Fortigate Graylog Centos7

[@LoyisoNicholusGawula89]

in terms of ubuntu are you using the same command line

[@babdianornhi]

in aug 2024 can't use this commandline

[@WisesageGaming]

สอบถามได้ไหมครับ ทำไมต้องลง Rsyslog ด้วยอะครับ ในเมื่อเราจะใช้ Graylog ในการทำงานอยู่แล้ว

[@babdianornhi]

เหมือน graylog จะเป็น interface รับข้อมูลโดยตรงจาก fortigate ไม่ได้หน่ะครับ
เลยต้องลง rsyslog เปิด port 514 รับข้อมูล แล้วให้ graylog เอาไปวิเคราะห์ต่อ

[@MrDoicopaci]

Hello,
Can you post the notepad file you we're watching?
I am interested in the Lookup Tables configuration from the bottom, but also in configuringing from top to bottom the system. Thanks

[@babdianornhi]

I already wrote notepad command in the description.

[@MrDoicopaci]

@@babdianornhi it is true, but you did not put the last part of it.

[@babdianornhi]

---------------- graylog geolocation -------------------
copy file to /etc/graylog/server
- GeoLite2-City.mmdb
- GeoLite2-Country.mmdb
web setting
- system - Lookup Tables
- Data Adapters
- Create data adapter
- Data Adapter type : Geo IP - MaxMind Databases
- title : GeoIP
- Name : geoip
- File Path : /etc/graylog/server/GeoLite2-Country.mmdb
- Database type : Country Database
- Caches
- Create cache
- Cache Type : Node-local, in-memory cache
- Title : GeoIP
- Name : geoip
- MaxEntries : 1000
- Lookup Table
- Create loopup table
- Title : TBGeoIP
- name : tbgeoip
- Data Apadter : GeoIP
- Cache : GeoIP
- system - Configurations
- Message Processors Configuration - update
- Sort
- Pipeline Processor
- Message Filter Chain
- GeoIP Resolver
- AWS Instance Name Lookup
- Disable AWS Instance Name Lookup
- Geo-Location Processor - update
- Enable Geo-Location processor : True
- Dashboards - Create new dashboard
- Createt
- Aggregation - edit
- Visualization Type - WorldMap
- Rows - srcip_geolocation
- Metrics - count(srcip_geolocation)

[@babdianornhi]

It's just guild step, Not command. You can follow the guidelines.

[@dota2jungletips819]

Hi, thanks for video. How make/convert byte to MB like your video? Thanks

[@babdianornhi]

Chart will be convert byte/MB when value many.

[@DixiAlex]

Where did you get json file for content pack end where did you get extractor ?

[@babdianornhi]

github.com/pfitchie/graylog3.Fortigate6xContentPack

[@babdianornhi]

github.com/juiceman84/Fortigate_Content_Pack