How can an administrator configure FortiNAC-F to normalize incoming syslog event levels across vendors?

Different network device vendors often use non-standardized severity levels in their syslog messages (e.g., numeric values, various keywords). To ensure consistent event processing and reporting within FortiNAC, the severity mapping feature is used. This feature allows an administrator to create rules that translate or "normalize" vendor-specific severity levels from incoming syslog messages into the standardized set of severity levels used internally by FortiNAC. This ensures that events from multi-vendor environments are categorized and handled uniformly.

B. Vendor OUI (Organizationally Unique Identifier) settings are used for device identification and profiling based on the MAC address, not for normalizing syslog event data.

C. Security rule settings define network access policies and conditions for endpoints, but they do not handle the normalization of incoming log data formats or levels.

D. Event to alarm mappings are used to trigger alarms based on specific events that have already been processed; they do not normalize the severity level of the initial event.

FortiNAC 7.6 Logging Guide, Page 21, "Severity Mapping" section: "Different vendors use different severity levels in their syslog messages. FortiNAC can normalize these levels by mapping them to the standard set of FortiNAC severity levels."