Collect Fortinet FortiClient logs

This document explains how to ingest Fortinet FortiClient logs to Google Security Operations using Bindplane agent.

FortiClient is an endpoint security solution that provides antivirus, web filtering, VPN, vulnerability scanning, and application firewall capabilities for Windows, macOS, Linux, and Chromebook endpoints. FortiClient is centrally managed through FortiClient EMS (Endpoint Management Server), which pushes security policies and configuration profiles to endpoints.

Before you begin

Ensure that you have the following prerequisites:

• A Google SecOps instance
• Windows Server 2016 or later, or Linux host with systemd
• Network connectivity between Bindplane agent and FortiClient endpoints
• If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
• Privileged access to the FortiClient EMS management console
• FortiClient EMS version 7.0 or later with licensed FortiClient endpoints

Get Google SecOps ingestion authentication file

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Collection Agent.
3. Click Downloadto download the ingestion authentication file.

4. Save the file securely on the system where Bindplane agent will be installed.

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.

3. Copy and save the Customer IDfrom the Organization Detailssection.

Install Bindplane agent

Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

Windows installation

1. Open Command Promptor PowerShellas an administrator.

2. Run the following command:

     msiexec 
     
    / 
    i 
     
    "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" 
     
    / 
    quiet 
    
   

3. Wait for the installation to complete.

4. Verify the installation by running:

    sc query observiq-otel-collector 
   

The service should show as RUNNING.

Linux installation

1. Open a terminal with root or sudo privileges.

2. Run the following command:

    sudo  
   sh  
   -c  
    " 
    $( 
   curl  
   -fsSlL  
   https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh ) 
    " 
     
   install_unix.sh 
   

3. Wait for the installation to complete.

4. Verify the installation by running:

    sudo  
   systemctl  
   status  
   observiq-otel-collector 
   

The service should show as active (running).

Additional installation resources

For additional installation options and troubleshooting, see Bindplane agent installation guide .

Configure Bindplane agent to ingest syslog and send to Google SecOps

Locate the configuration file

Linux:

 sudo  
nano  
/etc/bindplane-agent/config.yaml 

Windows:

 notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml" 

Edit the configuration file

Replace the entire contents of config.yaml with the following configuration:

  receivers 
 : 
  
 udplog 
 : 
  
 listen_address 
 : 
  
 "0.0.0.0:514" 
 exporters 
 : 
  
 chronicle/forticlient 
 : 
  
 compression 
 : 
  
 gzip 
  
 creds_file_path 
 : 
  
 '/etc/bindplane-agent/ingestion-auth.json' 
  
 customer_id 
 : 
  
 'your-customer-id-here' 
  
 endpoint 
 : 
  
 malachiteingestion-pa.googleapis.com 
  
 log_type 
 : 
  
 FORTINET_FORTICLIENT 
  
 raw_log_field 
 : 
  
 body 
  
 ingestion_labels 
 : 
  
 env 
 : 
  
 production 
  
 source 
 : 
  
 forticlient 
 service 
 : 
  
 pipelines 
 : 
  
 logs/forticlient_to_chronicle 
 : 
  
 receivers 
 : 
  
 - 
  
 udplog 
  
 exporters 
 : 
  
 - 
  
 chronicle/forticlient 
 

Configuration parameters

Replace the following placeholders:

Receiver configuration:

• listen_address : IP address and port to listen on. Use 0.0.0.0:514 to listen on all interfaces on port 514.

Exporter configuration:

• creds_file_path : Full path to ingestion authentication file:
  • Linux: /etc/bindplane-agent/ingestion-auth.json
  • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
• customer_id : Customer ID from the Google SecOps console
• endpoint : Regional endpoint URL:
  • US: malachiteingestion-pa.googleapis.com
  • Europe: europe-malachiteingestion-pa.googleapis.com
  • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
  • See Regional Endpoints for complete list
• log_type : FORTINET_FORTICLIENT
• ingestion_labels : Optional labels in YAML format

Save the configuration file

After editing, save the file:

• Linux: Press Ctrl+O , then Enter , then Ctrl+X
• Windows: Click File > Save

Restart Bindplane agent to apply the changes

• Linux

   sudo  
  systemctl  
  restart  
  observiq-otel-collector 
  

  1. Verify the service is running:

      sudo  
     systemctl  
     status  
     observiq-otel-collector 
     

  2. Check logs for errors:

      sudo  
     journalctl  
     -u  
     observiq-otel-collector  
     -f 
     

• Windows

  Choose one of the following options:

  • Using Command Prompt or PowerShell as administrator:

     net stop observiq-otel-collector && net start observiq-otel-collector 
    

  • Using Services console:

    1. Press Win+R , type services.msc , and press Enter.
    2. Locate observIQ OpenTelemetry Collector.

    3. Right-click and select Restart.

    4. Verify the service is running:

        sc query observiq-otel-collector 
       

    5. Check logs for errors:

         type 
         
        "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log" 
        
       

Configure FortiClient endpoint logging to send logs to Bindplane agent

FortiClient endpoint logging is configured centrally through FortiClient EMS by editing endpoint profiles with XML configuration. EMS pushes the logging configuration to FortiClient endpoints, which then send logs directly to the Bindplane agent syslog listener.

Sign in to FortiClient EMS

1. Sign in to the FortiClient EMS web console.
2. Go to Endpoint Profiles > Manage Profiles.

Edit or create an endpoint profile

1. Select an existing profile to edit, or click Addto create a new profile.
2. In the Profile Namefield, enter a descriptive name (for example, Chronicle-Logging-Profile ).
3. Click Advanced.
4. Click the XML Configurationtab.
5. Click Edit.

Configure remote logging in XML

EMS displays two panes. Use the pane on the right to edit the XML configuration.

Locate the <log_settings> section within <system> . If it does not exist, add it. Within <log_settings> , locate or add the <remote_logging> section and configure it as follows:

 <forticlient_configuration>  
<system>  
<log_settings>  
<onnet_local_logging>1</onnet_local_logging>  
<level>6</level>  
<log_events>ipsecvpn,sslvpn,scheduler,update,firewall,av,proxy,shield,webfilter,endpoint,fssoma,configd,vuln,sandboxing,antiexploit</log_events>  
<remote_logging>  
<log_upload_enabled>1</log_upload_enabled>  
<log_protocol>syslog</log_protocol>  
<netlog_server>192.168.1.100</netlog_server>  
<netlog_categories>7</netlog_categories>  
<log_upload_freq_minutes>5</log_upload_freq_minutes>  
</remote_logging>  
</log_settings>  
</system>
</forticlient_configuration> 

Configuration parameters:

• <log_upload_enabled> : Set to 1 to enable remote logging.
• <log_protocol> : Set to syslog to send logs to a syslog server. Use faz to send logs to FortiAnalyzer instead.
• <netlog_server> : Enter the IP address of the Bindplane agent host (for example, 192.168.1.100 ). This parameter is used only when <log_protocol> is set to syslog .
• <netlog_categories> : Enter the bitmask of log categories to upload:
  • 1 = Traffic logs
  • 2 = Vulnerability logs
  • 4 = Event logs
  • 7 = All categories (1 + 2 + 4)
• <log_upload_freq_minutes> : Enter the log upload frequency in minutes (for example, 5 for every 5 minutes).
• <level> : FortiClient logging level. Enter one of the following:
  • 0 = Emergency
  • 1 = Alert
  • 2 = Critical
  • 3 = Error
  • 4 = Warning
  • 5 = Notification
  • 6 = Information (recommended)
  • 7 = Debug

• <log_events> : Comma-separated list of FortiClient events or processes to log. Include the events you want to capture (for example, ipsecvpn,sslvpn,firewall,av,webfilter,endpoint ).

Save the profile

1. Click Test XMLto validate the XML configuration.
2. Click Saveto save the profile.

Apply the profile to endpoints

1. Go to Endpoint Policies > Manage Policies.
2. Select an existing policy or click Addto create a new policy.
3. In the Profiledropdown, select the profile you created or edited.
4. In the Endpoint Groupssection, select the endpoint groups to which you want to apply the policy.
5. Click Save.

EMS pushes the profile configuration to endpoints with the next Telemetry communication. FortiClient endpoints will begin sending logs to the Bindplane agent syslog listener.

Verify log forwarding

1. On the Bindplane agent host, check the agent logs to verify that logs are being received:

   Linux:

    sudo  
   journalctl  
   -u  
   observiq-otel-collector  
   -f 
   

   Windows:

     type 
     
    "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log" 
    
   

2. On a FortiClient endpoint, verify that remote logging is enabled by checking the FortiClient logs:

   Windows:

    C:\Program Files\Fortinet\FortiClient\logs\ 
   

   macOS:

    /Library/Application Support/Fortinet/FortiClient/logs/ 
   

   Linux:

     / 
    var 
    / 
    log 
    / 
    forticlient 
    / 
    
   

3. In the Google SecOps console, verify that FortiClient logs are being ingested:

   • Go to Search.
   • Enter a search query for FortiClient logs (for example, metadata.log_type = "FORTINET_FORTICLIENT" ).
   • Verify that logs appear in the search results.

UDM mapping table

Need more help? Get answers from Community members and Google SecOps professionals.