FortiOS UTM, Event, and Traffic

Fortigate is a line of firewall devices produced by Fortinet. FortiGate Next Generation Firewalls enable security-driven networking and consolidate industry-leading security capabilities such as intrusion prevention system (IPS), web filtering, secure sockets layer (SSL) inspection, and automated threat protection.

App Function

Normalize incoming event data
Set various user tags
Reformat the event message using all the key/value pairs present in the original message

Vendor Documentation

Log Source Details

Item	Value
Vendor	Fortinet
Device Type	Fortigate firewalls
Collection Method	Syslog
Configurable Log Output?	no
Exceptions	N/A

Logs can be generated by the following functions:

Traffic
Security: Antivirus
Security: Intrusion Prevention
Security: Application Control
Security: Web Filter
Security: DNS
Security: Data Leak Prevention
Security: Email Filter
Security: Web Application Firewall
Security: Vulnerability Scan
Security: VoIP
Security: FortiClient
Event: Endpoint
Event: HA
Event: Compliance
Event: System
Event: Router
Event: VPN
Event: User
Event: WAN Opt.
Event: Cache
Event: WiFi

Incoming Log Format

The incoming log messages are comprised of key/value pairs, each key/value separated by = and each pair separated by space. The keys are not denoted by quotes, but some (and only some) of the values are. See the bottom for example log messages. Log messages are generated for many different event types, and each event type produces distinct and differing keys -- some keys are common to different event types, whereas some keys are unique to other event types.

Parsed Metadata Fields

The following fields (keys) are tagged. Note that the user tag name is the same as the field key name.

Removed	Tagged	Field	Tag Name	Example
☑		`date`		`2019-05-13`
☑		`time`		`11:45:03`
☑		`eventtime`		`1557513467369913239`
☑		`logtime`		`1557513467369913239`
	☑	`action`	`action`	`close`
	☑	`addr`	`addr`	(n/a)
	☑	`agent`	`agent`	`curl/7.47.0`
	☑	`alert`	`alert`	(n/a)
	☑	`analyticssubmit`	`analyticssubmit`	`false`
	☑	`app`	`app`	`HTTP.BROWSER_Firefox`
	☑	`appcat`	`appcat`	`Web.Client`
	☑	`appid`	`appid`	`40568`
	☑	`applist`	`applist`	`g-default`
	☑	`apprisk`	`apprisk`	`elevated`
	☑	`apscan`	`apscan`	(n/a)
	☑	`attack`	`attack`	(n/a)
	☑	`auditscore`	`auditscore`	(n/a)
	☑	`authproto`	`authproto`	`TELNET(10.1.100.11)`
	☑	`catdesc`	`catdesc`	`Malicious Websites`
	☑	`cfgobj`	`cfgobj`	(n/a)
	☑	`channeltype`	`channeltype`	`shell`
	☑	`connection_type`	`connection_type`	(n/a)
	☑	`countapp`	`countapp`	`1`
	☑	`crlevel`	`crlevel`	`critical`
	☑	`desc`	`desc`	(n/a)
	☑	`detectionmethod`	`detectionmethod`	(n/a)
	☑	`devid`	`devid`	`FGVM02Q105060010`
	☑	`devtype`	`devtype`	`Linux PC`
	☑	`dir`	`dir`	(n/a)
	☑	`direction`	`direction`	`incoming`
	☑	`dlpextra`	`dlpextra`	(n/a)
	☑	`dstcountry`	`dstcountry`	`Canada`
	☑	`dstintf`	`dstintf`	`port11`
	☑	`dstintfrole`	`dstintfrole`	`undefined`
	☑	`dtype`	`dtype`	`Virus`
	☑	`encryption`	`encryption`	(n/a)
	☑	`eventtype`	`eventtype`	`infected`
	☑	`filtercat`	`filtercat`	(n/a)
	☑	`filtername`	`filtername`	(n/a)
	☑	`filtertype`	`filtertype`	(n/a)
	☑	`group`	`group`	`local-group1`
	☑	`ha_role`	`ha_role`	(n/a)
	☑	`icmpcode`	`icmpcode`	(n/a)
	☑	`icmpid`	`icmpid`	(n/a)
	☑	`icmptype`	`icmptype`	(n/a)
	☑	`init`	`init`	(n/a)
	☑	`interface`	`interface`	`port10`
	☑	`level`	`level`	`notice`
	☑	`license_limit`	`license_limit`	(n/a)
	☑	`logdesc`	`logdesc`	`Routing log`
	☑	`login`	`login`	`root`
	☑	`manuf`	`manuf`	(n/a)
	☑	`mastersrcmac`	`mastersrcmac`	`a2:e9:00:ec:40:01`
	☑	`method`	`method`	`domain`
	☑	`mode`	`mode`	(n/a)
	☑	`msg`	`msg`	`OSPF: RECV[Hello]: From 31.1.1.1 via port9:172.16.200.1: Invalid Area ID 0.0.0.0`
	☑	`name`	`name`	(n/a)
	☑	`netid`	`netid`	(n/a)
	☑	`onwire`	`onwire`	(n/a)
	☑	`osname`	`osname`	`Ubuntu`
	☑	`outintf`	`outintf`	(n/a)
	☑	`policyid`	`policyid`	`1`
	☑	`poluuid`	`poluuid`	`707a0d88-c972-51e7-bbc7-4d421660557b`
	☑	`policytype`	`policytype`	`policy`
	☑	`polmode`	`polmode`	`learn`
	☑	`poluuid`	`poluuid`	`707a0d88-c972-51e7-bbc7-4d421660557b`
	☑	`profile`	`profile`	`g-default`
	☑	`proto`	`proto`	`6`
	☑	`qclass`	`qclass`	(n/a)
	☑	`qtype`	`qtype`	(n/a)
	☑	`quarskip`	`quarskip`	`File-was-not-quarantined.`
	☑	`radioband`	`radioband`	(n/a)
	☑	`rcvdbyte`	`rcvdbyte`	`39898`
	☑	`rcvdpkt`	`rcvdpkt`	`37`
	☑	`reason`	`reason`	`malformed input`
	☑	`reqtype`	`reqtype`	`direct`
	☑	`result`	`result`	(n/a)
	☑	`role`	`role`	(n/a)
	☑	`security`	`security`	(n/a)
	☑	`service`	`service`	`HTTP`
	☑	`sentbyte`	`sentbyte`	`1850`
	☑	`sentpkt`	`sentpkt`	`25`
	☑	`sessionid`	`sessionid`	`8058`
	☑	`severity`	`fortigate_severity`	(n/a)
	☑	`sndetected`	`sndetected`	(n/a)
	☑	`srccountry`	`srccountry`	`Reserved`
	☑	`srcintf`	`srcintf`	`port12`
	☑	`srcintfrole`	`srcintfrole`	`undefined`
	☑	`srcmac`	`srcmac`	`a2:e9:00:ec:40:01`
	☑	`srcname`	`srcname`	`pc1`
	☑	`srcserver`	`srcserver`	`0`
	☑	`service`	`service`	`HTTPS`
	☑	`ssid`	`ssid`	(n/a)
	☑	`stamac`	`stamac`	(n/a)
	☑	`status`	`status`	`success`
	☑	`subtype`	`subtype`	`forward`
	☑	`trandisp`	`trandisp`	`snat`
	☑	`transip`	`transip`	`172.16.200.2`
	☑	`transport`	`trandisp`	`40772`
	☑	`type`	`fortigate_type`	`traffic`
	☑	`ui`	`ui`	(n/a)
	☑	`user`	`user`	`bob`
	☑	`utmaction`	`utmaction`	`allow`
	☑	`utmref`	`utmref`	`0`-`220586`
	☑	`vcluster_state`	`vcluster_state`	(n/a)
	☑	`vd`	`vd`	`vdom1`
	☑	`virus`	`virus`	`EICAR_TEST_FILE`
	☑	`vpntunnel`	`vpntunnel`	(n/a)
	☑	`xauthgroup`	`xauthgroup`	(n/a)
	☑	`xauthuser`	`xauthuser`	(n/a)

High-Cardinality (HC) Tags

SrcIP
DstIP

Example Logs

Block SSL Traffic

action="blocked" dstintf="unknown-0" dstintfrole="undefined"
dstip="172.16.200.99" dstport="8080" eventtype="ssl-anomalies"
level="warning" logid="1700062053" msg="Connection is blocked due
to unsupported SSL traffic" policyid="1"
profile="block-unsupported-ssl" proto="6" reason="malformed input"
service="SMTPS" sessionid="11424" srcintf="port2"
srcintfrole="undefined" srcip="10.1.100.66" srcport="41296"
subtype="ssl" type="utm" vd="vdom1"

Successful Authentication

date=2019-05-13 time=15:55:56 logid="0102043008" type="event"
subtype="user" level="notice" vd="root" eventtime=1557788156913809277
logdesc="Authentication success" srcip=10.1.100.11 dstip=172.16.200.55
policyid=1 interface="port10" user="bob" group="local-group1"
authproto="TELNET(10.1.100.11)" action="authentication"
status="success" reason="N/A" msg="User bob succeeded in
authentication"

Web Access Denied

date=2019-05-13 time=16:29:45 logid="0316013056" type="utm"
subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="vdom1"
eventtime=1557790184975119738 policyid=1 sessionid=381780
srcip=10.1.100.11 srcport=44258 srcintf="port12"
srcintfrole="undefined" dstip=185.244.31.158 dstport=80
dstintf="port11" dstintfrole="undefined" proto=6 service="HTTP"
hostname="morrishittu.ddns.net" profile="test-webfilter"
action="blocked" reqtype="direct" url="/" sentbyte=84 rcvdbyte=0
direction="outgoing" msg="URL belongs to a denied category in policy"
method="domain" cat=26 catdesc="Malicious Websites" crscore=30
craction=4194304 crlevel="high"

Fortigate Configuration

Fortigate should be configured as follows - Note that Local Traffic Log must be enabled.