Integrate FortiSIEM-Cisco WSA/ESA

[AliMhaerFathy]

Hello,

We need to integrate FortiSIEM-Cisco WSA/ESA through Syslog as per the official documents:

As we should call Log Name: IronPort-Mail OR IronPort-Web; we cant add another entry (Duplicate).

So, we need to know the Log type and the corresponding facility to send the concerned security logs.

Thanks in advance!

[premchanderr]

Hi @AliMhaerFathy ,

FortiSIEM can receive Syslog with any facility set from sending device configuration without any filters or log types. So, there would be no specification available from FortiSIEM side, but you can select both the parameters from Cisco device and send syslog accordingly.

Do note that depending on raw log and data parsed you might have to write a custom parser.