Troubleshooting Tip: Log Parser TAB not seen on FortiAnalyzer

This article talks about the steps to check on FortiAnalyzer in case Log parser TAB is not seen under Incidents & Events -> Log Parsers.

More about this feature is covered in this document: SIEM log parsers.

Things to confirm on the device:

1. Security Automation Service license.
   
   

2. ADOM should be a Fabric ADOM.
   
   

3. The SIEM module should be enabled:

config system global

unset disable-module <----- To enable all the modules in FortiAnalyzer.

get <----- This command lists the current config to check if any other modules other than SIEM are disabled as per the user requirement.

    set disable-module soc ot-view <----- This command removes SIEM from the list of disabled modules, keeping the other modules disabled and enabling only SIEM.

end

Once these three conditions are met, the log parser tab will be visible.

Note: Content Packet versions can be seen from Incidents & Events -> FortiGuard Services -> SOC Automation.

Related documents:

SOC Automation Content Pack

Custom Log Parsers