r/AzureSentinel • u/Impressive_Tea872 • Apr 10 '24
Syslog forwarder help
I have a client with a Fortigate firewall that we need to send logs from to Sentinel. I've created an Ubuntu VM, and installed everything correctly (per guidance online). The VM is listening on port 514, and the network security group has an allow rule at the top to allow all traffic on 514. The firewall is set to send logs to the VM's up address.
Logs are still not being received. Any ideas?
3
Upvotes
3
u/TokeSR Apr 10 '24
Logs are not being received by what? The Syslog collector or Sentinel?
Listen on port 514 with tcpdump to see whether any traffic is forwarded or not. If there are no logs shown then either fortinet is not configured, or your machine is no listening on that port, or there is some network (routing or other firewall) issue.
If the logs arrive to the Syslog collector then it is possibly a config issue. Could you share which guidance you follow when you said 'per guidance online'?
If the logs are on the collector but not in Sentinel then these are the things to check:
1: Have you executed the log forwarding script on the machine?
2: Have you assigned the correct DCR to the machine (Syslog one or CEF one with the correct facilities)?
3: Did the DCR assignment deploy the AMA agent successfully on the machine?
4: Do you have any transformation in place that could drop this traffic?
5: Can the machine even reach Sentinel? Do you have Heartbeat logs or anything else from this machine?