Skip to content

Installation

Let's get this party started! 🤩

FortiDragon uses a modular architecture where each layer is independent. Choose the technologies that best fit your needs.

Installation Flow

Follow these steps in order:

  1. Configure Data Sources - Set up your firewall to send logs
  2. Install Ingestion Layer - Deploy Vector to collect and process logs
  3. Set Up Storage - Choose Victoria Logs or Elasticsearch
  4. Configure Visualization - Import dashboards in Grafana or Kibana

1. Data Sources

Platform Status Guide
Fortigate ✅ Fully Supported → Setup Guide
FortiEDR ✅ Supported → Setup Guide
FortiMail ✅ Supported → Setup Guide
FortiWeb / FortiAppSec ✅ Supported → Setup Guide
Palo Alto PAN-OS ✅ Fully Supported → Setup Guide

Next: After configuring your firewall, proceed to install the ingestion layer.

2. Ingestion

The ingestion layer receives syslog data, parses it, enriches it, and forwards it to storage.

Platform Status Guide
Vector ✅ Recommended → Setup Guide
Logstash ❌ Deprecated → Setup Guide
Elastic Agent ❌ Deprecated → Setup Guide

Chef's Choice

Use Vector

It's fast, flexible, and powerfull.

We've migrated from Logstash and Elastic Agent to Vector.

Next: After installing Vector, set up your storage backend.

3. Storage

Choose where to store your parsed logs for analysis.

Platform Status Guide
Victoria Logs ✅ Recommended → Setup Guide
Elasticsearch 👴🏻 Supported → Setup Guide

Chef's Choice

Use Victoria Logs

It's the sweet spot of simplicity, performance, and query power.

It's actively developed with a great roadmap!

Next: After setting up storage, configure your visualization layer.

4. Visualization

Import pre-built dashboards to start analyzing your firewall logs immediately.

Platform Status Guide
Grafana ✅ Recommended → Setup Guide
Kibana 👴🏻 Supported → Setup Guide

Chef's Choice

Using Victoria Logs? → Use Grafana

Using Elasticsearch? → Use Kibana

Next: Import dashboards and start threat hunting!

Quick Start Paths

Choose your path based on your needs:

Best for: New deployments, maximum performance

  1. Configure Fortigate → Syslog to Vector
  2. Install Vector → Parse and enrich logs
  3. Install Victoria Logs → Store logs efficiently
  4. Setup Grafana Cloud → Visualize and analyze

Time to first dashboard: ~30 minutes

🏢 Legacy Path - Elasticsearch

Best for: Existing Elasticsearch deployments

  1. Configure Fortigate → Syslog to Vector
  2. Install Vector → Parse and enrich logs
  3. Configure Elasticsearch → Use existing cluster
  4. Setup Kibana → Import dashboards

Time to first dashboard: ~45 minutes

Ready to start? Pick your path above and let's go! 🐉

What You'll Get

After completing installation, you'll have:

  • 📊 Professional Dashboards - Pre-built visualizations for immediate insights
  • 🔍 Deep Visibility - Full parsing of all firewall fields
  • 🎯 User friendly UI - Easy to navigate and consistent UI
  • 🚀 High Performance - Handle massive log volumes
  • 💰 Cost Effective - Free and open source

Need Help?