FortiAnalyzer Log Forwarding into Azure Sentinel

Hello Everyone,

I have FortiAnalyzer setup to forward logs via Syslog into Azure Sentinel.

Works fantastically but I am noticing that the FortiAnalyzer is forwarding a lot of "useless" information as well. For a smaller organization we are ingesting a little over 16gb of logs per day purely from the FortiAnalyzer.

I was hoping that someone would have a similar setup and would be willing to share any filters or exclusions they are using on the Log Forwarding configuration in …

azure cybersecurity fortianalyzer forwarding log sentinel