Could not get login metrics from Fortigate devices in FortiSIEM

[samlouis55]

Hello,

I am testing FortiSIEM in a DEV environment. I have two physical fortigates (60f & 70F) & 2 Fortigate VMs. I have connected the physical fortigates to FortiSIEM through the API credentials. The only metrics i got for them in Analytics is regarding Fortigate performance. I don't get any log for user logins etc... I don't know what i am missing. I think as I was connecting throug API, all those metrics should be pulled by default.

Also, I have done a fortisiem workshop and do some labs with those metrics (fortigate admin-login-security) but I cannot get those logs in my dev environment.

[Secusaurus]

Hi samlouis,

Yes, that might be unclear at first glance. Have a detailed look at the documentation: https://docs.fortinet.com/document/fortisiem/7.1.1/external-systems-configuration-guide/751381/forti...

Via REST API, you can get a lot of information and metrics, but not the logs. For getting the logs (system logs in your case), you need to configure syslog.

Best,

Christian