LSO FortiAnalyzer - Traffic : Https/Http Mesages

Vendor Documentation

https://docs.fortinet.com/document/fortimanager/7.2.2/log-message-reference/439316/fortianalyzer-event-log-message-example

https://docs.fortinet.com/document/fortimanager/7.2.2/log-message-reference/395380/fortianalyzer-application-log-message-example

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Header: Severity	<severity>	N/A
vd	<domainorigin>	N/A
log_id	<vmid>	N/A
devname	<objectname>	N/A
pri	<severity>	N/A
proto	<protname>	N/A
status	<status>	N/A
reason	<reason>	N/A
policy	<policy>	N/A
src_port	<sport>	N/A
dst_port	<dport>	N/A
http_request_bytes	<bytesin>	N/A
http_response_bytes	<bytesout>	N/A
http_method	<command>	N/A
http_url	<url>	N/A
http_agent	<useragent>	N/A
http_retcode	<responsecode> <tag1>	N/A
msg	<subject>	N/A
user_name	<login>	N/A
http_version	<version>	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1010536	Traffic : Https/Http Mesages	Base Rule	General HTTP Information	Information
	HTTP 200 : Successful Messages	Sub Rule	HTTP 200 : Success Reply - OK	Information
	HTTP 302 : Moved Temporarily	Sub Rule	HTTP 302 : Redirect - Moved Temporarily	Information
	HTTP 404 : Not Found	Sub Rule	HTTP 404 : Not Found	Error
	HTTP 500 : Internal Server Error	Sub Rule	HTTP 500 : Server Error - Internal Server Error	Error

LogRhythm Default v2.0

N/A