LSO FortiAnalyzer - Event : Link

Vendor Documentation

https://docs.fortinet.com/document/fortimanager/7.2.2/log-message-reference/439316/fortianalyzer-event-log-message-example

https://docs.fortinet.com/document/fortimanager/7.2.2/log-message-reference/395380/fortianalyzer-application-log-message-example

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
devname	<objectname>	N/A
log_id	<vmid>	N/A
pri	<severity>	N/A
vd	<account>	N/A
action	<action>	N/A
user	<login>	N/A
status	<status>	N/A
msg	<subject>	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1013087	Event : Link	Base Rule	Link Status	Information

LogRhythm Default v2.0

N/A