Fortinet FortiWebCloud Add-on for Splunk
Overview
Details
Fortinet FortiWeb Cloud Add-on for Splunk
Overview
Fortinet FortiWeb Cloud Add-On for Splunk is the technical add-on (TA) developed by Fortinet, Inc. The add-on enables Splunk Enterprise to ingest or map security and audit data collected from FortiWeb Cloud. The key features include:
-
Ingesting attack logs of FortiWeb Cloud.
-
Ingesting audit logs of FortiWeb Cloud.
Dependencies
Configuration Steps
1. Install Fortinet FortiWeb Cloud Add-on for Splunk on search head, indexer, forwarder or single instance Splunk server:
There are three ways to install the add-on:
-
Install from Splunk web UI: Manage Apps -> Browse more apps -> Search keyword "FortiWebCloud" and find the add-on with Fortinet logo -> Click “Install free” button -> Click restart Splunk service.
-
Install from file on Splunk web UI: Manage Apps -> Install from file -> Upload the .tgz file which is downloaded from https://splunkbase.splunk.com/app/4626 -> Check the upgrade box -> Click restart Splunk service.
-
Install from file on Splunk server CLI interface: Extract the .tgz file -> Place the Splunk_TA_fortinet_fortiwebcloud folder under $SPLUNK_HOME/etc/apps -> Restart Splunk service.
2. Add data input on Splunk server:
Through Splunk Web UI:
Settings -> Data Input -> UDP -> New Local UDP
Port: 514 (Example, can be modified according to your own plan)
leave other parameters as is.
Note: The UDP port, 514 in this example should be opened in firewall for logs to pass through.
Press the button "Next".
Source Type: "Select"
Click on the "Select Source Type" Drop Menu, input "fwbcld" in the filter, press Enter, and select the item "fwbcld_log".
Fortinet FortiWebCloud Add-On for Splunk will by default automatically extract FortiWebCloud log data from inputs with sourcetype 'fwbcld_log'.
If "Fortinet FortiWebCloud App for Splunk" has been installed already, in "App Context" Drop Menu, select the item, otherwise, leave it by default.
leave other parameters as is.
Press the button "Review".
Make sure everything is correct and press the button "Submit".
3. Verify the Add-on in "Search & Reporting" App:
Through Splunk Web UI:
Apps -> Search & Reporting
If attack logs have been sent to Splunk, input 'sourcetype="fwbcld_attack"' in the search window, change the time range if needed.
Then the attack logs will be listed below.
If audit logs have been sent to Splunk, input 'sourcetype="fwbcld_event"' in the search window, change the time range if needed.
Then the audit logs will be listed below.
For more information on the App support, email splunk_app@fortinet.com.
Release Notes
Version 1.0.1
v1.0.1: August 2019
- Remove the duplicated stanza in transforms.conf.
v1.0.0: July 2019
- Initial release.