Traffic Log Messages (Fortinet FortiWeb CEF)

https://docs.fortinet.com/document/fortiweb/7.6.0/log-message-reference/848761/traffic

Traffic Log Messages

Base Rule

General Traffic Log

Network Traffic

 HTTP Traffic Logs

Sub Rule

 HTTP Session Created

 Network Traffic

HTTPS Traffic Logs

Sub Rule

HTTPS Request

Network Traffic

FTP Traffic Logs

Sub Rule

FTP Connection Established

Network Traffic

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

N/A

N/A

N/A

Common Traffic Format identifier: Default or unspecified severity level (can be replaced with specific severity levels such as 1-10).

N/A

N/A

N/A

Vendor or organization name.

N/A

N/A

N/A

Product or service name generating the Traffic.

N/A

<version>

Numbers

Version number.

N/A

<vmid>
<tag1>

Numbers

log_id

N/A

<vendorinfo>

Text/String

Description

N/A

<severity>

Text/String

Severity level of the Traffic.

cat

<objecttype>

Text/String

N/A

outcome

<result>

Text/String

N/A

reason

<reason>

Text/String

N/A

deviceExternalId

N/A

N/A

N/A

deviceProcessName

<process>

Text/String

N/A

proto

<protname>

Text/String

N/A

app

<object>

Text/String

N/A

src

<sip>

IP Address

N/A

spt

<sport>

Numbers

N/A

dst

<dip>

IP Address

N/A

dpt

<dport>

Numbers

N/A

requestMethod

<command>

Text/String

N/A

request

N/A

N/A

N/A

requestClientApplication

<useragent>

Text/String

N/A

dhost

<dname>

Text/String

N/A

in

<bytesin>

Numbers

N/A

out

<bytesout>

Numbers

N/A

msg

<subject>

Text/String

N/A

cn1

<responsecode>

Numbers

N/A

cn1Label

N/A

N/A

N/A

cs1

N/A

N/A

N/A

cs1Label

N/A

N/A

N/A

cs2

N/A

N/A

N/A

cs2Label

N/A

N/A

N/A

cs3

N/A

N/A

N/A

cs3Label

N/A

N/A

N/A

cs4

N/A

N/A

N/A

cs4Label

N/A

N/A

N/A

cs5

N/A

N/A

N/A

cs5Label

N/A

N/A

N/A