Detecting Missing Logs for a Specific Log Type

Question

We are trying to create a rule in FortiSIEM to detect the absence of a specific type of log being received from a device. For example, if a log source is configured to send PING, Sysmon, and Syslog logs to FortiSIEM, we need to create a rule that triggers an alert only when Syslog logs are missing from that device, even though other log types (e.g., PING, Sysmon) may still be received.

The default "No logs from a device" rule in FortiSIEM triggers alerts if all logs stop coming from the device, which does not meet our requirement to monitor the absence of a specific log type.

Has anyone implemented a rule or workaround to address this scenario? Any guidance or suggestions would be greatly appreciated!

sjoshi · Answer

Hi,

To create a rule in FortiSIEM to detect the absence of a specific type of log from a device while still receiving other log types, you can utilize Event Dropping rules. By setting up a custom Event Dropping rule for the specific log type you want to monitor, you can configure it to drop all events except for the desired log type. This way, if the syslog logs are missing, the rule will not drop them, triggering an alert. You can follow the steps outlined in the FortiSIEM User Guide to create this custom Event Dropping rule tailored to your specific monitoring needs.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded