Fortinet Sentinel Log Filtering

Question

Hello,

I've some problem about filtering Fortinet FW logs to the Sentinel. Logs are forwarded by FortiAnalyzer. Our daily data volume is more than 160 GB. I want to ingest only security logs, not others. I've tried this (https://docs.fortinet.com/document/fortianalyzer/6.0.5/administration-guide/576889/configuring-log-forwarding ) , but could't reach the solution.

Is there any way to filter fw logs.

Thanks.

Answer 1

Hello, You can drop unwanted Data with a DCR.

It's also now possible to split the data into different cost tiers, this is a great write-up of that process. https://www.linkedin.com/pulse/filter-split-firewallcef-logs-multiple-sentinel-tables-marko-lauren/?utm_source=share&utm_medium=member_android&utm_campaign=share_via

As an example, this wont send "traffic" to the CommonSecurityLog (you need to know what you are happy to drop, traffic is just an example)

source | where DeviceVendor != \"\" and Activity !startswith \"traffic\""