Using FortiAnalyzer as generic Syslog server, parse logs from non-Fortinet sources
Hello,
After making a research regarding of the (im)possibility to make it work, and some tests on FAZ 7.4.x, I wonder if this is feasible or even in the roadmap. Apparently the log parsers can be assigned to a device only if it is recognized as Fortinet, and appears first as unauthorized. However, sending syslog to FAZ from any device seems to store the logs into the Syslog ADOM, but when you try to assign a parser it's not possible because there is no device to select. Also, even if the logs would come from a Fortinet device (e.g. FortiSOAR), the docs say they would be parsed and inserted in a "SIEM db". But how can the latter be used?
Any ideas?
Thank you
Cristian
