2.4.70 fortigate integration not working

[udi-mosh]

Version

2.4.70

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

24

RAM

128

Storage for /

500GB

Storage for /nsm

6TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,
i have forwarder and manager\search nodes upgraded to 2.4.70. as learned from previous versions, i have installed the fortigate fortinet integration on the system created agent of the manager\search node (not the elastic fleet) and configured it with udp 9004 on 0.0.0.0. the agent status is healty and the integration status is healty. netstat is indicating that so is listening on 9004. i have configured the firewall with customhostgroup0 with fw ip, customportgroup0 with 9004 on udp and configured the input chain on the managersearch role accordingly. however, no data is showing on kibana.

1. did i configure it correctly ?
2. if so, what could be the problem ?
   10x,

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[udi-mosh]

running the so-log-check, i can see errors in logstash regarding fortigate.
the reason for the parsing error is because event.module is getting the value "fortinet_fortigate" but the mapping value that it is expecting to get is "fortinet"

[udi-mosh]

i have configured the mapping and things are now working. found old discussions that talked about this exact thing.
for the so dev team, i have used the new integration and not the old deprecated one. hope you will fix this issue.