Hi @satyenshah / @jerryzhao , Thanks for the awesome post. We had the same problem in our environment and we had applied this fix in our syslog-ng server yesterday and we see a considerable difference in the raw logs length of Fortinet logs after the unwanted fields are stripped. But we also noticed that, we no longer receive any logs in the catch-all sourcetype (fgt_log). Is this something expected? Regards, Vishnu.
... View more
We currently have the below default search from ES to alert for anomalous audit log clearance activities on windows hosts. But what we have observed so far is, these alerts are triggered during a reboot or shutdown procedure as well. Can someone help me on, how do we tweak the below search to exclude the alerting if its because of a reboot/shutdown?
| from datamodel:"Change_Analysis"."Auditing_Changes" | where ('action'="cleared" OR 'action'="stopped") | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",count by "dest","result"
What we do currently is, we investigate each alert and run a new search to check if there's an event code (like below) triggered during the same time-frame and then ignore if its because of a reboot/shutdown. But its getting painful. Hence we wanted to tweak the existing search from ES to exclude from alerting if its due to a reboot/shutdown. Can someone assist on this?
EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076"
... View more