LSO FortiAnalyzer - Traffic : Multicast

Vendor Documentation

https://docs.fortinet.com/document/fortimanager/7.2.2/log-message-reference/439316/fortianalyzer-event-log-message-example

https://docs.fortinet.com/document/fortimanager/7.2.2/log-message-reference/395380/fortianalyzer-application-log-message-example

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Header: Severity	<severity>	N/A
logid	<vmid> <tag1>	N/A
srcip	<sip>	N/A
srcport	<sport>	N/A
srcintf	<sinterface>	N/A
dstip	<dip>	N/A
dstport	<dport>	N/A
dstintf	<dinterface>	N/A
sessionid	<session>	N/A
proto	<protnum>	N/A
action	<action> <tag2>	N/A
policytype	<policy>	N/A
sentbyte	<bytesout>	N/A
rcvdbyte	<bytesin>	N/A
sentpkt	<packetsout>	N/A
rcvdpkt	<packetsin>	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1010148	Traffic : Multicast	Base Rule	General IP Multicast Information	Information
	Traffic Muticast Deny	Sub Rule	Auditing Session Failed	Other Audit Failure
	Traffic Multicast Start	Sub Rule	Session Started	Other Audit Success
	LOG_ID_TRAFFIC_MULTICAST	Sub Rule	Network Traffic	Network Traffic

LogRhythm Default v2.0

N/A