LSO FortiGate - Event : Endpoint

Vendor Documentation

https://docs.fortinet.com/document/fortigate/7.0.12/administration-guide/986892/sample-logs-by-log-type

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
date	N/A	N/A
time	N/A	N/A
logid	<vmid>	<vmid>
type	<policy>	<vendorinfo>
subtype	<subject>	N/A
level	<severity>	<severity>
vd	<domainorigin>	N/A
eventtime	N/A	N/A
logdesc	<vendorinfo>	N/A
action	<action> <tag1>	<action> <tag1>
status	<status>	<status>
license_limit	N/A	N/A
used_for_type	N/A	N/A
connection_type	<sessiontype>	<objecttype>
count	<quantity>	<quantity>
user	<login>	<login>
ip	<sip>	<sip>
name	<sname>	<objectname>
srcip	<sip>	N/A
srcname	<sname>	N/A
srcmac	<smac>	N/A
vulnname	<objectname>	N/A
vulncat	<objecttype>	N/A
severity	<severity>	N/A
vendorurl	<url>	N/A
fctuid	N/A	<object>
msg	<result>	<subject>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1011038	Event : Endpoint	Base Rule	Endpoint Profiling Activity	Information
	EVID 45057 : Add Connection	Sub Rule	Connection Established	Network Traffic
	EVID 45058 : Close Connection	Sub Rule	Client Connection Closed	Other Audit Success

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1013172	V 2.0 : Event : Endpoint	Base Rule	General Endpoint Message	Information
	V 2.0 : Add Connection	Sub Rule	Connection Established	Network Traffic
	V 2.0 : Close Connection	Sub Rule	Client Connection Closed	Other Audit Success