How effective is SO with only metadata(FortiGate syslog)?

[scolardc]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32

Storage for /

100GB

Storage for /nsm

200G

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

How effective is SO when only parsing metadata?
Instead of using a network / span port would SO still be effective if I directed the firewall logs (FortiGate syslog) to SO?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

From https://docs.securityonion.net/en/2.4/additional-network.html:

In the Network Visibility section, we looked at network visibility provided by Security Onion itself. The ideal situation would be to have Security Onion network sensors covering each and every one of your network segments. If you’re able to achieve that ideal situation, then you may not need any additional network visibility. However, there may be times when you simply can’t cover certain network segments with Security Onion network sensors and that’s when these additional options can be beneficial. Keep in mind, though, that the data that they provide is nowhere near as comprehensive as a full Security Onion network sensor. One option would be NetFlow logs from firewalls, switches, or routers showing what traffic was observed by the network device. Another option would be firewall logs showing what traffic was allowed through the firewall and what traffic was denied. An example of that would be pfSense firewall logs. You can find other firewall integrations in the Third Party Integrations section.

[scolardc]

Thanks for the direction @dougburks.