_query_id	boolean	Optional	Parameters for the Get Incident by ID action

Input Example

{"parameters":{"incidentId":"8064","timeout_mins":10,"minutes_ago":"524160","get_query_id":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
queryId	string	Unique identifier

Output Example

{"status_code":200,"reason":"OK","json_body":{"queryId":"12345"}}

Get Incidents by Query ID

Retrieve paginated incident query results from Fortinet FortiSIEM using queryId, offset, and limit, and parse totalCount to determine the number of required API calls.

Endpoint

URL: /phoenix/rest/query/events/{{queryId}}/{{offset}}/{{limit}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.queryId	string	Required	The query ID returned from the submit_query_with_xml (eventQuery) POST call.
path_parameters.offset	number	Required	First object index to return. Start at 0, then increment by limit + 1 for each subsequent call.
path_parameters.limit	number	Required	Number of objects to retrieve per page.

Input Example

{"path_parameters":{"queryId":"10277","offset":0,"limit":1000}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
result	object	Result of the operation
result.requestId	number	Unique identifier
result.timestamp	number	Epoch milliseconds when the response was generated.
result.error	object	Result of the operation
result.error.code	number	0 indicates no error, any other value is an error code.
result.queryResult	object	Result of the operation
result.queryResult.queryId	string	Unique identifier
result.queryResult.start	number	The offset used in this page of results.
result.queryResult.totalCount	number	Total number of matching events. Use to calculate pagination - stop when totalCount - currentOffset < limit.
result.queryResult.events	array	Array of event objects returned for this page.

Output Example

{"status_code":200,"reason":"OK","json_body":{"result":{"requestId":10277,"timestamp":1683849950912,"error":{},"queryResult":{}}}}

Get Query Progress

Retrieve the current progress of a previously submitted event query in Fortinet FortiSIEM using the provided query ID.

Endpoint

URL: /phoenix/rest/query/progress/{{query_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.query_id	string	Required	The requestId,expireTime values retrieved from an eventQuery response, in the format "requestId,expireTime" (e.g. "16761,1698294671787").

Input Example

{"path_parameters":{"query_id":"16761,1698294671787"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
xml_body	object	Request body data
xml_body.requestId	integer	Request body data
xml_body.timestamp	integer	Request body data
xml_body.result	object	Request body data
xml_body.result.error	object	Request body data
xml_body.result.error.code	string	Request body data
xml_body.result.expireTime	integer	Request body data
xml_body.result.progress	integer	Percent completion of the query (0-100).

Output Example

{"status_code":200,"reason":"OK","xml_body":{"requestId":10649,"timestamp":1674166342394,"result":{"expireTime":1674184342315,"progress":75}}}

Get Triggering Events Progress

Retrieve the progress percentage (0-100) of a triggering event query in Fortinet FortiSIEM using the provided queryId.

Endpoint

URL: /phoenix/rest/pub/incident/triggeringEvents/progress/{{queryId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.queryId	string	Required	Query ID returned from get_triggering_events_start.

Input Example

{"path_parameters":{"queryId":"14262"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"reason":"OK","json_body":100}

Get Triggering Events Result

Retrieve raw triggering events associated with a specified query ID in Fortinet FortiSIEM once the query progress reaches 100%.

Endpoint

URL: /phoenix/rest/pub/incident/triggeringEvents/result/{{queryId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.queryId	string	Required	Query ID returned from get_triggering_events_start.
query_parameters.size	number	Optional	Optional number of raw events to return. Default is 10, max is 100.

Input Example

{"path_parameters":{"queryId":"14262"},"query_parameters":{"size":20}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Raw events tied to the incident.
data.custId	number	Response data
data.index	number	Response data
data.id	string	Response data
data.eventType	string	Response data
data.receiveTime	number	Response data
data.rawMessage	string	Response data
data.nid	string	Response data
data.attributes	object	Response data
data.eventAttributes	array	Response data
data.dataStr	string	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"data":[]}}

Get Triggering Events Start

Initiate a request to retrieve triggering events for an incident in Fortinet FortiSIEM and receive a queryId for tracking progress and results.

Endpoint

URL: /phoenix/rest/pub/incident/triggeringEvents/start

Method: GET

Input

Argument Name	Type	Required	Description
query_parameters.incidentId	number	Required	The incident ID for which underlying events are retrieved.
query_parameters.timeFrom	number	Required	Start of the raw-event search window in epoch milliseconds. The max interval between timeFrom and timeTo cannot exceed 24 hours.
query_parameters.timeTo	number	Required	End of the raw-event search window in epoch milliseconds. The max interval between timeFrom and timeTo cannot exceed 24 hours.
query_parameters.size	number	Optional	Optional number of raw events to return. Default is 10, max is 100.

Input Example

{"query_parameters":{"incidentId":123456,"timeFrom":1685985216000,"timeTo":1685985215000,"size":20}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
queryId	string	Query ID used in get_triggering_events_progress and get_triggering_events_result.

Output Example

{"status_code":200,"reason":"OK","json_body":{"queryId":"14262"}}

Query CMDB Devices

Retrieve a paginated list of devices from the Fortinet FortiSIEM CMDB using optional filters and display fields, with start and size parameters for pagination.

Endpoint

URL: /phoenix/rest/pub/device

Method: POST

Input

Argument Name	Type	Required	Description
start	number	Optional	Offset for pagination. Start at 0 and increment by size until all records are retrieved.
size	number	Optional	Number of records per page. Defaults to 50.
custId	number	Optional	Organization ID to filter by. Optional, for super user only.
lastModifiedTime	number	Optional	Only return devices modified after this timestamp in epoch ms.
filter	object	Optional	Key-value filter pairs. Must be used together with fields.
filter.name	string	Optional	Name of the resource
filter.accessIp	string	Optional	Parameter for Query CMDB Devices
filter.deviceType.vendor	string	Optional	Type of the resource
filter.deviceType.model	string	Optional	Type of the resource
filter.status	string	Optional	Filter by CMDB device status. Use integer 0-3 when filtering.
filter.discoverMethod	string	Optional	HTTP method to use
filter.policyName	string	Optional	Name of the resource
filter.deviceStatus.agentStatus	string	Optional	Status value
filter.agentType	number	Optional	0=LINUX, 1=WINDOWS, 2=WINDOWS+UEBA, 3=UEBA_ONLY
filter.agentVersion	string	Optional	Parameter for Query CMDB Devices
filter.description	string	Optional	Parameter for Query CMDB Devices
filter.deviceStatus.eventStatus	string	Optional	Status value
filter.location	string	Optional	Parameter for Query CMDB Devices
filter.deviceStatus.monitorStatus	string	Optional	Status value
filter.eventParserList.name	string	Optional	Name of the resource
filter.purdueLevel	number	Optional	Parameter for Query CMDB Devices
filter.deviceTag	string	Optional	Parameter for Query CMDB Devices
fields	array	Optional	Fields to include in response. id must always be included. If omitted, default fields are returned.

Input Example

{"json_body":{"start":0,"size":50,"filter":{"status":"Pending","deviceType.model":"FortiOS"},"fields":["id","name","accessIp","status","discoverMethod","riskScore","lastModifiedTime"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Total number of matching CMDB devices across all pages
data	array	Response data
data.id	number	Response data
data.name	string	Response data
data.naturalId	string	Response data
data.vmName	string	Response data
data.appName	string	Response data
data.processName	string	Response data
data.version	string	Response data
data.hwVendor	string	Response data
data.hwModel	string	Response data
data.hwSerialNum	string	Response data
data.description	string	Response data
data.accessIp	string	Response data
data.assetCategory	string	Response data
data.importance	string	Response data
data.discoverAgent	string	Response data
data.discoverTime	number	Response data
data.discoverMethod	string	Response data
data.creationMethod	string	Response data
data.updateMethod	string	Response data
data.eventCollectMethod	string	Response data
data.systemUpTime	number	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"total":120,"data":[{}]}}

Submit Query with XML

Submit an XML report query to Fortinet FortiSIEM and receive a requestId and expireTime for use in subsequent progress and results API calls.

Endpoint

URL: /phoenix/rest/query/eventQuery

Method: POST

Input

Argument Name	Type	Required	Description
xml_body	string	Required	FortiSIEM Report XML. Populate ReportInterval Low and High with epoch seconds (10 digits) for the query time range.

Input Example

{"xml_body":"<Reports>\n <Report baseline=\"\" rsSync=\"\">\n <Name>All Security and Change Incidents</Name>\n <CustomerScope>\n <Include all=\"true\"/>\n <Exclude/>\n </CustomerScope>\n <SelectClause>\n <AttrList>phRecvTime,reptDevIpAddr,eventType</AttrList>\n </SelectClause>\n <ReportInterval>\n <Low>1674166342</Low>\n <High>1674184342</High>\n </ReportInterval>\n </Report>\n</Reports>\n"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
requestId	number	Query ID to use in progress and results API calls.
timestamp	number	Epoch milliseconds when the query was submitted.
result	object	Result of the operation
result.error	object	Result of the operation
result.error.code	number	0 indicates no error, any other value is an error code.
result.expireTime	number	Epoch ms expiry. Use with requestId for progress URL e.g. /progress/,.

Output Example

{"status_code":200,"reason":"OK","json_body":{"requestId":10649,"timestamp":1674166342394,"result":{"error":{},"expireTime":1674184342315}}}

Update Incident

Update an existing incident in Fortinet FortiSIEM using the specified incident ID and modify only the desired attributes.

Endpoint

URL: /phoenix/rest/pub/incident/update/{{incidentId}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.incidentId	string	Required	The ID of the incident to update. Required in the URL path.
incidentId	number	Optional	Required in the JSON body. Must match the path parameter.
incidentStatus	number	Optional	0=Active, 1=Auto Cleared, 2=Manually Cleared, 3=System Cleared
incidentSeverity	string	Optional	Possible values: LOW, MEDIUM, HIGH
incidentExtUser	string	Optional	The user as defined in the external ticketing system.
incidentExtClearedTime	number	Optional	Cleared time in the external ticketing system in epoch millis.
incidentExtTicketId	string	Optional	Ticket ID as defined in the external system.
incidentExtTicketState	string	Optional	State of the case as defined in the external system.
incidentExtTicketType	string	Optional	External ticket system ticket type.
comments	string	Optional	Investigation notes to be added to this individual incident.

Input Example

{"json_body":{"incidentId":8064,"incidentStatus":2,"incidentSeverity":"HIGH","incidentExtUser":"User A","incidentExtClearedTime":1620677781736,"incidentExtTicketId":"INS00456","incidentExtTicketState":"Closed","incidentExtTicketType":"Incident","comments":"SOC team investigated and closed this incident."},"path_parameters":{"incidentId":"8064"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
text_body	string	Returns SUCCESS on successful update.

Output Example

{"status_code":200,"reason":"OK","text_body":"SUCCESS"}

Update Incident External

Update a specific incident in Fortinet FortiSIEM by providing the incidentId and updated details in the JSON body.

Endpoint

URL: /phoenix/rest/incident/external

Method: POST

Input

Argument Name	Type	Required	Description
incidentId	number	Optional	This is the unique incident ID for this individual incident.
severity	number	Optional	Integer severity 1-10 (1-4 low, 5-8 medium, 9-10 high).
resolution	number	Optional	Integer resolution code (0-4).
incidentStatus	number	Optional	Integer status code (0-3).
externalAssignedUser	string	Optional	The user as defined in the external ticketing system.
externalClearTime	number	Optional	The cleared time as defined in the external ticketing system, in epoch millis
externalTicketId	string	Optional	This is the ticket ID as defined in the external system.
externalTicketState	string	Optional	This is the state of the case as defined in external system.
externalTicketType	string	Optional	External ticket system ticket type.
playbook	string	Optional	This is the playbook that was executed on the incident.
comments	string	Optional	Investigation notes to be added to this individual incident.

Input Example

{"json_body":{"incidentId":22,"severity":9,"resolution":1,"incidentStatus":0,"externalAssignedUser":"MyUser","externalClearTime":1683595260000,"externalTicketId":12345,"externalTicketState":"CLOSED","externalTicketType":"Incident","playbook":"BlockIOCs","comments":"This is a test comment"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
text_body	string	Returns OK on successful update.

Output Example

{"status_code":200,"reason":"OK","text_body":"OK"}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT