Skip to main content
KT06
Visitor III
July 11, 2026
Question

FortiSIEM 7.5 Headless Windows Agent: Host Discovered but No Event Logs

  • July 11, 2026
  • 2 replies
  • 78 views

Issue:

 

I’m deploying the FortiSIEM 7.5.0 Headless Windows Agent on a Windows machine in an OT environment. The communication path is Headless Agent → Diode Collector → L2.5 Virtual Collector → Supervisor. The Windows agent installation completes successfully, and the host is discovered in FortiSIEM, but no Windows Event Logs are being ingested.

 

Objective:

 

I’m trying to collect Windows Event Logs using the Headless Agent through the Diode Collector architecture. The OT Host Template is configured for Windows Event Logs. Has anyone encountered this issue or are there any additional configuration steps or prerequisites required for this deployment?

​@AEK 

 

 

2 replies

Muttahar_Rehman
Explorer
July 12, 2026
Verify headless agent is actually generating events?

C:\Program Files\FortiSIEM\Agent\log\
make sure windows events log channel enabled.

Confirm forwarding to the L2.5 Virtual Collector
 

Correct destination IP

UDP/514 path

No filtering on the data diode side

No packet drops due to MTU or rate limits

Thanks, R3hsec
AEK
SuperUser
SuperUser
July 13, 2026

I’m not FSM expert and even less familiar with FSM in OT env, but first questions I’d ask:

  • Is FSM successfully receiving any other logs from L2.5 VC?
  • IS VC receiving any other logs from Diode Collector?
  • Is DC actually receiving any logs from the Windows agent?
  • Is VC already approved on FSM?
AEK
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!