Just want to check with other peers about InsightIDR functionality. IDR do not seem to be able to parse all events that is sent from our Fortinet Firewall (FortiGate) via syslog to it and I have events i would like to create queries and cards for.
Is it correct that I cannot create a query based on raw logs that comes in from the FortiGate for events such as creation or deletion of an admin account or creation of a new firewall policy.
A little bit like what i understand Solarwinds Event Manager can do.
I have used the custom parser tool once before. so would you just extract the fields you want and once that is done i can use this for building queries and cards for dashboards?
Do i have to do the custom parsing tool? If i just go to log search and look under RAW and find my firewall, i can see the entries in a table form. Just in case i dont need to create the custom parsing tool entry
I replied to your thread in the support case you raised, but as you mentioned you see these keys in the table form, therefore you can use key comparison operators to build alerts and dashboards.
