Incident type events forwarded via syslog

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

If anyone viewing this topic has any knowledge on this, I encourage you to reply.

Thanks,

Hi @juanc,

There is a lot of missing information in your question.

Most SIEM systems prefer syslog, but it could be that your are using something closer to a SOAR that is more an event-driven system and therefor prefers the common event format (cef). So, the parameters fwd-server-type, server-port and fwd-reliable (which switches between tcp and udp) strongly depend on your requirements.

Speaking about the log filter: I don't know the field "event". You could set the field to "type" and the value to "event" then, but I think, this is not what you are targeting for. "Events" on FortiGates are system events like av-definition updates or SD-WAN-events like switching WAN-interfaces, etc.

You would more likely look for the log type "utm" which relate to security profiles of the firewall. Note, that you miss the general deny of traffic (which is interesting in a port scan) and e.g. vpn logons/failures completely with that filter.

But:

The FortiAnalyzer has two kinds of logs: The logs that it receives from other components (like firewalls, sandboxes, clients, etc.) and the logs that it generates itself. If you configure log *forwarding*, you are forwarding logs of other devices.

It could be - but this is something you need to discuss with your customer or team -, that the real request is that you receive the events (incidents) that the FortiAnalyzer *generates*. As the FAZ is kind of a "mini-SIEM", it can also correlate logs from the devices, make assumptions and generate events (called "incidents" in a real SIEM). If you like to get them, then you need to either configure the event handlers on the FAZ itself or send the local logs to your SIEM (see `config system locallog syslogd setting` for further details).

@Anthony_E: This is a topic for FortiAnalyzer, not FortiSIEM. I think, you can move it back ;)

Best,

Christian

Thank you as Christian :)!