Splunk Enterprise Security

Where should I install Fortinet Fortigate Add-On for Splunk?

bsuresh1
Path Finder

Hi All,

We are using Splunk Cloud environment with One Adhoc Search Head and one Enterprise Security Search head.

We have On-prem Deployment server, one Heavy forwarder and one syslog server (also a heavy forwarder).

Fortigate firewall logs are being sent from devices ---> syslog server (HF) ---> Splunk cloud indexers

Currently, I have set index=firewall and sourcetype=fgt for Fortigate firewall logs.

To have the Fortigate firewall logs on Enterprise Security dashboard (For example in Intrusion Center), where the add-on should be installed and what changes to be made?

Currently the add-on (1.6.0 version) is installed on ES Search Head. Should this be uninstalled from here and installed somewhere else?

0 Karma
1 Solution

bhavikbhalodia
Path Finder

Hi @bsuresh1

As per your requirement, you have to install Add-on on the Heavy Forwarder(HF). No need to uninstall Add-on from Search Head.

View solution in original post

0 Karma

jerryzhao
Contributor

keep it on search head and install it on indexers as well.
syslog->splunk indexers(add-on)->ES searchhead(add-on)
when using customized index name and sourcetypes, please refer to the documentation on how to change those in configuration for the add-on.
https://splunkbase.splunk.com/app/2846/#/details

0 Karma

SanjayM
Explorer

Hi Jerry,

in that case where TA is installed on both Indexer and SH,
Where the data input and all configurations are to be configured- on SH right (for Splunk Cloud deployment)
below flow?


Data sources --> HF(Syslog server) (TA not required)--> Cloud indexer (with TA)--> Cloud SH(with TA) 

 

I'd also suggest if you could update the add-on documentation to include clear details pls. That would help.

I have Splunk cloud with ITSI (not ES) and I want to test the Fortinet Add-on

 

0 Karma

bsuresh1
Path Finder

We are using Splunk Cloud. So, couldn't install on indexers. Shoudl I install it on Syslog (HF) and ES Search Head?

0 Karma

jerryzhao
Contributor

even on cloud, you can ask splunk support to install it for you, right? I have seen other customers use add-on on cloud as well.

neelamsantosh
Path Finder

As I have already placed the Fortigate AddOn on SH and u must be parsing the logs as expected.
Make sure the data models , event types and tags are in place.
Validate them first as ES mostly relies on them.

0 Karma

bhavikbhalodia
Path Finder

Hi @bsuresh1

As per your requirement, you have to install Add-on on the Heavy Forwarder(HF). No need to uninstall Add-on from Search Head.

0 Karma

bsuresh1
Path Finder

So, should I install the Add-On on Syslog server (Heavy Forwarder)? What should be the sourcetype for fortigate logs and how the props apply?

I believe based on the sourcetype, the logs get pushed to ES data model

0 Karma

bsuresh1
Path Finder

Hi All,
I have installed Add-On on heavy Forwarder (syslog server), but the sourcetype transformation is not happening. All the data is coming in as fgt_log as I defined in inputs.conf.

Am I missing something?

Work done by me:
Installed Fortigate Add-On on Heavy Forwarder
Edited inputs.conf on different app (my_syslog_inputs_app): changed sourcetype from fgt to fgt_log. Decided to keep index as "firewall"

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...