# FortiAnalyzer logs to SIEM
**URL:** https://discuss.elastic.co/t/fortianalyzer-logs-to-siem/190801
**Category:** SIEM
**Created:** [July 16, 2019, 5:02pm UTC](https://discuss.elastic.co/t/fortianalyzer-logs-to-siem/190801 "2019-07-16T17:02:16Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@gabrieltavares\_pp](https://discuss.elastic.co/u/gabrieltavares_pp)
#### Post date: [July 16, 2019, 5:02pm UTC](https://discuss.elastic.co/t/fortianalyzer-logs-to-siem/190801/1 "2019-07-16T17:02:16Z")
Hello,
I'm new with ELK and I installed Elasticsearch, Kibana and Logstash in the same server.
I followed this [procedure](https://www.musingitoutloud.com/elasticstack-fortigate-logging/) to send logs from FortiAnalyzer to ELK.
I tried to send logs to SIEM, but I have to setup Beats first. Even with filebeat installed I can't see the logs coming to Beats.
The logs from FortiAnalyzer is coming in the right way, but I don't know how to appear this logs in SIEM side.
Could you help me, please?
---
### Author:  [@adrisr](https://discuss.elastic.co/u/adrisr)
#### Post date: [July 18, 2019, 2:48pm UTC](https://discuss.elastic.co/t/fortianalyzer-logs-to-siem/190801/2 "2019-07-18T14:48:52Z")
Hi @gabrieltavares_pp
In order to be compatible with SIEM, your logs have to be compatible with the Elastic Common Schema (ECS). See [the introductory blog post](https://www.elastic.co/blog/introducing-the-elastic-common-schema) and [official spec.](https://www.elastic.co/blog/introducing-the-elastic-common-schema)
The setup described by the link you shared is unnecessarily complicated in that it involves Logstash to mutate the logs. In developing SIEM integrations we have taken the path of using ingest node and Beats processors.
I suggest you have a look at [any of our vendor-specific modules](https://github.com/elastic/beats/tree/master/x-pack/filebeat/module) (cisco ASA, PAN-OS, Zeek, etc.). It'll be easier to use one of them as a base to develop a new module. They're good examples for parsing logs in ingest node and populating ECS fields.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 15, 2019, 2:48pm UTC](https://discuss.elastic.co/t/fortianalyzer-logs-to-siem/190801/3 "2019-08-15T14:48:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.