Event Forwarding

In systems management, many servers may need access to forward logs, traps and NetFlows from network devices and servers, but it is often resource intensive for network devices and servers to forward logs, traps and NetFlows to multiple destinations. For example, most Cisco routers can forward NetFlow to two locations at most. However, FortiSIEM can forward/relay specific logs, traps and NetFlows to one or more destinations. A Super, Worker or Collector can forward events - the one which receives and parses the event forwards it. If you want to send a log to multiple destinations, you can send it to FortiSIEM, which will use an event forwarding rule to send it to the desired locations. If you only want the workers (or super) to forward events, after this configuration, see Event Forwarding by Worker.

1. Go to Admin > Settings > Event Pipeline > Forwarding tab.
2. Click +.
3. Select the Organization for which the rule will apply.
4. Click the drop-down next to Reporting Device and browse the folders to find the group of devices, or a specific device for which you must create a rule.
5. Click the drop-down next to Event Type and browse the folders to find the group of event types, or a specific event type for which you must create a rule.
6. Click Save.

7. Select the Traffic Type to which the rule should apply. Based on your Traffic Type selection, provide the following information based off the Traffic Type table:

   Traffic Type	Fields and Description Configuration
   Syslog	For Source IP, enter the IP address of the device that will be sending the logs. For Destination IP, enter the IP address of the device to which the logs are sent. For Severity, select an operator and enter a severity level that must match for the log to be forwarded. For Regex Filter, enter any regular expressions you want to use to filter the log files. If any matches are made against your regular expression, then the event will be forwarded. Under Forward To: Enter the IP address. Select the forwarding Protocol from the drop-down. UDP - If you use this protocol, events may be lost. TCP - This method ensures reliability. TCP over SSL - This method ensures reliability and security. See Note 3 below. Select the Port number in the Port field. Select the Format: Incoming - outgoing format is same as incoming. CEF - outgoing events are CEF formatted. See here for details on CEF formatted logs. When done, click Save.
   Netflow	Under Forward To: Enter the IP address. Protocol should default to Netflow. Select the Port number in the Port field. When done, click Save.
   Any	A Kafka Channel is required. This can be configured in Admin > Settings > System Kafka. Under Forward To: Protocol should default to Kafka. From the Kafka Channel drop-down, select the Kafka channel you configured. Click Save.

Notes:

1. If you want the same sender IP to forward events to multiple destinations, create a rule for each destination.
2. FortiSIEM will implement all rules that you create and enable, so if you create a duplicate of an event forwarding rule, two copies of the same log will be sent to the destination IP.
3. If you want to use public CA certificates for TCP over SSL communication, then note the following:

   • FortiSIEM's SSL library can validate an external system’s certificate if it is signed by a public CA.

   • If the external system wants to verify the FortiSIEM node's certificate, then you need to add the following certificate and key to the phoenix_config.txt file of the FortiSIEM nodes forwarding the event.

     [BEGIN phEventForwarder]
     tls_certificate_file= #/opt/phoenix/bin/.ssh/my_cert.crt
     …
     tls_key_file= #/opt/phoenix/bin/.ssh/my_cert.key
     [END]

Event Forwarding by Worker

There may be situations where you may not want to forward events from collectors to your target device. Fortinet allows you to forward events when workers (or super) receives collector event information. To configure this, go to Admin > Settings > Event Pipeline > Forwarding tab, and add a checkmark to the Forward From Worker checkbox. If there is more than one collector per org, this feature will forward events by workers for all collectors.