SSL-VPN succssfully login is not detected by FortiSIEM

Hi Ireda1,

I have moved your topic to the FortiSIEM discussions board, where you are more likely to receive a relevant reply.

Kind regards,

Hello @Ireda1,

Unless you are using log filtering on the FSM, these events should be there. Every event you can see in the FortiGate log is forwarded via syslog to the SIEM (or using the hop through the FortiAnalyzer). Have a look at the parameters in the logs of the FortiGate and pick a value which you won't likely see in other logs (e.g. remote ip), do a Analytics-search on the FSM in "Raw Log" "contains" and your value. You should see the events, even if they are not parsed.

It should be in the event types category successful vpn logins (CMDB), but I assume you already searched for them.

The FortiGate parser has changed in the last couple of versions from time to time, so check for the correct event type. Could be that you just picked one from another version.

Best,

Christian