Skip to main content
Tiger
Tiger
New Member
May 18, 2024
Question

OCI Firewall Traffic Logs to FortiSIEM

  • May 18, 2024
  • 2 replies
  • 1242 views

Trying to understand how easy it is to push Oracle OCI firewall traffic logs to FortiSIEM?  Can’t seem to find much on the subject, so wondered if there is anyone out there who may have already done this?  Can’t see it being that difficult, but can’t find much about this anywhere?  

Appreciate any insights here…

 

thanks!

    2 replies

    premchanderr
    Staff & Editor
    premchanderr
    Staff & Editor
    October 4, 2024

    HI @Tiger ,

     

    Currently this product is not listed in supported devices: 

    https://docs.fortinet.com/document/fortisiem/7.2.3/external-systems-configuration-guide/780675/forti...

     

    Refer a sample syslog parser and the below document can help you to build detailed parser:

    https://help.fortinet.com/fsiem/7-0-3/Online-Help/HTML5_Help/Configuring_parsers.htm

    prakadesh
    prakadesh
    Explorer II
    November 19, 2024

     

    Hi @Tiger To forward OCI Firewall traffic logs to FortiSIEM, :

    1. Enable Logging in OCI:

      • Navigate to the OCI Console, enable the Logging Service, and locate the Service Logs section. Look for Network Firewall Logs and ensure logging is enabled.
      • Refer to the OCI SIEM Integration Guide for additional details.

    2. Forward Logs via Connector Hub:

      • Use the Connector Hub to configure log forwarding from the Service Logs to the OCI Streaming Service.

    3. FortiSIEM Integration:

    4. Custom Parser:

      • Since FortiSIEM doesn’t natively parse OCI Firewall logs, a custom parser is necessary. While the parser will process the logs, you must ensure the following:
        • Map Event Attributes: Map log fields to FortiSIEM attributes based on the log reference.
        • Custom Event Types: Modify the event type and add relevant mappings to align with your FortiSIEM rules and correlation.
      Terms & ConditionsAccessibility statement