All Apps and Add-ons

fortinet logs visibility

splunkcol
Contributor

Hi all,

Currently I receive the logs from the fortinet source without problems, but what worries me is that there is a large consumption of licensing.

When I make a query I find that 94% of the logs that arrive are type "Notice"

Would it be a bad idea to ask the administrator not to send this type of log?

In case of blocking this type of log, what important information would you miss?

 

splunkcol_0-1639624528921.png

 

Labels (4)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

probably those with level notice are some audit trail etc. (like accepted connections and so on).

It's totally dependent are those needed on your organisation or not. If you are not needed those you could easily drop those away before indexing or try to ask that your network staff filltering those away before sending.

On splunk side (HF or IDX) you could also partially filtering those if some are needed and some not. Just look how this can do from docs or previous community answers.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

probably those with level notice are some audit trail etc. (like accepted connections and so on).

It's totally dependent are those needed on your organisation or not. If you are not needed those you could easily drop those away before indexing or try to ask that your network staff filltering those away before sending.

On splunk side (HF or IDX) you could also partially filtering those if some are needed and some not. Just look how this can do from docs or previous community answers.

r. Ismo

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...