Collect custom application logs to fotiSIEM

[pradarsha]

Dears,

How do we collect custom application logs (raw logs) to FortiSIEM, where the logs are stored in a windows server- folder / file with ext .log/.csv/.txt etc format.?

To be specific --

If a device is unsupported by fortisiem and we need to collect raw logs and develop a parser for the same. How do we

1. collect logs from a file or folder with .txt or .log or .CSV format files

2. Custom application that writes logs in a Database.  where we can write a query to collect specific data from the DB tables only.

** post collecting the raw logs we can write a parser to normalize the logs.

FortiSIEM 

[chiklya1]

We're sending logs from FortiGates, AD (log ins, DNS, DHCP) and from our antivirus/mail product. It doesn't seem right to limit the logs, as we might not send the relevant logs... also we could switch from the current AV/mail products to FortiNet products too as they are expiring next year or so and I believe FortiClient and FortiMail would be great also.

[pradarsha]

Hi,

AD, DNS, DHCP are supported by FortiSIEM.We can pull the logs either by an agent or wmi or other options,  but my query is specific to the devices/applications that are unsupported by FortiSIEM.