- Configuration of FortiGate Event Downloader Connector.
- Under the connector, go to Ingestion.
- Select FortiGate Event Downloader Connector. Click on Configure.
- Select the Enable FortiGate Firewall Events? as Yes.
- Select the Validate and Save.
- Will receive the Token Copy and Save the token will be required in setting up an ES agent.
- FortiGate Event Downloader Connector System Requirement.
- Linux or Mac machine with Static IP address allocation.
- Assign: RAM: 4 GB or more, CPU: 2 vCPUs or more, Disk: 100 GB or more.
- Curl installed.
- FortiGate ES Agent Installation
- In the prepared, Linux or Mac machine, we are good to install the ES agent.
- Replace with the actual token you saved during connector configuration.
- Then run the command to install:
sudo bash mkdir fortigate_es_agent cd fortigate_es_agent curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.17.9-linux-x86_64.tar.gz tar xzvf elastic-agent-8.17.9-linux-x86_64.tar.gz cd elastic-agent-8.17.9-linux-x86_64 sudo ./elastic-agent install --url=https://elk-next-fleet-1.seqrite.com:443 --insecure --enrollment-token=<Toekn>
- FortiGate Firewall Configuration
- The FortiGate ES agent is up and running.
- Go to FortiGate firewall interface. Go to Logs & Report > Log Settings. Under Global Settings, Enable Address, Event Logging, Local trafic Logging, Syslog Logging. Enter the IP address of the Linux or Mac machine.
- Click on Apply.
- After performing all the above steps, alerts will begin to generate in the XDR portal automatically, indicating successful configuration.
- FortiGate ES Agent Un-installation:
- After deleting the FortiGate Event Downloader connector configuration in the XDR portal, it is necessary to completely uninstall or remove the ES agent from the Linux or macOS system.
- Run the following command to Uninstall or remove the ES agent
sudo bash elastic-agent uninstall rm -rf elastic-agent-8.17.9-linux-x86_64 elastic-agent-8.17.9-linux-x86_64.tar.gz sudo rm -rf /opt/Elastic/Agent sudo rm -rf /etc/elastic-agent sudo rm -rf /var/lib/elastic-agent sudo rm -rf /var/log/elastic-agent Verify it's Gone ps aux | grep elastic-agent sudo systemctl status elastic-agent
