I can't parse Fortigate logs

[mahmoudelhaj]

How to parse Fortigate logs?

1. Add configuration manager’s minion pillar /opt/so/saltstack/local/pillar/minions/$managername_manager.sls

filebeat:
  third_party_filebeat:
    modules:
      fortinet:
        firewall:
          enabled: true
          var.input: udp
          var.syslog_host: 0.0.0.0
          var.syslog_port: 9004

2. Allow hosts to send syslog to a sensor node
   sudo so-firewall addhostgroup fortinet
   sudo so-firewall includehost fortinet 10.10.1.1

3. Add the following to the sensor minion pillar file located at /opt/so/saltstack/local/pillar/minions/_.sls
   on any node add this ??

firewall:
  assigned_hostgroups:
    chain:
      DOCKER-USER:
        hostgroups:
          syslogtosensor1:
            portgroups:
              - portgroups.syslog

4)sudo salt _ state.apply firewall

[mahmoudelhaj]

But the color of syslogs changes from orange to green

[InfosecGoon]

I think you're on the right track, but you might be missing a couple of details.

1. Add that filebeat YAML to your global.sls if you're in a distributed deployment.

filebeat:
  third_party_filebeat:
    modules:
      fortinet:
        firewall:
          enabled: true
          var.input: udp
          var.syslog_host: 0.0.0.0
          var.syslog_port: 9004

2. You'll want to make both a hostgroup fortinet AND a portgroup fortinet.

so-firewall addhostgroup fortinet
so-firewall includehost fortinet 10.10.1.1
so-firewall addportgroup fortinet
so-firewall addport fortinet udp 9004

3. Add the appropriate firewall YAML to the minion pillar for your sensor.

firewall:
  assigned_hostgroups:
    chain:
      DOCKER-USER:
        hostgroups:
          fortinet:
            portgroups:
              - portgroups.fortinet

4. Configure your Fortinet device to send logs to udp port 9004 on the sensor.

[mahmoudelhaj]

Thnx.