FortiAuthenticator Syslog source settings - question

I "want" many things, but I already figured out that by screaming I got nothing.

Here are some hints:

1

- login to your FAC and use that top-right (?) question mark icon

- it will get you to documentation site and there is admin guide

- then navigate to SSO and Syslog Source documentation

2

- rules section (6.1.0) do have some templates (pre-configured rules)

- at the bottom of rule there is input field which let's you test, just paste copied syslog message here and tweak fields accordingly till you get desired results.

3

- if you want more detailed advise/result you have to provide more detailed input

4

- it's not discussed for first time, so search forum as well or google it