Fortinet fields
editFortinet fields
editfortinet Module
fortinet
editFields from fortinet FortiOS
-
fortinet.file.hash.crc32
-
CRC32 Hash of file
type: keyword
firewall
editModule for parsing Fortinet syslog.
-
fortinet.firewall.acct_stat
-
Accounting state (RADIUS)
type: keyword
-
fortinet.firewall.acktime
-
Alarm Acknowledge Time
type: keyword
-
fortinet.firewall.act
-
Action
type: keyword
-
fortinet.firewall.action
-
Status of the session
type: keyword
-
fortinet.firewall.activity
-
HA activity message
type: keyword
-
fortinet.firewall.addr
-
IP Address
type: ip
-
fortinet.firewall.addr_type
-
Address Type
type: keyword
-
fortinet.firewall.addrgrp
-
Address Group
type: keyword
-
fortinet.firewall.adgroup
-
AD Group Name
type: keyword
-
fortinet.firewall.admin
-
Admin User
type: keyword
-
fortinet.firewall.age
-
Time in seconds - time passed since last seen
type: integer
-
fortinet.firewall.agent
-
User agent - eg. agent="Mozilla/5.0"
type: keyword
-
fortinet.firewall.alarmid
-
Alarm ID
type: integer
-
fortinet.firewall.alert
-
Alert
type: keyword
-
fortinet.firewall.analyticscksum
-
The checksum of the file submitted for analytics
type: keyword
-
fortinet.firewall.analyticssubmit
-
The flag for analytics submission
type: keyword
-
fortinet.firewall.ap
-
Access Point
type: keyword
-
fortinet.firewall.app-type
-
Address Type
type: keyword
-
fortinet.firewall.appact
-
The security action from app control
type: keyword
-
fortinet.firewall.appid
-
Application ID
type: integer
-
fortinet.firewall.applist
-
Application Control profile
type: keyword
-
fortinet.firewall.apprisk
-
Application Risk Level
type: keyword
-
fortinet.firewall.apscan
-
The name of the AP, which scanned and detected the rogue AP
type: keyword
-
fortinet.firewall.apsn
-
Access Point
type: keyword
-
fortinet.firewall.apstatus
-
Access Point status
type: keyword
-
fortinet.firewall.aptype
-
Access Point type
type: keyword
-
fortinet.firewall.assigned
-
Assigned IP Address
type: ip
-
fortinet.firewall.assignip
-
Assigned IP Address
type: ip
-
fortinet.firewall.attachment
-
The flag for email attachement
type: keyword
-
fortinet.firewall.attack
-
Attack Name
type: keyword
-
fortinet.firewall.attackcontext
-
The trigger patterns and the packetdata with base64 encoding
type: keyword
-
fortinet.firewall.attackcontextid
-
Attack context id / total
type: keyword
-
fortinet.firewall.attackid
-
Attack ID
type: integer
-
fortinet.firewall.auditid
-
Audit ID
type: long
-
fortinet.firewall.auditscore
-
The Audit Score
type: keyword
-
fortinet.firewall.audittime
-
The time of the audit
type: long
-
fortinet.firewall.authgrp
-
Authorization Group
type: keyword
-
fortinet.firewall.authid
-
Authentication ID
type: keyword
-
fortinet.firewall.authproto
-
The protocol that initiated the authentication
type: keyword
-
fortinet.firewall.authserver
-
Authentication server
type: keyword
-
fortinet.firewall.bandwidth
-
Bandwidth
type: keyword
-
fortinet.firewall.banned_rule
-
NAC quarantine Banned Rule Name
type: keyword
-
fortinet.firewall.banned_src
-
NAC quarantine Banned Source IP
type: keyword
-
fortinet.firewall.banword
-
Banned word
type: keyword
-
fortinet.firewall.botnetdomain
-
Botnet Domain Name
type: keyword
-
fortinet.firewall.botnetip
-
Botnet IP Address
type: ip
-
fortinet.firewall.bssid
-
Service Set ID
type: keyword
-
fortinet.firewall.call_id
-
Caller ID
type: keyword
-
fortinet.firewall.carrier_ep
-
The FortiOS Carrier end-point identification
type: keyword
-
fortinet.firewall.cat
-
DNS category ID
type: integer
-
fortinet.firewall.category
-
Authentication category
type: keyword
-
fortinet.firewall.cc
-
CC Email Address
type: keyword
-
fortinet.firewall.cdrcontent
-
Cdrcontent
type: keyword
-
fortinet.firewall.centralnatid
-
Central NAT ID
type: integer
-
fortinet.firewall.cert
-
Certificate
type: keyword
-
fortinet.firewall.cert-type
-
Certificate type
type: keyword
-
fortinet.firewall.certhash
-
Certificate hash
type: keyword
-
fortinet.firewall.cfgattr
-
Configuration attribute
type: keyword
-
fortinet.firewall.cfgobj
-
Configuration object
type: keyword
-
fortinet.firewall.cfgpath
-
Configuration path
type: keyword
-
fortinet.firewall.cfgtid
-
Configuration transaction ID
type: keyword
-
fortinet.firewall.cfgtxpower
-
Configuration TX power
type: integer
-
fortinet.firewall.channel
-
Wireless Channel
type: integer
-
fortinet.firewall.channeltype
-
SSH channel type
type: keyword
-
fortinet.firewall.chassisid
-
Chassis ID
type: integer
-
fortinet.firewall.checksum
-
The checksum of the scanned file
type: keyword
-
fortinet.firewall.chgheaders
-
HTTP Headers
type: keyword
-
fortinet.firewall.cldobjid
-
Connector object ID
type: keyword
-
fortinet.firewall.client_addr
-
Wifi client address
type: keyword
-
fortinet.firewall.cloudaction
-
Cloud Action
type: keyword
-
fortinet.firewall.clouduser
-
Cloud User
type: keyword
-
fortinet.firewall.column
-
VOIP Column
type: integer
-
fortinet.firewall.command
-
CLI Command
type: keyword
-
fortinet.firewall.community
-
SNMP Community
type: keyword
-
fortinet.firewall.configcountry
-
Configuration country
type: keyword
-
fortinet.firewall.connection_type
-
FortiClient Connection Type
type: keyword
-
fortinet.firewall.conserve
-
Flag for conserve mode
type: keyword
-
fortinet.firewall.constraint
-
WAF http protocol restrictions
type: keyword
-
fortinet.firewall.contentdisarmed
-
Email scanned content
type: keyword
-
fortinet.firewall.contenttype
-
Content Type from HTTP header
type: keyword
-
fortinet.firewall.cookies
-
VPN Cookie
type: keyword
-
fortinet.firewall.count
-
Counts of action type
type: integer
-
fortinet.firewall.countapp
-
Number of App Ctrl logs associated with the session
type: integer
-
fortinet.firewall.countav
-
Number of AV logs associated with the session
type: integer
-
fortinet.firewall.countcifs
-
Number of CIFS logs associated with the session
type: integer
-
fortinet.firewall.countdlp
-
Number of DLP logs associated with the session
type: integer
-
fortinet.firewall.countdns
-
Number of DNS logs associated with the session
type: integer
-
fortinet.firewall.countemail
-
Number of email logs associated with the session
type: integer
-
fortinet.firewall.countff
-
Number of ff logs associated with the session
type: integer
-
fortinet.firewall.countips
-
Number of IPS logs associated with the session
type: integer
-
fortinet.firewall.countssh
-
Number of SSH logs associated with the session
type: integer
-
fortinet.firewall.countssl
-
Number of SSL logs associated with the session
type: integer
-
fortinet.firewall.countwaf
-
Number of WAF logs associated with the session
type: integer
-
fortinet.firewall.countweb
-
Number of Web filter logs associated with the session
type: integer
-
fortinet.firewall.cpu
-
CPU Usage
type: integer
-
fortinet.firewall.craction
-
Client Reputation Action
type: integer
-
fortinet.firewall.criticalcount
-
Number of critical ratings
type: integer
-
fortinet.firewall.crl
-
Client Reputation Level
type: keyword
-
fortinet.firewall.crlevel
-
Client Reputation Level
type: keyword
-
fortinet.firewall.crscore
-
Some description
type: integer
-
fortinet.firewall.cveid
-
CVE ID
type: keyword
-
fortinet.firewall.daemon
-
Daemon name
type: keyword
-
fortinet.firewall.datarange
-
Data range for reports
type: keyword
-
fortinet.firewall.date
-
Date
type: keyword
-
fortinet.firewall.ddnsserver
-
DDNS server
type: ip
-
fortinet.firewall.desc
-
Description
type: keyword
-
fortinet.firewall.detectionmethod
-
Detection method
type: keyword
-
fortinet.firewall.devcategory
-
Device category
type: keyword
-
fortinet.firewall.devintfname
-
HA device Interface Name
type: keyword
-
fortinet.firewall.devtype
-
Device type
type: keyword
-
fortinet.firewall.dhcp_msg
-
DHCP Message
type: keyword
-
fortinet.firewall.dintf
-
Destination interface
type: keyword
-
fortinet.firewall.disk
-
Assosciated disk
type: keyword
-
fortinet.firewall.disklograte
-
Disk logging rate
type: long
-
fortinet.firewall.dlpextra
-
DLP extra information
type: keyword
-
fortinet.firewall.docsource
-
DLP fingerprint document source
type: keyword
-
fortinet.firewall.domainctrlauthstate
-
CIFS domain auth state
type: integer
-
fortinet.firewall.domainctrlauthtype
-
CIFS domain auth type
type: integer
-
fortinet.firewall.domainctrldomain
-
CIFS domain auth domain
type: keyword
-
fortinet.firewall.domainctrlip
-
CIFS Domain IP
type: ip
-
fortinet.firewall.domainctrlname
-
CIFS Domain name
type: keyword
-
fortinet.firewall.domainctrlprotocoltype
-
CIFS Domain connection protocol
type: integer
-
fortinet.firewall.domainctrlusername
-
CIFS Domain username
type: keyword
-
fortinet.firewall.domainfilteridx
-
Domain filter ID
type: integer
-
fortinet.firewall.domainfilterlist
-
Domain filter name
type: keyword
-
fortinet.firewall.ds
-
Direction with distribution system
type: keyword
-
fortinet.firewall.dst_int
-
Destination interface
type: keyword
-
fortinet.firewall.dstintfrole
-
Destination interface role
type: keyword
-
fortinet.firewall.dstcountry
-
Destination country
type: keyword
-
fortinet.firewall.dstdevcategory
-
Destination device category
type: keyword
-
fortinet.firewall.dstdevtype
-
Destination device type
type: keyword
-
fortinet.firewall.dstfamily
-
Destination OS family
type: keyword
-
fortinet.firewall.dsthwvendor
-
Destination HW vendor
type: keyword
-
fortinet.firewall.dsthwversion
-
Destination HW version
type: keyword
-
fortinet.firewall.dstinetsvc
-
Destination interface service
type: keyword
-
fortinet.firewall.dstosname
-
Destination OS name
type: keyword
-
fortinet.firewall.dstosversion
-
Destination OS version
type: keyword
-
fortinet.firewall.dstserver
-
Destination server
type: integer
-
fortinet.firewall.dstssid
-
Destination SSID
type: keyword
-
fortinet.firewall.dstswversion
-
Destination software version
type: keyword
-
fortinet.firewall.dstunauthusersource
-
Destination unauthenticated source
type: keyword
-
fortinet.firewall.dstuuid
-
UUID of the Destination IP address
type: keyword
-
fortinet.firewall.duid
-
DHCP UID
type: keyword
-
fortinet.firewall.eapolcnt
-
EAPOL packet count
type: integer
-
fortinet.firewall.eapoltype
-
EAPOL packet type
type: keyword
-
fortinet.firewall.encrypt
-
Whether the packet is encrypted or not
type: integer
-
fortinet.firewall.encryption
-
Encryption method
type: keyword
-
fortinet.firewall.epoch
-
Epoch used for locating file
type: integer
-
fortinet.firewall.espauth
-
ESP Authentication
type: keyword
-
fortinet.firewall.esptransform
-
ESP Transform
type: keyword
-
fortinet.firewall.exch
-
Mail Exchanges from DNS response answer section
type: keyword
-
fortinet.firewall.exchange
-
Mail Exchanges from DNS response answer section
type: keyword
-
fortinet.firewall.expectedsignature
-
Expected SSL signature
type: keyword
-
fortinet.firewall.expiry
-
FortiGuard override expiry timestamp
type: keyword
-
fortinet.firewall.fams_pause
-
Fortinet Analysis and Management Service Pause
type: integer
-
fortinet.firewall.fazlograte
-
FortiAnalyzer Logging Rate
type: long
-
fortinet.firewall.fctemssn
-
FortiClient Endpoint SSN
type: keyword
-
fortinet.firewall.fctuid
-
FortiClient UID
type: keyword
-
fortinet.firewall.field
-
NTP status field
type: keyword
-
fortinet.firewall.filefilter
-
The filter used to identify the affected file
type: keyword
-
fortinet.firewall.filehashsrc
-
Filehash source
type: keyword
-
fortinet.firewall.filtercat
-
DLP filter category
type: keyword
-
fortinet.firewall.filteridx
-
DLP filter ID
type: integer
-
fortinet.firewall.filtername
-
DLP rule name
type: keyword
-
fortinet.firewall.filtertype
-
DLP filter type
type: keyword
-
fortinet.firewall.fortiguardresp
-
Antispam ESP value
type: keyword
-
fortinet.firewall.forwardedfor
-
Email address forwarded
type: keyword
-
fortinet.firewall.fqdn
-
FQDN
type: keyword
-
fortinet.firewall.frametype
-
Wireless frametype
type: keyword
-
fortinet.firewall.freediskstorage
-
Free disk integer
type: integer
-
fortinet.firewall.from
-
From email address
type: keyword
-
fortinet.firewall.from_vcluster
-
Source virtual cluster number
type: integer
-
fortinet.firewall.fsaverdict
-
FSA verdict
type: keyword
-
fortinet.firewall.fwserver_name
-
Web proxy server name
type: keyword
-
fortinet.firewall.gateway
-
Gateway ip address for PPPoE status report
type: ip
-
fortinet.firewall.green
-
Memory status
type: keyword
-
fortinet.firewall.groupid
-
User Group ID
type: integer
-
fortinet.firewall.ha-prio
-
HA Priority
type: integer
-
fortinet.firewall.ha_group
-
HA Group
type: keyword
-
fortinet.firewall.ha_role
-
HA Role
type: keyword
-
fortinet.firewall.handshake
-
SSL Handshake
type: keyword
-
fortinet.firewall.hash
-
Hash value of downloaded file
type: keyword
-
fortinet.firewall.hbdn_reason
-
Heartbeat down reason
type: keyword
-
fortinet.firewall.highcount
-
Highcount fabric summary
type: integer
-
fortinet.firewall.host
-
Hostname
type: keyword
-
fortinet.firewall.iaid
-
DHCPv6 id
type: keyword
-
fortinet.firewall.icmpcode
-
Destination Port of the ICMP message
type: keyword
-
fortinet.firewall.icmpid
-
Source port of the ICMP message
type: keyword
-
fortinet.firewall.icmptype
-
The type of ICMP message
type: keyword
-
fortinet.firewall.identifier
-
Network traffic identifier
type: integer
-
fortinet.firewall.in_spi
-
IPSEC inbound SPI
type: keyword
-
fortinet.firewall.incidentserialno
-
Incident serial number
type: integer
-
fortinet.firewall.infected
-
Infected MMS
type: integer
-
fortinet.firewall.infectedfilelevel
-
DLP infected file level
type: integer
-
fortinet.firewall.informationsource
-
Information source
type: keyword
-
fortinet.firewall.init
-
IPSEC init stage
type: keyword
-
fortinet.firewall.initiator
-
Original login user name for Fortiguard override
type: keyword
-
fortinet.firewall.interface
-
Related interface
type: keyword
-
fortinet.firewall.intf
-
Related interface
type: keyword
-
fortinet.firewall.invalidmac
-
The MAC address with invalid OUI
type: keyword
-
fortinet.firewall.ip
-
Related IP
type: ip
-
fortinet.firewall.iptype
-
Related IP type
type: keyword
-
fortinet.firewall.keyword
-
Keyword used for search
type: keyword
-
fortinet.firewall.kind
-
VOIP kind
type: keyword
-
fortinet.firewall.lanin
-
LAN incoming traffic in bytes
type: long
-
fortinet.firewall.lanout
-
LAN outbound traffic in bytes
type: long
-
fortinet.firewall.lease
-
DHCP lease
type: integer
-
fortinet.firewall.license_limit
-
Maximum Number of FortiClients for the License
type: keyword
-
fortinet.firewall.limit
-
Virtual Domain Resource Limit
type: integer
-
fortinet.firewall.line
-
VOIP line
type: keyword
-
fortinet.firewall.live
-
Time in seconds
type: integer
-
fortinet.firewall.local
-
Local IP for a PPPD Connection
type: ip
-
fortinet.firewall.log
-
Log message
type: keyword
-
fortinet.firewall.login
-
SSH login
type: keyword
-
fortinet.firewall.lowcount
-
Fabric lowcount
type: integer
-
fortinet.firewall.mac
-
DHCP mac address
type: keyword
-
fortinet.firewall.malform_data
-
VOIP malformed data
type: integer
-
fortinet.firewall.malform_desc
-
VOIP malformed data description
type: keyword
-
fortinet.firewall.manuf
-
Manufacturer name
type: keyword
-
fortinet.firewall.masterdstmac
-
Master mac address for a host with multiple network interfaces
type: keyword
-
fortinet.firewall.mastersrcmac
-
The master MAC address for a host that has multiple network interfaces
type: keyword
-
fortinet.firewall.mediumcount
-
Fabric medium count
type: integer
-
fortinet.firewall.mem
-
Memory usage system statistics
type: keyword
-
fortinet.firewall.meshmode
-
Wireless mesh mode
type: keyword
-
fortinet.firewall.message_type
-
VOIP message type
type: keyword
-
fortinet.firewall.method
-
HTTP method
type: keyword
-
fortinet.firewall.mgmtcnt
-
The number of unauthorized client flooding managemet frames
type: integer
-
fortinet.firewall.mode
-
IPSEC mode
type: keyword
-
fortinet.firewall.module
-
PCI-DSS module
type: keyword
-
fortinet.firewall.monitor-name
-
Health Monitor Name
type: keyword
-
fortinet.firewall.monitor-type
-
Health Monitor Type
type: keyword
-
fortinet.firewall.mpsk
-
Wireless MPSK
type: keyword
-
fortinet.firewall.msgproto
-
Message Protocol Number
type: keyword
-
fortinet.firewall.mtu
-
Max Transmission Unit Value
type: integer
-
fortinet.firewall.name
-
Name
type: keyword
-
fortinet.firewall.nat
-
NAT IP Address
type: keyword
-
fortinet.firewall.netid
-
Connector NetID
type: keyword
-
fortinet.firewall.new_status
-
New status on user change
type: keyword
-
fortinet.firewall.new_value
-
New Virtual Domain Name
type: keyword
-
fortinet.firewall.newchannel
-
New Channel Number
type: integer
-
fortinet.firewall.newchassisid
-
New Chassis ID
type: integer
-
fortinet.firewall.newslot
-
New Slot Number
type: integer
-
fortinet.firewall.nextstat
-
Time interval in seconds for the next statistics.
type: integer
-
fortinet.firewall.nf_type
-
Notification Type
type: keyword
-
fortinet.firewall.noise
-
Wifi Noise
type: integer
-
fortinet.firewall.old_status
-
Original Status
type: keyword
-
fortinet.firewall.old_value
-
Original Virtual Domain name
type: keyword
-
fortinet.firewall.oldchannel
-
Original channel
type: integer
-
fortinet.firewall.oldchassisid
-
Original Chassis Number
type: integer
-
fortinet.firewall.oldslot
-
Original Slot Number
type: integer
-
fortinet.firewall.oldsn
-
Old Serial number
type: keyword
-
fortinet.firewall.oldwprof
-
Old Web Filter Profile
type: keyword
-
fortinet.firewall.onwire
-
A flag to indicate if the AP is onwire or not
type: keyword
-
fortinet.firewall.opercountry
-
Operating Country
type: keyword
-
fortinet.firewall.opertxpower
-
Operating TX power
type: integer
-
fortinet.firewall.osname
-
Operating System name
type: keyword
-
fortinet.firewall.osversion
-
Operating System version
type: keyword
-
fortinet.firewall.out_spi
-
Out SPI
type: keyword
-
fortinet.firewall.outintf
-
Out interface
type: keyword
-
fortinet.firewall.passedcount
-
Fabric passed count
type: integer
-
fortinet.firewall.passwd
-
Changed user password information
type: keyword
-
fortinet.firewall.path
-
Path of looped configuration for security fabric
type: keyword
-
fortinet.firewall.peer
-
WAN optimization peer
type: keyword
-
fortinet.firewall.peer_notif
-
VPN peer notification
type: keyword
-
fortinet.firewall.phase2_name
-
VPN phase2 name
type: keyword
-
fortinet.firewall.phone
-
VOIP Phone
type: keyword
-
fortinet.firewall.pid
-
Process ID
type: integer
-
fortinet.firewall.policytype
-
Policy Type
type: keyword
-
fortinet.firewall.poolname
-
IP Pool name
type: keyword
-
fortinet.firewall.port
-
Log upload error port
type: integer
-
fortinet.firewall.portbegin
-
IP Pool port number to begin
type: integer
-
fortinet.firewall.portend
-
IP Pool port number to end
type: integer
-
fortinet.firewall.probeproto
-
Link Monitor Probe Protocol
type: keyword
-
fortinet.firewall.process
-
URL Filter process
type: keyword
-
fortinet.firewall.processtime
-
Process time for reports
type: integer
-
fortinet.firewall.profile
-
Profile Name
type: keyword
-
fortinet.firewall.profile_vd
-
Virtual Domain Name
type: keyword
-
fortinet.firewall.profilegroup
-
Profile Group Name
type: keyword
-
fortinet.firewall.profiletype
-
Profile Type
type: keyword
-
fortinet.firewall.qtypeval
-
DNS question type value
type: integer
-
fortinet.firewall.quarskip
-
Quarantine skip explanation
type: keyword
-
fortinet.firewall.quotaexceeded
-
If quota has been exceeded
type: keyword
-
fortinet.firewall.quotamax
-
Maximum quota allowed - in seconds if time-based - in bytes if traffic-based
type: long
-
fortinet.firewall.quotatype
-
Quota type
type: keyword
-
fortinet.firewall.quotaused
-
Quota used - in seconds if time-based - in bytes if trafficbased)
type: long
-
fortinet.firewall.radioband
-
Radio band
type: keyword
-
fortinet.firewall.radioid
-
Radio ID
type: integer
-
fortinet.firewall.radioidclosest
-
Radio ID on the AP closest the rogue AP
type: integer
-
fortinet.firewall.radioiddetected
-
Radio ID on the AP which detected the rogue AP
type: integer
-
fortinet.firewall.rate
-
Wireless rogue rate value
type: keyword
-
fortinet.firewall.rawdata
-
Raw data value
type: keyword
-
fortinet.firewall.rawdataid
-
Raw data ID
type: keyword
-
fortinet.firewall.rcvddelta
-
Received bytes delta
type: keyword
-
fortinet.firewall.reason
-
Alert reason
type: keyword
-
fortinet.firewall.received
-
Server key exchange received
type: integer
-
fortinet.firewall.receivedsignature
-
Server key exchange received signature
type: keyword
-
fortinet.firewall.red
-
Memory information in red
type: keyword
-
fortinet.firewall.referralurl
-
Web filter referralurl
type: keyword
-
fortinet.firewall.remote
-
Remote PPP IP address
type: ip
-
fortinet.firewall.remotewtptime
-
Remote Wifi Radius authentication time
type: keyword
-
fortinet.firewall.reporttype
-
Report type
type: keyword
-
fortinet.firewall.reqtype
-
Request type
type: keyword
-
fortinet.firewall.request_name
-
VOIP request name
type: keyword
-
fortinet.firewall.result
-
VPN phase result
type: keyword
-
fortinet.firewall.role
-
VPN Phase 2 role
type: keyword
-
fortinet.firewall.rssi
-
Received signal strength indicator
type: integer
-
fortinet.firewall.rsso_key
-
RADIUS SSO attribute value
type: keyword
-
fortinet.firewall.ruledata
-
Rule data
type: keyword
-
fortinet.firewall.ruletype
-
Rule type
type: keyword
-
fortinet.firewall.scanned
-
Number of Scanned MMSs
type: integer
-
fortinet.firewall.scantime
-
Scanned time
type: long
-
fortinet.firewall.scope
-
FortiGuard Override Scope
type: keyword
-
fortinet.firewall.security
-
Wireless rogue security
type: keyword
-
fortinet.firewall.sensitivity
-
Sensitivity for document fingerprint
type: keyword
-
fortinet.firewall.sensor
-
NAC Sensor Name
type: keyword
-
fortinet.firewall.sentdelta
-
Sent bytes delta
type: keyword
-
fortinet.firewall.seq
-
Sequence number
type: keyword
-
fortinet.firewall.serial
-
WAN optimisation serial
type: keyword
-
fortinet.firewall.serialno
-
Serial number
type: keyword
-
fortinet.firewall.server
-
AD server FQDN or IP
type: keyword
-
fortinet.firewall.session_id
-
Session ID
type: keyword
-
fortinet.firewall.sessionid
-
WAD Session ID
type: integer
-
fortinet.firewall.setuprate
-
Session Setup Rate
type: long
-
fortinet.firewall.severity
-
Severity
type: keyword
-
fortinet.firewall.shaperdroprcvdbyte
-
Received bytes dropped by shaper
type: integer
-
fortinet.firewall.shaperdropsentbyte
-
Sent bytes dropped by shaper
type: integer
-
fortinet.firewall.shaperperipdropbyte
-
Dropped bytes per IP by shaper
type: integer
-
fortinet.firewall.shaperperipname
-
Traffic shaper name (per IP)
type: keyword
-
fortinet.firewall.shaperrcvdname
-
Traffic shaper name for received traffic
type: keyword
-
fortinet.firewall.shapersentname
-
Traffic shaper name for sent traffic
type: keyword
-
fortinet.firewall.shapingpolicyid
-
Traffic shaper policy ID
type: integer
-
fortinet.firewall.signal
-
Wireless rogue API signal
type: integer
-
fortinet.firewall.size
-
Email size in bytes
type: long
-
fortinet.firewall.slot
-
Slot number
type: integer
-
fortinet.firewall.sn
-
Security fabric serial number
type: keyword
-
fortinet.firewall.snclosest
-
SN of the AP closest to the rogue AP
type: keyword
-
fortinet.firewall.sndetected
-
SN of the AP which detected the rogue AP
type: keyword
-
fortinet.firewall.snmeshparent
-
SN of the mesh parent
type: keyword
-
fortinet.firewall.spi
-
IPSEC SPI
type: keyword
-
fortinet.firewall.src_int
-
Source interface
type: keyword
-
fortinet.firewall.srcintfrole
-
Source interface role
type: keyword
-
fortinet.firewall.srccountry
-
Source country
type: keyword
-
fortinet.firewall.srcfamily
-
Source family
type: keyword
-
fortinet.firewall.srchwvendor
-
Source hardware vendor
type: keyword
-
fortinet.firewall.srchwversion
-
Source hardware version
type: keyword
-
fortinet.firewall.srcinetsvc
-
Source interface service
type: keyword
-
fortinet.firewall.srcname
-
Source name
type: keyword
-
fortinet.firewall.srcserver
-
Source server
type: integer
-
fortinet.firewall.srcssid
-
Source SSID
type: keyword
-
fortinet.firewall.srcswversion
-
Source software version
type: keyword
-
fortinet.firewall.srcuuid
-
Source UUID
type: keyword
-
fortinet.firewall.sscname
-
SSC name
type: keyword
-
fortinet.firewall.ssid
-
Base Service Set ID
type: keyword
-
fortinet.firewall.sslaction
-
SSL Action
type: keyword
-
fortinet.firewall.ssllocal
-
WAD SSL local
type: keyword
-
fortinet.firewall.sslremote
-
WAD SSL remote
type: keyword
-
fortinet.firewall.stacount
-
Number of stations/clients
type: integer
-
fortinet.firewall.stage
-
IPSEC stage
type: keyword
-
fortinet.firewall.stamac
-
802.1x station mac
type: keyword
-
fortinet.firewall.state
-
Admin login state
type: keyword
-
fortinet.firewall.status
-
Status
type: keyword
-
fortinet.firewall.stitch
-
Automation stitch triggered
type: keyword
-
fortinet.firewall.subject
-
Email subject
type: keyword
-
fortinet.firewall.submodule
-
Configuration Sub-Module Name
type: keyword
-
fortinet.firewall.subservice
-
AV subservice
type: keyword
-
fortinet.firewall.subtype
-
Log subtype
type: keyword
-
fortinet.firewall.suspicious
-
Number of Suspicious MMSs
type: integer
-
fortinet.firewall.switchproto
-
Protocol change information
type: keyword
-
fortinet.firewall.sync_status
-
The sync status with the master
type: keyword
-
fortinet.firewall.sync_type
-
The sync type with the master
type: keyword
-
fortinet.firewall.sysuptime
-
System uptime
type: keyword
-
fortinet.firewall.tamac
-
the MAC address of Transmitter, if none, then Receiver
type: keyword
-
fortinet.firewall.threattype
-
WIDS threat type
type: keyword
-
fortinet.firewall.time
-
Time of the event
type: keyword
-
fortinet.firewall.to
-
Email to field
type: keyword
-
fortinet.firewall.to_vcluster
-
destination virtual cluster number
type: integer
-
fortinet.firewall.total
-
Total memory
type: integer
-
fortinet.firewall.totalsession
-
Total Number of Sessions
type: integer
-
fortinet.firewall.trace_id
-
Session clash trace ID
type: keyword
-
fortinet.firewall.trandisp
-
NAT translation type
type: keyword
-
fortinet.firewall.transid
-
HTTP transaction ID
type: integer
-
fortinet.firewall.translationid
-
DNS filter transaltion ID
type: keyword
-
fortinet.firewall.trigger
-
Automation stitch trigger
type: keyword
-
fortinet.firewall.trueclntip
-
File filter true client IP
type: ip
-
fortinet.firewall.tunnelid
-
IPSEC tunnel ID
type: integer
-
fortinet.firewall.tunnelip
-
IPSEC tunnel IP
type: ip
-
fortinet.firewall.tunneltype
-
IPSEC tunnel type
type: keyword
-
fortinet.firewall.type
-
Module type
type: keyword
-
fortinet.firewall.ui
-
Admin authentication UI type
type: keyword
-
fortinet.firewall.unauthusersource
-
Unauthenticated user source
type: keyword
-
fortinet.firewall.unit
-
Power supply unit
type: integer
-
fortinet.firewall.urlfilteridx
-
URL filter ID
type: integer
-
fortinet.firewall.urlfilterlist
-
URL filter list
type: keyword
-
fortinet.firewall.urlsource
-
URL filter source
type: keyword
-
fortinet.firewall.urltype
-
URL filter type
type: keyword
-
fortinet.firewall.used
-
Number of Used IPs
type: integer
-
fortinet.firewall.used_for_type
-
Connection for the type
type: integer
-
fortinet.firewall.utmaction
-
Security action performed by UTM
type: keyword
-
fortinet.firewall.vap
-
Virtual AP
type: keyword
-
fortinet.firewall.vapmode
-
Virtual AP mode
type: keyword
-
fortinet.firewall.vcluster
-
virtual cluster id
type: integer
-
fortinet.firewall.vcluster_member
-
Virtual cluster member
type: integer
-
fortinet.firewall.vcluster_state
-
Virtual cluster state
type: keyword
-
fortinet.firewall.vd
-
Virtual Domain Name
type: keyword
-
fortinet.firewall.vdname
-
Virtual Domain Name
type: keyword
-
fortinet.firewall.vendorurl
-
Vulnerability scan vendor name
type: keyword
-
fortinet.firewall.version
-
Version
type: keyword
-
fortinet.firewall.vip
-
Virtual IP
type: keyword
-
fortinet.firewall.virus
-
Virus name
type: keyword
-
fortinet.firewall.virusid
-
Virus ID (unique virus identifier)
type: integer
-
fortinet.firewall.voip_proto
-
VOIP protocol
type: keyword
-
fortinet.firewall.vpn
-
VPN description
type: keyword
-
fortinet.firewall.vpntunnel
-
IPsec Vpn Tunnel Name
type: keyword
-
fortinet.firewall.vpntype
-
The type of the VPN tunnel
type: keyword
-
fortinet.firewall.vrf
-
VRF number
type: integer
-
fortinet.firewall.vulncat
-
Vulnerability Category
type: keyword
-
fortinet.firewall.vulnid
-
Vulnerability ID
type: integer
-
fortinet.firewall.vulnname
-
Vulnerability name
type: keyword
-
fortinet.firewall.vwlid
-
VWL ID
type: integer
-
fortinet.firewall.vwlquality
-
VWL quality
type: keyword
-
fortinet.firewall.vwlservice
-
VWL service
type: keyword
-
fortinet.firewall.vwpvlanid
-
VWP VLAN ID
type: integer
-
fortinet.firewall.wanin
-
WAN incoming traffic in bytes
type: long
-
fortinet.firewall.wanoptapptype
-
WAN Optimization Application type
type: keyword
-
fortinet.firewall.wanout
-
WAN outgoing traffic in bytes
type: long
-
fortinet.firewall.weakwepiv
-
Weak Wep Initiation Vector
type: keyword
-
fortinet.firewall.xauthgroup
-
XAuth Group Name
type: keyword
-
fortinet.firewall.xauthuser
-
XAuth User Name
type: keyword
-
fortinet.firewall.xid
-
Wireless X ID
type: integer