Fortinet Fortigate
Overview
The range of Fortigate firewalls is a complete appliance solution whose security functions are highly developed. The firewalls run on the FortiOS operating system.
Related Built-in Rules
The following Sekoia.io built-in rules match the intake Fortinet FortiGate. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.
SEKOIA.IO x Fortinet FortiGate on ATT&CK Navigator
Account Added To A Security Enabled Group
Detection in order to investigate who has added a specific Domain User in Domain Admins or Group Policy Creator Owners (Security event 4728)
- Effort: master
Account Removed From A Security Enabled Group
Detection in order to investigate who has removed a specific Domain User in Domain Admins or Group Policy Creator Owners (Security event 4729)
- Effort: master
Backup Catalog Deleted
The rule detects when the Backup Catalog has been deleted. It means the administrators will not be able to access any backups that were created earlier to perform recoveries. This is often being done using the wbadmin.exe tool.
- Effort: intermediate
Burp Suite Tool Detected
Burp Suite is a cybersecurity tool. When used as a proxy service, its purpose is to intercept packets and modify them to send them to the server. Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities (vulnerabilities scanner).
- Effort: intermediate
CVE-2018-11776 Apache Struts2
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
- Effort: intermediate
CVE-2019-0604 SharePoint
Detects the exploitation of the SharePoint vulnerability (CVE-2019-0604).
- Effort: advanced
CVE-2020-0688 Microsoft Exchange Server Exploit
Detects the exploitation of CVE-2020-0688. The POC exploit a .NET serialization vulnerability in the Exchange Control Panel (ECP) web page. The vulnerability is due to Microsoft Exchange Server not randomizing the keys on a per-installation basis resulting in them using the same validationKey and decryptionKey values. With knowledge of these, values an attacker can craft a special viewstate to use an OS command to be executed by NT_AUTHORITY\SYSTEM using .NET deserialization. To exploit this vulnerability, an attacker needs to leverage the credentials of an account it had already compromised to authenticate to OWA.
- Effort: elementary
CVE-2020-1147 SharePoint
Detection of SharePoint vulnerability CVE-2020-1147.
- Effort: advanced
CVE-2020-14882 Oracle WebLogic Server
Detects the exploitation of the Oracle WebLogic Server vulnerability (CVE-2020-16952).
- Effort: advanced
CVE-2020-17530 Apache Struts RCE
Detects the exploitation of the Apache Struts RCE vulnerability (CVE-2020-17530).
- Effort: intermediate
CVE-2021-20021 SonicWall Unauthenticated Administrator Access
Detects the exploitation of SonicWall Unauthenticated Admin Access.
- Effort: advanced
CVE-2021-20023 SonicWall Arbitrary File Read
Detects Arbitrary File Read, which can be used with other vulnerabilities as a mean to obtain outputs generated by attackers, or sensitive data.
- Effort: advanced
CVE-2021-21972 VMware vCenter
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2). POST request on the following PATH "/ui/vropspluginui/rest/services/uploadova". If in response body (500) the words it has "uploadFile", that means the vCenter is available to accept files via POST without any restrictions.
- Effort: intermediate
CVE-2021-21985 VMware vCenter
The VMware vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.0 before 7.0 U2b, 6.7 before 6.7 U3n and 6.5 before 6.5 U3p) and VMware Cloud Foundation (4.x before 4.2.1 and 3.x before 3.10.2.1).
- Effort: advanced
CVE-2021-22123 Fortinet FortiWeb OS Command Injection
Detects Fortinet FortiWeb OS Command Injection (August 2021) vulnerability exploitation attempt. A remote, authenticated attacker can execute arbitrary commands on the system hosting a vulnerable FortiWeb WAF by sending a POST request with the command in the name field. At the time of writing this rule, it would appear that the request would respond in code 500 for a successful exploitation attempt.
- Effort: advanced
CVE-2021-22893 Pulse Connect Secure RCE Vulnerability
Detects potential exploitation of the authentication by-pass vulnerability that can allow an unauthenticated user to perform remote arbitrary file execution on the Pulse Connect Secure gateway. It is highly recommended to apply the Pulse Secure mitigations and seach for indicators of compromise on affected servers if you are in doubt over the integrity of your Pulse Connect Secure product.
- Effort: intermediate
CVE-2021-26855 Exchange SSRF
Detects the exploitation of ProyxLogon vulerability on Exchange servers.
- Effort: advanced
Computer Account Deleted
Detects computer account deletion.
- Effort: master
DHCP Server Error Failed Loading the CallOut DLL
This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded.
- Effort: intermediate
DHCP Server Loaded the CallOut DLL
This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded. This would indicate a succesful attack against DHCP service allowing to disrupt the service or alter the integrity of the responses.
- Effort: intermediate
DNS Server Error Failed Loading The ServerLevelPluginDLL
This rule detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded. This requires the dedicated Windows event provider Microsoft-Windows-DNS-Server-Service.
- Effort: master
Detect requests to Konni C2 servers
This rule detects requests to Konni C2 servers. These patterns come from an analysis done in 2022, September.
- Effort: elementary
Domain Trust Created Or Removed
A trust was created or removed to a domain. An attacker could perform that in order to do lateral movement easily between domains or shutdown the ability of two domains to communicate.
- Effort: advanced
Download Files From Non-Legitimate TLDs
Detects file downloads from non-legitimate TLDs. Additional legitimates TLDs should be filtered according to the business habits.
- Effort: master
Download Files From Suspicious TLDs
Detects download of certain file types from hosts in suspicious TLDs
- Effort: master
Failed Logon Source From Public IP Addresses
A login from a public IP can indicate a misconfigured firewall or network boundary. The sekoia.tags are used to filter internal Ipv4 addresses (10.0.0.0/8 172.16.0.0/12 127.0.0.0/8 169.254.0.0/16 192.168.0.0/16).
- Effort: master
FoggyWeb HTTP Default GET/POST Requests
Detects GET or POST request pattern observed within the first FoggyWeb campaign detected by Microsoft.
- Effort: advanced
Fortinet FortiGate Firewall Login In Failure
Detects failed login attemps on firewall administration rule. Prerequisites, check that the firewall logs format corresponds to the rule
- Effort: master
Koadic MSHTML Command
Detects Koadic payload using MSHTML module
- Effort: intermediate
Microsoft Defender Antivirus History Deleted
Windows Defender history has been deleted. Could be an attempt by an attacker to remove its traces.
- Effort: master
Microsoft Defender Antivirus Tampering Detected
Detection of Windows Defender Tampering, from definitions' deletion to deactivation of parts or all of Defender.
- Effort: advanced
Microsoft Defender Antivirus Threat Detected
Detection of a windows defender alert indicating the presence of potential malware
- Effort: advanced
Nimbo-C2 User Agent
Nimbo-C2 Uses an unusual User-Agent format in its implants.
- Effort: intermediate
Password Change On Directory Service Restore Mode (DSRM) Account
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password to gain persistence.
- Effort: intermediate
Possible Malicious File Double Extension
Detects request to potential malicious file with double extension
- Effort: elementary
Possible Replay Attack
This event can be a sign of Kerberos replay attack or, among other things, network device configuration or routing problems.
- Effort: intermediate
Potential Bazar Loader User-Agents
Detects potential Bazar loader communications through the user-agent
- Effort: elementary
Potential DNS Tunnel
Detects domain name which is longer than 95 characters. Long domain names are distinctive of DNS tunnels.
- Effort: advanced
Potential Lemon Duck User-Agent
Detects LemonDuck user agent. The format used two sets of alphabetical characters separated by dashes, for example "User-Agent: Lemon-Duck-[A-Z]-[A-Z]".
- Effort: elementary
Potential RDP Connection To Non-Domain Host
Detects logons using NTLM to hosts that are potentially not part of the domain using RDP (TermSrv). Event ID 8001 corresponds to outgoing NTLM authentication traffic and TermSrv stands for RDP Terminal Services Server. Check if the contacted host is legitimate. To use this detection rule, enable logging of outbound NTLM authentications on all domain controllers, using the following Group Policy (GPO) - Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers -> Define this policy setting: Audit all.
- Effort: master
Privilege Escalation Awesome Scripts (PEAS)
Detect PEAS privileges escalation scripts and binaries
- Effort: elementary
ProxyShell Microsoft Exchange Suspicious Paths
Detects suspicious calls to Microsoft Exchange resources, in locations related to webshells observed in campaigns using this vulnerability.
- Effort: elementary
RTLO Character
Detects RTLO (Right-To-Left character) in file and process names.
- Effort: elementary
SEKOIA.IO Intelligence Feed
Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.
- Effort: elementary
Sliver DNS Beaconing
Detects suspicious DNS queries known from Sliver beaconing
- Effort: intermediate
Suspicious TOR Gateway
Detects suspicious TOR gateways. Gateways are often used by the victim to pay and decrypt the encrypted files without installing TOR. Tor intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.
- Effort: advanced
Suspicious URI Used In A Lazarus Campaign
Detects suspicious requests to a specific URI, usually on an .asp page. The website is often compromised.
- Effort: intermediate
Telegram Bot API Request
Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
- Effort: advanced
TrevorC2 HTTP Communication
Detects TrevorC2 HTTP communication based on the HTTP request URI and the user-agent.
- Effort: elementary
User Account Created
Detects user creation on windows servers, which shouldn't happen in an Active Directory environment. Apply this on your windows server logs and not on your DC logs. One default account defaultuser0 is excluded as only used during Windows set-up. This detection use Security Event ID 4720.
- Effort: master
User Account Deleted
Detects local user deletion
- Effort: master
WCE wceaux.dll Creation
Detects wceaux.dll creation while Windows Credentials Editor (WCE) is executed.
- Effort: intermediate
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Network device logs |
FortiGate can record traffic logs flowing through their firewall. |
Network intrusion detection system |
Security logs provided by FortiGate include intrusion prevention related records. |
Web application firewall logs |
FortiWeb appliances and virtual appliances record WAF information. |
Web logs |
WAF information produces by FortiWeb units can record permited URL access. |
DNS records |
Both DNS queries and responses handled by the FortiGate domain name servers can be recorded. |
Event Samples
Find below few samples of events and how they are normalized by Sekoia.io.
{
"message": "CEF:0|Fortinet|Fortigate|v6.2.9|32102|event:system|7|deviceExternalId=FGVM2V0000171868 FortinetFortiGatelogid=0100032102 cat=event:system FortinetFortiGatesubtype=system FortinetFortiGatelevel=alert FortinetFortiGatevd=root FortinetFortiGateeventtime=1637681708541881380 FortinetFortiGatetz=+0100 FortinetFortiGatelogdesc=Configuration changed duser= sproc=console msg=Configuration is changed in the admin session",
"event": {
"category": "event",
"code": "0100032102",
"dataset": "event:system",
"reason": "Configuration is changed in the admin session",
"timezone": "+0100"
},
"@timestamp": "2021-11-23T15:35:08.541882Z",
"action": {
"outcome_reason": "Configuration is changed in the admin session",
"target": "network-traffic",
"type": "system"
},
"log": {
"level": "alert"
},
"observer": {
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.2.9"
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|24576|utm:dlp dlp block|4|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0954024576 cat=utm:dlp FTNTFGTsubtype=dlp FTNTFGTeventtype=dlp FTNTFGTlevel=warning FTNTFGTvd=vdom1 FTNTFGTeventtime=1545949776 FTNTFGTfilteridx=1 FTNTFGTdlpextra=test-dlp3 FTNTFGTfiltertype=file-type FTNTFGTfiltercat=file FTNTFGTseverity=medium FTNTFGTpolicyid=1 externalId=12680 FTNTFGTepoch=418303178 FTNTFGTeventid=0 duser=bob src=10.1.100.11 spt=33638 deviceInboundInterface=port12 FTNTFGTsrcintfrole=undefined dst=172.18.62.158 dpt=80 deviceOutboundInterface=port11 FTNTFGTdstintfrole=undefined proto=6 app=HTTP FTNTFGTfiletype=gif deviceDirection=0 act=block dhost=172.18.62.158 request=/dlp/flower.gif requestClientApplication=curl/7.47.0 fname=flower.gif fsize=1209 FTNTFGTprofile=test-dlp",
"event": {
"action": "block",
"category": "utm",
"code": "0954024576",
"dataset": "utm:dlp",
"outcome": "success"
},
"@timestamp": "2018-12-27T22:29:36Z",
"action": {
"name": "block",
"outcome": "success",
"target": "network-traffic",
"type": "dlp - dlp"
},
"destination": {
"address": "172.18.62.158",
"domain": "172.18.62.158",
"ip": "172.18.62.158",
"port": 80,
"user": {
"name": "bob"
}
},
"file": {
"name": "flower.gif",
"size": 1209
},
"fortinet": {
"fortigate": {
"event": {
"severity": "medium"
}
}
},
"log": {
"level": "warning"
},
"network": {
"application": "HTTP",
"direction": "inbound",
"protocol": "http",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port11"
}
},
"ingress": {
"interface": {
"name": "port12"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"hosts": [
"172.18.62.158"
],
"ip": [
"10.1.100.11",
"172.18.62.158"
],
"user": [
"bob"
]
},
"source": {
"address": "10.1.100.11",
"ip": "10.1.100.11",
"port": 33638
},
"url": {
"original": "/dlp/flower.gif",
"path": "/dlp/flower.gif"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "curl",
"original": "curl/7.47.0",
"os": {
"name": "Other"
},
"version": "7.47.0"
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|54802|dns:dns-response pass|3|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=1501054802 cat=dns:dns-response FTNTFGTsubtype=dns-response FTNTFGTlevel=notice FTNTFGTvd=vdom1 FTNTFGTeventtime=1545950726 FTNTFGTpolicyid=1 externalId=13355 duser=bob src=10.1.100.11 spt=54621 deviceInboundInterface=port12 FTNTFGTsrcintfrole=lan dst=172.16.200.55 dpt=53 deviceOutboundInterface=port11 FTNTFGTdstintfrole=wan proto=17 FTNTFGTprofile=default FTNTFGTsrcmac=a2:e9:00:ec:40:01 FTNTFGTxid=5137 FTNTFGTqname=detectportal.firefox.com FTNTFGTqtype=A FTNTFGTqtypeval=1 FTNTFGTqclass=IN FTNTFGTipaddr=104.80.89.26, 104.80.89.24 msg=Domain is monitored act=pass FTNTFGTcat=52 FTNTFGTcatdesc=Information Technology",
"event": {
"action": "pass",
"category": "dns",
"code": "1501054802",
"dataset": "dns:dns-response",
"outcome": "success",
"reason": "Domain is monitored"
},
"@timestamp": "2018-12-27T22:45:26Z",
"action": {
"name": "pass",
"outcome": "success",
"outcome_reason": "Domain is monitored",
"target": "network-traffic",
"type": "dns-response"
},
"destination": {
"address": "172.16.200.55",
"ip": "172.16.200.55",
"port": 53,
"user": {
"name": "bob"
}
},
"log": {
"level": "notice"
},
"network": {
"transport": "udp"
},
"observer": {
"egress": {
"interface": {
"name": "port11"
}
},
"ingress": {
"interface": {
"name": "port12"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"ip": [
"10.1.100.11",
"172.16.200.55"
],
"user": [
"bob"
]
},
"source": {
"address": "10.1.100.11",
"ip": "10.1.100.11",
"port": 54621
}
}
{
"message": "time=15:51:59 devname=\"my-device\" devid=\"1111111111111111\" eventtime=1668001919663486001 tz=\"+0100\" logid=\"1500054000\" type=\"utm\" subtype=\"dns\" eventtype=\"dns-query\" level=\"information\" vd=\"root\" policyid=1685 poluuid=\"4470d4c5-7e12-4a8f-a369-08eff4a43b5b\" policytype=\"policy\" sessionid=933308058 srcip=1.2.3.4 srcport=35305 srccountry=\"Reserved\" srcintf=\"INTF-1\" srcintfrole=\"undefined\" dstip=8.8.8.8 dstport=53 dstcountry=\"Reserved\" dstintf=\"INTF-2\" dstintfrole=\"lan\" proto=17 profile=\"DNS Filtering Normal\" xid=42240 qtype=\"NS\" qtypeval=2 qclass=\"IN\"",
"event": {
"category": "utm",
"code": "1500054000",
"timezone": "+0100"
},
"@timestamp": "2022-11-09T13:51:59.663486Z",
"action": {
"target": "network-traffic",
"type": "dns"
},
"destination": {
"address": "8.8.8.8",
"ip": "8.8.8.8",
"port": 53
},
"dns": {
"question": {
"class": "IN",
"type": "NS"
},
"rrtype": "NS"
},
"fortinet": {
"fortigate": {
"event": {
"type": "utm"
},
"policyid": "1685",
"poluuid": "4470d4c5-7e12-4a8f-a369-08eff4a43b5b",
"virtual_domain": "root"
}
},
"host": {
"name": "my-device"
},
"log": {
"hostname": "my-device",
"level": "information"
},
"network": {
"transport": "udp"
},
"observer": {
"egress": {
"interface": {
"name": "INTF-2"
}
},
"hostname": "my-device",
"ingress": {
"interface": {
"name": "INTF-1"
}
},
"serial_number": "1111111111111111"
},
"related": {
"hosts": [
"my-device"
],
"ip": [
"1.2.3.4",
"8.8.8.8"
]
},
"rule": {
"ruleset": "policy"
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 35305
}
}
{
"message": "time=15:58:39 devname=\"dev-name\" devid=\"1111111111111111\" eventtime=1668002319383195535 tz=\"+0100\" logid=\"1500054000\" type=\"utm\" subtype=\"dns\" eventtype=\"dns-query\" level=\"information\" vd=\"root\" policyid=770 poluuid=\"f2aef0f2-a721-49cf-9dd3-b27f7f5b90bc\" policytype=\"policy\" sessionid=933538554 user=\"agt\" srcip=1.2.3.4 srcport=45362 srccountry=\"Reserved\" srcintf=\"intf-1\" srcintfrole=\"undefined\" dstip=8.8.8.8 dstport=53 dstcountry=\"Reserved\" dstintf=\"intf-2\" dstintfrole=\"undefined\" proto=17 profile=\"DNS Filtering Normal\" xid=32649 qname=\"['fr.pool.ntp.org']\" qtype=\"A\" qtypeval=1 qclass=\"IN\"",
"event": {
"category": "utm",
"code": "1500054000",
"timezone": "+0100"
},
"@timestamp": "2022-11-09T13:58:39.383196Z",
"action": {
"target": "network-traffic",
"type": "dns"
},
"destination": {
"address": "8.8.8.8",
"ip": "8.8.8.8",
"port": 53
},
"dns": {
"question": {
"class": "IN",
"name": "'fr.pool.ntp.org'",
"subdomain": "'fr.pool.ntp",
"type": "A"
},
"rrname": "'fr.pool.ntp.org'",
"rrtype": "A"
},
"fortinet": {
"fortigate": {
"event": {
"type": "utm"
},
"policyid": "770",
"poluuid": "f2aef0f2-a721-49cf-9dd3-b27f7f5b90bc",
"virtual_domain": "root"
}
},
"host": {
"name": "dev-name"
},
"log": {
"hostname": "dev-name",
"level": "information"
},
"network": {
"transport": "udp"
},
"observer": {
"egress": {
"interface": {
"name": "intf-2"
}
},
"hostname": "dev-name",
"ingress": {
"interface": {
"name": "intf-1"
}
},
"serial_number": "1111111111111111"
},
"related": {
"hosts": [
"'fr.pool.ntp.org'",
"dev-name"
],
"ip": [
"1.2.3.4",
"8.8.8.8"
],
"user": [
"agt"
]
},
"rule": {
"ruleset": "policy"
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 45362,
"user": {
"name": "agt"
}
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|16384|utm:ips signature reset|7|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0419016384 cat=utm:ips FTNTFGTsubtype=ips FTNTFGTeventtype=signature FTNTFGTlevel=alert FTNTFGTvd=vdom1 FTNTFGTeventtime=1545938887 FTNTFGTseverity=info src=172.16.200.55 FTNTFGTsrccountry=Reserved dst=10.1.100.11 deviceInboundInterface=port11 FTNTFGTsrcintfrole=undefined deviceOutboundInterface=port12 FTNTFGTdstintfrole=undefined externalId=901 act=reset proto=6 app=HTTP FTNTFGTpolicyid=1 FTNTFGTattack=Eicar.Virus.Test.File spt=80 dpt=44362 dhost=172.16.200.55 request=/virus/eicar.com deviceDirection=0 FTNTFGTattackid=29844 FTNTFGTprofile=test-ips FTNTFGTref=http://www.fortinet.com/ids/VID29844 duser=bob FTNTFGTincidentserialno=877326946 msg=file_transfer: Eicar.Virus.Test.File,",
"event": {
"action": "reset",
"category": "utm",
"code": "0419016384",
"dataset": "utm:ips",
"outcome": "success",
"reason": "file_transfer: Eicar.Virus.Test.File,"
},
"@timestamp": "2018-12-27T19:28:07Z",
"action": {
"name": "reset",
"outcome": "success",
"outcome_reason": "file_transfer: Eicar.Virus.Test.File,",
"target": "network-traffic",
"type": "signature - ips"
},
"destination": {
"address": "10.1.100.11",
"domain": "172.16.200.55",
"ip": "10.1.100.11",
"port": 44362,
"user": {
"name": "bob"
}
},
"fortinet": {
"fortigate": {
"event": {
"severity": "info"
}
}
},
"log": {
"level": "alert"
},
"network": {
"application": "HTTP",
"direction": "inbound",
"protocol": "http",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port12"
}
},
"ingress": {
"interface": {
"name": "port11"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"hosts": [
"172.16.200.55"
],
"ip": [
"10.1.100.11",
"172.16.200.55"
],
"user": [
"bob"
]
},
"source": {
"address": "172.16.200.55",
"ip": "172.16.200.55",
"port": 80
},
"url": {
"original": "/virus/eicar.com",
"path": "/virus/eicar.com"
}
}
{
"message": "time=17:24:16 devname=\"abc\" devid=\"1\" logid=\"0101037130\" type=\"event\" subtype=\"vpn\" level=\"error\" vd=\"root\" eventtime=1580142256 logdesc=\"Progress IPsec phase 2\" msg=\"progress IPsec phase 2\" action=\"negotiate\" remip=1.1.1.1 locip=93.187.43.9 remport=500 locport=500 outintf=\"N/A\" cookies=\"07f928d94dd975ea/89b1d990f54f0b82\" user=\"N/A\" group=\"N/A\" xauthuser=\"N/A\" xauthgroup=\"N/A\" assignip=N/A vpntunnel=\"VPN-FOOBAR\" status=\"failure\" init=\"local\" exch=\"CREATE_CHILD\" dir=\"inbound\" role=\"initiator\" result=\"ERROR\" version=\"IKEv2\"",
"event": {
"action": "negotiate",
"category": "event",
"code": "0101037130",
"dataset": "event:vpn",
"outcome": "failure",
"reason": "progress IPsec phase 2"
},
"@timestamp": "2020-01-27T16:24:16Z",
"action": {
"name": "negotiate",
"outcome": "failure",
"outcome_reason": "progress IPsec phase 2",
"target": "network-traffic",
"type": "vpn"
},
"destination": {
"address": "93.187.43.9",
"ip": "93.187.43.9",
"port": 500
},
"fortinet": {
"fortigate": {
"event": {
"type": "event"
},
"tunnel": {
"name": "VPN-FOOBAR",
"version": "IKEv2"
},
"virtual_domain": "root"
}
},
"host": {
"name": "abc"
},
"log": {
"description": "Progress IPsec phase 2",
"hostname": "abc",
"level": "error"
},
"observer": {
"hostname": "abc",
"serial_number": "1"
},
"related": {
"hosts": [
"abc"
],
"ip": [
"1.1.1.1",
"93.187.43.9"
]
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"port": 500
}
}
{
"message": "time=16:48:00 devname=\"abc\" devid=\"1\" logid=\"0100032003\" type=\"event\" subtype=\"system\" level=\"information\" vd=\"root\" eventtime=1619621280 logdesc=\"Admin logout successful\" sn=\"1619620402\" user=\"test\" ui=\"jsconsole\" method=\"jsconsole\" srcip=1.1.1.1 dstip=2.2.2.2 action=\"logout\" status=\"success\" duration=878 reason=\"exit\" msg=\"Administrator test logged out from jsconsole\"",
"event": {
"action": "logout",
"category": "event",
"code": "0100032003",
"dataset": "event:system",
"outcome": "success",
"provider": "jsconsole",
"reason": "exit"
},
"@timestamp": "2021-04-28T14:48:00Z",
"action": {
"name": "logout",
"outcome": "success",
"outcome_reason": "Administrator test logged out from jsconsole",
"target": "network-traffic",
"type": "system"
},
"destination": {
"address": "2.2.2.2",
"ip": "2.2.2.2"
},
"fortinet": {
"fortigate": {
"event": {
"type": "event"
},
"virtual_domain": "root"
}
},
"host": {
"name": "abc"
},
"http": {
"request": {
"method": "jsconsole"
}
},
"log": {
"description": "Admin logout successful",
"hostname": "abc",
"level": "information"
},
"observer": {
"hostname": "abc",
"serial_number": "1"
},
"related": {
"hosts": [
"abc"
],
"ip": [
"1.1.1.1",
"2.2.2.2"
],
"user": [
"test"
]
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"user": {
"name": "test"
}
}
}
{
"message": "time=16:23:50 devname=\"abc\" devid=\"1\" logid=\"0100032011\" type=\"event\" subtype=\"system\" level=\"notice\" vd=\"PRX1-AA\" eventtime=1619619830 logdesc=\"Disk log rolled\" action=\"roll-log\" reason=\"file-size\" log=\"tlog\" msg=\"Disk log has rolled.\"",
"event": {
"action": "roll-log",
"category": "event",
"code": "0100032011",
"dataset": "event:system",
"outcome": "success",
"reason": "file-size"
},
"@timestamp": "2021-04-28T14:23:50Z",
"action": {
"name": "roll-log",
"outcome": "success",
"outcome_reason": "Disk log has rolled.",
"target": "network-traffic",
"type": "system"
},
"fortinet": {
"fortigate": {
"event": {
"type": "event"
},
"virtual_domain": "PRX1-AA"
}
},
"host": {
"name": "abc"
},
"log": {
"description": "Disk log rolled",
"hostname": "abc",
"level": "notice"
},
"observer": {
"hostname": "abc",
"serial_number": "1"
},
"related": {
"hosts": [
"abc"
]
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|61002|utm:ssh ssh-command passthrough|3|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=1600061002 cat=utm:ssh FTNTFGTsubtype=ssh FTNTFGTeventtype=ssh-command FTNTFGTlevel=notice FTNTFGTvd=vdom1 FTNTFGTeventtime=1545950175 FTNTFGTpolicyid=1 externalId=12921 duser=bob FTNTFGTprofile=test-ssh src=10.1.100.11 spt=56698 dst=172.16.200.55 dpt=22 deviceInboundInterface=port12 FTNTFGTsrcintfrole=lan deviceOutboundInterface=port11 FTNTFGTdstintfrole=wan proto=6 act=passthrough FTNTFGTlogin=root FTNTFGTcommand=ls FTNTFGTseverity=low",
"event": {
"action": "passthrough",
"category": "utm",
"code": "1600061002",
"dataset": "utm:ssh",
"outcome": "success"
},
"@timestamp": "2018-12-27T22:36:15Z",
"action": {
"name": "passthrough",
"outcome": "success",
"target": "network-traffic",
"type": "ssh-command - ssh"
},
"destination": {
"address": "172.16.200.55",
"ip": "172.16.200.55",
"port": 22,
"user": {
"name": "bob"
}
},
"fortinet": {
"fortigate": {
"event": {
"severity": "low"
}
}
},
"log": {
"level": "notice"
},
"network": {
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port11"
}
},
"ingress": {
"interface": {
"name": "port12"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"ip": [
"10.1.100.11",
"172.16.200.55"
],
"user": [
"bob"
]
},
"source": {
"address": "10.1.100.11",
"ip": "10.1.100.11",
"port": 56698
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|44032|utm:voip voip permit start|2|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0814044032 cat=utm:voip FTNTFGTsubtype=voip FTNTFGTeventtype=voip FTNTFGTlevel=information FTNTFGTvd=vdom1 FTNTFGTeventtime=1545958028 externalId=18975 FTNTFGTepoch=0 FTNTFGTevent_id=6857 src=10.1.100.11 spt=5060 dst=172.16.200.55 dpt=5060 proto=17 deviceInboundInterface=port12 deviceOutboundInterface=port11 FTNTFGTpolicy_id=1 FTNTFGTprofile=default FTNTFGTvoip_proto=sip FTNTFGTkind=call act=permit outcome=start FTNTFGTduration=0 FTNTFGTdir=session_origin FTNTFGTcall_id=3444-13134@127.0.0.1 suser=sip:sipp@127.0.0.1:5060 duser=sip:service@172.16.200.55:5060",
"event": {
"action": "permit",
"category": "utm",
"code": "0814044032",
"dataset": "utm:voip",
"outcome": "start"
},
"@timestamp": "2018-12-28T00:47:08Z",
"action": {
"name": "permit",
"outcome": "start",
"target": "network-traffic",
"type": "voip - voip"
},
"destination": {
"address": "172.16.200.55",
"ip": "172.16.200.55",
"port": 5060,
"user": {
"name": "sip:service@172.16.200.55:5060"
}
},
"log": {
"level": "information"
},
"network": {
"transport": "udp"
},
"observer": {
"egress": {
"interface": {
"name": "port11"
}
},
"ingress": {
"interface": {
"name": "port12"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"ip": [
"10.1.100.11",
"172.16.200.55"
],
"user": [
"sip:service@172.16.200.55:5060",
"sip:sipp@127.0.0.1:5060"
]
},
"source": {
"address": "10.1.100.11",
"ip": "10.1.100.11",
"port": 5060,
"user": {
"name": "sip:sipp@127.0.0.1:5060"
}
}
}
{
"message": "time=15:29:39 devname=\"abc\" devid=\"1\" logid=\"0105048039\" type=\"event\" subtype=\"wad\" level=\"error\" vd=\"PRX1-AA\" eventtime=1619616579 logdesc=\"SSL fatal alert sent\" session_id=473f963d policyid=0 srcip=2.2.2.2 srcport=47782 dstip=1.1.1.1 dstport=8002 action=\"send\" alert=\"2\" desc=\"illegal parameter\" msg=\"SSL Alert sent\"",
"event": {
"action": "send",
"category": "event",
"code": "0105048039",
"dataset": "utm:wad",
"outcome": "success",
"reason": "SSL Alert sent",
"type": "illegal parameter"
},
"@timestamp": "2021-04-28T13:29:39Z",
"action": {
"name": "send",
"outcome": "success",
"outcome_reason": "SSL Alert sent",
"target": "network-traffic",
"type": "wad"
},
"destination": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"port": 8002
},
"fortinet": {
"fortigate": {
"event": {
"desc": "illegal parameter",
"type": "event"
},
"policyid": "0",
"virtual_domain": "PRX1-AA"
}
},
"host": {
"name": "abc"
},
"log": {
"description": "SSL fatal alert sent",
"hostname": "abc",
"level": "error"
},
"observer": {
"hostname": "abc",
"serial_number": "1"
},
"related": {
"hosts": [
"abc"
],
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"source": {
"address": "2.2.2.2",
"ip": "2.2.2.2",
"port": 47782
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|30258|utm:waf waf-http-constraint passthrough|4|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=1203030258 cat=utm:waf FTNTFGTsubtype=waf FTNTFGTeventtype=waf-http-constraint FTNTFGTlevel=warning FTNTFGTvd=vdom1 FTNTFGTeventtime=1545951320 FTNTFGTpolicyid=1 externalId=13614 duser=bob FTNTFGTprofile=waf_test src=10.1.100.11 spt=57304 dst=172.16.200.55 dpt=80 deviceInboundInterface=port12 FTNTFGTsrcintfrole=lan deviceOutboundInterface=port11 FTNTFGTdstintfrole=wan proto=6 app=HTTP request=http://172.16.200.55/index.html?a\\=0123456789&b\\=0123456789&c\\=0123456789 FTNTFGTseverity=medium act=passthrough deviceDirection=0 requestClientApplication=curl/7.47.0 FTNTFGTconstraint=url-param-num FTNTFGTrawdata=Method\\=GET|User-Agent\\=curl/7.47.0",
"event": {
"action": "passthrough",
"category": "utm",
"code": "1203030258",
"dataset": "utm:waf",
"outcome": "success"
},
"@timestamp": "2018-12-27T22:55:20Z",
"action": {
"name": "passthrough",
"outcome": "success",
"target": "network-traffic",
"type": "waf-http-constraint - waf"
},
"destination": {
"address": "172.16.200.55",
"ip": "172.16.200.55",
"port": 80,
"user": {
"name": "bob"
}
},
"fortinet": {
"fortigate": {
"event": {
"severity": "medium"
}
}
},
"log": {
"level": "warning"
},
"network": {
"application": "HTTP",
"direction": "inbound",
"protocol": "http",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port11"
}
},
"ingress": {
"interface": {
"name": "port12"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"ip": [
"10.1.100.11",
"172.16.200.55"
],
"user": [
"bob"
]
},
"source": {
"address": "10.1.100.11",
"ip": "10.1.100.11",
"port": 57304
},
"url": {
"domain": "172.16.200.55",
"full": "http://172.16.200.55/index.html?a\\=0123456789&b\\=0123456789&c\\=0123456789",
"original": "http://172.16.200.55/index.html?a\\=0123456789&b\\=0123456789&c\\=0123456789",
"path": "/index.html",
"port": 80,
"query": "a\\=0123456789&b\\=0123456789&c\\=0123456789",
"scheme": "http"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "curl",
"original": "curl/7.47.0",
"os": {
"name": "Other"
},
"version": "7.47.0"
}
}
{
"message": "0|Fortinet|Fortigate|v6.0.3|18433|utm:anomaly anomaly clear_session|7|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0720018433 cat=utm:anomaly FTNTFGTsubtype=anomaly FTNTFGTeventtype=anomaly FTNTFGTlevel=alert FTNTFGTvd=vdom1 FTNTFGTeventtime=1545939604 FTNTFGTseverity=critical src=10.1.100.11 FTNTFGTsrccountry=Reserved dst=172.16.200.55 deviceInboundInterface=port12 FTNTFGTsrcintfrole=undefined externalId=0 act=clear_session proto=1 app=PING cnt=1 FTNTFGTattack=icmp_flood FTNTFGTicmpid=0x3053 FTNTFGTicmptype=0x08 FTNTFGTicmpcode=0x00 FTNTFGTattackid=16777316 FTNTFGTpolicyid=1 FTNTFGTpolicytype=DoS-policy FTNTFGTref=http://www.fortinet.com/ids/VID16777316 msg=anomaly: icmp_flood, 51 > threshold 50 FTNTFGTcrscore=50 FTNTFGTcrlevel=critical",
"event": {
"action": "clear_session",
"category": "utm",
"code": "0720018433",
"dataset": "utm:anomaly",
"outcome": "success",
"reason": "anomaly: icmp_flood, 51 > threshold 50"
},
"@timestamp": "2018-12-27T19:40:04Z",
"action": {
"name": "clear_session",
"outcome": "success",
"outcome_reason": "anomaly: icmp_flood, 51 > threshold 50",
"target": "network-traffic",
"type": "anomaly - anomaly"
},
"destination": {
"address": "172.16.200.55",
"ip": "172.16.200.55"
},
"fortinet": {
"fortigate": {
"event": {
"severity": "critical"
}
}
},
"log": {
"level": "alert"
},
"network": {
"application": "PING",
"protocol": "ping",
"transport": "icmp"
},
"observer": {
"ingress": {
"interface": {
"name": "port12"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"ip": [
"10.1.100.11",
"172.16.200.55"
]
},
"source": {
"address": "10.1.100.11",
"ip": "10.1.100.11"
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v5.6.0|18433|anomaly:anomaly clear_ session|7|FTNTFGTlogid=0720018433 cat=anomaly:anomaly FTNTFGTsubtype=anomaly FTNTFGTlevel=alert FTNTFGTvd=vdom1 FTNTFGTseverity=critical src=1.1.1.1 dst=2.2.2.2 deviceInboundInterface=port15 externalId=0 act=clear_session proto=1 app=icmp/146/81 cnt=306 FTNTFGTattack=icmp_flood dpt=20882 FTNTFGTicmptype=0x92 FTNTFGTicmpcode=0x51 FTNTFGTattackid=16777316 FTNTFGTprofile=DoS-policy1 cs2=http://www.fortinet.com/ids/VID16777316 cs2Label=Reference msg=anomaly: icmp_flood, 34 > threshold 25, repeats 306 times FTNTFGTcrscore=50 FTNTFGTcrlevel=critical",
"event": {
"action": "clear_session",
"category": "anomaly",
"code": "0720018433",
"dataset": "anomaly:anomaly",
"outcome": "success",
"reason": "anomaly: icmp_flood, 34 > threshold 25, repeats 306 times"
},
"action": {
"name": "clear_session",
"outcome": "success",
"outcome_reason": "anomaly: icmp_flood, 34 > threshold 25, repeats 306 times",
"target": "network-traffic",
"type": "anomaly"
},
"destination": {
"address": "2.2.2.2",
"ip": "2.2.2.2",
"port": 20882
},
"fortinet": {
"fortigate": {
"event": {
"severity": "critical"
}
}
},
"log": {
"level": "alert"
},
"network": {
"application": "icmp/146/81",
"protocol": "icmp/146/81",
"transport": "icmp"
},
"observer": {
"ingress": {
"interface": {
"name": "port15"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v5.6.0"
},
"related": {
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1"
}
}
{
"message": "date=2016-02-12,time=14:10:42,logid=0720018433,type=anomaly,subtype=anomaly,level=alert,vd=\"vdom1\",severity=critical,srcip=1.1.1.1,dstip=2.2.2.2,srcintf=\"port15\",sessionid=0,action=clear_session,proto=1,service=\"icmp/146/81\",count=306,attack=\"icmp_ flood\",dstport=20882,icmptype=0x92,icmpcode=0x51,attackid=16777316,profile=\"DoS-policy1\",ref=\"http://www.fortinet.com/ids/VID16777316\",msg=\"anomaly: icmp_flood, 34 > threshold 25, repeats 306 times\",crscore=50,crlevel=critical",
"event": {
"action": "clear_session",
"category": "anomaly",
"code": "0720018433",
"dataset": "utm:anomaly",
"outcome": "success",
"reason": "anomaly: icmp_flood, 34 > threshold 25, repeats 306 times"
},
"action": {
"name": "clear_session",
"outcome": "success",
"outcome_reason": "anomaly: icmp_flood, 34 > threshold 25, repeats 306 times",
"properties": {
"icmp_code": "0x51",
"icmp_type": "0x92"
},
"target": "network-traffic",
"type": "anomaly"
},
"destination": {
"address": "2.2.2.2",
"ip": "2.2.2.2",
"port": 20882
},
"fortinet": {
"fortigate": {
"attack": {
"id": "16777316",
"name": "icmp_ flood"
},
"event": {
"severity": "critical",
"type": "anomaly"
},
"icmp": {
"request": {
"code": "0x51",
"type": "0x92"
}
},
"virtual_domain": "vdom1"
}
},
"log": {
"level": "alert"
},
"network": {
"protocol": "icmp/146/81",
"transport": "icmp"
},
"observer": {
"ingress": {
"interface": {
"name": "port15"
}
}
},
"related": {
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1"
}
}
{
"message": "date=2016-02-12 time=14:10:42 logid=0720018433 type=anomaly subtype=anomaly level=alert vd=\"vdom1\" severity=critical srcip=1.1.1.1 dstip=2.2.2.2 srcintf=\"port15\" sessionid=0 action=clear_session proto=1 service=\"icmp/146/81\" count=306 attack=\"icmp_ flood\" dstport=20882 icmptype=0x92 icmpcode=0x51 attackid=16777316 profile=\"DoS-policy1\" ref=\"http://www.fortinet.com/ids/VID16777316\" msg=\"anomaly: icmp_flood, 34 > threshold 25, repeats 306 times\" crscore=50 crlevel=critical",
"event": {
"action": "clear_session",
"category": "anomaly",
"code": "0720018433",
"dataset": "utm:anomaly",
"outcome": "success",
"reason": "anomaly: icmp_flood, 34 > threshold 25, repeats 306 times"
},
"action": {
"name": "clear_session",
"outcome": "success",
"outcome_reason": "anomaly: icmp_flood, 34 > threshold 25, repeats 306 times",
"properties": {
"icmp_code": "0x51",
"icmp_type": "0x92"
},
"target": "network-traffic",
"type": "anomaly"
},
"destination": {
"address": "2.2.2.2",
"ip": "2.2.2.2",
"port": 20882
},
"fortinet": {
"fortigate": {
"attack": {
"id": "16777316",
"name": "icmp_ flood"
},
"event": {
"severity": "critical",
"type": "anomaly"
},
"icmp": {
"request": {
"code": "0x51",
"type": "0x92"
}
},
"virtual_domain": "vdom1"
}
},
"log": {
"level": "alert"
},
"network": {
"protocol": "icmp/146/81",
"transport": "icmp"
},
"observer": {
"ingress": {
"interface": {
"name": "port15"
}
}
},
"related": {
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1"
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|08192|utm:virus infected blocked|4|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0211008192 cat=utm:virus FTNTFGTsubtype=virus FTNTFGTeventtype=infected FTNTFGTlevel=warning FTNTFGTvd=vdom1 FTNTFGTeventtime=1545938448 msg=File is infected. act=blocked app=HTTP externalId=695 src=10.1.100.11 dst=172.16.200.55 spt=44356 dpt=80 deviceInboundInterface=port12 FTNTFGTsrcintfrole=undefined deviceOutboundInterface=port11 FTNTFGTdstintfrole=undefined FTNTFGTpolicyid=1 proto=6 deviceDirection=0 fname=eicar.com FTNTFGTquarskip=File-was-not-quarantined. FTNTFGTvirus=EICAR_TEST_FILE FTNTFGTdtype=Virus FTNTFGTref=http://www.fortinet.com/ve?vn\\=EICAR_TEST_FILE FTNTFGTvirusid=2172 request=http://172.16.200.55/virus/eicar.com FTNTFGTprofile=g-default duser=bob requestClientApplication=curl/7.47.0 FTNTFGTanalyticscksum=275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f FTNTFGTanalyticssubmit=false FTNTFGTcrscore=50 FTNTFGTcrlevel=critical",
"event": {
"action": "blocked",
"category": "utm",
"code": "0211008192",
"dataset": "utm:virus",
"outcome": "success",
"reason": "File is infected."
},
"@timestamp": "2018-12-27T19:20:48Z",
"action": {
"name": "blocked",
"outcome": "success",
"outcome_reason": "File is infected.",
"target": "network-traffic",
"type": "infected - virus"
},
"destination": {
"address": "172.16.200.55",
"ip": "172.16.200.55",
"port": 80,
"user": {
"name": "bob"
}
},
"file": {
"name": "eicar.com"
},
"log": {
"level": "warning"
},
"network": {
"application": "HTTP",
"direction": "inbound",
"protocol": "http",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port11"
}
},
"ingress": {
"interface": {
"name": "port12"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"ip": [
"10.1.100.11",
"172.16.200.55"
],
"user": [
"bob"
]
},
"source": {
"address": "10.1.100.11",
"ip": "10.1.100.11",
"port": 44356
},
"url": {
"domain": "172.16.200.55",
"full": "http://172.16.200.55/virus/eicar.com",
"original": "http://172.16.200.55/virus/eicar.com",
"path": "/virus/eicar.com",
"port": 80,
"scheme": "http"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "curl",
"original": "curl/7.47.0",
"os": {
"name": "Other"
},
"version": "7.47.0"
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v5.6.0|08192|utm:virus infected blocked|4|FTNTFGTlogid=0211008192 cat=utm:virus FTNTFGTsubtype=virus FTNTFGTeventtype=infected FTNTFGTlevel=warning FTNTFGTvd=vdom1 msg=File is infected act=blocked app=HTTP externalId=56633 src=1.1.1.1 dst=2.2.2.2 spt=45719 dpt=80 deviceInboundInterface=port15 deviceOutboundInterface=port19 proto=6 deviceDirection=0 fname=eicar.com FTNTFGTchecksum=1dd02bdb FTNTFGTquarskip=No-skip cs1=EICAR_TEST_FILE cs1Label=Virus FTNTFGTdtype=Virus cs2=http://www.fortinet.com/ve?vn\\=EICAR_TEST_FILE cs2Label=Reference FTNTFGTvirusid=2172 request=http://2.2.2.2/eicar.com FTNTFGTprofile=default duser= requestClientApplication=Wget/1 10 2 FTNTFGTanalyticscksum=131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267 FTNTFGTanalyticssubmit=false FTNTFGTcrscore=50 FTNTFGTcrlevel=critical",
"event": {
"action": "blocked",
"category": "utm",
"code": "0211008192",
"dataset": "utm:virus",
"outcome": "success",
"reason": "File is infected"
},
"action": {
"name": "blocked",
"outcome": "success",
"outcome_reason": "File is infected",
"target": "network-traffic",
"type": "infected - virus"
},
"destination": {
"address": "2.2.2.2",
"ip": "2.2.2.2",
"port": 80
},
"file": {
"name": "eicar.com"
},
"log": {
"level": "warning"
},
"network": {
"application": "HTTP",
"direction": "inbound",
"protocol": "http",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port19"
}
},
"ingress": {
"interface": {
"name": "port15"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v5.6.0"
},
"related": {
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"port": 45719
},
"url": {
"domain": "2.2.2.2",
"full": "http://2.2.2.2/eicar.com",
"original": "http://2.2.2.2/eicar.com",
"path": "/eicar.com",
"port": 80,
"scheme": "http"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Wget",
"original": "Wget/1 10 2",
"os": {
"name": "Other"
},
"version": "1"
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|28704|utm:app-ctrl app-ctrl-all pass|2|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=1059028704 cat=utm:app-ctrl FTNTFGTsubtype=app-ctrl FTNTFGTeventtype=app-ctrl-all FTNTFGTlevel=information FTNTFGTvd=vdom1 FTNTFGTeventtime=1545949688 FTNTFGTappid=34050 src=10.1.100.11 dst=104.80.89.24 spt=56826 dpt=80 deviceInboundInterface=port12 FTNTFGTsrcintfrole=undefined deviceOutboundInterface=port11 FTNTFGTdstintfrole=undefined proto=6 app=HTTP deviceDirection=1 FTNTFGTpolicyid=1 externalId=12567 FTNTFGTapplist=g-default FTNTFGTappcat=Web.Client FTNTFGTapp=HTTP.BROWSER_Firefox act=pass dhost=detectportal.firefox.com FTNTFGTincidentserialno=1702350499 request=/success.txt msg=Web.Client: HTTP.BROWSER_Firefox, FTNTFGTapprisk=elevated suser=Domain\\\\alice",
"event": {
"action": "pass",
"category": "utm",
"code": "1059028704",
"dataset": "utm:app-ctrl",
"outcome": "success",
"reason": "Web.Client: HTTP.BROWSER_Firefox,"
},
"@timestamp": "2018-12-27T22:28:08Z",
"action": {
"name": "pass",
"outcome": "success",
"outcome_reason": "Web.Client: HTTP.BROWSER_Firefox,",
"target": "network-traffic",
"type": "app-ctrl-all - app-ctrl"
},
"destination": {
"address": "104.80.89.24",
"domain": "detectportal.firefox.com",
"ip": "104.80.89.24",
"port": 80
},
"log": {
"level": "information"
},
"network": {
"application": "HTTP",
"direction": "outbound",
"protocol": "http",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port11"
}
},
"ingress": {
"interface": {
"name": "port12"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"hosts": [
"detectportal.firefox.com"
],
"ip": [
"10.1.100.11",
"104.80.89.24"
],
"user": [
"alice"
]
},
"source": {
"address": "10.1.100.11",
"ip": "10.1.100.11",
"port": 56826,
"user": {
"domain": "Domain",
"name": "alice"
}
},
"url": {
"original": "/success.txt",
"path": "/success.txt"
}
}
{
"message": "date=2018-12-27,time=14:45:26,logid=\"1501054802\",type=\"dns\",subtype=\"dns-response\",level=\"notice\",vd=\"vdom1\",eventtime=1545950726,policyid=1,sessionid=13355,user=\"bob\",srcip=1.1.1.1,srcport=54621,srcintf=\"port12\",srcintfrole=\"lan\",dstip=2.2.2.2,dstport=53,dstintf=\"port11\",dstintfrole=\"wan\",proto=17,profile=\"default\",srcmac=\"00:00:00:00:00:00\",xid=5137,qname=\"detectportal.firefox.com\",qtype=\"A\",qtypeval=1,qclass=\"IN\",ipaddr=\"104.80.89.26, 104.80.89.24\",msg=\"Domain is monitored\",action=\"pass\",cat=52,catdesc=\"Information Technology\"",
"event": {
"action": "pass",
"category": "dns",
"code": "1501054802",
"dataset": "dns:dns-response",
"outcome": "success",
"reason": "Domain is monitored"
},
"@timestamp": "2018-12-27T22:45:26Z",
"action": {
"name": "pass",
"outcome": "success",
"outcome_reason": "Domain is monitored",
"target": "network-traffic",
"type": "dns-response"
},
"destination": {
"address": "2.2.2.2",
"ip": "2.2.2.2",
"port": 53
},
"dns": {
"question": {
"class": "IN",
"name": "detectportal.firefox.com",
"registered_domain": "firefox.com",
"subdomain": "detectportal",
"top_level_domain": "com",
"type": "A"
},
"rrname": "detectportal.firefox.com",
"rrtype": "A"
},
"fortinet": {
"fortigate": {
"event": {
"type": "dns"
},
"policyid": "1",
"virtual_domain": "vdom1"
}
},
"log": {
"level": "notice"
},
"network": {
"transport": "udp"
},
"observer": {
"egress": {
"interface": {
"name": "port11"
}
},
"ingress": {
"interface": {
"name": "port12"
}
}
},
"related": {
"hosts": [
"detectportal.firefox.com"
],
"ip": [
"1.1.1.1",
"2.2.2.2"
],
"user": [
"bob"
]
},
"rule": {
"category": "Information Technology"
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"mac": "00:00:00:00:00:00",
"port": 54621,
"user": {
"name": "bob"
}
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|20503|utm:emailfilter smtp log-only|2|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0508020503 cat=utm:emailfilter FTNTFGTsubtype=emailfilter FTNTFGTeventtype=smtp FTNTFGTlevel=information FTNTFGTvd=vdom1 FTNTFGTeventtime=1545939418 FTNTFGTpolicyid=1 externalId=1135 duser=bob src=10.1.100.11 spt=35969 deviceInboundInterface=port12 FTNTFGTsrcintfrole=undefined dst=172.18.62.158 dpt=25 deviceOutboundInterface=port11 FTNTFGTdstintfrole=undefined proto=6 app=SMTP FTNTFGTprofile=test-spam act=log-only suser=testpc1@qa.fortinet.com duser=test1@server88.qa.fortinet.com FTNTFGTsender=testpc1@qa.fortinet.com FTNTFGTrecipient=test1@server88.qa.fortinet.com deviceDirection=1 msg=general email log FTNTFGTsubject=hello_world2 FTNTFGTsize=216 FTNTFGTattachment=no",
"event": {
"action": "log-only",
"category": "utm",
"code": "0508020503",
"dataset": "utm:emailfilter",
"outcome": "success",
"reason": "general email log"
},
"@timestamp": "2018-12-27T19:36:58Z",
"action": {
"name": "log-only",
"outcome": "success",
"outcome_reason": "general email log",
"target": "network-traffic",
"type": "smtp - emailfilter"
},
"destination": {
"address": "172.18.62.158",
"ip": "172.18.62.158",
"port": 25,
"user": {
"name": "bob"
}
},
"log": {
"level": "information"
},
"network": {
"application": "SMTP",
"direction": "outbound",
"protocol": "smtp",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port11"
}
},
"ingress": {
"interface": {
"name": "port12"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"ip": [
"10.1.100.11",
"172.18.62.158"
],
"user": [
"bob",
"testpc1@qa.fortinet.com"
]
},
"source": {
"address": "10.1.100.11",
"ip": "10.1.100.11",
"port": 35969,
"user": {
"name": "testpc1@qa.fortinet.com"
}
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|32002|event:system login failed|7|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0100032002 cat=event:system FTNTFGTsubtype=system FTNTFGTlevel=alert FTNTFGTvd=vdom1 FTNTFGTeventtime=1545938140 FTNTFGTlogdesc=Admin login failed FTNTFGTsn=0 duser=admin1 sproc=https(172.16.200.254) FTNTFGTmethod=https src=172.16.200.254 dst=172.16.200.1 act=login outcome=failed reason=name_invalid msg=Administrator admin1 login failed from https(172.16.200.254) because of invalid user name",
"event": {
"action": "login",
"category": "event",
"code": "0100032002",
"dataset": "event:system",
"outcome": "failed",
"reason": "name_invalid"
},
"@timestamp": "2018-12-27T19:15:40Z",
"action": {
"name": "login",
"outcome": "failed",
"outcome_reason": "Administrator admin1 login failed from https(172.16.200.254) because of invalid user name",
"target": "network-traffic",
"type": "system"
},
"destination": {
"address": "172.16.200.1",
"ip": "172.16.200.1",
"user": {
"name": "admin1"
}
},
"log": {
"level": "alert"
},
"observer": {
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"ip": [
"172.16.200.1",
"172.16.200.254"
],
"user": [
"admin1"
]
},
"source": {
"address": "172.16.200.254",
"ip": "172.16.200.254"
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|43008|event:user authentication success|3|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0102043008 cat=event:user FTNTFGTsubtype=user FTNTFGTlevel=notice FTNTFGTvd=vdom1 FTNTFGTeventtime=1545938255 FTNTFGTlogdesc=Authentication success src=10.1.100.11 dst=172.16.200.55 FTNTFGTpolicyid=1 deviceInboundInterface=port12 duser=bob FTNTFGTgroup=N/A FTNTFGTauthproto=TELNET(10.1.100.11) act=authentication outcome=success reason=N/A msg=User bob succeeded in authentication",
"event": {
"action": "authentication",
"category": "event",
"code": "0102043008",
"dataset": "event:user",
"outcome": "success",
"reason": "User bob succeeded in authentication"
},
"@timestamp": "2018-12-27T19:17:35Z",
"action": {
"name": "authentication",
"outcome": "success",
"outcome_reason": "User bob succeeded in authentication",
"target": "network-traffic",
"type": "user"
},
"destination": {
"address": "172.16.200.55",
"ip": "172.16.200.55",
"user": {
"name": "bob"
}
},
"log": {
"level": "notice"
},
"observer": {
"ingress": {
"interface": {
"name": "port12"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"ip": [
"10.1.100.11",
"172.16.200.55"
],
"user": [
"bob"
]
},
"source": {
"address": "10.1.100.11",
"ip": "10.1.100.11"
}
}
{
"message": "time=11:09:50 devname=\"abc\" devid=\"1\" logid=\"1059028704\" type=\"utm\" subtype=\"app-ctrl\" eventtype=\"app-ctrl-all\" level=\"information\" vd=\"root\" eventtime=1579860590 appid=40568 srcip=1.1.1.1 dstip=2.2.2.2 srcport=33345 dstport=443 srcintf=\"test\" srcintfrole=\"undefined\" dstintf=\"port1\" dstintfrole=\"undefined\" proto=6 service=\"HTTPS\" direction=\"outgoing\" policyid=1 sessionid=1508480438 applist=\"default\" appcat=\"Web.Client\" app=\"HTTPS.BROWSER\" action=\"pass\" hostname=\"abcd\" incidentserialno=455926217 url=\"/\" msg=\"Web.Client: HTTPS.BROWSER,\" apprisk=\"medium\"",
"event": {
"action": "pass",
"category": "utm",
"code": "1059028704",
"dataset": "utm:app-ctrl",
"outcome": "success",
"reason": "Web.Client: HTTPS.BROWSER,"
},
"@timestamp": "2020-01-24T10:09:50Z",
"action": {
"name": "pass",
"outcome": "success",
"outcome_reason": "Web.Client: HTTPS.BROWSER,",
"target": "network-traffic",
"type": "app-ctrl"
},
"destination": {
"address": "2.2.2.2",
"domain": "abcd",
"ip": "2.2.2.2",
"port": 443
},
"fortinet": {
"fortigate": {
"apprisk": "medium",
"event": {
"type": "utm"
},
"policyid": "1",
"virtual_domain": "root"
}
},
"host": {
"name": "abc"
},
"log": {
"hostname": "abc",
"level": "information"
},
"network": {
"application": "HTTPS.BROWSER",
"protocol": "https",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port1"
}
},
"hostname": "abc",
"ingress": {
"interface": {
"name": "test"
}
},
"serial_number": "1"
},
"related": {
"hosts": [
"abc",
"abcd"
],
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"rule": {
"apprisk": "medium",
"category": "Web.Client",
"ruleset": "default"
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"port": 33345
},
"url": {
"original": "/",
"path": "/"
}
}
{
"message": " time=15:22:43 devname=\"abc\" devid=\"1\" logid=\"0000000011\" type=\"traffic\" subtype=\"forward\" level=\"warning\" vd=\"root\" eventtime=1602591763587868496 tz=\"+0300\" srcip=1.1.1.1 identifier=256 srcintf=\"internal\" srcintfrole=\"lan\" dstip=2.2.2.2 dstintf=\"wan1\" dstintfrole=\"wan\" srcuuid=\"b22e6ef4-2e38-51ea-72c9-53b2da2e20f5\" dstuuid=\"052bdbce-823a-51e9-eb23-7a3e819fea4f\" poluuid=\"1520e1aa-823a-51e9-984f-a55e1f39b3c7\" sessionid=706677975 proto=1 action=\"ip-conn\" policyid=1 policytype=\"policy\" service=\"icmp/0/8\" dstcountry=\"Netherlands\" srccountry=\"Reserved\" appcat=\"unscanned\" crscore=5 craction=262144 crlevel=\"low\"",
"event": {
"action": "ip-conn",
"category": "traffic",
"code": "0000000011",
"dataset": "traffic:forward",
"outcome": "success",
"timezone": "+0300"
},
"@timestamp": "2020-10-13T12:22:43.587868Z",
"action": {
"name": "ip-conn",
"outcome": "success",
"target": "network-traffic",
"type": "forward"
},
"destination": {
"address": "2.2.2.2",
"ip": "2.2.2.2"
},
"fortinet": {
"fortigate": {
"event": {
"type": "traffic"
},
"policyid": "1",
"poluuid": "1520e1aa-823a-51e9-984f-a55e1f39b3c7",
"virtual_domain": "root"
}
},
"host": {
"name": "abc"
},
"log": {
"hostname": "abc",
"level": "warning"
},
"network": {
"protocol": "icmp/0/8",
"transport": "icmp"
},
"observer": {
"egress": {
"interface": {
"name": "wan1"
}
},
"hostname": "abc",
"ingress": {
"interface": {
"name": "internal"
}
},
"serial_number": "1"
},
"related": {
"hosts": [
"abc"
],
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"rule": {
"category": "unscanned",
"ruleset": "policy"
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1"
}
}
{
"message": " time=13:02:14 devname=\"abc\" devid=\"1\" logid=\"0001000014\" type=\"traffic\" subtype=\"local\" level=\"notice\" vd=\"root\" eventtime=1602586934900309053 tz=\"+0200\" srcip=00::00:00:00:00 identifier=0 srcintf=\"AVR-GUEST-AP\" srcintfrole=\"lan\" dstip=12::16 dstintf=\"unknown0\" dstintfrole=\"undefined\" sessionid=1395131 proto=58 action=\"accept\" policyid=0 policytype=\"local-in-policy6\" service=\"icmp6/143/0\" trandisp=\"noop\" app=\"icmp6/143/0\" duration=60 sentbyte=76 rcvdbyte=0 sentpkt=1 rcvdpkt=0 appcat=\"unscanned\"",
"event": {
"action": "accept",
"category": "traffic",
"code": "0001000014",
"dataset": "traffic:local",
"outcome": "success",
"timezone": "+0200"
},
"@timestamp": "2020-10-13T11:02:14.900309Z",
"action": {
"name": "accept",
"outcome": "success",
"target": "network-traffic",
"type": "local"
},
"destination": {
"address": "12::16",
"bytes": 0,
"ip": "12::16",
"packets": 0
},
"fortinet": {
"fortigate": {
"event": {
"type": "traffic"
},
"policyid": "0",
"virtual_domain": "root"
}
},
"host": {
"name": "abc"
},
"log": {
"hostname": "abc",
"level": "notice"
},
"network": {
"application": "icmp6/143/0",
"bytes": 76,
"protocol": "icmp6/143/0",
"transport": "ipv6-icmp"
},
"observer": {
"egress": {
"interface": {
"name": "unknown0"
}
},
"hostname": "abc",
"ingress": {
"interface": {
"name": "AVR-GUEST-AP"
}
},
"serial_number": "1"
},
"related": {
"hosts": [
"abc"
],
"ip": [
"12::16",
"::"
]
},
"rule": {
"category": "unscanned",
"ruleset": "local-in-policy6"
},
"source": {
"address": "::",
"bytes": 76,
"ip": "::",
"packets": 1
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.10|00014|traffic:local accept|3|deviceExternalId=FGVM2V0000171868 FortinetFortiGatelogid=0001000014 cat=traffic:local FortinetFortiGatesubtype=local FortinetFortiGatelevel=notice FortinetFortiGatevd=root FortinetFortiGateeventtime=1602663098 src=1.1.1.1 deviceInboundInterface=port1 FortinetFortiGatesrcintfrole=undefined dst=2.2.2.2 deviceOutboundInterface=root FortinetFortiGatedstintfrole=undefined externalId=4887198 proto=1 FortinetFortiGateaction=accept FortinetFortiGatepolicyid=0 FortinetFortiGatepolicytype=local-in-policy app=icmp/8/0 FortinetFortiGatedstcountry=Reserved FortinetFortiGatesrccountry=China FortinetFortiGatetrandisp=noop FortinetFortiGateapp=icmp/8/0 FortinetFortiGateduration=61 out=84 in=84 FortinetFortiGatesentpkt=1 FortinetFortiGatercvdpkt=1 FortinetFortiGateappcat=unscanned",
"event": {
"action": "accept",
"category": "traffic",
"code": "0001000014",
"dataset": "traffic:local",
"outcome": "success"
},
"@timestamp": "2020-10-14T08:11:38Z",
"action": {
"name": "accept",
"outcome": "success",
"target": "network-traffic",
"type": "local"
},
"destination": {
"address": "2.2.2.2",
"bytes": 84,
"ip": "2.2.2.2",
"packets": 1
},
"log": {
"level": "notice"
},
"network": {
"application": "icmp/8/0",
"bytes": 168,
"protocol": "icmp/8/0",
"transport": "icmp"
},
"observer": {
"egress": {
"interface": {
"name": "root"
}
},
"ingress": {
"interface": {
"name": "port1"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.10"
},
"related": {
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"source": {
"address": "1.1.1.1",
"bytes": 84,
"ip": "1.1.1.1",
"packets": 1
}
}
{
"message": " time=14:22:37 devname=\"abc\" devid=\"1\" logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"ROUTER\" eventtime=1602591758311908837 tz=\"+0200\" srcip=1.1.1.1 identifier=29027 srcintf=\"test1\" srcintfrole=\"undefined\" dstip=2.2.2.2 dstintf=\"test\" dstintfrole=\"undefined\" sessionid=3558919660 proto=1 action=\"accept\" policyid=637 policytype=\"policy\" poluuid=\"b23818a6-8f49-51ea-9db7-4e4965a3483c\" service=\"PING\" dstcountry=\"Reserved\" srccountry=\"Reserved\" trandisp=\"noop\" duration=64 sentbyte=420 rcvdbyte=420 sentpkt=5 rcvdpkt=5 appcat=\"unscanned\"",
"event": {
"action": "accept",
"category": "traffic",
"code": "0000000013",
"dataset": "traffic:forward",
"outcome": "success",
"timezone": "+0200"
},
"@timestamp": "2020-10-13T12:22:38.311909Z",
"action": {
"name": "accept",
"outcome": "success",
"target": "network-traffic",
"type": "forward"
},
"destination": {
"address": "2.2.2.2",
"bytes": 420,
"ip": "2.2.2.2",
"packets": 5
},
"fortinet": {
"fortigate": {
"event": {
"type": "traffic"
},
"policyid": "637",
"poluuid": "b23818a6-8f49-51ea-9db7-4e4965a3483c",
"virtual_domain": "ROUTER"
}
},
"host": {
"name": "abc"
},
"log": {
"hostname": "abc",
"level": "notice"
},
"network": {
"bytes": 840,
"protocol": "ping",
"transport": "icmp"
},
"observer": {
"egress": {
"interface": {
"name": "test"
}
},
"hostname": "abc",
"ingress": {
"interface": {
"name": "test1"
}
},
"serial_number": "1"
},
"related": {
"hosts": [
"abc"
],
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"rule": {
"category": "unscanned",
"ruleset": "policy"
},
"source": {
"address": "1.1.1.1",
"bytes": 420,
"ip": "1.1.1.1",
"packets": 5
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.4|32021|event:system login failed|7|deviceExternalId=FGVM2V0000171868 FortinetFortiGatelogid=0100032021 cat=event:system FortinetFortiGatesubtype=system FortinetFortiGatelevel=alert FortinetFortiGatevd=root FortinetFortiGateeventtime=1579172447 FortinetFortiGatelogdesc=Admin login disabled sproc=1.1.1.1 FortinetFortiGateaction=login outcome=failed reason=exceed_limit msg=Login disabled from IP 1.1.1.1 for 60 seconds because of 3 bad attempts",
"event": {
"action": "login",
"category": "event",
"code": "0100032021",
"dataset": "event:system",
"outcome": "failed",
"reason": "exceed_limit"
},
"@timestamp": "2020-01-16T11:00:47Z",
"action": {
"name": "login",
"outcome": "failed",
"outcome_reason": "Login disabled from IP 1.1.1.1 for 60 seconds because of 3 bad attempts",
"target": "network-traffic",
"type": "system"
},
"log": {
"level": "alert"
},
"observer": {
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.4"
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.10|39943|event:vpn ssl-new-con|2|deviceExternalId=FGT3HD3916803645 FTNTFGTlogid=0101039943 cat=event:vpn FTNTFGTsubtype=vpn FTNTFGTlevel=information FTNTFGTvd=root FTNTFGTeventtime=1637338258 FTNTFGTlogdesc=SSL VPN new connection act=ssl-new-con FTNTFGTtunneltype=ssl FTNTFGTtunnelid=0 dst=2.2.2.2 duser=N/A FTNTFGTgroup=N/A FTNTFGTdst_host=N/A reason=N/A msg=SSL new connection",
"event": {
"action": "ssl-new-con",
"category": "event",
"code": "0101039943",
"dataset": "event:vpn",
"outcome": "success",
"reason": "SSL new connection"
},
"@timestamp": "2021-11-19T16:10:58Z",
"action": {
"name": "ssl-new-con",
"outcome": "success",
"outcome_reason": "SSL new connection",
"target": "network-traffic",
"type": "vpn"
},
"destination": {
"address": "2.2.2.2",
"ip": "2.2.2.2"
},
"log": {
"level": "information"
},
"observer": {
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.10"
},
"related": {
"ip": [
"2.2.2.2"
]
}
}
{
"message": "timestamp=1698046849 devname=\"abc\" devid=\"1\" vd=\"root\" date=2023-10-23 time=00:40:49 eventtime=1698046849852012802 tz=\"-0700\" logid=\"0101037130\" type=\"utm\" subtype=\"ips\" eventtype=\"signature\" level=\"alert\" severity=\"low\" srcip=1.2.3.4 srccountry=\"Reserved\" dstip=4.5.6.7 dstcountry=\"Reserved\" srcintf=\"port2\" srcintfrole=\"undefined\" dstintf=\"port2\" dstintfrole=\"undefined\" sessionid=1234567890 action=\"detected\" proto=6 service=\"HTTP\" policyid=494 poluuid=\"aecacfaf-8d3f-4809-a60f-bf873e0fcab3\" policytype=\"policy\" attack=\"Qualys.Vulnerability.Scanner\" srcport=37364 dstport=80 hostname=\"10.20.30.40\" url=\"/cgi/rocket.pl?var1=alpha\" direction=\"outgoing\" attackid=45660 profile=\"Example_IPS\" ref=\"http://www.fortinet.com/ids/VID45660\" incidentserialno=1234567 msg=\"tools: Qualys.Vulnerability.Scanner\" crscore=5 craction=32768 crlevel=\"low\"\n",
"event": {
"action": "detected",
"category": "utm",
"code": "0101037130",
"outcome": "success",
"reason": "tools: Qualys.Vulnerability.Scanner",
"timezone": "-0700"
},
"@timestamp": "2023-10-23T07:40:49Z",
"action": {
"name": "detected",
"outcome": "success",
"outcome_reason": "tools: Qualys.Vulnerability.Scanner",
"target": "network-traffic",
"type": "ips"
},
"destination": {
"address": "4.5.6.7",
"domain": "10.20.30.40",
"ip": "4.5.6.7",
"port": 80
},
"fortinet": {
"fortigate": {
"attack": {
"id": "45660",
"name": "Qualys.Vulnerability.Scanner"
},
"event": {
"severity": "low",
"type": "utm"
},
"policyid": "494",
"poluuid": "aecacfaf-8d3f-4809-a60f-bf873e0fcab3",
"virtual_domain": "root"
}
},
"host": {
"name": "abc"
},
"log": {
"hostname": "abc",
"level": "alert"
},
"network": {
"protocol": "http",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port2"
}
},
"hostname": "abc",
"ingress": {
"interface": {
"name": "port2"
}
},
"serial_number": "1"
},
"related": {
"hosts": [
"10.20.30.40",
"abc"
],
"ip": [
"1.2.3.4",
"4.5.6.7"
]
},
"rule": {
"ruleset": "policy"
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 37364
},
"url": {
"original": "/cgi/rocket.pl?var1=alpha",
"path": "/cgi/rocket.pl",
"query": "var1=alpha"
}
}
{
"message": "time=08:20:44 devname=\"computer-039482\" devid=\"C10382849\" eventtime=1669620044749365658 tz=\"+0100\" logid=\"0000000020\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"root\" srcip=1.2.3.4 srcname=\"C-3424\" srcport=52272 srcintf=\"ID102\" srcintfrole=\"lan\" dstip=5.6.7.8 dstport=443 dstintf=\"ID015\" dstintfrole=\"wan\" srcuuid=\"ccd49675-9207-46cf-9c4b-8d522c2b977e\" srccountry=\"Reserved\" dstinetsvc=\"Microsoft-Office365.Published\" dstcountry=\"France\" dstregion=\"Ile-de-France\" dstcity=\"Paris\" dstreputation=5 sessionid=111111111 proto=6 action=\"accept\" policyid=37 policytype=\"policy\" poluuid=\"6a8f76d0-1459-4ddb-948a-62700ddbf241\" service=\"Microsoft-Office365.Published\" trandisp=\"snat\" transip=4.3.2.1 transport=52272 duration=258 sentbyte=160972 rcvdbyte=58449 sentpkt=333 rcvdpkt=192 vwlid=8 vwlquality=\"Seq_num(13 ID015), alive, custom1: 78.211: 0.000% 7.754 0.067 897379Kbps, selected\" vwlname=\"TO-INTERNET\" appcat=\"unscanned\" sentdelta=31328 rcvddelta=10476 srchwvendor=\"Dell\" devtype=\"Home & Office\" srcfamily=\"Computer\" osname=\"Windows\" srcswversion=\"10\" unauthuser=\"DOMAIN\\jdoe\" unauthusersource=\"kerberos\" mastersrcmac=\"00:00:00:00:00:00\" srcmac=\"00:00:00:00:00:00\" srcserver=0",
"event": {
"action": "accept",
"category": "traffic",
"code": "0000000020",
"dataset": "traffic:forward",
"outcome": "success",
"timezone": "+0100"
},
"@timestamp": "2022-11-28T07:20:44.749366Z",
"action": {
"name": "accept",
"outcome": "success",
"target": "network-traffic",
"type": "forward"
},
"destination": {
"address": "5.6.7.8",
"bytes": 58449,
"ip": "5.6.7.8",
"packets": 192,
"port": 443
},
"fortinet": {
"fortigate": {
"event": {
"type": "traffic"
},
"policyid": "37",
"poluuid": "6a8f76d0-1459-4ddb-948a-62700ddbf241",
"user": {
"source": "kerberos"
},
"virtual_domain": "root"
}
},
"host": {
"name": "C-3424",
"os": {
"family": "Windows"
}
},
"log": {
"hostname": "computer-039482",
"level": "notice"
},
"network": {
"bytes": 219421,
"protocol": "microsoft-office365.published",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "ID015"
}
},
"hostname": "computer-039482",
"ingress": {
"interface": {
"name": "ID102"
}
},
"serial_number": "C10382849"
},
"related": {
"hosts": [
"computer-039482"
],
"ip": [
"1.2.3.4",
"5.6.7.8"
],
"user": [
"jdoe"
]
},
"rule": {
"category": "unscanned",
"ruleset": "policy"
},
"source": {
"address": "1.2.3.4",
"bytes": 160972,
"ip": "1.2.3.4",
"mac": "00:00:00:00:00:00",
"packets": 333,
"port": 52272
},
"user": {
"domain": "DOMAIN",
"name": "jdoe"
}
}
{
"message": "CEF:0|Fortinet|FortiGate-1000C|5.6.14,build1727 (GA)|0000000020|forward traffic accept|5|start=Oct 12 2022 12:50:31 logver=506141727 deviceExternalId=FGT123 dvchost=FW-123 ad.vd=root ad.logid=0000000020 cat=traffic ad.subtype=forward deviceSeverity=notice ad.eventtime=1665571831 src=1.1.1.1 spt=55390 deviceInboundInterface=abc ad.srcintfrole=undefined dst=2.2.2.2 dpt=1522 deviceOutboundInterface=efg ad.dstintfrole=lan foo.poluuid=ec6ff8fe-5e41-51ec-bcbe-9e5484033dc8 externalID=3812440508 proto=6 act=accept ad.policyid=185 ad.policytype=policy app=SQLNET-1522 ad.dstcountry=Reserved ad.srccountry=Reserved ad.trandisp=noop ad.duration=268 out=202 in=52 ad.sentpkt=3 ad.rcvdpkt=1 ad.appcat=unscanned ad.sentdelta=0 ad.rcvddelta=0 tz=\"+0200\"",
"event": {
"action": "accept",
"category": "traffic",
"code": "0000000020",
"dataset": "traffic",
"outcome": "success",
"timezone": "+0200"
},
"@timestamp": "2022-10-12T10:50:31Z",
"action": {
"name": "accept",
"outcome": "success",
"target": "network-traffic"
},
"destination": {
"address": "2.2.2.2",
"bytes": 202,
"ip": "2.2.2.2",
"port": 1522
},
"network": {
"application": "SQLNET-1522",
"bytes": 254,
"protocol": "sqlnet-1522",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "efg"
}
},
"ingress": {
"interface": {
"name": "abc"
}
},
"type": "FortiGate-1000C",
"vendor": "Fortinet",
"version": "5.6.14,build1727 (GA)"
},
"related": {
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"source": {
"address": "1.1.1.1",
"bytes": 52,
"ip": "1.1.1.1",
"port": 55390
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.4|00013|traffic:forward timeout|3|deviceExternalId=FGVM2V0000171868 FortinetFortiGatelogid=0000000013 cat=traffic:forward FortinetFortiGatesubtype=forward FortinetFortiGatelevel=notice FortinetFortiGatevd=root FortinetFortiGateeventtime=1572471876 src=1.1.1.1 spt=49260 deviceInboundInterface=port1 FortinetFortiGatesrcintfrole=undefined dst=3.3.3.3 dpt=80 deviceOutboundInterface=port2 FortinetFortiGatedstintfrole=undefined FortinetFortiGatepoluuid=bafe134e-c0ad-51e8-ed9c-52f798dd69d4 externalId=12812952 proto=6 FortinetFortiGateaction=timeout FortinetFortiGatepolicyid=1 FortinetFortiGatepolicytype=policy app=HTTP FortinetFortiGatedstcountry=Reserved FortinetFortiGatesrccountry=United States FortinetFortiGatetrandisp=dnat destinationTranslatedAddress=2.2.2.2 destinationTranslatedPort=80 FortinetFortiGateduration=20 out=48 in=144 FortinetFortiGatesentpkt=1 FortinetFortiGatercvdpkt=3 FortinetFortiGateappcat=unscanned FortinetFortiGatecrscore=5 FortinetFortiGatecraction=262144 FortinetFortiGatecrlevel=low",
"event": {
"action": "timeout",
"category": "traffic",
"code": "0000000013",
"dataset": "traffic:forward",
"outcome": "success"
},
"@timestamp": "2019-10-30T21:44:36Z",
"action": {
"name": "timeout",
"outcome": "success",
"target": "network-traffic",
"type": "forward"
},
"destination": {
"address": "3.3.3.3",
"bytes": 48,
"ip": "3.3.3.3",
"nat": {
"ip": "2.2.2.2",
"port": 80
},
"packets": 3,
"port": 80
},
"log": {
"level": "notice"
},
"network": {
"application": "HTTP",
"bytes": 192,
"protocol": "http",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port2"
}
},
"ingress": {
"interface": {
"name": "port1"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.4"
},
"related": {
"ip": [
"1.1.1.1",
"2.2.2.2",
"3.3.3.3"
]
},
"source": {
"address": "1.1.1.1",
"bytes": 144,
"ip": "1.1.1.1",
"packets": 1,
"port": 49260
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|00013|traffic:forward close|3|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0000000013 cat=traffic:forward FTNTFGTsubtype=forward FTNTFGTlevel=notice FTNTFGTvd=vdom1 FTNTFGTeventtime=1545937675 src=10.1.100.11 spt=54190 deviceInboundInterface=port12 FTNTFGTsrcintfrole=undefined dst=52.53.140.235 dpt=443 deviceOutboundInterface=port11 FTNTFGTdstintfrole=undefined FTNTFGTpoluuid=c2d460aa-fe6f-51e8-9505-41b5117dfdd4 externalId=402 proto=6 act=close FTNTFGTpolicyid=1 FTNTFGTpolicytype=policy app=HTTPS FTNTFGTdstcountry=United States FTNTFGTsrccountry=Reserved FTNTFGTtrandisp=snat sourceTranslatedAddress=172.16.200.1 sourceTranslatedPort=54190 FTNTFGTappid=40568 FTNTFGTapp=HTTPS.BROWSER FTNTFGTappcat=Web.Client FTNTFGTapprisk=medium FTNTFGTapplist=g-default FTNTFGTduration=2 out=3652 in=146668 FTNTFGTsentpkt=58 FTNTFGTrcvdpkt=105 FTNTFGTutmaction=allow FTNTFGTcountapp=2",
"event": {
"action": "close",
"category": "traffic",
"code": "0000000013",
"dataset": "traffic:forward",
"outcome": "success"
},
"@timestamp": "2018-12-27T19:07:55Z",
"action": {
"name": "close",
"outcome": "success",
"target": "network-traffic",
"type": "forward"
},
"destination": {
"address": "52.53.140.235",
"bytes": 3652,
"ip": "52.53.140.235",
"port": 443
},
"log": {
"level": "notice"
},
"network": {
"application": "HTTPS",
"bytes": 150320,
"protocol": "https",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port11"
}
},
"ingress": {
"interface": {
"name": "port12"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"ip": [
"10.1.100.11",
"172.16.200.1",
"52.53.140.235"
]
},
"source": {
"address": "10.1.100.11",
"bytes": 146668,
"ip": "10.1.100.11",
"nat": {
"ip": "172.16.200.1",
"port": 54190
},
"packets": 58,
"port": 54190
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v5.6.0|00013|traffic:forward close|3|FTNTFGTlogid=0000000013 cat=traffic:forward FTNTFGTsubtype=forward FTNTFGTlevel=notice FTNTFGTvd=vdom1 src=2.2.2.2 shost=2.2.2.2 spt=45719 deviceInboundInterface=port15 dst=3.3.3.3 dhost=3.3.3.3 dpt=80 deviceOutboundInterface=port19 FTNTFGTpoluuid=61c4243a-34ba-51e5-c32a-3859389a5162 externalId=56633 proto=6 act=close cs5=10 cs5Label=Policy Id FTNTFGTdstcountry=Reserved FTNTFGTsrccountry=Reserved FTNTFGTtrandisp=snat sourceTranslatedAddress=1.1.1.1 sourceTranslatedPort=45719 app=HTTP FTNTFGTappid=38783 FTNTFGTapp=Wget.Like FTNTFGTappcat=General.Interest FTNTFGTapprisk=low FTNTFGTapplist=default FTNTFGTappact=detected cn1=7 cn1Label=Duration out=398 in=1605 cn2=5 cn2Label=Packets Sent cn3=5 cn3Label=Packets Received FTNTFGTutmaction=block FTNTFGTcountav=1 FTNTFGTcountapp=1 FTNTFGTcrscore=50 FTNTFGTcraction=2",
"event": {
"action": "close",
"category": "traffic",
"code": "0000000013",
"dataset": "traffic:forward",
"outcome": "success"
},
"action": {
"name": "close",
"outcome": "success",
"target": "network-traffic",
"type": "forward"
},
"destination": {
"address": "3.3.3.3",
"bytes": 398,
"domain": "3.3.3.3",
"ip": "3.3.3.3",
"packets": 5,
"port": 80
},
"log": {
"level": "notice"
},
"network": {
"application": "HTTP",
"bytes": 2003,
"protocol": "http",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port19"
}
},
"ingress": {
"interface": {
"name": "port15"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v5.6.0"
},
"related": {
"hosts": [
"2.2.2.2",
"3.3.3.3"
],
"ip": [
"1.1.1.1",
"2.2.2.2",
"3.3.3.3"
]
},
"source": {
"address": "2.2.2.2",
"bytes": 1605,
"domain": "2.2.2.2",
"ip": "2.2.2.2",
"nat": {
"ip": "1.1.1.1",
"port": 45719
},
"packets": 5,
"port": 45719
}
}
{
"message": "date=2018-07-26,time=16:51:36,logid=\"0000000013\",type=\"traffic\",subtype=\"forward\",level=\"notice\",vd=\"root\",eventtime=1532616695,srcip=1.1.1.1,srcport=10016,srcintf=\"test\",srcintfrole=\"undefined\",dstip=2.2.2.2,dstport=20,dstintf=\"dmz1\",dstintfrole=\"dmz\",sessionid=10006,proto=6,action=\"accept\",policyid=1,policytype=\"policy\",service=\"tcp/20\",dstcountry=\"France\",srccountry=\"United States\",trandisp=\"noop\",appid=35421,app=\"application\",appcat=\"Storage.Backup\",apprisk=\"medium\",applist=\"default\",duration=10,sentbyte=2000,rcvdbyte=1000,sentpkt=0,rcvdpkt=0,utmaction=\"allow\",countapp=1,devtype=\"iPad\",osname=\"Apple\",osversion=\"ver\",mastersrcmac=\"01:01:01:01:01:01\",srcmac=\"01:01:01:01:01:01\",srcserver=0,dstdevtype=\"Android Phone\",dstosname=\"Android\",dstosversion=\"ver\",masterdstmac=\"00:00:00:00:00:00\",dstmac=\"00:00:00:00:00:00\",dstserver=0,utmref=65491-194",
"event": {
"action": "accept",
"category": "traffic",
"code": "0000000013",
"dataset": "traffic:forward",
"outcome": "success"
},
"@timestamp": "2018-07-26T14:51:35Z",
"action": {
"name": "accept",
"outcome": "success",
"target": "network-traffic",
"type": "forward"
},
"destination": {
"address": "2.2.2.2",
"bytes": 1000,
"ip": "2.2.2.2",
"mac": "00:00:00:00:00:00",
"packets": 0,
"port": 20
},
"fortinet": {
"fortigate": {
"apprisk": "medium",
"event": {
"type": "traffic"
},
"policyid": "1",
"virtual_domain": "root"
}
},
"host": {
"os": {
"family": "Apple"
}
},
"log": {
"level": "notice"
},
"network": {
"application": "application",
"bytes": 3000,
"protocol": "tcp/20",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "dmz1"
}
},
"ingress": {
"interface": {
"name": "test"
}
}
},
"related": {
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"rule": {
"apprisk": "medium",
"category": "Storage.Backup",
"ruleset": "default"
},
"source": {
"address": "1.1.1.1",
"bytes": 2000,
"ip": "1.1.1.1",
"mac": "01:01:01:01:01:01",
"packets": 0,
"port": 10016
}
}
{
"message": "date=2018-07-26 time=16:51:36 logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"root\" eventtime=1532616695 srcip=1.1.1.1 srcport=10016 srcintf=\"test\" srcintfrole=\"undefined\" dstip=2.2.2.2 dstport=20 dstintf=\"test1\" dstintfrole=\"dmz\" sessionid=10006 proto=6 action=\"accept\" policyid=1 policytype=\"policy\" service=\"tcp/20\" dstcountry=\"France\" srccountry=\"United States\" trandisp=\"noop\" appid=35421 app=\"Dropbox_File.Download\" appcat=\"Storage.Backup\" apprisk=\"medium\" applist=\"default\" duration=10 sentbyte=2000 rcvdbyte=1000 sentpkt=0 rcvdpkt=0 utmaction=\"allow\" countapp=1 devtype=\"iPad\" osname=\"Apple\" osversion=\"ver\" mastersrcmac=\"01:01:01:01:01:01\" srcmac=\"01:01:01:01:01:01\" srcserver=0 dstdevtype=\"Android Phone\" dstosname=\"Android\" dstosversion=\"ver\" masterdstmac=\"00:00:00:00:00:00\" dstmac=\"00:00:00:00:00:00\" dstserver=0 utmref=65491-194",
"event": {
"action": "accept",
"category": "traffic",
"code": "0000000013",
"dataset": "traffic:forward",
"outcome": "success"
},
"@timestamp": "2018-07-26T14:51:35Z",
"action": {
"name": "accept",
"outcome": "success",
"target": "network-traffic",
"type": "forward"
},
"destination": {
"address": "2.2.2.2",
"bytes": 1000,
"ip": "2.2.2.2",
"mac": "00:00:00:00:00:00",
"packets": 0,
"port": 20
},
"fortinet": {
"fortigate": {
"apprisk": "medium",
"event": {
"type": "traffic"
},
"policyid": "1",
"virtual_domain": "root"
}
},
"host": {
"os": {
"family": "Apple"
}
},
"log": {
"level": "notice"
},
"network": {
"application": "Dropbox_File.Download",
"bytes": 3000,
"protocol": "tcp/20",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "test1"
}
},
"ingress": {
"interface": {
"name": "test"
}
}
},
"related": {
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"rule": {
"apprisk": "medium",
"category": "Storage.Backup",
"ruleset": "default"
},
"source": {
"address": "1.1.1.1",
"bytes": 2000,
"ip": "1.1.1.1",
"mac": "01:01:01:01:01:01",
"packets": 0,
"port": 10016
}
}
{
"message": "date=2021-06-21 time=09:38:29 devname=\"abc\" devid=\"1\" logid=\"0000000010\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"PRX1-AA\" eventtime=1624261109 srcip=1.1.1.1 srcport=50592 srcintf=\"port2\" srcintfrole=\"dmz\" dstip=2.2.2.2 dstport=443 dstintf=\"test\" dstintfrole=\"wan\" sessionid=1224900441 poluuid=\"1eb429d4-ff52-51ea-d119-d1db60e409a6\" dstcountry=\"United Kingdom\" srccountry=\"Reserved\" service=\"HTTPS\" wanoptapptype=\"web-proxy\" proto=6 action=\"accept\" duration=37 policyid=1 policytype=\"proxy-policy\" wanin=5851 rcvdbyte=5851 wanout=2523 lanin=2769 sentbyte=2769 lanout=5923 appcat=\"unscanned\" utmaction=\"allow\" countweb=1",
"event": {
"action": "accept",
"category": "traffic",
"code": "0000000010",
"dataset": "traffic:forward",
"outcome": "success"
},
"@timestamp": "2021-06-21T07:38:29Z",
"action": {
"name": "accept",
"outcome": "success",
"target": "network-traffic",
"type": "forward"
},
"destination": {
"address": "2.2.2.2",
"bytes": 5851,
"ip": "2.2.2.2",
"port": 443
},
"fortinet": {
"fortigate": {
"event": {
"type": "traffic"
},
"policyid": "1",
"poluuid": "1eb429d4-ff52-51ea-d119-d1db60e409a6",
"virtual_domain": "PRX1-AA"
}
},
"host": {
"name": "abc"
},
"log": {
"hostname": "abc",
"level": "notice"
},
"network": {
"bytes": 8620,
"protocol": "https",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "test"
}
},
"hostname": "abc",
"ingress": {
"interface": {
"name": "port2"
}
},
"serial_number": "1"
},
"related": {
"hosts": [
"abc"
],
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"rule": {
"category": "unscanned",
"ruleset": "proxy-policy"
},
"source": {
"address": "1.1.1.1",
"bytes": 2769,
"ip": "1.1.1.1",
"port": 50592
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.4.9|00011|traffic:forward dns|4|deviceExternalId=FG5H0ETB19909686 FTNTFGTeventtime=1662381825920035319 FTNTFGTtz=+0200 FTNTFGTlogid=0000000011 cat=traffic:forward FTNTFGTsubtype=forward FTNTFGTlevel=warning FTNTFGTvd=root src=172.16.222.150 spt=49956 deviceInboundInterface=port1 FTNTFGTsrcintfrole=wan dst=172.18.67.10 dpt=53 deviceOutboundInterface=RWC FRANCE 2023 FTNTFGTdstintfrole=lan FTNTFGTsrccountry=Reserved FTNTFGTdstcountry=Reserved externalId=1797928567 proto=17 act=dns FTNTFGTpolicyid=30 FTNTFGTpolicytype=policy FTNTFGTpoluuid=6c8b6672-0b92-51ea-95a0-556c3c0fdb8f FTNTFGTpolicyname=CLT-RWC2023-001 FTNTFGTcentralnatid=6 app=DNS FTNTFGTappcat=unscanned FTNTFGTcrscore=5 FTNTFGTcraction=262144 FTNTFGTcrlevel=low FTNTFGTdsthwvendor=VMware FTNTFGTdstdevtype=Server FTNTFGTdstfamily=Virtual Machine FTNTFGTdstosname=Windows FTNTFGTdsthwversion=Workstation Pro FTNTFGTdstswversion=7 FTNTFGTmasterdstmac=00:50:56:86:7a:ab FTNTFGTdstmac=00:50:56:86:7a:ab FTNTFGTdstserver=0",
"event": {
"action": "dns",
"category": "traffic",
"code": "0000000011",
"dataset": "traffic:forward",
"outcome": "success",
"timezone": "+0200"
},
"@timestamp": "2022-09-05T12:43:45.920035Z",
"action": {
"name": "dns",
"outcome": "success",
"target": "network-traffic",
"type": "forward"
},
"destination": {
"address": "172.18.67.10",
"ip": "172.18.67.10",
"port": 53
},
"log": {
"level": "warning"
},
"network": {
"application": "DNS",
"protocol": "dns",
"transport": "udp"
},
"observer": {
"egress": {
"interface": {
"name": "RWC FRANCE 2023"
}
},
"ingress": {
"interface": {
"name": "port1"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.4.9"
},
"related": {
"ip": [
"172.16.222.150",
"172.18.67.10"
]
},
"source": {
"address": "172.16.222.150",
"ip": "172.16.222.150",
"port": 49956
}
}
{
"message": "date=2018-07-26 time=14:56:21 devname=\"abc\" devid=\"1\" logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"root\" eventtime=1609941381 srcip=1.1.1.1 srcport=52125 srcintf=\"port9\" srcintfrole=\"undefined\" dstip=3.3.3.3 dstport=3727 dstintf=\"port10\" dstintfrole=\"undefined\" poluuid=\"d77c53b2-a3c6-51e9-49b2-61c9e68c1f7e\" sessionid=578033623 proto=6 action=\"server-rst\" policyid=207 policytype=\"policy\" service=\"tcp/3727\" dstcountry=\"France\" srccountry=\"Netherlands\" trandisp=\"dnat\" tranip=2.2.2.2 tranport=3727 duration=5 sentbyte=80 rcvdbyte=40 sentpkt=2 rcvdpkt=1 appcat=\"unscanned\" dstdevtype=\"Router/NAT Device\" dstdevcategory=\"Windows Device\" masterdstmac=\"00:00:00:00:00:00\" dstmac=\"00:00:00:00:00:00\" dstserver=1",
"event": {
"action": "server-rst",
"category": "traffic",
"code": "0000000013",
"dataset": "traffic:forward",
"outcome": "success"
},
"@timestamp": "2021-01-06T13:56:21Z",
"action": {
"name": "server-rst",
"outcome": "success",
"target": "network-traffic",
"type": "forward"
},
"destination": {
"address": "3.3.3.3",
"bytes": 40,
"ip": "3.3.3.3",
"mac": "00:00:00:00:00:00",
"nat": {
"ip": "2.2.2.2"
},
"packets": 1,
"port": 3727
},
"fortinet": {
"fortigate": {
"event": {
"type": "traffic"
},
"policyid": "207",
"poluuid": "d77c53b2-a3c6-51e9-49b2-61c9e68c1f7e",
"virtual_domain": "root"
}
},
"host": {
"name": "abc"
},
"log": {
"hostname": "abc",
"level": "notice"
},
"network": {
"bytes": 120,
"protocol": "tcp/3727",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port10"
}
},
"hostname": "abc",
"ingress": {
"interface": {
"name": "port9"
}
},
"serial_number": "1"
},
"related": {
"hosts": [
"abc"
],
"ip": [
"1.1.1.1",
"2.2.2.2",
"3.3.3.3"
]
},
"rule": {
"category": "unscanned",
"ruleset": "policy"
},
"source": {
"address": "1.1.1.1",
"bytes": 80,
"ip": "1.1.1.1",
"packets": 2,
"port": 52125
}
}
{
"message": "timestamp=1709762763 devname=\"FW-001\" devid=\"FG100D6G11111111\" vd=\"root\" date=2024-03-06 time=22:06:03 logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" eventtime=1709762764028577926 tz=\"+0000\" srcip=1.2.3.4 srcname=\"DESKTOP-00001\" srcport=62979 srcintf=\"Port3.999\" srcintfrole=\"lan\" dstip=5.6.7.8 dstport=53 dstintf=\"wan1\" dstintfrole=\"undefined\" sessionid=538959618 proto=17 action=\"accept\" policyid=41 policytype=\"policy\" poluuid=\"703570eee-edfc-4565-8599-c6a75fd3e1e8\" service=\"DNS\" dstcountry=\"France\" srccountry=\"Reserved\" trandisp=\"snat\" transip=4.5.6.7 transport=62979 appid=16195 app=\"DNS\" appcat=\"Network.Service\" apprisk=\"elevated\" applist=\"EMEA_Monitor\" duration=189 sentbyte=285 rcvdbyte=0 sentpkt=5 rcvdpkt=0 osname=\"Windows\" srcswversion=\"10\" mastersrcmac=\"54:13:79:a3:8a:a3\" srcmac=\"54:13:79:a3:8a:a3\" srcserver=0",
"event": {
"action": "accept",
"category": "traffic",
"code": "0000000013",
"dataset": "traffic:forward",
"outcome": "success",
"timezone": "+0000"
},
"@timestamp": "2024-03-06T22:06:03Z",
"action": {
"name": "accept",
"outcome": "success",
"target": "network-traffic",
"type": "forward"
},
"destination": {
"address": "5.6.7.8",
"bytes": 0,
"ip": "5.6.7.8",
"packets": 0,
"port": 53
},
"fortinet": {
"fortigate": {
"apprisk": "elevated",
"event": {
"type": "traffic"
},
"policyid": "41",
"poluuid": "703570eee-edfc-4565-8599-c6a75fd3e1e8",
"virtual_domain": "root"
}
},
"host": {
"name": "DESKTOP-00001",
"os": {
"family": "Windows"
}
},
"log": {
"hostname": "FW-001",
"level": "notice"
},
"network": {
"application": "DNS",
"bytes": 285,
"protocol": "dns",
"transport": "udp"
},
"observer": {
"egress": {
"interface": {
"name": "wan1"
}
},
"hostname": "FW-001",
"ingress": {
"interface": {
"name": "Port3.999"
}
},
"serial_number": "FG100D6G11111111"
},
"related": {
"hosts": [
"FW-001"
],
"ip": [
"1.2.3.4",
"5.6.7.8"
]
},
"rule": {
"apprisk": "elevated",
"category": "Network.Service",
"ruleset": "EMEA_Monitor"
},
"source": {
"address": "1.2.3.4",
"bytes": 285,
"ip": "1.2.3.4",
"mac": "54:13:79:a3:8a:a3",
"packets": 5,
"port": 62979
}
}
{
"message": "logver=60 timestamp=1566916060 tz=\"UTC+2\" devname=\"abc\" devid=\"1\" vd=\"IPSEC\" date=2019-08-27 time=16:27:40 logid=\"0101039949\" type=\"event\" subtype=\"vpn\" level=\"information\" eventtime=1566916060 logdesc=\"SSL VPN statistics\" action=\"tunnel-stats\" tunneltype=\"ssl-tunnel\" tunnelid=1995 remip=1.1.1.1 tunnelip=2.2.2.2 user=\"test\" group=\"GRP_Generic_JAIL_VPN\" dst_host=\"N/A\" nextstat=600 duration=8437 sentbyte=71524041 rcvdbyte=6151809 msg=\"SSL tunnel statistics\"\n",
"event": {
"action": "tunnel-stats",
"category": "event",
"code": "0101039949",
"dataset": "event:vpn",
"outcome": "success",
"reason": "SSL tunnel statistics",
"timezone": "UTC+2"
},
"@timestamp": "2019-08-27T14:27:40Z",
"action": {
"name": "tunnel-stats",
"outcome": "success",
"outcome_reason": "SSL tunnel statistics",
"target": "network-traffic",
"type": "vpn"
},
"destination": {
"bytes": 6151809
},
"fortinet": {
"fortigate": {
"event": {
"type": "event"
},
"tunnel": {
"id": "1995",
"ip": "2.2.2.2",
"type": "ssl-tunnel"
},
"virtual_domain": "IPSEC"
}
},
"host": {
"name": "abc"
},
"log": {
"description": "SSL VPN statistics",
"hostname": "abc",
"level": "information"
},
"network": {
"bytes": 77675850
},
"observer": {
"hostname": "abc",
"serial_number": "1"
},
"related": {
"hosts": [
"abc"
],
"ip": [
"1.1.1.1",
"2.2.2.2"
],
"user": [
"test"
]
},
"source": {
"address": "1.1.1.1",
"bytes": 71524041,
"ip": "1.1.1.1",
"nat": {
"ip": "2.2.2.2"
},
"user": {
"name": "test"
}
}
}
{
"message": " time=12:02:57 devname=\"abc\" devid=\"1\" logid=\"0101037141\" type=\"event\" subtype=\"vpn\" level=\"notice\" vd=\"root\" eventtime=1614855777 logdesc=\"IPsec tunnel statistics\" msg=\"IPsec tunnel statistics\" action=\"tunnel-stats\" remip=1.1.1.1 locip=93.187.43.9 remport=500 locport=500 outintf=\"N/A\" cookies=\"9b064274e0648c03/662c2b1264a2295e\" user=\"N/A\" group=\"N/A\" xauthuser=\"N/A\" xauthgroup=\"N/A\" assignip=N/A vpntunnel=\"VPN-HELPLINE\" tunnelip=N/A tunnelid=0 tunneltype=\"ipsec\" duration=102908570 sentbyte=7649 rcvdbyte=0 nextstat=600",
"event": {
"action": "tunnel-stats",
"category": "event",
"code": "0101037141",
"dataset": "event:vpn",
"outcome": "success",
"reason": "IPsec tunnel statistics"
},
"@timestamp": "2021-03-04T11:02:57Z",
"action": {
"name": "tunnel-stats",
"outcome": "success",
"outcome_reason": "IPsec tunnel statistics",
"target": "network-traffic",
"type": "vpn"
},
"destination": {
"address": "93.187.43.9",
"bytes": 0,
"ip": "93.187.43.9",
"port": 500
},
"fortinet": {
"fortigate": {
"event": {
"type": "event"
},
"tunnel": {
"id": "0",
"name": "VPN-HELPLINE",
"type": "ipsec"
},
"virtual_domain": "root"
}
},
"host": {
"name": "abc"
},
"log": {
"description": "IPsec tunnel statistics",
"hostname": "abc",
"level": "notice"
},
"network": {
"bytes": 7649
},
"observer": {
"hostname": "abc",
"serial_number": "1"
},
"related": {
"hosts": [
"abc"
],
"ip": [
"1.1.1.1",
"93.187.43.9"
]
},
"source": {
"address": "1.1.1.1",
"bytes": 7649,
"ip": "1.1.1.1",
"port": 500
}
}
{
"message": " time=14:38:46 devname=\"abc\" devid=\"1\" logid=\"0101041987\" type=\"event\" subtype=\"vpn\" level=\"information\" vd=\"root\" eventtime=1615469926 logdesc=\"Certificate updated\" action=\"info\" cert-type=\"CRL\" status=\"success\" name=\"CRL_1\" method=\"HTTP\" reason=\"N/A\" msg=\"A certificate is updated\"",
"event": {
"action": "CRL_1",
"category": "event",
"code": "0101041987",
"dataset": "event:vpn",
"outcome": "success",
"provider": "HTTP",
"reason": "A certificate is updated"
},
"@timestamp": "2021-03-11T13:38:46Z",
"action": {
"name": "CRL_1",
"outcome": "success",
"outcome_reason": "A certificate is updated",
"target": "network-traffic",
"type": "vpn"
},
"fortinet": {
"fortigate": {
"event": {
"type": "event"
},
"virtual_domain": "root"
}
},
"host": {
"name": "abc"
},
"http": {
"request": {
"method": "HTTP"
}
},
"log": {
"description": "Certificate updated",
"hostname": "abc",
"level": "information"
},
"observer": {
"hostname": "abc",
"serial_number": "1"
},
"related": {
"hosts": [
"abc"
]
}
}
{
"message": "time=17:43:43 devname=\"FW-FOOBAR\" devid=\"FG123\" eventtime=1665675824075327440 tz=\"+0200\" logid=\"0101039426\" type=\"event\" subtype=\"vpn\" level=\"alert\" vd=\"root\" logdesc=\"SSL VPN login fail\" action=\"ssl-login-fail\" tunneltype=\"ssl-web\" tunnelid=0 remip=1.1.1.1 user=\"CN = foo.bar.baz.com\" group=\"N/A\" dst_host=\"N/A\" reason=\"sslvpn_login_cert_checked_error\" msg=\"SSL user failed to logged in\"",
"event": {
"action": "ssl-login-fail",
"category": "event",
"code": "0101039426",
"dataset": "event:vpn",
"outcome": "success",
"reason": "sslvpn_login_cert_checked_error",
"timezone": "+0200"
},
"@timestamp": "2022-10-13T15:43:44.075328Z",
"action": {
"name": "ssl-login-fail",
"outcome": "success",
"outcome_reason": "SSL user failed to logged in",
"target": "network-traffic",
"type": "vpn"
},
"fortinet": {
"fortigate": {
"event": {
"type": "event"
},
"tunnel": {
"id": "0",
"type": "ssl-web"
},
"virtual_domain": "root"
}
},
"host": {
"name": "FW-FOOBAR"
},
"log": {
"description": "SSL VPN login fail",
"hostname": "FW-FOOBAR",
"level": "alert"
},
"observer": {
"hostname": "FW-FOOBAR",
"serial_number": "FG123"
},
"related": {
"hosts": [
"FW-FOOBAR"
],
"ip": [
"1.1.1.1"
],
"user": [
"CN = foo.bar.baz.com"
]
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"user": {
"name": "CN = foo.bar.baz.com"
}
}
}
{
"message": "time=17:43:43 devname=\"FW-FOOBAR\" devid=\"FG123\" eventtime=1665675824075327440 tz=\"+0200\" logid=\"0101039426\" type=\"event\" subtype=\"vpn\" level=\"alert\" vd=\"root\" logdesc=\"SSL VPN login fail\" action=\"ssl-login-fail\" tunneltype=\"ssl-web\" tunnelid=0 remip=\"N/A\" user=\"CN = foo.bar.baz.com\" group=\"N/A\" dst_host=\"N/A\" reason=\"sslvpn_login_cert_checked_error\" msg=\"SSL user failed to logged in\"",
"event": {
"action": "ssl-login-fail",
"category": "event",
"code": "0101039426",
"dataset": "event:vpn",
"outcome": "success",
"reason": "sslvpn_login_cert_checked_error",
"timezone": "+0200"
},
"@timestamp": "2022-10-13T15:43:44.075328Z",
"action": {
"name": "ssl-login-fail",
"outcome": "success",
"outcome_reason": "SSL user failed to logged in",
"target": "network-traffic",
"type": "vpn"
},
"fortinet": {
"fortigate": {
"event": {
"type": "event"
},
"tunnel": {
"id": "0",
"type": "ssl-web"
},
"virtual_domain": "root"
}
},
"host": {
"name": "FW-FOOBAR"
},
"log": {
"description": "SSL VPN login fail",
"hostname": "FW-FOOBAR",
"level": "alert"
},
"observer": {
"hostname": "FW-FOOBAR",
"serial_number": "FG123"
},
"related": {
"hosts": [
"FW-FOOBAR"
],
"user": [
"CN = foo.bar.baz.com"
]
},
"source": {
"user": {
"name": "CN = foo.bar.baz.com"
}
}
}
{
"message": "CEF:0|Fortinet|Fortigate|v6.0.3|13056|utm:webfilter ftgd_blk blocked|4|deviceExternalId=FGT5HD3915800610 FTNTFGTlogid=0316013056 cat=utm:webfilter FTNTFGTsubtype=webfilter FTNTFGTeventtype=ftgd_blk FTNTFGTlevel=warning FTNTFGTvd=vdom1 FTNTFGTeventtime=1545938629 FTNTFGTpolicyid=1 externalId=764 duser=Domain\\\\\\\\bob src=10.1.100.11 spt=59194 deviceInboundInterface=port12 FTNTFGTsrcintfrole=undefined dst=185.230.61.185 dpt=80 deviceOutboundInterface=port11 FTNTFGTdstintfrole=undefined proto=6 app=HTTP dhost=ambrishsriv.wixsite.com FTNTFGTprofile=g-default act=blocked FTNTFGTreqtype=direct request=/bizsquads out=96 in=0 deviceDirection=1 msg=URL belongs to a denied category in policy FTNTFGTmethod=domain FTNTFGTcat=26 requestContext=Malicious Websites FTNTFGTcrscore=60 FTNTFGTcrlevel=high",
"event": {
"action": "blocked",
"category": "utm",
"code": "0316013056",
"dataset": "utm:webfilter",
"outcome": "success",
"reason": "URL belongs to a denied category in policy"
},
"@timestamp": "2018-12-27T19:23:49Z",
"action": {
"name": "blocked",
"outcome": "success",
"outcome_reason": "URL belongs to a denied category in policy",
"target": "network-traffic",
"type": "ftgd_blk - webfilter"
},
"destination": {
"address": "185.230.61.185",
"bytes": 96,
"domain": "ambrishsriv.wixsite.com",
"ip": "185.230.61.185",
"port": 80,
"user": {
"domain": "Domain",
"name": "bob"
}
},
"log": {
"level": "warning"
},
"network": {
"application": "HTTP",
"bytes": 96,
"direction": "outbound",
"protocol": "http",
"transport": "tcp"
},
"observer": {
"egress": {
"interface": {
"name": "port11"
}
},
"ingress": {
"interface": {
"name": "port12"
}
},
"type": "Fortigate",
"vendor": "Fortinet",
"version": "v6.0.3"
},
"related": {
"hosts": [
"ambrishsriv.wixsite.com"
],
"ip": [
"10.1.100.11",
"185.230.61.185"
],
"user": [
"bob"
]
},
"rule": {
"category": "Malicious Websites"
},
"source": {
"address": "10.1.100.11",
"bytes": 0,
"ip": "10.1.100.11",
"port": 59194
},
"url": {
"original": "/bizsquads",
"path": "/bizsquads"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
action.properties.icmp_code |
keyword |
ICMP code (backward compatibility) |
action.properties.icmp_type |
keyword |
ICMP type (backward compatibility) |
action.target |
keyword |
Target of the action (backward compatibility) |
destination.address |
keyword |
Destination network address. |
destination.bytes |
long |
Bytes sent from the destination to the source. |
destination.domain |
keyword |
The domain name of the destination. |
destination.ip |
ip |
IP address of the destination. |
destination.mac |
keyword |
MAC address of the destination. |
destination.nat.ip |
ip |
Destination NAT ip |
destination.nat.port |
long |
Destination NAT Port |
destination.packets |
long |
Packets sent from the destination to the source. |
destination.port |
long |
Port of the destination. |
destination.user.domain |
keyword |
Name of the directory the user is a member of. |
destination.user.name |
keyword |
Short name or login of the user. |
dns.question.class |
keyword |
The class of records being queried. |
dns.question.name |
keyword |
The name being queried. |
dns.question.type |
keyword |
The type of record being queried. |
dns.rrname |
keyword |
DNS requested name (backward compatibility) |
dns.rrtype |
keyword |
DNS request type (backward compatibility) |
event.action |
keyword |
The action captured by the event. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.code |
keyword |
Identification code for this event. |
event.dataset |
keyword |
Name of the dataset. |
event.provider |
keyword |
Source of the event. |
event.reason |
keyword |
Reason why this event happened, according to the source |
event.timezone |
keyword |
Event time zone. |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
file.name |
keyword |
Name of the file including the extension, without the directory. |
file.size |
long |
File size in bytes. |
fortinet.fortigate.apprisk |
keyword |
Risk level of the application. |
fortinet.fortigate.attack.id |
keyword |
ID of the detected attack |
fortinet.fortigate.attack.name |
keyword |
Name of the detected attack |
fortinet.fortigate.event.desc |
keyword |
Type of log. |
fortinet.fortigate.event.severity |
keyword |
Anomaly severity as reported by Fortigate |
fortinet.fortigate.event.type |
keyword |
Type of the event. |
fortinet.fortigate.icmp.request.code |
keyword |
The request code. |
fortinet.fortigate.icmp.request.type |
keyword |
The request type. |
fortinet.fortigate.policyid |
keyword |
ID of the policy |
fortinet.fortigate.poluuid |
keyword |
UUID of pol |
fortinet.fortigate.tunnel.id |
keyword |
The id of the tunnel |
fortinet.fortigate.tunnel.ip |
keyword |
The ip of the tunnel |
fortinet.fortigate.tunnel.name |
keyword |
The name of the tunnel |
fortinet.fortigate.tunnel.type |
keyword |
The type of the tunnel |
fortinet.fortigate.tunnel.version |
keyword |
The version of the tunnel |
fortinet.fortigate.user.source |
keyword |
The source of the username |
fortinet.fortigate.virtual_domain |
keyword |
Name of the virtual domain in which the event was observed |
host.name |
keyword |
Name of the host. |
host.os.family |
keyword |
OS family (such as redhat, debian, freebsd, windows). |
http.request.method |
keyword |
HTTP request method. |
log.level |
keyword |
Log level of the log event. |
network.application |
keyword |
Application level protocol name. |
network.bytes |
long |
Total bytes transferred in both directions. |
network.protocol |
keyword |
Application protocol name. |
network.transport |
keyword |
Protocol Name corresponding to the field iana_number. |
observer.egress.interface.name |
keyword |
Interface name |
observer.hostname |
keyword |
Hostname of the observer. |
observer.ingress.interface.name |
keyword |
Interface name |
observer.serial_number |
keyword |
Observer serial number. |
observer.type |
keyword |
The type of the observer the data is coming from. |
observer.vendor |
keyword |
Vendor name of the observer. |
observer.version |
keyword |
Observer version. |
rule.apprisk |
keyword |
App risk reported by Fortigate (backward compatibility) |
rule.category |
keyword |
Rule category |
rule.ruleset |
keyword |
Rule ruleset |
source.bytes |
long |
Bytes sent from the source to the destination. |
source.domain |
keyword |
The domain name of the source. |
source.ip |
ip |
IP address of the source. |
source.mac |
keyword |
MAC address of the source. |
source.nat.ip |
ip |
Source NAT ip |
source.nat.port |
long |
Source NAT port |
source.packets |
long |
Packets sent from the source to the destination. |
source.port |
long |
Port of the source. |
source.user.domain |
keyword |
Name of the directory the user is a member of. |
source.user.name |
keyword |
Short name or login of the user. |
url.full |
wildcard |
Full unparsed URL. |
url.original |
wildcard |
Unmodified original url as seen in the event source. |
user.domain |
keyword |
Name of the directory the user is a member of. |
user.name |
keyword |
Short name or login of the user. |
user_agent.original |
keyword |
Unparsed user_agent string. |
Configure
In this documentation we explain one way to collect and send Fortigate logs to Sekoia.io.
- From the Fortigate machine to an internal syslog concentrator, then forwarded to Sekoia.io
Fortigate logs
On Fortigate appliances, most of the important hardward and software activities that are relevant for security detection and analysis, are logged into three files.
- Traffic: Local out traffic, Denied traffic, Allowed traffic
- Web
- Url-Filtering
- VPN
Transport to the concentrator
Prerequisites
The following prerequisites are needed in order to setup efficient log concentration:
- Have administrator writes on the Fortigate
- Traffic towards the syslog concentrator must be open on
TCP/514
Configure Fortigate
The first step is to configure Fortigate to log the awaited traffic. You can configure FortiOS to send log messages to remote syslog servers in standard, CSV or CEF (Common Event Format) format. These three formats are accepted by the Sekoia.io intake. To enable syslog, log into the CLI and enter the following commands:
config log syslogd setting
set status enable
set port 514
set mode reliable
set server [IP address of syslog server]
set facility user
set format rfc5424
end
Most FortiGate features are enabled for logging by default. Ensure they are enabled by executing the following command:
show full-configuration
Make sure the Traffic, Web and URL Filtering features are enabled for logging with the following commands:
config log syslogd filter
set forward-traffic enable
set local-traffic enable
set multicast-traffic enable
....
set vpn enable
set web enable
set url-filter enable
end
With some Fortigate appliance, it may not be possible to do the above configuration through the command line. An alternative method is to use the graphical interface and go to the Log Settings menu. From there you can choose every logging options within Event Logging and Local Traffic Log except for the Denied options.
Then in order to use CEF format, use the following commands :
config log syslogd setting
set format cef
end
Forward logs to Sekoia.io
Please consult the Syslog Forwarding documentation to forward these logs to Sekoia.io.