icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Fortinet FortiWeb Add-0n for Splunk
SHA256 checksum (fortinet-fortiweb-add-0n-for-splunk_101.tgz) 6001dc26856c60c6540abbf8b4b8739573b51d270cd102ef56067c8d7dddffe2
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Fortinet FortiWeb Add-0n for Splunk

Splunk AppInspect Passed
Overview
Details
Fortinet FortiWeb Add-On for Splunk is the technical add-on (TA) developed by Fortinet, Inc. The add-on enables Splunk Enterprise to ingest or map attack, traffic and event logs collected from FortiWeb physical and virtual appliances across domains. The key features include:

• Streamlining authentication and access from FortiWeb such as administrator login, user login to Splunk Enterprise Security Access Center

• Mapping FortiWeb threats report into Splunk Enterprise Security Endpoint Malware Center

• Ingesting attack logs, traffic logs and event logs etc.

The compatible FortiWeb version is 6.2.0 and later.

Fortinet FortiWeb Add-On for Splunk

Overview

Fortinet FortiWeb Add-On for Splunk is the technical add-on (TA) developed by Fortinet, Inc. The add-on enables Splunk Enterprise to ingest or map attack, traffic and event logs collected from FortiWeb physical and virtual appliances across domains. The key features include:

  • Streamlining authentication and access from FortiWeb such as administrator login, user login to Splunk Enterprise Security Access Center.

  • Mapping FortiWeb threats report into Splunk Enterprise Security Endpoint Malware Center.

  • Ingesting attack logs, traffic logs and event logs etc.

Dependencies

Please make sure FortiWeb version is 6.2.0 or later.

Configuration Steps

1. Install Fortinet FortiWeb Add-On for Splunk on search head, indexer, forwarder or single instance Splunk server:

There are three ways to install the add-on:

  1. Install from Splunk web UI: Manage Apps->Browse more apps->Search keyword "FortiWeb" and find the add-on with Fortinet logo->Click "Install free" button->Click restart splunk service.

  2. Install from file on Splunk web UI: Manage Apps->Install from file->Upload the .tgz file which is downloaded from https://splunkbase.splunk.com/app/4679 ->check the upgrade box-> click restart splunk service.

  3. Install from file on Splunk server CLI interface: Extract the .tgz file->Place the SplunkAddOnForFortiWeb folder under $SPLUNK_HOME/etc/apps-> Restart Splunk service.

2. Add data input on Splunk server:

Through Splunk Web UI:
Settings -> Data Input -> UDP -> New Local UDP

Port: 514 (Example, can be modified according to your own plan)

leave other parameters as is.
Note: The UDP port, 514 in this example should be opened in firewall for logs to pass through.

Press the button "Next".
Source Type: "Select"
Click on the "Select Source Type" Drop Menu, input "fwb" in the filter, and select the item "fwb_log".
Fortinet FortiWeb Add-On for Splunk will by default automatically extract FortiWeb log data from inputs with sourcetype "fwb_log".
leave other parameters as is.

Press the button "Review".
Make sure everything is correct and press the button "Submit".

3. Configure FortiWeb to send logs to Splunk server:

config log syslog-policy  
edit splunk  
config syslog-server-list 
edit 1
set server x.x.x.x
set port 514 (Example. Should be the same as in data input of Splunk server)   
end
end
config log syslogd
set policy splunk
set status enable
end

4. Verify the Add-on in "Search & Reporting" App:

Through Splunk Web UI:
Apps -> Search & Reporting

If attack logs have been sent to Splunk, input 'sourcetype="fwb_attack"' in the search window, change the time range if needed.
Then the attack logs will be listed below.

If traffic logs have been sent to Splunk, input 'sourcetype="fwb_traffic"' in the search window, change the time range if needed.
Then the traffic logs will be listed below.

If event logs have been sent to Splunk, input 'sourcetype="fwb_event"' in the search window, change the time range if needed.
Then the event logs will be listed below.

For more information on the App support, email splunk_app@fortinet.com.

Release Notes

Version 1.0.1
Sept. 10, 2019

- Initial release.

7
Installs
12
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2019 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.