Configuring FortiSOAR for FortiSIEM Integration

To set up FortiSOAR with a role so FortiSIEM integration can occur, take the following steps.

Set Up Authentication

HTTP Basic Authentication for API is used for authentication. A user that FortiSIEM can use to read, execute playbooks and connectors can be created by taking the following steps.

  1. Click the Setting icon on top right hand of the FortiSOAR GUI.

  2. Select Roles on left hand toolbar.

  3. Click Add.

  4. Give the Role a Name. For example, "FortiSIEM-Role".

  5. In Set Role Permissions, set the following:

    1. For All Modules Except for Users, set to Read allow.

    2. Set Connectors to Read + Execute.

    3. Set Playbooks to Read + Execute.

    4. Click Save.

  6. Select Users on left hand toolbar.

  7. Click Add.

  8. Set the following: 

    1. Fill out the First Name and Last Name fields, such as First Name "FortiSIEM", and "Last Name" User".

    2. For User Type, select Vendor.

    3. Enter a valid email address, such as yourname@yourdomain.tld.

    4. Select your Desired Team.

      Note: You must assign the user to a Team in addition to a Role, otherwise authentication for executing playbooks will fail.

    5. For Select Role, you can select FortiSIEM-Role for minimal access, or a desired Role.

    6. Under Authentication, for User Type, select Application User.

    7. Under Authentication, specify the username. Note, it can be different from the Name display value: fortisiem-user.

    8. Click Save. An email will be sent to the email address provided to change the password.

    9. Keep a record of the changed password.

    At this point, you can configure FortiSIEM for FortiSOAR Playbooks and FortiSOAR Connectors.

For additional information on the FortiSOAR for FortiSIEM Integration solution, see here.

Sample playbooks are available here. This contains:

  • Playbook for getting IP address reputation via VirusTotal

  • Playbook for getting Domain reputation via VirusTotal, Anomali, FortiGuard, MX Toolbox, URLVoid, Alienvault OTX

  • Playbook for getting URL reputation via VirusTotal, Anomali, FortiGuard, MX Toolbox, URLVoid

  • Playbook for getting file hash reputation via VirusTotal