config system syslog fortianalyzer settings

Syntax

Use this command to configure a FortiAnalyzer remote server which will receive syslogs. FortiNDR system will send logs with specified type and severity (only for NDR type ) to this remote server.

config system syslog fortianalyzer settings
    set ipaddr <ipv4mask> 
    set port 	<int> 
    set status {enable, disable}
    set type 	{event, malware, ndr}
    set ndr-severity {low, medium, high, critical}
end

Variable	Description	Default
`Name <string>`	Profile name
`ipaddr <ipv4mask>`	The IP address of the remote server. Only IPv4 is supported.	`0.0.0.0`
`port <int>`	The port number of the remote server for syslog services.	`514`
`status {enable, disable}`	Enable or disable sending logs to this remote server.	`disable`
`type {event, malware, ndr}`	FortiNDR supports three types of logs: `event`, `malware` and `ndr`. Multiple choices are supported.	`event`, `malware`, `ndr`
`ndr-severity {low, medium, high, critical}`	Filtering by severity is supported for sending `ndr` type log,. The supported multiple choices are `low`, `medium`, `high` and `critical`.	`low`, `medium`, `high`, `critical`

config system syslog fortianalyzer settings

Syntax

Use this command to configure a FortiAnalyzer remote server which will receive syslogs. FortiNDR system will send logs with specified type and severity (only for NDR type ) to this remote server.

config system syslog fortianalyzer settings set ipaddr <ipv4mask> set port <int> set status {enable, disable} set type {event, malware, ndr} set ndr-severity {low, medium, high, critical} end

Variable

Description

Default

Name <string>

Profile name

ipaddr <ipv4mask>

The IP address of the remote server. Only IPv4 is supported.

0.0.0.0

port <int>

The port number of the remote server for syslog services.

514

status {enable, disable}

Enable or disable sending logs to this remote server.

disable

type {event, malware, ndr}

FortiNDR supports three types of logs: event, malware and ndr.

Multiple choices are supported.

event, malware, ndr

ndr-severity {low, medium, high, critical}

Filtering by severity is supported for sending ndr type log,. The supported multiple choices are low, medium, high and critical.

low, medium, high, critical

CLI reference

config system syslog fortianalyzer settings