Fortinet FortiAnalyzer

Modified on Wed, 29 May 2024 at 09:49 PM

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai Help Center and we'll get it updated.


This guide describes the steps required to configure a FortiNet FortiAnalyzer to send syslog to the Samurai XDR


1) Configure the Samurai XDR application

  • Complete the FortiGate FortiAnalyzer Integration from Samurai XDR Application


2) Configure FortiGate FortiAnalyzer 

Complete the configuration from the FortiGate FortiAnalyzer

  • Configure log forwarding in Fortinet FortiAnalzer
  • Enable FortiGate to send logs to FortiAnalyzer

 


Configure the Samurai XDR Application

To complete the configuration to receive logs:

  1. Login to your Samurai XDR application tenant
  2. Click Telemetry > Integrations from the main menu
  3. Click Create
  4. Find and select Fortinet FortiAnalyzer
  5. Select Secure Syslog Collector. The IP Address and Port will be shown on the screen. Please make note of these, they will be used in the FortiAnalyzer configuration below.
  6. Click on Finish



Configure FortiGate FortiAnalyzer 

Configure log forwarding in Fortinet FortiAnalzer

Follow the steps outlined in the Fortinet documentation:


mceclip0.png Note: You must complete the configuration via the CLI.  The web UI configuration cannot set fwd mode "secure"



Use the following required parameters when completing the steps:

Log forward setting Value
Name Whatever you want, however we suggest "NTT_collector"
Status On 
Remote Server TypeSyslog
Server AddressIP address of your Secure Syslog Collector (captured earlier, step 5)
Server PortPort of your Secure Syslog Collector (captured earlier, step 5)
CompressionOff
Reliable ConnectionOn (This is required to enable TCP)
Secure ConnectionOn (This is required to enable TLS
Sending FrequencyReal-time
Device FiltersClick Select Device, then select the devices whose logs will be forwarded (Note: you may have to come back to this if you are not sending logs from your FortiGate devices yet!)
Log filtersOff
Enable exclusionsOff
Enable MaskingOff

Table 1: FortiAnalyzer setting Settings


  • Complete the confguration from the FortiAnalyzer CLI
config system log-forward
   edit 1
        set mode forwarding
        set fwd-max-delay realtime
        set server-name "NTT_collector”
        set server-addr "Copied from Samurai XDR app"
        set server-port "Copied from Samurai XDR app"
        set fwd-server-type syslog
        set fwd-reliable enable
        set fwd-secure enable
   end

Table 2: FortiAnalyzer configutration



Enable FortiGate to send logs to FortiAnalyzer

All FortiGate devices in scope must be connected to the FortiAnalyzer to send logs.

Follow the steps outlined in the Fortinet documentation:

Use the following required parameters when completing the steps:


Remote Logging and ArchivingValue 
Send logs to FortiAnalyzer/FortiManager Enable 
ServerIP address for your FortiAnalyzer 
Upload optionReal Time

Table 3: Fortigate settings (send logs to FortiAnalyzer)


mceclip0.png If this is the first time remote logging is configured and the FortiGate device was not previously added to FortiAnalyzer, the device needs to be authorized under FortiAnalyzer Device Manger to be able to upload its logs. Perform this on the FortiAnalyzer

 

Disk backed log buffer is recommended on Fortigates with an SSD disk. 

Follow the steps outlined in the Fortinet documentation:


Once you have completed the configuration of your firewall to send logs to Samurai XDR, your integration will automatically be discovered once Samurai XDR starts receiving logs from your firewall.