Jul 07 2020 05:51 PM
Jul 07 2020 05:51 PM
Hi, hoping someone can help me figure out why the Fortigate workbook isn't populating. I've had the Fortinet logs coming through for about 30 hours now, and the workbook doesn't seem to be populating. Any ideas?
Jul 08 2020 05:17 AM
@joshzan It does look like the data is being ingested, but have you run any queries against the table containing the Fortinet data to verify that the table is populated?
In the Logs blade:
| where DeviceVendor == "Fortinet"
| where DeviceProduct startswith "Fortigate"
Dec 14 2020 04:37 AM
So when you run this, you get data back? If so the workbook uses the same.
CommonSecurityLog | where DeviceVendor =~ 'Fortinet' | where DeviceProduct =~ 'Fortigate'
Do you get an error from the Workbook or "no data" ? Have you confirmed that the workbook is opened in the same Workspace?
Dec 14 2020 11:03 AM
Dec 14 2020 11:28 AM - edited Dec 14 2020 11:56 AM
I think I've figured out the problem here. The query doesn't actually work exactly as typed, my mistake. The DeviceProduct field contains data such as "FortiGate-80E" rather than simply "FortiGate". I've modified the Workbook queries to begin with...
let data = CommonSecurityLog
| where DeviceVendor =~ 'Fortinet'
| where DeviceProduct startswith 'Fortigate'
and it now populates. Perhaps this is a syntax problem with the workbook itself or maybe the Fortigate output format has changed since the workbook template was written. One other possibility, the content being sent to Sentinel in my case comes from FortiAnalyzer rather than directly from a Fortigate firewall.
Feb 08 2022 12:30 PM
Feb 13 2022 07:00 AM
Does this work better, new workbook version
1. How to install clivewatson/KQLpublic: My useful KQL and Azure Monitor workbooks (Public) (github.com)
- Just follow the above process but create a NEW Sentinel workbook, to paste the new code into
2. Link to a updated version of the Workbook: https://raw.githubusercontent.com/clivewatson/KQLpublic/master/KQL/Workbooks/Forti/FortiGate v1.1.wo...