Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Azure ATP integration with Fortinet

Copper Contributor

quick question I am trying to setup our VPN appliance to see if it can forward the logs to Azure ATP agents.    I read some articles on the integration with Radius servers but looking to see if anyone has been able to get a Fortinet appliance to connect and send info to the agents.    If anyone can share some insight it would be greatly appreciated. We do not have any standalone agents by the way. 



2 Replies

@Jose Escamilla 


@Andrew Harris (AZURE SEC): Is this something you can speak to? 

We only need the RADIUS Accounting logs. Once enabled in AATP, you can forward these events into AATP.


However, if that isn't possible for whatever reason (i.e. the appliance doesnt support RADIUS Accounting), I'd recommend sending this data to Azure Sentinel. We would do similar threat intelligence fusion against that data source as we do for Azure ATP--as long as you properly integrate it into Azure Sentinel so it knows which field is your Users, Computers, Timestamp, etc.. Here is an Azure Sentinel reference to get you started if that caught your interest :

Again, however, if the appliance supports RADIUS Accounting, just point those events to AATP and it will do the rest.