All Apps and Add-ons

fortinet logs visibility

splunkcol
Contributor

Hi all,

Currently I receive the logs from the fortinet source without problems, but what worries me is that there is a large consumption of licensing.

When I make a query I find that 94% of the logs that arrive are type "Notice"

Would it be a bad idea to ask the administrator not to send this type of log?

In case of blocking this type of log, what important information would you miss?

 

splunkcol_0-1639624528921.png

 

Labels (4)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

probably those with level notice are some audit trail etc. (like accepted connections and so on).

It's totally dependent are those needed on your organisation or not. If you are not needed those you could easily drop those away before indexing or try to ask that your network staff filltering those away before sending.

On splunk side (HF or IDX) you could also partially filtering those if some are needed and some not. Just look how this can do from docs or previous community answers.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

probably those with level notice are some audit trail etc. (like accepted connections and so on).

It's totally dependent are those needed on your organisation or not. If you are not needed those you could easily drop those away before indexing or try to ask that your network staff filltering those away before sending.

On splunk side (HF or IDX) you could also partially filtering those if some are needed and some not. Just look how this can do from docs or previous community answers.

r. Ismo

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...