---
url: https://docs.realmsec.info/integration/forticlient.md
---

# FortiClient Log Collection Integration

## Configuring FortiClient Integration for Realm Security

Realm Security collects FortiClient logs via FortiAnalyzer. Follow the steps below to configure FortiClient and FortiAnalyzer for log collection.

### Prerequisites

* Administrative access to the FortiClient EMS
* Administrative access to FortiAnalyzer
* Realm Collector is set up and running with a Raw TCP Stream. See [Realm Collector install guide](/integration/collector) for setting up a collector.
* Realm Security Raw TCP collector IP address or FQDN
* Realm Collector receiving port number. In Realm console, go to **Collectors > select collector** and copy the port number listed for the Stream.

### Configure FortiClient Log Forwarding to FortiAnalyzer

For additional configuration options, see the [FortiClient EMS Administration Guide](https://docs.fortinet.com/document/forticlient/6.2.9/ems-administration-guide/107284/system-settings).

1. In FortiClient EMS, go to **Endpoint Profiles > System Settings** and edit the desired profile
2. In the **Log** section, enable **Upload Logs to FortiAnalyzer/FortiManager**
3. Enter the IP Address/Hostname and port of the configured FortiAnalyzer instance — or if using FortiAnalyzer Cloud, click **Auto-config FAZ Cloud**

![ObjectsMenu](../images/forticlient_endpoint_profile.png)

### Configure FortiAnalyzer to Forward Logs to Realm Collector

For additional configuration options, see the [FortiAnalyzer Log Forwarding guide](https://docs.fortinet.com/document/fortianalyzer/7.6.6/administration-guide/19991/configuring-log-forwarding).

1. In FortiAnalyzer, go to **System Settings > Administrative Domain** and enable Administrative Domain (ADOM), then create or select the FortiClient ADOM
2. To connect FortiClient EMS to FortiAnalyzer, go to **Device Manager > Add Device** and enter the FortiClient EMS Serial Number
3. To forward logs from FortiAnalyzer to Realm, go to **System Settings > Advanced**, click the **Log Forwarding** tab, then click **Create New**
4. Fill out the forwarding details:
   > **Remote Server Type:** `Common Event Format (CEF)`
   > **Server FQDN/IP:** IP address or FQDN of the Realm Collector
   > **Port:** Realm Collector stream port number

![ObjectsMenu](../images/fortianalyzer_log_forwarding.png)