CCX Extensions for Fortinet Products (Fortigate Firewall)

About Us: CyberCX is Australia’s greatest force of cyber security experts. Our highly skilled professional services team operates a 24x7 on-shore security operations centre (SOC) servicing corporate and public sector organisations across Australia and New Zealand, specialising in Security Operations services leveraging Splunk. Description: The CCX Extensions for Fortinet Products looks to provide additional field extraction and CIM compliance for Fortinet Fortigate syslog logs pre-parsed using the Add-on "Fortinet FortiGate Add-On for Splunk". This Technical Add-on does not replace the public Splunk Add-on for Fortinet FortiGate (https://splunkbase.splunk.com/app/2846) but works as an additional extension to be deployed on Search Heads (only). Currently, this add-on provides additional extraction and CIM compliance support for the following sourcetypes: - fortigate_traffic - fortigate_utm - fortigate_anomaly - fortigate_event Fully compatible with Splunk Enterprise and Splunk Cloud, built by an Ops team for Ops teams. Features: - This TA currently supports logtypes tagged under the following CIM datamodels: Alerts, Authentication, Change, Email, Intrusion Detection (IDS), Malware, Network Traffic, Network Session, Performance, and Web.