Syslog - Fortinet FortiGate (Log Source Optimization)

Device Name

Syslog - Fortinet FortiGate

Vendor

Fortinet

Device Type

FortiGate Firewall

Supported Model Name/Number

N/A

Supported Software Version

N/A

Collection Method

Syslog

Configurable Log Output

N/A

Log Source Type

Syslog - Fortinet FortiGate

Log Processing Policy

LogRhythm Default V 2.0

Exceptions

N/A

Additional Information

https://docs.fortinet.com/document/fortigate/7.0.12/administration-guide/986892/sample-logs-by-log-type

V 2.0 : Event : Connector

N/A

<vendorinfo>, <vmid>, <severity>, <object>, <action>, <tag1>, <sip>, <subject>

V 2.0 : Event : Endpoint

N/A

<vendorinfo>, <vmid>, <severity>, <action>, <tag1>, <status>, <objecttype>, <quantity>, <login>, <sip>, <objectname>, <object>, <subject>

V 2.0 : Event : FortiExtender

N/A

<vendorinfo>, <vmid>, <severity>, <serialnumber>, <sip>, <action>, <reason>, <protname>, <bytesin>, <bytesout>, <subject>

V 2.0 : Event : HA

N/A

<vendorinfo>, <vmid>, <severity>, <subject>, <group>, <serialnumber>

V 2.0 : Event : Rest-Api

N/A

<vendorinfo>, <vmid>, <severity>, <login>, <sinterface>, <command>, <status>, <url>

V 2.0 : Event : Router

N/A

<vendorinfo>,<vmid>,<severity>,<subject>,<objecttype>,<sip>,<status>

V 2.0 : Event : SDWAN

N/A

<vendorinfo>, <vmid>, <severity>, <objecttype>, <object>, <dinterface>, <status>, <subject>

V 2.0 : Event : Security Rating

N/A

<vendorinfo>, <vmid>, <severity>, <subject>, <result>

V 2.0 : Event : Switch-Controller

N/A

<vendorinfo>, <vmid>, <severity>, <login>, <sinterface>, <serialnumber>, <subject>

V 2.0 : Event : System

N/A

<vendorinfo>, <vmid>, <severity>, <serialnumber>, <login>, <sip>, <dip>, <action>, <status>, <reason>, <subject>

V 2.0 : Event : User

N/A

<vendorinfo>, <vmid>, <severity>, <sip>, <dip>, <sinterface>, <login>, <group>, <action>, <status>, <reason>, <subject>

V 2.0 : Event : VPN

N/A

<vendorinfo>, <vmid>, <severity>, <subject>, <action>, <dip>, <sip>, <dport>, <sport>, <login>, <group>, <status>, <result>

V 2.0 : Event : WAD

N/A

<vendorinfo>, <vmid>, <severity>, <session>, <policy>, <sip>, <sport>, <dip>, <dport>, <action>, <threatid>, <threatname>, <subject>

V 2.0 : Event : Wireless

N/A

<vendorinfo>, <vmid>, <severity>, <action>, <object>, <objectname>, <objecttype>, <smac>, <quantity>, <status>, <subject>

V 2.0 : Traffic : Forward

N/A

<vendorinfo>, <vmid>, <severity>, <sip>, <sport>, <sinterface>, <dip>, <dport>, <dinterface>, <session>, <protnum>, <action>, <tag1>, <policy>, <protname>, <snatip>, <snatport>, <object>, <objectname>, <objecttype>, <threatname>, <bytesin>, <bytesout>, <packetsin>, <packetsout>, <status>, <tag2>, <quantity>, <smac>

V 2.0 : Traffic : Local

N/A

<vendorinfo>, <vmid>, <severity>, <sip>, <sport>, <dip>, <dport>, <protnum>, <action>, <tag1>, <policy>, <bytesin>, <bytesout>, <packetsin>, <packetsout>, <object>, <objecttype>

V 2.0 : Traffic : Multicast

N/A

<vendorinfo>, <vmid>, <severity>, <sip>, <sport>, <dip>, <dport>, <protnum>, <action>, <tag1>, <policy>, <bytesin>, <bytesout>, <packetsin>, <packetsout>, <object>, <protname>

V 2.0 : Traffic : Sniffer

N/A

<vendorinfo>, <vmid>, <severity>, <sip>, <sport>, <dip>, <dport>, <session>, <action>, <tag1>, <policy>, <snatip>, <snatport>, <bytesin>, <bytesout>, <packetsin>, <packetsout>, <object>, <protname>, <status>, <amount>

V 2.0 : UTM : Anomaly

N/A

<vendorinfo>, <vmid>, <severity>, <sip>, <dip>, <sinterface>, <session>, <action>, <protnum>, <protname>, <quantity>, <threatname>, <threatid>, <policy>, <url>, <subject>

V 2.0 : UTM : Antivirus

N/A

<vendorinfo>, <vmid>, <severity>, <subject>, <action>, <protname>, <session>, <sip>, <dip>, <sport>, <dport>, <sinterface>, <dinterface>, <policy>, <protnum>, <object>, <status>, <threatname>, <threatid>, <url>, <useragent>

V 2.0 : UTM : App-Ctrl

N/A

<vendorinfo>, <vmid>, <severity>, <object>, <sip>, <dip>, <sport>, <dport>, <sinterface>, <dinterface>, <protnum>, <protname>, <policy>, <session>, <objecttype>, <objectname>, <action>, <sname>, <serialnumber>, <url>, <subject>

V 2.0 : UTM : DLP

N/A

<vendorinfo>, <vmid>, <severity>, <policy>, <session>, <sip>, <sport>, <sinterface>, <dip>, <dport>, <dinterface>, <protnum>, <protname>, <objecttype>, <action>, <sname>, <url>, <useragent>, <object>

V 2.0 : UTM : DNS

N/A

<vendorinfo>, <vmid>, <severity>, <policy>, <session>, <sip>, <sport>, <sinterface>, <dip>, <dport>, <dinterface>, <protnum>, <smac>, <subject>, <action>, <object>, <objectname>

V 2.0 : UTM : IPS

N/A

<vendorinfo>, <vmid>, <severity>, <sip>, <dip>, <sinterface>, <dinterface>, <session>, <action>, <protnum>, <protname>, <policy>, <threatname>, <sport>, <dport>, <sname>, <url>, <threatid>, <subject>

V 2.0 : UTM : SSH

N/A

<vendorinfo>, <vmid>, <severity>, <policy>, <session>, <sip>, <sport>, <dip>, <dport>, <sinterface>, <dinterface>, <protnum>, <action>, <login>, <object>

V 2.0 : UTM : SSL

N/A

<vendorinfo>, <vmid>, <severity>, <action>, <policy>, <session>, <protname>, <sip>, <sport>, <dip>, <dport>, <sinterface>, <dinterface>, <protnum>, <subject>, <reason>, <dname>, <serialnumber>, <hash>, <size>

V 2.0 : UTM : Web-Filter

N/A

<vendorinfo>, <vmid>, <severity>, <policy>, <session>, <sip>, <sport>, <sinterface>, <dip>, <dport>, <dinterface>, <protnum>, <protname>, <dname>, <account>, <action>, <objecttype>, <url>, <bytesout>, <bytesin>, <subject>, <command>, <threatname>, <threatid>

V 2.0 : Catch All

N/A

<severity>, <tag1>

KB 7.1.674.0

Syslog - Fortinet FortiGate

New Log Source Optimization (LSO) policy: LogRhythm Default v2.0

Optimized new log processing policy for Syslog - Fortinet FortiGate.