Azure Sentinel receiving log from Firewall Fortinet

[BrunoFeltrin]

Hi Team.

We are using Azure Sentinel to receive logs from Fortinet Firewall via syslog, where it is forwarding all types of logs, how can I configure the syslog so that it forwards only important logs?

[#2 · Accepted solution]

There is an option in Fortinet manager it self where you can create a rue by going to - System Settings > Log Forwarding. > Create New and click "On" log filter option > Log message that math >click on Any of the following Condition And create your own rule to forward any specific rule that you want to send. Thanks.

[#3]

I've gone through this pain and collected 13GB logs per day from Fortinet Firewall. Finally ended up getting firewall engineer to selectively forward logs for syslog (linux) server. Refer to this link. You can opt our level 6 & 7 to avoid unnecessary noise.

[#4]

Hi Susantha Silva, Does not appear the link where you entered, to verify.

[#5]

@BrunoFeltrin Fortinet firewall logging levels are mentioned here - https://docs.fortinet.com/document/fortimanager/7.0.0/log-message-reference/547625/priority-levels

Best is to request your firewall administrator to log into cli mode and forward those logs into your syslog server via pre-configured port number of the syslog server. Normally port number is 514. Please refer to the attached pictue as wlel. 

[#6]

I also have the same problem. How can we filter logs in CLI, what are the commands for Forti Analyze. Because we couldn't activated the filters in the GUI screen.
Thanks a lot.

[#7]

Have you tried to use syslog over the AMA to gather the data? You can then use DCRs to filter the data. https://learn.microsoft.com/en-us/azure/sentinel/forward-syslog-monitor-agent