config system syslog1 settings
Use this command to configure a general remote server which can receive syslogs. FortiNDR system will send logs with specified type and severity (only for ndr type) to this remote server.
Syntax
config system syslog1 settings
set ipaddr <ipv4mask>
set port <int>
set status {enable, disable}
set type {event, malware, ndr, netflow}
set ndr-severity {low, medium, high, critical}
set format {default, cef}
end
|
Variable |
Description |
Default |
|---|---|---|
|
Name <string> |
Profile name |
|
|
ipaddr <ipv4mask> |
The IP address of the remote server. Only IPv4 is supported. |
|
|
port <int> |
The port number of the remote server for syslog services. |
|
|
status {enable, disable} |
Enable or disable sending logs to this remote server. |
|
|
type {event, malware, ndr, netflow} |
FortiNDR supports three types of logs: Multiple choices are supported. |
|
|
ndr-severity {low, medium, high, critical} |
Filtering by severity is supported when sending |
|
|
Format {default, cef} |
Log format: default is the syslog format, cef is the CEF (Common Event Format) format. |
|