You can search data from unsupported devices in FortiSIEM by sending custom event logs.

Can an administrator search for data from an unsupported device if custom event logs are sent to FortiSIEM?

• A. Yes
• B. No

Answer: (A)

An administrator can indeed search for data from an unsupported device if custom event logs are sent to FortiSIEM. This is possible because FortiSIEM is designed to handle logs from a variety of sources, including those that may not have direct or native support within the system. When custom event logs are configured and sent to FortiSIEM, the system can process these logs and store the information in a way that allows for searching and analysis. This capability enhances FortiSIEM's flexibility and usability, enabling organizations to extract valuable insights from a wide range of devices, irrespective of the initial support status. As long as the custom logs are appropriately formatted and transmitted to FortiSIEM, the search functionality remains intact, allowing administrators to leverage the rich data generated even from unsupported devices. This not only improves security visibility but also enables better incident response and compliance monitoring capabilities.

When you’re mapping a network, you quickly realize not every device speaks FortiSIEM fluently. Some gear—old routers, niche sensors, or IoT devices—comes with logs that aren’t native to FortiSIEM. The good news? If you can feed FortiSIEM with properly formatted custom event logs, you can still search, analyze, and act on that data. Yes, administrators can locate information from an unsupported device by sending in custom logs. Here’s how that works and why it matters.

The short answer you’ll likely hear from a seasoned admin: yes. FortiSIEM is built to handle data from a wide range of sources, not just those with built-in integrations. When you send custom event logs in a compatible format, FortiSIEM ingests, indexes, and makes them searchable. That means you don’t lose visibility just because a device isn’t officially supported. You gain insight into whether that device is behaving, where it’s pointing risk, and how it fits into your broader security picture. It’s like adding a new lens to a camera you already trust—the picture becomes clearer, not harder to interpret.

Let me explain what makes this workable in daily practice. FortiSIEM doesn’t rely on a single log source menu; it uses a flexible data model. Logs arrive, they’re parsed, fields are normalized, and the data becomes part of your searchable universe. If you can get the logs to FortiSIEM in a structure it recognizes (even if the device isn’t officially supported), you retain the ability to search across that data set. That’s the core win: breadth of visibility without waiting for a built-in integration.

How custom logs get turned into searchable data

• Forwarding formats matter. FortiSIEM typically accepts logs via standard channels like syslog, or through formats such as JSON or common security log schemas. The better the format, the easier it is to extract meaningful fields (timestamp, device name, event type, IPs, user IDs, etc.).

• Parsing is the bridge. You’ll set up a parsing rule or a small parser so FortiSIEM can recognize the fields you care about. Even if the device’s native logs aren’t in FortiSIEM’s default vocabulary, a well-crafted parser translates them into a consistent schema.

• Normalization and indexing. Once the fields are extracted, FortiSIEM normalizes them so that searches, correlations, and dashboards can compare apples to apples across all sources. The data gets indexed in a way that supports fast, repeatable queries.

• Searching and analyzing. With the logs parsed and indexed, you can run searches, build alerts, or create dashboards just as you would with native sources. The power isn’t limited by the device’s original status; it’s augmented by how well you structure and query the data.

Practical steps you can take (a quick blueprint)

• Define the data source. Tell FortiSIEM where the logs are coming from and what kind of data they contain. This is your first map for the journey.

• Create or adapt a parser. If your logs are JSON, you might specify the fields directly; if they’re a custom text format, you’ll define pattern rules to pull out the right pieces (time, device, event, severity, etc.).

• Standardize essential fields. At minimum, capture a clear timestamp, a device identifier, and an event descriptor. Add IPs, usernames, and severity when possible. Consistency here pays off in later searches.

• Validate timing. Time zones and clock drift happen. Align the log timestamps with your security timeline so investigations stay coherent.

• Test with representative queries. Try finding failed logins from that device, unexpected restarts, or unusual data transfers. If the tests work, you’re in good shape for ongoing monitoring.

• Save and share meaningful views. Build dashboards that show, for example, the volume of custom-logged events over time, correlation with other alerts, or the top sources of custom logs by category.

• Revisit and refine. As you gather more data, you’ll learn which fields matter most for your environment and adjust parsers or queries accordingly.

A few real-world scenarios where this matters

• IoT and industrial devices. Printers, smart thermostats, or field sensors often generate useful security-relevant data, but their logs aren’t always on the radar of standard integrations. Sending those logs into FortiSIEM keeps you from relying on a single choke point for visibility.

• Legacy gear. Older equipment might still be essential for operations, yet its events aren’t in modern formats. A custom log channel—properly parsed—lets you detect anomalies, outages, or misconfigurations without ripping out the device.

• Shadow IT components. If someone plugs in a device that’s not inventoried, you can still capture its activity by forwarding its logs. That data becomes part of your broader risk picture, not a blind spot.

Best practices to keep searches useful and reliable

• Keep log quality high. Ambiguity in fields makes searches noisy. Strive for clean timestamps, stable device identifiers, and consistent event keywords.

• Use consistent naming. Standardize event types and categories in your parsers. A single “login_failure” label across sources is far easier to search than a mix of “auth_fail,” “bad_login,” and “UNAUTHORIZED_LOGIN.”

• Correlate with known signals. When possible, link custom-log events to existing alerts or IOC indicators. Correlation helps you spot patterns that single-source queries miss.

• Create focused dashboards. Start with a few high-value views—time-based trends, top sources of custom logs, and a quick filter for critical events. Expand as you gain confidence.

• Pay attention to security in transit. Use secure channels for log forwarding, and manage access to the parsing rules and data sources so only authorized staff can modify them.

• Document your approach. A light-touch reference that lists the devices feeding custom logs, the parser details, and the key fields helps teams onboard quickly and reduces misconfigurations.

Common misconceptions and clarifications

• “If it’s not officially supported, I can’t search it.” Not true. As long as you can feed FortiSIEM logs in a parseable format, you can search that data. The system doesn’t require every device to have a native connector to be valuable.

• “Custom logs will break the system.” With careful parsing and field normalization, custom logs become just another source in your security data lake. The trick is discipline when defining the data you ingest.

• “Custom logs are a maintenance headache.” They can be, if you skip validation or skip updating parsers when log formats change. The key is to treat them as first-class data sources, with regular checks and updates as needed.

A moment for the broader picture

Visibility is the backbone of effective incident response. When you can see data from a wider array of devices, you gain a fuller picture of what’s happening in your environment. It’s not about chasing every single log line; it’s about having the context to connect dots—who, what, where, when, and why. And that context can be the difference between spotting a trend early or reacting after the fact.

If your network includes devices that don’t come with built-in FortiSIEM support, you’re not out of luck. You’re armed with a flexible workflow: forward the logs, parse them correctly, and weave them into your existing searches and dashboards. The result is a more complete security posture, with fewer blind spots and quicker insights when things go off the rails.

A final thought

The beauty of FortiSIEM lies in its adaptability. The moment you treat custom logs as legitimate data streams—worthy of parsing, indexing, and querying—you unlock a richer, more actionable view of your security landscape. It’s a practical reminder that good visibility isn’t limited to the gear that ships with one-click integrations. It grows from well-structured data and thoughtful configuration, day by day.

If you’re overseeing FortiSIEM in a mixed environment, consider starting with a single, high-value custom source. Build a solid parser, validate a handful of essential fields, and create a couple of targeted searches. You’ll likely discover that the overall clarity of your security posture improves faster than you’d expect. And yes, even devices you once considered “unsupported” can become meaningful contributors to your defense strategy.