---
title: "Integrate Fortinet FortiGate via FortiAnalyzer with Zscaler MDR"
slug: "integrate-fortinet-fortigate-via-fortianalyzer-with-red-canary"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/integrate-fortinet-fortigate-via-fortianalyzer-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Fortinet FortiGate via FortiAnalyzer with Zscaler MDR

> [!NOTE]
> **Note:** Red Canary is now Zscaler MDR. Please bear with us while we update the naming in our third-party integrations.

Monitoring a Fortinet FortiGate Next-Generation Firewall (NGFW) with Zscaler MDR enhances threat detection and response capabilities by combining advanced firewall protection with expert threat hunting. If you’re using Fortinet’s FortiAnalyzer product, you can configure Zscaler MDR to retrieve aggregated data from all your FortiGate NGFWs in a single integration.

#### Alert Filtering

Zscaler MDR only ingests Fortinet FortiGate alerts with `Critical` severity level from specific security-related log types (`virus`, `webfilter`, `ips`, `anomaly`, `voip`, `emailfilter`, `dlp`, `app-ctrl`, `waf`). Zscaler MDR automatically drops alerts that meet the following criteria:

- Severity level: `Warning`, `Error`, `Information`, or other non-critical levels
- Log types: `traffic` or other non-security event types

> [!NOTE]
> Note
> 
> This integration is designed to let multiple FortiGate NGFWs pass data to Zscaler MDR through a single FortiAnalyzer instance. If you need to integrate individual FortiGate NGFWs directly with Zscaler MDR, please follow [these instructions](/doc/docs/integrate-fortinet-fortigate-with-red-canary).

## Prerequisites

Before you start the Fortinet FortiGate via FortiAnalyzer integration, please make sure the following requirements are met:

- Your FortiAnalyzer login account uses the *Super_User* administrator profile (or a custom administrator profile with *Read-Write* permissions for System Settings). For more information, see the [FortiAnalyzer Administration Guide](https://docs.fortinet.com/document/fortianalyzer/7.6.2/administration-guide/392019/permissions).
- You have [OpenSSL](https://www.openssl.org/source/) (version 3.1 or higher) installed on the machine where you’ll be generating your TLS certificates

## 1 Zscaler MDR | Add the Integration

The first step is to add the new integration in Zscaler MDR.

1. In the Zscaler MDR portal, go to the **Integrations** page then click **Add Integration**. ![Add a new Red Canary integration](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations-main.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
2. On the **Add integration** dialog, search for the **Fortinet FortiGate via FortiAnalyzer** integration then click **Configure**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-1_01.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
3. On the **Add Integration page**, enter a name for the integration. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-1_02.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)

## 2 Zscaler MDR | Choose How Zscaler MDR Receives the Data

Setting the ingest method determines how Zscaler MDR will receive data from the FortiAnalyzer.

1. In the **Choose how Zscaler MDR will receive this data** section, select an ingest method from the **Ingest Format / Method** dropdown. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-2_01.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)

> [!NOTE]
> Note
> 
> For the Fortinet FortiGate via FortiAnalyzer integration, the only available ingest method is **Syslog**.
2. Click **Next**.

## 3 Zscaler MDR | Configure Zscaler MDR to Retrieve the Data

The integration will automatically provision a Zscaler MDR endpoint to collect the logs from the FortiAnalyzer.

1. In the **Configure Zscaler MDR to retrieve data from this integration** section, click **Provision**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-3_01.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
2. After a few seconds, Zscaler MDR will provision a collector to receive the data sent from the FortiAnalyzer. Copy the following two values so you can enter them into the FortiAnalyzer GUI in the next step:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-3_02.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
  - **Zscaler MDR Collector FQDN**
  - **Zscaler MDR Collector Port Number**

## 4 FortiAnalyzer | Configure Log Forwarding

In order for the FortiAnalyzer to pass alerts to Zscaler MDR, you need to set up a log forwarding service.

1. In the **FortiAnalyzer GUI**, go to **System Settings** > **Advanced** > **Log Forwarding**.
2. Under the **Settings** tab, click **Create New** in the toolbar. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-4_01.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
3. On the **Create New Log Forwarding** dialog, give the new forwarder a name and fill out the rest of the values as follows:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-4_02.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
  - **Remote Server Type**: Syslog
  - **Server FQDN/IP**: the Zscaler MDR Collector FQDN provisioned in [Step 3](/doc/docs/integrate-fortinet-fortigate-via-fortianalyzer-with-red-canary#3-red-canary-configure-red-canary-to-retrieve-the-data)
  - **Server Port**: the Zscaler MDR Collector Port Number provisioned in [Step 3](/doc/docs/integrate-fortinet-fortigate-via-fortianalyzer-with-red-canary#3-red-canary-configure-red-canary-to-retrieve-the-data)
  - **Reliable Connection**: Enabled
4. Click **OK**.
5. Click **>_** in the menubar to open the FortiAnalyzer CLI Console. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-4_03.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
6. Enter the following commands in the console to show a list of log forwarders:

```Custom
config system log-forward
show
```

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-4_04.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
7. Enter the `edit` command with a number corresponding to the log forwarder you created. For example:

```Custom
edit 1
```
8. Enter the following commands to configure the selected log forwarder:

```Custom
set fwd-secure enable
set fwd-syslog-format rfc-5424
end
```
9. Exit the console.

## 5 Command Line | Create TLS Certificates

Transport Layer Security (TLS) certificates protect the integrity of data in transit. You need to generate the necessary keys and TLS certificates to configure the FortiAnalyzer to send your logs securely to Zscaler MDR.

> [!NOTE]
> Note
> 
> You can generate these certificates on any machine. While the choice of command-line shell is yours (for example, PowerShell for Windows or Terminal for macOS), the example commands shown below are for Linux unless otherwise noted.

> [!WARNING]
> Important
> 
> The local certificate you create by following these instructions will need to be refreshed every year, while the root CA and intermediate CA are good for 10 years.

#### Download the Fortinet Certificates

1. Create a new working directory and change to that directory. For example:

```Custom
mkdir rcfortinet
cd rcfortinet
```
2. In the FortiAnalyzer GUI, go to **System Settings** > **Certificates** and download the **Fortinet_CA** and **Fortinet_SUBCA** certificates. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-5_01.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
3. Copy the downloaded Fortinet_CA and Fortinet_SUBCA certificates to your working directory. For example:

```Custom
mv ~/Downloads/Fortinet_CA.cer ./
mv ~/Downloads/Fortinet_SUBCA.cer ./
```

#### Generate the Root CA

> [!WARNING]
> Important
> 
> You must have [OpenSSL](https://www.openssl.org/source/) version 3.1 or later installed to complete these steps. Note that recent macOS versions use the LibreSSL library for openssh commands, which won’t work correctly with these instructions.

1. Create the root CA private key:

```Custom
openssl genrsa -out rootCA.key 4096
```
2. Create the root CA public certificate:

```Custom
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.pem
```

You’ll be prompted to enter a series of values to describe the certificate. Not all the fields are required but you need to fill out at least `Country Name`, `State or Province Name`, and `Organization Name`. You should also provide a `Common Name` identifier for the certificate, which can be any value. For example:

```Custom
Common Name:RedCanaryCA
```

You’ll upload the resulting `rootCA.pem` file to the FortiAnalyzer later.

#### Generate the Intermediate CA

1. Create the intermediate CA private key:

```Custom
openssl genrsa -out intermediateCA.key 4096
```
2. Use a text editor to create an `intermediateCA.cnf` configuration file:

```Custom
[req]
default_bits       = 2048
prompt             = no
default_md         = sha256
distinguished_name = dn
x509_extensions    = v3_ca
[dn]
CN = Zscaler MDR Intermediate CA    # Name the intermediate CA as desired
[v3_ca]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
```
3. Generate the intermediate CA CSR (Certificate Signing Request):

```Custom
openssl req -new -key intermediateCA.key -out intermediateCA.csr -config intermediateCA.cnf
```
4. Sign the intermediate CA CSR with the root CA:

```Custom
openssl x509 -req -in intermediateCA.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out intermediateCA.pem -days 3650 -sha256 -extfile intermediateCA.cnf -extensions v3_ca
```

You’ll upload the resulting `intermediateCA.pem` file to the FortiAnalyzer later.

#### Generate a Local Certificate for the Zscaler MDR Collector

1. Create the local certificate private key:

```Custom
openssl genrsa -out server.key 2048
```
2. Create a `server.cnf` configuration file for the Local Certificate, using the Zscaler MDR Collector FQDN for the `CN` and `DNS` values:

```Custom
[req]
default_bits       = 2048
prompt             = no
default_md         = sha256
distinguished_name = dn
req_extensions     = req_ext
[dn]
CN = prod1-use2-b7c04b26.prod1.collectors.redcanary.io   # Zscaler MDR Collector FQDN
[req_ext]
subjectAltName =  @alt_names
keyUsage = critical, digitalSignature, keyAgreement
extendedKeyUsage = serverAuth, clientAuth
[alt_names]
DNS = prod1-use2-b7c04b26.prod1.collectors.redcanary.io  # Zscaler MDR Collector FQDN
```
3. Generate the CSR for the local certificate:

```Custom
openssl req -new -key server.key -out server.csr -config server.cnf
```
4. Sign the local certificate CSR with the intermediate CA:

```Custom
openssl x509 -req -in server.csr -CA intermediateCA.pem -CAkey intermediateCA.key -CAcreateserial -out server.crt -days 365 -sha256 -extfile server.cnf -extensions req_ext
```
5. Convert the local certificate to PEM format:

```Custom
openssl x509 -in server.crt -out server.pem -outform PEM
```

You’ll upload the resulting `server.key` and `server.pem` files to Zscaler MDR later.

#### Create the CA Bundle

1. Concatenate the certificate chain into a single file:

```Custom
Linux: cat intermediateCA.pem Fortinet_SUBCA.cer Fortinet_CA.cer > ca-bundle.pem
Windows: type intermediateCA.pem Fortinet_SUBCA.cer Fortinet_CA.cer > ca-bundle.pem
```

You’ll upload the resulting `ca-bundle.pem` file to Zscaler MDR later.

> [!NOTE]
> Note
> 
> The certificates in the command must ordered correctly (Intermediate > Fortinet SUBCA > Fortinet CA)

## 6 FortiAnalyzer | Upload Certificates to FortiAnalyzer

After you’ve created the root CA and intermediate CA certificates, you can upload them to the FortiAnalyzer.

1. In the **FortiAnalyzer GUI**, go to **System Settings** > **Certificates**.
2. Click the **+ Create New/Import** button and select the **CA Certificate** option. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-6_01.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
3. Upload both the rootCA certificate (`rootCA.pem`) and the intermediateCA certificate (`intermediateCA.pem`) you created earlier. Give each certificate a name to identify it in the FortiAnalyzer GUI. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-6_02.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
4. Make sure both the certificates now appear under the **Local CA Certificate** section. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-6_03.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
5. Restart the log forwarding service by opening the FortiAnalyzer CLI console and entering the following command:

```Custom
diag test application logfwd 99
```

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-6_04.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)

## 7 Zscaler MDR | Upload Certificates to Zscaler MDR

After you’ve created the local certificates and the CA bundle, you need to upload them to Zscaler MDR in order to start receiving FortiAnalyzer alerts.

1. In the **Configure Zscaler MDR to retrieve data from this integration** section, go to **Section 2b (Send data to Zscaler MDR)** and check the **I’ve configured this integration to send data to Zscaler MDR** box. (This confirms that you’ve completed the [**Configure FortiAnalyzer Log Forwarding**](/doc/docs/integrate-fortinet-fortigate-via-fortianalyzer-with-red-canary#configure-fortianalyzer-log-forwarding) steps above.)
2. Go to **Section 2c (Configure Transport encryption)** and upload the certificate files as follows:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-7_01.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
  - Under **Upload a certificate, private key, and optional password**, choose the **server.pem** file
  - Under **Upload the corresponding private key file**, choose the **server.key** file
  - Under **Upload the CA certificate**, choose the **ca-bundle.pem** file
3. Click **Next** to upload the files.

## 8 Zscaler MDR | Customize Data Handling

**[OPTIONAL]** In the **Customize how data from this integration is handled** section, enable **Process Correlation** if appropriate.

> [!NOTE]
> What is Process Correlation?
> 
> If a third-party alert platform lets you create your own rules to trigger alerts, Zscaler MDR can correlate with the rule metadata when it displays the alerts in the timeline. To conserve API bandwidth and compute cycles, process correlation for user-defined alerts is disabled by default.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-8_01.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)

## 9 Zscaler MDR | Activate the Integration

After you’ve finished the configuration and uploaded the TLS certificates, click **Save** to activate the integration.

> [!TIP]
> The FortiAnalyzer integration is now live!
> 
> You should see FortiAnalyzer alerts start appearing in Zscaler MDR within 24 hours.

## 10 Zscaler MDR | Modifying the Integration

Once the FortiAnalyzer integration is active, the only routine maintenance task is to replace the TLS certificates when they expire. However, you’ll need to modify the configuration if you want to deactivate or remove the integration.

To modify the configuration:

1. In the Zscaler MDR portal, go to the **Integrations** page then click on the name of the integration you want to modify. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-10_01.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)

#### Uploading a TLS New Certificate

1. Go to the **Configure Zscaler MDR to retrieve data from this integration** section and review the details of the existing certificate. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-10_02.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D)
2. To upload a new certificate, follow the instructions in [Step 7](/doc/docs/integrate-fortinet-fortigate-via-fortianalyzer-with-red-canary#7-red-canary-upload-certificates-to-red-canary) above.

#### Deactivating the Integration

To suspend alerts for this integration, click the ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integration-deactivate-button.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D) button. The status displayed on the **Integrations** page changes to “Inactive” and no alerts will be passed to Zscaler MDR. If necessary, you can reactivate it later by clicking ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integration-activate-button.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D).

> [!NOTE]
> Note
> 
> Deactivating or reactivating the integration takes effect immediately. You don’t need to click **Save** to confirm the action.

#### Decommissioning the Integration

To remove the integration from Zscaler MDR, click the ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integration-delete-button.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A17%3A44Z&se=2026-10-27T00%3A17%3A44Z&sr=c&sp=r&sig=mFE7%2B84u8DuRE%2FJhPA5QOMFXikfQWzj7kvpgeU7vyJM%3D) button then click **OK** to confirm.

> [!WARNING]
> Important
> 
> If you decommission the integration, no new alerts will be sent to Zscaler MDR and all processed alerts will be deleted. This action cannot be undone.