FortiSIEMV2
Use FortiSIEM v2 to fetch and update incidents, search events and manage watchlists of FortiSIEM.
- Category
- Analytics & SIEM
- Pack
- FortiSIEM
Configuration parameters
- url — Server URL (required)
- credentials — Username (required)
- max_fetch — Maximum incidents per fetch.
- first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).
- status — Filter incidents by status.
- fetch_mode — Fetch Mode
- max_events_fetch — Maximum events to fetch per incident.
- proxy — Use system proxy settings
- insecure — Trust any certificate (not secure)
- incidentType — Incident type
- incidentFetchInterval — Incidents Fetch Interval
- isFetch — Fetch incidents
Commands (16)
- fortisiem-cmdb-device-get — Retrieve full information of the specified devices.
- fortisiem-cmdb-devices-list — List CMDB (Centralized Management Database) devices with short information for each device. If you provide one of the exclude arguments, their values are excluded from the provided include arguments. For example, to list all devices in the range 192.168.20.1-192.168.20.100, but exclude 192.168.20.20, 192.168.20.25, use include_ip_range='192.168.20.1-192.168.20.100' and exclude_ip='192.168.20.20, 192.168.20.25'. If no argument is provided, the command retrieves all devices.
- fortisiem-event-list-by-incident — Lists events by the specified incident ID. Available for FortiSiem version 6.6 and earlier.
- fortisiem-event-search — Initiate search process on events. The events are retrieved according to a constraint determined either by the query argument or by the filtering arguments. When using filtering arguments, an 'AND' operator is used between them. If the query argument is filled, it overrides the values in the filtering arguments.
- fortisiem-event-search-results — The results of the specified search ID.
- fortisiem-event-search-status — The status of the specified search ID.
- fortisiem-incident-update — Update attributes of the specified incident. Only the provided attributes are overwritten.
- fortisiem-monitored-organizations-list — List of monitored organizations in service provider deployments.
- fortisiem-watchlist-add — Add a watchlist group. You can also add an entry to the watchlist.
- fortisiem-watchlist-delete — Delete watchlist.
- fortisiem-watchlist-entry-add — Add watchlist entry to one or more watchlist groups.
- fortisiem-watchlist-entry-delete — Delete entry of watchlist.
- fortisiem-watchlist-entry-get — Get entry by the specified entry ID.
- fortisiem-watchlist-entry-update — Update watchlist entry. This command overrides all existing values in the entry's attribute. Fill in all relevant arguments to avoid deletion of data.
- fortisiem-watchlist-get — Get watchlist by the specified watchlist or entry ID.
- fortisiem-watchlist-list — List all watchlists from FortiSIEM database.