Mask user data in log forwarder

FortiAnalyzer includes an option to mask user privacy data when forwarding logs to a remote server in one of the supported types: FortiAnalyzer, Syslog, or CEF.

To configure data masking in log forwarding:

1. Go to System Settings > Log Forwarding, and configure a new or existing log forwarding profile.
2. Set the Enable Masking toggle to the ON position.
   Select the fields to be masked in Masking Data Fields, and create a Data Mask Key.
   
3. Click OK to save the log forwarding profile.
   The remote server will receive logs with the selected field values masked.
   

To configure log field exclusion in log forwarding:

1. Go to System Settings > Log Forwarding, and configure a new or existing log forwarding profile.
2. Set the Enable Exclusions toggle to the ON position.
   Add at least one log field to exclude.
   
3. Click OK to save the log forwarding profile.
   The remote server will receive logs with the selected log field removed.
   Log field exclusion will occur even when the same log field is also configured to be masked using data masking.

Configuring log field masking and exclusions in the CLI

The log-field-exclusion-status command was added to configure log field exclusions in the CLI.

The log-masking-status command was added to configure log field masking in the CLI.

The following is an example of the CLI used to configure log masking and exclusions:

config system log-forward

edit 1

set mode forwarding

set fwd-max-delay realtime

set server-name "faz-248"

set server-ip "10.2.125.248"

set fwd-reliable enable

set sync-metadata sf-topology interface-role device endusr-avatar

config device-filter

edit 1

set device "FG100D3G00002900"

next

edit 2

set device "FG100D3G00002901"

next

end

set signature 5899086158772996474

set log-field-exclusion-status enable

config log-field-exclusion

edit 1

set field-list "unauthuser"

next

edit 2

set log-type ANY-TYPE

set field-list "srcip"

next

end

set log-masking-status enable

set log-masking-fields user srcmac

set log-masking-key ENC MTI0MDIwNDAxNDU4MzE3Nwt6SkhHfPMpmk5BN3cthOBoZwEvkjlBLEzBvUk89vcWnE0O6zRVadjlp9dPTJ8fw3svp1FF2uiPb5h6iN+Y0Y/be4sGO0J1TYVuMoyz5Od6xgmAFnG1M7F3QLNpXMp1COjD8MNRIto

next

end