Technical Tip: FortiOS to CEF log field mapping guidelines
Description
This article shows the FortiOS to CEF log field mapping guidelines.
Scope
For version 6.4.2.
Solution
Following are the CEF priority levels.
Thereare opposite of FortiOS priority levels.
The following CEF format:
The Name field in CEF uses the following formula:
Any fields in FortiOS logs that are unmatched to fields in CEF include the FTNTFGT prefix.
Quotes ("") are removed from FortiOS logs to support CEF.
Forward slashes (//) in string values as well as the equal sign (=) and backward slashes (\) are escaped in FortiOS logs to support CEF.
This article shows the FortiOS to CEF log field mapping guidelines.
Scope
For version 6.4.2.
Solution
Following are the CEF priority levels.
Thereare opposite of FortiOS priority levels.
The following CEF format:
Date/Time host CEF:Version|Device Vendor|Device Product|DeviceDisplays as following in FortiOS logs with CEF enabled:
Version|Signature ID|Name|Severity|[Extension]
"MMM dd HH:mm:ss" "hostname of the fortigate" CEF:0|Fortinet|Fortigate|version|logid|type:subtype +[eventtype] +[action] +[status]|reversed level|...The SignatureId field in FortiOS logs maps to the logid field in CEF and have to be last 5 digits of logid.
The Name field in CEF uses the following formula:
type:subtype + [eventtype] + [action] + [status]Following is an example of the header and one key-value pair for extension from the Event VPN log in CEF:
#Feb 12 10:31:04 syslog-800c CEF:0|Fortinet|Fortigate|v5.6.0|37127|event:vpn negotiateThe type:subtype field in FortiOS logs maps to the cat field in CEF.
success|3|FTNTFGTlogid=0101037127
Any fields in FortiOS logs that are unmatched to fields in CEF include the FTNTFGT prefix.
Quotes ("") are removed from FortiOS logs to support CEF.
Forward slashes (//) in string values as well as the equal sign (=) and backward slashes (\) are escaped in FortiOS logs to support CEF.