elastic / elastic/integrations

[New Integration] FortiAnalyzer

Open
#10,160 8 comments 0 reactions 0 assignees View on GitHub
New Integration Team:Security-Deployment and Devices
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Description
FortiAnalyzer collects and aggregates logs from multiple Fortinet devices such as FortiGate firewalls, FortiMail email security appliances, FortiWeb web application firewalls, and other Fortinet products. This centralized approach simplifies log management and helps in maintaining compliance with regulatory requirements.

### Architecture
FortiAnalyzer supports log forwarding via syslog, which could be used to stream events from multiple Fortinet products to Elastic. For information regarding log forwarding, please see the FortiAnalyzer docs here: https://docs.fortinet.com/document/fortianalyzer/7.4.3/administration-guide/621804/log-forwarding

On our side, we need to discuss and agree upon an approach to supporting logs sent via FortiAnalyzer. Two options:

(1) We build a FortiAnalyzer integration which supports logs forwarded from any Fortinet product to FortiAnalyzer. Given that we don't have integrations with every Fortinet product, this may prove challenging. Could we outline what products we support via FortiAnalyzer and make a best effort to parse data with basic ECS mappings for sources we don't have integrations with?

(2) We add an additional input to our existing Fortinet integrations. e.g. Add an input to our FortiGate integration called 'Collect FortiGate logs via FortiAnalyzer'. We then include a pipeline in the FortiGate integration which supports the format produced by FortiAnalyzer. We do the same for FortiMail, FortiProxy, etc too.

# Integration release checklist

This checklist is intended for integrations maintainers to ensure consistency
when creating or updating a Package, Module or Dataset for an Integration.

### All changes

- [ ] Change follows the [contributing guidelines](https://github.com/elastic/integrations/blob/master/CONTRIBUTING.md)
- [ ] Supported versions of the monitoring target are documented
- [ ] Supported operating systems are documented (if applicable)
- [ ] Integration or [System tests](https://github.com/elastic/elastic-package/blob/master/docs/howto/system_testing.md) exist
- [ ] Documentation exists
- [ ] Fields follow [ECS](https://github.com/elastic/ecs) and [naming conventions](https://www.elastic.co/guide/en/beats/devguide/master/event-conventions.html)
- [ ] At least a manual test with ES / Kibana / Agent has been performed.
- [ ] Required Kibana version set to:

### New Package

- [ ] Screenshot of the "Add Integration" page on Fleet added

### Dashboards changes

- [ ] Dashboards exists
- [ ] Screenshots added or updated
- [ ] Datastream filters added to visualizations

### Log dataset changes

- [ ] [Pipeline tests](https://github.com/elastic/elastic-package/blob/master/docs/howto/pipeline_testing.md) exist (if applicable)
- [ ] Generated output for at least 1 log file exists
- [ ] Sample event (`sample_event.json`) exists

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.