How to integrate FortiGate logs with Microsoft Sentinel – leverage Log Forwarder + AMA

1. Benefits of integrating FortiGate with Sentinel

• Unified security logs – centralize logs across multiple devices for more accurate threat analysis
• Real-time monitoring – Enforce Microsoft Sentinel rules to enhance threat detection
• Automated incident response – Automate incident response with Sentinel playbooks
• Long-term log retention and visualization – Leverage Log Analytics for in-depth analysis

This mechanism reduces the burden on SOC operations while improving security visibility.

2. Composition Overview

To send FortiGate logs to Sentinel, use the following configuration:

1. Output logs in FortiGate → Syslog format
2. Log forwarder (Linux VM) receives → syslogs and forwards them to Microsoft Sentinel using Azure Monitor Agent (AMA)
3. Collect and analyze FortiGate logs via Microsoft Sentinel → Log Analytics

This approach eliminates the need to connect FortiGate directly to Sentinel, providing greater management flexibility.

3. Procedure Details

(1) Preparing the Log Forwarder

First, build a log forwarder (Linux VM) on Azure to receive FortiGate Syslog data.

1. Create a Linux VM in Azure

• OS: Ubuntu 20.04 or RHEL 8 or higher recommended
• Network Settings:
• Open TCP/UDP 514 port to receive syslogs from FortiGate

2. Syslog setup Install the **Syslog server (rsyslog or syslog-ng) on your Linux VM. **

sudo apt update && sudo apt install -y rsyslog

Edit the configuration file /etc/rsyslog.conf and add the following lines:

# Receive Syslog on UDP 514 port
$ModLoad imudp
$UDPServerRun 514

# Save FortiGate logs to a dedicated file
if $fromhost-ip startswith '

<FortiGateのIP>' then /var/log/fortigate.log
& stop

Restart syslog:

sudo systemctl restart rsyslog

(2) Installing Azure Monitor Agent (AMA)

Next, deploy the Azure Monitor Agent (AMA) in the log forwarder to enable FortiGate logs to be sent to Sentinel.

1. Install the Fortinet Solution from the Content Hub

Open the Microsoft Sentinel → Content Hub.
Search for "Fortinet Solution" and install it.
Confirm that the data connector (CEF via AMA) is automatically added.

2. Install the AMA Use **the script provided on the Common Event Format (CEF) via AMA data connector page in Microsoft Sentinel to install the AMA in the log forwarder. **

wget -O ama_installer.py https://aka.ms/AzureMonitorAgentInstall
sudo python3 ama_installer.py

3. Creating Data Collection Rules (DCRs)

• Open Microsoft Sentinel → Data Connector → CEF via AMA
• • Create Data Collection Rule
• Data source: Syslog
• Category: local7
• Log Level: LOG_NOTICE
• Add a log forwarder (Linux VM) to your resources
• Click "Create"

(3) Syslog Settings on the FortiGate Side

Finally, configure the Syslog forwarding in FortiGate.

1. Configure Syslog with FortiGate CLI

config log syslogd setting
set status enable
set server <ログフォワーダーのIPアドレス>
set mode udp
set port 514
set facility local7
set format cef
end

2. Adjust FortiGate log levels

config log syslogd filter
set severity information
set forward-traffic enable
set local-traffic enable
set anomaly enable
end

With this configuration, FortiGate logs are forwarded to the log forwarder in Syslog format and integrated into Microsoft Sentinel through an AMA.

4. Review logs in Sentinel

Once configured, verify that Microsoft Sentinel is collecting logs correctly.

(1) Check the logs with KQL Open the Microsoft Sentinel log query and run the following KQL query:

Syslog
| where Facility == "local7"
| where Hostname contains "FortiGate"
| project TimeGenerated, Hostname, Message
| sort by TimeGenerated desc

(2) Is the checkpoint log forwarder's syslog working correctly if no logs are collected?

tail -f /var/log/fortigate.log

Is the AMA status normal?

systemctl status azuremonitoragent

Is DCR applied?

Heartbeat | where Category == "Syslog"

5. Conclusion

The most efficient way to integrate FortiGate logs with Microsoft Sentinel is to leverage Azure Monitor Agent (AMA) through a log forwarder.

• Syslog sent to Linux log forwarder
• Forwarded to Microsoft Sentinel via Azure Monitor Agent (AMA)
• Leverages KQL queries to monitor threats in real time This reduces the burden of SOC operations while enabling rapid detection and response to threats.

At Colorkrew Security, we offer free consultations with the motto of being close to our customers. If you want to enhance your security monitoring, you should definitely consider Colorkrew Security's SOC services.

</ログフォワーダーのIPアドレス>

</FortiGateのIP>