Technical Tip: Download Unknown Raw Event logs from FortiSIEM GUI

[Mike17]

Description	This article describes how to download Unknown Raw Event logs on FortiSIEM GUI, this is useful when try to add new sources on FortiSIEM and for some reason FortiSIEM is not able to parse the received events
Scope	FortiSIEM.
Solution	When FortiSIEM receives logs that do not match with a system parser or a custom event parser, then FortiSIEM stores the event as Unknown_EventType. Once indexed on the event database, it is possible to download these kinds of events to be able to check their content and perform parse testing. To download the Unknown Event types, follow the next steps: Logging into FortiSIEM GUI with admin credentials Navigate to Analytics and create a new query by selecting the filter Criteria: Event Type CONTAIN unknown. Select 'Apply & Run, the unknown event types will be displayed as Results: Once displayed results with 'Unknown Event Types', export the results by selecting Actions -> Export Result -> CSV>Generate. After completing these steps, a compressed CSV file will be downloaded, then it is possible to check the content for these events to perform additional parsing tests

[maovalencia]

Thank you Mike for this article.