Overview of the FortiAnalyzer integration (Log collector)

You can integrate Fortinet FortiAnalyzer with Sophos Central so that it sends alerts to Sophos for analysis.

This page gives you an overview of the integration.

Fortinet FortiAnalyzer product overview

Fortinet's FortiAnalyzer platform centralizes the collection and interpretation of network events. Sophos can ingest Fortigate firewall alerts via FortiAnalyzer.

Fortigate is a next-generation firewall that delivers advanced threat protection and performance optimization. Its integrated platform consolidates various security and networking functions, offering users protection against sophisticated threats.

Sophos documents

Integrate Fortinet FortiAnalyzer (Log collector)

What we ingest

Sample alerts seen by Sophos:

Admin login failed
IPsec phase 1 error
Web request to Malicious Websites blocked
Risky App Cloudflare.1.1.1.1.VPN blocked
URL belongs to a denied category in policy
Web traffic to C&C from _ blocked
SSH channel blocked
applications3: F5.BIG.IP.TMM.URI.Normalization.Buffer.Overflow
operating_system: Linux.Kernel.TCP.SACK.Panic.DoS
misc: Java.Debug.Wire.Protocol.Insecure.Configuration
backdoor: Bladabindi.Botnet
Social.Media: Snapchat
General.Interest: Google.Cloud.Messaging
Email: Microsoft.Outlook.Office.365
Storage.Backup: Dropbox
Malware JS/Agent.10CC!tr download from WAN blocked

Filtering

We allow messages in standard CEF format.
We filter to remove data provided in a non-compliant format.
We then drop alerts that are uninteresting or non-security events.

Sample threat mappings

We define the type as follows:

If the field "message" is not empty, we search for a specified regex pattern. Otherwise we check for the existence of the 'FTNTFGTattack', 'ad.subtype', and 'cat' fields and assigns their values accordingly.

Sample mappings:

{"alertType": "Fortigate had experienced an unexpected power off!"}
{"threatId": "T1562.001", "threatName": "Disable or Modify Tools"}
{ "alertType": "Add dnsfilter.domain-filter N", "threatId": "TA0005", "threatName": "Defense Evasion"}