Description
This article describes how to configure Microsoft Sentinel to receive CEF logs from FortiAnalyzer in CEF format, assuming that user has successfully deployed and integrated FortiAnalyzer to Microsoft Sentinel via Azure Monitoring Agent.
Scope
FortiAnalyzer.
Solution
Refer to this FortiAnalyzer Integration with Microsoft Sentinel for deployment and setup between FortiAnalyzer and Microsoft Sentinel via Azure Monitoring Agent (AMA).
- After successfully configuring the Linux VM, navigate to FortiAnalyzer and configure the log forward settings in the CLI:
config system log-forward
edit 1
set mode forwarding
set server-name <server name>
set server-addr <server address>
set fwd-server-type cef
set fwd-facility local7
end
- On the Azure homepage, look for Azure services, select' Microsoft Sentinel'. Click on the configured Microsoft Sentinel.
- In Content management -> Content Hub, find 'CEF' in the search bar and install the 'Common Event Format (CEF) via AMA':
- Select the 'Open connector page':
- Select 'Create data collection rule':
- Configure the name, subscription, and resource group in the 'Basic' tab. In the 'Resources' tab, choose the configured Linux VM as mentioned in step 1.
- As for the 'Collect' tab, since 'set fwd-facility local7' was configured in step 1, the LOG_LOCAL7 facility needs to be set as 'LOG_DEBUG' in the Data Collection Rule (DCR) to receive the CEF logs.
- On the 'Review + create' tab, select 'Create'. Now, the DCR has been successfully created.
- Navigate to General -> Logs, type 'CommonSecurityLog' in the query field and select 'Run':
- The logs shown here are the logs received in CEF format from FortiAnalyzer, which originates from the FortiGate.
- If no logs are appearing, a test log can be sent from the FortiGate end by using the 'diagnose log test' command to troubleshoot further.
Related article:
Technical Tip: How to configure and troubleshoot Log Forwarding on FortiAnalyzer
