> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt # Linking Lacework FortiCNAPP as a source Canonical URL: https://posthog.com/docs/data-pipelines/sources/lacework > **Cloud region:** This page uses US Cloud hosts. For an EU Cloud project, use `https://eu.posthog.com` instead of `https://us.posthog.com` or `https://app.posthog.com` (app host for links). ## On this page - [Prerequisites](#prerequisites) - [Adding a data source](#adding-a-data-source) - [Sync modes](#sync-modes) - [Configuration](#configuration) - [Supported tables](#supported-tables) - [Troubleshooting](#troubleshooting) **Beta release** This source is currently in **beta**. It works end to end, but you may still hit rough edges. [Let us know](https://us.posthog.com/#panel=support%3Asupport%3Adata_warehouse%3A%3Atrue) if you do. ![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_9608fcca70) ![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_dark_a92b0e022d) Let AI connect your sources for you Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog. `npx @posthog/wizard warehouse` ![PostHog Wizard hedgehog](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png) ![](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)Let AI connect your sources for you The Lacework FortiCNAPP (Fortinet) connector syncs your cloud security data – alerts, host and container vulnerabilities, compliance evaluations, machines, agents, and console audit logs – into PostHog, so you can trend cloud risk, audit control coverage, and correlate security findings with the rest of your data. ## Prerequisites You need a Lacework FortiCNAPP account and an API key. Creating API keys requires an account admin role. In the FortiCNAPP Console, go to **Settings** > **Configuration** > **API keys**, click **Add New**, then download the generated key file to get the **key ID** and **secret key**. ## Adding a data source 1. In PostHog, go to the [Sources tab](https://app.posthog.com/data-management/sources) of the data pipeline section. 2. Click **\+ New source** and click **Link** next to this source. 3. Enter your credentials (see [Configuration](#configuration) below) and click **Next**. 4. Select the tables you want to sync, choose a sync method and frequency, then click **Import**. Once the syncs are complete, you can start querying this data in PostHog. When linking Lacework FortiCNAPP, you'll need: - **Account name** – the first part of your FortiCNAPP URL: `https://.lacework.net`. - **API key ID** – the `keyId` value from the downloaded API key file. - **Secret key** – the `secret` value from the downloaded API key file. ## Sync modes Each table can be synced in one of several modes, depending on what the source supports: - **Webhook** (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes. - **Incremental** – only new or updated rows are synced on each run, using a cursor field (such as an `updated_at` timestamp). Cheaper than a full refresh, but deletes aren't captured. - **Append only** – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs. - **Full refresh** – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected. See [sync methods](https://posthog.com/docs/data-pipelines/sources.md#sync-methods) for a full explanation of how each mode works and how to choose between them. Most tables (vulnerabilities, compliance evaluations, machines, audit logs) are append-only histories of time-windowed records without a unique row id, so they support append and full refresh syncs. The `alerts` table also supports incremental sync on `startTime`; note that incremental syncs filter by when an alert *started*, so status changes on older alerts are only picked up by a full refresh. The Lacework API only serves recent history, so the first sync (and any full refresh) reaches back a bounded window: 90 days for alerts, audit logs, and compliance evaluations, 30 days for vulnerabilities and machines, and 7 days for the agent inventory. Lacework rate-limits API access to 480 requests per hour. Large environments may need more than one sync run to complete the initial backfill; syncs pick up where they left off. ## Configuration | Option | Type | Required | | --- | --- | --- | | `Account name` | text | Yes | | `API key ID` | text | Yes | | `Secret key` | password | Yes | ## Supported tables | Table | Description | Sync method | Incremental field | Primary key | | --- | --- | --- | --- | --- | | `alerts` | Alerts raised by Lacework, filtered by the time the potential threat started. Status changes on alerts older than the last synced window are only picked up on a full refresh | Incremental, Full refresh | startTime | — | | `audit_logs` | Lacework console audit log entries. Syncs the last 90 days on first sync or full refresh | Append only, Full refresh | createdTime | — | | `agent_info` | Inventory of Lacework agents active in the last 7 days. Full refresh only | Full refresh | — | — | | `vulnerabilities_hosts` | Host vulnerability assessment results (one row per CVE per machine per assessment). Syncs the last 30 days on first sync or full refresh | Append only, Full refresh | startTime | — | | `vulnerabilities_containers` | Container image vulnerability assessment results (one row per CVE per image per assessment). Syncs the last 30 days on first sync or full refresh | Append only, Full refresh | startTime | — | | `compliance_evaluations_aws` | AWS compliance evaluations. Syncs the last 90 days on first sync or full refresh | Append only, Full refresh | reportTime | — | | `compliance_evaluations_azure` | Azure compliance evaluations. Syncs the last 90 days on first sync or full refresh | Append only, Full refresh | reportTime | — | | `compliance_evaluations_gcp` | GCP compliance evaluations. Syncs the last 90 days on first sync or full refresh | Append only, Full refresh | reportTime | — | | `compliance_evaluations_k8s` | Kubernetes compliance evaluations. Syncs the last 90 days on first sync or full refresh | Append only, Full refresh | reportTime | — | | `entities_machines` | Machines observed online, one row per machine per activity segment. Syncs the last 30 days on first sync or full refresh | Append only, Full refresh | startTime | — | | `entities_containers` | Active containers, one row per container per hourly aggregation window. Syncs the last 7 days on first sync or full refresh | Append only, Full refresh | startTime | — | | `entities_images` | Container images, one row per image per machine. Syncs the last 30 days on first sync or full refresh | Append only, Full refresh | createdTime | — | | `inventory_aws` | AWS cloud resource inventory, one row per resource per collection run. Syncs the last 7 days on first sync or full refresh | Append only, Full refresh | startTime | — | | `inventory_azure` | Azure cloud resource inventory, one row per resource per collection run. Syncs the last 7 days on first sync or full refresh | Append only, Full refresh | startTime | — | | `inventory_gcp` | GCP cloud resource inventory, one row per resource per collection run. Syncs the last 7 days on first sync or full refresh | Append only, Full refresh | startTime | — | | `cloud_accounts` | Cloud account integrations (AWS, Azure, GCP, OCI). Full refresh only | Full refresh | — | — | | `policies` | Lacework policies, keyed by the policyId that alerts reference. Full refresh only | Full refresh | — | — | ## Troubleshooting If your sync is failing or data looks wrong, see the [Data warehouse troubleshooting guide](https://posthog.com/docs/data-warehouse/troubleshooting.md). If that doesn't help, [contact support](https://us.posthog.com/#panel=support%3Asupport%3Adata_warehouse%3A%3Atrue) – we're happy to help.