[{"data":1,"prerenderedAt":454},["ShallowReactive",2],{"connector-en-fortianalyzer":3},{"id":4,"title":5,"body":6,"category":444,"description":445,"extension":446,"meta":447,"navigation":448,"path":449,"seo":450,"sidebar":451,"stem":452,"updatedAt":444,"__hash__":453},"connectorsEn\u002Fen\u002Fconnectors\u002Ffortianalyzer.md","FortiAnalyzer",{"type":7,"value":8,"toc":428},"minimark",[9,13,18,44,48,96,100,103,157,161,166,249,252,256,272,275,285,289,325,328,331,334,364,373,376,380,387,398,401,407,411],[10,11,12],"p",{},"The FortiAnalyzer connector imports into OverView the inventory of Fortinet devices registered in the FortiAnalyzer Device Manager. It queries the appliance's JSON-RPC API in read-only mode, using an API key.",[14,15,17],"h2",{"id":16},"prerequisites","Prerequisites",[19,20,21,25,33,41],"ul",{},[22,23,24],"li",{},"FortiAnalyzer 7.2.2 or later, the version from which API key authentication is available",[22,26,27,28,32],{},"A FortiAnalyzer administrator account with the ",[29,30,31],"code",{},"Super_User"," profile, to create the REST API administrator",[22,34,35,36,40],{},"An ",[37,38,39],"strong",{},"OverView OutPost"," deployed in your network: FortiAnalyzer runs on premises, so OverView reaches its API through the OutPost",[22,42,43],{},"An HTTPS flow allowed from the OutPost VM to the FortiAnalyzer appliance",[14,45,47],{"id":46},"information-to-provide-in-overview","Information to provide in OverView",[49,50,51,64],"table",{},[52,53,54],"thead",{},[55,56,57,61],"tr",{},[58,59,60],"th",{},"Field",[58,62,63],{},"Description",[65,66,67,86],"tbody",{},[55,68,69,75],{},[70,71,72],"td",{},[37,73,74],{},"API URL",[70,76,77,78,81,82,85],{},"Base URL of the appliance as the OutPost VM reaches it, e.g. ",[29,79,80],{},"https:\u002F\u002Ffaz.example.com",", without the ",[29,83,84],{},"\u002Fjsonrpc"," path",[55,87,88,93],{},[70,89,90],{},[37,91,92],{},"API Key",[70,94,95],{},"API key of the REST API administrator (see the procedure below)",[14,97,99],{"id":98},"parameters","Parameters",[10,101,102],{},"These parameters are optional. Leave them at their default value unless you have a specific reason to change them.",[49,104,105,117],{},[52,106,107],{},[55,108,109,112,114],{},[58,110,111],{},"Parameter",[58,113,63],{},[58,115,116],{},"Default",[65,118,119,132,145],{},[55,120,121,126,129],{},[70,122,123],{},[37,124,125],{},"ADOMs",[70,127,128],{},"List of ADOMs to collect. When empty, the connector collects every ADOM visible to the API key",[70,130,131],{},"All",[55,133,134,139,142],{},[70,135,136],{},[37,137,138],{},"Verify SSL",[70,140,141],{},"Verify the appliance's TLS certificate. Disable it for a self-signed certificate",[70,143,144],{},"Enabled",[55,146,147,152,155],{},[70,148,149],{},[37,150,151],{},"Loadsub",[70,153,154],{},"Load VDOMs and cluster members along with each device",[70,156,144],{},[14,158,160],{"id":159},"procedure","Procedure",[162,163,165],"h3",{"id":164},"create-the-rest-api-administrator","Create the REST API administrator",[167,168,169,175,193,243],"ol",{},[22,170,171,172,174],{},"Sign in to FortiAnalyzer with an account that has the ",[29,173,31],{}," profile.",[22,176,177,178,181,182,185,186,181,189,192],{},"Go to ",[37,179,180],{},"System Settings"," > ",[37,183,184],{},"Administrators",", then ",[37,187,188],{},"Create New",[37,190,191],{},"REST API Admin",".",[22,194,195,196],{},"Fill in the form:\n",[19,197,198,207,219,228,237],{},[22,199,200,203,204],{},[37,201,202],{},"User Name",": a meaningful name, such as ",[29,205,206],{},"overview-api",[22,208,209,212,213,218],{},[37,210,211],{},"Admin Profile",": a read-only profile (see ",[214,215,217],"a",{"href":216},"#required-permissions","Required permissions",")",[22,220,221,224,225],{},[37,222,223],{},"JSON API Access",": ",[37,226,227],{},"Read",[22,229,230,224,233,236],{},[37,231,232],{},"Administrative Domain",[37,234,235],{},"All ADOMs",", or only the ADOMs to bring into OverView",[22,238,239,242],{},[37,240,241],{},"Trusted Hosts",": the LAN IP address of the OutPost VM",[22,244,245,246,192],{},"Click ",[37,247,248],{},"OK",[10,250,251],{},"Trusted hosts are mandatory for a REST API administrator: FortiAnalyzer rejects calls that do not come from a declared address. OverView calls originate from the OutPost VM, whose LAN IP address is shown on the hypervisor console banner.",[162,253,255],{"id":254},"generate-the-api-key","Generate the API key",[167,257,258,261,269],{},[22,259,260],{},"Open the administrator created in the previous step again.",[22,262,245,263,181,266,192],{},[37,264,265],{},"Regenerate",[37,267,268],{},"Generate",[22,270,271],{},"Copy the key and store it securely: it will not be shown again.",[10,273,274],{},"The key can also be generated from the CLI:",[276,277,283],"pre",{"className":278,"code":280,"language":281,"meta":282},[279],"language-text","execute api-user generate-key overview-api\n","text","",[29,284,280],{"__ignoreMap":282},[162,286,288],{"id":287},"configure-the-connector-in-overview","Configure the connector in OverView",[167,290,291,300,309,312,320],{},[22,292,293,294,181,297,192],{},"In OverView, go to ",[37,295,296],{},"Data Sources Settings",[37,298,299],{},"Sources",[22,301,302,303,305,306,192],{},"Select ",[37,304,5],{}," and click ",[37,307,308],{},"Configure",[22,310,311],{},"Select your OutPost as the collection point.",[22,313,314,315,317,318,192],{},"Enter the ",[37,316,74],{}," and the ",[37,319,92],{},[22,321,245,322,192],{},[37,323,324],{},"Save Configuration",[10,326,327],{},"On save, OverView checks access to the ADOM list, then to the devices of each ADOM.",[14,329,217],{"id":330},"required-permissions",[10,332,333],{},"The connector only performs reads. The REST API administrator needs:",[19,335,336,347,361],{},[22,337,338,340,341,343,344,218],{},[37,339,223],{}," set to ",[37,342,227],{}," (CLI: ",[29,345,346],{},"set rpc-permit read",[22,348,349,350,353,354,357,358],{},"an admin profile with ",[37,351,352],{},"Read-Only"," on ",[37,355,356],{},"Device Manager",", all other rights set to ",[37,359,360],{},"None",[22,362,363],{},"access to the ADOMs to collect",[10,365,366,367,369,370,372],{},"FortiAnalyzer permissions apply ADOM by ADOM. Every ADOM visible to the administrator must allow reading its devices, otherwise the access check fails. To limit collection to some ADOMs, restrict the administrator's ",[37,368,232],{}," or fill in the ",[37,371,125],{}," parameter.",[10,374,375],{},"Secrets stored by FortiAnalyzer (admin passwords, private keys, pre-shared keys) are never requested by the connector.",[162,377,379],{"id":378},"no-permission-for-the-resource-error","\"No permission for the resource\" error",[10,381,382,383,386],{},"FortiAnalyzer returns the error ",[29,384,385],{},"-11 No permission for the resource"," in two cases:",[19,388,389,395],{},[22,390,391,392,394],{},"the LAN IP address of the OutPost VM is not declared in the administrator's ",[37,393,241],{},";",[22,396,397],{},"the administrator cannot read the devices of an ADOM.",[10,399,400],{},"Run from the FortiAnalyzer CLI, the following commands show the source address of API calls and whether it matches an administrator:",[276,402,405],{"className":403,"code":404,"language":281,"meta":282},[279],"diagnose debug application auth 8\ndiagnose debug enable\n# … then to stop:\ndiagnose debug disable\n",[29,406,404],{"__ignoreMap":282},[14,408,410],{"id":409},"official-documentation","Official Documentation",[19,412,413,421],{},[22,414,415],{},[214,416,420],{"href":417,"rel":418},"https:\u002F\u002Fcommunity.fortinet.com\u002Ft5\u002FFortiManager\u002FTechnical-Tip-API-requests-by-using-the-API-token-authentication\u002Fta-p\u002F276351",[419],"nofollow","Fortinet Community: API requests using API token authentication",[22,422,423],{},[214,424,427],{"href":425,"rel":426},"https:\u002F\u002Fcommunity.fortinet.com\u002Ffortianalyzer-6\u002Ftroubleshooting-tip-troubleshooting-rest-api-access-error-190160",[419],"Fortinet Community: Troubleshooting REST API access error",{"title":282,"searchDepth":429,"depth":429,"links":430},2,[431,432,433,434,440,443],{"id":16,"depth":429,"text":17},{"id":46,"depth":429,"text":47},{"id":98,"depth":429,"text":99},{"id":159,"depth":429,"text":160,"children":435},[436,438,439],{"id":164,"depth":437,"text":165},3,{"id":254,"depth":437,"text":255},{"id":287,"depth":437,"text":288},{"id":330,"depth":429,"text":217,"children":441},[442],{"id":378,"depth":437,"text":379},{"id":409,"depth":429,"text":410},null,"Import the inventory of Fortinet devices managed by FortiAnalyzer into OverView","md",{},true,"\u002Fen\u002Fconnectors\u002Ffortianalyzer",{"title":5,"description":445},{"label":5},"en\u002Fconnectors\u002Ffortianalyzer","Bc3v3rLSKJS-2q6msw4xo5YjwZz7NtAjpGftCuCIg8A",1791970232332]