--- title: "Fortinet Firewall" slug: "fortinet-firewall" updated: 2026-08-25T15:33:21Z published: 2026-08-25T15:33:21Z canonical: "docs.databee.buzz/fortinet-firewall" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt > Use this file to discover all available pages before exploring further. # Fortinet Firewall Fortinet FortiGate Firewall is a next-generation firewall (NGFW) that provides network security, threat prevention, and secure connectivity for organizations of all sizes. For detailed information refer to the Fortinet Firewall’s official [documentation](https://www.fortinet.com/products/next-generation-firewall). **Integration** **Method**: Data Collector (Syslog) **Tables**: Detection Finding (2004), Network Activity (4001), HTTP Activity (4002), Authentication (3002) This integration supports the following events. | **Event** | **Description** | | --- | --- | | Application Control | Logs application signatures detected on the network, recording the application identity, risk level, and whether the traffic was allowed or blocked based on policy. | | IPS | Logs intrusion prevention signature matches, capturing detected attack patterns, exploits, or anomalous network behavior with the associated severity and action taken. | | Virus | Logs file-based threat detections, including infected files identified by the AV engine and files blocked by the Virus Outbreak Prevention service. | | WAF | Logs web application firewall events for inbound HTTP/HTTPS traffic, covering signature-based attack detections and HTTP constraint violations on requests and responses. | | Web Filter | Logs URL and domain categorization decisions, recording whether web access was allowed or blocked based on FortiGuard category ratings. | | Traffic | Logs network session flow records for forward, local, multicast, and sniffer traffic, capturing session details such as source/destination, protocol, bytes transferred, and final action. | | Authentication | Logs user authentication lifecycle events including successful logins, logouts, authentication timeouts, and admin session activity. | This integration supports the following versions. | FortiOS Version | v7.4.11 | | --- | --- | # Prerequisites - The user should have access to the Fortinet Firewall portal. - The user should have admin access to the Fortinet Firewall to update the Log Setting. - The user should have access to the DataBee console. # Configuration overview 1. Install Data Collector on a VM. 2. Update Log Setting to forward logs to syslog server. 3. [Add the Fortinet Firewall in the DataBee console.](/docs/fortinet-firewall#_DataBee_Configuration) # Install Data Collector on a VM 1. To install a Data Collector on any VM, follow this [documentation](https://docs.databee.buzz/docs/data-collector). Where all the guidelines are mentioned about the Data Collector. 2. Note the IP of the VM on which Data collector is installed. # Fortinet Firewall Configuration for Log Settings 1. Login to your Fortinet portal. 2. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/fortinet1.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A11Z&se=2026-10-30T13%3A20%3A11Z&sr=c&sp=r&sig=UcEFWBa2Pxh1OwSQQ5BsFxIa6FgAaEYUCuolT2N%2BJEU%3D)Navigate to **Log & Report** > **Log Settings** 3. Make sure the below log settings are configured 1. Select **Event logging** and **local traffic logging** as per the requirements 2. Make sure **System logging** is **Enable** 3. Enter the [**IP address of the VM**](/docs/fortinet-firewall#vm_ip) on which Data Collector is installed 4. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/fortinet2(1).png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A11Z&se=2026-10-30T13%3A20%3A11Z&sr=c&sp=r&sig=UcEFWBa2Pxh1OwSQQ5BsFxIa6FgAaEYUCuolT2N%2BJEU%3D)Click on the Apply button 5. Navigate to **Policy & Objects > Firewall Policy** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/fortinet3.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A11Z&se=2026-10-30T13%3A20%3A11Z&sr=c&sp=r&sig=UcEFWBa2Pxh1OwSQQ5BsFxIa6FgAaEYUCuolT2N%2BJEU%3D) 6. Check Security Profiles are applied to your policies and make sure required profiles are enabled. Make sure **Log allowed traffic** option is enabled. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/fortinet4.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A11Z&se=2026-10-30T13%3A20%3A11Z&sr=c&sp=r&sig=UcEFWBa2Pxh1OwSQQ5BsFxIa6FgAaEYUCuolT2N%2BJEU%3D) # DataBee Configuration 1. Login to the DataBee UI, navigate to **Data > Data Feeds** and click the **Add New Data Feed** button. 2. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/fortinet-d1.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A11Z&se=2026-10-30T13%3A20%3A11Z&sr=c&sp=r&sig=UcEFWBa2Pxh1OwSQQ5BsFxIa6FgAaEYUCuolT2N%2BJEU%3D)Search for **Fortinet Firewall** and click on it as shown below.![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/fortinet-d2.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A11Z&se=2026-10-30T13%3A20%3A11Z&sr=c&sp=r&sig=UcEFWBa2Pxh1OwSQQ5BsFxIa6FgAaEYUCuolT2N%2BJEU%3D) 3. Click on the **Data Collector** collection method![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/fortinet-d3.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A11Z&se=2026-10-30T13%3A20%3A11Z&sr=c&sp=r&sig=UcEFWBa2Pxh1OwSQQ5BsFxIa6FgAaEYUCuolT2N%2BJEU%3D) 4. Click on the **Syslog** method.![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/fortinet-d4.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A11Z&se=2026-10-30T13%3A20%3A11Z&sr=c&sp=r&sig=UcEFWBa2Pxh1OwSQQ5BsFxIa6FgAaEYUCuolT2N%2BJEU%3D) 5. In configuration, enter feed contact information, and select the Data Collector.![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/fortinet-d5.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A11Z&se=2026-10-30T13%3A20%3A11Z&sr=c&sp=r&sig=UcEFWBa2Pxh1OwSQQ5BsFxIa6FgAaEYUCuolT2N%2BJEU%3D) 6. Confirm the following details: 1. **Format:** syslog-rfc5424 2. **Mode:** UDP 3. **Port**: 514![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/fortinet-d6.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A20%3A11Z&se=2026-10-30T13%3A20%3A11Z&sr=c&sp=r&sig=UcEFWBa2Pxh1OwSQQ5BsFxIa6FgAaEYUCuolT2N%2BJEU%3D) 7. Click **Submit**. # Troubleshooting Tips - If you are not able to see data being ingested, make sure data collector is installed successfully and IP of that VM is set in the Log Settings of the Fortinet Firewall. Make sure required security profiles are enabled, and Log allowed traffic is allowed. #