Receiving logs from syslog relay (Rsyslog/syslog-ng) to FortiSIEM

[KalanaChandrasiri]

Hi People,
We have a setup to collect all the syslogs in to a rsyslog (a syslog relay). I'm planing to forward all the necessary syslogs from it.

Does FortiSIEM able to identify syslogs separetly as an individual device ?

(See below architecture)

------------------------------
Kalana Chandrasiri
------------------------------

[FSM_FTNT · Accepted solution]

Hi Kalana,

Yes, FortiSIEM is able to identify relayed logs, but it does expect the syslog-ng relay to prepend the standard Syslog-ng header to the log.

If you go to Admin / Device Support / Parsers you will see SyslogNGParser at the top of the list. This parser is a special parser and cannot have it's ordering changed. When a log is received by ForitSIEM it enters the parsing framework and runs through the parsers in a top-down approach. When it hits the SyslogNGParser FortiSIEM breaks off the SyslogNG header and passes the rest of the log to the other parsers so that the log can be parsed normally.

So that FortiSIEM correctly recognises the original sending host it will most likely need to do a reverse DNS lookup on the hostname.

For example parse IP and/or host name from the syslog header

<134>May 21 14:29:18 2015 host 1.2.3.4
<134>May 21 14:29:18 2015 [1.2.3.4]
<134>May 21 14:29:18 2015 1.2.3.4
<134>May 21 2015 14:29:18 1.2.3.4
<134>May 21 14:29:18 1.2.3.4

And this is an example relayed event, notice the prepended syslog relay header.

<134>May 21 14:29:18 10.4.2.9 May 21 2007 14:00:34 : %-6-302020: Built ICMP connection for faddr 10.2.3.14/0 gaddr asa70/0 laddr asa70/0