Receiving logs from syslog relay (Rsyslog/syslog-ng) to FortiSIEM

Hi Kalana,

Yes, FortiSIEM is able to identify relayed logs, but it does expect the syslog-ng relay to prepend the standard Syslog-ng header to the log.

If you go to Admin / Device Support / Parsers you will see SyslogNGParser at the top of the list. This parser is a special parser and cannot have it's ordering changed. When a log is received by ForitSIEM it enters the parsing framework and runs through the parsers in a top-down approach. When it hits the SyslogNGParser FortiSIEM breaks off the SyslogNG header and passes the rest of the log to the other parsers so that the log can be parsed normally.

So that FortiSIEM correctly recognises the original sending host it will most likely need to do a reverse DNS lookup on the hostname.

For example parse IP and/or host name from the syslog header

<134>May 21 14:29:18 2015 host 1.2.3.4
<134>May 21 14:29:18 2015 [1.2.3.4]
<134>May 21 14:29:18 2015 1.2.3.4
<134>May 21 2015 14:29:18 1.2.3.4
<134>May 21 14:29:18 1.2.3.4

And this is an example relayed event, notice the prepended syslog relay header.

<134>May 21 14:29:18 10.4.2.9 May 21 2007 14:00:34 : %-6-302020: Built ICMP connection for faddr 10.2.3.14/0 gaddr asa70/0 laddr asa70/0

-------------------------------------------
Original Message:
Sent: 09-17-2019 02:28
From: Kalana Chandrasiri
Subject: Receiving logs from syslog relay (Rsyslog/syslog-ng) to FortiSIEM

Hi People,
We have a setup to collect all the a (a relay). I'm to forward all the necessary from it.

Does FortiSIEM able to identify as an individual

(See below architecture)



------------------------------
Kalana Chandrasiri
------------------------------