How to integrate Cymulate and Fortigates with Sentinel?

[ChrisF71]

New to these products and was told we could use Sentinel to pull data from Cymulate and our Fortigates.   Anyone know how to do this?   I know with have FortiSEIM, not sure on SOAR in our environment (if it would be useful for this we could get it added).

Thanks

[#2]

@ChrisF71 Fortigate is a Solution in the "Content Hub"

[#3]

@Clive_Watson That appears to use SOAR, which we don't currently have.  Trying to find out if there is a way without an additional spend.

[#4]

It does use a Playbook (SOAR), you have access to that in Azure - but I guess you have a process before you can use them? Playbooks are pretty low cost, you'd probably spend more trying to implement a workaround.

[#5]

Hello @ChrisF71 ,

1.  You can forward Syslog from Fortinet to Sentinel using Sentinel Log Forwarder:

Technical Tip: Integrate FortiGate with Microsoft ... - Fortinet Community

Deploy a log forwarder to ingest Syslog and CEF logs to Microsoft Sentinel | Microsoft Docs

2. If Cymulate supports Syslog, you can use the same log forwarder.