bridgecrew/syslog-integration repository overview

⁠docker-syslog-integration

The docker contains a running logstash agent. The docker is collecting data from Fortigate firwall (using syslog) and sends the log data to Bridgecrew cloud in an encrypted secured manner.

⁠Fortigate

The installation includes 2 steps:

1. Fortigate syslog configuration
2. Installing the syslog integration docker

⁠1. Fortigate syslog configuration

connect to fortigate console and run the following command:

config log syslogd setting
  set status enable
  set server [IP of the server with the docker]
  set reliable UDP
  set port 9910
  set csv enable
  set facility local7
end

⁠2. Install the syslog integration docker

⁠Port verification

The port 9910 (UDP) must be open to the fortigate host (listening port).
Verify that iptables is configured to allow incoming traffic on port 9910.

⁠Installation

1. ssh into a server where the logstash-docker should be deployed
2. Install docker
3. Verify docker by running the following command: docker info
4. Run syslog-integration docker by executing:

docker run -d -p 9910:9910/udp -e BC_CUSTOMER_NAME=[REPLACE_WITH_CUSTOMER_NAME] -e BC_API_TOKEN=[REPLACE_WITH_API_TOKEN] -e BC_URL="https://www.bridgecrew.cloud/api/v1/integrations/logstash" bridgecrew/syslog-integration

The server needs to be able to connect our DNS (https://www.bridgecrew.cloud⁠) with 443 port.
AWS Regions and IP Address Ranges⁠ . (us-west-2: 54.70.204.128/27)