How to integrate fortigate logs with Wazuh? #2152

dafuq213 · 2020-03-25T07:45:32Z

Hi Folks,

I have recently deployed Wazuh in our infrastructure. It was pretty easy to integrate Windows and Linux os for monitoring. So here is the problem-

I followed Wazuh documentation to configure network devices to receive logs in Wazuh manager.Also allowed the port and ip in ossec.conf. I can see the syslog traffic coming from source machine in tcpdump but events are not visible in Wazuh UI.

Also if you can help me to understand below queries:

Where syslog events are getting stored?
How decoders identify the log path of fortigate

Wazuh Version: 3.11

Any help would be appreciated.

jsanchez91 · 2020-03-25T09:58:19Z

Hi @nkhljswl,
The alerts generated by Wazuh are stored in /var/ossec/logs/alerts/alerts.(json|log) and the events at /var/ossec/logs/archives/archives.(json|log).
Note: By default the event storage is disabled, to enable it change in ossec.conf this:

<ossec_config>
  <global>
    <jsonout_output>yes</jsonout_output>
    <alerts_log>yes</alerts_log>
    <logall>yes</logall> <!-- This -->
    <logall_json>yes</logall_json> <!-- This -->
    <email_notification>no</email_notification>
    <smtp_server>smtp.example.wazuh.com</smtp_server>
    <email_from>ossecm@example.wazuh.com</email_from>
    <email_to>recipient@example.wazuh.com</email_to>
    <email_maxperhour>12</email_maxperhour>
    <email_log_source>alerts.log</email_log_source>
  </global>

You can get more info about the archival data storage here. archival-data-storage
After made the change you can check if your environment generate Syslog events in the files /var/ossec/logs/archives/archives.(json|log).

If you have events but no alerts, you may need to create decoders or custom rules, this Issue can help. #1884

You can also check this blog: Monitoring network devices Wazuh hids

I hope this helps you, don't hesitate to ask if you have any more questions.
Regards,
Jose.

dafuq213 · 2020-03-29T05:53:25Z

Hi @jsanchez91 ,

I have updated the configuration. Also i have added fortigate decoder. Link

But, still i couldn't find logs in archive.log .

jsanchez91 · 2020-04-01T07:13:50Z

Could you explain the steps you take to set up Fortigate on Wazuh?

dafuq213 · 2020-04-01T13:12:54Z

Sure,

Step 1 Enabled syslog in Fortigate firewall to forward log.
Step 2 Added remote port 514 in ossec.conf
Step 3 Updated configuration as per your recommendation
Step 4 Created a xml file inside etc/decoder/custom_fortigate_decoder.xml File
Step 5 Restarted Wazuh manager

jsanchez91 · 2020-04-03T07:29:34Z

Hello,

We can check a few things.

The first is the "var/ossec/logs/ossec.log" file. Check if you have any errors about the rsyslog.

If you have no errors, make sure your remote configuration is good, check if the IP of the Fortigate machine is in the allowed-ips and the local_ip are visible by the Fortigate.

And finally, check the configuration in the file /etc/rsyslog.conf in the Fortigate side. Try to add this to forward all logs to Wazuh:

*.* @[WAZUH-MANAGER-IP]:514

In these links you can get more info about rsyslog:
How to configure Rsyslog client to send events to Wazuh
Remote documentation

If you have any questions, don't hesitate to ask.
Regards,
Jose

dafuq213 · 2020-04-06T09:32:06Z

Hi @jsanchez91

The first is the "var/ossec/logs/ossec.log" file. Check if you have any errors about the rsyslog

I can't see any error message related to rsyslog.

If you have no errors, make sure your remote configuration is good, check if the IP of the Fortigate machine is in the allowed-ips and the local_ip are visible by the Fortigate.

Please find the below screenshot of my configuration

And finally, check the configuration in the file /etc/rsyslog.conf in the Fortigate side. Try to add this to forward all logs to Wazuh:

I can see the syslog traffic in tcpdump

jsanchez91 · 2020-04-07T07:22:16Z

After adding the settings to rsyslog.conf to forward all logs, do you receive any events or alerts?
Run this command to see if you get any events:

tail -n 1000 /var/ossec/logs/archives/archives.json  | grep "<your-fortigate-ip>"

dafuq213 · 2020-04-07T11:07:23Z

Hi Jose,

I can see only archives.log. I couldn't find archives.json.

jsanchez91 · 2020-04-08T07:00:35Z

To save the events in the files.json file enable the logall_json option in the ossec.conf.

<ossec_config>
  <global>
    <jsonout_output>yes</jsonout_output>
    <alerts_log>yes</alerts_log>
    <logall>yes</logall>
    <logall_json>yes</logall_json> <!-- THIS OPTION -->
    <email_notification>no</email_notification>
    <smtp_server>smtp.example.wazuh.com</smtp_server>
    <email_from>ossecm@example.wazuh.com</email_from>
    <email_to>recipient@example.wazuh.com</email_to>
    <email_maxperhour>12</email_maxperhour>
    <email_log_source>alerts.log</email_log_source>
  </global>
...

After the change, restart Wazuh.

dafuq213 · 2020-04-08T07:30:40Z

Hi Jose,

Configuration is already in place.

dafuq213 · 2020-04-12T11:18:44Z

Is there any other workaround to get firewall logs in Wazuh?

jsanchez91 · 2020-04-13T06:54:06Z

Hi @nkhljswl,

It's strange that you don't have the archives.json file with the logall_json option enabled.

Could you share your ossec.log with me to see if your environment has any problems?

dafuq213 · 2020-04-13T11:53:57Z

Hi Jose,

ossec.log

jsanchez91 · 2020-04-14T07:07:00Z

Hello @nkhljswl,

I found no mistake, but it seems your Wazuh service has stopped.

2020/04/08 13:43:41 ossec-authd: INFO: Exiting...

Share with me the output from running this command

systemctl status wazuh-manager

If the service has stopped, restart with this command.

systemctl start wazuh-manager

jsanchez91 · 2020-05-21T06:21:29Z

Hi @nkhljswl

I am closing this issue due to inactivity. Please, if you still have this problem, feel free to open a new issue.

Thank you.

hansaliyad1 · 2020-11-04T21:19:24Z

@jsanchez91 I am having a similar problem as described by @nkhljswl . I have followed all your instructions. I can also see archives.log/json and logs in them. I am not able to on Kibana. I have configured the decoder and rules as described in #1884 . I am using Wazuh 4.0. I am not sure where I am getting wrong. I will appreciate any help!

jsanchez91 · 2020-11-10T10:36:03Z

Hi @hansaliyad1,

Could you share your archives.json with me?
I need to see if you have any events related to Fortigate

hansaliyad1 · 2020-11-10T13:43:31Z

Hey! @jsanchez91

I am sorry! I won't be able to share that file since it contains sensitive information. Also, it is a really big file since it is running for a while now. But I can confirm it has all the events related to Fortigate.

jsanchez91 · 2020-11-11T16:43:16Z

Could you send me some examples of events related to Fortigate that hide sensitive information?

jsanchez91 · 2020-11-11T16:51:11Z

On the other hand, you have commented that you added the decoders and ruleset mentioned in this Issue: #1884

In this comment, a rule is added that level 0, which by default does not generate alerts.

You can try to use the decoders and ruleset indicated in this other comment: #1884 (comment)

hansaliyad1 · 2020-11-12T12:41:35Z

@jsanchez91 Thanks for your response again. I apologize for the delayed response. I did change the level number to 4. I ended removing wazuh and installed ELK. I just needed a log manager. It works now like charm. Thank you again for your help.

jsanchez91 · 2020-11-12T15:59:26Z

I'm glad I could help you, if everything is resolved I'll close the Issue.

If you have any further questions, please do not hesitate to reopen the Issue or use our slack channel, our Google group

Regards

theazlan89 · 2021-09-10T09:43:25Z

Hi,

May i know which format i should choose in Fortigate ?

default Syslog format.
csv CSV (Comma Separated Values) format.
cef CEF (Common Event Format) format.

syafeera92 · 2022-06-16T05:23:43Z

Hi,

I can see the log in tail -n 1000 /var/ossec/logs/archives/archives.json but why i still cannot view fortigate log in wazuh discovery?

Thanks

jsanchez91 self-assigned this Mar 25, 2020

juankaromo added this to To do in Wazuh 3.13 Apr 16, 2020

juankaromo added the reporter/community Issue reported by the community label Apr 21, 2020

jsanchez91 closed this as completed May 21, 2020

Wazuh 3.13 automation moved this from To do to Done May 21, 2020

jsanchez91 reopened this Nov 10, 2020

jsanchez91 closed this as completed Nov 12, 2020

yenienserrano mentioned this issue Mar 4, 2022

Wazuh Manager not detected Fortigate firewall #3851

Closed

RyanInsolencee mentioned this issue Oct 20, 2023

Fortigate syslogs #6028

Closed

kvcdomingues79 mentioned this issue Jan 15, 2024

Invalid element in the configuration: 'group' wazuh/wazuh#21448

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

How to integrate fortigate logs with Wazuh? #2152

How to integrate fortigate logs with Wazuh? #2152

dafuq213 commented Mar 25, 2020 •

edited

jsanchez91 commented Mar 25, 2020

dafuq213 commented Mar 29, 2020 •

edited

jsanchez91 commented Apr 1, 2020

dafuq213 commented Apr 1, 2020

jsanchez91 commented Apr 3, 2020

dafuq213 commented Apr 6, 2020 •

edited

jsanchez91 commented Apr 7, 2020

dafuq213 commented Apr 7, 2020

jsanchez91 commented Apr 8, 2020

dafuq213 commented Apr 8, 2020

dafuq213 commented Apr 12, 2020

jsanchez91 commented Apr 13, 2020

dafuq213 commented Apr 13, 2020

jsanchez91 commented Apr 14, 2020

jsanchez91 commented May 21, 2020

hansaliyad1 commented Nov 4, 2020 •

edited

jsanchez91 commented Nov 10, 2020

hansaliyad1 commented Nov 10, 2020

jsanchez91 commented Nov 11, 2020

jsanchez91 commented Nov 11, 2020

hansaliyad1 commented Nov 12, 2020

jsanchez91 commented Nov 12, 2020

theazlan89 commented Sep 10, 2021

syafeera92 commented Jun 16, 2022

How to integrate fortigate logs with Wazuh? #2152

How to integrate fortigate logs with Wazuh? #2152

Comments

dafuq213 commented Mar 25, 2020 • edited

jsanchez91 commented Mar 25, 2020

dafuq213 commented Mar 29, 2020 • edited

jsanchez91 commented Apr 1, 2020

dafuq213 commented Apr 1, 2020

jsanchez91 commented Apr 3, 2020

dafuq213 commented Apr 6, 2020 • edited

jsanchez91 commented Apr 7, 2020

dafuq213 commented Apr 7, 2020

jsanchez91 commented Apr 8, 2020

dafuq213 commented Apr 8, 2020

dafuq213 commented Apr 12, 2020

jsanchez91 commented Apr 13, 2020

dafuq213 commented Apr 13, 2020

jsanchez91 commented Apr 14, 2020

jsanchez91 commented May 21, 2020

hansaliyad1 commented Nov 4, 2020 • edited

jsanchez91 commented Nov 10, 2020

hansaliyad1 commented Nov 10, 2020

jsanchez91 commented Nov 11, 2020

jsanchez91 commented Nov 11, 2020

hansaliyad1 commented Nov 12, 2020

jsanchez91 commented Nov 12, 2020

theazlan89 commented Sep 10, 2021

syafeera92 commented Jun 16, 2022

dafuq213 commented Mar 25, 2020 •

edited

dafuq213 commented Mar 29, 2020 •

edited

dafuq213 commented Apr 6, 2020 •

edited

hansaliyad1 commented Nov 4, 2020 •

edited