Questions - Fortigate - SysLog - CEF? about fortinet-2-elasticsearch HOT 4 CLOSED

Hi @nicpenning

About your questions:

1 We dont have any other communication channel besides github yet.

2 Regular syslog, no CEF. ECS is the new CEF.

3 Not really, this all the documentation we have so far. We will try to give more details. Basically, what you need to do is:

• Set up your ES cluster.
• Load pipelines to logstash.
• Build you dictionaries for enrichment. This is kind of optional, only if you want enrichments on your logs, you should do this.
• Load dashboards and templates to Kibana
• Stream your syslog from your firewalls to your logstash IP.

It should be pretty straight forward if you have some experience with ES.

We would be able to help as well if you need some extra hand.

from fortinet-2-elasticsearch.

Thanks for the quick response! I have some follow up questions that may not be suited here, how can I get a hold of you?

from fortinet-2-elasticsearch.

Just send me an email

[email protected]

from fortinet-2-elasticsearch.

What I do is to send Fortinet CEF to a filebeat (that performs some basic ECS alignment), with just a little modification of the beat conf to properly set the observer ip (becuase of elastic/beats#15774). Then I just rename some field and that's it. If you follow the syslog way you have to do an extra work on the patterns..so I prefer to use the cef module. It only needs to be more aligned to ECS

from fortinet-2-elasticsearch.