# Fortigate not listed under "Network events" in Security

**URL:** <https://discuss.elastic.co/t/fortigate-not-listed-under-network-events-in-security/379754>\
**Category:** SIEM\
**Created:** [July 3, 2025, 10:49am UTC](https://discuss.elastic.co/t/fortigate-not-listed-under-network-events-in-security/379754 "2025-07-03T10:49:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [July 3, 2025, 10:49am UTC](https://discuss.elastic.co/t/fortigate-not-listed-under-network-events-in-security/379754/1 "2025-07-03T10:49:37Z")

</div>

Hi,

I'm wondering why Fortigate is not listed under the "Network events" pane in Security overview dashboard? Including screenshot for reference.

Fortigate is an integration available to add, so I think it should be listed.

I did dig throught the code and found it's missing : [kibana/x-pack/solutions/security/plugins/security\_solution/common/search\_strategy/security\_solution/network/overview/index.ts at 2ca700ab74545de98bb9df845c722d3ebe474573 · elastic/kibana · GitHub](https://github.com/elastic/kibana/blob/2ca700ab74545de98bb9df845c722d3ebe474573/x-pack/solutions/security/plugins/security_solution/common/search_strategy/security_solution/network/overview/index.ts#L11)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb9781fb6bf40603e451d8ae99d5995e4bf83785.png)

---

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [July 20, 2025, 5:27pm UTC](https://discuss.elastic.co/t/fortigate-not-listed-under-network-events-in-security/379754/2 "2025-07-20T17:27:31Z")

</div>

Anyone?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 20, 2025, 8:58pm UTC](https://discuss.elastic.co/t/fortigate-not-listed-under-network-events-in-security/379754/3 "2025-07-20T20:58:52Z")

</div>

@dot-mike

I pinged internal. See if anybody comes back

---

<div class="post-metadata">

**Author:** ![Mark\_Hopkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_hopkin/32/92593_2.png) [@Mark\_Hopkin](https://discuss.elastic.co/u/Mark_Hopkin)\
**Post date:** [July 24, 2025, 10:57am UTC](https://discuss.elastic.co/t/fortigate-not-listed-under-network-events-in-security/379754/4 "2025-07-24T10:57:16Z")

</div>

hi @dot-mike, I think we would broaden it out to all Fortinet data instead of Fortigate. I was looking at our integration data streams and they all seem to set `observer.vendor` to "Fortinet", so maybe that is the filter we could use to get the count.

If you have some data locally maybe you could confirm this filter brings back the expected count?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2025, 10:57am UTC](https://discuss.elastic.co/t/fortigate-not-listed-under-network-events-in-security/379754/5 "2025-08-21T10:57:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.