Parse logs sent from ATA to SIEM

Question

Hello team,

Is there a way to parse the logs sent by ATA to FortiSIEM. FortiSIEM received the logs just fine but there are not defined by category/types

Any outcome would be appreciated!

Thanks in advance!

Jose Mauricio Gomez

Answer 1

Did you try this:
https://learn.microsoft.com/en-us/advanced-threat-analytics/cef-format-sa
?