Does the FortiGate addon work with the new Splunk Security Essentials App?

[smaat11]

Will the Fortigate Addon work with the new Splunk Security Essentials App (v2.1) out of the box or will I need to make additional customizations to get things working?

I am thinking it's the latter since the use case for Basic Scanning shows the requirement "Must have Firewall Data" is satisfied for live data (Green Check), but the requirement "Must have a dest_ip and dest_port field" is not meeting requirements of the app (red exclimation).

[jerryzhao · Accepted solution]

in the add-on, there is dest but not dest_ip, so you can add an alias for it to work.
dest_port should already be there.
you can add the following in props.conf of the add-on under [fgt_traffic]
FIELDALIAS-fgt_traffic_dest_ip = dstip as dest_ip

The add-on works with enterprise security fine but wasn't verified with security essentials app. So you mileage may vary.

[smaat11]

Thanks for the info. I will give that a try and let you know if it works out.

[David]

Any data sources that are Common Information Model compliant should satisfy that particular requirement (along with all of those in the app -- there are a few gaps that we're looking forward to closing in the near future).

Do you have the add-on installed on your Search Head?

[smaat11]

Small single server implementation at the moment, so yes both Security Essentials and Fortigate add-on are installed on the search head.