找出 config.yaml 檔案。通常位於 Linux 的 /etc/bindplane-agent/ 目錄，或 Windows 的安裝目錄。
使用文字編輯器 (例如 nano、vi 或記事本) 開啟檔案。
按照下列方式編輯 config.yaml 檔案：
```yamlreceivers:udplog:# Replace the port and IP address as requiredlisten_address:"0.0.0.0:5252"exporters:chronicle/chronicle_w_labels:compression:gzip# Adjust the path to the credentials file you downloaded in Step 1creds:'/path/to/ingestion-authentication-file.json'# Replace with your actual customer ID from Step 2customer_id:<customer_id>
endpoint:malachiteingestion-pa.googleapis.com# Add optional ingestion labels for better organizationingestion_labels:log_type:SYSLOGnamespace:fortinet_fortimailraw_log_field:bodyservice:pipelines:logs/source0__chronicle_w_labels-0:receivers:-udplogexporters:-chronicle/chronicle_w_labels```
視基礎架構需求，替換通訊埠和 IP 位址。
將 <customer_id> 替換為實際的客戶 ID。
將 /path/to/ingestion-authentication-file.json 更新為「取得 Google SecOps 擷取驗證檔案」一節中儲存驗證檔案的路徑。
重新啟動 Bindplane 代理程式，以套用變更
如要在 Linux 中重新啟動 Bindplane 代理程式，請執行下列指令：
sudosystemctlrestartbindplane-agent
如要在 Windows 中重新啟動 Bindplane 代理程式，可以使用「服務」控制台，或輸入下列指令：
net stop BindPlaneAgent && net start BindPlaneAgent
設定 Fortinet FortiMail 系統記錄檔
登入 FortiMail 裝置網頁介面。
依序選取「記錄和報告」>「記錄設定」>「遠端」。
按一下「新增」建立新項目。
在隨即顯示的對話方塊中，選取「啟用」，允許記錄至遠端主機。
請提供下列詳細資料：
名稱：輸入不重複且有意義的名稱。
伺服器名稱/IP：輸入 Bindplane IP 位址。
伺服器通訊埠：輸入 Bindplane UDP 通訊埠號碼。
等級：選取「資訊」做為嚴重性等級。
設施：輸入不重複的設施 ID，並確認沒有其他網路裝置使用相同的設施 ID。
取消選取 CSV 格式。
記錄通訊協定：選取「系統記錄檔」。
記錄政策設定：啟用轉送所有類型的事件或記錄。
點選「建立」。
UDM 對應表
記錄欄位
UDM 對應
邏輯
authid
read_only_udm.target.user.email_addresses
如果 authid 欄位包含 @，則對應至這個欄位
authid
read_only_udm.target.user.userid
將「authid」欄位對應至這個欄位
密碼
read_only_udm.network.tls.cipher
將「cipher」欄位對應至這個欄位
client_ip
read_only_udm.principal.ip
將「client_ip」欄位對應至這個欄位
client_name
read_only_udm.principal.hostname
將「client_name」欄位對應至這個欄位
詳細資料
read_only_udm.security_result.summary
將「detail」欄位對應至這個欄位
device_id
read_only_udm.principal.resource.id
將「device_id」欄位對應至這個欄位
devname
read_only_udm.principal.resource.name
將「devname」欄位對應至這個欄位
方向
read_only_udm.network.direction
如果 direction 欄位等於 out，則對應值為 OUTBOUND；如果 direction 欄位等於 in，則對應值為 INBOUND；否則對應值為 UNKNOWN_DIRECTION
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-10 (世界標準時間)。"],[[["\u003cp\u003eThis guide outlines how to collect Fortinet FortiMail logs and send them to Google Security Operations (SecOps) using the Bindplane agent.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves installing the Bindplane agent on either a Windows or Linux host, configuring it to receive Syslog data, and sending it to Google SecOps.\u003c/p\u003e\n"],["\u003cp\u003eBefore beginning, you'll need a Google SecOps instance, an ingestion authentication file, and your customer ID from the SecOps console.\u003c/p\u003e\n"],["\u003cp\u003eThe collected FortiMail logs are parsed and mapped to Google SecOps' Unified Data Model (UDM), extracting key-value pairs and normalizing fields like timestamps, IP addresses, and event types.\u003c/p\u003e\n"],["\u003cp\u003eProperly configuring FortiMail to send logs via Syslog to the Bindplane agent, including setting the correct IP address, port, severity level, and facility, is essential.\u003c/p\u003e\n"]]],[],null,["# Collect Fortinet FortiMail logs\n===============================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to collect Fortinet FortiMail logs by using Bindplane. The parser extracts key-value pairs, normalizes various fields like timestamps and IP addresses, and maps them into a unified data model (UDM) for Google Security Operations, categorizing the event type based on the available information.\n\nBefore you begin\n----------------\n\n- Ensure that you have a Google Security Operations instance.\n- Ensure that you are using Windows 2016 or later, or a Linux host with `systemd`.\n- If running behind a proxy, ensure firewall [ports](/chronicle/docs/ingestion/use-bindplane-agent#verify_the_firewall_configuration) are open.\n- Ensure that you have privileged access to Fortinet Fortimail.\n\nGet Google SecOps ingestion authentication file\n-----------------------------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Collection Agents**.\n3. Download the **Ingestion Authentication File**. Save the file securely on the system where Bindplane will be installed.\n\nGet Google SecOps customer ID\n-----------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Profile**.\n3. Copy and save the **Customer ID** from the **Organization Details** section.\n\nInstall the Bindplane agent\n---------------------------\n\n### Windows installation\n\n1. Open the **Command Prompt** or **PowerShell** as an administrator.\n2. Run the following command:\n\n msiexec /i \"https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi\" /quiet\n\n### Linux installation\n\n1. Open a terminal with root or sudo privileges.\n2. Run the following command:\n\n sudo sh -c \"$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)\" install_unix.sh\n\n### Additional installation resources\n\n- For additional installation options, consult this [installation guide](/chronicle/docs/ingestion/use-bindplane-agent#install_the_bindplane_agent).\n\nConfigure the Bindplane agent to ingest Syslog and send to Google SecOps\n------------------------------------------------------------------------\n\n1. Access the configuration file:\n\n 1. Locate the `config.yaml` file. Typically, it's in the `/etc/bindplane-agent/` directory on Linux or in the installation directory on Windows.\n 2. Open the file using a text editor (for example, `nano`, `vi`, or Notepad).\n2. Edit the `config.yaml` file as follows:\n\n ```yaml\n receivers:\n udplog:\n # Replace the port and IP address as required\n listen_address: \"0.0.0.0:5252\"\n\n exporters:\n chronicle/chronicle_w_labels:\n compression: gzip\n # Adjust the path to the credentials file you downloaded in Step 1\n creds: '/path/to/ingestion-authentication-file.json'\n # Replace with your actual customer ID from Step 2\n customer_id: \u003ccustomer_id\u003e\n endpoint: malachiteingestion-pa.googleapis.com\n # Add optional ingestion labels for better organization\n ingestion_labels:\n log_type: SYSLOG\n namespace: fortinet_fortimail\n raw_log_field: body\n\n service:\n pipelines:\n logs/source0__chronicle_w_labels-0:\n receivers:\n - udplog\n exporters:\n - chronicle/chronicle_w_labels\n ```\n\n3. Replace the port and IP address as required in your infrastructure.\n\n4. Replace `\u003ccustomer_id\u003e` with the actual customer ID.\n\n5. Update `/path/to/ingestion-authentication-file.json` to the path where the authentication file was saved in the\n [Get Google SecOps ingestion authentication file](/chronicle/docs/ingestion/default-parsers/fortinet-fm#get-auth-file) section.\n\nRestart the Bindplane agent to apply the changes\n------------------------------------------------\n\n- To restart the Bindplane agent in Linux, run the following command:\n\n sudo systemctl restart bindplane-agent\n\n- To restart the Bindplane agent in Windows, you can either use the **Services** console or enter the following command:\n\n net stop BindPlaneAgent && net start BindPlaneAgent\n\nConfigure Fortinet FortiMail syslog\n-----------------------------------\n\n1. Sign in to the FortiMail device web interface.\n2. Select **Log \\& Report \\\u003e Log Settings \\\u003e Remote**.\n3. Click **New** to create a new entry.\n4. In a dialog that appears, select **Enable** to allow logging to a remote host.\n5. Provide the following details:\n - **Name**: enter a unique and meaningful name.\n - **Server name/IP** : enter the **Bindplane** IP address.\n - **Server port** : enter the **Bindplane** UDP port number.\n - **Level** : select **Information** as severity level.\n - **Facility**: enter a unique facility identifier and verify that no other network devices use the same facility identifier.\n - Deselect CSV format.\n - **Log protocol** : select **Syslog**.\n - **Logging policy configuration**: enable all types of events or logs to be forwarded.\n6. Click **Create**.\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
