FortiAnalyzer Cloud Limitation for Red Canary

Customer unable to find or enable FortiAnalyzer integration in Red Canary; existing FortiAnalyzer Cloud instance does not forward logs. Customer confirmed with Fortinet Support that log forwarding is not supported in FortiAnalyzer Cloud. Unable to aggregate multiple FortiGate firewalls through FortiAnalyzer for Red Canary log ingestion.

Cause

FortiAnalyzer Cloud does not support log forwarding, preventing it from serving as a centralized source for FortiGate logs to Red Canary.

Resolution

To ingest FortiGate firewall logs into Red Canary without FortiAnalyzer log forwarding:

1. For each FortiGate firewall, configure direct log forwarding to Red Canary via secure syslog.
2. Follow steps outlined in the integration guide: https://docs.redcanary.com/docs/integrate-fortinet-fortigate-with-red-canary
3. Repeat the integration process for each individual FortiGate firewall.
4. Confirm outgoing syslog traffic from each FortiGate is targeting Red Canary's collector IP .
5. Verify connectivity and alert ingestion in the Red Canary console after configuration.

Keywords

FortiAnalyzer Cloud log forwarding not supported, FortiGate individual integration Red Canary, Fortinet firewall syslog setup, cannot aggregate firewalls via FortiAnalyzer, Red Canary Fortinet integration steps, FortiAnalyzer integration unavailable, multiple FortiGates Red Canary setup