Log Type Overview and Considerations

FortiSIEM collects two main classes of log:

• Security (SOC) logs

• Performance (NOC) logs

These two classes of logs are presented to the analyst via a single GUI and made available via a single analytics interface. This combination of performance and security logs is what enables the FortiSIEM combined NOC & SOC analytics feature.

Different protocols are used to gather logs, depending on the log source and the type of log. Security logs are typically collected via:

• Syslog

• API

• WMI / OMI

• FortiSIEM Agent for Windows and Linux

Performance logs are typically collected via

• SNMP

• WMI

• Custom performance monitors

Additional application specific protocols, such as JDBC, are also used where relevant.

Different log collection protocols have a different impact on the FortiSIEM cluster. Some protocols such as syslog are efficient and have lower performance overhead, whereas others such as SNMP and WMI are resource intensive as they require the system to periodically poll the device to gather data.

When designing a FortiSIEM solution to monitor large numbers of devices by SNMP and / or WMI, provision sufficient collectors to handle the additional overhead of polling the devices. As a rule of thumb deploy one collector per 150 WMI devices or 200 - 250 SNMP devices, the exact capacity will depend on deployment specific factors such as the polling frequency, number of SNMP objects etc. Collectors can perform multiple roles simultaneously, collectors performing WMI / OMI or SNMP monitoring can also ingest syslog and accept agent connections.