LSO FortiGate - Event : User

Vendor Documentation

https://docs.fortinet.com/document/fortigate/7.0.12/administration-guide/986892/sample-logs-by-log-type

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Header: Severity	<severity>	N/A
date	N/A	N/A
time	N/A	N/A
logid	<vmid> <tag1>	<vmid>
type	N/A	<vendorinfo>
subtype	N/A	N/A
level	N/A	<severity>
vd	N/A	N/A
eventtime	N/A	N/A
logdesc	<status>	N/A
srcip	<sip>	<sip>
dstip	<dip>	<dip>
policyid	N/A	N/A
interface	N/A	<sinterface>
user	<login>	<login>
group	<group>	<group>
authproto	N/A	N/A
action	<action>	<action>
status	<status>	<status>
reason	<reason>	<reason>
oldwprof	<object>	N/A
profile	<objecttype>	N/A
msg	<subject>	<subject>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1010175	Event : User	Base Rule	General User Information	Information
	User FSSO SVR Status	Sub Rule	General Active Directory Information	Information
	User Event Auth Time Out	Sub Rule	Authentication Timeout	Other Audit
	User Event Auth FSAE Logon	Sub Rule	User Logon	Authentication Success
	User Event Auth FSAE Logoff	Sub Rule	User Logoff	Authentication Success
	User Event Auth Logon	Sub Rule	User Logon	Authentication Success
	User Event Auth Logout	Sub Rule	User Logoff	Authentication Success
	User Event Auth FGOVRD Success	Sub Rule	Successful Activity	Other Audit Success

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1013171	V 2.0 : Event : User	Base Rule	General User Information	Information
	V 2.0 : User FSSO SVR Status	Sub Rule	General Active Directory Information	Information
	V 2.0 : User Event Auth Time Out	Sub Rule	Authentication Timeout	Other Audit
	V 2.0 : User Event Auth FSAE Logon	Sub Rule	User Logon	Authentication Success
	V 2.0 : User Event Auth FSAE Logoff	Sub Rule	User Logoff	Authentication Success
	V 2.0 : User Event Auth Logon	Sub Rule	User Logon	Authentication Success
	V 2.0 : User Event Auth Logout	Sub Rule	User Logoff	Authentication Success
	V 2.0 : User Event Auth FGOVRD Success	Sub Rule	Successful Activity	Other Audit Success