icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Fortinet FortiWebCloud App for Splunk
SHA256 checksum (fortinet-fortiwebcloud-app-for-splunk_101.tgz) a6d21a2f6386829457cabddaa5c5d6684cb2c2295a133f941e72cb9446141fa4
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Fortinet FortiWebCloud App for Splunk

Splunk AppInspect Passed
Overview
Details
The Fortinet FortiWeb Cloud App for Splunk provides real-time and historical dashboard on threats, performance metrics and audit information for FortiWeb Cloud. FortiWeb Cloud WAF-as-a-Service is a SaaS cloud-based web application firewall (WAF) that protects public cloud hosted web applications from the OWASP Top 10, zero day threats and other application layer attacks.

Fortinet FortiWebCloud App for Splunk

Overview

The Fortinet FortiWeb Cloud App for Splunk provides real-time and historical dashboard on threats, performance metrics and audit information for FortiWeb Cloud. FortiWeb Cloud WAF-as-a-Service is a SaaS cloud-based web application firewall (WAF) that protects public cloud hosted web applications from the OWASP Top 10, zero day threats and other application layer attacks.

With the massive set of logs and big data aggregation through Splunk, the Fortinet FortiWeb Cloud App for Splunk is certified with pre-defined threat monitoring and performance indicators that helps guide network security . As the de facto trending dashboard for many enterprises or service providers, IT administrators can also modify the regular expression query to custom fit views for advanced security reporting and compliance mandates.

This document describes how to set up Fortinet FortiWeb Cloud App for Splunk as well as configuration on the SaaS to enable log shipping to Splunk.

Dependencies

The Fortinet FortiWeb Cloud App depends on the Add-on application in order to work properly, so please make sure Fortinet FortiWebCloud Add-on for Splunk has been installed before you proceed.

Configuration Steps

1. Install Fortinet FortiWebCloud Add-on for Splunk on search head, indexer, forwarder or single instance Splunk server:

There are three ways to install the add-on:

  1. Install from Splunk web UI: Manage Apps -> Browse more apps -> Search keyword "FortiWeb Cloud" and find the add-on with Fortinet logo -> Click "Install free" button -> Click restart Splunk service.

  2. Install from file on Splunk web UI: Manage Apps -> Install from file -> Upload the .tgz file which is downloaded from https://splunkbase.splunk.com/app/4626 -> Check the upgrade box -> Click restart Splunk service.

  3. Install from file on Splunk server CLI interface: Extract the .tgz file -> Place the Splunk_TA_fortinet_fortiwebcloud folder under $SPLUNK_HOME/etc/apps -> Restart Splunk service.

2. Install Fortinet FortiWeb Cloud App for Splunk on search head, indexer, forwarder or single instance Splunk server:

There are three ways to install the app:

  1. Install from Splunk web UI: Manage Apps -> Browse more apps -> Search keyword "FortiWebCloud" and find the app with Fortinet logo -> Click "Install free" button -> Click restart Splunk service.

  2. Install from file on Splunk web UI: Manage Apps -> Install from file -> Upload the .tgz file which is downloaded from https://splunkbase.splunk.com/app/4627 -> Check the upgrade box -> Click restart Splunk service.

  3. Install from file on Splunk server CLI interface: Extract the .tgz file -> Place the SplunkAppForFortiWebCloud folder under $SPLUNK_HOME/etc/apps -> restart Splunk Service.

3. Add data input on Splunk server:

Through Splunk Web UI:
Settings -> Data Input -> UDP -> New Local UDP

Port: 514 (Example, can be modified according to your own plan)

leave other parameters as is.
Note: the UDP port, 514 in this example should be opened in firewall for logs to pass through.

Press the button "Next".
Source Type: "Select"
Click on the "Select Source Type" Drop Menu, input "fwbcld" in the filter, press Enter, and select the item "fwbcld_log".

Fortinet FortiWebCloud Add-On for Splunk will by default automatically extract FortiWebCloud log data from inputs with sourcetype 'fwbcld_log'.

In "App Context" Drop Menu, select "Fortinet FortiWebCloud App for Splunk".
leave other parameters as is.

Press the button "Review".
Make sure everything is correct and press the button "Submit".

4. Configure FortiWebCloud to send logs to Splunk server:

Attack Logs:

Enter the Application to be exported on FortiWebCloud.
Go to LOGS -> Attack Log Export, switch on the feature, and press "Add Log Server".
Input the name, the IP/Domain and Port of the Splunk server (514, for example).
Choose the protocol (UDP, for example).
In "Log Format", choose "Splunk".
Select the "Log Severity" and "Log Facility", press "OK" to finish.

Audit Logs:

Go to GLOBAL -> Settings, and switch on the feature of "Audit Logs Export".
Input the IP/Domain and Port of the Splunk server (514, for example).
Choose the protocol (UDP, for example).
In "Log Format", choose "Splunk".
Select the "Log Facility", press "SAVE" to finish.

5. Verify that logs are received on Splunk server:

Through Splunk Web UI:
Apps -> Search & Reporting
If attack logs have been sent to Splunk, input 'sourcetype="fwbcld_attack"' in the search window, change the time range if needed.
Then the attack logs will be listed below.

If audit logs have been sent to Splunk, input 'sourcetype="fwbcld_event"' in the search window, change the time range if needed.
Then the audit logs will be listed below.

At this point, you will see data parsed and presented on the dashboard of Fortinet FortiWebCloud App for Splunk.

Troubleshooting

  • Go back to Configuration Steps to double check if every step has been followed.
  • Make sure port 514 in this case is opened on firewalls throughout the log's data path.
  • Double-check Splunk server and FortiWebCloud are synchronized in time.
  • Make sure the attack log and event log have been generated.
  • If nothing shows on dashboard, extend the time range may works.

If still no luck getting the dashboards to show anything, please try searching for "host=x.x.x.x" where x.x.x.x is the IP or the hostname of the machine reporting the log, if there are any results with sourcetype=fwbcld_attack or fwbcld_event, you just need a little bit of patience, if not, please take a screenshot and send it to the email below.

For more information on the App support, email splunk_app@fortinet.com for further support.

Release Notes

Version 1.0.1
Aug. 6, 2019

v1.0.1: August 2019
- Disable the data model acceleration by default.
v1.0.0: July 2019
- Initial release.

13
Installs
23
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2019 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.