Customizable Syslog CEF output/format for Fortigate's?

[b_rod]

Hi All,

I did some digging and even opened a case with support and I came up empty handed on this topic.

We are wondering if the syslog CEF output can be customized? The primary goal is to trim down the size of the logs to just the data we need before ingestion to our SIEM. On PANs we could do this fairly easily, curious if an on box way exists to do with Fortigates.

We are running 7.2 code on 200Fs.

Thanks

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[Anthony_E]

To customize the syslog CEF output/format for FortiGate, you can configure the syslog settings to send log messages in CEF format.

1. Access the CLI: Log in to your FortiGate device using the CLI.
2. Configure Syslog Settings: Enter the syslog configuration mode:

config log syslogd setting

Set the format to CEF:

set format cef 

End the configuration: 

end

Additional Configuration: You can configure other syslog settings independently of the log message format, such as the server address and transport protocol (UDP or TCP). - Filtering can also be configured for both CEF and CSV formatted log messages.

Verify Configuration: To confirm the current format used to send Syslog messages, use the following command: 

show full-configuration log syslogd setting | grep -i format

[robinh007]

Thank you @Anthony_E 

[JFMM]

Hi Anthony,
I was looking for same configuration to customize the output of the Logs that send to SIEM, so we could trim the log size and have a better size of logs ingestion to the SIEM
For reference that Palo Alto PAN-OS could customize the the Log Format before send to SIEM, attached the PAN-OS Configuration Menu

Is there any way out to the same on Fortigate?