Fortigate Log types

[Tempoary]

Hello everybody, I am making a list of the "recommended/important" fortigate log types for our customers. however i do not have access to a fortigate firewall and i cant seem to find any "good" documentation. so far what i have found has been contradicting itself by other searches.

so now i have taken to the community:) would anyone share what log types are available from the fortigate firewall and what those logs contain

[AEK]

Hi Temporary

Besides traffic log and local traffic log, here are the other available logs:

• System activity event
• VPN _activity event
• User activity event
• Router activity event
• WiFi activity event
• Explicit web proxy event
• Endpoint event
• HA event
• Security Rating event
• FortiExtender event
• SDN connector Event
• SD-WAN event
• CIFS event
• Switch controller event

[Tempoary]

Thank you AEK:)

Can you provide a brief explanation of what these contain:

CIFS event

SDN connector event

User activity (guessing its the same as traffic logs?)

switch controller event (guessing its changes to configs and alerts about switch ports?)

again thank you:)

[GauravPandya]

Hi,

Below URL would be helpful.

https://docs.fortinet.com/document/fortigate/7.6.0/fortios-log-message-reference/160372/list-of-log-...

[Tempoary]

Hi GauravPandya

yeah i have been looking at that documentation but from what i have read on other webpages/forums, the info appears to be outdated + when i ressarch what logtypes fortigate uses, other users respond with other logtypes that are not listed so its really confusing

[GauravPandya]

It depends on versions. URL which I have posted is from version 7.6. You can check admin guide based on your firewall version.

[AEK]

Here it is:

• CIFS event: This one should be related to logs of CIFS protocol (Common Internet File System) file filtering, see "config cifs profile" if you are interested
• SDN connector event: Logs related to public and private cloud solutions connectors
• User activity: Logs related to user authentication, login, logout events
• Switch controller event: Events that happening on the managed switches