Fortinet FortiEDR On-Premise

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure an On-Premise deployed Fortinet FortiEDR Central Manager for telemetry data ingestion to the Samurai platform.

Follow the steps below:

1) Ensure Connectivity Requirements are in place

• Connectivity Requirements

2. From the FortiEDR Central Manager (On-Premise)

• Configure syslog to your local collector
• Create a user with a REST API role
• Additional information required

3. From the Samurai MDR portal

• Complete the Fortinet FortiEDR On-premise Integration

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Configure syslog to your local collector

Follow the steps outlined in the Fortinet documentation:

• Syslog

Use the following parameters when completing the steps:

Create a user with a REST API role

Follow the Fortinet documentation:

• To add a user

When completing the steps use the following parameters:

Additional information required

You will also need to provide additional information to complete the integration. This includes:

• Deployment URL: This is the URL utilized to access the On-Premise deployed FortiEDR Central Manager
  • Example: https://IP address or Hostname (if hostname it must resolve to the IP address)
• Organization: This is the Organization name used when logging into the FortiEDR Central Manager (On-Premise)

Complete the Fortinet FortiEDR On-premise Integration

1. Login to the Samurai MDR portal
2. Click Telemetry and select Integrations from the main menu
3. Select Create
4. Locate and click Fortinet FortiEDR (on-prem) 
5. Click Next
6. Select the relevant Local Collector and click Next
7. Enter a Name of Integration
8. Enter a Description (Optional)
9. Enter your Local Deployment URL - example https://IP or hostname (if hostname is used, it must be resolveable and accessible from the local collector)
10. Enter your Organization
11. Enter your Username
12. Enter your Password
13. Select the Fallback timezone - this is the timezone to assume if no epoch field exists in the data. UTC and CET (for CET/CEST) supported.
14. Click Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.