Imports the inventory of supervised devices, security logs and incidents from FortiAnalyzer (Fortinet SIEM / log collector) through its JSON-RPC API.
For the general flow of adding a source, see Connect Data Sources.
Before you start
FortiAnalyzer 7.2 or later — compatible with 7.4, 7.6 and 8.0; static REST API tokens are available from v7.2
A FortiAnalyzer administrator account able to create a REST API user
Read access to the target ADOM (root by default)
Step 1 — Create a REST API user
Sign in to the FortiAnalyzer console and select the target ADOM (default root)
Open System Settings → Admin → Administrators → Create New → REST API Admin
JSON API Access: Read
Admin Profile: Restricted_User (read-only)
Trusted Hosts: restrict to the IP addresses provided by HARVEN
Click Regenerate → Generate to obtain the API key
Copy and store the key securely — it is shown only once
Step 2 — Configure the connector in HARVEN
Open Workspace → Data sources → Add → FortiAnalyzer
Base URL: your FortiAnalyzer instance endpoint, e.g. https://fortianalyzer.example.com
Paste the token into the API Token field
Leave ADOM at root, or enter the ADOM you granted access to
Test the connection before saving
About Trusted Hosts
Contact us so we can provide the IP address to enter in the API user's Trusted Hosts field.
What to enter in HARVEN
Base URL — FortiAnalyzer instance URL, the JSON-RPC endpoint (e.g. https://fortianalyzer.example.com)
API Token — REST API user token (FortiAnalyzer → System Settings → Admin → Administrators → REST API Admin)
ADOM — Administrative domain to read, root by default
What HARVEN reads
devices — Inventory of supervised devices: identification (name, serial, hostname), platform (ip, platform, os_version), state and scope (connection_status, adom)
logs — Security logs: classification (log_type, subtype, level), network context (action, src_ip, dst_ip), actor and timestamp (user, message, event_time)
incidents — Security incidents: identification and severity (incident_id, category, severity), handling (status, assignee), latency and MTTR (create_time, update_time)
Official documentation
Need help? Contact [email protected].
