Connect this data source on your own, using the Hunters platform.
TL;DR
Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
|---|---|---|---|---|---|---|---|
Fortinet Firewall Logs | ✅ | ✅ | fortinet_firewall | Key value | S3 | ||
Fortinet FortiAnalyzer Logs | ✅ | ✅ | fortinet_fortianalyzer | Key value | S3 | ||
Fortinet FortiMail Logs | ✅ | fortimail_logs | Key value | S3 | |||
Fortinet FortiEDR Security Events | ✅ | ✅ | fortinet_fortiedr_security_events | JSON | API |
Overview
Fortinet is a cybersecurity company specializing in network security solutions. It provides hardware, software, and services for protecting enterprise IT environments, with a focus on firewalls, intrusion prevention, endpoint security, and secure access solutions. Known for its FortiGate product line, Fortinet integrates threat intelligence and automation to address complex security challenges. The company serves a wide range of industries, emphasizing scalability and centralized management for global organizations.
Supported data types
Fortinet Firewall Logs
Overview
Table name: fortinet_firewall
Fortinet Firewall logs provide detailed records of events and traffic flowing through the firewall. These logs are crucial for security analysis, troubleshooting, and compliance reporting. They include information on allowed and denied traffic, security threats detected, system events, VPN activities, and more. Analyzing these logs helps in identifying suspicious activities, understanding traffic patterns, and ensuring the network's security posture is maintained effectively.
Learn more here.
For details on specific events logged see here.
Send data to Hunters
Hunters supports the ingestion of Fortinet logs via an intermediary AWS S3 bucket.
To connect Fortinet logs:
Export your logs from Fortinet to an AWS S3 bucket by following this guide.
Once the export is completed and the logs are collected to S3, follow the steps in this section.
Expected format
Logs are expected in KeyVal format.
Fortinet FortiAnalyzer Logs
Overview
Table name: fortinet_fortianalyzer
Fortinet FortiAnalyzer Logs provide centralized logging and analysis for Fortinet security devices, enabling organizations to collect, store, and analyze logs from multiple sources. This helps identify security incidents, monitor network activity, and meet compliance requirements. FortiAnalyzer supports advanced analytics, reporting, and visualization tools, allowing for streamlined investigation and response to threats.
Send data to Hunters
Hunters supports the ingestion of Fortinet logs via an intermediary AWS S3 bucket.
To connect Fortinet logs:
Export your logs from Fortinet to an AWS S3 bucket by following this guide.
Once the export is completed and the logs are collected to S3, follow the steps in this section.
Expected format
Logs are expected in KeyVal format.
Fortinet FortiMail Logs
Overview
Table name: fortimail_logs
Fortinet FortiMail Logs record email traffic and activity within the FortiMail secure email gateway. These logs provide detailed insights into email flows, spam filtering, and potential threats, helping organizations monitor and analyze email-based security events. FortiMail logs support compliance reporting, threat investigation, and proactive measures against phishing, malware, and other email-borne attacks.
Send data to Hunters
Hunters supports the ingestion of Fortinet logs via an intermediary AWS S3 bucket.
To connect Fortinet logs:
Export your logs from Fortinet to an AWS S3 bucket by following this guide.
Once the export is completed and the logs are collected to S3, follow the steps in this section.
Expected format
Logs are expected in KeyVal format.
Fortinet FortiEDR Security Events
Overview
Table name: fortinet_fortiedr_security_events
Fortinet FortiEDR logs provide detailed telemetry on endpoint activity, focusing on detecting and responding to advanced threats in real time. These logs include information about process execution, network connections, file access, and behavioral anomalies. They are typically used for threat hunting, incident investigation, and integration with SIEM platforms for centralized security monitoring.
Send data to Hunters
Hunters supports the ingestion of Fortinet FortiEDR logs via an API connection.
📘Note
To perform this process, you must have FortiEDR administration rights.
To connect FortiEDR logs:
Create a designated FortiEDR user:
On your FortiEDR platform, open the Administration section and then navigate to Users.
Click Add User to open the user details window.
.png?sv=2022-11-02&spr=https&st=2025-07-03T09%3A45%3A22Z&se=2025-07-03T10%3A00%3A22Z&sr=c&sp=r&sig=BMyaMRZudQDKpP0%2BYFMdki7tVGCRI%2B1DEG9Kgom0xEM%3D)
Fill in the fields to create a designated user for Hunters. We recommend providing an informative user name.
Define a password for the user and remember it for the next steps.
Under Roles, select Senior Analyst.
Under Advanced, mark the Rest API checkbox.
Make sure the Two-Factor Authentication checkbox is NOT selected.
Click Save.
Complete the process on the Hunters platform, following this guide.
During this process, provide Hunters with the user name and password of the user created in step 1.
Expected format
Logs are expected in JSON format.