Receive Fortigate syslog events
If you want Artica PCAP filter to detect malicious IP addresses through Fortigate access events, you must ensure that your Fortigate sends network access events via syslog.
If you want Artica PCAP filter to detect malicious IP addresses through Fortigate access events, you must ensure that your Fortigate sends network access events via syslog.
If you already use a syslog server, you can set up the syslog server to forward events to Artica PCAP filter
To do this, you need to change the destination port and the format (CEF) sent by Fortigate.
These parameters are available on the command line.
# config log syslogd setting
router (setting) #
(setting) # set port 5514
(setting) # set server 192.168.1.190
(setting) # set format cef
router (setting) # end
Port 5514 is different from default port 514.
Confirm to use port 5514 instead?
Do you want to continue? (y/n)y
Port set to 5514