Azure ATP integration with Fortinet

[Jose Escamilla]

quick question I am trying to setup our VPN appliance to see if it can forward the logs to Azure ATP agents.    I read some articles on the integration with Radius servers but looking to see if anyone has been able to get a Fortinet appliance to connect and send info to the agents.    If anyone can share some insight it would be greatly appreciated. We do not have any standalone agents by the way. 

Thanks,  

[#2]

@Jose Escamilla 

@Andrew Harris (AZURE SEC): Is this something you can speak to? 

[#3]

We only need the RADIUS Accounting logs. Once enabled in AATP, you can forward these events into AATP.

Here: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/install-atp-step6-vpn

However, if that isn't possible for whatever reason (i.e. the appliance doesnt support RADIUS Accounting), I'd recommend sending this data to Azure Sentinel. We would do similar threat intelligence fusion against that data source as we do for Azure ATP--as long as you properly integrate it into Azure Sentinel so it knows which field is your Users, Computers, Timestamp, etc.. Here is an Azure Sentinel reference to get you started if that caught your interest : https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard

Again, however, if the appliance supports RADIUS Accounting, just point those events to AATP and it will do the rest.