LSO FortiAnalyzer - UTM : App

Vendor Documentation

https://docs.fortinet.com/document/fortimanager/7.2.2/log-message-reference/439316/fortianalyzer-event-log-message-example

https://docs.fortinet.com/document/fortimanager/7.2.2/log-message-reference/395380/fortianalyzer-application-log-message-example

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Header: Severity	<severity>	N/A
logid	<vmid> <tag1>	N/A
appid	<processid>	N/A
user	<account>	N/A
group	<group>	N/A
srcip	<sip>	N/A
srcport	<sport>	N/A
srcintf	<sinterface>	N/A
dstip	<dip>	N/A
dstport	<dport>	N/A
dstintf	<dinterface>	N/A
proto	<protnum>	N/A
policyid	<policy>	N/A
policytype	<process>	N/A
sessionid	<session>	N/A
action	<action>	N/A
appcat	<objectname>	N/A
app	<object>	N/A
hostname	<dname>	N/A
scertcname	<parentprocessname>	N/A
scertissuer	<objecttype>	N/A
url	<url>	N/A
agent	<useragent>	N/A
apprisk	<severity>	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1010161	UTM : App	Base Rule	General Application Control Message	Information
	UTM App Ctrl IPS Pass	Sub Rule	Traffic Allowed by IDS/IPS	Network Allow
	UTM App Ctrl IPS Block	Sub Rule	Traffic Denied by IDS/IPS	Network Deny
	UTM App Ctrl IPS Reset	Sub Rule	General IPS Message	Information
	LOGID_APP_CTRL_IM_BASIC	Sub Rule	General VDS Basic Provider 1.0 Information	Information
	LOGID_APP_CTRL_IM_BASIC_WITH_STATUS	Sub Rule	Task Status	Information
	LOGID_APP_CTRL_IM_BASIC_WITH_COUNT	Sub Rule	IM Activity	Activity
	LOGID_APP_CTRL_IM_FILE	Sub Rule	Application Control IM Message	Information
	LOGID_APP_CTRL_IM_CHAT	Sub Rule	Application Control IM Message	Information
	LOGID_APP_CTRL_IM_CHAT_BLOCK	Sub Rule	Failed IM/Chat Activity	Failed Misuse
	LOGID_APP_CTRL_IM_BLOCK	Sub Rule	IM/Chat Activity	Misuse
	LOGID_APP_CTRL_SSH_PASS	Sub Rule	SSH Session Opened	Network Traffic
	LOGID_APP_CTRL_SSH_BLOCK	Sub Rule	Denied SSH Session	Warning

LogRhythm Default v2.0

N/A