Fortigate Integration

[brazorfajeje]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32

Storage for /

100

Storage for /nsm

250

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I'm trying to redirect a Fortigate (FortiOS 7.x) to securityonion.
The integration is correctly installed, the firewall is configured and I can clearly see the firewall sending the logs to the manager and the manager accepting the connections, but I have no parsed logs.
I noticed that the proposed integration version is 1.19 (probably not compatible with FortiOS 7.x) and not the latest 1.23.
From the elastic website I can see that 1.23.1 is compatible with kibana 8.3.0 or higher (https://docs.elastic.co/integrations/fortinet_fortigate ), is there a reason why I can't install the latest version?

Thanks in advance

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Check you Logstash log for issues /opt/so/log/logstash/logstash.log.

[brazorfajeje]

OK, found the error log:

[WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["create", {:_id=>nil, :_index=>"logs-fortinet_fortigate.log-default", :routing=>nil}, {"elastic_agent"=>{"version"=>"8.10.4"

...

"reason"=>"[1:2125] failed to parse field [event.module] of type [constant_keyword] in document with id 'uzWEUo0BDpeU6GOg2CfP'. Preview of field's value: 'fortinet_fortigate'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"[constant_keyword] field [event.module] only accepts values that are equal to the value defined in the mappings [fortinet], but got [fortinet_fortigate]"}}}}}

[brazorfajeje]

Is this solution #11995
the correct one?
Do I have to manually edit the mappings?

Thanks

[cm-ops]

#11730 (comment) You can try that, This was fixed upstream with Elastic elastic/integrations#8453 so the change should only be temporary.

[samuel809]

can you please share to what policy are you adding the fortinet integration ?