Detections
Analytics

7.3.1 Centralized Logging and Reporting

Information

Device logs should be sent to a centralized device for log collection, retention, and reporting. This could be a SIEM. syslog device, FortiAnalyzer, FortiManager, etc.

Centralized logging allows for more reliable log retention and more enriched log data for review and reporting.

Solution

Configure a remote server for logs to be sent to:

1. Go to Log & Report > Log Settings.
2. Under "Syslog logging" configure a remote server to send logs to.

See Also

https://workbench.cisecurity.org/benchmarks/15284

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-1, 800-53|AU-2, 800-53|AU-6(3), CSCv7|6.3, CSCv7|8.6

Plugin: FortiGate

Control ID: 1b77e5246339e0695ce3358a2377fa85c41b6ae355bc5421ce4db2461a8e2ac4