Fortinet FortiGate Firewall Logs Integration for Elastic

The Fortinet FortiGate Firewall Logs integration for Elastic enables the collection of logs from Fortinet FortiGate firewalls. This allows for comprehensive security monitoring, threat detection, and network traffic analysis within the Elastic Stack. By ingesting FortiGate logs, users can gain visibility into firewall activity, monitor for security threats, audit policy compliance, and troubleshoot network issues.

This integration facilitates:

• Security monitoring and threat detection
• Network traffic analysis and monitoring
• Firewall policy compliance and auditing
• Intrusion detection and prevention system (IPS) event monitoring
• VPN connection monitoring and troubleshooting
• Web filtering and application control monitoring

This integration has been tested against FortiOS versions 6.x and 7.x up to 7.4.1. Newer versions are expected to work but have not been tested.

This integration is compatible with Elastic Stack version 8.11.0 or higher.

This integration collects logs from FortiGate firewalls by receiving syslog data over TCP or UDP, or by reading directly from log files. An Elastic Agent is deployed on a host that is configured as a syslog receiver or has access to the log files. The agent forwards the logs to your Elastic deployment, where they can be monitored or analyzed.

The Fortinet FortiGate Firewall Logs integration collects the following types of logs:

• Traffic logs: Records of firewall decisions to allow or deny traffic.
• UTM (Unified Threat Management) logs: Includes events from antivirus, web filter, application control, IPS, and DNS filter modules.
• Event logs: System-level events, high-availability (HA) events, and configuration changes.
• Authentication logs: Records of VPN, administrator, and user authentication events.

Integrating Fortinet FortiGate logs with Elastic provides a powerful solution for enhancing security posture and operational visibility. Key use cases include:

• Real-time Threat Detection: Leverage Elastic SIEM to detect and respond to threats identified in firewall logs.
• Network Traffic Analysis: Use Kibana dashboards to visualize and analyze network traffic patterns, helping to identify anomalies and optimize network performance.
• Compliance and Auditing: Maintain a searchable, long-term archive of firewall logs to meet compliance requirements and conduct security audits.
• Incident Response: Accelerate incident investigation by correlating firewall data with other security and observability data sources within Elastic.

• A FortiGate firewall with administrative access to configure syslog settings.
• Network connectivity between the FortiGate firewall and the Elastic Agent host.
• Elastic Stack version 8.11.0 or higher.

Elastic Agent must be installed on a host that will receive the syslog data or has access to the log files from the FortiGate firewall. For detailed installation instructions, refer to the Elastic Agent installation guide. Only one Elastic Agent is needed per host.

You can configure FortiGate to send logs to the Elastic Agent using either the GUI or the CLI.

GUI Configuration:

1. Log in to the FortiGate web-based manager (GUI).
2. Navigate to Log & Report -> Log Settings.
3. Enable Send Logs to Syslog.
4. In the IP address field, enter the IP address of the host where the Elastic Agent is installed.
5. Click Apply.
6. Under Log Settings, ensure that Event Logging and all desired log subtypes are enabled to generate and send the necessary logs.

CLI Configuration:

1. Log in to the FortiGate CLI.

2. Use the following commands to configure the syslog server settings:

   config log syslogd setting
       set status enable
       set server "<elastic_agent_ip>"
       set port <port>
       set mode <udp|reliable>
       set format <default|rfc5424>
   end
   

   1. Default syslog ports are 514 for UDP and TCP
   • mode: Use udp (the FortiGate default) with the integration's UDP input, or reliable with the TCP input. In reliable mode, FortiGate sends syslog over TCP using RFC 6587 octet-counting framing, which matches the TCP input's default framing: rfc6587. Every receiver between FortiGate and Elasticsearch must support this framing; see Troubleshooting.
   • format: Use default (key-value syslog) or rfc5424 (key-value message with an RFC 5424 syslog header). The integration does not parse the csv, cef, or json formats.
   • port: Must match the Listen Port configured in the integration.

3. Configure the appropriate log types and severity levels to be sent to the syslog server. For example:

   config log syslogd filter
       set severity information
       set forward-traffic enable
       set local-traffic enable
       set web enable
       set antivirus enable
       // Enable other UTM and event logs as needed
   end
   

For more detailed information, refer to the FortiGate CLI reference.

1. In Kibana, navigate to Management > Integrations.
2. Search for "Fortinet FortiGate Firewall Logs" and select the integration.
3. Click Add Fortinet FortiGate Firewall Logs.
4. Configure the integration by selecting an input type and providing the necessary settings. This integration supports TCP, UDP, and Log file inputs.

This input collects logs over a TCP socket.

Under Advanced Options, you can configure the following optional parameters:

This input collects logs over a UDP socket.

Under Advanced Options, you can configure the following optional parameters:

This input collects logs directly from log files on the host where the Elastic Agent is running.

Under Advanced Options, you can configure the following optional parameters:

After configuring the input, assign the integration to an agent policy and click Save and continue.

1. First, verify on the FortiGate device that logs are being actively sent to the configured Elastic Agent host.
2. In Kibana, navigate to Discover.
3. In the search bar, enter data_stream.dataset: "fortinet_fortigate.log" and check for incoming documents.
4. Verify that events are appearing with recent timestamps.
5. Navigate to Management > Dashboards and search for "Fortinet FortiGate Overview" to see if the visualizations are populated with data.
6. Generate some test traffic that would be logged by the firewall and confirm that the corresponding logs appear in Kibana.

For help with Elastic ingest tools, check Common problems.

• No data is being collected:
  • Verify network connectivity (e.g., using ping or netcat) between the FortiGate firewall and the Elastic Agent host.
  • Ensure there are no firewalls or network ACLs blocking the syslog port.
  • Confirm that the listening port configured in the Elastic integration matches the destination port configured on the FortiGate device.
• TCP framing issues:
  • In reliable mode, FortiGate always sends syslog over TCP with RFC 6587 octet-counting framing (each message is prefixed with its length, with no newline between messages). Keep the TCP input's framing set to rfc6587; other framing values will result in parsing errors or lost logs.
  • Any receiver placed in front of Elasticsearch must also split messages using RFC 6587 octet counting. A receiver that splits the stream on newlines (for example, the Logstash tcp input with its default line codec) combines all messages from a connection into one very large message. Such messages are indexed unparsed with event.kind: pipeline_error and an error.message reporting either that the message exceeds 900000 characters or that a key appears more than once. In that setup, either send from FortiGate with mode udp, or receive the TCP stream with Elastic Agent using this integration's TCP input.

• FortiGate CLI Reference - Syslog Settings
• Fortinet Documentation Library
• FortiGate Administration Guide

For more information on architectures that can be used for scaling this integration, check the Ingest Architectures documentation.

Elastic Agent must receive syslog directly from the FortiGate devices. This integration's input settings, such as TCP framing, timezone, and network direction, are applied only by Elastic Agent, so placing Logstash in front of the Elastic Agents, or receiving FortiGate syslog with a Logstash input, is not covered by this integration. If you use FortiGate's reliable mode, keep the Elastic Agent TCP input's framing set to rfc6587.

If you need Logstash for additional processing or routing, place it after the Elastic Agents: send data from the Elastic Agents to Logstash using the elastic_agent input, and run the integration's ingest pipeline with the elastic_integration filter. For details, check Using Logstash with Elastic integrations.

The log data stream collects all log types from the FortiGate firewall, including traffic, UTM, event, and authentication logs.

{
    "@timestamp": "2019-05-15T18:03:36.000Z",
    "agent": {
        "ephemeral_id": "65ad5a4b-72ad-4878-905c-6f7f2a959ee4",
        "id": "2f63344b-97c9-4998-9535-0fc6454ddd4b",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.9.0"
    },
    "data_stream": {
        "dataset": "fortinet_fortigate.log",
        "namespace": "ep",
        "type": "logs"
    },
    "destination": {
        "as": {
            "number": 35908
        },
        "geo": {
            "continent_name": "Asia",
            "country_iso_code": "BT",
            "country_name": "Bhutan",
            "location": {
                "lat": 27.5,
                "lon": 90.5
            }
        },
        "ip": "67.43.156.14",
        "port": 443
    },
    "ecs": {
        "version": "8.17.0"
    },
    "elastic_agent": {
        "id": "2f63344b-97c9-4998-9535-0fc6454ddd4b",
        "snapshot": false,
        "version": "8.9.0"
    },
    "event": {
        "action": "app-ctrl-all",
        "agent_id_status": "verified",
        "category": [
            "network"
        ],
        "code": "1059028704",
        "dataset": "fortinet_fortigate.log",
        "ingested": "2023-10-26T15:15:25Z",
        "kind": "event",
        "original": "<190>date=2019-05-15 time=18:03:36 logid=\"1059028704\" type=\"utm\" subtype=\"app-ctrl\" eventtype=\"app-ctrl-all\" level=\"information\" vd=\"root\" eventtime=1557968615 appid=40568 srcip=10.1.100.22 dstip=67.43.156.14 srcport=50798 dstport=443 srcintf=\"port10\" srcintfrole=\"lan\" dstintf=\"port9\" dstintfrole=\"wan\" proto=6 service=\"HTTPS\" direction=\"outgoing\" policyid=1 sessionid=4414 applist=\"block-social.media\" appcat=\"Web.Client\" app=\"HTTPS.BROWSER\" action=\"pass\" hostname=\"www.dailymotion.com\" incidentserialno=1962906680 url=\"/\" msg=\"Web.Client: HTTPS.BROWSER,\" apprisk=\"medium\" scertcname=\"*.dailymotion.com\" scertissuer=\"DigiCert SHA2 High Assurance Server CA\"",
        "outcome": "success",
        "start": "2019-05-16T01:03:35.000Z",
        "type": [
            "allowed"
        ]
    },
    "fortinet": {
        "firewall": {
            "action": "pass",
            "appid": "40568",
            "apprisk": "medium",
            "dstintfrole": "wan",
            "incidentserialno": "1962906680",
            "sessionid": "4414",
            "srcintfrole": "lan",
            "subtype": "app-ctrl",
            "type": "utm",
            "vd": "root"
        }
    },
    "input": {
        "type": "tcp"
    },
    "log": {
        "level": "information",
        "source": {
            "address": "172.24.0.4:57264"
        },
        "syslog": {
            "facility": {
                "code": 23
            },
            "priority": 190,
            "severity": {
                "code": 6
            }
        }
    },
    "message": "Web.Client: HTTPS.BROWSER,",
    "network": {
        "application": "HTTPS.BROWSER",
        "direction": "outbound",
        "iana_number": "6",
        "protocol": "https",
        "transport": "tcp"
    },
    "observer": {
        "egress": {
            "interface": {
                "name": "port9"
            }
        },
        "ingress": {
            "interface": {
                "name": "port10"
            }
        },
        "product": "Fortigate",
        "type": "firewall",
        "vendor": "Fortinet"
    },
    "related": {
        "ip": [
            "10.1.100.22",
            "67.43.156.14"
        ]
    },
    "rule": {
        "category": "Web-Client",
        "id": "1",
        "ruleset": "block-social.media"
    },
    "source": {
        "ip": "10.1.100.22",
        "port": 50798
    },
    "tags": [
        "preserve_original_event",
        "fortinet-fortigate",
        "fortinet-firewall",
        "forwarded"
    ],
    "tls": {
        "server": {
            "issuer": "DigiCert SHA2 High Assurance Server CA",
            "x509": {
                "issuer": {
                    "common_name": [
                        "DigiCert SHA2 High Assurance Server CA"
                    ]
                },
                "subject": {
                    "common_name": [
                        "*.dailymotion.com"
                    ]
                }
            }
        }
    },
    "url": {
        "domain": "www.dailymotion.com",
        "path": "/"
    }
}

These inputs can be used with this integration:

ssl.enabled: true
ssl.certificate: "/path/to/server.crt"
ssl.key: "/path/to/server.key"
ssl.certificate_authorities: ["/path/to/ca.crt"]
ssl.client_authentication: "optional"

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.