Fortigate: Log Monitoring and Email Alerting via Fortianalyzer

Using the logs sent by your Fortigate Firewall to your Fortianalyzer, you can set up an monitoring/alerting function for any logs or events captured. This is very helpful in monitoring critical systems and functions such as interface flaps or VPN IPsec Issues. You can monitor any events as long as it is logged.  In this example, I will setup a monitoring and alert functions for any Admin Login fail attempts.

On the Fortianalyzer (FAZ) (I am using FortiOS v5.6 for the FAZ), select Event Management -> Event Handler List

faz

Create a new Handler, For this example we will match logid sent by the Fortigate to your FAZ. In this example, we will match event logs for failed admin logins.

faz2.png

Select, the Log Type. (Other logs maybe on a different Log Type, Failed Logins falls under Event Log) and Event Category or Subtype (for this example, System) .

32002.png

Reference: For the complete list of Log IDs, Type and Subtype you can use

Go to –> https://docs.fortinet.com/uploaded/files/3610/FortiOS-5.6.0-Log-Reference.pdf

On the Log Field, choose LogID, Match set to “Equal To” and Value being the Message ID.

The Message ID is actually a 10-digit field, where the first two digits represents the Log type. (00 for Traffic Log and 01 for Event Log) and last 6 digit is for the LogID, and just fill in zeroes in between to complete a 10-digit value. So for LogID 32002, use the value: 0100032002

And finally, supply in the email details of the recipients and the source email and the subject and the SMTP server that will route the mail.

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s