Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jerryzhao
jerryzhao
Contributor
Member since:
12-17-2015
03-13-2023
Community Statistics
| Posts | 76 |
| Solutions | 13 |
| Karma Given | 3 |
| Karma Received | 10 |
| Member Since | 12-17-2015 |
Activity Feed
- Karma Trimming firewall logs using syslog-ng to conserve license, and a bugfix for the Fortinet FortiGate Add-On for Splunk for satyenshah. 03-13-2023 07:23 PM
- Got Karma for Re: Fortinet Fortigate App for Splunk Empty Dashboards. 01-25-2023 12:12 PM
- Got Karma for Re: Why is Fortinet FortiGate CEF Format Not Matching?. 08-15-2022 05:05 AM
- Posted Re: Why is Fortinet FortiGate CEF Format Not Matching? on All Apps and Add-ons. 08-12-2022 11:30 AM
- Got Karma for Re: Fortinet Fortigate App and Add-on for Splunk: Why are dashboards not showing any data from our UDP:515 input?. 01-14-2021 04:54 AM
- Got Karma for Re: Trimming firewall logs using syslog-ng to conserve license, and a bugfix for the Fortinet FortiGate Add-On for Splunk. 08-12-2020 12:03 AM
- Got Karma for Re: Fortinet Fortigate App for Splunk Empty Dashboards. 06-05-2020 12:51 AM
- Karma Re: Why do some searches only display statistics and not Events? for elliotproebstel. 06-05-2020 12:49 AM
- Karma Re: 2018: Fortinet Fortigate Add-on for Splunk: When I run a search, I can see events, but why am I unable to see data in any dashboards? for xpac. 06-05-2020 12:49 AM
- Got Karma for Re: Fortinet FortiGate App for Splunk: Why am I receiving this Error in 'SearchParser' and that macro cannot be found in every panel on the dashboard?. 06-05-2020 12:49 AM
- Got Karma for Re: Does the FortiGate addon work with the new Splunk Security Essentials App?. 06-05-2020 12:49 AM
- Got Karma for Re: Which TA should I use for FortiGate?. 06-05-2020 12:49 AM
- Got Karma for Re: Which TA should I use for FortiGate?. 06-05-2020 12:49 AM
- Got Karma for Re: Why isn't this query showing iplocation statistics?. 06-05-2020 12:49 AM
- Posted Re: Fortinet Fortigate App for Splunk Empty Dashboards on All Apps and Add-ons. 05-18-2020 05:51 PM
- Posted Re: Fortinet Fortigate App for Splunk Empty Dashboards on All Apps and Add-ons. 05-18-2020 02:23 PM
- Posted Re: Fortinet Fortigate App for Splunk Empty Dashboards on All Apps and Add-ons. 05-18-2020 02:22 PM
- Posted Re: Fortinet Fortigate App for Splunk Empty Dashboards on All Apps and Add-ons. 05-15-2020 03:24 PM
- Posted Re: Fortinet Fortigate App for Splunk Empty Dashboards on All Apps and Add-ons. 03-24-2020 10:03 AM
- Posted Re: Trimming firewall logs using syslog-ng to conserve license, and a bugfix for the Fortinet FortiGate Add-On for Splunk on All Apps and Add-ons. 11-07-2019 11:25 AM
Topics I've Started
No posts to display.
08-12-2022
11:30 AM
1 Karma
login to fortigate cli. config global config log syslogd setting set format default end However if cef format is configured on fortianalyzer and then forwarded to splunk, you need to change the format on fortianlayzer to syslog.
... View more
05-18-2020
05:51 PM
please copy exact the string `fgt_logs` and paste in search. it is not single quote.
if there is still no result, can you check whether you use cutomized index name? can you check following:
If a customized index is used for the input, it also needs to be added in admin user's default authorized list of indexes to search.
In $SPLUNK_HOME/etc/system/local/authorize.conf
[role_admin]
srchIndexesDefault = fgt;main
srchMaxTime = 8640000
In this example, fgt is the index for my fortigate log input.
... View more
05-18-2020
02:23 PM
fgt_logs macro needs to be put in query field: `fgt_logs`
... View more
05-18-2020
02:22 PM
can you try running fgt_logs query for last 10 minutes in real time streaming in search and reporting app?
the overall dashboard runs the same query.
... View more
05-15-2020
03:24 PM
overview dashboard is different from other dashboards. because overview page is for real time logs. Can you check in search&reporting if the logs are coming in in real time? are all your servers' time in sync?
... View more
03-24-2020
10:03 AM
2 Karma
Did you enable data model acceleration?
5. Enable Data Model Acceleration:
Since version 1.5.0 of the app, data model acceleration is no longer enabled in default/datamodels.conf. User has to either enable data acceleration on Splunk GUI Settings->Data Models->Fortinet FoS Log.
Or on Splunk search head, where the app is installed, create "local" folder under $SPLUNK_HOME/etc/apps/SplunkAppForFortinet/ and create a file in this "local" folder named datamodels.conf with the following content:
[ftnt_fos]
acceleration = 1
acceleration.earliest_time = -1mon
https://splunkbase.splunk.com/app/2800/#/details
... View more
11-07-2019
11:25 AM
1 Karma
Thanks Satyen for the input.
As Satyen also pointed out, please trim the events according to your own needs. Some trimming may break dashboards on the Fortinet App.
... View more
10-24-2019
12:03 PM
Fortinet Fortigate App is not needed for enterprise security.
To see results in intrusion center, do you have any logs like this? with attack in the field?
Aug 15 15:20:18 10.160.55.31 date=2019-08-15 time=15:20:38 devname="FGT1500D0-232" devid="FG1K5D3I13800014" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" eventtime=1565907638 severity="critical" srcip=x.x.x.x srccountry="United States" dstip=x.x.x.x srcintf="port32" srcintfrole="undefined" dstintf="demo-gateway" dstintfrole="lan" sessionid=39547555 action="dropped" proto=6 service="HTTPS" policyid=13 attack="OpenSSL.Heartbleed.Attack" srcport=58940 dstport=443 hostname="*.fortinet.com" direction="outgoing" attackid=38315 profile="default" ref="http://www.fortinet.com/ids/VID38315" incidentserialno=949409074 msg="applications: OpenSSL.Heartbleed.Attack, OpenSSL Heartbleed" crscore=50 crlevel="critical"
... View more
10-18-2019
10:32 AM
even on cloud, you can ask splunk support to install it for you, right? I have seen other customers use add-on on cloud as well.
... View more
10-17-2019
12:35 PM
keep it on search head and install it on indexers as well.
syslog->splunk indexers(add-on)->ES searchhead(add-on)
when using customized index name and sourcetypes, please refer to the documentation on how to change those in configuration for the add-on.
https://splunkbase.splunk.com/app/2846/#/details
... View more
09-03-2019
11:07 AM
replied to you in support email thread.
But anyway, also paste the questions here:
I have enterprise security 5.3.1 installed and could not find the issue you reported.
Which add-on version did you install?
Is CIM related datamodels accelerating? For example, traffic center is most likely to have data.
... View more
05-23-2019
12:46 PM
it works on 7.2. i have updated splunkbase to reflect it.
... View more
03-25-2019
04:17 PM
our current TA works for both 5.4, 5.6 and 6.0.
as i included in my email reply, the screen capture shows the action="deny" was correctly converted to blocked for action and vendor_action.
i verified this on a new installation with the app/TA on splunk base. please make sure the TA are installed on all forwarder, indexer and searchheads, unmodified. My splunk server is 7.2.4 though but double quotes have been verified long ago since 5.6 introduced double quotes in logs.
can you try reinstalling them?
... View more
03-25-2019
03:21 PM
yes. vendor_action is for CIM model, i wrote that. but anyway that is not what we should worry about.
as i replied to your email, i have no issue with 6.0 FOS logs with quotes. Do you have other TA for fortigate installed than our TA? i remember there is one that comes with enterprise security installation, you have to uninstall it.
have your traffic logs, for example, been transformed to fgt_traffic sourcetype? if not, that is an indication that our TA is not taking effect.
... View more
03-25-2019
12:29 PM
still the original action extracted should be without quotes in the first place. look up only does a translation between action and vendor action.
which splunk version are you using?
... View more
03-25-2019
11:51 AM
splunk should be able to extract the value stripping off the quotes automatically. the one with regex is for extracting vendor actions, which i found had not been even necessary.
let me verify this and let you know
... View more
03-20-2019
11:25 AM
Hi gvmorley
Thanks for pointing out the bug and providing a better approach.
We sure will verify it and include the fix in future release.
Thanks again!
... View more
10-17-2018
11:18 AM
sorry i didn't check back. you might have found a solution or given up, but fwiw, please make sure fgt_traffic, fgt_event, or fgt_utm sourcetypes are populated by the add-on as indication that the add-on is actually working. You can do that by search sourcetype= any of the 3 sourcetype listed above. And we can investigate further from there if fortigate logs is still not going into CIM model.
... View more
09-06-2018
06:24 PM
not can be installed but must be installed. so yes, you need to install add-on on searchhead, indexer and forwarder.
... View more
09-06-2018
06:21 PM
1 Karma
after changing the sourcetype to Fortinet, you have to modify it in props.conf of add-on as well.
Quote from the documentation of add-on:
https://splunkbase.splunk.com/app/2846/#/details
Fortinet FortiGate Add-On for Splunk will by default automatically extract FortiGate log data from inputs with sourcetype 'fgt_log'.
If you want to configure it to extract a self-defined sourcetype, copy the props.conf
in $SPLUNK_HOME/etc/apps/Splunk_TA_fortinet_fortigate/default/props.conf to
$SPLUNK_HOME/etc/apps/Splunk_TA_fortinet_fortigate/local/props.conf and change the source stanza.
replace [fgt_log] with [fortigate], for instance.
Restart Splunk service for the change to take effect.
BTW, what do you mean by "We have the Fortinet Addon and TA addon installed", the app and add-on you need to install are:
https://splunkbase.splunk.com/app/2800/
https://splunkbase.splunk.com/app/2846/
... View more
04-30-2018
02:23 PM
splitting the input and rewriting sourcetype somehow will bypass the props.conf in our add-on. because we need to rewrite fgt_log to fgt_traffic, fgt_utm... at props.conf stage. can splunk chain/pipeline those processes?
... View more
04-30-2018
02:10 PM
you don't have access to any of the servers? indexer or an additional dedicated server/vm just for receiving syslog and save them to different files by hosts?
then it is hard for splunk to turn one input into different sourcetypes at input phase. you can write rules in splunk for that but that will bypass our processing in the add-on.
... View more
04-30-2018
01:49 PM
second this suggestion.
... View more
04-30-2018
01:48 PM
can you use a different port from 514, 513 for example?
then configure syslog to use 513.
... View more
04-19-2018
04:07 PM
I think you mean srcip doesn't fall into a certain state.
index="myIndex" eventtype=ftnt_fgt_event subtype=system eventtype=ftnt_fgt_auth_privileged status=failed |iplocation srcip |where Region!="California"
This example shows all failed logins out of california
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-13-2023
10:53 PM
|
Karma from
