All Apps and Add-ons

Fortinet FortiGate Add-On for Splunk: How to use only the Fortigate Add-on to parse logs

Explorer

Hello,
I have a FortiGate 300e with FortiOS 6.0.4, and would like to index only the security events in Splunk.
Also, I want to use only the Fortigate Add-on for the parse of the logs.
I do not want to use the Fortigate APP because I will build my own dashboard. Is this possible?

Does anyone have experience with this?

Tks

Explorer

Hi Burak,

For the Palo Alto Firewall I was able to do the indexing of the logs via Palo Alto Add-on only. I've used 3 files in the local directory, such as:

Inputs.conf
[udp: // 5514]
sourcetype = pan: log
no_appending_timestamp = true
index = pancompany_logs

Props.conf
[pan: log]
TRANSFORMS-drop = discard-traffic

Transforms.conf
[discard-traffic]
REGEX =, TRAFFIC,
DEST_KEY = queue
FORMAT = nullQueue

Help!!!
How do I configure the inputs, props and transforms in FortiGate Add-on?

I would like to drop traffic logs (ex.: type="traffic") and index only security logs (ex.: type="utm") from FortiGate.

Can you help me?

Tks

0 Karma

Engager

Did you get this working? I am working on this myself right now. Only want the utm logs but on top of this only specific fields within those logs.

UTM gets very sizable in our environment and we have a constraining license.

0 Karma

Path Finder

hi ,

you can deploy related TA to your indexer and heavy forwarder only, you don't need to deploy APP to search head or any splunk role if you don't want their dashboard.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!