FortiNDR Cloud Sentinel add new fields for detections

[FortiNDR-Integration]

Required items, please complete

Change(s):

• Add Mitre Attack primary/secondary ids to detections
• Add link URL to detection rule page to detections
• Remove PDNS and DHCP fields from detections

Reason for Change(s):

• Fields update required by the customer

Version Updated:

• Yes

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[FortiNDR-Integration]

Here are the working images:
Overview:

OrchestratorWatchdog;

SingletonEternalOrchestrator:

FetchAndSendEventsHistory:

FetchAndSendDetectionsHistory:

FetchAndSendEvents:

FetchAndSendDetections:

[FortiNDR-Integration]

Hi @v-prasadboke,

As you asked, we updated the data connector to use Python 3.11, but we met an issue, and need your help.

After we update python 3.11, urllib3 starts to give an error when making requests, SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)'))).

Have you dealt with this kind of situation before? Could you please help us with it?

[FortiNDR-Integration]

Hi @v-prasadboke ,

We have fixed the SSL issue and updated the integration to use python 3.11.

Here are the working images:
Overview:

OrchestratorWatchdog;

SingletonEternalOrchestrator:

FetchAndSendEventsHistory:

FetchAndSendDetectionsHistory:

FetchAndSendEvents:

FetchAndSendDetections:

Best