Parse syslogs of different devices in FortiAnalyzer

[alled]

Hi guys,

is it possible with the FortiAnalyzer to parse information out of a syslog, for example from a Sophos XG Firewall? Is there a site where i can find already written Log parsers? Or how do i write one?
We want to ingest Logs from different sources, Sophos, Juniper, Checkpoint, Palo Alto,... via syslog in FAZ and parse them, to run Event Handlers on those parsed logs. Is that even possible with FAZ?

Thanks for your answers :)

[ozkanaltas]

Hello @alled ,

FortiAnalyzer can only collect logs from Fortinet products. If you want to collect and parse logs from other devices, you can use an SIEM solution such as FortiSIEM. 

[seguridadinformatica]

Yes, You can add third party devices via syslog, the bad news is that you need to configure a JSON parser adhoc to ingest third party devices and match every field of the log.
There is little information for build a JSON parser for FAZ.

[vraev]

Hi,

Under (v7.4) Incidents & Events > Log Parser you can find the available ones.

https://docs.fortinet.com/document/fortianalyzer/7.4.0/new-features/751682/support-parsing-and-addit...

https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/353514/siem-log-parsers