Log Forwarding from FortiNAC to SIEM Server with Facility Selection

[N_W]

I want to forward logs from FortiNAC to the SIEM server, but it only offers the option to select a single facility, and I'm not sure which one to choose. I want to view both when switches go down and authentication events. I'm attaching the details.

 

[AEK]

If I remember well I think it doesn't really matter, since the facility is to categorize the event. You can also use for example Local 1, 2, ... or 7 for your case.