Log Forwarding from FortiNAC to SIEM Server with Facility Selection

If I remember well I think it doesn't really matter, since the facility is to categorize the event. You can also use for example Local 1, 2, ... or 7 for your case.

The default setting of "Security/Authorization" should fulfill your requirement.

Check this article for more details: https://community.fortinet.com/t5/FortiNAC/Troubleshooting-Tip-Syslog-messages-not-being-sent-to-syslog/ta-p/196661

okey thanks,