All Apps and Add-ons

Does the FortiGate addon work with the new Splunk Security Essentials App?

Explorer

Will the Fortigate Addon work with the new Splunk Security Essentials App (v2.1) out of the box or will I need to make additional customizations to get things working?

I am thinking it's the latter since the use case for Basic Scanning shows the requirement "Must have Firewall Data" is satisfied for live data (Green Check), but the requirement "Must have a dest_ip and dest_port field" is not meeting requirements of the app (red exclimation).

0 Karma
1 Solution

Contributor

in the add-on, there is dest but not dest_ip, so you can add an alias for it to work.
dest_port should already be there.
you can add the following in props.conf of the add-on under [fgt_traffic]
FIELDALIAS-fgt_traffic_dest_ip = dstip as dest_ip

The add-on works with enterprise security fine but wasn't verified with security essentials app. So you mileage may vary.

View solution in original post

Contributor

in the add-on, there is dest but not dest_ip, so you can add an alias for it to work.
dest_port should already be there.
you can add the following in props.conf of the add-on under [fgt_traffic]
FIELDALIAS-fgt_traffic_dest_ip = dstip as dest_ip

The add-on works with enterprise security fine but wasn't verified with security essentials app. So you mileage may vary.

View solution in original post

Explorer

Thanks for the info. I will give that a try and let you know if it works out.

0 Karma

Splunk Employee
Splunk Employee

Any data sources that are Common Information Model compliant should satisfy that particular requirement (along with all of those in the app -- there are a few gaps that we're looking forward to closing in the near future).

Do you have the add-on installed on your Search Head?

0 Karma

Explorer

Small single server implementation at the moment, so yes both Security Essentials and Fortigate add-on are installed on the search head.

0 Karma