--- title: Fortinet FortiSIEM v7 slug: connectors/fortinet-fortisiem-v7 docTags: createdAt: 2026-06-09T16:30:24.645Z --- Fortinet FortiSIEM is a robust SIEM solution that provides real-time monitoring and threat detection across IT environments. Fortinet FortiSIEM is a comprehensive security information and event management (SIEM) solution that provides real-time visibility and analytics for security operations. This connector enables seamless integration with Swimlane Turbine, allowing users to automate SIEM operations such as incident management, watchlist management, and device monitoring. By leveraging this integration, Swimlane Turbine users can enhance their security posture through automated incident retrieval, watchlist updates, and device information management, ultimately improving response times and operational efficiency. ## Prerequisites Before you can use the Fortinet FortiSIEM v7 connector for Turbine, you'll need access to the Fortinet FortiSIEM API. This requires the following: - HTTP Basic authentication using the following parameters: - URL: The endpoint URL for accessing Fortinet FortiSIEM services. - Username: Your Fortinet FortiSIEM account username. - Password: The password associated with your Fortinet FortiSIEM account. ## Capabilities This Connector provides the following capabilities: - Add Watch List - Add Watch List Entry - Delete Watch List by ID - Delete Watch List Entry by ID - Fetch Incidents by Filters - Get Agent Status by Host - Get All Watch Lists - Get Device Information - Get Devices - Get Event Query Progress by ID - Get Incident by Incident ID - Get Incidents by Query ID - Get List of Monitored Organizations - Get Watch List by Watch List Entry ID - Get Watch List by Watch List ID *... and so on* ## Notes This connector was developed against product version: 7.1.3 ## API Documentation Link [FortiSIEM API Documentation Link](https://fndn.fortinet.net/index.php?/fortiapi/2627-FortiSIEM/3790/) ## Additional Documentation - [Fortinet FortiSIEM v7 Connector Documentation](https://docs.swimlane.com/connectors/fortinet-fortisiem-v7) - [Fortinet FortiSIEM v7 API Documentation](https://fndn.fortinet.net/index.php?/fortiapi/5-fortisiem/) # Configurations ## Fortinet FortiSIEM V7 HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | -------------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | The username is in the format of \. | string | Required | | password | Password | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Watch List Create a new watchlist with specified entries in Fortinet FortiSIEM for enhanced monitoring. ### Endpoint - **URL:** `/phoenix/rest/watchlist/save` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ---------------------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `response` | array | Output field: response | | `response.id` | number | Unique identifier | | `response.naturalId` | string | Unique identifier | | `response.displayName` | string | Name of the resource | | `response.description` | string | Output field: response.description | | `response.valuePattern` | string | Value for the parameter | | `response.ageOut` | string | Output field: response.ageOut | | `response.topGroup` | boolean | Output field: response.topGroup | | `response.entries` | array | Output field: response.entries | | `response.entries.id` | number | Unique identifier | | `response.entries.firstSeen` | number | Output field: response.entries.firstSeen | | `response.entries.lastSeen` | number | Output field: response.entries.lastSeen | | `response.entries.expiredTime` | number | Time value | | `response.entries.state` | string | Output field: response.entries.state | | `response.entries.naturalId` | string | Unique identifier | | `response.entries.triggeringRules` | string | Output field: response.entries.triggeringRules | | `response.entries.entryValue` | string | Value for the parameter | | `response.entries.description` | string | Output field: response.entries.description | | `response.entries.ageOut` | string | Output field: response.entries.ageOut | | `response.entries.count` | number | Count value | | `response.entries.dataCreationType` | number | Response data | ### Output Example `{"json_body":{"response":[{}]},"reason":"OK","response_headers":{},"status_code":200}` ## Add Watch List Entry Add entries to a specified watchlist in Fortinet FortiSIEM, enhancing monitoring and alerting capabilities. Requires parameters and watchlistId. ### Endpoint - **URL:** `/phoenix/rest/watchlist/addTo` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------- | | `parameters.watchlistId` | number | Required | This is the ID field of a watchlist, that contains the watchlist where the posted entries should be added to. | ### Input Example `{"parameters":{"watchlistId":1},"json_body":[{"entryValue":"myhost.example.com","firstSeen":1613601369215,"lastSeen":1613601369215,"expiredTime":1613601369215,"state":"Enabled","description":"Description of entry","ageOut":"1d","count":10}]}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `response` | string | Output field: response | | `status` | string | Status value | ### Output Example `{"json_body":{"response":"Successfully added to watch list - [IDs]","status":"Success"},"reason":"OK","response_headers":{},"status_code":200}` ## Delete Watch List by ID Remove specified watchlists from FortiSIEM using their unique entry IDs. Requires JSON body input. ### Endpoint - **URL:** `/phoenix/rest/watchlist/delete` - **Method:** `DELETE` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `response` | string | Output field: response | | `status` | string | Status value | ### Output Example `{"json_body":{"response":"Deleted watch lists - [IDs]","status":"Success"},"reason":"OK","response_headers":{},"status_code":200}` ## Delete Watch List Entry by ID Remove specified entries from a watchlist in Fortinet FortiSIEM v7 using their unique IDs. Requires JSON body input. ### Endpoint - **URL:** `/phoenix/rest/watchlist/entry/delete` - **Method:** `DELETE` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `response` | string | Output field: response | | `status` | string | Status value | ### Output Example `{"json_body":{"response":"Deleted entries - [IDs]","status":"Success"},"reason":"OK","response_headers":{},"status_code":200}` ## Fetch Incidents by Filters Retrieve incidents from Fortinet FortiSIEM v7 using time or incidentID filters with specific options and fields. ### Endpoint - **URL:** `/phoenix/rest/pub/incident` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `filters` | object | Optional | Parameter for Fetch Incidents by Filters | | `filters.incidentId` | array | Optional | This is an array of integers representing specific incident ID's to filter by. | | `filters.incidentStatus` | array | Optional | Incident statuses. 0 - Active Incidents, 1 - Auto Cleared Incidents, 2 - Manually Cleared Incidents, 3 - System Cleared Incidents. | | `filters.eventSeverity` | array | Optional | Possible values are from 1-10. To specify 1-4, provide an array such as \[1,2,3,4]. | | `filters.eventSeverityCat` | array | Optional | Possible values are LOW, MEDIUM, HIGH. To specify more than one, provide an array such as \["LOW","HIGH"]. | | `filters.phIncidentCategory` | array | Optional | Possible values are from 1-5. 1 = Availability Incidents, 2 = Performance Incidents, 3 = Change Incidents, 4 = Security Incidents, 5 = Other Incidents. To specify more than one, supply an array such as \[3,4,5] (Security, Change, and Other). | | `filters.phCustId` | array | Optional | This filter accepts an array of organization ID's. | | `filters.customer` | array | Optional | Parameter for Fetch Incidents by Filters | | `filters.incidentReso` | array | Optional | This field allows you to filter by incident resolution status. Possible Values are from 0-4. 0 = None, 1 = Open, 2 = TruePositive, 3 = FalsePositive, 4 = InProgress. To specify more than one value, most fields accept an array such as \[0,1,2,3]. | | `timeTo` | number | Optional | The incident to time range in epoch milliseconds. Required if incidentID filter list is not specified. | | `timeFrom` | number | Optional | The incident from time range in epoch milliseconds. Required if incidentID filter list is not specified. | | `start` | number | Optional | Optional offset to start with, not needed if you are iterating using queryID and page numbers. | | `size` | number | Optional | Number of items to return per page of incidents. | | `orderBy` | string | Optional | Set Descending or Ascending order of searched incidents using any datetime attribute such as incidentLastSeen. | | `descending` | string | Optional | Specify if sort order is ascending or descending. Only needed if orderBy set. | | `fields` | array | Optional | Array of all the incident fields you would liked to return. | ### Input Example `{"json_body":{"filters":{"incidentId":[123456],"incidentStatus":[0],"eventSeverity":[10],"eventSeverityCat":["HIGH"],"phIncidentCategory":[4],"phCustId":[2000],"customer":["Super"],"incidentReso":[1]},"timeTo":1620684981736,"timeFrom":1620677781736,"start":0,"size":500,"orderBy":"incidentLastSeen","descending":"true","fields":["eventType"]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `total` | number | Output field: total | | `pages` | number | Output field: pages | | `data` | array | Response data | | `data.incidentId` | number | Response data | | `data.incidentTitle` | string | Response data | | `data.eventSeverity` | number | Response data | | `data.incidentFirstSeen` | number | Response data | | `data.incidentLastSeen` | number | Response data | | `data.incidentReso` | number | Response data | | `data.incidentRptIp` | string | Response data | | `data.incidentRptDevName` | string | Response data | | `data.incidentSrc` | string | Response data | | `data.incidentTarget` | string | Response data | | `data.count` | number | Response data | | `data.attackTechnique` | string | Response data | | `data.attackTactic` | string | Response data | | `data.phSubIncidentCategory` | string | Response data | | `data.eventType` | string | Response data | | `data.eventName` | string | Response data | | `data.phIncidentCategory` | number | Response data | | `data.incidentClearedTime` | number | Response data | | `data.eventSeverityCat` | string | Response data | | `data.incidentDetail` | string | Response data | ### Output Example `{"json_body":{"total":4,"pages":2,"data":[{}],"start":0,"sizePerPage":2,"queryId":"pub_inc_query_81_1684452618294"},"reason":"OK","response_headers":{},"status_code":200}` ## Get Agent Status by Host Retrieve the incident status of Linux and Windows agents in Fortinet FortiSIEM v7 by host. ### Endpoint - **URL:** `/phoenix/rest/agentStatus/all` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------------------- | | `parameters.request` | string | Optional | Request query with the format request=orgId,hostName | ### Input Example `{"parameters":{"request":"1,Linux"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | ### Output Example `{"json_body":{},"reason":"OK","response_headers":{},"status_code":200}` ## Get All Watch Lists Retrieve all watchlists and their entries from Fortinet FortiSIEM for monitoring and analysis. ### Endpoint - **URL:** `/phoenix/rest/watchlist/all` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ---------------------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `response` | array | Output field: response | | `response.id` | number | Unique identifier | | `response.naturalId` | string | Unique identifier | | `response.displayName` | string | Name of the resource | | `response.description` | string | Output field: response.description | | `response.valuePattern` | string | Value for the parameter | | `response.ageOut` | string | Output field: response.ageOut | | `response.topGroup` | boolean | Output field: response.topGroup | | `response.entries` | array | Output field: response.entries | | `response.entries.id` | number | Unique identifier | | `response.entries.firstSeen` | number | Output field: response.entries.firstSeen | | `response.entries.lastSeen` | number | Output field: response.entries.lastSeen | | `response.entries.expiredTime` | number | Time value | | `response.entries.state` | string | Output field: response.entries.state | | `response.entries.naturalId` | string | Unique identifier | | `response.entries.triggeringRules` | string | Output field: response.entries.triggeringRules | | `response.entries.entryValue` | string | Value for the parameter | | `response.entries.description` | string | Output field: response.entries.description | | `response.entries.ageOut` | string | Output field: response.entries.ageOut | | `response.entries.count` | number | Count value | | `response.entries.dataCreationType` | number | Response data | ### Output Example `{"json_body":{"response":[{}]},"reason":"OK","response_headers":{},"status_code":200}` ## Get Device Information Fetches the Configuration Management Database (CMDB) device information in Fortinet FortiSIEM v7. ### Endpoint - **URL:** `/phoenix/rest/cmdbDeviceInfo/devices` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------ | | `parameters.organization` | string | Optional | All devices in a particular org are fetched. | | `parameters.includeIps` | string | Optional | All devices in a this address range are fetched. | | `parameters.excludeIps` | string | Optional | All devices in a this address range are ignored. | | `parameters.ip` | string | Optional | Full info about this particular device is fetched. | | `parameters.loadDepend` | string | Optional | Can be set to True/False. Full info about this particular device is fetched. | | `parameters.fields` | string | Optional | A section of information (Applications, Interfaces, Processors, Storages) about one device is fetched. | ### Input Example `{"parameters":{"organization":"test","includeIps":"172.16.1.1","excludeIps":"172.16.1.0","ip":"172.16.1.3","loadDepend":"False","fields":"Applications"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | ### Output Example `{"json_body":{},"reason":"OK","response_headers":{},"status_code":200}` ## Get Devices Retrieve a list of devices using a specific organization ID and device IP or host name in Fortinet FortiSIEM v7. ### Endpoint - **URL:** `/phoenix/rest/device/list` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ---------------------------------- | | `parameters.orgId` | string | Required | The organization Id of the device. | | `parameters.accessIp` | string | Optional | The IP address of the device. | | `parameters.name` | string | Optional | The name of the device. | ### Input Example `{"parameters":{"orgId":"123","accessIp":"127.0.0.1","name":"router"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `id` | number | Unique identifier | | `orgId` | number | Unique identifier | | `orgName` | string | Name of the resource | | `hostName` | string | Name of the resource | | `accessIp` | string | Output field: accessIp | | `deviceType` | string | Type of the resource | ### Output Example `{"json_body":{"id":111111,"orgId":1,"orgName":"Super","hostName":"FSM_Test_123456_0000","accessIp":"172.16.1.1","deviceType":"Redhat Linux"},"reason":"OK","response_headers":{},"status_code":200}` ## Get Event Query Progress by ID Query the progress of a previously submitted event query in Fortinet FortiSIEM using the queryId path parameter and required headers. ### Endpoint - **URL:** `/phoenix/rest/query/progress/{{queryId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ---------------------------------------------------------------- | | `path_parameters.queryId` | string | Required | This is the requestID values retrieved from eventQuery response. | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept` | string | Required | HTTP headers for the request | ### Input Example `{"path_parameters":{"queryId":"123"},"headers":{"Accept":"application/xml"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | ### Output Example `{"json_body":{},"reason":"OK","response_headers":{},"status_code":200}` ## Get Incident by Incident ID Retrieve incidents from Fortinet FortiSIEM v7 using time or incident ID. ### Endpoint - **URL:** `/phoenix/rest/pub/incident` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.status` | array | Optional | Optional List of incident status integer types to filter by ACTIVE = 0, AUTOMATICALLY CLEARED = 1, MANUALLY CLEARED = 2, SYSTEM CLEARED = 3. To specify all, use status=\[0,1,2,3]. | | `parameters.incidentId` | array | Optional | Array of incidents to query. If this value is used, timeTo and timeFrom parameters are not needed. | | `parameters.timeFrom` | number | Optional | The incident from time range in epoch milliseconds, this is not required if querying by incident ID. | | `parameters.timeTo` | number | Optional | The incident to time range in epoch milliseconds, this is not required if querying by incident ID. | | `parameters.size` | number | Optional | This is an optional size parameter, the number of incidents to return per page of query results. Default is 500. | ### Input Example `{"parameters":{"status":[0,1],"incidentId":[22],"timeFrom":1683578670000,"timeTo":1684452600000,"size":500}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `total` | number | Output field: total | | `pages` | number | Output field: pages | | `data` | array | Response data | | `data.incidentId` | number | Response data | | `data.incidentTitle` | string | Response data | | `data.eventSeverity` | number | Response data | | `data.incidentFirstSeen` | number | Response data | | `data.incidentLastSeen` | number | Response data | | `data.incidentReso` | number | Response data | | `data.incidentRptIp` | string | Response data | | `data.incidentRptDevName` | string | Response data | | `data.incidentSrc` | string | Response data | | `data.incidentTarget` | string | Response data | | `data.count` | number | Response data | | `data.attackTechnique` | string | Response data | | `data.attackTactic` | string | Response data | | `data.phSubIncidentCategory` | string | Response data | | `data.eventType` | string | Response data | | `data.eventName` | string | Response data | | `data.phIncidentCategory` | number | Response data | | `data.incidentClearedTime` | number | Response data | | `data.eventSeverityCat` | string | Response data | | `data.incidentDetail` | string | Response data | ### Output Example `{"json_body":{"total":4,"pages":2,"data":[{}],"start":0,"sizePerPage":2,"queryId":"pub_inc_query_81_1684452618294"},"reason":"OK","response_headers":{},"status_code":200}` ## Get Incidents by Query ID Retrieve incidents from Fortinet FortiSIEM v7 using a specific query ID and page number. ### Endpoint - **URL:** `/phoenix/rest/pub/incident/{{queryId}}/{{pageNumber}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------- | | `path_parameters.queryId` | string | Required | This is the queryID returned in the response body from the action Get Incident by incident ID. | | `path_parameters.pageNumber` | number | Required | This param is the current page number to retrieve. | ### Input Example `{"path_parameters":{"queryId":"pub_inc_query_81_1684452618294","pageNumber":1}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `total` | number | Output field: total | | `pages` | number | Output field: pages | | `data` | array | Response data | | `data.incidentId` | number | Response data | | `data.incidentTitle` | string | Response data | | `data.eventSeverity` | number | Response data | | `data.incidentFirstSeen` | number | Response data | | `data.incidentLastSeen` | number | Response data | | `data.incidentReso` | number | Response data | | `data.incidentRptIp` | string | Response data | | `data.incidentRptDevName` | string | Response data | | `data.incidentSrc` | string | Response data | | `data.incidentTarget` | string | Response data | | `data.count` | number | Response data | | `data.attackTechnique` | string | Response data | | `data.attackTactic` | string | Response data | | `data.phSubIncidentCategory` | string | Response data | | `data.eventType` | string | Response data | | `data.eventName` | string | Response data | | `data.phIncidentCategory` | number | Response data | | `data.incidentClearedTime` | number | Response data | | `data.eventSeverityCat` | string | Response data | | `data.incidentDetail` | string | Response data | ### Output Example `{"json_body":{"total":4,"pages":2,"data":[{}],"start":0,"sizePerPage":2,"queryId":"pub_inc_query_81_1684452618294"},"reason":"OK","response_headers":{},"status_code":200}` ## Get List of Monitored Organizations Retrieve a list of organizations currently monitored by Fortinet FortiSIEM v7. This action requires headers for authentication. ### Endpoint - **URL:** `/phoenix/rest/config/domain` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------- | | `headers` | object | Required | HTTP headers for the request | | `headers.Accept` | string | Required | HTTP headers for the request | ### Input Example `{"headers":{"Accept":"application/xml"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | ### Output Example `{"json_body":{},"reason":"OK","response_headers":{},"status_code":200}` ## Get Watch List by Watch List Entry ID Retrieve a specific watchlist in FortiSIEM by providing the unique entry ID as a path parameter. ### Endpoint - **URL:** `/phoenix/rest/watchlist/byEntry/{{watchlistEntryId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------ | | `path_parameters.watchlistEntryId` | string | Required | This is the ID field of an individual entry within a watchlist to search with. | ### Input Example `{"path_parameters":{"watchlistEntryId":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ---------------------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `response` | object | Output field: response | | `response.id` | number | Unique identifier | | `response.naturalId` | string | Unique identifier | | `response.displayName` | string | Name of the resource | | `response.description` | string | Output field: response.description | | `response.valuePattern` | string | Value for the parameter | | `response.ageOut` | string | Output field: response.ageOut | | `response.topGroup` | boolean | Output field: response.topGroup | | `response.entries` | array | Output field: response.entries | | `response.entries.id` | number | Unique identifier | | `response.entries.firstSeen` | number | Output field: response.entries.firstSeen | | `response.entries.lastSeen` | number | Output field: response.entries.lastSeen | | `response.entries.expiredTime` | number | Time value | | `response.entries.state` | string | Output field: response.entries.state | | `response.entries.naturalId` | string | Unique identifier | | `response.entries.triggeringRules` | string | Output field: response.entries.triggeringRules | | `response.entries.entryValue` | string | Value for the parameter | | `response.entries.description` | string | Output field: response.entries.description | | `response.entries.ageOut` | string | Output field: response.entries.ageOut | | `response.entries.count` | number | Count value | | `response.entries.dataCreationType` | number | Response data | | `status` | string | Status value | ### Output Example `{"json_body":{"response":{"id":899753,"naturalId":"PH_DYNLIST_MAIL_VIOLATOR","displayName":"Resource Issues Test WL Grp4","description":"Servers, network or storage devices","valuePattern":"testpattern","ageOut":"1w","topGroup":false,"entries":[]},"status":"Success"},"reason":"OK","response_headers":{},"status_code":200}` ## Get Watch List by Watch List ID Retrieve details of a specific watchlist in Fortinet FortiSIEM by providing the watchlist ID as a path parameter. ### Endpoint - **URL:** `/phoenix/rest/watchlist/{{watchlistId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | --------------------------------- | | `path_parameters.watchlistId` | string | Required | This is the incidentID to update. | ### Input Example `{"path_parameters":{"watchlistId":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ---------------------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `response` | array | Output field: response | | `response.id` | number | Unique identifier | | `response.naturalId` | string | Unique identifier | | `response.displayName` | string | Name of the resource | | `response.description` | string | Output field: response.description | | `response.valuePattern` | string | Value for the parameter | | `response.ageOut` | string | Output field: response.ageOut | | `response.topGroup` | boolean | Output field: response.topGroup | | `response.entries` | array | Output field: response.entries | | `response.entries.id` | number | Unique identifier | | `response.entries.firstSeen` | number | Output field: response.entries.firstSeen | | `response.entries.lastSeen` | number | Output field: response.entries.lastSeen | | `response.entries.expiredTime` | number | Time value | | `response.entries.state` | string | Output field: response.entries.state | | `response.entries.naturalId` | string | Unique identifier | | `response.entries.triggeringRules` | string | Output field: response.entries.triggeringRules | | `response.entries.entryValue` | string | Value for the parameter | | `response.entries.description` | string | Output field: response.entries.description | | `response.entries.ageOut` | string | Output field: response.entries.ageOut | | `response.entries.count` | number | Count value | | `response.entries.dataCreationType` | number | Response data | ### Output Example `{"json_body":{"response":[{}]},"reason":"OK","response_headers":{},"status_code":200}` ## Get Watch List Entry by Watch List Entry ID Retrieve a specific watchlist entry from Fortinet FortiSIEM using the provided watchlistEntryId. ### Endpoint - **URL:** `/phoenix/rest/watchlist/entry/{{watchlistEntryId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------ | | `path_parameters.watchlistEntryId` | string | Required | This is the ID field of an individual entry within a watchlist to search with. | ### Input Example `{"path_parameters":{"watchlistEntryId":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `response` | object | Output field: response | | `response.id` | number | Unique identifier | | `response.firstSeen` | number | Output field: response.firstSeen | | `response.lastSeen` | number | Output field: response.lastSeen | | `response.expiredTime` | number | Time value | | `response.state` | string | Output field: response.state | | `response.naturalId` | string | Unique identifier | | `response.triggeringRules` | string | Output field: response.triggeringRules | | `response.entryValue` | string | Value for the parameter | | `response.description` | string | Output field: response.description | | `response.ageOut` | string | Output field: response.ageOut | | `response.count` | number | Count value | | `response.dataCreationType` | number | Response data | | `status` | string | Status value | ### Output Example `{"json_body":{"response":{"id":1,"firstSeen":1613601369215,"lastSeen":1613601369215,"expiredTime":1613601369215,"state":"Enabled","naturalId":"10.65.20.240_1686877740000","triggeringRules":"Sudden Change In DNS Data Transfer Pattern From A Specific Host","entryValue":"myhost.example.com","description":"Description of entry","ageOut":"1d","count":10,"dataCreationType":0},"status":"Success"},"reason":"OK","response_headers":{},"status_code":200}` ## Retrieve Context by Hostname Retrieve context information associated with a specified hostname in Fortinet FortiSIEM. Requires parameters and value input. ### Endpoint - **URL:** `/phoenix/rest/context/hostname` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------------------------- | | `parameters.value` | string | Required | The Hostname to retrieve context. | ### Input Example `{"parameters":{"value":"testdomain"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------------- | -------- | ----------------------------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `contexts` | array | Output field: contexts | | `contexts.parameter` | string | Parameter for the Retrieve Context by Hostname action | | `contexts.value` | string | Value for the parameter | | `contexts.hostname` | string | Name of the resource | | `contexts.deviceType` | string | Type of the resource | | `contexts.importance` | string | Output field: contexts.importance | | `contexts.externalLookups` | object | Output field: contexts.externalLookups | | `contexts.externalLookups.domain` | string | Output field: contexts.externalLookups.domain | | `contexts.externalLookups.FortiGuardIOCResult` | object | Result of the operation | | `contexts.externalLookups.FortiGuardIOCResult.wf_cate` | string | Result of the operation | | `contexts.externalLookups.FortiGuardIOCResult.ioc_tags` | string | Result of the operation | | `contexts.externalLookups.FortiGuardIOCResult.verdict` | string | Result of the operation | | `contexts.externalLookups.FortiGuardIOCResult.confidence` | string | Unique identifier | | `contexts.externalLookups.FortiGuardIOCResult.av_cate` | string | Result of the operation | | `contexts.externalLookups.FortiGuardIOCResult.ioc_cate` | string | Result of the operation | | `contexts.externalLookups.FortiGuardIOCResult.spam_cate` | string | Result of the operation | ### Output Example `{"json_body":{"contexts":[{}]},"reason":"OK","response_headers":{},"status_code":200}` ## Retrieve Context by IP Retrieve context information for a specified IP address from Fortinet FortiSIEM using the 'value' parameter. ### Endpoint - **URL:** `/phoenix/rest/context/ip` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ----------------------------------- | | `parameters.value` | string | Required | The IP address to retrieve context. | ### Input Example `{"parameters":{"value":"1.1.1.1"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------- | -------- | ----------------------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `contexts` | array | Output field: contexts | | `contexts.parameter` | string | Parameter for the Retrieve Context by IP action | | `contexts.value` | string | Value for the parameter | | `contexts.hostname` | string | Name of the resource | | `contexts.deviceType` | string | Type of the resource | | `contexts.importance` | string | Output field: contexts.importance | | `contexts.location` | object | Output field: contexts.location | | `contexts.location.countryCode` | string | Output field: contexts.location.countryCode | | `contexts.location.countryName` | string | Name of the resource | | `contexts.location.region` | string | Output field: contexts.location.region | | `contexts.location.city` | string | Output field: contexts.location.city | | `contexts.location.latitude` | number | Output field: contexts.location.latitude | | `contexts.location.longitude` | number | Output field: contexts.location.longitude | | `contexts.deviceCustomProperties` | array | Output field: contexts.deviceCustomProperties | | `contexts.deviceCustomProperties.propertyName` | string | Name of the resource | | `contexts.deviceCustomProperties.propertyValue` | string | Value for the parameter | | `contexts.identities` | array | Unique identifier | | `contexts.identities.ipAddr` | string | Unique identifier | | `contexts.identities.firstSeenTime` | string | Unique identifier | | `contexts.identities.lastSeenTime` | string | Unique identifier | | `contexts.performanceInfo` | object | Output field: contexts.performanceInfo | | `contexts.performanceInfo.cpuUtil` | number | Output field: contexts.performanceInfo.cpuUtil | | `contexts.performanceInfo.memUtil` | number | Output field: contexts.performanceInfo.memUtil | ### Output Example `{"json_body":{"contexts":[{}]},"reason":"OK","response_headers":{},"status_code":200}` ## Retrieve Context by User Retrieve contextual data for a specified user in Fortinet FortiSIEM, aiding in user-centric analysis. Requires parameters and value input. ### Endpoint - **URL:** `/phoenix/rest/context/user` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ----------------------------------------- | | `parameters.value` | string | Required | The name of the user to retrieve context. | ### Input Example `{"parameters":{"value":"test"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | ------------------------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `contexts` | array | Output field: contexts | | `contexts.parameter` | string | Parameter for the Retrieve Context by User action | | `contexts.value` | string | Value for the parameter | | `contexts.location` | object | Output field: contexts.location | | `contexts.location.latitude` | number | Output field: contexts.location.latitude | | `contexts.location.longitude` | number | Output field: contexts.location.longitude | | `contexts.userInfo` | object | Output field: contexts.userInfo | | `contexts.userInfo.groups` | array | Output field: contexts.userInfo.groups | | `contexts.topEventTypes` | array | Type of the resource | | `contexts.topEventTypes.eventType` | string | Type of the resource | | `contexts.topEventTypes.eventName` | string | Name of the resource | | `contexts.topEventTypes.count` | number | Type of the resource | ### Output Example `{"json_body":{"contexts":[{}]},"reason":"OK","response_headers":{},"status_code":200}` ## Update Incident Update a single FortiSIEM incident using the incidentId as a path parameter. ### Endpoint - **URL:** `/phoenix/rest/pub/incident/update/{{incidentId}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | | `path_parameters.incidentId` | string | Required | This is the incidentID to update. | | `incidentId` | number | Optional | This is the unique incident ID for this individual trigger of this incident. | | `incidentTitle` | string | Optional | Dynamic Title of incident. | | `eventSeverity` | number | Optional | Integer severity 1-10 (1-4 low, 5-8 medium, 9-10 high). | | `incidentFirstSeen` | number | Optional | Incident First Seen time in epoch milliseconds. | | `incidentLastSeen` | number | Optional | Incident Last Seen time in epoch milliseconds. | | `incidentReso` | number | Optional | Incident Resolution integer value. None = 0 Open = 1 TruePositive = 2 FalsePositive = 3 InProgress = 4. | | `incidentRptIp` | string | Optional | Incident Reporting IP - Log source of Incident. | | `incidentRptDevName` | string | Optional | This is the Incident Reporting Device Name - The hostname of the log source of the incident. | | `incidentSrc` | string | Optional | Attributes identifying the source of the incident, defined as a comma separated list of pairs. This is optional and depends on the incident. | | `incidentTarget` | string | Optional | Attributes identifying the target of the incident, defined as a comma separated list of pairs. This is optional and depends on the incident. | | `count` | number | Optional | Incident Count. While the incident is active, this is the number of times the ACTIVE incident has triggered for a distinct event window. | | `attackTechnique` | string | Optional | The associated Mitre Attach Technique ID and Technique Name. | | `attackTactic` | string | Optional | This is the Mitre tactic associated with the incident. | | `phSubIncidentCategory` | string | Optional | Incident Subcategory, often synonymous with Mitre tactic but can be other categories as well. | | `eventType` | string | Optional | This is a incident event type, a special unique identifier of the incident/rule, not to be confused with a raw event event type. | | `eventName` | string | Optional | This is the incident name (display name), equivalent to the underlying rule name. | | `phIncidentCategory` | number | Optional | This is the integer incident category. AVAILABILITY = 1, PERFORMANCE = 2, CHANGE = 3, SECURITY = 4 and OTHER = 5. | | `incidentClearedTime` | number | Optional | Incident cleared time in epoch milliseconds, if 0, it has never been cleared. | | `eventSeverityCat` | string | Optional | String representation of incident LOW,MEDIUM,HIGH. | | `incidentDetail` | string | Optional | Incident detail metadata associated with the incident, defined as a comma separated list of pairs. This is optional and depends on the incident. | | `incidentStatus` | number | Optional | Integer incident status integer types to filter by ACTIVE = 0, AUTOMATICALLY CLEARED = 1, MANUALLY CLEARED = 2 and SYSTEM CLEARED = 3. | | `customer` | string | Optional | This is the FortiSIEM organization name for which the incident triggered. | | `phCustId` | number | Optional | This is the FortiSIEM Organization ID. | | `incidentExtUser` | string | Optional | The user as defined in the external ticketing system. | ### Input Example `{"json_body":{"incidentId":12,"incidentTitle":"","eventSeverity":9,"incidentFirstSeen":1683595260000,"incidentLastSeen":1684439940000,"incidentReso":1,"incidentRptIp":"192.168.1.25","incidentRptDevName":"lab1.example.com","incidentSrc":"user:Administrator","incidentTarget":"hostName:lab.example.com","count":25,"attackTechnique":"[{\"name\": \"Endpoint Denial of Service: Application or System Exploitation\", \"techniqueid\": \"T1499.004\"}]","attackTactic":"Impact","phSubIncidentCategory":"Impact","eventType":"PH_RULE_HIGH_SEV_SCANNER","eventName":"Scanner found severe vulnerability","phIncidentCategory":4,"incidentClearedTime":0,"eventSeverityCat":"Medium","incidentDetail":"vulnName:Microsoft Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability","incidentStatus":0,"customer":"Super","phCustId":2000,"incidentExtUser":"MyUser","incidentExtClearedTime":1683595260000,"incidentExtTicketId":"12345","incidentExtTicketState":"CLOSED","incidentExtTicketType":"Incident"},"path_parameters":{"incidentId":"12"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","response_text":"SUCCESS"}` ## Update Watch List Entry Update a specified watchlist entry in FortiSIEM by providing the unique entry ID and entry value. ### Endpoint - **URL:** `/phoenix/rest/watchlist/entry/save` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------- | | `id` | number | Optional | The integer identifier a watchlist single entry, this is used to search for the watchlist entry and update it. | | `entryValue` | string | Optional | This is the new value of the watchlist entry to update. | ### Input Example `{"json_body":{"id":889400,"entryValue":"PVVol_A001_A000356_POWER23"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------------- | | `reason` | string | Response reason phrase | | `status_code` | number | HTTP status code of the response | | `response` | object | Output field: response | | `response.id` | number | Unique identifier | | `response.firstSeen` | number | Output field: response.firstSeen | | `response.lastSeen` | number | Output field: response.lastSeen | | `response.expiredTime` | number | Time value | | `response.state` | string | Output field: response.state | | `response.naturalId` | string | Unique identifier | | `response.triggeringRules` | string | Output field: response.triggeringRules | | `response.entryValue` | string | Value for the parameter | | `response.description` | string | Output field: response.description | | `response.ageOut` | string | Output field: response.ageOut | | `response.count` | number | Count value | | `response.dataCreationType` | number | Response data | | `status` | string | Status value | ### Output Example `{"json_body":{"response":{"id":1,"firstSeen":1613601369215,"lastSeen":1613601369215,"expiredTime":1613601369215,"state":"Enabled","naturalId":"10.65.20.240_1686877740000","triggeringRules":"Sudden Change In DNS Data Transfer Pattern From A Specific Host","entryValue":"myhost.example.com","description":"Description of entry","ageOut":"1d","count":10,"dataCreationType":0},"status":"Success"},"reason":"OK","response_headers":{},"status_code":200}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |