UnixParser assign as Event Type Generic_Unix_sshd_Generic for ssh login / logout events in analytics but if i run a parser test on log the event is correct assigned.
This make impossibile to generate reports in login / logout events.
Thank you
I found the problem. I set rsyslog to send logs in RFC 5424 and fortisiem seams to have trouble interpreting this format. I leave default format and logs are parsed correctly.
Did you get this sorted? If not, share with me the log (PM) if needed and I will check it out.
Thanks
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.