Connect FortiAnalyzer - HARVEN Help Center

Imports the inventory of supervised devices, FortiGate traffic logs and incidents from FortiAnalyzer (Fortinet SIEM / log collector) through its JSON-RPC API.

For the general flow of adding a source, see Connect Data Sources.

Prerequisites

FortiAnalyzer 7.2 or later (compatible with 7.4, 7.6, 8.0) - static REST API tokens are available from v7.2
FortiAnalyzer administrator account able to create a REST API user
Read access to the target ADOM (root by default)

Setup

Step 1 - Create a REST API user

Sign in to the FortiAnalyzer console and select the target ADOM (default root)
System Settings → Admin → Administrators → Create New → REST API Admin
JSON API Access: Read
Admin Profile: Restricted_User (read-only)
Trusted Hosts: restrict to the IP addresses provided by HARVEN
Click Regenerate → Generate to obtain the API key
Copy and store the key securely (shown only once)

Step 2 - Fill the parameters in HARVEN

Base URL: your FortiAnalyzer instance endpoint, e.g. https://fortianalyzer.example.com
Paste the token into the API token field
Leave ADOM at root, or enter the ADOM you granted access to
Click Save. HARVEN does not test the credentials on save: the connector opens on its Tables tab, where each table is checked

About Trusted Hosts

Fields to fill in HARVEN

Field	Where to find it
Base URL	e.g. https://fortianalyzer.example.com
API token	FortiAnalyzer → System Settings → Admin → Administrators → REST API Admin
ADOM	The ADOM selected in Step 1 — root by default

Collected data

devices — Inventory of supervised devices: Identification (name, serial, hostname), Platform and firmware (ip, platform, os_version, build, patch), Signatures and sync (av_version, ips_version, config_status, last_checked), State and scope (connection_status, adom)
logs — FortiGate traffic logs, read live over a bounded window — the last 24 hours unless you filter on event_time, and at most the 100,000 most recent rows: Classification (log_type, subtype, level), Network context (action, src_ip, dst_ip), Actor and timestamp (user, message, event_time)
incidents — Security incidents: Identification and severity (incident_id, category, severity), Handling (status, assignee), Latency and MTTR (create_time, update_time)

Official documentation

Need help? Contact [email protected].

Setup

Step 1 - Create a REST API user

System Settings → Admin → Administrators → Create New → REST API Admin

JSON API Access: Read

Admin Profile: Restricted_User (read-only)

Trusted Hosts: restrict to the IP addresses provided by HARVEN

Click Regenerate → Generate to obtain the API key

Copy and store the key securely (shown only once)

Step 2 - Fill the parameters in HARVEN

Base URL: your FortiAnalyzer instance endpoint, e.g. https://fortianalyzer.example.com

Paste the token into the API token field

Leave ADOM at root, or enter the ADOM you granted access to

Click Save. HARVEN does not test the credentials on save: the connector opens on its Tables tab, where each table is checked

About Trusted Hosts

Field

Where to find it

Base URL

e.g. https://fortianalyzer.example.com

API token

FortiAnalyzer → System Settings → Admin → Administrators → REST API Admin

ADOM

The ADOM selected in Step 1 — root by default

Collected data

devices — Inventory of supervised devices: Identification (name, serial, hostname), Platform and firmware (ip, platform, os_version, build, patch), Signatures and sync (av_version, ips_version, config_status, last_checked), State and scope (connection_status, adom)

logs — FortiGate traffic logs, read live over a bounded window — the last 24 hours unless you filter on event_time, and at most the 100,000 most recent rows: Classification (log_type, subtype, level), Network context (action, src_ip, dst_ip), Actor and timestamp (user, message, event_time)

incidents — Security incidents: Identification and severity (incident_id, category, severity), Handling (status, assignee), Latency and MTTR (create_time, update_time)