Fortinet FortiGate

The Fortinet FortiGate and ESET PROTECT integration enables ingestion and normalization of selected network security indicators (traffic logs), providing visibility into network-related threats alongside ESET security events. Indicators are available for investigation in the ESET PROTECT Web Console > Advanced Search.

The integration is Syslog-based and installs a Broker Agent on the target device during integration setup. The Broker Agent is a component that collects and forwards data to the ESET PROTECT Platform.

ESET PROTECT offers two options of the integration setup for your choice: Optimal and Custom setup. If you select Optimal setup, ESET handles the setup and maintenance for you, including Syslog profile creation and management. If you select Custom setup, you set up and manage the Syslog profile yourself in Fortinet, and provide its configuration details during the setup process in the ESET PROTECT Web Console.

Prerequisites

•You have configured the Fortinet Firewall on your network.

•The Fortinet Firewall generates the traffic logs.

•You have prepared a target device running Windows Server 2016 or later.

•The target device has the ESET Management Agent installed and is connected to ESET PROTECT.

•The target device can receive incoming Syslog traffic on the configured port.

•You have generated an API key in Fortinet using the Fortinet instructions (required for Optimal setup).

•You have imported a signed certificate from a trusted certificate authority (CA) to Fortinet FortiGate using the Fortinet instructions. You have selected the certificate for HTTPS Management Interface in Fortinet FortiGate System > Settings > Administration Settings > HTTPS server certificate (required for Optimal setup).

•You have configured a Syslog profile with the RFC 5424 log format in Fortinet (required for Custom setup).

How to enable the integration

To install and set up the Fortinet FortiGate integration application, navigate to ESET PROTECT Web Console > Integrations > Marketplace and follow the steps below.

1.On the Marketplace, find Fortinet FortiGate and click Connect.

2.Review the Before you begin notification and click Continue.

3.In General Setup, complete the following fields. Then, click Next.

•Select company (required)—Select the company for which you configure the integration. The field appears only for MSP users.

•Name (optional)—Type a distinct name for the integration.

•Description (optional)—Type a description for the integration.

4.In Choose Configuration, select the desired setup option. Then, click Next.

•Optimal setup—ESET handles the setup and maintenance for you, including Syslog profile creation and management.

•Custom setup—You set up and manage the Syslog profile yourself in Fortinet, and provide its configuration details during the setup process in the ESET PROTECT Web Console.

5.In Target, select the target device for the integration, and click Next.

6.In Instance Settings, complete the following fields. Then, click Next.

•IP/Hostname address (required)—Type the IP address or Hostname of your Fortinet Firewall.

•API Port (required)—Select the API port used by your Fortinet Firewall.

•API Key (required)—Type the API key that your Fortinet Firewall generated.

•Certificate (required)—Upload the obtained signed SSL certificate.

7.In Syslog Settings, complete the following fields. Then, click Next.

•Listener (Bind) IP address (optional)—Type the IP address for the connector to listen for incoming Syslog messages. If not specified, the connector will listen to all available network interfaces (0.0.0.0).

•Allowed source IP addresses (optional)—Type the IP addresses or CIDR blocks from which the Syslog listener can accept incoming messages. Use the UDP and TCP settings to prevent log spoofing from unauthorized devices on the local network. If you do not specify an IP address, the listener accepts connections from any IP address.

•Protocol (required)—Select the connection protocol.

•Port (required)—Specify the port number to use for the connection. If multiple integrations use the same target device, configure a unique Syslog listener port for each integration to avoid port conflicts.

•Severity settings (required)—Select severity types for the logs to be received. Available severity settings are:

oAll severities—Include low, information, notification, warning, error, critical, alert and emergency.

oEmergency

oAlert and above

oCritical and above

oError and above

oWarning and above

oNotification and above

oInformation and above

8.In Summary, review your settings and click Create.

When the integration setup is complete, the data from Fortinet will appear in the ESET PROTECT Web Console > Advanced Search. Retrieve the data from Fortinet using the following filter:

Troubleshooting

˄˅