Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • CLI Reference

    Home FortiWeb 7.2.4 CLI Reference
    7.2.4
    7.6.1
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.3.23
    6.3.19
    6.3.18
    6.3.17
    6.3.16
    6.3.15
    6.3.14
    6.3.13
    6.3.11
    6.3.10
    6.3.9
    6.3.7
    6.3.6
    6.3.5
    6.3.4
    6.3.3
    6.3.2
    6.3.1
    6.3.0
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.1.2
    6.1.1
    5.7.0
    5.6.1
    5.6.0

    log siem-policy

    log siem-policy

    Use this command to configure a connection to one or more ArcSight SIEM (security information and event management) servers, IBM QRadar servers or Azure Security Center (if your FortiWeb-VM is deployed on Microsoft Azure). The policy is used by the log syslogd configuration to define the specific ArcSight server, QRadar server or Azure Event Hub on which log messages are stored. For details, see log syslogd.

    To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For details, see Permissions.

    Syntax

    config log siem-policy

    edit "<policy_name>"

    config siem-server-list

    edit <entry_index>

    set type <arcsight-cef | qradar-leef | azure-cef>

    set port <port_int>

    set server "<siem_ipv4>"

    end

    next

    end

    Variable Description Default

    "<policy_name>"

    Enter the name of a new or existing SIEM policy. The maximum length is 63 characters.

    To display the list of existing policies, enter:

    edit ?

    		No default.

    <entry_index>

    		 Enter the index number of the individual entry in the table.
    		 No default.

    type <arcsight-cef | qradar-leef | azure-cef>

    Enter to store log messages to a SIEM (Security Information and Event Management) server. According to the specified SIEM policy, FortiWeb will carry out one of the following actions:

    • arcsight-cef—Store log messages remotely to an ArcSight server
    • qradar-leef—Store log messages remotely to a QRadar server
    • azure-cef—Send log messages to Azure Event Hub (only available for FortiWeb-VM installed on Azure)

    FortiWeb sends log entries in CEF (Common Event Format) format. There is a 256 byte limit for URLs.

    If this option is enabled, but no trigger action is selected for a specific type of violation, FortiWeb records every occurrence of that violation to the resource specified by SIEM Policy.

    The Azure CEF policy type requires you to complete Azure event hub settings using the system eventhub CLI command.

    Note: Before you enable this option, verify that log frequency is not too great. If logs are very frequent, enabling this option can decrease performance and cause the FortiWeb appliance to send many log messages to the resource.

    Note: You cannot view logs stored remotely from the FortiWeb web UI.

    		 arcsight-cef

    port <port_int>

    		 Enter the port where the ArcSight or QRadar server listens for log output. 514

    server "<siem_ipv4>"

    		 Enter the IP address of the ArcSight or QRadar server. No default.

    Example

    This example creates SIEM_Policy1. FortiWeb contacts the ArcSight server using its IP address, 192.0.2.10. Communications occur over the standard port number for ArcSight, UDP port 514. The FortiWeb appliance sends log messages to the server in CEF format.

    config log siem-policy

    edit "SIEM_Policy1"

    config siem-server-list

    edit 1

    set type arcsight-cef

    set port 514

    set server "192.0.2.10"

    end

    next

    end

    Related topics

    Previous
    Next

    log siem-policy

    log siem-policy

    Use this command to configure a connection to one or more ArcSight SIEM (security information and event management) servers, IBM QRadar servers or Azure Security Center (if your FortiWeb-VM is deployed on Microsoft Azure). The policy is used by the log syslogd configuration to define the specific ArcSight server, QRadar server or Azure Event Hub on which log messages are stored. For details, see log syslogd.

    To use this command, your administrator account’s access control profile must have either w or rw permission to the loggrp area. For details, see Permissions.

    Syntax

    config log siem-policy

    edit "<policy_name>"

    config siem-server-list

    edit <entry_index>

    set type <arcsight-cef | qradar-leef | azure-cef>

    set port <port_int>

    set server "<siem_ipv4>"

    end

    next

    end

    Variable Description Default

    "<policy_name>"

    Enter the name of a new or existing SIEM policy. The maximum length is 63 characters.

    To display the list of existing policies, enter:

    edit ?

    		No default.

    <entry_index>

    		 Enter the index number of the individual entry in the table.
    		 No default.

    type <arcsight-cef | qradar-leef | azure-cef>

    Enter to store log messages to a SIEM (Security Information and Event Management) server. According to the specified SIEM policy, FortiWeb will carry out one of the following actions:

    • arcsight-cef—Store log messages remotely to an ArcSight server
    • qradar-leef—Store log messages remotely to a QRadar server
    • azure-cef—Send log messages to Azure Event Hub (only available for FortiWeb-VM installed on Azure)

    FortiWeb sends log entries in CEF (Common Event Format) format. There is a 256 byte limit for URLs.

    If this option is enabled, but no trigger action is selected for a specific type of violation, FortiWeb records every occurrence of that violation to the resource specified by SIEM Policy.

    The Azure CEF policy type requires you to complete Azure event hub settings using the system eventhub CLI command.

    Note: Before you enable this option, verify that log frequency is not too great. If logs are very frequent, enabling this option can decrease performance and cause the FortiWeb appliance to send many log messages to the resource.

    Note: You cannot view logs stored remotely from the FortiWeb web UI.

    		 arcsight-cef

    port <port_int>

    		 Enter the port where the ArcSight or QRadar server listens for log output. 514

    server "<siem_ipv4>"

    		 Enter the IP address of the ArcSight or QRadar server. No default.

    Example

    This example creates SIEM_Policy1. FortiWeb contacts the ArcSight server using its IP address, 192.0.2.10. Communications occur over the standard port number for ArcSight, UDP port 514. The FortiWeb appliance sends log messages to the server in CEF format.

    config log siem-policy

    edit "SIEM_Policy1"

    config siem-server-list

    edit 1

    set type arcsight-cef

    set port 514

    set server "192.0.2.10"

    end

    next

    end

    Related topics

    Previous
    Next