Forum Discussion
Solved
Azure Sentinel receiving log from Firewall Fortinet
Hi Team.
We are using Azure Sentinel to receive logs from Fortinet Firewall via syslog, where it is forwarding all types of logs, how can I configure the syslog so that it forwards only important logs?
- There is an option in Fortinet manager it self where you can create a rue by going to - System Settings > Log Forwarding. > Create New and click "On" log filter option > Log message that math >click on Any of the following Condition And create your own rule to forward any specific rule that you want to send. Thanks.
6 Replies
- Have you tried to use syslog over the AMA to gather the data? You can then use DCRs to filter the data. https://learn.microsoft.com/en-us/azure/sentinel/forward-syslog-monitor-agent
- I've gone through this pain and collected 13GB logs per day from Fortinet Firewall. Finally ended up getting firewall engineer to selectively forward logs for syslog (linux) server. Refer to this link. You can opt our level 6 & 7 to avoid unnecessary noise.
- I also have the same problem. How can we filter logs in CLI, what are the commands for Forti Analyze. Because we couldn't activated the filters in the GUI screen.
Thanks a lot. - Hi Susantha Silva, Does not appear the link where you entered, to verify.
BrunoFeltrin Fortinet firewall logging levels are mentioned here - https://docs.fortinet.com/document/fortimanager/7.0.0/log-message-reference/547625/priority-levels
Best is to request your firewall administrator to log into cli mode and forward those logs into your syslog server via pre-configured port number of the syslog server. Normally port number is 514. Please refer to the attached pictue as wlel.
- There is an option in Fortinet manager it self where you can create a rue by going to - System Settings > Log Forwarding. > Create New and click "On" log filter option > Log message that math >click on Any of the following Condition And create your own rule to forward any specific rule that you want to send. Thanks.
