Events FortiPAM to FortiSIEM

[targe]

Hi,

I want to send the events from FortiPAM to the SIEM, to see login to the console and so on. In the FortiSIEM CMDB-->Devices I see the PAM device and "Pending" status, I approve the status and in Edit Device, select Type: FortiProxy, there is no FortiPAM type. When I search for the events in SIEM they appear as "Unknown_EventType".

In the raw events I can see "Authentication Failure: Local", for example...Thanks

[sjoshi]

To send events from FortiPAM to FortiSIEM, you need to configure FortiPAM to send logs to FortiSIEM using syslog. In FortiSIEM CMDB, when adding the device, select "FortiProxy" as the type since there is no specific "FortiPAM" type available. After approving the device status and editing it, ensure the syslog format is set to Common Event Format (CEF) to properly parse the events. The "unknown_eventtype" issue may be due to mismatched event types or configurations. Check the event types and syslog settings to align with FortiSIEM's requirements for proper event parsing and identification. The "authentication failure: local" event should be recognized once the syslog configuration is correctly set up.

[callmeahero]

Since there is no specific FortiPAM device type in FortiSIEM, choosing FortiProxy is a reasonable workaround for now.

However, this can cause event classification issues, which is likely why your events are showing as "Unknown_EventType."

The "Unknown_EventType" issue happens because FortiSIEM doesn’t have a predefined parser for FortiPAM logs.

You might need to create a custom log parser in FortiSIEM to properly recognize and categorize the events from FortiPAM.

You can create custom event types in FortiSIEM for specific FortiPAM logs (like "Authentication Failure: Local") so that they get categorized correctly.

This will involve writing a custom parser or adjusting the existing ones.

Ensure that FortiPAM is correctly configured to send logs to FortiSIEM.

You may need to adjust the syslog settings on FortiPAM to ensure that all necessary events are sent and properly formatted for FortiSIEM to process.

After approving the device in FortiSIEM's CMDB, double-check the device settings, ensure you’ve selected the right log sources, and review the FortiPAM device’s log forwarding settings.