config system syslog fortianalyzer settings
Syntax
Use this command to configure a FortiAnalyzer remote server which will receive syslogs. FortiNDR system will send logs with specified type and severity (only for NDR type ) to this remote server.
config system syslog fortianalyzer settings
set ipaddr <ipv4mask>
set port <int>
set status {enable, disable}
set type {event, malware, ndr, netflow}
set ndr-severity {low, medium, high, critical}
set protocol {syslog, oftps}
end
|
Variable |
Description |
Default |
|---|---|---|
|
ipaddr <ipv4mask> |
The IP address of the remote server. Only IPv4 is supported. |
0.0.0.0 |
|
port <int> |
The port number of the remote server for syslog services. |
514 |
|
status {enable, disable} |
Enable or disable sending logs to this remote server. |
disable |
|
type {event, malware, ndr, netflow} |
FortiNDR supports three types of logs: Multiple choices are supported. |
event, malware, ndr |
|
ndr-severity {low, medium, high, critical} |
Filtering by severity is supported for sending |
low, medium, high, critical |
|
protocol {syslog, oftps} |
The protocol for connecting to the remote server |
oftps |