This integration is available on our Advanced and Enterprise packages.
Before you get started
Before beginning the integration, you will need to deploy a log collector within the same network as your firewall.
To initiate the collector deployment process, please reach out to our Technical Support team, who'll provide you with a deployment pack that includes all the software and scripts needed to configure this.
If you already have a log collector deployed, please follow the steps outlined below.
Configuring syslog
Log in to your FortiGate web interface.
In the left menu, go to: Log & Report.
Select Log Settings (In FortiOS 7.4 and newer, it may appear as System Log Settings).
Scroll down to the section called Remote Syslog or Syslog.
Click Create New.
Configure the following fields:
Name: Defense.com SIEM (or any descriptive name you prefer).
Status: Enable.
IP Address / FQDN: Your log collector private IP address.
Port: 5514 (not the default 514).
Protocol: UDP.
Server Type: CEF.
Facility: local7 – default.
CSV: Disable – gives structured logs instead of CSV format.
Upload Option: Reliable – preferred over Legacy.
Click OK.
Click Apply at the bottom of the Log Settings page.
Confirming log flow
Once the above steps are complete, your device will now ship logs to our SIEM platform via your collector. You can confirm logs are successfully reaching our SIEM by either.
Navigating to the Log Search feature in Defense.com by browsing to SIEM > Log Search and then filtering the logs by
type:"syslog".Reaching out to our Technical Support team, who'll be able to check and confirm this for you.
And that's it! You've successfully integrated your FortiGate Firewall 🎉