# Vê logs do IPS do firewall foritgate no Kibana **URL:** \ **Category:** Endpoint Security\ **Created:** [June 13, 2023, 7:07pm UTC](https://discuss.elastic.co/t/ve-logs-do-ips-do-firewall-foritgate-no-kibana/335908 "2023-06-13T19:07:38Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Paulo\_Martins\_de\_Sen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulo_martins_de_sen/32/123008_2.png) [@Paulo\_Martins\_de\_Sen](https://discuss.elastic.co/u/Paulo_Martins_de_Sen)\ **Post date:** [June 13, 2023, 7:07pm UTC](https://discuss.elastic.co/t/ve-logs-do-ips-do-firewall-foritgate-no-kibana/335908/1 "2023-06-13T19:07:38Z")
Hello community, I hope everyone is doing well. I have the following scenario, A fortigate(v7) firewall sending the logs to the logstash server and sending the logs back to the elasticsearch server, even calm, I can receive the logs from the firewall. But I can't see the logs referring to the IPS, I noticed that they are not being sent to the logstash server. I already enabled the firewall to send all the logs. Below is a print of the firewall and logstash settings ![Screenshot_3](https://us1.discourse-cdn.com/elastic/original/3X/5/a/5a3286c000a003005720d73259eaed003f894434.png) . ![Screenshot_2](https://us1.discourse-cdn.com/elastic/original/3X/8/6/865e2479014da714021156ecd4252474ec6d8ae5.png) ---
**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\ **Post date:** [June 15, 2023, 1:05pm UTC](https://discuss.elastic.co/t/ve-logs-do-ips-do-firewall-foritgate-no-kibana/335908/2 "2023-06-15T13:05:10Z")
Hi @Paulo_Martins_de_Se1 ! For FORTIGATE log collection, I recommend the Elastic Agent Fortinet integration: > **[Fortinet | Elastic docs](https://docs.elastic.co/en/integrations/fortinet)** > > Deprecated. Collect logs from Fortinet instances with Elastic Agent. In this way, the fields are already normalized for the ECS. Another thing you mentioned is the logs of IPS actions. This information needs to be configured on your equipment when sending the logs. Once everything is well configured, the field that receives this information is fortinet.firewall.attack. Here, I've even created a detection rule to alert you when an IPS rule kicks in. It is also possible to use filebeat to collect logs from FORtinet solutions: > **[Fortinet module | Filebeat Reference \[8.8\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-fortinet.html)** ![fortinet_rule](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc9a017258a4c7477465c8522677f126324c1336.png) ---
**Author:** ![Paulo\_Martins\_de\_Sen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulo_martins_de_sen/32/123008_2.png) [@Paulo\_Martins\_de\_Sen](https://discuss.elastic.co/u/Paulo_Martins_de_Sen)\ **Post date:** [June 15, 2023, 3:03pm UTC](https://discuss.elastic.co/t/ve-logs-do-ips-do-firewall-foritgate-no-kibana/335908/3 "2023-06-15T15:03:28Z")
Hello Wagner, thank you very much for your explanation, it cleared my doubts. About your "Fortinet IPS Detect Attack" rule is it available in version 8.8.1? If not, could you pass the filter you used. Thank you very much in advance. Note: I'm a fan of your linkedin posts on the subject. ---
**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\ **Post date:** [June 15, 2023, 8:23pm UTC](https://discuss.elastic.co/t/ve-logs-do-ips-do-firewall-foritgate-no-kibana/335908/4 "2023-06-15T20:23:16Z")
I'm grateful for the feedback. This filter that I applied to the rule, can be done in version 8.8.1 also provided that this field is being populated when data arrives from your firewall. Anything, call me on Linkedin and we can exchange an idea. ---
**Author:** ![Paulo\_Martins\_de\_Sen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulo_martins_de_sen/32/123008_2.png) [@Paulo\_Martins\_de\_Sen](https://discuss.elastic.co/u/Paulo_Martins_de_Sen)\ **Post date:** [June 15, 2023, 8:38pm UTC](https://discuss.elastic.co/t/ve-logs-do-ips-do-firewall-foritgate-no-kibana/335908/5 "2023-06-15T20:38:15Z")
OK! Thank you so much Wagner. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 13, 2023, 8:39pm UTC](https://discuss.elastic.co/t/ve-logs-do-ips-do-firewall-foritgate-no-kibana/335908/6 "2023-07-13T20:39:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.