Technical Tip: Viewing FortiClient OS Events logs in FortiAnalyzer

FortiClient can be configured to send various types of logs to FortiAnalyzer, one of which is OS Events.

Below are the prerequisites to set up.

Configuring FortiAnalyzer:
Follow the admin guide to add a FortiClient ADOM (FortiClient ADOM is compulsory)

Configuring FortiClient EMS Endpoint Profile:

1. In FortiClient EMS -> Endpoint Profiles -> System Settings -> (select) -> Edit -> Advanced.
2. Toggle [Upload Logs to FortiAnalyzer] to ON.
3. In the Upload option section, toggle [Send OS Events] to ON.

4. Save the profile.

To view FortiClient OS Events logs in FortiAnalyzer:

1. Go to the FortiClient ADOM.
2. Go to Log View -> Log Browse -> SIEM log (File name = Xlog.log).

3. Double-click the SIEM.log, it will display the Windows OS Events.

Note: When setting this up for the first time, the first SIEM log may take a longer time to appear, as FortiAnalyzer will need some time to parse it for the first time.