Collect FortiWeb WAF logs

This document describes how you can collect the FortiWeb web application firewall (WAF) logs by using a Google Security Operations forwarder.

For more information, see Data ingestion to Google Security Operations overview.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the FORTINET_FORTIWEB ingestion label.

Configure the FortiWeb WAF logs

To configure the FortiWeb WAF to send logs to a Google Security Operations forwarder, do the following:

• Create a syslog policy.
• Enable the syslog types and log level.
• Create a trigger.

Create a syslog policy

1. Sign in to the Fortinet FortiWeb console.
2. In the Fortinet FortiWeb console, select Log & report > Log policy > Syslog policy.
3. Click Create new.

4. In the New syslog policy window that appears, do the following:

   • In the Policy name field, specify a name for the policy that you want to use in the configuration.
   • In the IP address field, specify the IP address or hostname for the remote syslog server.
   • In the Port field, specify the port for the syslog server.
   • Clear the Enable CSV format checkbox, if it is selected.

5. Click OK.

Enable the syslog types and log level

1. In the Fortinet FortiWeb console, select Log & report > Log config > Global log settings.

2. In the Global log settings window that appears, select the Syslog checkbox and do the following:

   • In the Syslog policy list, select the syslog policy that you created earlier.
   • In the Log level list, choose the minimum severity level for logs to collect.
   • In the Facility list, select the log facility.

3. Click Apply.

Create a trigger

1. In the Fortinet FortiWeb console, select Log & report > Log policy > Trigger policy.
2. Click Create new.

3. In the New trigger policy window that appears, do the following:

   • In the Policy name field, specify a name for the policy that you want to use in the configuration.
   • In the Syslog policy list, select the syslog policy that you created earlier.

4. Click OK.

   Update your syslog policy with the newly created trigger to ensure all required events are logged to Google Security Operations syslog forwarder.

Configure the Google Security Operations forwarder to ingest FortiWeb WAF logs

1. Go to SIEM Settings > Forwarders.
2. Click Add new forwarder.
3. In the Forwarder Name field, enter a unique name for the forwarder.
4. Click Submit. The forwarder is added and the Add collector configuration window appears.
5. In the Collector name field, type a name.
6. Select Fortinet Web Application Firewall as the Log type.
7. Select Syslog as the Collector type.
8. Configure the following mandatory input parameters:
   • Protocol: specify the connection protocol that the collector uses to listen to syslog data.
   • Address: specify the target IP address or hostname where the collector resides and listens to syslog data.
   • Port: specify the target port where the collector resides and listens to syslog data.
9. Click Submit.

For more information about the Google Security Operations forwarders, see Manage forwarder configurations through the Google Security Operations UI.

If you encounter issues when you create forwarders, contact Google Security Operations support.

Field mapping reference

This parser handles logs from FORTINET FORTIWEB in key-value (KV) format, transforming them into UDM. It processes both CEF and non-CEF formatted logs, extracting fields, normalizing values, and mapping them to the appropriate UDM fields based on the log format.

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.