Wazuh decider fir Forigate Version 7

[Shenal Perera]

Hi All,

I have a requirement to forward logs from a Fortinet v7.4 firewall. Are the wazuh decoders supported with this version?

Furthermore, let me know the supported FortiGate versions as well

The decoder shows it only supports the below versions. is there any new update which can support version 7

Thank you

[Rolly Davany Mougoue Kakanou]

Hello Shenal and thanks for using wazuh.

In the latest version of wazuh(v4.4.5) FortiOS 7 is unfortunately not listed as part of the supported fortigate versions. Nevertheless depending on the structure of the logs,  you could copy and edit existing decoders and rules for v6.0 to make it match your firewall.

I'll be sending a memo to the core team requesting to include decoder and rules for FortiOS 7.0 in next release.

Regards,

[Shenal Perera]

Hi Rolly,

Thank you very much for the prompt response.

Will it be possible for your team to develop a decoder if I share some raw logs with you?

Thank you

[Rolly Davany Mougoue Kakanou]

Hi Shenal and sorry for the delay. 

Yes that works too. Feel free to share here a sample of your logs and I'll revert to you with a custom decoder and rule.

Regards,

Rolly

[Shenal Perera]

Hi Rolly,

Thanks for the response, Please allow me sometime to grab sample logs for you. 

Thank you