Re: Decoder for Forticlient and FortiEDR

[Kasim Mustapha]

Hello Fidel,

Apologies for the late response.

To address this issue, we recommend creating custom decoders for the EDR and Forticlient logs. 

By creating custom decoders, you can ensure that Wazuh can properly parse and analyze the logs from these sources. 
https://wazuh.com/blog/creating-decoders-and-rules-from-scratch/

https://documentation.wazuh.com/current/user-manual/ruleset/custom.html

If you need assistance in creating custom decoders, please let us know and we will be happy to help.

Regards,

Kasim 

On Tuesday, August 29, 2023 at 9:51:21 AM UTC+1 Fidel wrote:

I'm sending all logs from Fortinet firewalls, EDR and Forticlient through Fortianalyzer but Wazuh only decoders the firewalls logs because there isn't a specific decoder to the others.