How to Export FortiSIEM Events as Raw Logs
Summary
A practical guide to exporting FortiSIEM events through its REST query API, polling for results, extracting raw log messages, and troubleshooting common export problems.
Key points
- Run an XML event query through FortiSIEM’s REST API using an account authorized to run analytics queries.
- Poll the query’s progress endpoint until it reaches 100, then retrieve results by query ID.
- Use offset and count parameters to page through large result sets.
- Select rawEventMsg to retrieve each event’s original log line; the guide uses Python to extract these messages from XML.
- Older events may be in archive storage, and the guide lists common fixes for authentication, query, and missing-log issues.
Article Details
- Defense Focus
- Export FortiSIEM event logs as raw messages for sanitization and investigation in LogTotal.
- Detection Methods
- Query events through the REST event query API, then extract each event's rawEventMsg value for review.
- Data Sources
- FortiSIEM event records, including phRecvTime, reptDevIpAddr, eventType, and rawEventMsg.
- Archived events may require separate retrieval steps.
- Rule Types
- XML event-query requests submitted to the REST API.
- Defensive Actions
- Use an API account authorized to run analytics queries and include the organization in the basic-auth username.
- Build and test filters in Analytics, using FortiSIEM attribute names.
- Narrow the time range and add filters if a query does not complete.
- Select rawEventMsg when exporting, and page through large result sets.
- Check archive options when older events are missing.
- Sanitize exported logs before reviewing them in LogTotal.