config system syslog1 settings

Use this command to configure a general remote server which can receive syslogs. FortiNDR system will send logs with specified type and severity (only for ndr type) to this remote server.

Syntax

config system syslog1 settings
    set ipaddr <ipv4mask> 
    set port 	<int> 
    set status {enable, disable}
    set type 	{event, malware, ndr}
    set ndr-severity {low, medium, high, critical}
end

Variable	Description	Default
`Name <string>`	Profile name
`ipaddr <ipv4mask>`	The IP address of the remote server. Only IPv4 is supported.	`0.0.0.0`
`port <int>`	The port number of the remote server for syslog services.	`514`
`status {enable, disable}`	Enable or disable sending logs to this remote server.	`disable`
`type {event, malware, ndr}`	FortiNDR supports three types of logs: `event`, `malware` and `ndr`. Multiple choices are supported.	`event`, `malware`, `ndr`
`ndr-severity {low, medium, high, critical}`	Filtering by severity is supported when sending `ndr` logs. The supported multiple choices are `low`, `medium`, `high` and `critical`.	`low`, `medium`, `high`, `critical`

config system syslog1 settings

Use this command to configure a general remote server which can receive syslogs. FortiNDR system will send logs with specified type and severity (only for ndr type) to this remote server.

Syntax

config system syslog1 settings set ipaddr <ipv4mask> set port <int> set status {enable, disable} set type {event, malware, ndr} set ndr-severity {low, medium, high, critical} end

Variable

Description

Default

Name <string>

Profile name

ipaddr <ipv4mask>

The IP address of the remote server. Only IPv4 is supported.

0.0.0.0

port <int>

The port number of the remote server for syslog services.

514

status {enable, disable}

Enable or disable sending logs to this remote server.

disable

type {event, malware, ndr}

FortiNDR supports three types of logs: event, malware and ndr.

Multiple choices are supported.

event, malware, ndr

ndr-severity {low, medium, high, critical}

Filtering by severity is supported when sending ndr logs. The supported multiple choices are low, medium, high and critical.

low, medium, high, critical

CLI reference

config system syslog1 settings