V 2.0 : FortiAnalyzer Event

Vendor Documentation

Rule Name	Rule Type	Common Event	Classification
V 2.0 : FortiAnalyzer Event	Base Rule	General Event Log Information	Information

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
Action	<action>	Text/String	Records the action taken, if applicable.
Date	N/A	N/A	The year, month, and day when the event occurred in the format: YY-MM-DD.
Time	N/A	N/A	The hour, minute, and second of when the event occurred.
Description	N/A	N/A	The activity or event recorded by the FortiAnalyzer unit.
Device ID	N/A	N/A	An identification number for the device that recorded the event.
Device Time	N/A	N/A	The year, month, and day when the event occurred in the format: YY-MM-DD. It also includes the hour, minute, and second of when the event occurred.
ID	<vmid>	Number	A ten-digit number that identifies the log type. The first two digits represent the log type, and the following two digits represent the log subtype. The last six digits represent the message ID number.
Level	<severity>	Text/String	The severity level or priority of the event. There are several severity or priority levels.
Msg	<subject>	Text/String	A description of the activity or event recorded by the FortiAnalyzer unit.
Subtype	<objecttype>	Text/String	The subtype of each log message.
Type	<object>	Text/String	The section of the system where the event occurred.
User	<login>	Text/String	The name of the user creating the traffic.
User From	N/A	N/A	Where the user initiated the activity or event, if applicable.