LSO FortiGate - Event : Security Rating

Vendor Documentation

https://docs.fortinet.com/document/fortigate/7.0.12/administration-guide/986892/sample-logs-by-log-type

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
date	N/A	N/A
time	N/A	N/A
logid	<vmid>	<vmid>
type	N/A	<vendorinfo>
subtype	N/A	N/A
level	<severity>	<severity>
vd	<login>	<sessiontype>
eventtime	N/A	N/A
logdesc	<vendorinfo>	<subject>
auditid	N/A	N/A
audittime	N/A	N/A
auditscore	N/A	<result>
criticalcount	N/A	N/A
highcount	N/A	N/A
mediumcount	N/A	N/A
lowcount	N/A	N/A
passedcount	N/A	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1012054	Event: Security Rating	Base Rule	General Security Note	Information
	LOG_ID_EVENT_SECURITY_AUDIT_FABRIC_SUMMARY	Sub Rule	General Operations Security Log Export API Message	Information
	LOG_ID_EVENT_SECURITY_AUDIT_FABRIC_CHANGE	Sub Rule	General Operations Security Log Export API Message	Information

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1013174	V 2.0: Event: Security Rating	Base Rule	General Security Note	Information
	V 2.0: LOG_ID_EVENT_SECURITY_AUDIT_FABRIC_SUMMARY	Sub Rule	General Audit	Other Audit Success
	V 2.0: LOG_ID_EVENT_SECURITY_AUDIT_FABRIC_CHANGE	Sub Rule	General Audit	Other Audit Success