Events FortiPAM to FortiSIEM

To send events from FortiPAM to FortiSIEM, you need to configure FortiPAM to send logs to FortiSIEM using syslog. In FortiSIEM CMDB, when adding the device, select "FortiProxy" as the type since there is no specific "FortiPAM" type available. After approving the device status and editing it, ensure the syslog format is set to Common Event Format (CEF) to properly parse the events. The "unknown_eventtype" issue may be due to mismatched event types or configurations. Check the event types and syslog settings to align with FortiSIEM's requirements for proper event parsing and identification. The "authentication failure: local" event should be recognized once the syslog configuration is correctly set up.

Since there is no specific FortiPAM device type in FortiSIEM, choosing FortiProxy is a reasonable workaround for now.

However, this can cause event classification issues, which is likely why your events are showing as "Unknown_EventType."

The "Unknown_EventType" issue happens because FortiSIEM doesn’t have a predefined parser for FortiPAM logs.

You might need to create a custom log parser in FortiSIEM to properly recognize and categorize the events from FortiPAM.

You can create custom event types in FortiSIEM for specific FortiPAM logs (like "Authentication Failure: Local") so that they get categorized correctly.

This will involve writing a custom parser or adjusting the existing ones.

Ensure that FortiPAM is correctly configured to send logs to FortiSIEM.

You may need to adjust the syslog settings on FortiPAM to ensure that all necessary events are sent and properly formatted for FortiSIEM to process.

After approving the device in FortiSIEM's CMDB, double-check the device settings, ensure you’ve selected the right log sources, and review the FortiPAM device’s log forwarding settings.