Technical Tip: How to Fine-Tune Audit Log Forwarding Rules on syslog

[bbae]

Description	This article describes how to Fine-Tune Audit Log Forwarding Rules on syslog.
Scope	FortiSOAR v7.2.x, syslog.
Solution	If the desired options cannot be found while creating or editing Audit Log Forwarding Rules, try adjusting the rule gradually as below. Configure a Syslog server to the window or server using the Visual Syslog server tool, etc. Execute a playbook. Check the playbook log through 'Audit Log' on 'System -> Audit Log' directly to set the rule granularly. Set the rule's conditions as per the 'Audit Log' previously reviewed, such as type, operation, user, or Source. *If nothing is set on the field, the field is applied to everything. Check the Syslog server to see whether it was received correctly.