Configure Fortigate SIEM Integration

Section 1: Create a Firewall Rule on your Utility Agent

1. From the Utility Host – open the Run command and enter the following command wf.msc or open the control panel and navigate to the firewall settings page
   
   
   
   Linux can be used as a utility agent, Ubunut 20.04 and 22.04 are the currently supported versions.
2. Select Inbound Rules on the right side
3. Right-click and select New Rule
   
   
   
4. Select Custom
5. Click Next
   
   
   
6. Select All Programs
   
7. Click Next
   
   
   
8. Use the following settings:
   • Protocol Type: UDP
   • Local Port: 514
9. Click Next
   
   
   
10. Under the "Which remote IP addresses does this rule apply to?" section, select These IP Addresses
11. Click Add
    
    
    
12. If the utility agent resides on the same LAN as the Firewall, enter the LAN IP of the Fortinet device. If the utility agent is on a different subnet than the Firewall, enter the Public IP of the Fortinet device that is sending logs under the This IP address or subnet field.
    
    
    
13. You'll be brought back to the Scope screen, click Next
14. On the Action screen, select Allow the connection, then click Next
    
    
    
15. On the Profile screen, ensure Domain, Private, and Guest are selected, then click Next
    
    
    
16. Give the Firewall rule a name and description, then click Finish
    

Section 2a (Legacy): Configure Fortinet to Forward Logs

1. Log in to the Fortinet console
2. Select Log & Report Menu Option on the left
3. Select Log Settings
   
   
   
4. Enable Send logs to syslog
5. Enter the LAN IP of the Utility Agent
   
   
   
6. Save your configuration
   
   

Section 2b (FortiOS v5.x+): Configure Fortinet to Forward Logs

1. Open the CLI
2. Find a syslogd setting that is not in use:

   config log {syslogd | syslogd2 | syslogd3 | syslogd4} setting
   show
   end

   Note: One of the options within the brackets should be selected and entered without the brackets.
3. Configure the desired syslogd setting:

   config log syslogd setting 

   Note: Change syslogd to the one you determined to use in step 2.

4. set mode udp
   set server "LAN IP of Utility Agent"
   set port 514
   set facility user
   set source-ip "LAN IP of FW"
   set format default
   set priority default
   set max-log-rate 0
   set interface-select-method auto

5. use command config log syslogd filter and then set severity <severity level> to change the severity level of the logs being ingested. Setting to level Warning and above is probably best. Fortinet article that shows the logging levels.
6. Confirm settings:

   show full
   end

Section 3: Todyl Portal

Configure the integration within the Todyl Portal with the following settings:

• UDP Host: 0.0.0.0
• UDP Port: 514