Hi,
I wanted to know more about the "User Log" feature in FortiSIEM Agents. I presume this feature is for collecting custom logs from the endpoints. If so, how do we go about configuring this?
The only explanation provided through documentation is as follows,
2acb451cae0a41178bed24d4e936e454.png
I wanted to know whether the below configuration is correct or not, also,if we are to troubleshoot issues related to that which event type to look in the phoenix.log file?
c47d7909bb4e416ab2ea0109ed877e55.png
Sample Custom log
5d7d4367e2b74f03aa033856fd2d8dd0.png
If the custom log has a dynamic value at the beginning of the log event (ex: timestamp) how to correctly configure the prefix? Does it support regex?
------------------------------
Cheers,
Isuru
------------------------------
I wanted to know more about the "User Log" feature in FortiSIEM Agents. I presume this feature is for collecting custom logs from the endpoints. If so, how do we go about configuring this?
The only explanation provided through documentation is as follows,
2acb451cae0a41178bed24d4e936e454.pngI wanted to know whether the below configuration is correct or not, also,if we are to troubleshoot issues related to that which event type to look in the phoenix.log file?
c47d7909bb4e416ab2ea0109ed877e55.pngSample Custom log
5d7d4367e2b74f03aa033856fd2d8dd0.pngIf the custom log has a dynamic value at the beginning of the log event (ex: timestamp) how to correctly configure the prefix? Does it support regex?
------------------------------
Cheers,
Isuru
------------------------------
Windows agent is going to send the file to FortiSIEM, line by line. One line is 1 log. You need to write a parser using the keyword (that you define in User log configuration from gui) as the event recognizer. Within the parser you can define event type based on parsed values. Then you can query using that event type and parsed values.
hope this explains.
Original Message:
Sent: Sep 02, 2022 04:08 AM
From: Isuru Tharanga
Subject: FortiSIEM - Agent "User Log" Feature
Hi,
I wanted to know more about the "User Log" feature in FortiSIEM Agents. I presume this feature is for collecting custom logs from the endpoints. If so, how do we go about configuring this?
The only explanation provided through documentation is as follows,
2acb451cae0a41178bed24d4e936e454.pngI wanted to know whether the below configuration is correct or not, also,if we are to troubleshoot issues related to that which event type to look in the phoenix.log file?
c47d7909bb4e416ab2ea0109ed877e55.pngSample Custom log
5d7d4367e2b74f03aa033856fd2d8dd0.pngIf the custom log has a dynamic value at the beginning of the log event (ex: timestamp) how to correctly configure the prefix? Does it support regex?
------------------------------
Cheers,
Isuru
------------------------------
Hi Partha,
Thanks for your insight. The parsing comes after this configuration. However, my concern is whether my configuration is correct or not. If not, what is the proper way to set it up?
Moreover, in a case where we cannot set a constant "prefix" value what the alternatives are?
The documentation does not provide any of this information unless we find the correct way by trial and error.
A simple example would help. This is the same for most of the configurations. Lack of information in the documentation.
------------------------------
Cheers,
Isuru
------------------------------
-------------------------------------------
Original Message:
Sent: Sep 03, 2022 11:47 AM
From: Partha Bhattacharya
Subject: FortiSIEM - Agent "User Log" Feature
Original Message:
Sent: Sep 02, 2022 04:08 AM
From: Isuru Tharanga
Subject: FortiSIEM - Agent "User Log" Feature
Hi,
I wanted to know more about the "User Log" feature in FortiSIEM Agents. I presume this feature is for collecting custom logs from the endpoints. If so, how do we go about configuring this?
The only explanation provided through documentation is as follows,
2acb451cae0a41178bed24d4e936e454.png
I wanted to know whether the below configuration is correct or not, also,if we are to troubleshoot issues related to that which event type to look in the phoenix.log file?
c47d7909bb4e416ab2ea0109ed877e55.png
Sample Custom log
5d7d4367e2b74f03aa033856fd2d8dd0.png
If the custom log has a dynamic value at the beginning of the log event (ex: timestamp) how to correctly configure the prefix? Does it support regex?
------------------------------
Cheers,
Isuru
------------------------------
Thanks for your insight. The parsing comes after this configuration. However, my concern is whether my configuration is correct or not. If not, what is the proper way to set it up?
Moreover, in a case where we cannot set a constant "prefix" value what the alternatives are?
The documentation does not provide any of this information unless we find the correct way by trial and error.
A simple example would help. This is the same for most of the configurations. Lack of information in the documentation.
------------------------------
Cheers,
Isuru
------------------------------
-------------------------------------------
Original Message:
Sent: Sep 03, 2022 11:47 AM
From: Partha Bhattacharya
Subject: FortiSIEM - Agent "User Log" Feature
Windows agent is going to send the file to FortiSIEM, line by line. One line is 1 log. You need to write a parser using the keyword (that you define in User log configuration from gui) as the event recognizer. Within the parser you can define event type based on parsed values. Then you can query using that event type and parsed values.
hope this explains.
Original Message:
Sent: Sep 02, 2022 04:08 AM
From: Isuru Tharanga
Subject: FortiSIEM - Agent "User Log" Feature
Hi,
I wanted to know more about the "User Log" feature in FortiSIEM Agents. I presume this feature is for collecting custom logs from the endpoints. If so, how do we go about configuring this?
The only explanation provided through documentation is as follows,
2acb451cae0a41178bed24d4e936e454.pngI wanted to know whether the below configuration is correct or not, also,if we are to troubleshoot issues related to that which event type to look in the phoenix.log file?
c47d7909bb4e416ab2ea0109ed877e55.pngSample Custom log
5d7d4367e2b74f03aa033856fd2d8dd0.pngIf the custom log has a dynamic value at the beginning of the log event (ex: timestamp) how to correctly configure the prefix? Does it support regex?
------------------------------
Cheers,
Isuru
------------------------------
here is an example
log message in the file
"this is a sample log1"
"this is a sample log2"
You configured "MyFavKeyword" in the GUI
Windows agent is going to add a header and keyword in the log and then send to FortiSIEM. So FortiSIEM will receive
<136> Tuesday WIN-Host-FQDN <IP> AccelOps-WUA-UserLog MyFavKeyword this is a sample log1
<136> Tuesday WIN-Host-FQDN <IP> AccelOps-WUA-UserLog MyFavKeyword this is a sample log2
This may not be 100% exact but you can try it out.
I will ask someone to update docs in a few days
Partha
-------------------------------------------
Original Message:
Sent: Sep 04, 2022 04:46 AM
From: Isuru Tharanga
Subject: FortiSIEM - Agent "User Log" Feature
Hi Partha,
Thanks for your insight. The parsing comes after this configuration. However, my concern is whether my configuration is correct or not. If not, what is the proper way to set it up?
Moreover, in a case where we cannot set a constant "prefix" value what the alternatives are?
The documentation does not provide any of this information unless we find the correct way by trial and error.
A simple example would help. This is the same for most of the configurations. Lack of information in the documentation.
------------------------------
Cheers,
Isuru
------------------------------
Original Message:
Sent: Sep 03, 2022 11:47 AM
From: Partha Bhattacharya
Subject: FortiSIEM - Agent "User Log" Feature
Original Message:
Sent: Sep 02, 2022 04:08 AM
From: Isuru Tharanga
Subject: FortiSIEM - Agent "User Log" Feature
Hi,
I wanted to know more about the "User Log" feature in FortiSIEM Agents. I presume this feature is for collecting custom logs from the endpoints. If so, how do we go about configuring this?
The only explanation provided through documentation is as follows,
2acb451cae0a41178bed24d4e936e454.png
I wanted to know whether the below configuration is correct or not, also,if we are to troubleshoot issues related to that which event type to look in the phoenix.log file?
c47d7909bb4e416ab2ea0109ed877e55.png
Sample Custom log
5d7d4367e2b74f03aa033856fd2d8dd0.png
If the custom log has a dynamic value at the beginning of the log event (ex: timestamp) how to correctly configure the prefix? Does it support regex?
------------------------------
Cheers,
Isuru
------------------------------
log message in the file
"this is a sample log1"
"this is a sample log2"
You configured "MyFavKeyword" in the GUI
Windows agent is going to add a header and keyword in the log and then send to FortiSIEM. So FortiSIEM will receive
<136> Tuesday WIN-Host-FQDN <IP> AccelOps-WUA-UserLog MyFavKeyword this is a sample log1
<136> Tuesday WIN-Host-FQDN <IP> AccelOps-WUA-UserLog MyFavKeyword this is a sample log2
This may not be 100% exact but you can try it out.
I will ask someone to update docs in a few days
Partha
-------------------------------------------
Original Message:
Sent: Sep 04, 2022 04:46 AM
From: Isuru Tharanga
Subject: FortiSIEM - Agent "User Log" Feature
Hi Partha,
Thanks for your insight. The parsing comes after this configuration. However, my concern is whether my configuration is correct or not. If not, what is the proper way to set it up?
Moreover, in a case where we cannot set a constant "prefix" value what the alternatives are?
The documentation does not provide any of this information unless we find the correct way by trial and error.
A simple example would help. This is the same for most of the configurations. Lack of information in the documentation.
------------------------------
Cheers,
Isuru
------------------------------
Original Message:
Sent: Sep 03, 2022 11:47 AM
From: Partha Bhattacharya
Subject: FortiSIEM - Agent "User Log" Feature
Windows agent is going to send the file to FortiSIEM, line by line. One line is 1 log. You need to write a parser using the keyword (that you define in User log configuration from gui) as the event recognizer. Within the parser you can define event type based on parsed values. Then you can query using that event type and parsed values.
hope this explains.
Original Message:
Sent: Sep 02, 2022 04:08 AM
From: Isuru Tharanga
Subject: FortiSIEM - Agent "User Log" Feature
Hi,
I wanted to know more about the "User Log" feature in FortiSIEM Agents. I presume this feature is for collecting custom logs from the endpoints. If so, how do we go about configuring this?
The only explanation provided through documentation is as follows,
2acb451cae0a41178bed24d4e936e454.pngI wanted to know whether the below configuration is correct or not, also,if we are to troubleshoot issues related to that which event type to look in the phoenix.log file?
c47d7909bb4e416ab2ea0109ed877e55.pngSample Custom log
5d7d4367e2b74f03aa033856fd2d8dd0.pngIf the custom log has a dynamic value at the beginning of the log event (ex: timestamp) how to correctly configure the prefix? Does it support regex?
------------------------------
Cheers,
Isuru
------------------------------
Hi Partha,
Thanks again for your support. Understood now. I will test this out.
------------------------------
Cheers,
Isuru
------------------------------
-------------------------------------------
Original Message:
Sent: Sep 06, 2022 08:11 AM
From: Partha Bhattacharya
Subject: FortiSIEM - Agent "User Log" Feature
here is an example
log message in the file
"this is a sample log1"
"this is a sample log2"
You configured "MyFavKeyword" in the GUI
Windows agent is going to add a header and keyword in the log and then send to FortiSIEM. So FortiSIEM will receive
<136> Tuesday WIN-Host-FQDN <IP> AccelOps-WUA-UserLog MyFavKeyword this is a sample log1
<136> Tuesday WIN-Host-FQDN <IP> AccelOps-WUA-UserLog MyFavKeyword this is a sample log2
This may not be 100% exact but you can try it out.
I will ask someone to update docs in a few days
Partha
Original Message:
Sent: Sep 04, 2022 04:46 AM
From: Isuru Tharanga
Subject: FortiSIEM - Agent "User Log" Feature
Hi Partha,
Thanks for your insight. The parsing comes after this configuration. However, my concern is whether my configuration is correct or not. If not, what is the proper way to set it up?
Moreover, in a case where we cannot set a constant "prefix" value what the alternatives are?
The documentation does not provide any of this information unless we find the correct way by trial and error.
A simple example would help. This is the same for most of the configurations. Lack of information in the documentation.
------------------------------
Cheers,
Isuru
Original Message:
Sent: Sep 03, 2022 11:47 AM
From: Partha Bhattacharya
Subject: FortiSIEM - Agent "User Log" Feature
Original Message:
Sent: Sep 02, 2022 04:08 AM
From: Isuru Tharanga
Subject: FortiSIEM - Agent "User Log" Feature
Hi,
I wanted to know more about the "User Log" feature in FortiSIEM Agents. I presume this feature is for collecting custom logs from the endpoints. If so, how do we go about configuring this?
The only explanation provided through documentation is as follows,
2acb451cae0a41178bed24d4e936e454.png
I wanted to know whether the below configuration is correct or not, also,if we are to troubleshoot issues related to that which event type to look in the phoenix.log file?
c47d7909bb4e416ab2ea0109ed877e55.png
Sample Custom log
5d7d4367e2b74f03aa033856fd2d8dd0.png
If the custom log has a dynamic value at the beginning of the log event (ex: timestamp) how to correctly configure the prefix? Does it support regex?
------------------------------
Cheers,
Isuru
------------------------------
Thanks again for your support. Understood now. I will test this out.
------------------------------
Cheers,
Isuru
------------------------------
-------------------------------------------
Original Message:
Sent: Sep 06, 2022 08:11 AM
From: Partha Bhattacharya
Subject: FortiSIEM - Agent "User Log" Feature
here is an example
log message in the file
"this is a sample log1"
"this is a sample log2"
You configured "MyFavKeyword" in the GUI
Windows agent is going to add a header and keyword in the log and then send to FortiSIEM. So FortiSIEM will receive
<136> Tuesday WIN-Host-FQDN <IP> AccelOps-WUA-UserLog MyFavKeyword this is a sample log1
<136> Tuesday WIN-Host-FQDN <IP> AccelOps-WUA-UserLog MyFavKeyword this is a sample log2
This may not be 100% exact but you can try it out.
I will ask someone to update docs in a few days
Partha
Original Message:
Sent: Sep 04, 2022 04:46 AM
From: Isuru Tharanga
Subject: FortiSIEM - Agent "User Log" Feature
Hi Partha,
Thanks for your insight. The parsing comes after this configuration. However, my concern is whether my configuration is correct or not. If not, what is the proper way to set it up?
Moreover, in a case where we cannot set a constant "prefix" value what the alternatives are?
The documentation does not provide any of this information unless we find the correct way by trial and error.
A simple example would help. This is the same for most of the configurations. Lack of information in the documentation.
------------------------------
Cheers,
Isuru
Original Message:
Sent: Sep 03, 2022 11:47 AM
From: Partha Bhattacharya
Subject: FortiSIEM - Agent "User Log" Feature
Windows agent is going to send the file to FortiSIEM, line by line. One line is 1 log. You need to write a parser using the keyword (that you define in User log configuration from gui) as the event recognizer. Within the parser you can define event type based on parsed values. Then you can query using that event type and parsed values.
hope this explains.
Original Message:
Sent: Sep 02, 2022 04:08 AM
From: Isuru Tharanga
Subject: FortiSIEM - Agent "User Log" Feature
Hi,
I wanted to know more about the "User Log" feature in FortiSIEM Agents. I presume this feature is for collecting custom logs from the endpoints. If so, how do we go about configuring this?
The only explanation provided through documentation is as follows,
2acb451cae0a41178bed24d4e936e454.pngI wanted to know whether the below configuration is correct or not, also,if we are to troubleshoot issues related to that which event type to look in the phoenix.log file?
c47d7909bb4e416ab2ea0109ed877e55.pngSample Custom log
5d7d4367e2b74f03aa033856fd2d8dd0.pngIf the custom log has a dynamic value at the beginning of the log event (ex: timestamp) how to correctly configure the prefix? Does it support regex?
------------------------------
Cheers,
Isuru
------------------------------
