| 1 | --- |
| 2 | title: Fortinet FortiGate (syslog) |
| 3 | description: Configure FortiGate to forward logs to your SIEM via syslog. |
| 4 | --- |
| 5 | |
| 6 | ## What this connector is |
| 7 | |
| 8 | This connector covers how to configure a **Fortinet FortiGate** firewall to forward logs to your SIEM using **syslog**. |
| 9 | |
| 10 | --- |
| 11 | |
| 12 | ## Data path (how it flows) |
| 13 | |
| 14 | 1) FortiGate → syslog (TCP/UDP) |
| 15 | 2) SIEM syslog input (typically Graylog) |
| 16 | 3) Stream/index routing + dashboards |
| 17 | |
| 18 | --- |
| 19 | |
| 20 | ## Configuration steps (FortiGate) |
| 21 | |
| 22 | ### Step 1: Access the firewall |
| 23 | |
| 24 | - Open the FortiGate web UI (e.g., `https://192.168.1.99`) |
| 25 | - Log in with administrative credentials |
| 26 | |
| 27 | ### Step 2: Configure syslog forwarding |
| 28 | |
| 29 | In the FortiGate UI: |
| 30 | |
| 31 | - Go to **Log & Report** |
| 32 | - Select **Log Settings** |
| 33 | - Under **Syslog Servers**, click **Create New** |
| 34 | |
| 35 | Configure: |
| 36 | - **Name:** recognizable name |
| 37 | - **IP/Domain:** SIEM syslog server |
| 38 | - **Reliable:** TCP (reliable) or UDP (faster) |
| 39 | - **Port:** listening port (default 514) |
| 40 | - **Facility:** e.g., Local7 |
| 41 | - **Source IP:** optional |
| 42 | |
| 43 | Note: |
| 44 | - Syslog format is configured via FortiGate **CLI**. Set the format to **rfc5424**. |
| 45 | |
| 46 | ### Step 3: Save |
| 47 | |
| 48 | Click **OK/Apply**. |
| 49 | |
| 50 | ### Step 4: Verify reception |
| 51 | |
| 52 | Confirm logs appear on the SIEM syslog input. |
| 53 | |
| 54 | --- |
| 55 | |
| 56 | ## Additional considerations |
| 57 | |
| 58 | - Ensure firewall rules allow outbound syslog traffic to the SIEM. |
| 59 | - If logs traverse the internet, use a secure transport (VPN/TLS collector pattern). |
| 60 | - Keep NTP/time sync correct for reliable correlation. |