Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Filebeat Fortigate Module #17743

Closed
wants to merge 8 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Empty file modified .ci/scripts/install-docker-compose.sh 100755 → 100644
Empty file.
Empty file modified .ci/scripts/install-go.sh 100755 → 100644
Empty file.
Empty file modified .ci/scripts/kind-setup.sh 100755 → 100644
Empty file.
Empty file modified .ci/scripts/minikube-setup.sh 100755 → 100644
Empty file.
Empty file modified .ci/scripts/travis_has_changes.sh 100755 → 100644
Empty file.
Empty file modified deploy/kubernetes/.travis/setup.sh 100755 → 100644
Empty file.
Empty file modified dev-tools/cherrypick_pr 100755 → 100644
Empty file.
Empty file modified dev-tools/deploy 100755 → 100644
Empty file.
Empty file modified dev-tools/find_pr_jenkins_jobs.sh 100755 → 100644
Empty file.
Empty file modified dev-tools/generate_notice.py 100755 → 100644
Empty file.
Empty file modified dev-tools/get_version 100755 → 100644
Empty file.
Empty file modified dev-tools/jenkins_ci.ps1 100755 → 100644
Empty file.
Empty file modified dev-tools/jenkins_ci.sh 100755 → 100644
Empty file.
Empty file modified dev-tools/jenkins_intake.sh 100755 → 100644
Empty file.
Empty file modified dev-tools/jenkins_release.sh 100755 → 100644
Empty file.
Empty file modified dev-tools/merge_pr 100755 → 100644
Empty file.
Empty file modified dev-tools/open_pr 100755 → 100644
Empty file.
Empty file modified dev-tools/run_with_go_ver 100755 → 100644
Empty file.
Empty file modified dev-tools/set_docs_version 100755 → 100644
Empty file.
Empty file modified dev-tools/set_version 100755 → 100644
Empty file.
Empty file modified filebeat/module/elasticsearch/_meta/docs.asciidoc 100755 → 100644
Empty file.
16 changes: 16 additions & 0 deletions filebeat/module/fortigate/_meta/config.yml
@@ -0,0 +1,16 @@
- module: fortigate
# All logs
{fileset}:
enabled: true

# Set custom paths for the log files. If left empty,
# Filebeat will choose the paths depending on your OS.
#var.paths:

- module: fortigate
fortios:
enable: true
# Set custom paths for the log files. If left empty,
# Filebeat will choose the paths depending on your OS.
#var.udp_host: 0.0.0.0
#var.udp_port: 514
66 changes: 66 additions & 0 deletions filebeat/module/fortigate/_meta/docs.asciidoc
@@ -0,0 +1,66 @@
:modulename: fortigate
:has-dashboards: true

== Fortigate Firewall module

This is a module for Fortinet Foritgate fortios firewall monitoring logs received
over Syslog.

include::../include/gs-link.asciidoc[]

[float]
=== Compatibility

Tested on 5.6 To 6.4.0
include::../include/configuring-intro.asciidoc[]

The {plugins}/ingest-geoip.html[ingest-geoip]
Elasticsearch plugin is required to run this module.

include::../include/configuring-intro.asciidoc[]

The module is by default configured to run via udp on port 9001. =

:fileset_ex: fortios

include::../include/config-option-intro.asciidoc[]

[float]
==== `fortios` fileset settings

Example config:

[source,yaml]
----
panos:
var.udp_host: 0.0.0.0
var.udp_port: 514
----

include::../include/var-paths.asciidoc[]

*`var.udp_host`*::

The interface to listen to UDP based syslog traffic. Defaults to `localhost`.
Set to `0.0.0.0` to bind to all available interfaces.

*`var.udp_port`*::

The UDP port to listen for syslog traffic. Defaults to `9001`

NOTE: Ports below 1024 require {beatname_uc} to run as root.


[float]
=== Example dashboard

This module comes with a sample dashboard. For example:

TODO: include an image of a sample dashboard. If you do not include a dashboard,
remove this section and set `:has-dashboards: false` at the top of this file.

:has-dashboards!:

:fileset_ex!:

:modulename!:
9 changes: 9 additions & 0 deletions filebeat/module/fortigate/_meta/fields.yml
@@ -0,0 +1,9 @@
- key: fortigate
title: "fortigate"
description: >
fortigate Module
fields:
- name: fortigate
type: group
description: >
fields: