> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# FortiAnalyzer

> Connect Fortinet FortiAnalyzer to Myrmex over JSON-RPC — create an admin with JSON API access and add the integration.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect your **Fortinet FortiAnalyzer** (FAZ) so Myrmex can search its log analytics, build entity dossiers, register FortiGate log sources, and check storage health. Myrmex reaches FortiAnalyzer over **HTTPS** (JSON-RPC at `/jsonrpc`) through a [Collector](/documentation/agent-endpoint-security/collector-mode) on your network. Every search runs **live, on demand** — Myrmex queries the FAZ's own log analytics and returns only what you ask for, copying or storing nothing on its side. Credentials are resolved on your side and never pass through the model.

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Log search with presets" icon="magnifying-glass">
    Run FortiAnalyzer log searches live using analyst presets and return only the matching events.
  </Card>

  <Card title="Entity dossier" icon="sitemap">
    Enrich an IP, user, or host by pulling its activity from the FAZ on demand.
  </Card>

  <Card title="Register FortiGate sources" icon="plug">
    Register a FortiGate as a log source by serial number.
  </Card>

  <Card title="Storage & retention health" icon="database">
    Check FortiAnalyzer storage and retention state to catch capacity issues early.
  </Card>
</CardGroup>

## Before You Start

* A **Collector** that can reach FortiAnalyzer over HTTPS (default port `443`); the JSON-RPC endpoint is `/jsonrpc`. See [Collector mode](/documentation/agent-endpoint-security/collector-mode).
* An **admin whose profile has JSON API Access = Read-Write** (CLI equivalent: under `config system admin user`, `set rpc-permit read-write`).
* The **ADOM** you want Myrmex to work in (default `root`; per-call override is supported).

## Step 1 — Create the Credential in FortiAnalyzer

<Steps>
  <Step title="Create an admin profile with JSON API access">
    In **System Settings → Admin → Profiles**, create or edit a profile and set **JSON API Access** to **Read-Write**.
  </Step>

  <Step title="Create the administrator">
    In **System Settings → Admin → Administrators**, add an admin, set a strong password, and assign the profile above.
  </Step>

  <Step title="Or configure it from the CLI">
    Equivalent CLI: under `config system admin user`, edit the account and run `set rpc-permit read-write`.
  </Step>
</Steps>

<Tip>
  JSON API Read-Write is required because registering FortiGate log sources is a write action. Scope the admin profile to only the ADOMs Myrmex needs.
</Tip>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → FortiAnalyzer**, then fill in:

| Field                      | Description                                                                                  |
| -------------------------- | -------------------------------------------------------------------------------------------- |
| **Name**                   | A unique name for this FortiAnalyzer.                                                        |
| **Description**            | Optional note to identify the appliance.                                                     |
| **Protocol**               | Protocol used to reach the FortiAnalyzer (default `https`).                                  |
| **FortiAnalyzer Host**     | FortiAnalyzer host or IP (e.g. `192.168.0.10` or `faz.corp.local`). May include scheme/port. |
| **API Port**               | API port (default `443`).                                                                    |
| **Username**               | Admin user with JSON API Read-Write.                                                         |
| **Password**               | Admin password (stored encrypted).                                                           |
| **ADOM**                   | Default ADOM (default `root`). Per-call override is supported.                               |
| **Verify TLS Certificate** | Verify the TLS certificate. Default off (on-prem appliances use a self-signed cert).         |
| **Collectors**             | Collectors that can reach this FortiAnalyzer.                                                |

## Connect

Click **Connect** to validate the JSON-RPC connection and finish. FortiAnalyzer then appears under **Environment → Integrations**, and you can ask about it in the Workspace or through the [Integration Specialist agent](/documentation/multi-agent-system/integration-specialist-agent).

<Note>
  Registering a FortiGate as a log source is done **by serial number**. Have the device serial ready when you ask Myrmex to add a source.
</Note>