Fortinet Fortigate via Radiant Agent

Configure Fortinet Fortigate for syslog log forwarding to Radiant Security via Radiant Agent.

In this guide, you will configure syslog log forwarding for Fortinet Fortigate via Radiant Agent.

To use Fortinet FortiAnalyzer to forward Fortigate syslog to Radiant Security, refer to the Fortinet FortiAnalyzer (syslog) documentation

Add the data connector in Radiant Security

1. Log in to Radiant Security.

2. From the navigation menu, click Settings > Data Connectors and click + Add Connector.

3. Search for and select the Radiant Agent option and then click Data Feeds.

4. Under Select your data feeds, select the Fortinet Fortigate v7 data feed and click Credentials.

5. Under Credential Name, give the credential an identifiable name (e.g. Radiant Agent integration). If you already have a Radiant Agent in place, select it from the drop-down menu.

6. Click Add Connector.

Configure syslog directly from FortiGate Firewalls

The steps below must be applied on all Fortigate firewalls that should forward syslog to Radiant Security. Use the following help article as a reference: Log settings and targets.

Log into the FortiGate CLI and configure the following syslogd setting:

Make sure to replace the server placeholder with the private IP of the VM where the agent is installed, and the port one by the port configured for the Fortigate Firewall data type (if you don't know the port, please reach out to your Customer Success rep.)

config log syslogd setting
    set status enable
    set server <INTERNAL_IP_OF_YOUR_RADIANT_AGENT>
    set mode reliable
    set port <PORT_CONFIGURED_IN_YOUR_AGENT_TO_RECEIVE_FORTIGATE_DATA>
end