Log Source SIEM

[adem_netsys]

Hi guys,

In fortisiem, some of the log sources are sent to supervisor and some to collector. Is there any way to see this on the GUI other than getting a dump?

[Richie_C · Accepted solution]

Hi 

I'm thinking that you could achieve it with an analytics search. I don't actually have a collector in my test setup, but my idea is to search all logs and then aggregate the search with reporting IP and collector name or collector id. Then use the count function as per the screenshot. I'm not sure if it will work if you have loads of events, but maybe you could play around with the filters to help narrow down the search.

I hope it helps!

[Anthony_E]

Hello Adem,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello Adem,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[heng]

Hi there, 

May I know what is the ask here to be more specific? You want to look at the formatted log (Under GUI Analytic) or the achieve log via GUI? 

[adem_netsys]

Hi, i'm sorry for late reply. For example, we want the products in the customer environment to send logs only to the collector, but there were products that sent logs to the supervisor before. Can I see where the log is coming to the supervisor on the gui?

[Richie_C · Accepted solution]

Hi 

I'm thinking that you could achieve it with an analytics search. I don't actually have a collector in my test setup, but my idea is to search all logs and then aggregate the search with reporting IP and collector name or collector id. Then use the count function as per the screenshot. I'm not sure if it will work if you have loads of events, but maybe you could play around with the filters to help narrow down the search.

I hope it helps!

[adem_netsys]

Hi @Richie_C,

thanks for all your help, you have been very helpful

[heng · Accepted solution]

Richie is right, you can use the "change display fields" under the analytic to filter accordingly. E.g. if you see the Collector ID=1, that's mean the logs is sending to the supervisor while other not equal to 1 will be the corresponding collector with Collector ID=10002 for instance.

[adem_netsys]

Hi @heng 

thanks for all your help :)