Do Wazuh and FortiGate logs arrive in the same format?
No. That is why a normalization layer is required.
Technical Guide
FortiGate Wazuh log normalization
FortiGate and Wazuh produce different contexts. Without shared user, IP, asset, time, and action fields, reliable analysis becomes harder.
Shared field model
When source IP, destination IP, user, host, policy ID, action, service, and time are held in the same schema, FortiGate sessions can be compared with Wazuh host signals more reliably.
Operational result
Normalization improves search speed, alert quality, and reporting consistency. Bivoxy uses this layer for FortiGate, Wazuh, and standard syslog sources.