Syslog Fortinet FortiGate - V 2.0 : UTM : WAF

https://docs.fortinet.com/document/fortigate/7.0.12/administration-guide/986892/sample-logs-by-log-type

V 2.0: UTM: WAF

Base Rule

General Firewall Event

Information

V 2.0: WAF_SIGNATURE_BLOCK

Sub Rule

Traffic Denied by WAF

Network Deny

V 2.0: WAF_SIGNATURE_PASS

Sub Rule

Traffic Allowed by WAF

Network Allow

V 2.0: WAF_SIGNATURE_ERASE

Sub Rule

General Firewall Log

Network Traffic

V 2.0: WAF_CUSTOM_SIGNATURE_BLOCK

Sub Rule

Traffic Denied by WAF

Network Deny

V 2.0: WAF_CUSTOM_SIGNATURE_PASS

Sub Rule

Traffic Allowed by WAF

Network Allow

V 2.0: WAF_METHOD_BLOCK

Sub Rule

Traffic Denied by WAF

Network Deny

V 2.0: WAF_ADDRESS_LIST_BLOCK

Sub Rule

Traffic Denied by WAF

Network Deny

V 2.0: WAF_CONSTRAINTS_BLOCK

Sub Rule

Traffic Denied by WAF

Network Deny

V 2.0: WAF_CONSTRAINTS_PASS

Sub Rule

Traffic Allowed by WAF

Network Allow

V 2.0: WAF_URL_ACCESS_PERMIT

Sub Rule

Traffic Allowed by WAF

Network Allow

V 2.0: WAF_URL_ACCESS_BYPASS

Sub Rule

Traffic Allowed by WAF

Network Allow

V 2.0: WAF_URL_ACCESS_BLOCK

Sub Rule

Traffic Denied by WAF

Network Deny

date

N/A

N/A

The date of the event.

time

N/A

N/A

The time of the event.

devname

<sname>

Text/String

N/A

devid

N/A

N/A

N/A

eventtime

N/A

N/A

N/A

tz

N/A

N/A

N/A

logid

<vmid>

Number

The log ID.

type

<vendorinfo>

Text/String

The type of event.

subtype

N/A

N/A

The subtype of the event.

eventtype

N/A

N/A

The specific type of WAF event.

level

N/A

N/A

The level of the event.

vd

<sessiontype>

Text/String

N/A

policyid

<policy>

Number

The policy ID

poluuid

N/A

N/A

The policy UID

policytype

N/A

N/A

The policy Type

sessionid

<session>

Number

The ID of the session associated with the log event.

profile

N/A

N/A

N/A

srcip

<sip>

IP Address

The source IP address.

srcport

<sport>

Number

The source port.

srccountry

N/A

N/A

The source country.

srcuuid

N/A

N/A

N/A

dstip

<dip>

IP Address

The destination IP address.

dstport

<dport>

Number

The destination port.

dstcountry

N/A

N/A

The destination country.

dstuuid

N/A

N/A

N/A

srcintf

<sinterface>

Text/String

The source interface.

srcintfrole

N/A

N/A

The source interface role.

dstintf

<dinterface>

Text/String

The destination interface.

dstintfrole

N/A

N/A

The destination interface role.

proto

<protnum>

Number

The protocol.

service

<parentprocessname>

Text/String

N/A

url

<url>

Text/String

N/A

severity

<severity>

Text/String

N/A

action

<action>

Text/String

N/A

direction

N/A

N/A

N/A

agent

<useragent>

Text/String

N/A

constraint

N/A

N/A

N/A

eventid

N/A

N/A

N/A

msg

<subject>

Text/String

N/A