Have you had any success with this?
I note that the following link states dictionaries for ingress control with fortinet are included as of 6.6.1
https://gold.nvc.co.jp/document/aruba/Releasenote/ClearPass/clearpass6.6.x/ClearPass_6.6.1_ReleaseNotes.pdf
The new Ingress Event Engine enables ClearPass to process Syslog events from third-party devices to make
policy changes in realtime. For example: (#28446, #29415, #30254, #32451)
- A third-party device could signal to a ClearPass appliance to quarantine or block a user if the contents indicate the presence of malware.
- Syslog dictionaries from leading vendors such as Palo Alto Networks, Checkpoint, Juniper Networks, and Fortinet are included by default.