How to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment?

Forum|Forum|10 years ago
January 26, 2016
5 replies
1387 views

I would like to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment.

I found the following documentation about Fortigate and ArcSight communication, but there is no information about the TCP syslog configuration between this two platforms.

http://help.fortinet.com/fdb/5-0-0/html/source/concepts/c_dam_notification_tab.html

Is it possible to send TCP syslog messages (with or without TLS) from Fortigate firewall device to the Arcsight SIEM?

PauloRaponi

New Member

Hi,

# config log syslogd setting

# set reliable enable

# end

Regards,

Paulo Raponi

A

Anonymous_UserAuthor

Contributor III

Can ArcSight be configured to accept that?

Rgrds,

Peter

PauloRaponi

New Member

Sure. Are the same contend as UDP. The difference are that it need create a session between Fortigate and ArcSight... The traffic inside the TCP session are clear text.

Sign up

Login with SSO

Login to the community

Login with SSO