FortiSIEMV2

Use FortiSIEM v2 to fetch and update incidents, search events and manage watchlists of FortiSIEM.

Analytics & SIEM · FortiSIEM

Configuration parameters

  • url — Server URL (required)
  • credentials — Username (required)
  • max_fetch — Maximum incidents per fetch.
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).
  • status — Filter incidents by status.
  • fetch_mode — Fetch Mode
  • max_events_fetch — Maximum events to fetch per incident.
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • incidentType — Incident type
  • isFetch — Fetch incidents

Commands (16)

  • fortisiem-cmdb-device-get

    Retrieve full information of the specified devices.

  • fortisiem-cmdb-devices-list

    List CMDB (Centralized Management Database) devices with short information for each device. If you provide one of the exclude arguments, their values are excluded from the provided include arguments. For example, to list all devices in the range 192.168.20.1-192.168.20.100, but exclude 192.168.20.20, 192.168.20.25, use include_ip_range='192.168.20.1-192.168.20.100' and exclude_ip='192.168.20.20, 192.168.20.25'. If no argument is provided, the command retrieves all devices.

  • fortisiem-event-list-by-incident

    Lists events by the specified incident ID. Available for FortiSiem version 6.6 and earlier.

  • fortisiem-event-search

    Initiate search process on events. The events are retrieved according to a constraint determined either by the query argument or by the filtering arguments. When using filtering arguments, an 'AND' operator is used between them. If the query argument is filled, it overrides the values in the filtering arguments.

  • fortisiem-event-search-results

    The results of the specified search ID.

  • fortisiem-event-search-status

    The status of the specified search ID.

  • fortisiem-incident-update

    Update attributes of the specified incident. Only the provided attributes are overwritten.

  • fortisiem-monitored-organizations-list

    List of monitored organizations in service provider deployments.

  • fortisiem-watchlist-add

    Add a watchlist group. You can also add an entry to the watchlist.

  • fortisiem-watchlist-delete

    Delete watchlist.

  • fortisiem-watchlist-entry-add

    Add watchlist entry to one or more watchlist groups.

  • fortisiem-watchlist-entry-delete

    Delete entry of watchlist.

  • fortisiem-watchlist-entry-get

    Get entry by the specified entry ID.

  • fortisiem-watchlist-entry-update

    Update watchlist entry. This command overrides all existing values in the entry's attribute. Fill in all relevant arguments to avoid deletion of data.

  • fortisiem-watchlist-get

    Get watchlist by the specified watchlist or entry ID.

  • fortisiem-watchlist-list

    List all watchlists from FortiSIEM database.