Technical Tip: How to configure an Event Handler with a generic text filter

Description

FortiAnalyzer v7.4.x and v7.6.x.

Solution

• Go to Log View and select the log type/category.
• Filter the required logs, which should be triggering the handler.
• On the top-right, select More -> Raw Log.
  
  

   

• Once the raw logs are displayed, it is possible to choose a log record and copy from it the string wanted to match in the handler.

• Go to Incidents & Events -> Event Handlers -> (in v.7.4 select the handler type) -> +Create New.
• There are two types of Event Handlers:
  • The correlation type generates an event when multiple rules are met in a specific correlation sequence.
  • The basic handler uses simple OR logic when multiple rules are defined.
  • Both types have the same set of base settings, data selectors, and notification options, and both use Rules to define the granular conditions.
  • Depending on the handler type, the location of the Rules is slightly different:

• Add a new rule, give it an appropriate name, and select the device and log types that the event handler should monitor.
• Under the Log Filters, select the condition as 'Any of the Following Conditions' and delete the default filter.
• In the box 'Log Filter by Text', add the string that should trigger the handler. This can be a simple string copied from the raw log, as mentioned above, or a Glibc POSIX Regex pattern.

The example below uses a simple string copied from the raw log. For details on the Regex syntax, see this article: Technical Tip: Use of Operators in Event Handler General Filter (syntax).

• When done, select OK to save the rule.
• Back in the handler settings, select/create a Notification profile to receive an alert when the handler is triggered.

Related article:

Technical Tip: Use of Operators in Event Handler General Filter (syntax)